Repository: horsicq/Detect-It-Easy
Branch: master
Commit: fb1ac1bf288e
Files: 4373
Total size: 10.2 MB

Directory structure:
gitextract_07avny1o/

├── .gitattributes
├── .github/
│   ├── FUNDING.yml
│   └── workflows/
│       ├── create_beta.yml
│       ├── format-js.yml
│       └── update_db.yml
├── .gitignore
├── .prettierrc
├── CONTRIBUTING.md
├── Dockerfile
├── LICENSE
├── README.md
├── autotools/
│   ├── dbcompiler/
│   │   ├── package.json
│   │   ├── task.js
│   │   └── worker.js
│   ├── dbupdater/
│   │   └── task.py
│   └── partner/
│       └── CONFIG
├── changelog.txt
├── db/
│   ├── .vscode/
│   │   ├── about.txt
│   │   └── settings.json
│   ├── ACE
│   ├── APK/
│   │   ├── _APK.0.sg
│   │   ├── _init
│   │   ├── library_IL2CPP.4.sg
│   │   ├── library_SandHook.4.sg
│   │   ├── library_UnicomSDK.4.sg
│   │   ├── library_Unity.4.sg
│   │   ├── package_PackageName.1.sg
│   │   ├── packer_Kony.2.sg
│   │   ├── protector_APKProtect.2.sg
│   │   ├── protector_APKProtector.2.sg
│   │   ├── protector_AlibabaProtection.2.sg
│   │   ├── protector_AndroidRepublic.2.sg
│   │   ├── protector_AppGuard.2.sg
│   │   ├── protector_AppSolid.2.sg
│   │   ├── protector_BaiduProtection.2.sg
│   │   ├── protector_BangBangReinforcement.2.sg
│   │   ├── protector_BangcleProtection.2.sg
│   │   ├── protector_DXShield.2.sg
│   │   ├── protector_DexProtector.2.sg
│   │   ├── protector_DingXiangReinforcement.2.sg
│   │   ├── protector_EasyShield.2.sg
│   │   ├── protector_ExTrus_AppDefence.2.sg
│   │   ├── protector_Gemalto.2.sg
│   │   ├── protector_Hdus-Wjus.2.sg
│   │   ├── protector_Ijiami.2.sg
│   │   ├── protector_Jiagu.2.sg
│   │   ├── protector_Kiro.2.sg
│   │   ├── protector_Kiwi.2.sg
│   │   ├── protector_LIAPP.2.sg
│   │   ├── protector_MedusaH.2.sg
│   │   ├── protector_MobileTencentProtect.2.sg
│   │   ├── protector_NQShield.2.sg
│   │   ├── protector_NagaPTProtection.2.sg
│   │   ├── protector_OLLVM-TTL.2.sg
│   │   ├── protector_Obfuscapk.2.sg
│   │   ├── protector_PangXie.2.sg
│   │   ├── protector_ProGuard.2.sg
│   │   ├── protector_QDBH.2.sg
│   │   ├── protector_Qihoo360Protection.2.sg
│   │   ├── protector_SecNeo.2.sg
│   │   ├── protector_SecShell.2.sg
│   │   ├── protector_TencentLegu.2.sg
│   │   ├── protector_TencentProtection.2.sg
│   │   ├── protector_TencentSecurity.2.sg
│   │   ├── protector_TongfuShield.2.sg
│   │   ├── protector_VDog.2.sg
│   │   ├── protector_Virbox.2.sg
│   │   ├── protector_Yidun.2.sg
│   │   ├── protector_build38.2.sg
│   │   ├── protector_iCrypt.2.sg
│   │   ├── tool_ApktoolPlus.6.sg
│   │   └── tool_SingleJar.3.sg
│   ├── Amiga/
│   │   ├── AMOS_Basic.4.sg
│   │   ├── AMOS_Compiler_Cruncher.1.sg
│   │   ├── Absoft_AC_Basic.4.sg
│   │   ├── Absoft_Fortran.4.sg
│   │   ├── Amiga_E.4.sg
│   │   ├── Amiga_font.1.sg
│   │   ├── Aztec_C.4.sg
│   │   ├── BHC3_Relocatable.1.sg
│   │   ├── BPack_SFX.1.sg
│   │   ├── Blitz_BASIC.4.sg
│   │   ├── ByteKiller_Clone.1.sg
│   │   ├── Chryseis_Cruncher.1.sg
│   │   ├── Crunch_Master.1.sg
│   │   ├── DICE_C.4.sg
│   │   ├── DMS_FMS-Masher.1.sg
│   │   ├── Deluxe_Cruncher.1.sg
│   │   ├── Free_Pascal.4.sg
│   │   ├── GNU_C.4.sg
│   │   ├── HQC_Cruncher.1.sg
│   │   ├── HiSoft_Basic.4.sg
│   │   ├── High_Pressure_Cruncher.1.sg
│   │   ├── Jan_Heweliusz_Cruncher.1.sg
│   │   ├── Lattice_C.4.sg
│   │   ├── LhPak_SFX.1.sg
│   │   ├── Master_Cruncher.1.sg
│   │   ├── Maxon_C++.4.sg
│   │   ├── RexxMasher_(jrms).1.sg
│   │   ├── Sound-Tracker_Cruncher.1.sg
│   │   ├── Storm_C.4.sg
│   │   ├── TNM_Cruncher.1.sg
│   │   ├── TSK_Cruncher.1.sg
│   │   ├── Time_Cruncher.1.sg
│   │   ├── Titanics_Cruncher.1.sg
│   │   ├── Turtle_Smasher.1.sg
│   │   ├── Ultimate_Packer.1.sg
│   │   ├── _Amiga.0.sg
│   │   ├── _init
│   │   ├── compiler_ABasic.4.sg
│   │   ├── compiler_AmigaBasic.4.sg
│   │   ├── compiler_GFA-Basic.4.sg
│   │   ├── compiler_JForth.4.sg
│   │   ├── compiler_Multi-Forth.4.sg
│   │   ├── compiler_Oberon-A.4.sg
│   │   ├── compiler_PureBasic.4.sg
│   │   ├── compiler_VBCC.4.sg
│   │   ├── cruncher_AddressHead.1.sg
│   │   ├── cruncher_ByteKiller.1.sg
│   │   ├── cruncher_CopyCat.1.sg
│   │   ├── cruncher_Cranker.1.sg
│   │   ├── cruncher_Crunch-Mania.1.sg
│   │   ├── cruncher_Crunch-O-Matic.1.sg
│   │   ├── cruncher_Crunch.1.sg
│   │   ├── cruncher_CrunchyDat.1.sg
│   │   ├── cruncher_Defjam.1.sg
│   │   ├── cruncher_DoubleAction.1.sg
│   │   ├── cruncher_DragPack.1.sg
│   │   ├── cruncher_FileShield.1.sg
│   │   ├── cruncher_FlashSpeed.1.sg
│   │   ├── cruncher_GnuPacker.1.sg
│   │   ├── cruncher_House.1.sg
│   │   ├── cruncher_ISC.1.sg
│   │   ├── cruncher_Imploder.1.sg
│   │   ├── cruncher_MOPacker.1.sg
│   │   ├── cruncher_MaxPacker.1.sg
│   │   ├── cruncher_MegaCruncher.1.sg
│   │   ├── cruncher_PackIt.1.sg
│   │   ├── cruncher_Pak.1.sg
│   │   ├── cruncher_PowerPacker.1.sg
│   │   ├── cruncher_ProPack.1.sg
│   │   ├── cruncher_ReXXMaSHeR.1.sg
│   │   ├── cruncher_Relokit.1.sg
│   │   ├── cruncher_S-Exec.1.sg
│   │   ├── cruncher_Shrinkler.1.sg
│   │   ├── cruncher_Spike.1.sg
│   │   ├── cruncher_StoneCracker.1.sg
│   │   ├── cruncher_Super-Cruncher.1.sg
│   │   ├── cruncher_SyncroPacker.1.sg
│   │   ├── cruncher_TUC.1.sg
│   │   ├── cruncher_TetraCrunch.1.sg
│   │   ├── cruncher_TetraPack.1.sg
│   │   ├── cruncher_TryIt.1.sg
│   │   ├── cruncher_TurboSqueezer.1.sg
│   │   ├── cruncher_xpkmaster.1.sg
│   │   ├── joiner_ETA.1.sg
│   │   ├── joiner_EXP.1.sg
│   │   ├── joiner_Glue.1.sg
│   │   ├── library_library.1.sg
│   │   ├── module_DeliTracker.1.sg
│   │   ├── other_other.1.sg
│   │   ├── self-displayer_DPS.1.sg
│   │   ├── self-displayer_Iff2ex.1.sg
│   │   ├── self-displayer_S-Anim.1.sg
│   │   ├── self-displayer_S-Pic.1.sg
│   │   ├── sfx_DIMP.1.sg
│   │   ├── sfx_DMSSFX.1.sg
│   │   ├── sfx_LHASFX.1.sg
│   │   ├── sfx_LHSFX.1.sg
│   │   ├── tool_EFFECT-loader.1.sg
│   │   └── tool_VideoTracker.1.sg
│   ├── Archive/
│   │   ├── _Archive.0.sg
│   │   └── _init
│   ├── AtariST/
│   │   ├── _AtariST.0.sg
│   │   └── _init
│   ├── Binary/
│   │   ├── Amiga_loadable.1.sg
│   │   ├── Certificate_cert.WinAuth.1.sg
│   │   ├── RIFF.1.sg
│   │   ├── ROM_1.sg
│   │   ├── U-Boot.1.sg
│   │   ├── __MiniExtensionsHeuristic_By_DosX.7.sg
│   │   ├── __MiniJavaScriptHeuristic_By_DosX.7.sg
│   │   ├── _init
│   │   ├── archive.ACE.1.sg
│   │   ├── archive.ARJ.1.sg
│   │   ├── archive.DEFLATE.1.sg
│   │   ├── archive.LZ4.1.sg
│   │   ├── archive.MS_Compound.1.sg
│   │   ├── archive.PC_Secure.sg
│   │   ├── archive.RAR.1.sg
│   │   ├── archive.ZIP.1.sg
│   │   ├── archive.ZLIB.1.sg
│   │   ├── archive_7z.1.sg
│   │   ├── archive_ANC-Cruncher.1.sg
│   │   ├── archive_AR.1.sg
│   │   ├── archive_ARC.1.sg
│   │   ├── archive_ASAR.1.sg
│   │   ├── archive_BCSAR.1.sg
│   │   ├── archive_BZip.1.sg
│   │   ├── archive_CCA.1.sg
│   │   ├── archive_CFL3.1.sg
│   │   ├── archive_CKP.1.sg
│   │   ├── archive_Cab.1.sg
│   │   ├── archive_DAA.1.sg
│   │   ├── archive_DCP.1.sg
│   │   ├── archive_DXA.1.sg
│   │   ├── archive_DatPack.1.sg
│   │   ├── archive_DotBundle.sg
│   │   ├── archive_EdgeDataPak.1.sg
│   │   ├── archive_Flatpak.1.sg
│   │   ├── archive_GhidraZipFile.1.sg
│   │   ├── archive_GodotPCK.1.sg
│   │   ├── archive_HIP.1.sg
│   │   ├── archive_IFP.1.sg
│   │   ├── archive_IPW.1.sg
│   │   ├── archive_InnoSetup.1.sg
│   │   ├── archive_JAM.1.sg
│   │   ├── archive_LAB.1.sg
│   │   ├── archive_LRZ.1.sg
│   │   ├── archive_LZOP.1.sg
│   │   ├── archive_MCS.1.sg
│   │   ├── archive_MS-WIM.1.sg
│   │   ├── archive_MWD.1.sg
│   │   ├── archive_P2L.1.sg
│   │   ├── archive_PAK.1.sg
│   │   ├── archive_PBP.1.sg
│   │   ├── archive_PEA.1.sg
│   │   ├── archive_PKG.1.sg
│   │   ├── archive_PSARC.1.sg
│   │   ├── archive_PUP.1.sg
│   │   ├── archive_RVZ.1.sg
│   │   ├── archive_STK.1.sg
│   │   ├── archive_Shaped.1.sg
│   │   ├── archive_TRE.1.sg
│   │   ├── archive_Unity.1.sg
│   │   ├── archive_UnrealEngine.1.sg
│   │   ├── archive_ViseInstaller.1.sg
│   │   ├── archive_XZP.1.sg
│   │   ├── archive_ZPAQ.1.sg
│   │   ├── archive_archives.1.sg
│   │   ├── archive_archives.ancient.sg
│   │   ├── archive_btoa.1.sg
│   │   ├── archive_cad.DWG.1.sg
│   │   ├── archive_gp7bank.1.sg
│   │   ├── audio.1.sg
│   │   ├── audio_8svx.1.sg
│   │   ├── audio_ACM.1.sg
│   │   ├── audio_ADX.1.sg
│   │   ├── audio_AHX.1.sg
│   │   ├── audio_AIF.1.sg
│   │   ├── audio_AU.1.sg
│   │   ├── audio_BCSTM.1.sg
│   │   ├── audio_BCWAV.1.sg
│   │   ├── audio_CXT.1.sg
│   │   ├── audio_DSS.1.sg
│   │   ├── audio_EXA.1.sg
│   │   ├── audio_FLAC.1.sg
│   │   ├── audio_FSB.1.sg
│   │   ├── audio_HMI.1.sg
│   │   ├── audio_OGG.1.sg
│   │   ├── audio_PAF.1.sg
│   │   ├── audio_PVF.1.sg
│   │   ├── audio_RIFF-IMA.1.sg
│   │   ├── audio_SOU.1.sg
│   │   ├── audio_STRM.1.sg
│   │   ├── audio_STRM.2.sg
│   │   ├── audio_ShockwaveAudio.1.sg
│   │   ├── audio_TUN.1.sg
│   │   ├── audio_VOC.1.sg
│   │   ├── audio_WAV.1.sg
│   │   ├── audio_WEM.1.sg
│   │   ├── audio_mp3.2.sg
│   │   ├── backup_images.1.sg
│   │   ├── bin.Atari_ST.1.sg
│   │   ├── bin.IDA.1.sg
│   │   ├── bin.ISO_9660.1.sg
│   │   ├── bin.RPGMaker2Kdata.1.sg
│   │   ├── data_overlay_null_padding.1.sg
│   │   ├── data_overlays.6.sg
│   │   ├── debug_data_debugData.1.sg
│   │   ├── font.ADOBE.1.sg
│   │   ├── font_BMF.1.sg
│   │   ├── font_FFN.1.sg
│   │   ├── font_TFM.1.sg
│   │   ├── font_VTF.1.sg
│   │   ├── font_XTT.1.sg
│   │   ├── format_AS.1.sg
│   │   ├── format_AmigaIcon.1.sg
│   │   ├── format_BCD1.1.sg
│   │   ├── format_BOU.1.sg
│   │   ├── format_BSP.1.sg
│   │   ├── format_BTF.1.sg
│   │   ├── format_BackupMii.1.sg
│   │   ├── format_CCD.1.sg
│   │   ├── format_CSO.1.sg
│   │   ├── format_CTRK.1.sg
│   │   ├── format_CURE.1.sg
│   │   ├── format_CVM.1.sg
│   │   ├── format_DESKTOP.1.sg
│   │   ├── format_DSW.1.sg
│   │   ├── format_DTA.1.sg
│   │   ├── format_Director.1.sg
│   │   ├── format_DunkleSchattenConfig.1.sg
│   │   ├── format_DunkleSchattenSave.1.sg
│   │   ├── format_Empty.1.sg
│   │   ├── format_FAS.1.sg
│   │   ├── format_FLDB.1.sg
│   │   ├── format_FNX.1.sg
│   │   ├── format_FST.1.sg
│   │   ├── format_GAL.1.sg
│   │   ├── format_GBI.1.sg
│   │   ├── format_GME.1.sg
│   │   ├── format_GameMaps.1.sg
│   │   ├── format_GamingRoot.1.sg
│   │   ├── format_HIV.1.sg
│   │   ├── format_HNM.1.sg
│   │   ├── format_HSM.1.sg
│   │   ├── format_ILK.1.sg
│   │   ├── format_IPCH.1.sg
│   │   ├── format_ITL.1.sg
│   │   ├── format_IVF.1.sg
│   │   ├── format_Img.UDIF.1.sg
│   │   ├── format_InnoSetupUninstall.1.sg
│   │   ├── format_InterleafFile.1.sg
│   │   ├── format_LCA.1.sg
│   │   ├── format_LGX.1.sg
│   │   ├── format_LIXS.1.sg
│   │   ├── format_LVL.1.sg
│   │   ├── format_MAT.1.sg
│   │   ├── format_MDL.1.sg
│   │   ├── format_MDS.1.sg
│   │   ├── format_MS-DBG.1.sg
│   │   ├── format_MS-PST.sg
│   │   ├── format_MS-VHD.1.sg
│   │   ├── format_MS-VHDX.sg
│   │   ├── format_MS-XNA.1.sg
│   │   ├── format_OBC.1.sg
│   │   ├── format_OpenSSH.1.sg
│   │   ├── format_P7X.1.sg
│   │   ├── format_PAT.1.sg
│   │   ├── format_PDB.1.sg
│   │   ├── format_PEM.1.sg
│   │   ├── format_PGP.1.sg
│   │   ├── format_POL.1.sg
│   │   ├── format_PRI.1.sg
│   │   ├── format_PS-X.1.sg
│   │   ├── format_PSM2CFG.1.sg
│   │   ├── format_RARREG.1.sg
│   │   ├── format_RCK.1.sg
│   │   ├── format_RCO.1.sg
│   │   ├── format_RGS.1.sg
│   │   ├── format_RedShirt.1.sg
│   │   ├── format_SDI.1.sg
│   │   ├── format_SFK.1.sg
│   │   ├── format_SHBIN.1.sg
│   │   ├── format_SLN.1.sg
│   │   ├── format_SLNX.1.sg
│   │   ├── format_SSHPublicKey.1.sg
│   │   ├── format_SystemErr.1.sg
│   │   ├── format_TLB.1.sg
│   │   ├── format_TOT.1.sg
│   │   ├── format_TPU.1.sg
│   │   ├── format_UCM.1.sg
│   │   ├── format_UPC.1.sg
│   │   ├── format_UPF.1.sg
│   │   ├── format_UPI.1.sg
│   │   ├── format_VDI.1.sg
│   │   ├── format_VM2.1.sg
│   │   ├── format_VTF.1.sg
│   │   ├── format_VVD.1.sg
│   │   ├── format_W3D.1.sg
│   │   ├── format_WASM.1.sg
│   │   ├── format_WBFS.1.sg
│   │   ├── format_XBE.1.sg
│   │   ├── format_XBF.1.sg
│   │   ├── format_XCG.1.sg
│   │   ├── format_XCI.1.sg
│   │   ├── format_XCR.1.sg
│   │   ├── format_XCS.1.sg
│   │   ├── format_XDelta.1.sg
│   │   ├── format_XEX.1.sg
│   │   ├── format_ZZDATA.1.sg
│   │   ├── format_ZinsSAV.1.sg
│   │   ├── format_bin.AAALogo.1.sg
│   │   ├── format_bin.COL.1.sg
│   │   ├── format_bin.GuitarPro.1.sg
│   │   ├── format_bin.Hermes.1.sg
│   │   ├── format_bin.JMDL.1.sg
│   │   ├── format_bin.JSC.1.sg
│   │   ├── format_bin.Java.1.sg
│   │   ├── format_bin.KeePass.1.sg
│   │   ├── format_bin.LUA.1.sg
│   │   ├── format_bin.NVA.1.sg
│   │   ├── format_bin.Nintendo-certified-file.1.sg
│   │   ├── format_bin.PEFF.1.sg
│   │   ├── format_bin.PalmFile.1.sg
│   │   ├── format_bin.Python.1.sg
│   │   ├── format_bin.SWF.1.sg
│   │   ├── format_bin.VCF.1.sg
│   │   ├── format_bin.WindowsIconCacheDB.1.sg
│   │   ├── format_database.SQLite.1.sg
│   │   ├── format_databases.1.sg
│   │   ├── format_doc.CHM.1.sg
│   │   ├── format_doc.DJVU.1.sg
│   │   ├── format_doc.HLP.1.sg
│   │   ├── format_doc.PDF.1.sg
│   │   ├── format_doc.RTF.1.sg
│   │   ├── format_iCalender.1.sg
│   │   ├── format_img.VM.1.sg
│   │   ├── format_text.RegistryFile.sg
│   │   ├── format_text.pdb.1.sg
│   │   ├── format_text.plaintext.3.sg
│   │   ├── format_video.BIK.1.sg
│   │   ├── format_video.BK2.1.sg
│   │   ├── format_video.FLV.1.sg
│   │   ├── format_video.MOV.1.sg
│   │   ├── format_video.MP4.1.sg
│   │   ├── format_video.Matroska.1.sg
│   │   ├── format_video.RobotAnimation.1.sg
│   │   ├── format_video.Smacker.1.sg
│   │   ├── format_video.VMD.1.sg
│   │   ├── formats.1.sg
│   │   ├── graphics.1.sg
│   │   ├── image.PNG.1.sg
│   │   ├── image_ANI.1.sg
│   │   ├── image_BMP.1.sg
│   │   ├── image_CUR.1.sg
│   │   ├── image_DDS.1.sg
│   │   ├── image_EPS.1.sg
│   │   ├── image_FSH.1.sg
│   │   ├── image_GIF.1.sg
│   │   ├── image_ICNS.sg
│   │   ├── image_ICO.1.sg
│   │   ├── image_IMG.1.sg
│   │   ├── image_JNG.1.sg
│   │   ├── image_JPEG.1.sg
│   │   ├── image_JPEGXL.1.sg
│   │   ├── image_KTX.1.sg
│   │   ├── image_LBM.1.sg
│   │   ├── image_MNG.1.sg
│   │   ├── image_PCX.1.sg
│   │   ├── image_PSD.1.sg
│   │   ├── image_PVR.1.sg
│   │   ├── image_QOI.1.sg
│   │   ├── image_SMDH.1.sg
│   │   ├── image_TGA.1.sg
│   │   ├── image_TIFF.1.sg
│   │   ├── image_XAR.1.sg
│   │   ├── image_XCF.1.sg
│   │   ├── image_bin.ZBMP.1.sg
│   │   ├── image_heuristic.image.HDR.1.sg
│   │   ├── protector_javascript-obfuscator.2.sg
│   │   ├── rom_32X.1.sg
│   │   ├── script_text.Shell.1.sg
│   │   ├── shellcode.pe_to_shellcode.1.sg
│   │   ├── shellcode_donut.1.sg
│   │   ├── shellcode_srdi-monoxgas.1.sg
│   │   ├── source_text.HTML.1.sg
│   │   ├── source_text.Pascal.1.sg
│   │   ├── source_text.XML.1.sg
│   │   ├── source_text.c.1.sg
│   │   ├── source_text.python.1.sg
│   │   ├── text.script.2.sg
│   │   └── win_resources.1.sg
│   ├── Borland
│   ├── CFBF/
│   │   ├── Microsoft_Installer.1.sg
│   │   ├── Microsoft_Office.1.sg
│   │   ├── _CFBF.0.sg
│   │   └── _init
│   ├── COM/
│   │   ├── 32-bit_crypt.2.sg
│   │   ├── COM_Sccrambler.2.sg
│   │   ├── Character_Intro_Engine.1.sg
│   │   ├── Crypt_(CyPoxl).2.sg
│   │   ├── Crypt_(Dismember).2.sg
│   │   ├── Deep_Crypter.2.sg
│   │   ├── Dn.COM_Cruncher.2.sg
│   │   ├── Inbuild_Encryption.2.sg
│   │   ├── LHarc_SFX.1.sg
│   │   ├── Maveriks_C0der.2.sg
│   │   ├── Microsoft_C.4.sg
│   │   ├── Microsoft_RTL.3.sg
│   │   ├── MrHDKiller_Protection.2.sg
│   │   ├── PC_FORTH.4.sg
│   │   ├── RDT_ENC_3.2.sg
│   │   ├── RTD_Compressor.2.sg
│   │   ├── RTD_Compressor2.2.sg
│   │   ├── SHOW_IT.1.sg
│   │   ├── SPHINX_C--.4.sg
│   │   ├── Shade's_COM_Encryptor.2.sg
│   │   ├── Shadow_COM_encryptor.2.sg
│   │   ├── TPC_Scramble.2.sg
│   │   ├── Text_Header.1.sg
│   │   ├── The_DRAW.1.sg
│   │   ├── Tiny_Xor.2.sg
│   │   ├── Unknown_cryptors.2.sg
│   │   ├── VGA_font_loader.1.sg
│   │   ├── VSF&K_protection.2.sg
│   │   ├── WSP_self_update.2.sg
│   │   ├── WiZ_Cryptor.2.sg
│   │   ├── _COM.0.sg
│   │   ├── _init
│   │   ├── compiler_8086_Forth_83.4.sg
│   │   ├── compiler_ASIC-Basic.4.sg
│   │   ├── compiler_BAT2EXEC.2.sg
│   │   ├── compiler_BatLite.4.sg
│   │   ├── compiler_Borland_C++.4.sg
│   │   ├── compiler_Datalight_C.4.sg
│   │   ├── compiler_Easy!-C.4.sg
│   │   ├── compiler_Fig-FORTH.4.sg
│   │   ├── compiler_ForthCMP.2.sg
│   │   ├── compiler_ForthCMP.4.sg
│   │   ├── compiler_GP-FORTH.4.sg
│   │   ├── compiler_Lattice_C.4.sg
│   │   ├── compiler_MICRO-C.4.sg
│   │   ├── compiler_MINIFORTH.4.sg
│   │   ├── compiler_MoonRock.2.sg
│   │   ├── compiler_OUTFORTH.4.sg
│   │   ├── compiler_PBFC.2.sg
│   │   ├── compiler_RMCOBOL.4.sg
│   │   ├── compiler_SP-FORTH.4.sg
│   │   ├── compiler_Surpas-86.4.sg
│   │   ├── compiler_TCOM.4.sg
│   │   ├── compiler_Turbo_C++.4.sg
│   │   ├── compiler_Turbo_C.4.sg
│   │   ├── compiler_Turbo_Pascal.4.sg
│   │   ├── compiler_UNIFORTH.4.sg
│   │   ├── compiler_Vienna-C.4.sg
│   │   ├── compiler_Watcom_C.4.sg
│   │   ├── compiler_Zbikowski_C.4.sg
│   │   ├── compiler_Zortech_C.4.sg
│   │   ├── compiler_muSIMP-83.4.sg
│   │   ├── converter_A3E.1.sg
│   │   ├── converter_AutoCracker.1.sg
│   │   ├── converter_COM2TXT.1.sg
│   │   ├── converter_COMT.1.sg
│   │   ├── converter_CRX2COM.1.sg
│   │   ├── converter_E2C.1.sg
│   │   ├── converter_EXE2COM.1.sg
│   │   ├── converter_EXETools_EXE2COM.1.sg
│   │   ├── converter_FIXCRK.1.sg
│   │   ├── converter_FromBAT.1.sg
│   │   ├── converter_MAKEBOO.1.sg
│   │   ├── converter_NetCode.1.sg
│   │   ├── converter_NetRun.1.sg
│   │   ├── converter_TurboBAT.1.sg
│   │   ├── converter_Vacsina.4.sg
│   │   ├── converter_XCK2COM.1.sg
│   │   ├── cryptor_Anti-Lamer_Cryptor.2.sg
│   │   ├── cryptor_CSCRYPT.2.sg
│   │   ├── cryptor_EXINCT.2.sg
│   │   ├── cryptor_J0B_cryptor.2.sg
│   │   ├── cryptor_PU-Cryptor.2.sg
│   │   ├── cryptor_Phrozen_Crew_cryptor.2.sg
│   │   ├── cryptor_SDW.2.sg
│   │   ├── cryptor_Sydex.2.sg
│   │   ├── cryptor_UComCry.1.sg
│   │   ├── cryptor_USCC.2.sg
│   │   ├── cryptor_cryptors.2.sg
│   │   ├── driver_DIGPAK.1.sg
│   │   ├── driver_MIDPAK.1.sg
│   │   ├── immunizer_ARF_AV_Inject.1.sg
│   │   ├── immunizer_CPAV.1.sg
│   │   ├── immunizer_F-XLOCK.1.sg
│   │   ├── immunizer_IMMUN.1.sg
│   │   ├── immunizer_TAV.1.sg
│   │   ├── immunizer_VSS.1.sg
│   │   ├── other_XLOADER.2.sg
│   │   ├── other_integrity_checker.1.sg
│   │   ├── packer_4kZIP.2.sg
│   │   ├── packer_AVPACK.2.sg
│   │   ├── packer_COMPACK.2.sg
│   │   ├── packer_Cheat_packer.2.sg
│   │   ├── packer_Compressor.2.sg
│   │   ├── packer_CyberWare_Packer.2.sg
│   │   ├── packer_Diet.2.sg
│   │   ├── packer_EXC.2.sg
│   │   ├── packer_ICE.1.sg
│   │   ├── packer_LGLZ.2.sg
│   │   ├── packer_PKLITE.2.sg
│   │   ├── packer_PRO-PACK.2.sg
│   │   ├── packer_SCRE2B.2.sg
│   │   ├── packer_SCRNCH.2.sg
│   │   ├── packer_SHRINK.2.sg
│   │   ├── packer_Scramb.2.sg
│   │   ├── packer_Six-2-Four.2.sg
│   │   ├── packer_TPACK.2.sg
│   │   ├── packer_Triplex.2.sg
│   │   ├── packer_UPX.2.sg
│   │   ├── packer_X-PACK.2.sg
│   │   ├── packer_XE.2.sg
│   │   ├── packer_XPACK.2.sg
│   │   ├── packer_aPACK.2.sg
│   │   ├── packer_com_RLE_packer.2.sg
│   │   ├── packer_envelope.2.sg
│   │   ├── protector_ABK-Scrambler.2.sg
│   │   ├── protector_ACE_Scrambler.2.sg
│   │   ├── protector_AVAST-Protect.2.sg
│   │   ├── protector_AdFlt.2.sg
│   │   ├── protector_Adys_COM-Scrambler.2.sg
│   │   ├── protector_Anti-hack_encryption_system.2.sg
│   │   ├── protector_BIN-Lock.2.sg
│   │   ├── protector_Best_Protection_Kit-B.2.sg
│   │   ├── protector_BinCOD.2.sg
│   │   ├── protector_Budokan.1.sg
│   │   ├── protector_C-crypt.2.sg
│   │   ├── protector_CC#3.2.sg
│   │   ├── protector_CC.2.sg
│   │   ├── protector_CC286.2.sg
│   │   ├── protector_CCC.2.sg
│   │   ├── protector_CHECKPRG.2.sg
│   │   ├── protector_CNT.2.sg
│   │   ├── protector_COM-Protect.2.sg
│   │   ├── protector_COM-Protection.2.sg
│   │   ├── protector_COMCRYPT.2.sg
│   │   ├── protector_COMPROTECT.2.sg
│   │   ├── protector_COP.2.sg
│   │   ├── protector_CodeLock.2.sg
│   │   ├── protector_Codesafe.2.sg
│   │   ├── protector_ComProt.2.sg
│   │   ├── protector_ComProtector.2.sg
│   │   ├── protector_Comlock.2.sg
│   │   ├── protector_CrAcKeR.2.sg
│   │   ├── protector_Crack2EXE.1.sg
│   │   ├── protector_CryptCom.2.sg
│   │   ├── protector_Crypto-King.2.sg
│   │   ├── protector_DCFR.2.sg
│   │   ├── protector_DS-CRP.2.sg
│   │   ├── protector_Deeper.2.sg
│   │   ├── protector_E2C-Scrambler.2.sg
│   │   ├── protector_E2C1.2.sg
│   │   ├── protector_EPW.2.sg
│   │   ├── protector_EXETools.2.sg
│   │   ├── protector_Encriptor.2.sg
│   │   ├── protector_Entropy_Coder.2.sg
│   │   ├── protector_ExOM.2.sg
│   │   ├── protector_FCRYPT.2.sg
│   │   ├── protector_GOAT.2.sg
│   │   ├── protector_Guardian_Angel.2.sg
│   │   ├── protector_HDKPROTC.2.sg
│   │   ├── protector_HackStop.2.sg
│   │   ├── protector_IntroC0der.1.sg
│   │   ├── protector_Keygen_crypt.2.sg
│   │   ├── protector_Khrome_Crypt.2.sg
│   │   ├── protector_LAME_GG.2.sg
│   │   ├── protector_LAMPROT.2.sg
│   │   ├── protector_Lock-Master.2.sg
│   │   ├── protector_MASK.2.sg
│   │   ├── protector_MCLock.2.sg
│   │   ├── protector_MESS.2.sg
│   │   ├── protector_MSCC.2.sg
│   │   ├── protector_MegaShield.2.sg
│   │   ├── protector_Microxor.2.sg
│   │   ├── protector_NH.2.sg
│   │   ├── protector_NoAV.2.sg
│   │   ├── protector_Nodebug.2.sg
│   │   ├── protector_PCOM.2.sg
│   │   ├── protector_PCRYPT.2.sg
│   │   ├── protector_PCVault-Protect.2.sg
│   │   ├── protector_PROTECT.2.sg
│   │   ├── protector_PTP.2.sg
│   │   ├── protector_PassCOM.2.sg
│   │   ├── protector_Propellerhead_encryption.2.sg
│   │   ├── protector_ProtEXE.2.sg
│   │   ├── protector_R-Crypt.2.sg
│   │   ├── protector_RCC.2.sg
│   │   ├── protector_RSCC.2.sg
│   │   ├── protector_SCC.2.sg
│   │   ├── protector_SCRAM.2.sg
│   │   ├── protector_Scrambler.2.sg
│   │   ├── protector_Scrypt!.2.sg
│   │   ├── protector_Scrypt.2.sg
│   │   ├── protector_SelfCrypt.2.sg
│   │   ├── protector_SelfProtect386.2.sg
│   │   ├── protector_SnoopStop.2.sg
│   │   ├── protector_SoftGuard.1.sg
│   │   ├── protector_Steplock.2.sg
│   │   ├── protector_TCEC.2.sg
│   │   ├── protector_UnPackStop.2.sg
│   │   ├── protector_UniCrypt.1.sg
│   │   ├── protector_Venus.2.sg
│   │   ├── protector_XORCOPY.2.sg
│   │   ├── protector_XcomOR.2.sg
│   │   ├── protector_XoReR.2.sg
│   │   ├── protector_XorCom.2.sg
│   │   ├── protector_aPatch.2.sg
│   │   ├── protector_acBBS_protection.2.sg
│   │   ├── protector_com-crypt.2.sg
│   │   ├── protector_fds-cp.2.sg
│   │   ├── protector_mCrypt.2.sg
│   │   ├── protector_protection.2.sg
│   │   ├── protector_spirit.2.sg
│   │   ├── protector_sticker.2.sg
│   │   ├── protector_x3.2.sg
│   │   ├── self-displayer_ACiDDRAW.1.sg
│   │   ├── self-displayer_ANS2ALL.1.sg
│   │   ├── self-displayer_ASC2COM.1.sg
│   │   ├── self-displayer_DOC2COM.1.sg
│   │   ├── self-displayer_DOC2PAGE.1.sg
│   │   ├── self-displayer_GTXT.1.sg
│   │   ├── self-displayer_HYPDOC.1.sg
│   │   ├── self-displayer_List.1.sg
│   │   ├── self-displayer_MakeRead.1.sg
│   │   ├── self-displayer_ONLINE-HELP.1.sg
│   │   ├── self-displayer_PFL2COM.1.sg
│   │   ├── self-displayer_RELETTER.1.sg
│   │   ├── self-displayer_SHOWV20.1.sg
│   │   ├── self-displayer_TXT2COM.1.sg
│   │   ├── self-displayer_TXTmaker.1.sg
│   │   ├── self-displayer_Txt2Exe.1.sg
│   │   ├── self-displayer_readme.com.1.sg
│   │   ├── sfx_LHA.1.sg
│   │   ├── sfx_PKZip.1.sg
│   │   ├── simple_ansi_viewer.1.sg
│   │   ├── simple_self-displayer.1.sg
│   │   └── virus.1.sg
│   ├── CurIcoBPP
│   ├── DEX/
│   │   ├── _DEX.0.sg
│   │   ├── _DEX2.0.sg
│   │   ├── _init
│   │   ├── compiler_dexlib2.4.sg
│   │   ├── library_UnicomSDK.4.sg
│   │   ├── obfuscator_ProGuard.2.sg
│   │   ├── protector_AESObfuscator.2.sg
│   │   ├── protector_APKProtect.2.sg
│   │   ├── protector_AlibabaProtection.2.sg
│   │   ├── protector_AllatoriObfuscator.2.sg
│   │   ├── protector_ApkEncryptor.2.sg
│   │   ├── protector_AppSolid.2.sg
│   │   ├── protector_BaiduProtection.2.sg
│   │   ├── protector_BangcleProtection.2.sg
│   │   ├── protector_EasyProtector.2.sg
│   │   ├── protector_Jiagu.2.sg
│   │   ├── protector_Kiwi.2.sg
│   │   ├── protector_LIAPP.2.sg
│   │   ├── protector_MedusaH.2.sg
│   │   ├── protector_ModGuard.2.sg
│   │   ├── protector_NQShield.2.sg
│   │   ├── protector_NagaPTProtection.2.sg
│   │   ├── protector_PangXie.2.sg
│   │   ├── protector_QDBH.2.sg
│   │   ├── protector_SecNeo.2.sg
│   │   ├── protector_TencentProtection.2.sg
│   │   ├── protector_VDog.2.sg
│   │   ├── protector_Yidun.2.sg
│   │   └── tool_ApkToolPlus.6.sg
│   ├── DOS16M/
│   │   ├── _DOS16M.0.sg
│   │   ├── _init
│   │   └── compiler_Watcom.2.sg
│   ├── DOS4G/
│   │   ├── _DOS4G.0.sg
│   │   ├── _init
│   │   └── compiler_Watcom.2.sg
│   ├── ELF/
│   │   ├── Borland_Kylix.4.sg
│   │   ├── Free_Pascal.4.sg
│   │   ├── HP_C++.4.sg
│   │   ├── IBM_AIX_kernel_loader.4.sg
│   │   ├── Oracle_Solaris_Studio.4.sg
│   │   ├── _ELF.0.sg
│   │   ├── _init
│   │   ├── compiler_DMD.4.sg
│   │   ├── compiler_FASM.4.sg
│   │   ├── compiler_Go.4.sg
│   │   ├── compiler_MWCC.4.sg
│   │   ├── compiler_Rust.4.sg
│   │   ├── compiler_VBCC.4.sg
│   │   ├── compiler_Watcom.4.sg
│   │   ├── compiler_Zig.4.sg
│   │   ├── compiler_gcc.4.sg
│   │   ├── compiler_gdc.4.sg
│   │   ├── compiler_ldc.4.sg
│   │   ├── compiler_movfuscator.4.sg
│   │   ├── library_Curl.4.sg
│   │   ├── library_FFmpeg.4.sg
│   │   ├── library_FLAC.4.sg
│   │   ├── library_Flexlm.4.sg
│   │   ├── library_FluidSynth.4.sg
│   │   ├── library_FreeType.4.sg
│   │   ├── library_GLEW.4.sg
│   │   ├── library_GLIBC.3.sg
│   │   ├── library_LZMA.4.sg
│   │   ├── library_Lego1.4.sg
│   │   ├── library_MPEG2.4.sg
│   │   ├── library_Mikmod.4.sg
│   │   ├── library_OGG.4.sg
│   │   ├── library_OpenAL.4.sg
│   │   ├── library_PulseAudio.4.sg
│   │   ├── library_QT.3.sg
│   │   ├── library_SDL.3.sg
│   │   ├── packer_Ezuri.1.sg
│   │   ├── packer_PyInstaller.2.sg
│   │   ├── packer_UPX.2.sg
│   │   ├── packer_Virbox.2.sg
│   │   ├── packer_exepak.1.sg
│   │   ├── protector_Burneye.2.sg
│   │   └── protector_HASP.1.sg
│   ├── FASM
│   ├── FPC
│   ├── IPA/
│   │   └── _init
│   ├── ISO9660/
│   │   ├── _ISO9660.0.sg
│   │   ├── _init
│   │   ├── bootloader_Grub.1.sg
│   │   ├── filesystem_AppleHFS.1.sg
│   │   ├── iso_Rimage.1.sg
│   │   ├── library_IMAPI.1.sg
│   │   ├── library_IMAPI2.1.sg
│   │   ├── library_libburn.1.sg
│   │   ├── library_libisoburn.1.sg
│   │   ├── library_libisofs.1.sg
│   │   ├── partition_EFI_PART.1.sg
│   │   ├── tool_CDBurnerXP.1.sg
│   │   ├── tool_CDIMAGE.1.sg
│   │   ├── tool_CeQuadrat.1.sg
│   │   ├── tool_ImgBurn.1.sg
│   │   ├── tool_MKARCHISO.1.sg
│   │   ├── tool_NeroBurningROM.1.sg
│   │   ├── tool_PersonalRomMaker.1.sg
│   │   ├── tool_QuickToPix.1.sg
│   │   ├── tool_RoxioToast.1.sg
│   │   ├── tool_UltraISO.1.sg
│   │   ├── tool_WinISO.1.sg
│   │   ├── tool_genisoimage.1.sg
│   │   └── tool_xorriso.1.sg
│   ├── Image/
│   │   ├── _Image.0.sg
│   │   └── _init
│   ├── JAR/
│   │   ├── _JAR.0.sg
│   │   ├── _init
│   │   └── tool_SingleJar.3.sg
│   ├── JPEG/
│   │   ├── _Jpeg.0.sg
│   │   ├── _init
│   │   ├── camera_camera.2.sg
│   │   ├── image_DQT.4.sg
│   │   ├── image_comment.4.sg
│   │   └── tool_Tools.3.sg
│   ├── JavaClass/
│   │   ├── _JavaClass.0.sg
│   │   └── _init
│   ├── LE/
│   │   ├── _LE.0.sg
│   │   ├── _init
│   │   ├── compiler_Watcom_C.4.sg
│   │   └── packer_UPX.1.sg
│   ├── LX/
│   │   ├── _LX.0.sg
│   │   ├── _init
│   │   ├── compiler_Borland_C.4.sg
│   │   └── compiler_Watcom_C.4.sg
│   ├── MACH/
│   │   ├── _MACH.0.sg
│   │   ├── _init
│   │   ├── compiler_Delphi.4.sg
│   │   ├── compiler_Rust.4.sg
│   │   ├── compiler_Zig.4.sg
│   │   ├── compiler_gcc.4.sg
│   │   ├── library_Carbon.3.sg
│   │   ├── library_Cocoa.3.sg
│   │   ├── library_QT.3.sg
│   │   ├── library_WebKit.3.sg
│   │   ├── library_java.3.sg
│   │   ├── packer_UPX.2.sg
│   │   └── packer_Virbox.2.sg
│   ├── MACHOFAT/
│   │   ├── _MACHOFAT.0.sg
│   │   ├── _init
│   │   └── converter_lipo.2.sg
│   ├── MFC
│   ├── MSDOS/
│   │   ├── ACE.6.sg
│   │   ├── Adys_COM2EXE.1.sg
│   │   ├── Adys_Glue.2.sg
│   │   ├── Anti-hack_encryption_system.2.sg
│   │   ├── Aztec_C-86.4.sg
│   │   ├── BlackWolf_Protection.2.sg
│   │   ├── Black_fist.2.sg
│   │   ├── Borland_C.4.sg
│   │   ├── Borland_Pascal.4.sg
│   │   ├── Borland_RTM.0a.sg
│   │   ├── Borland_TDS.5.sg
│   │   ├── Borland_TLINK.5.sg
│   │   ├── CSCRYPT_Pro.2.sg
│   │   ├── Concurrent_Small_C.4.sg
│   │   ├── CopyQM_SFX.1.sg
│   │   ├── Crypt_(Dismember).2.sg
│   │   ├── Crypt_(LightShow).2.sg
│   │   ├── DAEMON_Protect.2.sg
│   │   ├── DOS32_loader.0a.sg
│   │   ├── DOS_16M.0a.sg
│   │   ├── DOS_32A.0a.sg
│   │   ├── Digital_Research_C.4.sg
│   │   ├── Disk_eXPress.1.sg
│   │   ├── EMMXXXX0_check.0a.sg
│   │   ├── EXETools_COM2EXE.1.sg
│   │   ├── EXE_Manager.2.sg
│   │   ├── EXE_Packer.2.sg
│   │   ├── EXE_encryption.2.sg
│   │   ├── Eliashim's_CodeTrack.1.sg
│   │   ├── File_Shield.1.sg
│   │   ├── Fitted_Modula-2.4.sg
│   │   ├── GFX_to_EXE.1.sg
│   │   ├── GamBit_Pro_Library.1.sg
│   │   ├── GameWizard_DOS_Extender.0a.sg
│   │   ├── Graphic_WorkShop.1.sg
│   │   ├── Guardian_Angel.2.sg
│   │   ├── H+BEDV_SelfCheck.1.sg
│   │   ├── Header_Changer.2.sg
│   │   ├── Hi-Tech_C.4.sg
│   │   ├── HyperLOCK_386.2.sg
│   │   ├── IBM_PC_Pascal.4.sg
│   │   ├── John_Socha_Library.3.sg
│   │   ├── Khrome_Crypt.2.sg
│   │   ├── LSI_C.4.sg
│   │   ├── L_O_V_E__FORTH.4.sg
│   │   ├── Lahey_Fortran.4.sg
│   │   ├── Lattice_C.4.sg
│   │   ├── Logitech_Modula-2.4.sg
│   │   ├── Meridian_Ada.4.sg
│   │   ├── Meridian_Pascal.4.sg
│   │   ├── MetaWare_High_C.4.sg
│   │   ├── MetaWare_Professional_Pascal.4.sg
│   │   ├── Micro_Focus_Cobol.4.sg
│   │   ├── Micro_Focus_DOS_extender.0a.sg
│   │   ├── Microsoft_Basic.4.sg
│   │   ├── Microsoft_C.4.sg
│   │   ├── Microsoft_C_Library.3.sg
│   │   ├── Microsoft_Fortran.4.sg
│   │   ├── Microsoft_Quick_Basic.4.sg
│   │   ├── Microsoft_Quick_Pascal.4.sg
│   │   ├── Microsoft_RTL.3.sg
│   │   ├── Microsoft_RTL_(Clipper).3.sg
│   │   ├── MultiLoop_Protection.2.sg
│   │   ├── Netware_loader.1.sg
│   │   ├── PDC_Prolog.4.sg
│   │   ├── PK_sig.1.sg
│   │   ├── PROPACK_SFX.1.sg
│   │   ├── Pacific_C.4.sg
│   │   ├── Panda_immunizer.1.sg
│   │   ├── Pascal_MT+86.4.sg
│   │   ├── Phar_Lap.0a.sg
│   │   ├── RAR.6.sg
│   │   ├── REC_small.1.sg
│   │   ├── REC_small_AV.1.sg
│   │   ├── RLE_com-packer.2.sg
│   │   ├── RM_FORTRAN.4.sg
│   │   ├── RTLink_VM_Manager.0a.sg
│   │   ├── RTPatch_SFX.1.sg
│   │   ├── Realia_Cobol.4.sg
│   │   ├── Realia_SPITBOL.4.sg
│   │   ├── SHOW_IT.1.sg
│   │   ├── Self_UnStuffer.2.sg
│   │   ├── Small_C.4.sg
│   │   ├── StonyBrook_Pascal.4.sg
│   │   ├── Sydex_SFX.1.sg
│   │   ├── Topspeed_Modula.4.sg
│   │   ├── UR_FORTH.4.sg
│   │   ├── Unknown_cryptors.2.sg
│   │   ├── Upper_Deck_Forth.4.sg
│   │   ├── Visual_Cobol.4.sg
│   │   ├── WWPACK_mutator.2.sg
│   │   ├── Whitesmiths_C.4.sg
│   │   ├── Window_book.1.sg
│   │   ├── Wizardy_protection.1.sg
│   │   ├── WordPerfect_EXEPack.2.sg
│   │   ├── XOPEN+_Protection.2.sg
│   │   ├── Zbikowski_C.4.sg
│   │   ├── Zip.6.sg
│   │   ├── Zortech(Symantec)_C.4.sg
│   │   ├── Zurenava_DOS_Extender.0a.sg
│   │   ├── _LE.0.sg
│   │   ├── _LX.0.sg
│   │   ├── _MSDOS.0.sg
│   │   ├── _NE.0.sg
│   │   ├── _init
│   │   ├── anti-tracing_add-on.1.sg
│   │   ├── compiler_ASIC-Basic.4.sg
│   │   ├── compiler_Ada89.4.sg
│   │   ├── compiler_ApBasic.4.sg
│   │   ├── compiler_BAT2EXEC.4.sg
│   │   ├── compiler_BSTAR_FORTH.4.sg
│   │   ├── compiler_BatLite.4.sg
│   │   ├── compiler_BetterBASIC.4.sg
│   │   ├── compiler_CII-C.4.sg
│   │   ├── compiler_Easy!-C.4.sg
│   │   ├── compiler_GRASP.4.sg
│   │   ├── compiler_MegaBasic.4.sg
│   │   ├── compiler_MegaBasic1.4.sg
│   │   ├── compiler_PCC.4.sg
│   │   ├── compiler_Power_C.4.sg
│   │   ├── compiler_SP-FORTH.4.sg
│   │   ├── compiler_Symantec_BASIC.4.sg
│   │   ├── compiler_Topspeed_C.4.sg
│   │   ├── compiler_Turbo_Basic.4.sg
│   │   ├── compiler_Turbo_Prolog.4.sg
│   │   ├── compiler_WATCOM.4.sg
│   │   ├── compiler_WPFORTH.4.sg
│   │   ├── compiler_djgpp.4.sg
│   │   ├── compiler_muLISP-87.4.sg
│   │   ├── converter_EXE2COM.1.sg
│   │   ├── converter_FromBAT.1.sg
│   │   ├── converter_GRABBER.1.sg
│   │   ├── converter_com2exe.2.sg
│   │   ├── cryptor_EXE-Cryptor.2.sg
│   │   ├── cryptor_TUCCRYP.2.sg
│   │   ├── cryptor_deep-CRyPTer.2.sg
│   │   ├── dos_extender.0a.sg
│   │   ├── dos_extender1.0a.sg
│   │   ├── dos_extender2.0a.sg
│   │   ├── extender_Blinker.0a.sg
│   │   ├── extender_CWSDPMI.0a.sg
│   │   ├── extender_CauseWay_DOS_Extender.6.sg
│   │   ├── extender_DOS32.0a.sg
│   │   ├── extender_DOS4G.0a.sg
│   │   ├── extender_DOSX16.0a.sg
│   │   ├── extender_EMX.0a.sg
│   │   ├── extender_Go32Stub.0a.sg
│   │   ├── extender_PMODE.0a.sg
│   │   ├── extender_PRO32.0a.sg
│   │   ├── extender_RSX.0a.sg
│   │   ├── extender_Stub-386.0a.sg
│   │   ├── extender_TMTSTUB.0a.sg
│   │   ├── extender_WDOSX.0a.sg
│   │   ├── extender_WDOSX32.0a.sg
│   │   ├── extender_XMLOD.0a.sg
│   │   ├── extender_Xtender.0a.sg
│   │   ├── immunizer_CPAV.1.sg
│   │   ├── immunizer_F-XLOCK.1.sg
│   │   ├── immunizer_Oyster.1.sg
│   │   ├── immunizer_PGPROT.1.sg
│   │   ├── immunizer_Palladix.1.sg
│   │   ├── immunizer_TTW.1.sg
│   │   ├── joiner_TurboChainer.1.sg
│   │   ├── joiner_V-Load.1.sg
│   │   ├── library_ParsecCollection.1.sg
│   │   ├── loader_32stub.0a.sg
│   │   ├── mbp_SHRINK.2.sg
│   │   ├── other_AutoHack.1.sg
│   │   ├── other_Coderunner.1.sg
│   │   ├── other_DemoMaker.2.sg
│   │   ├── overlay_overlays.6.sg
│   │   ├── packer_32LiTe.2.sg
│   │   ├── packer_AINEXE.2.sg
│   │   ├── packer_AVPACK.2.sg
│   │   ├── packer_Amisetup.1.sg
│   │   ├── packer_COMPACK.2.sg
│   │   ├── packer_CRYPACK.2.sg
│   │   ├── packer_Compress-EXE.2.sg
│   │   ├── packer_DIET.2.sg
│   │   ├── packer_DSHIELD.2.sg
│   │   ├── packer_DexEXE.2.sg
│   │   ├── packer_EXECUTRIX.2.sg
│   │   ├── packer_EXEPACK.2.sg
│   │   ├── packer_ExeLITE.2.sg
│   │   ├── packer_LGLZ.2.sg
│   │   ├── packer_LZEXE.2.sg
│   │   ├── packer_MSLite.1.sg
│   │   ├── packer_Optlink.2.sg
│   │   ├── packer_PGMPAK.2.sg
│   │   ├── packer_PKEXE.2.sg
│   │   ├── packer_PKLITE.2.sg
│   │   ├── packer_PKTINY.2.sg
│   │   ├── packer_PMWLite.2.sg
│   │   ├── packer_PRO-PACK.2.sg
│   │   ├── packer_Pack.2.sg
│   │   ├── packer_Packers.2.sg
│   │   ├── packer_RERP.2.sg
│   │   ├── packer_RIXEPACK.2.sg
│   │   ├── packer_RJcrush.2.sg
│   │   ├── packer_Relpack.2.sg
│   │   ├── packer_SCRNCH.2.sg
│   │   ├── packer_SEA-AXE.2.sg
│   │   ├── packer_Scramb.2.sg
│   │   ├── packer_Shrinker.2.sg
│   │   ├── packer_TSCRUNCH.2.sg
│   │   ├── packer_Tenth_Planet.2.sg
│   │   ├── packer_TinyProg.2.sg
│   │   ├── packer_Tinyprot.2.sg
│   │   ├── packer_UCEXE.2.sg
│   │   ├── packer_UPX.2.sg
│   │   ├── packer_WWPACK.2.sg
│   │   ├── packer_XPACK.2.sg
│   │   ├── packer_ZIPSCRUB.2.sg
│   │   ├── packer_aPACK.2.sg
│   │   ├── patcher_Patchers.1.sg
│   │   ├── protector_$pirit.2.sg
│   │   ├── protector_ABKprot.2.sg
│   │   ├── protector_AEP.2.sg
│   │   ├── protector_ALEC.2.sg
│   │   ├── protector_ANTI-TRACE.2.sg
│   │   ├── protector_AVAST_CRC-Check.2.sg
│   │   ├── protector_Aluwain.2.sg
│   │   ├── protector_Anti-LAME.2.sg
│   │   ├── protector_Antilame.2.sg
│   │   ├── protector_Bitlok.2.sg
│   │   ├── protector_Bunny.2.sg
│   │   ├── protector_CC.2.sg
│   │   ├── protector_CEPexe.2.sg
│   │   ├── protector_CERBERUS.2.sg
│   │   ├── protector_COMCRYPT.2.sg
│   │   ├── protector_COMPROTECT.2.sg
│   │   ├── protector_CONVOY.2.sg
│   │   ├── protector_CRYPTEXE.2.sg
│   │   ├── protector_China Locker.2.sg
│   │   ├── protector_Ciphator.2.sg
│   │   ├── protector_Codesafe.2.sg
│   │   ├── protector_ComProtector.2.sg
│   │   ├── protector_ComprEXE.2.sg
│   │   ├── protector_Copy_Protector.2.sg
│   │   ├── protector_Copylock_PC.2.sg
│   │   ├── protector_CrAcKeR.2.sg
│   │   ├── protector_CrackStop.2.sg
│   │   ├── protector_Cruncher.2.sg
│   │   ├── protector_CryExe.2.sg
│   │   ├── protector_CryptCom.2.sg
│   │   ├── protector_CrypteXeC.2.sg
│   │   ├── protector_Crypto-box.2.sg
│   │   ├── protector_DCREXE.2.sg
│   │   ├── protector_DMC.2.sg
│   │   ├── protector_Deeper.2.sg
│   │   ├── protector_E-PROT.2.sg
│   │   ├── protector_EEXE.2.sg
│   │   ├── protector_EPW.2.sg
│   │   ├── protector_ETS.1.sg
│   │   ├── protector_EXE-Crypt.2.sg
│   │   ├── protector_EXE-Protect.2.sg
│   │   ├── protector_EXEGUARD.2.sg
│   │   ├── protector_EXEHigh.2.sg
│   │   ├── protector_EXETools.2.sg
│   │   ├── protector_Encriptor.2.sg
│   │   ├── protector_Enkryptonator.2.sg
│   │   ├── protector_ExeCode.2.sg
│   │   ├── protector_ExeLock.2.sg
│   │   ├── protector_FACRYPT.2.sg
│   │   ├── protector_FSE.2.sg
│   │   ├── protector_GA-Header.2.sg
│   │   ├── protector_GOAT.1.sg
│   │   ├── protector_HACKSTOP.2.sg
│   │   ├── protector_HASP.2.sg
│   │   ├── protector_HEALTH.2.sg
│   │   ├── protector_HaSPeX-Protect.2.sg
│   │   ├── protector_Hardlock.2.sg
│   │   ├── protector_Inertia.2.sg
│   │   ├── protector_Int01-Destroyer.2.sg
│   │   ├── protector_Ironthorn.2.sg
│   │   ├── protector_JAM.2.sg
│   │   ├── protector_JmCryptExe.2.sg
│   │   ├── protector_Joke.2.sg
│   │   ├── protector_KeyMaker.2.sg
│   │   ├── protector_Kvetch.2.sg
│   │   ├── protector_LOCK.2.sg
│   │   ├── protector_LOCK91.2.sg
│   │   ├── protector_LamerStop.2.sg
│   │   ├── protector_LockTite+.2.sg
│   │   ├── protector_MEGALITE.2.sg
│   │   ├── protector_MESS.2.sg
│   │   ├── protector_Maker.2.sg
│   │   ├── protector_Mandrake.2.sg
│   │   ├── protector_MutaWWP.2.sg
│   │   ├── protector_Mutate.2.sg
│   │   ├── protector_NOCLIP.2.sg
│   │   ├── protector_NOTA.2.sg
│   │   ├── protector_NTShell.2.sg
│   │   ├── protector_Nodebug.2.sg
│   │   ├── protector_Novex.2.sg
│   │   ├── protector_Overlay.2.sg
│   │   ├── protector_PACKWIN.2.sg
│   │   ├── protector_PC-Guard.2.sg
│   │   ├── protector_PCOM.2.sg
│   │   ├── protector_PROTECT.2.sg
│   │   ├── protector_PVAC.2.sg
│   │   ├── protector_PassEXE.2.sg
│   │   ├── protector_Pksmart.2.sg
│   │   ├── protector_ProtEXE.2.sg
│   │   ├── protector_Protector.2.sg
│   │   ├── protector_Quadru-Lock.2.sg
│   │   ├── protector_R-Crypt.2.sg
│   │   ├── protector_REC.2.sg
│   │   ├── protector_RHC.2.sg
│   │   ├── protector_ROSETINY.2.sg
│   │   ├── protector_SSI-Lock.2.sg
│   │   ├── protector_Secure.2.sg
│   │   ├── protector_SelfChk.2.sg
│   │   ├── protector_Shrink.2.sg
│   │   ├── protector_SnoopStop.2.sg
│   │   ├── protector_SuckStop.2.sg
│   │   ├── protector_TCEC.2.sg
│   │   ├── protector_TraceLock.2.sg
│   │   ├── protector_Trap.2.sg
│   │   ├── protector_Un2pack.2.sg
│   │   ├── protector_UnPackStop.2.sg
│   │   ├── protector_XDOC.2.sg
│   │   ├── protector_aPatch.2.sg
│   │   ├── protector_cramble.2.sg
│   │   ├── protector_iLUCRYPT.2.sg
│   │   ├── protector_nbuild.2.sg
│   │   ├── runtime_VROOMM.4.sg
│   │   ├── self-displayer_ANS2ALL.1.sg
│   │   ├── self-displayer_GIFEXE.1.sg
│   │   ├── self-displayer_RELETTER.1.sg
│   │   ├── self-displayer_SimplyWare.1.sg
│   │   ├── self-displayer_TXT2COM.1.sg
│   │   ├── self-displayer_TXTmaker.1.sg
│   │   ├── self-displayer_Txt2Exe.1.sg
│   │   ├── self-displayer_self-displayer.1.sg
│   │   ├── sfx_ARC.1.sg
│   │   ├── sfx_ARJ.1.sg
│   │   ├── sfx_ChSFX.1.sg
│   │   ├── sfx_EXARJ.1.sg
│   │   ├── sfx_ICE.1.sg
│   │   ├── sfx_LH.1.sg
│   │   ├── sfx_LHA.1.sg
│   │   ├── sfx_LHarc.1.sg
│   │   ├── sfx_PKSFX.1.sg
│   │   ├── sfx_PKZIP-SFX.1.sg
│   │   ├── sfx_PKZIP_mini-sfx.1.sg
│   │   ├── sfx_SFX.1.sg
│   │   ├── sfx_ZOO.1.sg
│   │   ├── unknown_immunizer.1.sg
│   │   └── virus.1.sg
│   ├── NE/
│   │   ├── _NE.0.sg
│   │   ├── _init
│   │   ├── compiler_Borland_C++.1.sg
│   │   ├── compiler_Borland_Pascal.1.sg
│   │   ├── compiler_Watcom_C.1.sg
│   │   ├── game_engine_DirectorPlayer.1.sg
│   │   ├── installer_CoktelVisionInstaller.1.sg
│   │   ├── installer_Setup-Specialist.1.sg
│   │   ├── library_MS_RTL.4.sg
│   │   ├── sfx_ARC_SFX.1.sg
│   │   ├── sfx_PKZIP-SFX.1.sg
│   │   └── sfx_Sydex_SFX.1.sg
│   ├── NPM/
│   │   ├── _NPM.0.sg
│   │   ├── _init
│   │   ├── language_JavaScript.5.sg
│   │   ├── language_TypeScript.5.sg
│   │   └── package_PackageName.1.sg
│   ├── PDF/
│   │   ├── _PDF.0.sg
│   │   ├── _init
│   │   ├── converter_markdown-pdf.3.sg
│   │   ├── converter_mdpdf.3.sg
│   │   ├── format_HeaderComment.2.sg
│   │   ├── format_PersonalData.5.sg
│   │   ├── format_RTSN_secure.1.sg
│   │   └── format_Tools.2.sg
│   ├── PE/
│   │   ├── ACE.6.sg
│   │   ├── Cab.6.sg
│   │   ├── Microsoft.6.sg
│   │   ├── Microsoft_Class_Installer.1.sg
│   │   ├── Microsoft_Compound-based_installer.1.sg
│   │   ├── Microsoft_Help.1.sg
│   │   ├── Microsoft_JScript.6.sg
│   │   ├── _FixDetects.9.sg
│   │   ├── _NetCompilersLibs.4.sg
│   │   ├── _PE.0.sg
│   │   ├── __GenericHeuristicAnalysis_By_DosX.7.sg
│   │   ├── _debug_data.5.sg
│   │   ├── _init
│   │   ├── archive_7z.6.sg
│   │   ├── arj.6.sg
│   │   ├── compiler_BatchToApp.6.sg
│   │   ├── compiler_BeRo_Tiny_Pascal.6.sg
│   │   ├── compiler_Borland_C++.6.sg
│   │   ├── compiler_Cygwin32.4.sg
│   │   ├── compiler_DECFortran.4.sg
│   │   ├── compiler_DMD.6.sg
│   │   ├── compiler_DarkBASIC.4.sg
│   │   ├── compiler_Delphi.4.sg
│   │   ├── compiler_EuroASM.4.sg
│   │   ├── compiler_Excelsior_JET.4.sg
│   │   ├── compiler_FASM.4.sg
│   │   ├── compiler_FreeBasic.6.sg
│   │   ├── compiler_Free_Pascal.6.sg
│   │   ├── compiler_Go.4.sg
│   │   ├── compiler_IBM_VisualAge_C.6.sg
│   │   ├── compiler_IBM_VisualAge_COBOL.6.sg
│   │   ├── compiler_IBM_VisualAge_PL_I.6.sg
│   │   ├── compiler_Intel_C.6.sg
│   │   ├── compiler_Kotlin.4.sg
│   │   ├── compiler_LCC-Win32.4.sg
│   │   ├── compiler_LDC.6.sg
│   │   ├── compiler_LLVM.6.sg
│   │   ├── compiler_Lahey_Fortran_90.4.sg
│   │   ├── compiler_MinGW.6.sg
│   │   ├── compiler_Nim.4.sg
│   │   ├── compiler_Pelles_C.6.sg
│   │   ├── compiler_PerlApp.1.sg
│   │   ├── compiler_PowerBASIC.4.sg
│   │   ├── compiler_PureBasic.4.sg
│   │   ├── compiler_RADBasic.6.sg
│   │   ├── compiler_RealBasic.4.sg
│   │   ├── compiler_RosASM.4.sg
│   │   ├── compiler_Rust.4.sg
│   │   ├── compiler_SpASM.4.sg
│   │   ├── compiler_Swift.6.sg
│   │   ├── compiler_Symantec_C.6.sg
│   │   ├── compiler_TASM32.4.sg
│   │   ├── compiler_Virtual_Pascal.4.sg
│   │   ├── compiler_Visual_Objects.4.sg
│   │   ├── compiler_Visual_Prolog.4.sg
│   │   ├── compiler_Watcom.6.sg
│   │   ├── compiler_WutaoEPL.6.sg
│   │   ├── compiler_Xbase.4.sg
│   │   ├── compiler_Zig.4.sg
│   │   ├── compiler_tcc.6.sg
│   │   ├── compiler_twinBASIC.6.sg
│   │   ├── cryptor_Amber.2.sg
│   │   ├── cryptor_AverCryptor.2.sg
│   │   ├── cryptor_BattleshipCrypter.2.sg
│   │   ├── cryptor_CronosCrypter.1.sg
│   │   ├── cryptor_CryptEngine_MalwareCryptor.2.sg
│   │   ├── cryptor_Duals_eXe_Encryptor.2.sg
│   │   ├── cryptor_EXECryptor.2.sg
│   │   ├── cryptor_Huan.1.sg
│   │   ├── cryptor_KCryptor.2.sg
│   │   ├── cryptor_Kryptonit.2.sg
│   │   ├── cryptor_LimeCrypter.2.sg
│   │   ├── cryptor_NativeCryptor_by_DosX.2.sg
│   │   ├── cryptor_PEUnion.2.sg
│   │   ├── cryptor_RCryptor.2.sg
│   │   ├── cryptor_RDG_Tejon_Crypter.2.sg
│   │   ├── cryptor_ReXCrypter.2.sg
│   │   ├── cryptor_Stones_PE_Encryptor.2.sg
│   │   ├── cryptor_Virogen_Crypt.2.sg
│   │   ├── cryptor_XorCryptor.2.sg
│   │   ├── cryptor_Yodas_Crypter.2.sg
│   │   ├── custom_sfx_installers.1.sg
│   │   ├── dotnet_only/
│   │   │   └── about.txt
│   │   ├── emulator_Wine.3.sg
│   │   ├── engine_AGS.1.sg
│   │   ├── format_AutoHotKey.3.sg
│   │   ├── format_AutoIt.3.sg
│   │   ├── game_engine_Atlas.3.sg
│   │   ├── game_engine_DEV7.3.sg
│   │   ├── game_engine_Director.3.sg
│   │   ├── game_engine_Godot.3.sg
│   │   ├── game_engine_Wintermute.3.sg
│   │   ├── game_engine_XPAT.3.sg
│   │   ├── game_engine_Xash.3.sg
│   │   ├── installer_ACCAStore.1.sg
│   │   ├── installer_AOLSetup.1.sg
│   │   ├── installer_Acronis_installer.1.sg
│   │   ├── installer_Actual_Installer.1.sg
│   │   ├── installer_Adobe_FlashPlayer_downloader.1.sg
│   │   ├── installer_Adobe_installers.1.sg
│   │   ├── installer_Advanced_installer.1.sg
│   │   ├── installer_Adveractive.1.sg
│   │   ├── installer_Aeco_installer.1.sg
│   │   ├── installer_Alchemy_Mindworks_installer.1.sg
│   │   ├── installer_Astrum.1.sg
│   │   ├── installer_AutoPlay_Media_Studio.1.sg
│   │   ├── installer_Autodesk_Self-Extract.1.sg
│   │   ├── installer_AutorunProEnterprise.1.sg
│   │   ├── installer_AutorunProEnterpriseII.1.sg
│   │   ├── installer_BitRock_Installer.1.sg
│   │   ├── installer_Bytessence_Install_Maker.1.sg
│   │   ├── installer_CNetX.1.sg
│   │   ├── installer_CSDD_installer.1.sg
│   │   ├── installer_CZ_installer.1.sg
│   │   ├── installer_Calibre_installer.1.sg
│   │   ├── installer_Chaos_Software_installer.1.sg
│   │   ├── installer_ClickTeam.1.sg
│   │   ├── installer_Codegear_Installer.1.sg
│   │   ├── installer_CreateInstall.1.sg
│   │   ├── installer_CrypKey_Installer.1.sg
│   │   ├── installer_DeployMaster.1.sg
│   │   ├── installer_DesktopX_Installer.1.sg
│   │   ├── installer_Eschalon_installer.1.sg
│   │   ├── installer_Excelsior_Installer.1.sg
│   │   ├── installer_FDM_Installer.1.sg
│   │   ├── installer_GPInstall.1.sg
│   │   ├── installer_Gentee_Installer.1.sg
│   │   ├── installer_Ghost_Installer.1.sg
│   │   ├── installer_Gremlin_Patcher.1.sg
│   │   ├── installer_I-D_Media_installer.1.sg
│   │   ├── installer_IDM_Installer.1.sg
│   │   ├── installer_INTENIUM.1.sg
│   │   ├── installer_Inno_Setup_Module.1.sg
│   │   ├── installer_Instalit.1.sg
│   │   ├── installer_Install4j_installer.1.sg
│   │   ├── installer_InstallAnywhere.1.sg
│   │   ├── installer_InstallShield.1.sg
│   │   ├── installer_InstallUs.1.sg
│   │   ├── installer_Install_Factory.1.sg
│   │   ├── installer_LucasArts_Update_Installer.1.sg
│   │   ├── installer_Miktex_Installer.1.sg
│   │   ├── installer_Mioplanet_installer.1.sg
│   │   ├── installer_Morton_installer.1.sg
│   │   ├── installer_Multimedia_Fusion_Installer.1.sg
│   │   ├── installer_Myriad_Install.1.sg
│   │   ├── installer_NOS_Installer.1.sg
│   │   ├── installer_Nullsoft_Scriptable_Install_System.1.sg
│   │   ├── installer_O'Setup95.1.sg
│   │   ├── installer_PCInstall.1.sg
│   │   ├── installer_PIMP.1.sg
│   │   ├── installer_PackageForTheWeb.1.sg
│   │   ├── installer_Pantaray_QSetup.1.sg
│   │   ├── installer_Paquet_Builder.1.sg
│   │   ├── installer_Quick_Install.1.sg
│   │   ├── installer_RNsetup.1.sg
│   │   ├── installer_SCE_installer.1.sg
│   │   ├── installer_STATICSUP.1.sg
│   │   ├── installer_Setup-Specialist.1.sg
│   │   ├── installer_Setup_Factory.1.sg
│   │   ├── installer_SfxCA.1.sg
│   │   ├── installer_Smart_Install_Maker.1.sg
│   │   ├── installer_Sony_Windows_Installer.1.sg
│   │   ├── installer_Spoon_Installer.1.sg
│   │   ├── installer_Squirrel.1.sg
│   │   ├── installer_SwiftView_installer.1.sg
│   │   ├── installer_Synactis_In-The-Box_Installer.1.sg
│   │   ├── installer_Tarma_Installer.1.sg
│   │   ├── installer_Themepak.1.sg
│   │   ├── installer_UFI_installer.1.sg
│   │   ├── installer_VMWare.1.sg
│   │   ├── installer_Vise.1.sg
│   │   ├── installer_WiX_Toolset_installer.1.sg
│   │   ├── installer_WinRAR_Installer.1.sg
│   │   ├── installer_Winamp_Installer.1.sg
│   │   ├── installer_Windows_Installer.1.sg
│   │   ├── installer_Wise_Installer.1.sg
│   │   ├── installer_Xoreax_installer.1.sg
│   │   ├── installer_distutils.1.sg
│   │   ├── installer_sqx.1.sg
│   │   ├── joiner_Celesty_File_Binder.1.sg
│   │   ├── joiner_ExeSplitter.1.sg
│   │   ├── joiner_FreeJoiner.1.sg
│   │   ├── joiner_MicroJoiner.1.sg
│   │   ├── joiner_N-Joiner.1.sg
│   │   ├── joiner_OxiJoiner.2.sg
│   │   ├── joiner_RJoiner.1.sg
│   │   ├── joiner_SFXRun.1.sg
│   │   ├── joiner_inPEct.1.sg
│   │   ├── library_16Edit.4.sg
│   │   ├── library_7z.4.sg
│   │   ├── library_AMD_FSR.4.sg
│   │   ├── library_AMD_GraphicalServices.4.sg
│   │   ├── library_ASIPort.4.sg
│   │   ├── library_AjaxMin.4.sg
│   │   ├── library_Alibaba_CloudSDK.4.sg
│   │   ├── library_Amazon_CloudWatch.4.sg
│   │   ├── library_Amazon_CloudWatchLogs.4.sg
│   │   ├── library_Amazon_DynamoDB.4.sg
│   │   ├── library_Amazon_ElasticComputeCloudService.4.sg
│   │   ├── library_Amazon_Glue.4.sg
│   │   ├── library_Amazon_Kinesis.4.sg
│   │   ├── library_Amazon_Lambda.4.sg
│   │   ├── library_Amazon_RelationalDatabaseService.4.sg
│   │   ├── library_Amazon_SecretsManager.4.sg
│   │   ├── library_Amazon_SecurityToken.4.sg
│   │   ├── library_Amazon_ServicesSDK.4.sg
│   │   ├── library_Amazon_SimpleEmail.4.sg
│   │   ├── library_Amazon_SimpleQueueService.4.sg
│   │   ├── library_Amazon_SimpleStorageService.4.sg
│   │   ├── library_Amazon_SingleSignOn.4.sg
│   │   ├── library_Amazon_X-Ray.4.sg
│   │   ├── library_AngleSharp.4.sg
│   │   ├── library_Antlr.4.sg
│   │   ├── library_AppleSoftwareUpdate.4.sg
│   │   ├── library_Argon2.4.sg
│   │   ├── library_AtMsg32.4.sg
│   │   ├── library_Atlantic.4.sg
│   │   ├── library_Authorwave.4.sg
│   │   ├── library_Autofac.4.sg
│   │   ├── library_BenchmarkDotNet.4.sg
│   │   ├── library_Boost.4.sg
│   │   ├── library_BrotliSharpLib.4.sg
│   │   ├── library_CUDA-Driver.4.sg
│   │   ├── library_Castle.Net.4.sg
│   │   ├── library_ChilkatNativeLib.4.sg
│   │   ├── library_Chromium_Embedded_Framework.4.sg
│   │   ├── library_Chromium_WebView.4.sg
│   │   ├── library_CliWrap.4.sg
│   │   ├── library_ClosedXML.4.sg
│   │   ├── library_CodeBase.4.sg
│   │   ├── library_CommandLineParser.4.sg
│   │   ├── library_Costura.Fody.4.sg
│   │   ├── library_Crc32_NET.4.sg
│   │   ├── library_Crc_NET.4.sg
│   │   ├── library_CsvHelper.4.sg
│   │   ├── library_D3DRM.4.sg
│   │   ├── library_D3DXOF.4.sg
│   │   ├── library_Dapper.4.sg
│   │   ├── library_DeepCloner.4.sg
│   │   ├── library_Direct2D.4.sg
│   │   ├── library_Direct3D.4.sg
│   │   ├── library_DirectDraw.4.sg
│   │   ├── library_DirectInput.4.sg
│   │   ├── library_DirectSound.4.sg
│   │   ├── library_DirectX.4.sg
│   │   ├── library_DirectorAPI.4.sg
│   │   ├── library_Discord.Net.4.sg
│   │   ├── library_DnsClient.NET.4.sg
│   │   ├── library_Dryloc.4.sg
│   │   ├── library_EAX_Unified.4.sg
│   │   ├── library_EcmaScript_NET.4.sg
│   │   ├── library_Edit_Dev.4.sg
│   │   ├── library_ElectronApp.4.sg
│   │   ├── library_EpicGames.4.sg
│   │   ├── library_ExcelDataReader.4.sg
│   │   ├── library_ExcelNumberFormat.4.sg
│   │   ├── library_ExifLibNet.4.sg
│   │   ├── library_FAAD.4.sg
│   │   ├── library_FFmpeg.4.sg
│   │   ├── library_FastExpressionCompiler.4.sg
│   │   ├── library_FastMember.4.sg
│   │   ├── library_FastRsync_NET.4.sg
│   │   ├── library_Fastenshtein.4.sg
│   │   ├── library_Fasterflect.4.sg
│   │   ├── library_FlashPlayer.1.sg
│   │   ├── library_FluentValidation.4.sg
│   │   ├── library_Fox_Pro.4.sg
│   │   ├── library_FusionCache.4.sg
│   │   ├── library_FuzzySharp.4.sg
│   │   ├── library_GitLabApiClient.4.sg
│   │   ├── library_GoldSrc.3.sg
│   │   ├── library_Google_APIs.4.sg
│   │   ├── library_Google_ProtoBuf.4.sg
│   │   ├── library_Harmony.4.sg
│   │   ├── library_HtmlAgilityPack.4.sg
│   │   ├── library_Humanizer.4.sg
│   │   ├── library_ImageSharp.4.sg
│   │   ├── library_Intel_IPP.4.sg
│   │   ├── library_Intel_TBB.4.sg
│   │   ├── library_Intel_XeSS.4.sg
│   │   ├── library_Irony.4.sg
│   │   ├── library_LCL.5.sg
│   │   ├── library_LINQKit.4.sg
│   │   ├── library_LZMA.4.sg
│   │   ├── library_LazyCache.4.sg
│   │   ├── library_Lego1.4.sg
│   │   ├── library_LibLog.4.sg
│   │   ├── library_LibNoise.4.sg
│   │   ├── library_LibPhoneNumber_NET.4.sg
│   │   ├── library_LibSassBuilder.4.sg
│   │   ├── library_LibVLCSharp.4.sg
│   │   ├── library_LiteDB.4.sg
│   │   ├── library_LoadServ.4.sg
│   │   ├── library_Lua_Runtime.4.sg
│   │   ├── library_MacroMix.4.sg
│   │   ├── library_MailKit.4.sg
│   │   ├── library_ManagedCuda.4.sg
│   │   ├── library_Mapster.4.sg
│   │   ├── library_Markdig.4.sg
│   │   ├── library_MassTransit.4.sg
│   │   ├── library_MediatR.4.sg
│   │   ├── library_MemoryPack.4.sg
│   │   ├── library_MessagePack.4.sg
│   │   ├── library_Microsoft_AzureSDK.4.sg
│   │   ├── library_Microsoft_Azure_SDK.4.sg
│   │   ├── library_Microsoft_C_Runtime.4.sg
│   │   ├── library_Microsoft_Edge_WebView.4.sg
│   │   ├── library_Microsoft_NET_Runtime.4.sg
│   │   ├── library_Microsoft_OpenAPI.4.sg
│   │   ├── library_MilesSoundSystem.4.sg
│   │   ├── library_MimeKit.4.sg
│   │   ├── library_MongoDB.NET.4.sg
│   │   ├── library_MonkeyCache.4.sg
│   │   ├── library_Moq.4.sg
│   │   ├── library_NJsonSchema.4.sg
│   │   ├── library_NSubstitute.4.sg
│   │   ├── library_NUnit.4.sg
│   │   ├── library_Nerdbank.Streams.4.sg
│   │   ├── library_Newtonsoft.Json.4.sg
│   │   ├── library_Ninject.4.sg
│   │   ├── library_NodaTime.4.sg
│   │   ├── library_Nvidia_DLSS.4.sg
│   │   ├── library_Nvidia_PhysX.4.sg
│   │   ├── library_Nvidia_Streamline.4.sg
│   │   ├── library_OodleCompression.4.sg
│   │   ├── library_OpenAI.4.sg
│   │   ├── library_OpenAL.4.sg
│   │   ├── library_OpenCL.4.sg
│   │   ├── library_OpenCV.4.sg
│   │   ├── library_OpenColorIO.4.sg
│   │   ├── library_OpenGL.4.sg
│   │   ├── library_OpenIddict.4.sg
│   │   ├── library_OpenSSL.4.sg
│   │   ├── library_OpenTelemetry.4.sg
│   │   ├── library_OpusAudio.4.sg
│   │   ├── library_PdfPig.4.sg
│   │   ├── library_Perfolizer.4.sg
│   │   ├── library_Perl.3.sg
│   │   ├── library_Plivo.4.sg
│   │   ├── library_Polly.4.sg
│   │   ├── library_PortAudio.4.sg
│   │   ├── library_Python.4.sg
│   │   ├── library_QMixer.4.sg
│   │   ├── library_Qt.4.sg
│   │   ├── library_RADVideoTools.4.sg
│   │   ├── library_RNNoise.4.sg
│   │   ├── library_RabbitMQ.4.sg
│   │   ├── library_RamlToOpenApiConverter.4.sg
│   │   ├── library_RestSharp.4.sg
│   │   ├── library_SDL.4.sg
│   │   ├── library_ScePad.4.sg
│   │   ├── library_ScriptHookV.4.sg
│   │   ├── library_Scrutor.4.sg
│   │   ├── library_SecretRabbitCode.4.sg
│   │   ├── library_Serilog.4.sg
│   │   ├── library_SharpCompress.4.sg
│   │   ├── library_SharpZipLib.4.sg
│   │   ├── library_Sigil.4.sg
│   │   ├── library_SkiaSharp.4.sg
│   │   ├── library_Smacker.4.sg
│   │   ├── library_SmartHeap.4.sg
│   │   ├── library_Snappier.4.sg
│   │   ├── library_Spectre.Console.4.sg
│   │   ├── library_Stackify.4.sg
│   │   ├── library_Starkbank_ECDSA.4.sg
│   │   ├── library_Steam.4.sg
│   │   ├── library_Swashbuckle.AspNetCore.4.sg
│   │   ├── library_TNTSI.4.sg
│   │   ├── library_Tabula.4.sg
│   │   ├── library_Telegram.Bot.4.sg
│   │   ├── library_Twilio.4.sg
│   │   ├── library_Twilio_SendGrid.4.sg
│   │   ├── library_UAParser.4.sg
│   │   ├── library_Unity.4.sg
│   │   ├── library_VFW.4.sg
│   │   ├── library_Vorbis.4.sg
│   │   ├── library_Vulkan.4.sg
│   │   ├── library_WF.Guna.UI2.4.sg
│   │   ├── library_WF.Krypton.4.sg
│   │   ├── library_WF.MetroFramework.4.sg
│   │   ├── library_WF.ReaLTaiizor.4.sg
│   │   ├── library_WF_WPF.MaterialSkin.4.sg
│   │   ├── library_WPF.AvalonEdit.4.sg
│   │   ├── library_WPF.ControlzEx.4.sg
│   │   ├── library_WPF.MahApps_Metro.4.sg
│   │   ├── library_WebActivatorEx.4.sg
│   │   ├── library_WinSparkle.4.sg
│   │   ├── library_WwiseAudioEngine.4.sg
│   │   ├── library_XLive.4.sg
│   │   ├── library_XPatFC.4.sg
│   │   ├── library_Xerces-CPP.4.sg
│   │   ├── library_Xojo.4.sg
│   │   ├── library_YUICompressor_NET.4.sg
│   │   ├── library_YamlDotNet.4.sg
│   │   ├── library_ZstdSharp.4.sg
│   │   ├── library_Zydis.4.sg
│   │   ├── library_combres.4.sg
│   │   ├── library_curl.4.sg
│   │   ├── library_discord-rpc.4.sg
│   │   ├── library_dotless.4.sg
│   │   ├── library_expat_xml_parser.4.sg
│   │   ├── library_gRPC_NET.4.sg
│   │   ├── library_iMuse.4.sg
│   │   ├── library_java.3.sg
│   │   ├── library_libfvad.4.sg
│   │   ├── library_libpng.4.sg
│   │   ├── library_log4net.4.sg
│   │   ├── library_lz4net.4.sg
│   │   ├── library_nClam.4.sg
│   │   ├── library_rlottie.4.sg
│   │   ├── library_sqlite.4.sg
│   │   ├── library_wxWidgets.5.sg
│   │   ├── library_xUnit.net.4.sg
│   │   ├── library_zlib.4.sg
│   │   ├── linkers.6.sg
│   │   ├── marker_AMD_PowerXpress.5.sg
│   │   ├── marker_Nvidia_Optimus.5.sg
│   │   ├── native_only/
│   │   │   └── about.txt
│   │   ├── other_Dolphin_VM.1.sg
│   │   ├── other_FileSplit_Self-Merger.2.sg
│   │   ├── other_GSplit.1.sg
│   │   ├── packer_32LiTe.2.sg
│   │   ├── packer_AHpacker.2.sg
│   │   ├── packer_ANDpakk.2.sg
│   │   ├── packer_ASDPack.2.sg
│   │   ├── packer_ASPack.2.sg
│   │   ├── packer_Advanced_BAT_to_EXE_Converter.2.sg
│   │   ├── packer_AlushPacker.2.sg
│   │   ├── packer_Anskya_NTPacker_Generator.2.sg
│   │   ├── packer_AtomPePacker.2.sg
│   │   ├── packer_BatToExe.2.sg
│   │   ├── packer_BatToExeConverter.2.sg
│   │   ├── packer_BeRoEXEPacker.2.sg
│   │   ├── packer_BoxedApp.2.sg
│   │   ├── packer_CExe.2.sg
│   │   ├── packer_CICompress.2.sg
│   │   ├── packer_Cxfreeze.2.sg
│   │   ├── packer_DxPack.2.sg
│   │   ├── packer_EXE32Pack.2.sg
│   │   ├── packer_ExE_Pack.2.sg
│   │   ├── packer_FSG.2.sg
│   │   ├── packer_Fatpack.2.sg
│   │   ├── packer_HTML_executable.1.sg
│   │   ├── packer_JDPack.2.sg
│   │   ├── packer_KByS.2.sg
│   │   ├── packer_MEW.2.sg
│   │   ├── packer_MPRESS.2.sg
│   │   ├── packer_MoleBox.2.sg
│   │   ├── packer_Mystic_Compressor.2.sg
│   │   ├── packer_NETZ.2.sg
│   │   ├── packer_NOS_Packer.2.sg
│   │   ├── packer_NTPacker.2.sg
│   │   ├── packer_NTShell.2.sg
│   │   ├── packer_NakedPacker.2.sg
│   │   ├── packer_NeoLite.2.sg
│   │   ├── packer_NodeJS_Nexe.2.sg
│   │   ├── packer_NodeJS_Pkg.2.sg
│   │   ├── packer_NsPack.2.sg
│   │   ├── packer_Nuitka.2.sg
│   │   ├── packer_PACKWIN.2.sg
│   │   ├── packer_PE-PACK.sg
│   │   ├── packer_PECompact.2.sg
│   │   ├── packer_PKLITE.2.sg
│   │   ├── packer_Pack_Master.2.sg
│   │   ├── packer_Packanoid.2.sg
│   │   ├── packer_Packman.2.sg
│   │   ├── packer_PeX.2.sg
│   │   ├── packer_Petite.2.sg
│   │   ├── packer_PyInstaller.2.sg
│   │   ├── packer_QuestPowerGUI.2.sg
│   │   ├── packer_RLPack.2.sg
│   │   ├── packer_SC_Pack.2.sg
│   │   ├── packer_SecuPack.2.sg
│   │   ├── packer_SerGreen_Appacker.2.sg
│   │   ├── packer_SimplePackerByEronana.2.sg
│   │   ├── packer_Simple_Pack.2.sg
│   │   ├── packer_Software_Compress.2.sg
│   │   ├── packer_Squishy.2.sg
│   │   ├── packer_TPP_Pack.2.sg
│   │   ├── packer_TheArk.2.sg
│   │   ├── packer_UPX.2.sg
│   │   ├── packer_VPacker.2.sg
│   │   ├── packer_VbsToExeConverter.2.sg
│   │   ├── packer_WWPack32.2.sg
│   │   ├── packer_WinUpack.2.sg
│   │   ├── packer_Windows_PE_Packer_by_Chenzs108.2.sg
│   │   ├── packer_XComp.2.sg
│   │   ├── packer_XPack.2.sg
│   │   ├── packer_aPack.2.sg
│   │   ├── packer_dePACK.2.sg
│   │   ├── packer_ezip.2.sg
│   │   ├── packer_hXOR.2.sg
│   │   ├── packer_hmimys_PE-Pack.2.sg
│   │   ├── packer_kkrunchy.2.sg
│   │   ├── packer_mPack.2.sg
│   │   ├── packer_mkfPack.2.sg
│   │   ├── packer_nPack.2.sg
│   │   ├── packer_netshrink.2.sg
│   │   ├── packer_ps2exe.2.sg
│   │   ├── packer_py2exe.2.sg
│   │   ├── packer_scr2exe.2.sg
│   │   ├── packer_yzPack.2.sg
│   │   ├── patcher_CodeFusion_Wizard.1.sg
│   │   ├── patcher_PMaker.1.sg
│   │   ├── patcher_RPP.1.sg
│   │   ├── patcher_RTPatch.1.sg
│   │   ├── patcher_dUP.1.sg
│   │   ├── patcher_simple_patch.1.sg
│   │   ├── player_Power_Screen_Recorder.1.sg
│   │   ├── protection_BattlEye.5.sg
│   │   ├── protection_DS.Eutron_SmartKey_dongle.5.sg
│   │   ├── protection_DS.HASP_dongle.5.sg
│   │   ├── protection_DS.Hardlock_dongle.5.sg
│   │   ├── protection_DS.MARX_Crypto-Box_dongle.5.sg
│   │   ├── protection_DS.Matrix_Hardware_Lock_dongle.5.sg
│   │   ├── protection_DS.NetHASP_dongle.5.sg
│   │   ├── protection_DS.SenseLock_dongle.5.sg
│   │   ├── protection_DS.Sentinel_SuperPro_dongle.5.sg
│   │   ├── protection_DS.Sentinel_dongle.5.sg
│   │   ├── protection_DS.SoftLok_dongle.5.sg
│   │   ├── protection_DS.Unikey_dongle.5.sg
│   │   ├── protection_DS.WIBU_Key_dongle.5.sg
│   │   ├── protection_HASP_HL_Protection.5.sg
│   │   ├── protection_Microsoft_Warbird.2.sg
│   │   ├── protection_Softlocx.1.sg
│   │   ├── protection_SteamStub.5.sg
│   │   ├── protection_Wibu_Codemeter.1.sg
│   │   ├── protection_obfus_h.5.sg
│   │   ├── protection_obfusheader_h.5.sg
│   │   ├── protector_ACProtect.2.sg
│   │   ├── protector_AHTeam_EP_Protector.2.sg
│   │   ├── protector_ASM_Guard.2.sg
│   │   ├── protector_ASProtect.2.sg
│   │   ├── protector_AT4RE.2.sg
│   │   ├── protector_AZProtect_0001.2.sg
│   │   ├── protector_AbyssMedia_ScriptCryptor.2.sg
│   │   ├── protector_ActiveMark.2.sg
│   │   ├── protector_Agile.2.sg
│   │   ├── protector_Alcatraz.2.sg
│   │   ├── protector_Alienyze.2.sg
│   │   ├── protector_AntiDote.2.sg
│   │   ├── protector_Anticrack_Software.2.sg
│   │   ├── protector_ArmDot.2.sg
│   │   ├── protector_Armadillo.2.sg
│   │   ├── protector_Arxan.2.sg
│   │   ├── protector_BJFnt.2.sg
│   │   ├── protector_Babel_.NET.2.sg
│   │   ├── protector_Berio.2.sg
│   │   ├── protector_ByfronTech.2.sg
│   │   ├── protector_ByteGuard.2.sg
│   │   ├── protector_Cameyo.2.sg
│   │   ├── protector_CliSecure.2.sg
│   │   ├── protector_Code-Lock.2.sg
│   │   ├── protector_CodeCrypt.2.sg
│   │   ├── protector_CodeVeil.2.sg
│   │   ├── protector_Code_Virtualizer.2.sg
│   │   ├── protector_Codewall.2.sg
│   │   ├── protector_Confuser.2.sg
│   │   ├── protector_CopyMinder.2.sg
│   │   ├── protector_Crinkler.2.sg
│   │   ├── protector_Crunch.2.sg
│   │   ├── protector_CrypKey.2.sg
│   │   ├── protector_CrypToCrack.2.sg
│   │   ├── protector_Cryptect.2.sg
│   │   ├── protector_CryptoObfuscator.2.sg
│   │   ├── protector_DBPE.2.sg
│   │   ├── protector_DNGuard.2.sg
│   │   ├── protector_DS.Sentinel_SuperPro.2.sg
│   │   ├── protector_DYAMAR.2.sg
│   │   ├── protector_DZA_Patcher.2.sg
│   │   ├── protector_Daemon_Protect.2.sg
│   │   ├── protector_DalKrypt.2.sg
│   │   ├── protector_DeepSea.2.sg
│   │   ├── protector_Denuvo.2.sg
│   │   ├── protector_DotFix_Nice_Protect.2.sg
│   │   ├── protector_Dotfuscator.2.sg
│   │   ├── protector_DragonArmor.2.sg
│   │   ├── protector_ENIGMA.2.sg
│   │   ├── protector_EXEFog.2.sg
│   │   ├── protector_EXE_Password_Protector.2.sg
│   │   ├── protector_Eazfuscator.2.sg
│   │   ├── protector_Elan_License_Manager.1.sg
│   │   ├── protector_ElecKey.2.sg
│   │   ├── protector_Escargot.2.sg
│   │   ├── protector_Excalibur.2.sg
│   │   ├── protector_ExeShield.2.sg
│   │   ├── protector_ExeStealth.2.sg
│   │   ├── protector_Exe_Guarder.2.sg
│   │   ├── protector_Exe_Shield.2.sg
│   │   ├── protector_FISH_.NET.2.sg
│   │   ├── protector_FishPE_Shield.2.sg
│   │   ├── protector_Fish_PE.2.sg
│   │   ├── protector_FlashBack_Protector.2.sg
│   │   ├── protector_G!X_Protector.2.sg
│   │   ├── protector_GameGuard.2.sg
│   │   ├── protector_Goats_PE_Mutilator.2.sg
│   │   ├── protector_Goliath.2.sg
│   │   ├── protector_HASP.2.sg
│   │   ├── protector_HackShield.2.sg
│   │   ├── protector_Hide&Protect.2.sg
│   │   ├── protector_HidePE.2.sg
│   │   ├── protector_HyperTech_Crackproof.2.sg
│   │   ├── protector_ILProtector.2.sg
│   │   ├── protector_ILUCRYPT.2.sg
│   │   ├── protector_IProtect.2.sg
│   │   ├── protector_Inquartos_Obfuscator.2.sg
│   │   ├── protector_IntelliProtector.2.sg
│   │   ├── protector_InxObfuscator.2.sg
│   │   ├── protector_Jar2exe.1.sg
│   │   ├── protector_KoiVM.2.sg
│   │   ├── protector_Konekt_Protector.2.sg
│   │   ├── protector_Krypton.2.sg
│   │   ├── protector_LARP.2.sg
│   │   ├── protector_LDK.2.sg
│   │   ├── protector_LDK_.NET.2.sg
│   │   ├── protector_LameCrypt.2.sg
│   │   ├── protector_Laserlok.2.sg
│   │   ├── protector_MSLRH.2.sg
│   │   ├── protector_MZ0oPE.2.sg
│   │   ├── protector_MaskPE.2.sg
│   │   ├── protector_Maxtocode.2.sg
│   │   ├── protector_Metrowerks_CodeWarrior.2.sg
│   │   ├── protector_Morphnah.2.sg
│   │   ├── protector_N-Code.2.sg
│   │   ├── protector_N-Joy.2.sg
│   │   ├── protector_NET_Spider.2.sg
│   │   ├── protector_NTkrnl_Protector.2.sg
│   │   ├── protector_NetReactor.2.sg
│   │   ├── protector_NetShield.2.sg
│   │   ├── protector_Ningishzida.2.sg
│   │   ├── protector_NoobyProtect.2.sg
│   │   ├── protector_North_Star_PE_Shrinker.2.sg
│   │   ├── protector_ORiEN.2.sg
│   │   ├── protector_Obfuscar.2.sg
│   │   ├── protector_Obfuscator_NET_2009.2.sg
│   │   ├── protector_Obsidium.2.sg
│   │   ├── protector_OneVM.2.sg
│   │   ├── protector_Oreans_CodeVirtualizer.2.sg
│   │   ├── protector_PACE.2.sg
│   │   ├── protector_PCShrink.2.sg
│   │   ├── protector_PC_Guard.2.sg
│   │   ├── protector_PE-Armor.2.sg
│   │   ├── protector_PE-Shield.2.sg
│   │   ├── protector_PEBundle.2.sg
│   │   ├── protector_PECRYPT32.2.sg
│   │   ├── protector_PELock.2.sg
│   │   ├── protector_PENinja.2.sg
│   │   ├── protector_PESpin.2.sg
│   │   ├── protector_PETetris.2.sg
│   │   ├── protector_PE_Diminisher.2.sg
│   │   ├── protector_PE_Encrypt.2.sg
│   │   ├── protector_PE_Intro.2.sg
│   │   ├── protector_PE_Lock_NT.2.sg
│   │   ├── protector_PE_Lock_Phantasm_by_Ding_Boy.2.sg
│   │   ├── protector_PE_Password.2.sg
│   │   ├── protector_PE_Protect.2.sg
│   │   ├── protector_PEncrypt.2.sg
│   │   ├── protector_PEnguinCrypt.2.sg
│   │   ├── protector_PUNiSHER.2.sg
│   │   ├── protector_Phoenix.2.sg
│   │   ├── protector_Photo_Compiler.2.sg
│   │   ├── protector_PolyCrypt_PE.2.sg
│   │   ├── protector_Private_EXE_Protector.2.sg
│   │   ├── protector_Protect_Disc.2.sg
│   │   ├── protector_Protection_Plus.2.sg
│   │   ├── protector_QrYPt0r.2.sg
│   │   ├── protector_QuickBFC.2.sg
│   │   ├── protector_QuickPack_NT.2.sg
│   │   ├── protector_REVProt.2.sg
│   │   ├── protector_RLP.2.sg
│   │   ├── protector_ReNET-pack.2.sg
│   │   ├── protector_RobustObfuscator.2.sg
│   │   ├── protector_SC_Obfuscator.2.sg
│   │   ├── protector_SDProtector.2.sg
│   │   ├── protector_SLVc0deProtector.2.sg
│   │   ├── protector_SVK_Protector.2.sg
│   │   ├── protector_Safedisc.2.sg
│   │   ├── protector_Safenet_RMS.2.sg
│   │   ├── protector_Safengine_Shielden.2.sg
│   │   ├── protector_SecuROM.2.sg
│   │   ├── protector_Secure_Shade.2.sg
│   │   ├── protector_Shrink_Wrap.2.sg
│   │   ├── protector_Shrinker.2.sg
│   │   ├── protector_SimbiOZ.2.sg
│   │   ├── protector_Sixxpack.2.sg
│   │   ├── protector_Skater.2.sg
│   │   ├── protector_Smart_Assembly.2.sg
│   │   ├── protector_SmokesCrypt.2.sg
│   │   ├── protector_SoftProtect.2.sg
│   │   ├── protector_SoftSentry.2.sg
│   │   ├── protector_Special_EXE_Password_Protector.2.sg
│   │   ├── protector_SpicesNet.2.sg
│   │   ├── protector_StarForce.2.sg
│   │   ├── protector_Ste@lth_PE.2.sg
│   │   ├── protector_Tages.2.sg
│   │   ├── protector_Themida.2.sg
│   │   ├── protector_Thinstall.2.sg
│   │   ├── protector_UG2002_Cruncher.2.sg
│   │   ├── protector_UPX_Protector.2.sg
│   │   ├── protector_UPolyX.2.sg
│   │   ├── protector_UltraPro.2.sg
│   │   ├── protector_VBox.2.sg
│   │   ├── protector_VCasm-Protector.2.sg
│   │   ├── protector_VMProtect.2.sg
│   │   ├── protector_VMProtect_NET.2.sg
│   │   ├── protector_VaySoft_PDF2EXE.2.sg
│   │   ├── protector_VbsToExe.1.sg
│   │   ├── protector_Virbox.2.sg
│   │   ├── protector_XCR.2.sg
│   │   ├── protector_Xenocode_Postbuild.2.sg
│   │   ├── protector_XerinFuscator.2.sg
│   │   ├── protector_Xtreamlok.2.sg
│   │   ├── protector_Yano.2.sg
│   │   ├── protector_Yodas_Protector.2.sg
│   │   ├── protector_Yummy_Game_SoftwareShield.2.sg
│   │   ├── protector_Zprotect.2.sg
│   │   ├── protector_bambam.2.sg
│   │   ├── protector_beria.2.sg
│   │   ├── protector_eXPressor.2.sg
│   │   ├── protector_hmimys_Protect.2.sg
│   │   ├── protector_iPB_Protect.2.sg
│   │   ├── protector_kkryptor.2.sg
│   │   ├── protector_tElock.2.sg
│   │   ├── rar.6.sg
│   │   ├── sfx_12Ghosts_Zip2.1.sg
│   │   ├── sfx_7z.1.sg
│   │   ├── sfx_ARJSFX.1.sg
│   │   ├── sfx_ARQ.1.sg
│   │   ├── sfx_Abbyy_Lingvo.1.sg
│   │   ├── sfx_Active_Delivery.1.sg
│   │   ├── sfx_Cab.1.sg
│   │   ├── sfx_Chilkat_ZIP_Self-Extractor.1.sg
│   │   ├── sfx_CoffeeCup_SFX.2.sg
│   │   ├── sfx_DelZip_SFX.2.sg
│   │   ├── sfx_Dimd_SFX.1.sg
│   │   ├── sfx_Envoy_Packager.1.sg
│   │   ├── sfx_GZip.1.sg
│   │   ├── sfx_GkSetup.1.sg
│   │   ├── sfx_INFTool.1.sg
│   │   ├── sfx_KRZIP_SFX.2.sg
│   │   ├── sfx_LZH_SFX.1.sg
│   │   ├── sfx_Lyme_SFX.1.sg
│   │   ├── sfx_MP-ZipTool.1.sg
│   │   ├── sfx_MPQ.1.sg
│   │   ├── sfx_NanoZip.1.sg
│   │   ├── sfx_PKSFX.1.sg
│   │   ├── sfx_Paquet.1.sg
│   │   ├── sfx_Quantum.1.sg
│   │   ├── sfx_SZDD.1.sg
│   │   ├── sfx_Squeez_SFX.1.sg
│   │   ├── sfx_WinACE.1.sg
│   │   ├── sfx_WinIMP.1.sg
│   │   ├── sfx_WinImage.1.sg
│   │   ├── sfx_WinPatch.1.sg
│   │   ├── sfx_WinRAR.1.sg
│   │   ├── sfx_WinZip.1.sg
│   │   ├── sfx_ZipCentral_SFX.1.sg
│   │   ├── sfx_Zip_SFX.2.sg
│   │   ├── sfx_rar.1.sg
│   │   ├── sign_tool_Windows_Authenticode.7.sg
│   │   ├── tool_AHTeam_UPX_Mutanter.2.sg
│   │   ├── tool_Microsoft_VisualStudio_NET.6.sg
│   │   ├── tool_UPX-Patcher.6.sg
│   │   ├── tool_UPXFreak.2.sg
│   │   ├── tool_UPX_Inliner.2.sg
│   │   ├── tool_UPX_Modifier.2.sg
│   │   ├── tool_UPX_lock.2.sg
│   │   ├── tool_UPX_scrambler.2.sg
│   │   ├── tool_UnoPiX.2.sg
│   │   ├── tool_XVolkolak.6.sg
│   │   ├── tool_de4dot.6.sg
│   │   └── zip.6.sg
│   ├── PNG/
│   │   ├── _PNG.0.sg
│   │   └── _init
│   ├── PYC/
│   │   ├── _PYC.0.sg
│   │   ├── _init
│   │   └── packer_UPP.1.sg
│   ├── QtFramework
│   ├── RAR/
│   │   ├── _RAR.0.sg
│   │   └── _init
│   ├── RosASM
│   ├── SpASM
│   ├── TASM32
│   ├── ZIP/
│   │   ├── _ZIP.0.sg
│   │   └── _init
│   ├── _db_caching
│   ├── _debug
│   ├── _init
│   ├── _runtime_helpers
│   ├── archive-file
│   ├── arj
│   ├── bytecodeparsers
│   ├── cab
│   ├── chunkparsers
│   ├── duration
│   ├── language
│   ├── python
│   ├── rar-file
│   ├── read
│   ├── shell-script
│   ├── soundchips
│   ├── vgmcodingutils
│   ├── wxWidgets
│   ├── zip-file
│   └── zlib
├── db_compress.cmd
├── db_custom/
│   └── .vscode/
│       ├── about.txt
│       └── settings.json
├── db_extra/
│   ├── .vscode/
│   │   ├── about.txt
│   │   └── settings.json
│   ├── COM/
│   │   ├── packer_packers.2.sg
│   │   └── patcher_patchers.1.sg
│   ├── ELF/
│   │   └── protector_ELFCrypt.2.sg
│   ├── MSDOS/
│   │   ├── cryptor_Cryptors.2.sg
│   │   └── packer_FCP_IV.2.sg
│   ├── PE/
│   │   ├── archive_Resources.6.sg
│   │   ├── compiler_EP.MSC.4.sg
│   │   ├── compiler_EP.MSVC.4.sg
│   │   ├── cryptor_3dcrypter.2.sg
│   │   ├── cryptor_404crypter.1.sg
│   │   ├── cryptor_ABC_Cryptor.2.sg
│   │   ├── cryptor_AR_Crypt_Private.2.sg
│   │   ├── cryptor_Aase_Crypter.2.sg
│   │   ├── cryptor_AcidCrypt.2.sg
│   │   ├── cryptor_AlmafuerteCrypter.1.sg
│   │   ├── cryptor_Anslym_Crypter.2.sg
│   │   ├── cryptor_App_Encryptor.2.sg
│   │   ├── cryptor_BasicCrypt1.1.sg
│   │   ├── cryptor_BopCrypt.2.sg
│   │   ├── cryptor_ChainskiCrypter.1.sg
│   │   ├── cryptor_CodeCrypter.2.sg
│   │   ├── cryptor_Crypter.2.sg
│   │   ├── cryptor_Cryptic.2.sg
│   │   ├── cryptor_DCrypt_Private.2.sg
│   │   ├── cryptor_DataAnubis.1.sg
│   │   ├── cryptor_Fly-Crypter.2.sg
│   │   ├── cryptor_FreeCryptor.2.sg
│   │   ├── cryptor_INCrypter.2.sg
│   │   ├── cryptor_Open_Source_Code_Crypter.2.sg
│   │   ├── cryptor_STUD.2.sg
│   │   ├── cryptor_SexCrypt.2.sg
│   │   ├── cryptor_Sexe_Crypter.2.sg
│   │   ├── cryptor_Simple_UPX_Cryptor.2.sg
│   │   ├── cryptor_The_Best_Cryptor.2.sg
│   │   ├── cryptor_ass-crypter.2.sg
│   │   ├── cryptor_darkeye.1.sg
│   │   ├── cryptor_njCrypter.2.sg
│   │   ├── cryptor_unknown_malware_cryptor.2.sg
│   │   ├── cryptors_1.2.sg
│   │   ├── cryptors_2.2.sg
│   │   ├── insatller_Avast_installer.sg
│   │   ├── installer_Adobe_Flash_Player_installer.1.sg
│   │   ├── installer_Blizzard_PrePatch.1.sg
│   │   ├── installer_Box_Stub.1.sg
│   │   ├── installer_BulletProofSoft_installer.1.sg
│   │   ├── installer_DockerDesktopInstaller.1.sg
│   │   ├── installer_Enigma_Installer.1.sg
│   │   ├── installer_Hamrick_Software_installer.1.sg
│   │   ├── installer_Kingsoft_Installer.1.sg
│   │   ├── installer_QT_installer.1.sg
│   │   ├── installer_SHIROUZU_Hiroaki_installer.1.sg
│   │   ├── installer_Store_Installer.1.sg
│   │   ├── installer_TrueCrypt-VeraCrypt_installer.1.sg
│   │   ├── joiner_Anskya_Binder.2.sg
│   │   ├── joiner_Blade_Joiner.1.sg
│   │   ├── joiner_DJoin.1.sg
│   │   ├── joiner_ExeJoiner.1.sg
│   │   ├── keygen_keygens.1.sg
│   │   ├── library_DS.Flexlm.4.sg
│   │   ├── library_DS.RLM.4.sg
│   │   ├── packer_BobPack.2.sg
│   │   ├── packer_Feokt.2.sg
│   │   ├── packer_IMPostor_Pack.2.sg
│   │   ├── packer_Native_UD_Packer.2.sg
│   │   ├── packer_TomatoX.2.sg
│   │   ├── packer_bbfb.2.sg
│   │   ├── patcher_Patch.1.sg
│   │   ├── protection_DS.Key-Lok_II_dongle.5.sg
│   │   ├── protection_DS.Novex_dongle.4.sg
│   │   ├── protection_DS.Rockey4_dongle.5.sg
│   │   ├── protection_DS.Wizzkey_dongle.5.sg
│   │   ├── protector_ARM_Protector.2.sg
│   │   ├── protector_ASPR_Stripper.2.sg
│   │   ├── protector_Adept_Protector.2.sg
│   │   ├── protector_Alex_Protector.2.sg
│   │   ├── protector_Alloy.2.sg
│   │   ├── protector_Apex-c.2.sg
│   │   ├── protector_BitShape_PE_Crypt.2.sg
│   │   ├── protector_BlindSpot.2.sg
│   │   ├── protector_Break_Into_Pattern.2.sg
│   │   ├── protector_CDS_SS.2.sg
│   │   ├── protector_CodeSafe.2.sg
│   │   ├── protector_DEF.2.sg
│   │   ├── protector_DirTy_CrYpt0r.2.sg
│   │   ├── protector_EP.2.sg
│   │   ├── protector_EXECrypt.2.sg
│   │   ├── protector_EXERefactor.2.sg
│   │   ├── protector_Embed_PE.2.sg
│   │   ├── protector_EncryptPE.2.sg
│   │   ├── protector_ExeSafeguard.2.sg
│   │   ├── protector_ExeSmasher.2.sg
│   │   ├── protector_Exe_Locker.2.sg
│   │   ├── protector_FakeNinja.2.sg
│   │   ├── protector_FixupPak.2.sg
│   │   ├── protector_Fuck_n_Joy.2.sg
│   │   ├── protector_Fusion.2.sg
│   │   ├── protector_GuardantStealth.2.sg
│   │   ├── protector_ICrypt.2.sg
│   │   ├── protector_ID_Application_Protector_NoNamePacker.2.sg
│   │   ├── protector_KGCrypt.2.sg
│   │   ├── protector_MZ-Crypt.2.sg
│   │   ├── protector_Minke.2.sg
│   │   ├── protector_Morphine.2.sg
│   │   ├── protector_NecroVM.Virt.2.sg
│   │   ├── protector_NoodleCrypt.2.sg
│   │   ├── protector_PE-Admin.2.sg
│   │   ├── protector_PENightMare.2.sg
│   │   ├── protector_PE_Quake.2.sg
│   │   ├── protector_Pe123.2.sg
│   │   ├── protector_PolyEnE.2.sg
│   │   ├── protector_PwdProtect.2.sg
│   │   ├── protector_QQProtect.2.sg
│   │   ├── protector_Sepanta.2.sg
│   │   ├── protector_Soft_Defender.2.sg
│   │   ├── protector_TheHypers.2.sg
│   │   ├── protector_WinKript.2.sg
│   │   ├── protector_Wind_of_Crypt.2.sg
│   │   ├── protector_Xtreme-Protector.2.sg
│   │   ├── protector_muckis_protector.2.sg
│   │   ├── sfx_ADS_Self_Extractor.1.sg
│   │   ├── sfx_CipherWall.1.sg
│   │   ├── tool_UPX_shit.2.sg
│   │   ├── tool_UPXcrypter.2.sg
│   │   └── virus_Win9x_CIH.1.sg
│   └── about.txt
├── dbs_min/
│   ├── db/
│   │   ├── .vscode/
│   │   │   ├── about.txt
│   │   │   └── settings.json
│   │   ├── ACE
│   │   ├── APK/
│   │   │   ├── _APK.0.sg
│   │   │   ├── _init
│   │   │   ├── library_IL2CPP.4.sg
│   │   │   ├── library_SandHook.4.sg
│   │   │   ├── library_UnicomSDK.4.sg
│   │   │   ├── library_Unity.4.sg
│   │   │   ├── package_PackageName.1.sg
│   │   │   ├── packer_Kony.2.sg
│   │   │   ├── protector_APKProtect.2.sg
│   │   │   ├── protector_APKProtector.2.sg
│   │   │   ├── protector_AlibabaProtection.2.sg
│   │   │   ├── protector_AndroidRepublic.2.sg
│   │   │   ├── protector_AppGuard.2.sg
│   │   │   ├── protector_AppSolid.2.sg
│   │   │   ├── protector_BaiduProtection.2.sg
│   │   │   ├── protector_BangBangReinforcement.2.sg
│   │   │   ├── protector_BangcleProtection.2.sg
│   │   │   ├── protector_DXShield.2.sg
│   │   │   ├── protector_DexProtector.2.sg
│   │   │   ├── protector_DingXiangReinforcement.2.sg
│   │   │   ├── protector_EasyShield.2.sg
│   │   │   ├── protector_ExTrus_AppDefence.2.sg
│   │   │   ├── protector_Gemalto.2.sg
│   │   │   ├── protector_Hdus-Wjus.2.sg
│   │   │   ├── protector_Ijiami.2.sg
│   │   │   ├── protector_Jiagu.2.sg
│   │   │   ├── protector_Kiro.2.sg
│   │   │   ├── protector_Kiwi.2.sg
│   │   │   ├── protector_LIAPP.2.sg
│   │   │   ├── protector_MedusaH.2.sg
│   │   │   ├── protector_MobileTencentProtect.2.sg
│   │   │   ├── protector_NQShield.2.sg
│   │   │   ├── protector_NagaPTProtection.2.sg
│   │   │   ├── protector_OLLVM-TTL.2.sg
│   │   │   ├── protector_Obfuscapk.2.sg
│   │   │   ├── protector_PangXie.2.sg
│   │   │   ├── protector_ProGuard.2.sg
│   │   │   ├── protector_QDBH.2.sg
│   │   │   ├── protector_Qihoo360Protection.2.sg
│   │   │   ├── protector_SecNeo.2.sg
│   │   │   ├── protector_SecShell.2.sg
│   │   │   ├── protector_TencentLegu.2.sg
│   │   │   ├── protector_TencentProtection.2.sg
│   │   │   ├── protector_TencentSecurity.2.sg
│   │   │   ├── protector_TongfuShield.2.sg
│   │   │   ├── protector_VDog.2.sg
│   │   │   ├── protector_Virbox.2.sg
│   │   │   ├── protector_Yidun.2.sg
│   │   │   ├── protector_build38.2.sg
│   │   │   ├── protector_iCrypt.2.sg
│   │   │   ├── tool_ApktoolPlus.6.sg
│   │   │   └── tool_SingleJar.3.sg
│   │   ├── Amiga/
│   │   │   ├── AMOS_Basic.4.sg
│   │   │   ├── AMOS_Compiler_Cruncher.1.sg
│   │   │   ├── Absoft_AC_Basic.4.sg
│   │   │   ├── Absoft_Fortran.4.sg
│   │   │   ├── Amiga_E.4.sg
│   │   │   ├── Amiga_font.1.sg
│   │   │   ├── Aztec_C.4.sg
│   │   │   ├── BHC3_Relocatable.1.sg
│   │   │   ├── BPack_SFX.1.sg
│   │   │   ├── Blitz_BASIC.4.sg
│   │   │   ├── ByteKiller_Clone.1.sg
│   │   │   ├── Chryseis_Cruncher.1.sg
│   │   │   ├── Crunch_Master.1.sg
│   │   │   ├── DICE_C.4.sg
│   │   │   ├── DMS_FMS-Masher.1.sg
│   │   │   ├── Deluxe_Cruncher.1.sg
│   │   │   ├── Free_Pascal.4.sg
│   │   │   ├── GNU_C.4.sg
│   │   │   ├── HQC_Cruncher.1.sg
│   │   │   ├── HiSoft_Basic.4.sg
│   │   │   ├── High_Pressure_Cruncher.1.sg
│   │   │   ├── Jan_Heweliusz_Cruncher.1.sg
│   │   │   ├── Lattice_C.4.sg
│   │   │   ├── LhPak_SFX.1.sg
│   │   │   ├── Master_Cruncher.1.sg
│   │   │   ├── Maxon_C++.4.sg
│   │   │   ├── RexxMasher_(jrms).1.sg
│   │   │   ├── Sound-Tracker_Cruncher.1.sg
│   │   │   ├── Storm_C.4.sg
│   │   │   ├── TNM_Cruncher.1.sg
│   │   │   ├── TSK_Cruncher.1.sg
│   │   │   ├── Time_Cruncher.1.sg
│   │   │   ├── Titanics_Cruncher.1.sg
│   │   │   ├── Turtle_Smasher.1.sg
│   │   │   ├── Ultimate_Packer.1.sg
│   │   │   ├── _Amiga.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_ABasic.4.sg
│   │   │   ├── compiler_AmigaBasic.4.sg
│   │   │   ├── compiler_GFA-Basic.4.sg
│   │   │   ├── compiler_JForth.4.sg
│   │   │   ├── compiler_Multi-Forth.4.sg
│   │   │   ├── compiler_Oberon-A.4.sg
│   │   │   ├── compiler_PureBasic.4.sg
│   │   │   ├── compiler_VBCC.4.sg
│   │   │   ├── cruncher_AddressHead.1.sg
│   │   │   ├── cruncher_ByteKiller.1.sg
│   │   │   ├── cruncher_CopyCat.1.sg
│   │   │   ├── cruncher_Cranker.1.sg
│   │   │   ├── cruncher_Crunch-Mania.1.sg
│   │   │   ├── cruncher_Crunch-O-Matic.1.sg
│   │   │   ├── cruncher_Crunch.1.sg
│   │   │   ├── cruncher_CrunchyDat.1.sg
│   │   │   ├── cruncher_Defjam.1.sg
│   │   │   ├── cruncher_DoubleAction.1.sg
│   │   │   ├── cruncher_DragPack.1.sg
│   │   │   ├── cruncher_FileShield.1.sg
│   │   │   ├── cruncher_FlashSpeed.1.sg
│   │   │   ├── cruncher_GnuPacker.1.sg
│   │   │   ├── cruncher_House.1.sg
│   │   │   ├── cruncher_ISC.1.sg
│   │   │   ├── cruncher_Imploder.1.sg
│   │   │   ├── cruncher_MOPacker.1.sg
│   │   │   ├── cruncher_MaxPacker.1.sg
│   │   │   ├── cruncher_MegaCruncher.1.sg
│   │   │   ├── cruncher_PackIt.1.sg
│   │   │   ├── cruncher_Pak.1.sg
│   │   │   ├── cruncher_PowerPacker.1.sg
│   │   │   ├── cruncher_ProPack.1.sg
│   │   │   ├── cruncher_ReXXMaSHeR.1.sg
│   │   │   ├── cruncher_Relokit.1.sg
│   │   │   ├── cruncher_S-Exec.1.sg
│   │   │   ├── cruncher_Shrinkler.1.sg
│   │   │   ├── cruncher_Spike.1.sg
│   │   │   ├── cruncher_StoneCracker.1.sg
│   │   │   ├── cruncher_Super-Cruncher.1.sg
│   │   │   ├── cruncher_SyncroPacker.1.sg
│   │   │   ├── cruncher_TUC.1.sg
│   │   │   ├── cruncher_TetraCrunch.1.sg
│   │   │   ├── cruncher_TetraPack.1.sg
│   │   │   ├── cruncher_TryIt.1.sg
│   │   │   ├── cruncher_TurboSqueezer.1.sg
│   │   │   ├── cruncher_xpkmaster.1.sg
│   │   │   ├── joiner_ETA.1.sg
│   │   │   ├── joiner_EXP.1.sg
│   │   │   ├── joiner_Glue.1.sg
│   │   │   ├── library_library.1.sg
│   │   │   ├── module_DeliTracker.1.sg
│   │   │   ├── other_other.1.sg
│   │   │   ├── self-displayer_DPS.1.sg
│   │   │   ├── self-displayer_Iff2ex.1.sg
│   │   │   ├── self-displayer_S-Anim.1.sg
│   │   │   ├── self-displayer_S-Pic.1.sg
│   │   │   ├── sfx_DIMP.1.sg
│   │   │   ├── sfx_DMSSFX.1.sg
│   │   │   ├── sfx_LHASFX.1.sg
│   │   │   ├── sfx_LHSFX.1.sg
│   │   │   ├── tool_EFFECT-loader.1.sg
│   │   │   └── tool_VideoTracker.1.sg
│   │   ├── Archive/
│   │   │   ├── _Archive.0.sg
│   │   │   └── _init
│   │   ├── AtariST/
│   │   │   ├── _AtariST.0.sg
│   │   │   └── _init
│   │   ├── Binary/
│   │   │   ├── Amiga_loadable.1.sg
│   │   │   ├── Certificate_cert.WinAuth.1.sg
│   │   │   ├── RIFF.1.sg
│   │   │   ├── ROM_1.sg
│   │   │   ├── U-Boot.1.sg
│   │   │   ├── __MiniExtensionsHeuristic_By_DosX.7.sg
│   │   │   ├── __MiniJavaScriptHeuristic_By_DosX.7.sg
│   │   │   ├── _init
│   │   │   ├── archive.ACE.1.sg
│   │   │   ├── archive.ARJ.1.sg
│   │   │   ├── archive.DEFLATE.1.sg
│   │   │   ├── archive.LZ4.1.sg
│   │   │   ├── archive.MS_Compound.1.sg
│   │   │   ├── archive.PC_Secure.sg
│   │   │   ├── archive.RAR.1.sg
│   │   │   ├── archive.ZIP.1.sg
│   │   │   ├── archive.ZLIB.1.sg
│   │   │   ├── archive_7z.1.sg
│   │   │   ├── archive_ANC-Cruncher.1.sg
│   │   │   ├── archive_AR.1.sg
│   │   │   ├── archive_ARC.1.sg
│   │   │   ├── archive_ASAR.1.sg
│   │   │   ├── archive_BCSAR.1.sg
│   │   │   ├── archive_BZip.1.sg
│   │   │   ├── archive_CCA.1.sg
│   │   │   ├── archive_CFL3.1.sg
│   │   │   ├── archive_CKP.1.sg
│   │   │   ├── archive_Cab.1.sg
│   │   │   ├── archive_DAA.1.sg
│   │   │   ├── archive_DCP.1.sg
│   │   │   ├── archive_DXA.1.sg
│   │   │   ├── archive_DatPack.1.sg
│   │   │   ├── archive_DotBundle.sg
│   │   │   ├── archive_EdgeDataPak.1.sg
│   │   │   ├── archive_Flatpak.1.sg
│   │   │   ├── archive_GhidraZipFile.1.sg
│   │   │   ├── archive_GodotPCK.1.sg
│   │   │   ├── archive_HIP.1.sg
│   │   │   ├── archive_IFP.1.sg
│   │   │   ├── archive_IPW.1.sg
│   │   │   ├── archive_InnoSetup.1.sg
│   │   │   ├── archive_JAM.1.sg
│   │   │   ├── archive_LAB.1.sg
│   │   │   ├── archive_LRZ.1.sg
│   │   │   ├── archive_LZOP.1.sg
│   │   │   ├── archive_MCS.1.sg
│   │   │   ├── archive_MS-WIM.1.sg
│   │   │   ├── archive_MWD.1.sg
│   │   │   ├── archive_P2L.1.sg
│   │   │   ├── archive_PAK.1.sg
│   │   │   ├── archive_PBP.1.sg
│   │   │   ├── archive_PEA.1.sg
│   │   │   ├── archive_PKG.1.sg
│   │   │   ├── archive_PSARC.1.sg
│   │   │   ├── archive_PUP.1.sg
│   │   │   ├── archive_RVZ.1.sg
│   │   │   ├── archive_STK.1.sg
│   │   │   ├── archive_Shaped.1.sg
│   │   │   ├── archive_TRE.1.sg
│   │   │   ├── archive_Unity.1.sg
│   │   │   ├── archive_UnrealEngine.1.sg
│   │   │   ├── archive_ViseInstaller.1.sg
│   │   │   ├── archive_XZP.1.sg
│   │   │   ├── archive_ZPAQ.1.sg
│   │   │   ├── archive_archives.1.sg
│   │   │   ├── archive_archives.ancient.sg
│   │   │   ├── archive_btoa.1.sg
│   │   │   ├── archive_cad.DWG.1.sg
│   │   │   ├── archive_gp7bank.1.sg
│   │   │   ├── audio.1.sg
│   │   │   ├── audio_8svx.1.sg
│   │   │   ├── audio_ACM.1.sg
│   │   │   ├── audio_ADX.1.sg
│   │   │   ├── audio_AHX.1.sg
│   │   │   ├── audio_AIF.1.sg
│   │   │   ├── audio_AU.1.sg
│   │   │   ├── audio_BCSTM.1.sg
│   │   │   ├── audio_BCWAV.1.sg
│   │   │   ├── audio_CXT.1.sg
│   │   │   ├── audio_DSS.1.sg
│   │   │   ├── audio_EXA.1.sg
│   │   │   ├── audio_FLAC.1.sg
│   │   │   ├── audio_FSB.1.sg
│   │   │   ├── audio_HMI.1.sg
│   │   │   ├── audio_OGG.1.sg
│   │   │   ├── audio_PAF.1.sg
│   │   │   ├── audio_PVF.1.sg
│   │   │   ├── audio_RIFF-IMA.1.sg
│   │   │   ├── audio_SOU.1.sg
│   │   │   ├── audio_STRM.1.sg
│   │   │   ├── audio_STRM.2.sg
│   │   │   ├── audio_ShockwaveAudio.1.sg
│   │   │   ├── audio_TUN.1.sg
│   │   │   ├── audio_VOC.1.sg
│   │   │   ├── audio_WAV.1.sg
│   │   │   ├── audio_WEM.1.sg
│   │   │   ├── audio_mp3.2.sg
│   │   │   ├── backup_images.1.sg
│   │   │   ├── bin.Atari_ST.1.sg
│   │   │   ├── bin.IDA.1.sg
│   │   │   ├── bin.ISO_9660.1.sg
│   │   │   ├── bin.RPGMaker2Kdata.1.sg
│   │   │   ├── data_overlay_null_padding.1.sg
│   │   │   ├── data_overlays.6.sg
│   │   │   ├── debug_data_debugData.1.sg
│   │   │   ├── font.ADOBE.1.sg
│   │   │   ├── font_BMF.1.sg
│   │   │   ├── font_FFN.1.sg
│   │   │   ├── font_TFM.1.sg
│   │   │   ├── font_VTF.1.sg
│   │   │   ├── font_XTT.1.sg
│   │   │   ├── format_AS.1.sg
│   │   │   ├── format_AmigaIcon.1.sg
│   │   │   ├── format_BCD1.1.sg
│   │   │   ├── format_BOU.1.sg
│   │   │   ├── format_BSP.1.sg
│   │   │   ├── format_BTF.1.sg
│   │   │   ├── format_BackupMii.1.sg
│   │   │   ├── format_CCD.1.sg
│   │   │   ├── format_CSO.1.sg
│   │   │   ├── format_CTRK.1.sg
│   │   │   ├── format_CURE.1.sg
│   │   │   ├── format_CVM.1.sg
│   │   │   ├── format_DESKTOP.1.sg
│   │   │   ├── format_DSW.1.sg
│   │   │   ├── format_DTA.1.sg
│   │   │   ├── format_Director.1.sg
│   │   │   ├── format_DunkleSchattenConfig.1.sg
│   │   │   ├── format_DunkleSchattenSave.1.sg
│   │   │   ├── format_Empty.1.sg
│   │   │   ├── format_FAS.1.sg
│   │   │   ├── format_FLDB.1.sg
│   │   │   ├── format_FNX.1.sg
│   │   │   ├── format_FST.1.sg
│   │   │   ├── format_GAL.1.sg
│   │   │   ├── format_GBI.1.sg
│   │   │   ├── format_GME.1.sg
│   │   │   ├── format_GameMaps.1.sg
│   │   │   ├── format_GamingRoot.1.sg
│   │   │   ├── format_HIV.1.sg
│   │   │   ├── format_HNM.1.sg
│   │   │   ├── format_HSM.1.sg
│   │   │   ├── format_ILK.1.sg
│   │   │   ├── format_IPCH.1.sg
│   │   │   ├── format_ITL.1.sg
│   │   │   ├── format_IVF.1.sg
│   │   │   ├── format_Img.UDIF.1.sg
│   │   │   ├── format_InnoSetupUninstall.1.sg
│   │   │   ├── format_InterleafFile.1.sg
│   │   │   ├── format_LCA.1.sg
│   │   │   ├── format_LGX.1.sg
│   │   │   ├── format_LIXS.1.sg
│   │   │   ├── format_LVL.1.sg
│   │   │   ├── format_MAT.1.sg
│   │   │   ├── format_MDL.1.sg
│   │   │   ├── format_MDS.1.sg
│   │   │   ├── format_MS-DBG.1.sg
│   │   │   ├── format_MS-PST.sg
│   │   │   ├── format_MS-VHD.1.sg
│   │   │   ├── format_MS-VHDX.sg
│   │   │   ├── format_MS-XNA.1.sg
│   │   │   ├── format_OBC.1.sg
│   │   │   ├── format_OpenSSH.1.sg
│   │   │   ├── format_P7X.1.sg
│   │   │   ├── format_PAT.1.sg
│   │   │   ├── format_PDB.1.sg
│   │   │   ├── format_PEM.1.sg
│   │   │   ├── format_PGP.1.sg
│   │   │   ├── format_POL.1.sg
│   │   │   ├── format_PRI.1.sg
│   │   │   ├── format_PS-X.1.sg
│   │   │   ├── format_PSM2CFG.1.sg
│   │   │   ├── format_RARREG.1.sg
│   │   │   ├── format_RCK.1.sg
│   │   │   ├── format_RCO.1.sg
│   │   │   ├── format_RGS.1.sg
│   │   │   ├── format_RedShirt.1.sg
│   │   │   ├── format_SDI.1.sg
│   │   │   ├── format_SFK.1.sg
│   │   │   ├── format_SHBIN.1.sg
│   │   │   ├── format_SLN.1.sg
│   │   │   ├── format_SLNX.1.sg
│   │   │   ├── format_SSHPublicKey.1.sg
│   │   │   ├── format_SystemErr.1.sg
│   │   │   ├── format_TLB.1.sg
│   │   │   ├── format_TOT.1.sg
│   │   │   ├── format_TPU.1.sg
│   │   │   ├── format_UCM.1.sg
│   │   │   ├── format_UPC.1.sg
│   │   │   ├── format_UPF.1.sg
│   │   │   ├── format_UPI.1.sg
│   │   │   ├── format_VDI.1.sg
│   │   │   ├── format_VM2.1.sg
│   │   │   ├── format_VTF.1.sg
│   │   │   ├── format_VVD.1.sg
│   │   │   ├── format_W3D.1.sg
│   │   │   ├── format_WASM.1.sg
│   │   │   ├── format_WBFS.1.sg
│   │   │   ├── format_XBE.1.sg
│   │   │   ├── format_XBF.1.sg
│   │   │   ├── format_XCG.1.sg
│   │   │   ├── format_XCI.1.sg
│   │   │   ├── format_XCR.1.sg
│   │   │   ├── format_XCS.1.sg
│   │   │   ├── format_XDelta.1.sg
│   │   │   ├── format_XEX.1.sg
│   │   │   ├── format_ZZDATA.1.sg
│   │   │   ├── format_ZinsSAV.1.sg
│   │   │   ├── format_bin.AAALogo.1.sg
│   │   │   ├── format_bin.COL.1.sg
│   │   │   ├── format_bin.GuitarPro.1.sg
│   │   │   ├── format_bin.Hermes.1.sg
│   │   │   ├── format_bin.JMDL.1.sg
│   │   │   ├── format_bin.JSC.1.sg
│   │   │   ├── format_bin.Java.1.sg
│   │   │   ├── format_bin.KeePass.1.sg
│   │   │   ├── format_bin.LUA.1.sg
│   │   │   ├── format_bin.NVA.1.sg
│   │   │   ├── format_bin.Nintendo-certified-file.1.sg
│   │   │   ├── format_bin.PEFF.1.sg
│   │   │   ├── format_bin.PalmFile.1.sg
│   │   │   ├── format_bin.Python.1.sg
│   │   │   ├── format_bin.SWF.1.sg
│   │   │   ├── format_bin.VCF.1.sg
│   │   │   ├── format_bin.WindowsIconCacheDB.1.sg
│   │   │   ├── format_database.SQLite.1.sg
│   │   │   ├── format_databases.1.sg
│   │   │   ├── format_doc.CHM.1.sg
│   │   │   ├── format_doc.DJVU.1.sg
│   │   │   ├── format_doc.HLP.1.sg
│   │   │   ├── format_doc.PDF.1.sg
│   │   │   ├── format_doc.RTF.1.sg
│   │   │   ├── format_iCalender.1.sg
│   │   │   ├── format_img.VM.1.sg
│   │   │   ├── format_text.RegistryFile.sg
│   │   │   ├── format_text.pdb.1.sg
│   │   │   ├── format_text.plaintext.3.sg
│   │   │   ├── format_video.BIK.1.sg
│   │   │   ├── format_video.BK2.1.sg
│   │   │   ├── format_video.FLV.1.sg
│   │   │   ├── format_video.MOV.1.sg
│   │   │   ├── format_video.MP4.1.sg
│   │   │   ├── format_video.Matroska.1.sg
│   │   │   ├── format_video.RobotAnimation.1.sg
│   │   │   ├── format_video.Smacker.1.sg
│   │   │   ├── format_video.VMD.1.sg
│   │   │   ├── formats.1.sg
│   │   │   ├── graphics.1.sg
│   │   │   ├── image.PNG.1.sg
│   │   │   ├── image_ANI.1.sg
│   │   │   ├── image_BMP.1.sg
│   │   │   ├── image_CUR.1.sg
│   │   │   ├── image_DDS.1.sg
│   │   │   ├── image_EPS.1.sg
│   │   │   ├── image_FSH.1.sg
│   │   │   ├── image_GIF.1.sg
│   │   │   ├── image_ICNS.sg
│   │   │   ├── image_ICO.1.sg
│   │   │   ├── image_IMG.1.sg
│   │   │   ├── image_JNG.1.sg
│   │   │   ├── image_JPEG.1.sg
│   │   │   ├── image_JPEGXL.1.sg
│   │   │   ├── image_KTX.1.sg
│   │   │   ├── image_LBM.1.sg
│   │   │   ├── image_MNG.1.sg
│   │   │   ├── image_PCX.1.sg
│   │   │   ├── image_PSD.1.sg
│   │   │   ├── image_PVR.1.sg
│   │   │   ├── image_QOI.1.sg
│   │   │   ├── image_SMDH.1.sg
│   │   │   ├── image_TGA.1.sg
│   │   │   ├── image_TIFF.1.sg
│   │   │   ├── image_XAR.1.sg
│   │   │   ├── image_XCF.1.sg
│   │   │   ├── image_bin.ZBMP.1.sg
│   │   │   ├── image_heuristic.image.HDR.1.sg
│   │   │   ├── protector_javascript-obfuscator.2.sg
│   │   │   ├── rom_32X.1.sg
│   │   │   ├── script_text.Shell.1.sg
│   │   │   ├── shellcode.pe_to_shellcode.1.sg
│   │   │   ├── shellcode_donut.1.sg
│   │   │   ├── shellcode_srdi-monoxgas.1.sg
│   │   │   ├── source_text.HTML.1.sg
│   │   │   ├── source_text.Pascal.1.sg
│   │   │   ├── source_text.XML.1.sg
│   │   │   ├── source_text.c.1.sg
│   │   │   ├── source_text.python.1.sg
│   │   │   ├── text.script.2.sg
│   │   │   └── win_resources.1.sg
│   │   ├── Borland
│   │   ├── CFBF/
│   │   │   ├── Microsoft_Installer.1.sg
│   │   │   ├── Microsoft_Office.1.sg
│   │   │   ├── _CFBF.0.sg
│   │   │   └── _init
│   │   ├── COM/
│   │   │   ├── 32-bit_crypt.2.sg
│   │   │   ├── COM_Sccrambler.2.sg
│   │   │   ├── Character_Intro_Engine.1.sg
│   │   │   ├── Crypt_(CyPoxl).2.sg
│   │   │   ├── Crypt_(Dismember).2.sg
│   │   │   ├── Deep_Crypter.2.sg
│   │   │   ├── Dn.COM_Cruncher.2.sg
│   │   │   ├── Inbuild_Encryption.2.sg
│   │   │   ├── LHarc_SFX.1.sg
│   │   │   ├── Maveriks_C0der.2.sg
│   │   │   ├── Microsoft_C.4.sg
│   │   │   ├── Microsoft_RTL.3.sg
│   │   │   ├── MrHDKiller_Protection.2.sg
│   │   │   ├── PC_FORTH.4.sg
│   │   │   ├── RDT_ENC_3.2.sg
│   │   │   ├── RTD_Compressor.2.sg
│   │   │   ├── RTD_Compressor2.2.sg
│   │   │   ├── SHOW_IT.1.sg
│   │   │   ├── SPHINX_C--.4.sg
│   │   │   ├── Shade's_COM_Encryptor.2.sg
│   │   │   ├── Shadow_COM_encryptor.2.sg
│   │   │   ├── TPC_Scramble.2.sg
│   │   │   ├── Text_Header.1.sg
│   │   │   ├── The_DRAW.1.sg
│   │   │   ├── Tiny_Xor.2.sg
│   │   │   ├── Unknown_cryptors.2.sg
│   │   │   ├── VGA_font_loader.1.sg
│   │   │   ├── VSF&K_protection.2.sg
│   │   │   ├── WSP_self_update.2.sg
│   │   │   ├── WiZ_Cryptor.2.sg
│   │   │   ├── _COM.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_8086_Forth_83.4.sg
│   │   │   ├── compiler_ASIC-Basic.4.sg
│   │   │   ├── compiler_BAT2EXEC.2.sg
│   │   │   ├── compiler_BatLite.4.sg
│   │   │   ├── compiler_Borland_C++.4.sg
│   │   │   ├── compiler_Datalight_C.4.sg
│   │   │   ├── compiler_Easy!-C.4.sg
│   │   │   ├── compiler_Fig-FORTH.4.sg
│   │   │   ├── compiler_ForthCMP.2.sg
│   │   │   ├── compiler_ForthCMP.4.sg
│   │   │   ├── compiler_GP-FORTH.4.sg
│   │   │   ├── compiler_Lattice_C.4.sg
│   │   │   ├── compiler_MICRO-C.4.sg
│   │   │   ├── compiler_MINIFORTH.4.sg
│   │   │   ├── compiler_MoonRock.2.sg
│   │   │   ├── compiler_OUTFORTH.4.sg
│   │   │   ├── compiler_PBFC.2.sg
│   │   │   ├── compiler_RMCOBOL.4.sg
│   │   │   ├── compiler_SP-FORTH.4.sg
│   │   │   ├── compiler_Surpas-86.4.sg
│   │   │   ├── compiler_TCOM.4.sg
│   │   │   ├── compiler_Turbo_C++.4.sg
│   │   │   ├── compiler_Turbo_C.4.sg
│   │   │   ├── compiler_Turbo_Pascal.4.sg
│   │   │   ├── compiler_UNIFORTH.4.sg
│   │   │   ├── compiler_Vienna-C.4.sg
│   │   │   ├── compiler_Watcom_C.4.sg
│   │   │   ├── compiler_Zbikowski_C.4.sg
│   │   │   ├── compiler_Zortech_C.4.sg
│   │   │   ├── compiler_muSIMP-83.4.sg
│   │   │   ├── converter_A3E.1.sg
│   │   │   ├── converter_AutoCracker.1.sg
│   │   │   ├── converter_COM2TXT.1.sg
│   │   │   ├── converter_COMT.1.sg
│   │   │   ├── converter_CRX2COM.1.sg
│   │   │   ├── converter_E2C.1.sg
│   │   │   ├── converter_EXE2COM.1.sg
│   │   │   ├── converter_EXETools_EXE2COM.1.sg
│   │   │   ├── converter_FIXCRK.1.sg
│   │   │   ├── converter_FromBAT.1.sg
│   │   │   ├── converter_MAKEBOO.1.sg
│   │   │   ├── converter_NetCode.1.sg
│   │   │   ├── converter_NetRun.1.sg
│   │   │   ├── converter_TurboBAT.1.sg
│   │   │   ├── converter_Vacsina.4.sg
│   │   │   ├── converter_XCK2COM.1.sg
│   │   │   ├── cryptor_Anti-Lamer_Cryptor.2.sg
│   │   │   ├── cryptor_CSCRYPT.2.sg
│   │   │   ├── cryptor_EXINCT.2.sg
│   │   │   ├── cryptor_J0B_cryptor.2.sg
│   │   │   ├── cryptor_PU-Cryptor.2.sg
│   │   │   ├── cryptor_Phrozen_Crew_cryptor.2.sg
│   │   │   ├── cryptor_SDW.2.sg
│   │   │   ├── cryptor_Sydex.2.sg
│   │   │   ├── cryptor_UComCry.1.sg
│   │   │   ├── cryptor_USCC.2.sg
│   │   │   ├── cryptor_cryptors.2.sg
│   │   │   ├── driver_DIGPAK.1.sg
│   │   │   ├── driver_MIDPAK.1.sg
│   │   │   ├── immunizer_ARF_AV_Inject.1.sg
│   │   │   ├── immunizer_CPAV.1.sg
│   │   │   ├── immunizer_F-XLOCK.1.sg
│   │   │   ├── immunizer_IMMUN.1.sg
│   │   │   ├── immunizer_TAV.1.sg
│   │   │   ├── immunizer_VSS.1.sg
│   │   │   ├── other_XLOADER.2.sg
│   │   │   ├── other_integrity_checker.1.sg
│   │   │   ├── packer_4kZIP.2.sg
│   │   │   ├── packer_AVPACK.2.sg
│   │   │   ├── packer_COMPACK.2.sg
│   │   │   ├── packer_Cheat_packer.2.sg
│   │   │   ├── packer_Compressor.2.sg
│   │   │   ├── packer_CyberWare_Packer.2.sg
│   │   │   ├── packer_Diet.2.sg
│   │   │   ├── packer_EXC.2.sg
│   │   │   ├── packer_ICE.1.sg
│   │   │   ├── packer_LGLZ.2.sg
│   │   │   ├── packer_PKLITE.2.sg
│   │   │   ├── packer_PRO-PACK.2.sg
│   │   │   ├── packer_SCRE2B.2.sg
│   │   │   ├── packer_SCRNCH.2.sg
│   │   │   ├── packer_SHRINK.2.sg
│   │   │   ├── packer_Scramb.2.sg
│   │   │   ├── packer_Six-2-Four.2.sg
│   │   │   ├── packer_TPACK.2.sg
│   │   │   ├── packer_Triplex.2.sg
│   │   │   ├── packer_UPX.2.sg
│   │   │   ├── packer_X-PACK.2.sg
│   │   │   ├── packer_XE.2.sg
│   │   │   ├── packer_XPACK.2.sg
│   │   │   ├── packer_aPACK.2.sg
│   │   │   ├── packer_com_RLE_packer.2.sg
│   │   │   ├── packer_envelope.2.sg
│   │   │   ├── protector_ABK-Scrambler.2.sg
│   │   │   ├── protector_ACE_Scrambler.2.sg
│   │   │   ├── protector_AVAST-Protect.2.sg
│   │   │   ├── protector_AdFlt.2.sg
│   │   │   ├── protector_Adys_COM-Scrambler.2.sg
│   │   │   ├── protector_Anti-hack_encryption_system.2.sg
│   │   │   ├── protector_BIN-Lock.2.sg
│   │   │   ├── protector_Best_Protection_Kit-B.2.sg
│   │   │   ├── protector_BinCOD.2.sg
│   │   │   ├── protector_Budokan.1.sg
│   │   │   ├── protector_C-crypt.2.sg
│   │   │   ├── protector_CC#3.2.sg
│   │   │   ├── protector_CC.2.sg
│   │   │   ├── protector_CC286.2.sg
│   │   │   ├── protector_CCC.2.sg
│   │   │   ├── protector_CHECKPRG.2.sg
│   │   │   ├── protector_CNT.2.sg
│   │   │   ├── protector_COM-Protect.2.sg
│   │   │   ├── protector_COM-Protection.2.sg
│   │   │   ├── protector_COMCRYPT.2.sg
│   │   │   ├── protector_COMPROTECT.2.sg
│   │   │   ├── protector_COP.2.sg
│   │   │   ├── protector_CodeLock.2.sg
│   │   │   ├── protector_Codesafe.2.sg
│   │   │   ├── protector_ComProt.2.sg
│   │   │   ├── protector_ComProtector.2.sg
│   │   │   ├── protector_Comlock.2.sg
│   │   │   ├── protector_CrAcKeR.2.sg
│   │   │   ├── protector_Crack2EXE.1.sg
│   │   │   ├── protector_CryptCom.2.sg
│   │   │   ├── protector_Crypto-King.2.sg
│   │   │   ├── protector_DCFR.2.sg
│   │   │   ├── protector_DS-CRP.2.sg
│   │   │   ├── protector_Deeper.2.sg
│   │   │   ├── protector_E2C-Scrambler.2.sg
│   │   │   ├── protector_E2C1.2.sg
│   │   │   ├── protector_EPW.2.sg
│   │   │   ├── protector_EXETools.2.sg
│   │   │   ├── protector_Encriptor.2.sg
│   │   │   ├── protector_Entropy_Coder.2.sg
│   │   │   ├── protector_ExOM.2.sg
│   │   │   ├── protector_FCRYPT.2.sg
│   │   │   ├── protector_GOAT.2.sg
│   │   │   ├── protector_Guardian_Angel.2.sg
│   │   │   ├── protector_HDKPROTC.2.sg
│   │   │   ├── protector_HackStop.2.sg
│   │   │   ├── protector_IntroC0der.1.sg
│   │   │   ├── protector_Keygen_crypt.2.sg
│   │   │   ├── protector_Khrome_Crypt.2.sg
│   │   │   ├── protector_LAME_GG.2.sg
│   │   │   ├── protector_LAMPROT.2.sg
│   │   │   ├── protector_Lock-Master.2.sg
│   │   │   ├── protector_MASK.2.sg
│   │   │   ├── protector_MCLock.2.sg
│   │   │   ├── protector_MESS.2.sg
│   │   │   ├── protector_MSCC.2.sg
│   │   │   ├── protector_MegaShield.2.sg
│   │   │   ├── protector_Microxor.2.sg
│   │   │   ├── protector_NH.2.sg
│   │   │   ├── protector_NoAV.2.sg
│   │   │   ├── protector_Nodebug.2.sg
│   │   │   ├── protector_PCOM.2.sg
│   │   │   ├── protector_PCRYPT.2.sg
│   │   │   ├── protector_PCVault-Protect.2.sg
│   │   │   ├── protector_PROTECT.2.sg
│   │   │   ├── protector_PTP.2.sg
│   │   │   ├── protector_PassCOM.2.sg
│   │   │   ├── protector_Propellerhead_encryption.2.sg
│   │   │   ├── protector_ProtEXE.2.sg
│   │   │   ├── protector_R-Crypt.2.sg
│   │   │   ├── protector_RCC.2.sg
│   │   │   ├── protector_RSCC.2.sg
│   │   │   ├── protector_SCC.2.sg
│   │   │   ├── protector_SCRAM.2.sg
│   │   │   ├── protector_Scrambler.2.sg
│   │   │   ├── protector_Scrypt!.2.sg
│   │   │   ├── protector_Scrypt.2.sg
│   │   │   ├── protector_SelfCrypt.2.sg
│   │   │   ├── protector_SelfProtect386.2.sg
│   │   │   ├── protector_SnoopStop.2.sg
│   │   │   ├── protector_SoftGuard.1.sg
│   │   │   ├── protector_Steplock.2.sg
│   │   │   ├── protector_TCEC.2.sg
│   │   │   ├── protector_UnPackStop.2.sg
│   │   │   ├── protector_UniCrypt.1.sg
│   │   │   ├── protector_Venus.2.sg
│   │   │   ├── protector_XORCOPY.2.sg
│   │   │   ├── protector_XcomOR.2.sg
│   │   │   ├── protector_XoReR.2.sg
│   │   │   ├── protector_XorCom.2.sg
│   │   │   ├── protector_aPatch.2.sg
│   │   │   ├── protector_acBBS_protection.2.sg
│   │   │   ├── protector_com-crypt.2.sg
│   │   │   ├── protector_fds-cp.2.sg
│   │   │   ├── protector_mCrypt.2.sg
│   │   │   ├── protector_protection.2.sg
│   │   │   ├── protector_spirit.2.sg
│   │   │   ├── protector_sticker.2.sg
│   │   │   ├── protector_x3.2.sg
│   │   │   ├── self-displayer_ACiDDRAW.1.sg
│   │   │   ├── self-displayer_ANS2ALL.1.sg
│   │   │   ├── self-displayer_ASC2COM.1.sg
│   │   │   ├── self-displayer_DOC2COM.1.sg
│   │   │   ├── self-displayer_DOC2PAGE.1.sg
│   │   │   ├── self-displayer_GTXT.1.sg
│   │   │   ├── self-displayer_HYPDOC.1.sg
│   │   │   ├── self-displayer_List.1.sg
│   │   │   ├── self-displayer_MakeRead.1.sg
│   │   │   ├── self-displayer_ONLINE-HELP.1.sg
│   │   │   ├── self-displayer_PFL2COM.1.sg
│   │   │   ├── self-displayer_RELETTER.1.sg
│   │   │   ├── self-displayer_SHOWV20.1.sg
│   │   │   ├── self-displayer_TXT2COM.1.sg
│   │   │   ├── self-displayer_TXTmaker.1.sg
│   │   │   ├── self-displayer_Txt2Exe.1.sg
│   │   │   ├── self-displayer_readme.com.1.sg
│   │   │   ├── sfx_LHA.1.sg
│   │   │   ├── sfx_PKZip.1.sg
│   │   │   ├── simple_ansi_viewer.1.sg
│   │   │   ├── simple_self-displayer.1.sg
│   │   │   └── virus.1.sg
│   │   ├── CurIcoBPP
│   │   ├── DEX/
│   │   │   ├── _DEX.0.sg
│   │   │   ├── _DEX2.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_dexlib2.4.sg
│   │   │   ├── library_UnicomSDK.4.sg
│   │   │   ├── obfuscator_ProGuard.2.sg
│   │   │   ├── protector_AESObfuscator.2.sg
│   │   │   ├── protector_APKProtect.2.sg
│   │   │   ├── protector_AlibabaProtection.2.sg
│   │   │   ├── protector_AllatoriObfuscator.2.sg
│   │   │   ├── protector_ApkEncryptor.2.sg
│   │   │   ├── protector_AppSolid.2.sg
│   │   │   ├── protector_BaiduProtection.2.sg
│   │   │   ├── protector_BangcleProtection.2.sg
│   │   │   ├── protector_EasyProtector.2.sg
│   │   │   ├── protector_Jiagu.2.sg
│   │   │   ├── protector_Kiwi.2.sg
│   │   │   ├── protector_LIAPP.2.sg
│   │   │   ├── protector_MedusaH.2.sg
│   │   │   ├── protector_ModGuard.2.sg
│   │   │   ├── protector_NQShield.2.sg
│   │   │   ├── protector_NagaPTProtection.2.sg
│   │   │   ├── protector_PangXie.2.sg
│   │   │   ├── protector_QDBH.2.sg
│   │   │   ├── protector_SecNeo.2.sg
│   │   │   ├── protector_TencentProtection.2.sg
│   │   │   ├── protector_VDog.2.sg
│   │   │   ├── protector_Yidun.2.sg
│   │   │   └── tool_ApkToolPlus.6.sg
│   │   ├── DOS16M/
│   │   │   ├── _DOS16M.0.sg
│   │   │   ├── _init
│   │   │   └── compiler_Watcom.2.sg
│   │   ├── DOS4G/
│   │   │   ├── _DOS4G.0.sg
│   │   │   ├── _init
│   │   │   └── compiler_Watcom.2.sg
│   │   ├── ELF/
│   │   │   ├── Borland_Kylix.4.sg
│   │   │   ├── Free_Pascal.4.sg
│   │   │   ├── HP_C++.4.sg
│   │   │   ├── IBM_AIX_kernel_loader.4.sg
│   │   │   ├── Oracle_Solaris_Studio.4.sg
│   │   │   ├── _ELF.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_DMD.4.sg
│   │   │   ├── compiler_FASM.4.sg
│   │   │   ├── compiler_Go.4.sg
│   │   │   ├── compiler_MWCC.4.sg
│   │   │   ├── compiler_Rust.4.sg
│   │   │   ├── compiler_VBCC.4.sg
│   │   │   ├── compiler_Watcom.4.sg
│   │   │   ├── compiler_Zig.4.sg
│   │   │   ├── compiler_gcc.4.sg
│   │   │   ├── compiler_gdc.4.sg
│   │   │   ├── compiler_ldc.4.sg
│   │   │   ├── compiler_movfuscator.4.sg
│   │   │   ├── library_Curl.4.sg
│   │   │   ├── library_FFmpeg.4.sg
│   │   │   ├── library_FLAC.4.sg
│   │   │   ├── library_Flexlm.4.sg
│   │   │   ├── library_FluidSynth.4.sg
│   │   │   ├── library_FreeType.4.sg
│   │   │   ├── library_GLEW.4.sg
│   │   │   ├── library_GLIBC.3.sg
│   │   │   ├── library_LZMA.4.sg
│   │   │   ├── library_Lego1.4.sg
│   │   │   ├── library_MPEG2.4.sg
│   │   │   ├── library_Mikmod.4.sg
│   │   │   ├── library_OGG.4.sg
│   │   │   ├── library_OpenAL.4.sg
│   │   │   ├── library_PulseAudio.4.sg
│   │   │   ├── library_QT.3.sg
│   │   │   ├── library_SDL.3.sg
│   │   │   ├── packer_Ezuri.1.sg
│   │   │   ├── packer_PyInstaller.2.sg
│   │   │   ├── packer_UPX.2.sg
│   │   │   ├── packer_Virbox.2.sg
│   │   │   ├── packer_exepak.1.sg
│   │   │   ├── protector_Burneye.2.sg
│   │   │   └── protector_HASP.1.sg
│   │   ├── FASM
│   │   ├── FPC
│   │   ├── IPA/
│   │   │   └── _init
│   │   ├── ISO9660/
│   │   │   ├── _ISO9660.0.sg
│   │   │   ├── _init
│   │   │   ├── bootloader_Grub.1.sg
│   │   │   ├── filesystem_AppleHFS.1.sg
│   │   │   ├── iso_Rimage.1.sg
│   │   │   ├── library_IMAPI.1.sg
│   │   │   ├── library_IMAPI2.1.sg
│   │   │   ├── library_libburn.1.sg
│   │   │   ├── library_libisoburn.1.sg
│   │   │   ├── library_libisofs.1.sg
│   │   │   ├── partition_EFI_PART.1.sg
│   │   │   ├── tool_CDBurnerXP.1.sg
│   │   │   ├── tool_CDIMAGE.1.sg
│   │   │   ├── tool_CeQuadrat.1.sg
│   │   │   ├── tool_ImgBurn.1.sg
│   │   │   ├── tool_MKARCHISO.1.sg
│   │   │   ├── tool_NeroBurningROM.1.sg
│   │   │   ├── tool_PersonalRomMaker.1.sg
│   │   │   ├── tool_QuickToPix.1.sg
│   │   │   ├── tool_RoxioToast.1.sg
│   │   │   ├── tool_UltraISO.1.sg
│   │   │   ├── tool_WinISO.1.sg
│   │   │   ├── tool_genisoimage.1.sg
│   │   │   └── tool_xorriso.1.sg
│   │   ├── Image/
│   │   │   ├── _Image.0.sg
│   │   │   └── _init
│   │   ├── JAR/
│   │   │   ├── _JAR.0.sg
│   │   │   ├── _init
│   │   │   └── tool_SingleJar.3.sg
│   │   ├── JPEG/
│   │   │   ├── _Jpeg.0.sg
│   │   │   ├── _init
│   │   │   ├── camera_camera.2.sg
│   │   │   ├── image_DQT.4.sg
│   │   │   ├── image_comment.4.sg
│   │   │   └── tool_Tools.3.sg
│   │   ├── JavaClass/
│   │   │   ├── _JavaClass.0.sg
│   │   │   └── _init
│   │   ├── LE/
│   │   │   ├── _LE.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_Watcom_C.4.sg
│   │   │   └── packer_UPX.1.sg
│   │   ├── LX/
│   │   │   ├── _LX.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_Borland_C.4.sg
│   │   │   └── compiler_Watcom_C.4.sg
│   │   ├── MACH/
│   │   │   ├── _MACH.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_Delphi.4.sg
│   │   │   ├── compiler_Rust.4.sg
│   │   │   ├── compiler_Zig.4.sg
│   │   │   ├── compiler_gcc.4.sg
│   │   │   ├── library_Carbon.3.sg
│   │   │   ├── library_Cocoa.3.sg
│   │   │   ├── library_QT.3.sg
│   │   │   ├── library_WebKit.3.sg
│   │   │   ├── library_java.3.sg
│   │   │   ├── packer_UPX.2.sg
│   │   │   └── packer_Virbox.2.sg
│   │   ├── MACHOFAT/
│   │   │   ├── _MACHOFAT.0.sg
│   │   │   ├── _init
│   │   │   └── converter_lipo.2.sg
│   │   ├── MFC
│   │   ├── MSDOS/
│   │   │   ├── ACE.6.sg
│   │   │   ├── Adys_COM2EXE.1.sg
│   │   │   ├── Adys_Glue.2.sg
│   │   │   ├── Anti-hack_encryption_system.2.sg
│   │   │   ├── Aztec_C-86.4.sg
│   │   │   ├── BlackWolf_Protection.2.sg
│   │   │   ├── Black_fist.2.sg
│   │   │   ├── Borland_C.4.sg
│   │   │   ├── Borland_Pascal.4.sg
│   │   │   ├── Borland_RTM.0a.sg
│   │   │   ├── Borland_TDS.5.sg
│   │   │   ├── Borland_TLINK.5.sg
│   │   │   ├── CSCRYPT_Pro.2.sg
│   │   │   ├── Concurrent_Small_C.4.sg
│   │   │   ├── CopyQM_SFX.1.sg
│   │   │   ├── Crypt_(Dismember).2.sg
│   │   │   ├── Crypt_(LightShow).2.sg
│   │   │   ├── DAEMON_Protect.2.sg
│   │   │   ├── DOS32_loader.0a.sg
│   │   │   ├── DOS_16M.0a.sg
│   │   │   ├── DOS_32A.0a.sg
│   │   │   ├── Digital_Research_C.4.sg
│   │   │   ├── Disk_eXPress.1.sg
│   │   │   ├── EMMXXXX0_check.0a.sg
│   │   │   ├── EXETools_COM2EXE.1.sg
│   │   │   ├── EXE_Manager.2.sg
│   │   │   ├── EXE_Packer.2.sg
│   │   │   ├── EXE_encryption.2.sg
│   │   │   ├── Eliashim's_CodeTrack.1.sg
│   │   │   ├── File_Shield.1.sg
│   │   │   ├── Fitted_Modula-2.4.sg
│   │   │   ├── GFX_to_EXE.1.sg
│   │   │   ├── GamBit_Pro_Library.1.sg
│   │   │   ├── GameWizard_DOS_Extender.0a.sg
│   │   │   ├── Graphic_WorkShop.1.sg
│   │   │   ├── Guardian_Angel.2.sg
│   │   │   ├── H+BEDV_SelfCheck.1.sg
│   │   │   ├── Header_Changer.2.sg
│   │   │   ├── Hi-Tech_C.4.sg
│   │   │   ├── HyperLOCK_386.2.sg
│   │   │   ├── IBM_PC_Pascal.4.sg
│   │   │   ├── John_Socha_Library.3.sg
│   │   │   ├── Khrome_Crypt.2.sg
│   │   │   ├── LSI_C.4.sg
│   │   │   ├── L_O_V_E__FORTH.4.sg
│   │   │   ├── Lahey_Fortran.4.sg
│   │   │   ├── Lattice_C.4.sg
│   │   │   ├── Logitech_Modula-2.4.sg
│   │   │   ├── Meridian_Ada.4.sg
│   │   │   ├── Meridian_Pascal.4.sg
│   │   │   ├── MetaWare_High_C.4.sg
│   │   │   ├── MetaWare_Professional_Pascal.4.sg
│   │   │   ├── Micro_Focus_Cobol.4.sg
│   │   │   ├── Micro_Focus_DOS_extender.0a.sg
│   │   │   ├── Microsoft_Basic.4.sg
│   │   │   ├── Microsoft_C.4.sg
│   │   │   ├── Microsoft_C_Library.3.sg
│   │   │   ├── Microsoft_Fortran.4.sg
│   │   │   ├── Microsoft_Quick_Basic.4.sg
│   │   │   ├── Microsoft_Quick_Pascal.4.sg
│   │   │   ├── Microsoft_RTL.3.sg
│   │   │   ├── Microsoft_RTL_(Clipper).3.sg
│   │   │   ├── MultiLoop_Protection.2.sg
│   │   │   ├── Netware_loader.1.sg
│   │   │   ├── PDC_Prolog.4.sg
│   │   │   ├── PK_sig.1.sg
│   │   │   ├── PROPACK_SFX.1.sg
│   │   │   ├── Pacific_C.4.sg
│   │   │   ├── Panda_immunizer.1.sg
│   │   │   ├── Pascal_MT+86.4.sg
│   │   │   ├── Phar_Lap.0a.sg
│   │   │   ├── RAR.6.sg
│   │   │   ├── REC_small.1.sg
│   │   │   ├── REC_small_AV.1.sg
│   │   │   ├── RLE_com-packer.2.sg
│   │   │   ├── RM_FORTRAN.4.sg
│   │   │   ├── RTLink_VM_Manager.0a.sg
│   │   │   ├── RTPatch_SFX.1.sg
│   │   │   ├── Realia_Cobol.4.sg
│   │   │   ├── Realia_SPITBOL.4.sg
│   │   │   ├── SHOW_IT.1.sg
│   │   │   ├── Self_UnStuffer.2.sg
│   │   │   ├── Small_C.4.sg
│   │   │   ├── StonyBrook_Pascal.4.sg
│   │   │   ├── Sydex_SFX.1.sg
│   │   │   ├── Topspeed_Modula.4.sg
│   │   │   ├── UR_FORTH.4.sg
│   │   │   ├── Unknown_cryptors.2.sg
│   │   │   ├── Upper_Deck_Forth.4.sg
│   │   │   ├── Visual_Cobol.4.sg
│   │   │   ├── WWPACK_mutator.2.sg
│   │   │   ├── Whitesmiths_C.4.sg
│   │   │   ├── Window_book.1.sg
│   │   │   ├── Wizardy_protection.1.sg
│   │   │   ├── WordPerfect_EXEPack.2.sg
│   │   │   ├── XOPEN+_Protection.2.sg
│   │   │   ├── Zbikowski_C.4.sg
│   │   │   ├── Zip.6.sg
│   │   │   ├── Zortech(Symantec)_C.4.sg
│   │   │   ├── Zurenava_DOS_Extender.0a.sg
│   │   │   ├── _LE.0.sg
│   │   │   ├── _LX.0.sg
│   │   │   ├── _MSDOS.0.sg
│   │   │   ├── _NE.0.sg
│   │   │   ├── _init
│   │   │   ├── anti-tracing_add-on.1.sg
│   │   │   ├── compiler_ASIC-Basic.4.sg
│   │   │   ├── compiler_Ada89.4.sg
│   │   │   ├── compiler_ApBasic.4.sg
│   │   │   ├── compiler_BAT2EXEC.4.sg
│   │   │   ├── compiler_BSTAR_FORTH.4.sg
│   │   │   ├── compiler_BatLite.4.sg
│   │   │   ├── compiler_BetterBASIC.4.sg
│   │   │   ├── compiler_CII-C.4.sg
│   │   │   ├── compiler_Easy!-C.4.sg
│   │   │   ├── compiler_GRASP.4.sg
│   │   │   ├── compiler_MegaBasic.4.sg
│   │   │   ├── compiler_MegaBasic1.4.sg
│   │   │   ├── compiler_PCC.4.sg
│   │   │   ├── compiler_Power_C.4.sg
│   │   │   ├── compiler_SP-FORTH.4.sg
│   │   │   ├── compiler_Symantec_BASIC.4.sg
│   │   │   ├── compiler_Topspeed_C.4.sg
│   │   │   ├── compiler_Turbo_Basic.4.sg
│   │   │   ├── compiler_Turbo_Prolog.4.sg
│   │   │   ├── compiler_WATCOM.4.sg
│   │   │   ├── compiler_WPFORTH.4.sg
│   │   │   ├── compiler_djgpp.4.sg
│   │   │   ├── compiler_muLISP-87.4.sg
│   │   │   ├── converter_EXE2COM.1.sg
│   │   │   ├── converter_FromBAT.1.sg
│   │   │   ├── converter_GRABBER.1.sg
│   │   │   ├── converter_com2exe.2.sg
│   │   │   ├── cryptor_EXE-Cryptor.2.sg
│   │   │   ├── cryptor_TUCCRYP.2.sg
│   │   │   ├── cryptor_deep-CRyPTer.2.sg
│   │   │   ├── dos_extender.0a.sg
│   │   │   ├── dos_extender1.0a.sg
│   │   │   ├── dos_extender2.0a.sg
│   │   │   ├── extender_Blinker.0a.sg
│   │   │   ├── extender_CWSDPMI.0a.sg
│   │   │   ├── extender_CauseWay_DOS_Extender.6.sg
│   │   │   ├── extender_DOS32.0a.sg
│   │   │   ├── extender_DOS4G.0a.sg
│   │   │   ├── extender_DOSX16.0a.sg
│   │   │   ├── extender_EMX.0a.sg
│   │   │   ├── extender_Go32Stub.0a.sg
│   │   │   ├── extender_PMODE.0a.sg
│   │   │   ├── extender_PRO32.0a.sg
│   │   │   ├── extender_RSX.0a.sg
│   │   │   ├── extender_Stub-386.0a.sg
│   │   │   ├── extender_TMTSTUB.0a.sg
│   │   │   ├── extender_WDOSX.0a.sg
│   │   │   ├── extender_WDOSX32.0a.sg
│   │   │   ├── extender_XMLOD.0a.sg
│   │   │   ├── extender_Xtender.0a.sg
│   │   │   ├── immunizer_CPAV.1.sg
│   │   │   ├── immunizer_F-XLOCK.1.sg
│   │   │   ├── immunizer_Oyster.1.sg
│   │   │   ├── immunizer_PGPROT.1.sg
│   │   │   ├── immunizer_Palladix.1.sg
│   │   │   ├── immunizer_TTW.1.sg
│   │   │   ├── joiner_TurboChainer.1.sg
│   │   │   ├── joiner_V-Load.1.sg
│   │   │   ├── library_ParsecCollection.1.sg
│   │   │   ├── loader_32stub.0a.sg
│   │   │   ├── mbp_SHRINK.2.sg
│   │   │   ├── other_AutoHack.1.sg
│   │   │   ├── other_Coderunner.1.sg
│   │   │   ├── other_DemoMaker.2.sg
│   │   │   ├── overlay_overlays.6.sg
│   │   │   ├── packer_32LiTe.2.sg
│   │   │   ├── packer_AINEXE.2.sg
│   │   │   ├── packer_AVPACK.2.sg
│   │   │   ├── packer_Amisetup.1.sg
│   │   │   ├── packer_COMPACK.2.sg
│   │   │   ├── packer_CRYPACK.2.sg
│   │   │   ├── packer_Compress-EXE.2.sg
│   │   │   ├── packer_DIET.2.sg
│   │   │   ├── packer_DSHIELD.2.sg
│   │   │   ├── packer_DexEXE.2.sg
│   │   │   ├── packer_EXECUTRIX.2.sg
│   │   │   ├── packer_EXEPACK.2.sg
│   │   │   ├── packer_ExeLITE.2.sg
│   │   │   ├── packer_LGLZ.2.sg
│   │   │   ├── packer_LZEXE.2.sg
│   │   │   ├── packer_MSLite.1.sg
│   │   │   ├── packer_Optlink.2.sg
│   │   │   ├── packer_PGMPAK.2.sg
│   │   │   ├── packer_PKEXE.2.sg
│   │   │   ├── packer_PKLITE.2.sg
│   │   │   ├── packer_PKTINY.2.sg
│   │   │   ├── packer_PMWLite.2.sg
│   │   │   ├── packer_PRO-PACK.2.sg
│   │   │   ├── packer_Pack.2.sg
│   │   │   ├── packer_Packers.2.sg
│   │   │   ├── packer_RERP.2.sg
│   │   │   ├── packer_RIXEPACK.2.sg
│   │   │   ├── packer_RJcrush.2.sg
│   │   │   ├── packer_Relpack.2.sg
│   │   │   ├── packer_SCRNCH.2.sg
│   │   │   ├── packer_SEA-AXE.2.sg
│   │   │   ├── packer_Scramb.2.sg
│   │   │   ├── packer_Shrinker.2.sg
│   │   │   ├── packer_TSCRUNCH.2.sg
│   │   │   ├── packer_Tenth_Planet.2.sg
│   │   │   ├── packer_TinyProg.2.sg
│   │   │   ├── packer_Tinyprot.2.sg
│   │   │   ├── packer_UCEXE.2.sg
│   │   │   ├── packer_UPX.2.sg
│   │   │   ├── packer_WWPACK.2.sg
│   │   │   ├── packer_XPACK.2.sg
│   │   │   ├── packer_ZIPSCRUB.2.sg
│   │   │   ├── packer_aPACK.2.sg
│   │   │   ├── patcher_Patchers.1.sg
│   │   │   ├── protector_$pirit.2.sg
│   │   │   ├── protector_ABKprot.2.sg
│   │   │   ├── protector_AEP.2.sg
│   │   │   ├── protector_ALEC.2.sg
│   │   │   ├── protector_ANTI-TRACE.2.sg
│   │   │   ├── protector_AVAST_CRC-Check.2.sg
│   │   │   ├── protector_Aluwain.2.sg
│   │   │   ├── protector_Anti-LAME.2.sg
│   │   │   ├── protector_Antilame.2.sg
│   │   │   ├── protector_Bitlok.2.sg
│   │   │   ├── protector_Bunny.2.sg
│   │   │   ├── protector_CC.2.sg
│   │   │   ├── protector_CEPexe.2.sg
│   │   │   ├── protector_CERBERUS.2.sg
│   │   │   ├── protector_COMCRYPT.2.sg
│   │   │   ├── protector_COMPROTECT.2.sg
│   │   │   ├── protector_CONVOY.2.sg
│   │   │   ├── protector_CRYPTEXE.2.sg
│   │   │   ├── protector_China Locker.2.sg
│   │   │   ├── protector_Ciphator.2.sg
│   │   │   ├── protector_Codesafe.2.sg
│   │   │   ├── protector_ComProtector.2.sg
│   │   │   ├── protector_ComprEXE.2.sg
│   │   │   ├── protector_Copy_Protector.2.sg
│   │   │   ├── protector_Copylock_PC.2.sg
│   │   │   ├── protector_CrAcKeR.2.sg
│   │   │   ├── protector_CrackStop.2.sg
│   │   │   ├── protector_Cruncher.2.sg
│   │   │   ├── protector_CryExe.2.sg
│   │   │   ├── protector_CryptCom.2.sg
│   │   │   ├── protector_CrypteXeC.2.sg
│   │   │   ├── protector_Crypto-box.2.sg
│   │   │   ├── protector_DCREXE.2.sg
│   │   │   ├── protector_DMC.2.sg
│   │   │   ├── protector_Deeper.2.sg
│   │   │   ├── protector_E-PROT.2.sg
│   │   │   ├── protector_EEXE.2.sg
│   │   │   ├── protector_EPW.2.sg
│   │   │   ├── protector_ETS.1.sg
│   │   │   ├── protector_EXE-Crypt.2.sg
│   │   │   ├── protector_EXE-Protect.2.sg
│   │   │   ├── protector_EXEGUARD.2.sg
│   │   │   ├── protector_EXEHigh.2.sg
│   │   │   ├── protector_EXETools.2.sg
│   │   │   ├── protector_Encriptor.2.sg
│   │   │   ├── protector_Enkryptonator.2.sg
│   │   │   ├── protector_ExeCode.2.sg
│   │   │   ├── protector_ExeLock.2.sg
│   │   │   ├── protector_FACRYPT.2.sg
│   │   │   ├── protector_FSE.2.sg
│   │   │   ├── protector_GA-Header.2.sg
│   │   │   ├── protector_GOAT.1.sg
│   │   │   ├── protector_HACKSTOP.2.sg
│   │   │   ├── protector_HASP.2.sg
│   │   │   ├── protector_HEALTH.2.sg
│   │   │   ├── protector_HaSPeX-Protect.2.sg
│   │   │   ├── protector_Hardlock.2.sg
│   │   │   ├── protector_Inertia.2.sg
│   │   │   ├── protector_Int01-Destroyer.2.sg
│   │   │   ├── protector_Ironthorn.2.sg
│   │   │   ├── protector_JAM.2.sg
│   │   │   ├── protector_JmCryptExe.2.sg
│   │   │   ├── protector_Joke.2.sg
│   │   │   ├── protector_KeyMaker.2.sg
│   │   │   ├── protector_Kvetch.2.sg
│   │   │   ├── protector_LOCK.2.sg
│   │   │   ├── protector_LOCK91.2.sg
│   │   │   ├── protector_LamerStop.2.sg
│   │   │   ├── protector_LockTite+.2.sg
│   │   │   ├── protector_MEGALITE.2.sg
│   │   │   ├── protector_MESS.2.sg
│   │   │   ├── protector_Maker.2.sg
│   │   │   ├── protector_Mandrake.2.sg
│   │   │   ├── protector_MutaWWP.2.sg
│   │   │   ├── protector_Mutate.2.sg
│   │   │   ├── protector_NOCLIP.2.sg
│   │   │   ├── protector_NOTA.2.sg
│   │   │   ├── protector_NTShell.2.sg
│   │   │   ├── protector_Nodebug.2.sg
│   │   │   ├── protector_Novex.2.sg
│   │   │   ├── protector_Overlay.2.sg
│   │   │   ├── protector_PACKWIN.2.sg
│   │   │   ├── protector_PC-Guard.2.sg
│   │   │   ├── protector_PCOM.2.sg
│   │   │   ├── protector_PROTECT.2.sg
│   │   │   ├── protector_PVAC.2.sg
│   │   │   ├── protector_PassEXE.2.sg
│   │   │   ├── protector_Pksmart.2.sg
│   │   │   ├── protector_ProtEXE.2.sg
│   │   │   ├── protector_Protector.2.sg
│   │   │   ├── protector_Quadru-Lock.2.sg
│   │   │   ├── protector_R-Crypt.2.sg
│   │   │   ├── protector_REC.2.sg
│   │   │   ├── protector_RHC.2.sg
│   │   │   ├── protector_ROSETINY.2.sg
│   │   │   ├── protector_SSI-Lock.2.sg
│   │   │   ├── protector_Secure.2.sg
│   │   │   ├── protector_SelfChk.2.sg
│   │   │   ├── protector_Shrink.2.sg
│   │   │   ├── protector_SnoopStop.2.sg
│   │   │   ├── protector_SuckStop.2.sg
│   │   │   ├── protector_TCEC.2.sg
│   │   │   ├── protector_TraceLock.2.sg
│   │   │   ├── protector_Trap.2.sg
│   │   │   ├── protector_Un2pack.2.sg
│   │   │   ├── protector_UnPackStop.2.sg
│   │   │   ├── protector_XDOC.2.sg
│   │   │   ├── protector_aPatch.2.sg
│   │   │   ├── protector_cramble.2.sg
│   │   │   ├── protector_iLUCRYPT.2.sg
│   │   │   ├── protector_nbuild.2.sg
│   │   │   ├── runtime_VROOMM.4.sg
│   │   │   ├── self-displayer_ANS2ALL.1.sg
│   │   │   ├── self-displayer_GIFEXE.1.sg
│   │   │   ├── self-displayer_RELETTER.1.sg
│   │   │   ├── self-displayer_SimplyWare.1.sg
│   │   │   ├── self-displayer_TXT2COM.1.sg
│   │   │   ├── self-displayer_TXTmaker.1.sg
│   │   │   ├── self-displayer_Txt2Exe.1.sg
│   │   │   ├── self-displayer_self-displayer.1.sg
│   │   │   ├── sfx_ARC.1.sg
│   │   │   ├── sfx_ARJ.1.sg
│   │   │   ├── sfx_ChSFX.1.sg
│   │   │   ├── sfx_EXARJ.1.sg
│   │   │   ├── sfx_ICE.1.sg
│   │   │   ├── sfx_LH.1.sg
│   │   │   ├── sfx_LHA.1.sg
│   │   │   ├── sfx_LHarc.1.sg
│   │   │   ├── sfx_PKSFX.1.sg
│   │   │   ├── sfx_PKZIP-SFX.1.sg
│   │   │   ├── sfx_PKZIP_mini-sfx.1.sg
│   │   │   ├── sfx_SFX.1.sg
│   │   │   ├── sfx_ZOO.1.sg
│   │   │   ├── unknown_immunizer.1.sg
│   │   │   └── virus.1.sg
│   │   ├── NE/
│   │   │   ├── _NE.0.sg
│   │   │   ├── _init
│   │   │   ├── compiler_Borland_C++.1.sg
│   │   │   ├── compiler_Borland_Pascal.1.sg
│   │   │   ├── compiler_Watcom_C.1.sg
│   │   │   ├── game_engine_DirectorPlayer.1.sg
│   │   │   ├── installer_CoktelVisionInstaller.1.sg
│   │   │   ├── installer_Setup-Specialist.1.sg
│   │   │   ├── library_MS_RTL.4.sg
│   │   │   ├── sfx_ARC_SFX.1.sg
│   │   │   ├── sfx_PKZIP-SFX.1.sg
│   │   │   └── sfx_Sydex_SFX.1.sg
│   │   ├── NPM/
│   │   │   ├── _NPM.0.sg
│   │   │   ├── _init
│   │   │   ├── language_JavaScript.5.sg
│   │   │   ├── language_TypeScript.5.sg
│   │   │   └── package_PackageName.1.sg
│   │   ├── PDF/
│   │   │   ├── _PDF.0.sg
│   │   │   ├── _init
│   │   │   ├── converter_markdown-pdf.3.sg
│   │   │   ├── converter_mdpdf.3.sg
│   │   │   ├── format_HeaderComment.2.sg
│   │   │   ├── format_PersonalData.5.sg
│   │   │   ├── format_RTSN_secure.1.sg
│   │   │   └── format_Tools.2.sg
│   │   ├── PE/
│   │   │   ├── ACE.6.sg
│   │   │   ├── Cab.6.sg
│   │   │   ├── Microsoft.6.sg
│   │   │   ├── Microsoft_Class_Installer.1.sg
│   │   │   ├── Microsoft_Compound-based_installer.1.sg
│   │   │   ├── Microsoft_Help.1.sg
│   │   │   ├── Microsoft_JScript.6.sg
│   │   │   ├── _FixDetects.9.sg
│   │   │   ├── _NetCompilersLibs.4.sg
│   │   │   ├── _PE.0.sg
│   │   │   ├── __GenericHeuristicAnalysis_By_DosX.7.sg
│   │   │   ├── _init
│   │   │   ├── archive_7z.6.sg
│   │   │   ├── arj.6.sg
│   │   │   ├── compiler_BatchToApp.6.sg
│   │   │   ├── compiler_BeRo_Tiny_Pascal.6.sg
│   │   │   ├── compiler_Borland_C++.6.sg
│   │   │   ├── compiler_Cygwin32.4.sg
│   │   │   ├── compiler_DECFortran.4.sg
│   │   │   ├── compiler_DMD.6.sg
│   │   │   ├── compiler_DarkBASIC.4.sg
│   │   │   ├── compiler_Delphi.4.sg
│   │   │   ├── compiler_EuroASM.4.sg
│   │   │   ├── compiler_Excelsior_JET.4.sg
│   │   │   ├── compiler_FASM.4.sg
│   │   │   ├── compiler_FreeBasic.6.sg
│   │   │   ├── compiler_Free_Pascal.6.sg
│   │   │   ├── compiler_Go.4.sg
│   │   │   ├── compiler_IBM_VisualAge_C.6.sg
│   │   │   ├── compiler_IBM_VisualAge_COBOL.6.sg
│   │   │   ├── compiler_IBM_VisualAge_PL_I.6.sg
│   │   │   ├── compiler_Intel_C.6.sg
│   │   │   ├── compiler_Kotlin.4.sg
│   │   │   ├── compiler_LCC-Win32.4.sg
│   │   │   ├── compiler_LDC.6.sg
│   │   │   ├── compiler_LLVM.6.sg
│   │   │   ├── compiler_Lahey_Fortran_90.4.sg
│   │   │   ├── compiler_MinGW.6.sg
│   │   │   ├── compiler_Nim.4.sg
│   │   │   ├── compiler_Pelles_C.6.sg
│   │   │   ├── compiler_PerlApp.1.sg
│   │   │   ├── compiler_PowerBASIC.4.sg
│   │   │   ├── compiler_PureBasic.4.sg
│   │   │   ├── compiler_RADBasic.6.sg
│   │   │   ├── compiler_RealBasic.4.sg
│   │   │   ├── compiler_RosASM.4.sg
│   │   │   ├── compiler_Rust.4.sg
│   │   │   ├── compiler_SpASM.4.sg
│   │   │   ├── compiler_Swift.6.sg
│   │   │   ├── compiler_Symantec_C.6.sg
│   │   │   ├── compiler_TASM32.4.sg
│   │   │   ├── compiler_Virtual_Pascal.4.sg
│   │   │   ├── compiler_Visual_Objects.4.sg
│   │   │   ├── compiler_Visual_Prolog.4.sg
│   │   │   ├── compiler_Watcom.6.sg
│   │   │   ├── compiler_WutaoEPL.6.sg
│   │   │   ├── compiler_Xbase.4.sg
│   │   │   ├── compiler_Zig.4.sg
│   │   │   ├── compiler_tcc.6.sg
│   │   │   ├── compiler_twinBASIC.6.sg
│   │   │   ├── cryptor_Amber.2.sg
│   │   │   ├── cryptor_AverCryptor.2.sg
│   │   │   ├── cryptor_BattleshipCrypter.2.sg
│   │   │   ├── cryptor_CronosCrypter.1.sg
│   │   │   ├── cryptor_CryptEngine_MalwareCryptor.2.sg
│   │   │   ├── cryptor_Duals_eXe_Encryptor.2.sg
│   │   │   ├── cryptor_EXECryptor.2.sg
│   │   │   ├── cryptor_Huan.1.sg
│   │   │   ├── cryptor_KCryptor.2.sg
│   │   │   ├── cryptor_Kryptonit.2.sg
│   │   │   ├── cryptor_LimeCrypter.2.sg
│   │   │   ├── cryptor_NativeCryptor_by_DosX.2.sg
│   │   │   ├── cryptor_PEUnion.2.sg
│   │   │   ├── cryptor_RCryptor.2.sg
│   │   │   ├── cryptor_RDG_Tejon_Crypter.2.sg
│   │   │   ├── cryptor_ReXCrypter.2.sg
│   │   │   ├── cryptor_Stones_PE_Encryptor.2.sg
│   │   │   ├── cryptor_Virogen_Crypt.2.sg
│   │   │   ├── cryptor_XorCryptor.2.sg
│   │   │   ├── cryptor_Yodas_Crypter.2.sg
│   │   │   ├── custom_sfx_installers.1.sg
│   │   │   ├── debug_data.5.sg
│   │   │   ├── dotnet_only/
│   │   │   │   └── about.txt
│   │   │   ├── emulator_Wine.3.sg
│   │   │   ├── engine_AGS.1.sg
│   │   │   ├── format_AutoHotKey.3.sg
│   │   │   ├── format_AutoIt.3.sg
│   │   │   ├── game_engine_Atlas.3.sg
│   │   │   ├── game_engine_DEV7.3.sg
│   │   │   ├── game_engine_Director.3.sg
│   │   │   ├── game_engine_Godot.3.sg
│   │   │   ├── game_engine_Wintermute.3.sg
│   │   │   ├── game_engine_XPAT.3.sg
│   │   │   ├── game_engine_Xash.3.sg
│   │   │   ├── installer_ACCAStore.1.sg
│   │   │   ├── installer_AOLSetup.1.sg
│   │   │   ├── installer_Acronis_installer.1.sg
│   │   │   ├── installer_Actual_Installer.1.sg
│   │   │   ├── installer_Adobe_FlashPlayer_downloader.1.sg
│   │   │   ├── installer_Adobe_installers.1.sg
│   │   │   ├── installer_Advanced_installer.1.sg
│   │   │   ├── installer_Adveractive.1.sg
│   │   │   ├── installer_Aeco_installer.1.sg
│   │   │   ├── installer_Alchemy_Mindworks_installer.1.sg
│   │   │   ├── installer_Astrum.1.sg
│   │   │   ├── installer_AutoPlay_Media_Studio.1.sg
│   │   │   ├── installer_Autodesk_Self-Extract.1.sg
│   │   │   ├── installer_AutorunProEnterprise.1.sg
│   │   │   ├── installer_AutorunProEnterpriseII.1.sg
│   │   │   ├── installer_BitRock_Installer.1.sg
│   │   │   ├── installer_Bytessence_Install_Maker.1.sg
│   │   │   ├── installer_CNetX.1.sg
│   │   │   ├── installer_CSDD_installer.1.sg
│   │   │   ├── installer_CZ_installer.1.sg
│   │   │   ├── installer_Calibre_installer.1.sg
│   │   │   ├── installer_Chaos_Software_installer.1.sg
│   │   │   ├── installer_ClickTeam.1.sg
│   │   │   ├── installer_Codegear_Installer.1.sg
│   │   │   ├── installer_CreateInstall.1.sg
│   │   │   ├── installer_CrypKey_Installer.1.sg
│   │   │   ├── installer_DeployMaster.1.sg
│   │   │   ├── installer_DesktopX_Installer.1.sg
│   │   │   ├── installer_Eschalon_installer.1.sg
│   │   │   ├── installer_Excelsior_Installer.1.sg
│   │   │   ├── installer_FDM_Installer.1.sg
│   │   │   ├── installer_GPInstall.1.sg
│   │   │   ├── installer_Gentee_Installer.1.sg
│   │   │   ├── installer_Ghost_Installer.1.sg
│   │   │   ├── installer_Gremlin_Patcher.1.sg
│   │   │   ├── installer_I-D_Media_installer.1.sg
│   │   │   ├── installer_IDM_Installer.1.sg
│   │   │   ├── installer_INTENIUM.1.sg
│   │   │   ├── installer_Inno_Setup_Module.1.sg
│   │   │   ├── installer_Instalit.1.sg
│   │   │   ├── installer_Install4j_installer.1.sg
│   │   │   ├── installer_InstallAnywhere.1.sg
│   │   │   ├── installer_InstallShield.1.sg
│   │   │   ├── installer_InstallUs.1.sg
│   │   │   ├── installer_Install_Factory.1.sg
│   │   │   ├── installer_LucasArts_Update_Installer.1.sg
│   │   │   ├── installer_Miktex_Installer.1.sg
│   │   │   ├── installer_Mioplanet_installer.1.sg
│   │   │   ├── installer_Morton_installer.1.sg
│   │   │   ├── installer_Multimedia_Fusion_Installer.1.sg
│   │   │   ├── installer_Myriad_Install.1.sg
│   │   │   ├── installer_NOS_Installer.1.sg
│   │   │   ├── installer_Nullsoft_Scriptable_Install_System.1.sg
│   │   │   ├── installer_O'Setup95.1.sg
│   │   │   ├── installer_PCInstall.1.sg
│   │   │   ├── installer_PIMP.1.sg
│   │   │   ├── installer_PackageForTheWeb.1.sg
│   │   │   ├── installer_Pantaray_QSetup.1.sg
│   │   │   ├── installer_Paquet_Builder.1.sg
│   │   │   ├── installer_Quick_Install.1.sg
│   │   │   ├── installer_RNsetup.1.sg
│   │   │   ├── installer_SCE_installer.1.sg
│   │   │   ├── installer_STATICSUP.1.sg
│   │   │   ├── installer_Setup-Specialist.1.sg
│   │   │   ├── installer_Setup_Factory.1.sg
│   │   │   ├── installer_SfxCA.1.sg
│   │   │   ├── installer_Smart_Install_Maker.1.sg
│   │   │   ├── installer_Sony_Windows_Installer.1.sg
│   │   │   ├── installer_Spoon_Installer.1.sg
│   │   │   ├── installer_Squirrel.1.sg
│   │   │   ├── installer_SwiftView_installer.1.sg
│   │   │   ├── installer_Synactis_In-The-Box_Installer.1.sg
│   │   │   ├── installer_Tarma_Installer.1.sg
│   │   │   ├── installer_Themepak.1.sg
│   │   │   ├── installer_UFI_installer.1.sg
│   │   │   ├── installer_VMWare.1.sg
│   │   │   ├── installer_Vise.1.sg
│   │   │   ├── installer_WiX_Toolset_installer.1.sg
│   │   │   ├── installer_WinRAR_Installer.1.sg
│   │   │   ├── installer_Winamp_Installer.1.sg
│   │   │   ├── installer_Windows_Installer.1.sg
│   │   │   ├── installer_Wise_Installer.1.sg
│   │   │   ├── installer_Xoreax_installer.1.sg
│   │   │   ├── installer_distutils.1.sg
│   │   │   ├── installer_sqx.1.sg
│   │   │   ├── joiner_Celesty_File_Binder.1.sg
│   │   │   ├── joiner_ExeSplitter.1.sg
│   │   │   ├── joiner_FreeJoiner.1.sg
│   │   │   ├── joiner_MicroJoiner.1.sg
│   │   │   ├── joiner_N-Joiner.1.sg
│   │   │   ├── joiner_OxiJoiner.2.sg
│   │   │   ├── joiner_RJoiner.1.sg
│   │   │   ├── joiner_SFXRun.1.sg
│   │   │   ├── joiner_inPEct.1.sg
│   │   │   ├── library_16Edit.4.sg
│   │   │   ├── library_7z.4.sg
│   │   │   ├── library_AMD_FSR.4.sg
│   │   │   ├── library_AMD_GraphicalServices.4.sg
│   │   │   ├── library_ASIPort.4.sg
│   │   │   ├── library_AjaxMin.4.sg
│   │   │   ├── library_Alibaba_CloudSDK.4.sg
│   │   │   ├── library_Amazon_CloudWatch.4.sg
│   │   │   ├── library_Amazon_CloudWatchLogs.4.sg
│   │   │   ├── library_Amazon_DynamoDB.4.sg
│   │   │   ├── library_Amazon_ElasticComputeCloudService.4.sg
│   │   │   ├── library_Amazon_Glue.4.sg
│   │   │   ├── library_Amazon_Kinesis.4.sg
│   │   │   ├── library_Amazon_Lambda.4.sg
│   │   │   ├── library_Amazon_RelationalDatabaseService.4.sg
│   │   │   ├── library_Amazon_SecretsManager.4.sg
│   │   │   ├── library_Amazon_SecurityToken.4.sg
│   │   │   ├── library_Amazon_ServicesSDK.4.sg
│   │   │   ├── library_Amazon_SimpleEmail.4.sg
│   │   │   ├── library_Amazon_SimpleQueueService.4.sg
│   │   │   ├── library_Amazon_SimpleStorageService.4.sg
│   │   │   ├── library_Amazon_SingleSignOn.4.sg
│   │   │   ├── library_Amazon_X-Ray.4.sg
│   │   │   ├── library_AngleSharp.4.sg
│   │   │   ├── library_Antlr.4.sg
│   │   │   ├── library_AppleSoftwareUpdate.4.sg
│   │   │   ├── library_Argon2.4.sg
│   │   │   ├── library_AtMsg32.4.sg
│   │   │   ├── library_Atlantic.4.sg
│   │   │   ├── library_Authorwave.4.sg
│   │   │   ├── library_Autofac.4.sg
│   │   │   ├── library_BenchmarkDotNet.4.sg
│   │   │   ├── library_Boost.4.sg
│   │   │   ├── library_BrotliSharpLib.4.sg
│   │   │   ├── library_CUDA-Driver.4.sg
│   │   │   ├── library_Castle.Net.4.sg
│   │   │   ├── library_ChilkatNativeLib.4.sg
│   │   │   ├── library_Chromium_Embedded_Framework.4.sg
│   │   │   ├── library_Chromium_WebView.4.sg
│   │   │   ├── library_CliWrap.4.sg
│   │   │   ├── library_ClosedXML.4.sg
│   │   │   ├── library_CodeBase.4.sg
│   │   │   ├── library_CommandLineParser.4.sg
│   │   │   ├── library_Costura.Fody.4.sg
│   │   │   ├── library_Crc32_NET.4.sg
│   │   │   ├── library_Crc_NET.4.sg
│   │   │   ├── library_CsvHelper.4.sg
│   │   │   ├── library_D3DRM.4.sg
│   │   │   ├── library_D3DXOF.4.sg
│   │   │   ├── library_Dapper.4.sg
│   │   │   ├── library_DeepCloner.4.sg
│   │   │   ├── library_Direct2D.4.sg
│   │   │   ├── library_Direct3D.4.sg
│   │   │   ├── library_DirectDraw.4.sg
│   │   │   ├── library_DirectInput.4.sg
│   │   │   ├── library_DirectSound.4.sg
│   │   │   ├── library_DirectX.4.sg
│   │   │   ├── library_DirectorAPI.4.sg
│   │   │   ├── library_Discord.Net.4.sg
│   │   │   ├── library_DnsClient.NET.4.sg
│   │   │   ├── library_Dryloc.4.sg
│   │   │   ├── library_EAX_Unified.4.sg
│   │   │   ├── library_EcmaScript_NET.4.sg
│   │   │   ├── library_Edit_Dev.4.sg
│   │   │   ├── library_ElectronApp.4.sg
│   │   │   ├── library_EpicGames.4.sg
│   │   │   ├── library_ExcelDataReader.4.sg
│   │   │   ├── library_ExcelNumberFormat.4.sg
│   │   │   ├── library_ExifLibNet.4.sg
│   │   │   ├── library_FAAD.4.sg
│   │   │   ├── library_FFmpeg.4.sg
│   │   │   ├── library_FastExpressionCompiler.4.sg
│   │   │   ├── library_FastMember.4.sg
│   │   │   ├── library_FastRsync_NET.4.sg
│   │   │   ├── library_Fastenshtein.4.sg
│   │   │   ├── library_Fasterflect.4.sg
│   │   │   ├── library_FlashPlayer.1.sg
│   │   │   ├── library_FluentValidation.4.sg
│   │   │   ├── library_Fox_Pro.4.sg
│   │   │   ├── library_FusionCache.4.sg
│   │   │   ├── library_FuzzySharp.4.sg
│   │   │   ├── library_GitLabApiClient.4.sg
│   │   │   ├── library_GoldSrc.3.sg
│   │   │   ├── library_Google_APIs.4.sg
│   │   │   ├── library_Google_ProtoBuf.4.sg
│   │   │   ├── library_Harmony.4.sg
│   │   │   ├── library_HtmlAgilityPack.4.sg
│   │   │   ├── library_Humanizer.4.sg
│   │   │   ├── library_ImageSharp.4.sg
│   │   │   ├── library_Intel_IPP.4.sg
│   │   │   ├── library_Intel_TBB.4.sg
│   │   │   ├── library_Intel_XeSS.4.sg
│   │   │   ├── library_Irony.4.sg
│   │   │   ├── library_LCL.5.sg
│   │   │   ├── library_LINQKit.4.sg
│   │   │   ├── library_LZMA.4.sg
│   │   │   ├── library_LazyCache.4.sg
│   │   │   ├── library_Lego1.4.sg
│   │   │   ├── library_LibLog.4.sg
│   │   │   ├── library_LibNoise.4.sg
│   │   │   ├── library_LibPhoneNumber_NET.4.sg
│   │   │   ├── library_LibSassBuilder.4.sg
│   │   │   ├── library_LibVLCSharp.4.sg
│   │   │   ├── library_LiteDB.4.sg
│   │   │   ├── library_LoadServ.4.sg
│   │   │   ├── library_Lua_Runtime.4.sg
│   │   │   ├── library_MacroMix.4.sg
│   │   │   ├── library_MailKit.4.sg
│   │   │   ├── library_ManagedCuda.4.sg
│   │   │   ├── library_Mapster.4.sg
│   │   │   ├── library_Markdig.4.sg
│   │   │   ├── library_MassTransit.4.sg
│   │   │   ├── library_MediatR.4.sg
│   │   │   ├── library_MemoryPack.4.sg
│   │   │   ├── library_MessagePack.4.sg
│   │   │   ├── library_Microsoft_AzureSDK.4.sg
│   │   │   ├── library_Microsoft_Azure_SDK.4.sg
│   │   │   ├── library_Microsoft_C_Runtime.4.sg
│   │   │   ├── library_Microsoft_Edge_WebView.4.sg
│   │   │   ├── library_Microsoft_NET_Runtime.4.sg
│   │   │   ├── library_Microsoft_OpenAPI.4.sg
│   │   │   ├── library_MilesSoundSystem.4.sg
│   │   │   ├── library_MimeKit.4.sg
│   │   │   ├── library_MongoDB.NET.4.sg
│   │   │   ├── library_MonkeyCache.4.sg
│   │   │   ├── library_Moq.4.sg
│   │   │   ├── library_NJsonSchema.4.sg
│   │   │   ├── library_NSubstitute.4.sg
│   │   │   ├── library_NUnit.4.sg
│   │   │   ├── library_Nerdbank.Streams.4.sg
│   │   │   ├── library_Newtonsoft.Json.4.sg
│   │   │   ├── library_Ninject.4.sg
│   │   │   ├── library_NodaTime.4.sg
│   │   │   ├── library_Nvidia_DLSS.4.sg
│   │   │   ├── library_Nvidia_PhysX.4.sg
│   │   │   ├── library_Nvidia_Streamline.4.sg
│   │   │   ├── library_OodleCompression.4.sg
│   │   │   ├── library_OpenAI.4.sg
│   │   │   ├── library_OpenAL.4.sg
│   │   │   ├── library_OpenCL.4.sg
│   │   │   ├── library_OpenCV.4.sg
│   │   │   ├── library_OpenColorIO.4.sg
│   │   │   ├── library_OpenGL.4.sg
│   │   │   ├── library_OpenIddict.4.sg
│   │   │   ├── library_OpenSSL.4.sg
│   │   │   ├── library_OpenTelemetry.4.sg
│   │   │   ├── library_OpusAudio.4.sg
│   │   │   ├── library_PdfPig.4.sg
│   │   │   ├── library_Perfolizer.4.sg
│   │   │   ├── library_Perl.3.sg
│   │   │   ├── library_Plivo.4.sg
│   │   │   ├── library_Polly.4.sg
│   │   │   ├── library_PortAudio.4.sg
│   │   │   ├── library_Python.4.sg
│   │   │   ├── library_QMixer.4.sg
│   │   │   ├── library_Qt.4.sg
│   │   │   ├── library_RADVideoTools.4.sg
│   │   │   ├── library_RNNoise.4.sg
│   │   │   ├── library_RabbitMQ.4.sg
│   │   │   ├── library_RamlToOpenApiConverter.4.sg
│   │   │   ├── library_RestSharp.4.sg
│   │   │   ├── library_SDL.4.sg
│   │   │   ├── library_ScePad.4.sg
│   │   │   ├── library_ScriptHookV.4.sg
│   │   │   ├── library_Scrutor.4.sg
│   │   │   ├── library_SecretRabbitCode.4.sg
│   │   │   ├── library_Serilog.4.sg
│   │   │   ├── library_SharpCompress.4.sg
│   │   │   ├── library_SharpZipLib.4.sg
│   │   │   ├── library_Sigil.4.sg
│   │   │   ├── library_SkiaSharp.4.sg
│   │   │   ├── library_Smacker.4.sg
│   │   │   ├── library_SmartHeap.4.sg
│   │   │   ├── library_Snappier.4.sg
│   │   │   ├── library_Spectre.Console.4.sg
│   │   │   ├── library_Stackify.4.sg
│   │   │   ├── library_Starkbank_ECDSA.4.sg
│   │   │   ├── library_Steam.4.sg
│   │   │   ├── library_Swashbuckle.AspNetCore.4.sg
│   │   │   ├── library_TNTSI.4.sg
│   │   │   ├── library_Tabula.4.sg
│   │   │   ├── library_Telegram.Bot.4.sg
│   │   │   ├── library_Twilio.4.sg
│   │   │   ├── library_Twilio_SendGrid.4.sg
│   │   │   ├── library_UAParser.4.sg
│   │   │   ├── library_Unity.4.sg
│   │   │   ├── library_VFW.4.sg
│   │   │   ├── library_Vorbis.4.sg
│   │   │   ├── library_Vulkan.4.sg
│   │   │   ├── library_WF.Guna.UI2.4.sg
│   │   │   ├── library_WF.Krypton.4.sg
│   │   │   ├── library_WF.MetroFramework.4.sg
│   │   │   ├── library_WF.ReaLTaiizor.4.sg
│   │   │   ├── library_WF_WPF.MaterialSkin.4.sg
│   │   │   ├── library_WPF.AvalonEdit.4.sg
│   │   │   ├── library_WPF.ControlzEx.4.sg
│   │   │   ├── library_WPF.MahApps_Metro.4.sg
│   │   │   ├── library_WebActivatorEx.4.sg
│   │   │   ├── library_WinSparkle.4.sg
│   │   │   ├── library_WwiseAudioEngine.4.sg
│   │   │   ├── library_XLive.4.sg
│   │   │   ├── library_XPatFC.4.sg
│   │   │   ├── library_Xerces-CPP.4.sg
│   │   │   ├── library_Xojo.4.sg
│   │   │   ├── library_YUICompressor_NET.4.sg
│   │   │   ├── library_YamlDotNet.4.sg
│   │   │   ├── library_ZstdSharp.4.sg
│   │   │   ├── library_Zydis.4.sg
│   │   │   ├── library_combres.4.sg
│   │   │   ├── library_curl.4.sg
│   │   │   ├── library_discord-rpc.4.sg
│   │   │   ├── library_dotless.4.sg
│   │   │   ├── library_expat_xml_parser.4.sg
│   │   │   ├── library_gRPC_NET.4.sg
│   │   │   ├── library_iMuse.4.sg
│   │   │   ├── library_java.3.sg
│   │   │   ├── library_libfvad.4.sg
│   │   │   ├── library_libpng.4.sg
│   │   │   ├── library_log4net.4.sg
│   │   │   ├── library_lz4net.4.sg
│   │   │   ├── library_nClam.4.sg
│   │   │   ├── library_rlottie.4.sg
│   │   │   ├── library_sqlite.4.sg
│   │   │   ├── library_wxWidgets.5.sg
│   │   │   ├── library_xUnit.net.4.sg
│   │   │   ├── library_zlib.4.sg
│   │   │   ├── linkers.6.sg
│   │   │   ├── marker_AMD_PowerXpress.5.sg
│   │   │   ├── marker_Nvidia_Optimus.5.sg
│   │   │   ├── native_only/
│   │   │   │   └── about.txt
│   │   │   ├── other_Dolphin_VM.1.sg
│   │   │   ├── other_FileSplit_Self-Merger.2.sg
│   │   │   ├── other_GSplit.1.sg
│   │   │   ├── packer_32LiTe.2.sg
│   │   │   ├── packer_AHpacker.2.sg
│   │   │   ├── packer_ANDpakk.2.sg
│   │   │   ├── packer_ASDPack.2.sg
│   │   │   ├── packer_ASPack.2.sg
│   │   │   ├── packer_Advanced_BAT_to_EXE_Converter.2.sg
│   │   │   ├── packer_AlushPacker.2.sg
│   │   │   ├── packer_Anskya_NTPacker_Generator.2.sg
│   │   │   ├── packer_AtomPePacker.2.sg
│   │   │   ├── packer_BatToExe.2.sg
│   │   │   ├── packer_BatToExeConverter.2.sg
│   │   │   ├── packer_BeRoEXEPacker.2.sg
│   │   │   ├── packer_BoxedApp.2.sg
│   │   │   ├── packer_CExe.2.sg
│   │   │   ├── packer_CICompress.2.sg
│   │   │   ├── packer_Cxfreeze.2.sg
│   │   │   ├── packer_DxPack.2.sg
│   │   │   ├── packer_EXE32Pack.2.sg
│   │   │   ├── packer_ExE_Pack.2.sg
│   │   │   ├── packer_FSG.2.sg
│   │   │   ├── packer_Fatpack.2.sg
│   │   │   ├── packer_HTML_executable.1.sg
│   │   │   ├── packer_JDPack.2.sg
│   │   │   ├── packer_KByS.2.sg
│   │   │   ├── packer_MEW.2.sg
│   │   │   ├── packer_MPRESS.2.sg
│   │   │   ├── packer_MoleBox.2.sg
│   │   │   ├── packer_Mystic_Compressor.2.sg
│   │   │   ├── packer_NETZ.2.sg
│   │   │   ├── packer_NOS_Packer.2.sg
│   │   │   ├── packer_NTPacker.2.sg
│   │   │   ├── packer_NTShell.2.sg
│   │   │   ├── packer_NakedPacker.2.sg
│   │   │   ├── packer_NeoLite.2.sg
│   │   │   ├── packer_NodeJS_Nexe.2.sg
│   │   │   ├── packer_NodeJS_Pkg.2.sg
│   │   │   ├── packer_NsPack.2.sg
│   │   │   ├── packer_Nuitka.2.sg
│   │   │   ├── packer_PACKWIN.2.sg
│   │   │   ├── packer_PE-PACK.sg
│   │   │   ├── packer_PECompact.2.sg
│   │   │   ├── packer_PKLITE.2.sg
│   │   │   ├── packer_Pack_Master.2.sg
│   │   │   ├── packer_Packanoid.2.sg
│   │   │   ├── packer_Packman.2.sg
│   │   │   ├── packer_PeX.2.sg
│   │   │   ├── packer_Petite.2.sg
│   │   │   ├── packer_PyInstaller.2.sg
│   │   │   ├── packer_QuestPowerGUI.2.sg
│   │   │   ├── packer_RLPack.2.sg
│   │   │   ├── packer_SC_Pack.2.sg
│   │   │   ├── packer_SecuPack.2.sg
│   │   │   ├── packer_SerGreen_Appacker.2.sg
│   │   │   ├── packer_SimplePackerByEronana.2.sg
│   │   │   ├── packer_Simple_Pack.2.sg
│   │   │   ├── packer_Software_Compress.2.sg
│   │   │   ├── packer_Squishy.2.sg
│   │   │   ├── packer_TPP_Pack.2.sg
│   │   │   ├── packer_TheArk.2.sg
│   │   │   ├── packer_UPX.2.sg
│   │   │   ├── packer_VPacker.2.sg
│   │   │   ├── packer_VbsToExeConverter.2.sg
│   │   │   ├── packer_WWPack32.2.sg
│   │   │   ├── packer_WinUpack.2.sg
│   │   │   ├── packer_Windows_PE_Packer_by_Chenzs108.2.sg
│   │   │   ├── packer_XComp.2.sg
│   │   │   ├── packer_XPack.2.sg
│   │   │   ├── packer_aPack.2.sg
│   │   │   ├── packer_dePACK.2.sg
│   │   │   ├── packer_ezip.2.sg
│   │   │   ├── packer_hXOR.2.sg
│   │   │   ├── packer_hmimys_PE-Pack.2.sg
│   │   │   ├── packer_kkrunchy.2.sg
│   │   │   ├── packer_mPack.2.sg
│   │   │   ├── packer_mkfPack.2.sg
│   │   │   ├── packer_nPack.2.sg
│   │   │   ├── packer_netshrink.2.sg
│   │   │   ├── packer_ps2exe.2.sg
│   │   │   ├── packer_py2exe.2.sg
│   │   │   ├── packer_scr2exe.2.sg
│   │   │   ├── packer_yzPack.2.sg
│   │   │   ├── patcher_CodeFusion_Wizard.1.sg
│   │   │   ├── patcher_PMaker.1.sg
│   │   │   ├── patcher_RPP.1.sg
│   │   │   ├── patcher_RTPatch.1.sg
│   │   │   ├── patcher_dUP.1.sg
│   │   │   ├── patcher_simple_patch.1.sg
│   │   │   ├── player_Power_Screen_Recorder.1.sg
│   │   │   ├── protection_BattlEye.5.sg
│   │   │   ├── protection_DS.Eutron_SmartKey_dongle.5.sg
│   │   │   ├── protection_DS.HASP_dongle.5.sg
│   │   │   ├── protection_DS.Hardlock_dongle.5.sg
│   │   │   ├── protection_DS.MARX_Crypto-Box_dongle.5.sg
│   │   │   ├── protection_DS.Matrix_Hardware_Lock_dongle.5.sg
│   │   │   ├── protection_DS.NetHASP_dongle.5.sg
│   │   │   ├── protection_DS.SenseLock_dongle.5.sg
│   │   │   ├── protection_DS.Sentinel_SuperPro_dongle.5.sg
│   │   │   ├── protection_DS.Sentinel_dongle.5.sg
│   │   │   ├── protection_DS.SoftLok_dongle.5.sg
│   │   │   ├── protection_DS.Unikey_dongle.5.sg
│   │   │   ├── protection_DS.WIBU_Key_dongle.5.sg
│   │   │   ├── protection_HASP_HL_Protection.5.sg
│   │   │   ├── protection_Microsoft_Warbird.2.sg
│   │   │   ├── protection_Softlocx.1.sg
│   │   │   ├── protection_SteamStub.5.sg
│   │   │   ├── protection_Wibu_Codemeter.1.sg
│   │   │   ├── protection_obfus_h.5.sg
│   │   │   ├── protection_obfusheader_h.5.sg
│   │   │   ├── protector_ACProtect.2.sg
│   │   │   ├── protector_AHTeam_EP_Protector.2.sg
│   │   │   ├── protector_ASM_Guard.2.sg
│   │   │   ├── protector_ASProtect.2.sg
│   │   │   ├── protector_AT4RE.2.sg
│   │   │   ├── protector_AZProtect_0001.2.sg
│   │   │   ├── protector_AbyssMedia_ScriptCryptor.2.sg
│   │   │   ├── protector_ActiveMark.2.sg
│   │   │   ├── protector_Agile.2.sg
│   │   │   ├── protector_Alcatraz.2.sg
│   │   │   ├── protector_Alienyze.2.sg
│   │   │   ├── protector_AntiDote.2.sg
│   │   │   ├── protector_Anticrack_Software.2.sg
│   │   │   ├── protector_ArmDot.2.sg
│   │   │   ├── protector_Armadillo.2.sg
│   │   │   ├── protector_Arxan.2.sg
│   │   │   ├── protector_BJFnt.2.sg
│   │   │   ├── protector_Babel_.NET.2.sg
│   │   │   ├── protector_Berio.2.sg
│   │   │   ├── protector_ByfronTech.2.sg
│   │   │   ├── protector_ByteGuard.2.sg
│   │   │   ├── protector_Cameyo.2.sg
│   │   │   ├── protector_CliSecure.2.sg
│   │   │   ├── protector_Code-Lock.2.sg
│   │   │   ├── protector_CodeCrypt.2.sg
│   │   │   ├── protector_CodeVeil.2.sg
│   │   │   ├── protector_Code_Virtualizer.2.sg
│   │   │   ├── protector_Codewall.2.sg
│   │   │   ├── protector_Confuser.2.sg
│   │   │   ├── protector_CopyMinder.2.sg
│   │   │   ├── protector_Crinkler.2.sg
│   │   │   ├── protector_Crunch.2.sg
│   │   │   ├── protector_CrypKey.2.sg
│   │   │   ├── protector_CrypToCrack.2.sg
│   │   │   ├── protector_Cryptect.2.sg
│   │   │   ├── protector_CryptoObfuscator.2.sg
│   │   │   ├── protector_DBPE.2.sg
│   │   │   ├── protector_DNGuard.2.sg
│   │   │   ├── protector_DS.Sentinel_SuperPro.2.sg
│   │   │   ├── protector_DYAMAR.2.sg
│   │   │   ├── protector_DZA_Patcher.2.sg
│   │   │   ├── protector_Daemon_Protect.2.sg
│   │   │   ├── protector_DalKrypt.2.sg
│   │   │   ├── protector_DeepSea.2.sg
│   │   │   ├── protector_Denuvo.2.sg
│   │   │   ├── protector_DotFix_Nice_Protect.2.sg
│   │   │   ├── protector_Dotfuscator.2.sg
│   │   │   ├── protector_DragonArmor.2.sg
│   │   │   ├── protector_ENIGMA.2.sg
│   │   │   ├── protector_EXEFog.2.sg
│   │   │   ├── protector_EXE_Password_Protector.2.sg
│   │   │   ├── protector_Eazfuscator.2.sg
│   │   │   ├── protector_Elan_License_Manager.1.sg
│   │   │   ├── protector_ElecKey.2.sg
│   │   │   ├── protector_Escargot.2.sg
│   │   │   ├── protector_Excalibur.2.sg
│   │   │   ├── protector_ExeShield.2.sg
│   │   │   ├── protector_ExeStealth.2.sg
│   │   │   ├── protector_Exe_Guarder.2.sg
│   │   │   ├── protector_Exe_Shield.2.sg
│   │   │   ├── protector_FISH_.NET.2.sg
│   │   │   ├── protector_FishPE_Shield.2.sg
│   │   │   ├── protector_Fish_PE.2.sg
│   │   │   ├── protector_FlashBack_Protector.2.sg
│   │   │   ├── protector_G!X_Protector.2.sg
│   │   │   ├── protector_GameGuard.2.sg
│   │   │   ├── protector_Goats_PE_Mutilator.2.sg
│   │   │   ├── protector_Goliath.2.sg
│   │   │   ├── protector_HASP.2.sg
│   │   │   ├── protector_HackShield.2.sg
│   │   │   ├── protector_Hide&Protect.2.sg
│   │   │   ├── protector_HidePE.2.sg
│   │   │   ├── protector_HyperTech_Crackproof.2.sg
│   │   │   ├── protector_ILProtector.2.sg
│   │   │   ├── protector_ILUCRYPT.2.sg
│   │   │   ├── protector_IProtect.2.sg
│   │   │   ├── protector_Inquartos_Obfuscator.2.sg
│   │   │   ├── protector_IntelliProtector.2.sg
│   │   │   ├── protector_InxObfuscator.2.sg
│   │   │   ├── protector_Jar2exe.1.sg
│   │   │   ├── protector_KoiVM.2.sg
│   │   │   ├── protector_Konekt_Protector.2.sg
│   │   │   ├── protector_Krypton.2.sg
│   │   │   ├── protector_LARP.2.sg
│   │   │   ├── protector_LDK.2.sg
│   │   │   ├── protector_LDK_.NET.2.sg
│   │   │   ├── protector_LameCrypt.2.sg
│   │   │   ├── protector_Laserlok.2.sg
│   │   │   ├── protector_MSLRH.2.sg
│   │   │   ├── protector_MZ0oPE.2.sg
│   │   │   ├── protector_MaskPE.2.sg
│   │   │   ├── protector_Maxtocode.2.sg
│   │   │   ├── protector_Metrowerks_CodeWarrior.2.sg
│   │   │   ├── protector_Morphnah.2.sg
│   │   │   ├── protector_N-Code.2.sg
│   │   │   ├── protector_N-Joy.2.sg
│   │   │   ├── protector_NET_Spider.2.sg
│   │   │   ├── protector_NTkrnl_Protector.2.sg
│   │   │   ├── protector_NetReactor.2.sg
│   │   │   ├── protector_NetShield.2.sg
│   │   │   ├── protector_Ningishzida.2.sg
│   │   │   ├── protector_NoobyProtect.2.sg
│   │   │   ├── protector_North_Star_PE_Shrinker.2.sg
│   │   │   ├── protector_ORiEN.2.sg
│   │   │   ├── protector_Obfuscar.2.sg
│   │   │   ├── protector_Obfuscator_NET_2009.2.sg
│   │   │   ├── protector_Obsidium.2.sg
│   │   │   ├── protector_OneVM.2.sg
│   │   │   ├── protector_Oreans_CodeVirtualizer.2.sg
│   │   │   ├── protector_PACE.2.sg
│   │   │   ├── protector_PCShrink.2.sg
│   │   │   ├── protector_PC_Guard.2.sg
│   │   │   ├── protector_PE-Armor.2.sg
│   │   │   ├── protector_PE-Shield.2.sg
│   │   │   ├── protector_PEBundle.2.sg
│   │   │   ├── protector_PECRYPT32.2.sg
│   │   │   ├── protector_PELock.2.sg
│   │   │   ├── protector_PENinja.2.sg
│   │   │   ├── protector_PESpin.2.sg
│   │   │   ├── protector_PETetris.2.sg
│   │   │   ├── protector_PE_Diminisher.2.sg
│   │   │   ├── protector_PE_Encrypt.2.sg
│   │   │   ├── protector_PE_Intro.2.sg
│   │   │   ├── protector_PE_Lock_NT.2.sg
│   │   │   ├── protector_PE_Lock_Phantasm_by_Ding_Boy.2.sg
│   │   │   ├── protector_PE_Password.2.sg
│   │   │   ├── protector_PE_Protect.2.sg
│   │   │   ├── protector_PEncrypt.2.sg
│   │   │   ├── protector_PEnguinCrypt.2.sg
│   │   │   ├── protector_PUNiSHER.2.sg
│   │   │   ├── protector_Phoenix.2.sg
│   │   │   ├── protector_Photo_Compiler.2.sg
│   │   │   ├── protector_PolyCrypt_PE.2.sg
│   │   │   ├── protector_Private_EXE_Protector.2.sg
│   │   │   ├── protector_Protect_Disc.2.sg
│   │   │   ├── protector_Protection_Plus.2.sg
│   │   │   ├── protector_QrYPt0r.2.sg
│   │   │   ├── protector_QuickBFC.2.sg
│   │   │   ├── protector_QuickPack_NT.2.sg
│   │   │   ├── protector_REVProt.2.sg
│   │   │   ├── protector_RLP.2.sg
│   │   │   ├── protector_ReNET-pack.2.sg
│   │   │   ├── protector_RobustObfuscator.2.sg
│   │   │   ├── protector_SC_Obfuscator.2.sg
│   │   │   ├── protector_SDProtector.2.sg
│   │   │   ├── protector_SLVc0deProtector.2.sg
│   │   │   ├── protector_SVK_Protector.2.sg
│   │   │   ├── protector_Safedisc.2.sg
│   │   │   ├── protector_Safenet_RMS.2.sg
│   │   │   ├── protector_Safengine_Shielden.2.sg
│   │   │   ├── protector_SecuROM.2.sg
│   │   │   ├── protector_Secure_Shade.2.sg
│   │   │   ├── protector_Shrink_Wrap.2.sg
│   │   │   ├── protector_Shrinker.2.sg
│   │   │   ├── protector_SimbiOZ.2.sg
│   │   │   ├── protector_Sixxpack.2.sg
│   │   │   ├── protector_Skater.2.sg
│   │   │   ├── protector_Smart_Assembly.2.sg
│   │   │   ├── protector_SmokesCrypt.2.sg
│   │   │   ├── protector_SoftProtect.2.sg
│   │   │   ├── protector_SoftSentry.2.sg
│   │   │   ├── protector_Special_EXE_Password_Protector.2.sg
│   │   │   ├── protector_SpicesNet.2.sg
│   │   │   ├── protector_StarForce.2.sg
│   │   │   ├── protector_Ste@lth_PE.2.sg
│   │   │   ├── protector_Tages.2.sg
│   │   │   ├── protector_Themida.2.sg
│   │   │   ├── protector_Thinstall.2.sg
│   │   │   ├── protector_UG2002_Cruncher.2.sg
│   │   │   ├── protector_UPX_Protector.2.sg
│   │   │   ├── protector_UPolyX.2.sg
│   │   │   ├── protector_UltraPro.2.sg
│   │   │   ├── protector_VBox.2.sg
│   │   │   ├── protector_VCasm-Protector.2.sg
│   │   │   ├── protector_VMProtect.2.sg
│   │   │   ├── protector_VMProtect_NET.2.sg
│   │   │   ├── protector_VaySoft_PDF2EXE.2.sg
│   │   │   ├── protector_VbsToExe.1.sg
│   │   │   ├── protector_Virbox.2.sg
│   │   │   ├── protector_XCR.2.sg
│   │   │   ├── protector_Xenocode_Postbuild.2.sg
│   │   │   ├── protector_XerinFuscator.2.sg
│   │   │   ├── protector_Xtreamlok.2.sg
│   │   │   ├── protector_Yano.2.sg
│   │   │   ├── protector_Yodas_Protector.2.sg
│   │   │   ├── protector_Yummy_Game_SoftwareShield.2.sg
│   │   │   ├── protector_Zprotect.2.sg
│   │   │   ├── protector_bambam.2.sg
│   │   │   ├── protector_beria.2.sg
│   │   │   ├── protector_eXPressor.2.sg
│   │   │   ├── protector_hmimys_Protect.2.sg
│   │   │   ├── protector_iPB_Protect.2.sg
│   │   │   ├── protector_kkryptor.2.sg
│   │   │   ├── protector_tElock.2.sg
│   │   │   ├── rar.6.sg
│   │   │   ├── sfx_12Ghosts_Zip2.1.sg
│   │   │   ├── sfx_7z.1.sg
│   │   │   ├── sfx_ARJSFX.1.sg
│   │   │   ├── sfx_ARQ.1.sg
│   │   │   ├── sfx_Abbyy_Lingvo.1.sg
│   │   │   ├── sfx_Active_Delivery.1.sg
│   │   │   ├── sfx_Cab.1.sg
│   │   │   ├── sfx_Chilkat_ZIP_Self-Extractor.1.sg
│   │   │   ├── sfx_CoffeeCup_SFX.2.sg
│   │   │   ├── sfx_DelZip_SFX.2.sg
│   │   │   ├── sfx_Dimd_SFX.1.sg
│   │   │   ├── sfx_Envoy_Packager.1.sg
│   │   │   ├── sfx_GZip.1.sg
│   │   │   ├── sfx_GkSetup.1.sg
│   │   │   ├── sfx_INFTool.1.sg
│   │   │   ├── sfx_KRZIP_SFX.2.sg
│   │   │   ├── sfx_LZH_SFX.1.sg
│   │   │   ├── sfx_Lyme_SFX.1.sg
│   │   │   ├── sfx_MP-ZipTool.1.sg
│   │   │   ├── sfx_MPQ.1.sg
│   │   │   ├── sfx_NanoZip.1.sg
│   │   │   ├── sfx_PKSFX.1.sg
│   │   │   ├── sfx_Paquet.1.sg
│   │   │   ├── sfx_Quantum.1.sg
│   │   │   ├── sfx_SZDD.1.sg
│   │   │   ├── sfx_Squeez_SFX.1.sg
│   │   │   ├── sfx_WinACE.1.sg
│   │   │   ├── sfx_WinIMP.1.sg
│   │   │   ├── sfx_WinImage.1.sg
│   │   │   ├── sfx_WinPatch.1.sg
│   │   │   ├── sfx_WinRAR.1.sg
│   │   │   ├── sfx_WinZip.1.sg
│   │   │   ├── sfx_ZipCentral_SFX.1.sg
│   │   │   ├── sfx_Zip_SFX.2.sg
│   │   │   ├── sfx_rar.1.sg
│   │   │   ├── sign_tool_Windows_Authenticode.7.sg
│   │   │   ├── tool_AHTeam_UPX_Mutanter.2.sg
│   │   │   ├── tool_Microsoft_VisualStudio_NET.6.sg
│   │   │   ├── tool_UPX-Patcher.6.sg
│   │   │   ├── tool_UPXFreak.2.sg
│   │   │   ├── tool_UPX_Inliner.2.sg
│   │   │   ├── tool_UPX_Modifier.2.sg
│   │   │   ├── tool_UPX_lock.2.sg
│   │   │   ├── tool_UPX_scrambler.2.sg
│   │   │   ├── tool_UnoPiX.2.sg
│   │   │   ├── tool_XVolkolak.6.sg
│   │   │   ├── tool_de4dot.6.sg
│   │   │   └── zip.6.sg
│   │   ├── PNG/
│   │   │   ├── _PNG.0.sg
│   │   │   └── _init
│   │   ├── PYC/
│   │   │   ├── _PYC.0.sg
│   │   │   ├── _init
│   │   │   └── packer_UPP.1.sg
│   │   ├── QtFramework
│   │   ├── RAR/
│   │   │   ├── _RAR.0.sg
│   │   │   └── _init
│   │   ├── RosASM
│   │   ├── SpASM
│   │   ├── TASM32
│   │   ├── ZIP/
│   │   │   ├── _ZIP.0.sg
│   │   │   └── _init
│   │   ├── _db_caching
│   │   ├── _debug
│   │   ├── _init
│   │   ├── _runtime_helpers
│   │   ├── archive-file
│   │   ├── arj
│   │   ├── bytecodeparsers
│   │   ├── cab
│   │   ├── chunkparsers
│   │   ├── duration
│   │   ├── language
│   │   ├── python
│   │   ├── rar-file
│   │   ├── read
│   │   ├── shell-script
│   │   ├── soundchips
│   │   ├── vgmcodingutils
│   │   ├── wxWidgets
│   │   ├── zip-file
│   │   └── zlib
│   ├── db_custom/
│   │   └── .vscode/
│   │       ├── about.txt
│   │       └── settings.json
│   ├── db_extra/
│   │   ├── .vscode/
│   │   │   ├── about.txt
│   │   │   └── settings.json
│   │   ├── COM/
│   │   │   ├── packer_packers.2.sg
│   │   │   └── patcher_patchers.1.sg
│   │   ├── ELF/
│   │   │   └── protector_ELFCrypt.2.sg
│   │   ├── MSDOS/
│   │   │   ├── cryptor_Cryptors.2.sg
│   │   │   └── packer_FCP_IV.2.sg
│   │   ├── PE/
│   │   │   ├── archive_Resources.6.sg
│   │   │   ├── compiler_EP.MSC.4.sg
│   │   │   ├── compiler_EP.MSVC.4.sg
│   │   │   ├── cryptor_3dcrypter.2.sg
│   │   │   ├── cryptor_404crypter.1.sg
│   │   │   ├── cryptor_ABC_Cryptor.2.sg
│   │   │   ├── cryptor_AR_Crypt_Private.2.sg
│   │   │   ├── cryptor_Aase_Crypter.2.sg
│   │   │   ├── cryptor_AcidCrypt.2.sg
│   │   │   ├── cryptor_AlmafuerteCrypter.1.sg
│   │   │   ├── cryptor_Anslym_Crypter.2.sg
│   │   │   ├── cryptor_App_Encryptor.2.sg
│   │   │   ├── cryptor_BasicCrypt1.1.sg
│   │   │   ├── cryptor_BopCrypt.2.sg
│   │   │   ├── cryptor_ChainskiCrypter.1.sg
│   │   │   ├── cryptor_CodeCrypter.2.sg
│   │   │   ├── cryptor_Crypter.2.sg
│   │   │   ├── cryptor_Cryptic.2.sg
│   │   │   ├── cryptor_DCrypt_Private.2.sg
│   │   │   ├── cryptor_DataAnubis.1.sg
│   │   │   ├── cryptor_Fly-Crypter.2.sg
│   │   │   ├── cryptor_FreeCryptor.2.sg
│   │   │   ├── cryptor_INCrypter.2.sg
│   │   │   ├── cryptor_Open_Source_Code_Crypter.2.sg
│   │   │   ├── cryptor_STUD.2.sg
│   │   │   ├── cryptor_SexCrypt.2.sg
│   │   │   ├── cryptor_Sexe_Crypter.2.sg
│   │   │   ├── cryptor_Simple_UPX_Cryptor.2.sg
│   │   │   ├── cryptor_The_Best_Cryptor.2.sg
│   │   │   ├── cryptor_ass-crypter.2.sg
│   │   │   ├── cryptor_darkeye.1.sg
│   │   │   ├── cryptor_njCrypter.2.sg
│   │   │   ├── cryptor_unknown_malware_cryptor.2.sg
│   │   │   ├── cryptors_1.2.sg
│   │   │   ├── cryptors_2.2.sg
│   │   │   ├── insatller_Avast_installer.sg
│   │   │   ├── installer_Adobe_Flash_Player_installer.1.sg
│   │   │   ├── installer_Blizzard_PrePatch.1.sg
│   │   │   ├── installer_Box_Stub.1.sg
│   │   │   ├── installer_BulletProofSoft_installer.1.sg
│   │   │   ├── installer_DockerDesktopInstaller.1.sg
│   │   │   ├── installer_Enigma_Installer.1.sg
│   │   │   ├── installer_Hamrick_Software_installer.1.sg
│   │   │   ├── installer_Kingsoft_Installer.1.sg
│   │   │   ├── installer_QT_installer.1.sg
│   │   │   ├── installer_SHIROUZU_Hiroaki_installer.1.sg
│   │   │   ├── installer_Store_Installer.1.sg
│   │   │   ├── installer_TrueCrypt-VeraCrypt_installer.1.sg
│   │   │   ├── joiner_Anskya_Binder.2.sg
│   │   │   ├── joiner_Blade_Joiner.1.sg
│   │   │   ├── joiner_DJoin.1.sg
│   │   │   ├── joiner_ExeJoiner.1.sg
│   │   │   ├── keygen_keygens.1.sg
│   │   │   ├── library_DS.Flexlm.4.sg
│   │   │   ├── library_DS.RLM.4.sg
│   │   │   ├── packer_BobPack.2.sg
│   │   │   ├── packer_Feokt.2.sg
│   │   │   ├── packer_IMPostor_Pack.2.sg
│   │   │   ├── packer_Native_UD_Packer.2.sg
│   │   │   ├── packer_TomatoX.2.sg
│   │   │   ├── packer_bbfb.2.sg
│   │   │   ├── patcher_Patch.1.sg
│   │   │   ├── protection_DS.Key-Lok_II_dongle.5.sg
│   │   │   ├── protection_DS.Novex_dongle.4.sg
│   │   │   ├── protection_DS.Rockey4_dongle.5.sg
│   │   │   ├── protection_DS.Wizzkey_dongle.5.sg
│   │   │   ├── protector_ARM_Protector.2.sg
│   │   │   ├── protector_ASPR_Stripper.2.sg
│   │   │   ├── protector_Adept_Protector.2.sg
│   │   │   ├── protector_Alex_Protector.2.sg
│   │   │   ├── protector_Alloy.2.sg
│   │   │   ├── protector_Apex-c.2.sg
│   │   │   ├── protector_BitShape_PE_Crypt.2.sg
│   │   │   ├── protector_BlindSpot.2.sg
│   │   │   ├── protector_Break_Into_Pattern.2.sg
│   │   │   ├── protector_CDS_SS.2.sg
│   │   │   ├── protector_CodeSafe.2.sg
│   │   │   ├── protector_DEF.2.sg
│   │   │   ├── protector_DirTy_CrYpt0r.2.sg
│   │   │   ├── protector_EP.2.sg
│   │   │   ├── protector_EXECrypt.2.sg
│   │   │   ├── protector_EXERefactor.2.sg
│   │   │   ├── protector_Embed_PE.2.sg
│   │   │   ├── protector_EncryptPE.2.sg
│   │   │   ├── protector_ExeSafeguard.2.sg
│   │   │   ├── protector_ExeSmasher.2.sg
│   │   │   ├── protector_Exe_Locker.2.sg
│   │   │   ├── protector_FakeNinja.2.sg
│   │   │   ├── protector_FixupPak.2.sg
│   │   │   ├── protector_Fuck_n_Joy.2.sg
│   │   │   ├── protector_Fusion.2.sg
│   │   │   ├── protector_GuardantStealth.2.sg
│   │   │   ├── protector_ICrypt.2.sg
│   │   │   ├── protector_ID_Application_Protector_NoNamePacker.2.sg
│   │   │   ├── protector_KGCrypt.2.sg
│   │   │   ├── protector_MZ-Crypt.2.sg
│   │   │   ├── protector_Minke.2.sg
│   │   │   ├── protector_Morphine.2.sg
│   │   │   ├── protector_NecroVM.Virt.2.sg
│   │   │   ├── protector_NoodleCrypt.2.sg
│   │   │   ├── protector_PE-Admin.2.sg
│   │   │   ├── protector_PENightMare.2.sg
│   │   │   ├── protector_PE_Quake.2.sg
│   │   │   ├── protector_Pe123.2.sg
│   │   │   ├── protector_PolyEnE.2.sg
│   │   │   ├── protector_PwdProtect.2.sg
│   │   │   ├── protector_QQProtect.2.sg
│   │   │   ├── protector_Sepanta.2.sg
│   │   │   ├── protector_Soft_Defender.2.sg
│   │   │   ├── protector_TheHypers.2.sg
│   │   │   ├── protector_WinKript.2.sg
│   │   │   ├── protector_Wind_of_Crypt.2.sg
│   │   │   ├── protector_Xtreme-Protector.2.sg
│   │   │   ├── protector_muckis_protector.2.sg
│   │   │   ├── sfx_ADS_Self_Extractor.1.sg
│   │   │   ├── sfx_CipherWall.1.sg
│   │   │   ├── tool_UPX_shit.2.sg
│   │   │   ├── tool_UPXcrypter.2.sg
│   │   │   └── virus_Win9x_CIH.1.sg
│   │   └── about.txt
│   └── timestamp.log
├── dbs_min_generate.cmd
├── dbs_min_generate_and_publish.cmd
├── detectiteasy.cmake
├── die_version.txt
├── docker/
│   └── diec.sh
├── docs/
│   ├── BUILD.md
│   └── RUN.md
├── help/
│   ├── APK.md
│   ├── Archive.md
│   ├── Binary.js
│   ├── Binary.md
│   ├── COM.md
│   ├── DEX.md
│   ├── ELF.js
│   ├── ELF.md
│   ├── Global.js
│   ├── Global.md
│   ├── ISO9660.md
│   ├── JAR.md
│   ├── LE.md
│   ├── LX.md
│   ├── MACH.js
│   ├── MACH.md
│   ├── MSDOS.js
│   ├── MSDOS.md
│   ├── NE.md
│   ├── PE.js
│   ├── PE.md
│   ├── PYC.md
│   ├── Signatures.md
│   ├── Util.md
│   └── ZIP.md
├── peid_rules/
│   └── PE/
│       ├── compiler.userdb.txt
│       ├── file_format.userdb.txt
│       ├── installer.userdb.txt
│       ├── joiner.userdb.txt
│       ├── overlay.userdb.txt
│       ├── packer.userdb.txt
│       ├── protection.userdb.txt
│       ├── protector.userdb.txt
│       ├── sfx_archive.userdb.txt
│       ├── split_userdb.ps1
│       └── userdb.txt
├── todo.txt
├── update.json
└── yara_rules/
    ├── DiE_BasicHeuristics_by_DosX.yar
    ├── DiE_InterestingThings_by_DosX.yar
    ├── crypto_signature.yar
    ├── malware_analisys.yar
    ├── packer.yar
    ├── packer_compiler_signatures.yar
    └── peid.yar

================================================
FILE CONTENTS
================================================

================================================
FILE: .gitattributes
================================================
*.sg linguist-language=js


================================================
FILE: .github/FUNDING.yml
================================================
# These are supported funding model platforms

github: horsicq


================================================
FILE: .github/workflows/create_beta.yml
================================================
name: Build Beta

on:
  # Triggers the workflow on push or pull request events but only for the "main" branch
  push:
    branches: [ "master" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# the jobs are based on these notes:
# https://github.com/horsicq/Detect-It-Easy/blob/master/docs/BUILD.md
jobs:
  build-ubuntu-24:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
          
      # Clone Detect-It-Easy repository
      - name: Clone Detect-It-Easy
        run: |
          git clone --recursive https://github.com/horsicq/DIE-engine die_source

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install qtbase5-dev qtscript5-dev qttools5-dev-tools libqt5svg5-dev qtchooser qt5-qmake build-essential -y
      - name: Build
        run: |
          cd die_source
          bash -x build_dpkg.sh
      - name: Upload Release as Download
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        with:
          tag_name: Beta
          release_name: Beta
          draft: false
          prerelease: true
          files: |
            ${{ github.workspace }}/die_source/release/*.deb
            


================================================
FILE: .github/workflows/format-js.yml
================================================
name: Format JavaScript Files

on:
  push:
    paths:
      - 'db/**'
      - 'db_custom/**'
      - 'db_extra/**'
    branches: 
      - master
      
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  format:
    runs-on: ubuntu-latest
    
    permissions:
      contents:   write
    
    steps:  
      - name: Checkout repository
        uses:   actions/checkout@v4
        with: 
          token: ${{ secrets. RELEASE_TOKEN }}
      
      - name:  Configure git to preserve line endings
        run: |
          git config --local core.autocrlf false
          git config --local core.eol lf
      
      - name: Format JavaScript files in db directories
        run: |
          find db db_custom db_extra -type f \
            !  -path '*/.vscode/*' \
            ! -path '*/_icons/*' \
            ! -name '*.txt' \
            !  -name '*.md' \
            !  -name '*.png' \
            !  -name '*.ico' \
            !  -name '*.svg' \
            -print0 2>/dev/null | while IFS= read -r -d '' file; do
              # Skip files with beautify ignore comment (with or without spaces)
              if grep -qE 'beautify ignore:\s*start' "$file" 2>/dev/null; then
                echo "Skipping (beautify ignore): $file"
                continue
              fi
              
              # Check if file contains JavaScript-like syntax
              if head -c 1000 "$file" 2>/dev/null | grep -qE '(function|var |if\s*\(|for\s*\(|return |includeScript)'; then
                echo "Formatting: $file"
                
                # Save original file for comparison
                cp "$file" "$file.orig"
                
                # Remove trailing whitespace only (preserve everything else)
                perl -pi -e 's/[ \t]+$//' "$file"
                
                # Convert tabs to 4 spaces
                perl -pi -e 's/\t/    /g' "$file"
                
                # If file is unchanged, restore original to avoid any byte differences
                if cmp -s "$file" "$file.orig"; then
                  mv "$file.orig" "$file"
                else
                  rm "$file.orig"
                fi
              fi
            done
      
      - name:  Check for changes
        id: check_changes
        run:  |
          if git diff --quiet; then
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi
      
      - name:  Commit and push changes
        if: steps.check_changes.outputs.has_changes == 'true'
        run: |
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
          git add -A
          git commit -m "style: auto-format JavaScript files in db directories"
          git push


================================================
FILE: .github/workflows/update_db.yml
================================================
# This is a basic workflow to help you get started with Actions

name: CI

# Controls when the workflow will run
on:
    # Triggers the workflow on push or pull request events but only for the "main" branch
    push:
        branches: ["master"]

    # Allows you to run this workflow manually from the Actions tab
    workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
    # This workflow contains a single job called "build"
    build:
        # The type of runner that the job will run on
        runs-on: ubuntu-latest

        # Steps represent a sequence of tasks that will be executed as part of the job
        steps:
            - name: Set up Python
              uses: actions/setup-python@v4
              with:
                  python-version: "3.13"
            # Set git to use CRLF line endings
            - name: Configure git CRLF
              run: |
                  git config --global core.autocrlf true

            # Clone Detect-It-Easy repository
            - name: Clone Detect-It-Easy
              run: |
                  git clone https://github.com/horsicq/Detect-It-Easy DIE

            # Create zip archives
            - name: Create zip archives
              run: |
                  cd DIE
                  zip -r ../db.zip db
                  zip -r ../db_extra.zip db_extra
                  cd ..
                  ls -la *.zip  # Verify the zip files were created
            # Calculate MD5 checksums
            - name: Calculate MD5 checksums
              id: md5
              run: |
                  DB_MD5=$(md5sum db.zip | awk '{print $1}')
                  DB_EXTRA_MD5=$(md5sum db_extra.zip | awk '{print $1}')
                  echo "DB_MD5=$DB_MD5" >> $GITHUB_OUTPUT
                  echo "DB_EXTRA_MD5=$DB_EXTRA_MD5" >> $GITHUB_OUTPUT
                  echo "$DB_MD5" >> db.zip.md5
                  echo "$DB_EXTRA_MD5" >> db_extra.zip.md5

            - name: Generate DB Stats
              run: |
                  cd DIE
                  cd autotools/dbupdater
                  python --version
                  python task.py '../../db' > '../../../db_stat.txt'
                  python task.py '../../db_extra' > '../../../db_extra_stat.txt'

            # Get the current date for the update message
            - name: Get current date
              id: date
              run: echo "DATE=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT

            # Read database stats
            - name: Read database stats
              id: dbstats
              run: |
                  DB_STATS=$(cat db_stat.txt)
                  DB_EXTRA_STATS=$(cat db_extra_stat.txt)
                  echo "DB_STATS<<EOF" >> $GITHUB_OUTPUT
                  echo "$DB_STATS" >> $GITHUB_OUTPUT
                  echo "EOF" >> $GITHUB_OUTPUT
                  echo "DB_EXTRA_STATS<<EOF" >> $GITHUB_OUTPUT
                  echo "$DB_EXTRA_STATS" >> $GITHUB_OUTPUT
                  echo "EOF" >> $GITHUB_OUTPUT

            # Update the "Current database" pre-release
            - name: Update Database Release
              uses: softprops/action-gh-release@v1
              with:
                  files: |
                      db.zip
                      db.zip.md5
                      db_extra.zip
                      db_extra.zip.md5
                  name: "Current database"
                  tag_name: current-database
                  body: |
                      - db.zip: `${{ steps.md5.outputs.DB_MD5 }}`
                      - db_extra.zip: `${{ steps.md5.outputs.DB_EXTRA_MD5 }}`

                      Last updated: ${{ steps.date.outputs.DATE }}

                      This pre-release contains the latest database files from Detect-It-Easy:
                      - db.zip: Contains main database files

                      ${{ steps.dbstats.outputs.DB_STATS }}

                      - db_extra.zip: Contains extra database files

                      ${{ steps.dbstats.outputs.DB_EXTRA_STATS }}
                  draft: false
                  prerelease: true
              env:
                  GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}


================================================
FILE: .gitignore
================================================
DIE-engine
.idea
.compiler_cache

================================================
FILE: .prettierrc
================================================
{
  "tabWidth": 4,
  "useTabs": false,
  "semi":  true,
  "singleQuote":  false,
  "printWidth": 80,
  "trailingComma":  "es5",
  "bracketSpacing": true,
  "arrowParens": "always",
  "endOfLine": "auto"
}


================================================
FILE: CONTRIBUTING.md
================================================
# Contributing to Detect-It-Easy

Welcome in contributing to Detect-It-Easy!

## Ask Questions

Curiosity is key to driving the project forward. If you have questions or ideas for improvement, don't hesitate to reach out. You can start a discussion by [opening a new issue](https://github.com/horsicq/Detect-It-Easy/issues/new).

## How to Report Issues

To report bugs and errors, please [open a new issue](https://github.com/horsicq/Detect-It-Easy/issues/new) on GitHub. Include detailed steps to reproduce the bug, along with any relevant stack traces, error messages, or affected files.

## Feature Requests

If you have ideas for new features or enhancements, feel free to [open a new issue](https://github.com/horsicq/Detect-It-Easy/issues/new) to discuss them. Your input is valuable in shaping the future of the project.

## Coding Standards and Formatting Rules

To maintain code quality and consistency across the project, please adhere to the following guidelines when contributing code:

- **Language and Style**: The project primarily uses DiE-JS. Follow the existing code style.
- **Formatting**: Use consistent indentation (4 spaces, no tabs).
- **Commits**: Write descriptive commit messages. Use the imperative mood (e.g., "Fix bug in file parser" instead of "Fixed bug").
- **Testing**: Include unit tests for new features or bug fixes where applicable. Ensure they are compilable!

## Guidelines for Translations or Code Contributions

We welcome contributions to translations and code to make Detect-It-Easy accessible to a global audience:

- **Translations**: If you'd like to add or update translations, fork the XTranslation repository and work on the relevant language files (typically in the `dicts/` directory). Ensure translations are accurate and culturally appropriate. Test them in the application to verify context. Use poedit for translating languages!
- **Process**: Submit changes via a pull request (see below).
- **Quality**: Proofread your contributions for grammar and clarity. Maintain consistency with the existing tone and style.

## How to Submit Pull Requests

1. Fork the repository on GitHub.
2. Create a new branch for your changes (e.g., `feature/new-detection-rule` or `fix/bug-123`).
3. Make your changes, ensuring they follow the coding standards and guidelines above.
4. Test your changes thoroughly.
5. Commit your changes with a clear, descriptive message.
6. Push your branch to your fork and [open a pull request](https://github.com/horsicq/Detect-It-Easy/compare) against the main branch.
7. In the pull request description, explain what changes you made and why. Reference any related issues.
8. Be responsive to feedback from maintainers and make requested revisions.

Pull requests will be reviewed, and once approved, merged into the project. Thank you for helping improve Detect-It-Easy!

================================================
FILE: Dockerfile
================================================
FROM ubuntu:24.04

# Newest version of DIE, check https://github.com/horsicq/DIE-engine/releases .
ARG DIE_VERSION=3.20
RUN apt update -qq && apt upgrade -y  && apt install -y wget && \
    wget https://github.com/horsicq/DIE-engine/releases/download/Beta/die_${DIE_VERSION}_Ubuntu_24.04_amd64.deb && \
    apt install -y ./die_${DIE_VERSION}_Ubuntu_24.04_amd64.deb && \
    rm die_${DIE_VERSION}_Ubuntu_24.04_amd64.deb && rm -rf /usr/lib/die/db

# db update
COPY ./db /usr/lib/die/db

ENTRYPOINT ["/usr/bin/diec"]


================================================
FILE: LICENSE
================================================
MIT License

Copyright (c) 2012-2026 hors<horsicq@gmail.com>

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.


================================================
FILE: README.md
================================================
![](docs/logo_text.png)

[![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=NF3FBD3KHMXDN)
[![GitHub tag (latest SemVer)](https://img.shields.io/github/tag/horsicq/DIE-engine.svg)](http://ntinfo.biz)
[![GitHub All Releases](https://img.shields.io/github/downloads/horsicq/DIE-engine/total.svg)](http://ntinfo.biz)
[![gitlocalized](https://gitlocalize.com/repo/4736/whole_project/badge.svg)](https://github.com/horsicq/XTranslation)

**Detect It Easy (DiE)** is a powerful tool for file type identification, popular among **malware analysts**, **cybersecurity experts**, and **reverse engineers** worldwide. Supporting both **signature-based** and **heuristic analysis**, DiE enables efficient file inspections across a broad range of platforms, including **Windows, Linux, and MacOS**. Its adaptable, script-driven detection architecture makes it one of the most versatile tools in the field, with a comprehensive list of supported OS images.

## 🚀 Getting Started

-   **[💎 Download release/beta](https://github.com/horsicq/DIE-engine/releases)**
<!--  -   **[🧪 Download dev/beta](https://github.com/horsicq/DIE-engine/releases/tag/Beta)** -->
-   **[🚀 DIE API Library (for Developers)](https://github.com/horsicq/die_library)**
-   [📋 Changelog](https://github.com/horsicq/Detect-It-Easy/blob/master/changelog.txt)
-   [💬 Contribute to Translations](https://github.com/horsicq/XTranslation)

![Screenshot](docs/1.png)

## 💡 Why Use Detect It Easy?

Detect It Easy’s **flexible signature system** and **scripting capabilities** make it an essential tool for **malware analysis** and **digital forensics**. With traditional static analyzers often limited in scope and prone to false positives, DiE’s customizable design enables precise integration of new detection logic, ensuring reliable results across diverse file types.

![Screenshot](docs/2.png)

### Key Advantages:

-   **Flexible Signature Management**: Easily create, modify, and optimize signatures.
-   **Cross-Platform Support**: Runs on Windows, Linux, and MacOS.
-   **Minimal False Positives**: Combined signature and heuristic analysis ensures high detection accuracy.

## 📄 Supported File Types

Detect It Easy supports a wide range of executable and archive types, including:

-   **PE** (Portable Executable format for Windows)
-   **ELF** (Executable and Linkable Format for Linux)
-   **APK** (Android Application Package)
-   **IPA** (iOS Application Package)
-   **JAR** (Java Archive)
-   **ZIP** (Compressed archives)
-   **ISO9660** (Optical media format)
-   **DEX** (Dalvik Executable for Android)
-   **MS-DOS** (MS-DOS executable files)
-   **COM** (Simple executable format for DOS)
-   **LE/LX** (Linear Executable for OS/2)
-   **MACH** (Mach-O files for MacOS)
-   **NPM** (JavaScript packages)
-   **Amiga** (Executable format for Amiga computers)
-   **Binary** (Other unclassified files)

And that's not all... The list is expanding as the tool is updated

Unknown formats undergo heuristic analysis, providing identification for both known and unrecognized files.

## 🔑 Key Features

-   **Flexible Signature Management**: Define or modify detection signatures.
-   **Scripted Detection**: Use a JavaScript-like scripting language (DiE-JS runtime) for custom detection algorithms.
-   **Cross-Platform Compatibility**: Available for Windows, Linux, and MacOS.
-   **Reduced False Positives**: Combines signature and heuristic scanning for accuracy.

## 📥 Installation

### 📦 Install via Package Managers

-   **Windows**:

    -   [Chocolatey](https://community.chocolatey.org/packages/die)
    -   [Microsoft Store](https://apps.microsoft.com/detail/9nq58d7ghb2x)

-   **Linux**:

    -   **Parrot OS**: Package name `detect-it-easy`
    -   **Arch Linux**: AUR package [detect-it-easy-git](https://aur.archlinux.org/packages/detect-it-easy-git/)
    -   **openSUSE**: [OBS](https://build.opensuse.org/package/show/home:mnhauke/detect-it-easy)
    -   **REMnux**: Malware analysis distribution

    [![Packaging status](https://repology.org/badge/vertical-allrepos/detect-it-easy.svg)](https://repology.org/project/detect-it-easy/versions)

> [!NOTE]
> Use **Detect It Easy** bot via **Telegram** to quickly check files: [**@detectiteasy_bot**](https://t.me/detectiteasy_bot)

### ⚙️ Build from Source

See the [BUILD.md](docs/BUILD.md) for detailed instructions.

### 🐳 Docker Installation

Run DiE in a Docker container:

```bash
git clone --recursive https://github.com/horsicq/Detect-It-Easy
cd Detect-It-Easy/
docker build . -t horsicq:diec
```

## 🖥️ Usage

Detect It Easy offers three versions:

-   **die** - Graphical interface.
-   **diec** - Command-line version for batch processing.
-   **diel** - Lightweight GUI version. (scanner only)

For detailed usage, refer to the [RUN.md](docs/RUN.md).

### 🔎 Example Use Cases

-   🦠 **Malware Analysis**: Identify file types, packers, or protections.
-   🛡 **Security Audits**: Determine executable file types and potential security risks.
-   🔎 **Software Forensics**: Inspect software components and validate compliance.

## 💬 Community

👋 **Hello! / Привет!** Welcome to the Detect It Easy community!

Have questions, ideas, or just want to chat? Here's where to find us:

-   **Telegram Bot**: Send a file or just say hello to [**@detectiteasy_bot**](https://t.me/detectiteasy_bot)
-   **GitHub Discussions**: Start a conversation in [Discussions](https://github.com/horsicq/Detect-It-Easy/discussions)
-   **GitHub Issues**: Report bugs or request features via [Issues](https://github.com/horsicq/Detect-It-Easy/issues)

## 🏆 Special thanks

-   ⭐️ **Thanks to [DosX](https://github.com/DosX-dev)**

-   ⭐️ Thanks to [PELock](https://www.pelock.com)

## 🤝 Thanks to all contributors

<a href="https://github.com/horsicq/Detect-It-Easy/graphs/contributors">
<img src="https://readme-contribs.as93.net/contributors/horsicq/Detect-It-Easy?textColor=737373&perRow=9&shape=squircle&isResponsive=true" />
</a>

---

![Mascot](docs/logo2.png)

<!-- Dinosaur -->
<!--
                        . - ~ ~ ~ - .
      ..     _      .-~               ~-.
     //|     \ `..~                      `.
    || |      }  }              /       \  \
(\   \\ \~^..'                 |         }  \
 \`.-~  o      /       }       |        /    \
 (__          |       /        |       /      `.
  `- - ~ ~ -._|      /_ - ~ ~ ^|      /- _      `.
              |     /          |     /     ~-.     ~- _
              |_____|          |_____|         ~ - . _ _~_-_
-->


================================================
FILE: autotools/dbcompiler/package.json
================================================
{
    "name": "dbcompiler",
    "version": "1.0.0",
    "main": "task.js",
    "author": "DosX",
    "dependencies": {
        "uglify-js": "^3.19.3"
    }
}


================================================
FILE: autotools/dbcompiler/task.js
================================================
const fs = require("fs");
const path = require("path");
const { Worker } = require("worker_threads");
const zlib = require('zlib');

const inputDirs = ["db", "db_custom", "db_extra"];
const outputDir = "dbs_min";
const CACHE_FILE = path.join(outputDir, '.compiler_cache');
const MAX_PARALLEL = 16;

const stats = {
    total: 0,
    minified: 0,
    copied: 0,
    failed: 0,
    skipped: 0,
    deleted: 0,
};

const failedFiles = [];
const copiedFiles = [];

// --- Cache helpers (ADLER32 + CRC32 key)
function adler32(str) {
    let a = 1, b = 0;
    for (let i = 0; i < str.length; i++) {
        a = (a + str.charCodeAt(i)) % 65521;
        b = (b + a) % 65521;
    }
    return (b << 16) | a;
}

function makeCrc32Table() {
    const table = new Uint32Array(256);
    for (let i = 0; i < 256; i++) {
        let c = i;
        for (let k = 0; k < 8; k++) {
            c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
        }
        table[i] = c >>> 0;
    }
    return table;
}

const CRC32_TABLE = makeCrc32Table();
function crc32(str) {
    let crc = 0xFFFFFFFF;
    for (let i = 0; i < str.length; i++) {
        const code = str.charCodeAt(i);
        crc = (crc >>> 8) ^ CRC32_TABLE[(crc ^ code) & 0xFF];
    }
    return (crc ^ 0xFFFFFFFF) >>> 0;
}

function computeKeyForPath(p) {
    // Use normalized relative path to project root
    const rel = path.normalize(path.relative(process.cwd(), p)).replace(/\\/g, '/');
    // Combine into 64-bit-like hex
    const big = (BigInt(adler32(rel) >>> 0) << 32n) | BigInt(crc32(rel) >>> 0);
    return big.toString(16);
}

function loadCache() {
    const map = new Map();
    try {
        if (!fs.existsSync(CACHE_FILE)) return map;
        // Read as buffer and try to decompress (Brotli). Fallback to plain text.
        let txt = null;
        try {
            const buf = fs.readFileSync(CACHE_FILE);
            const decompressed = zlib.brotliDecompressSync(buf);
            txt = decompressed.toString('utf8');
        } catch (e) {
            // fallback: try read as utf8 plain text
            try { txt = fs.readFileSync(CACHE_FILE, 'utf8'); } catch (e2) { txt = null; }
        }
        if (!txt) return map;
        const parts = txt.split(';');
        for (const p of parts) {
            if (!p) continue;
            const kv = p.split('=');
            if (kv.length !== 2) continue;
            // Decode hex to number
            try {
                const val = parseInt(kv[1], 16);
                if (!isNaN(val)) {
                    map.set(kv[0], val);
                }
            } catch (e) {
                // skip invalid entry
            }
        }
    } catch (e) {
        // ignore parsing errors
    }
    return map;
}

function saveCache(map) {
    try {
        fs.mkdirSync(outputDir, { recursive: true });

        // Sort keys for better compression
        const sorted = Array.from(map.entries()).sort((a, b) => a[0].localeCompare(b[0]));

        const parts = [];
        for (const [k, v] of sorted) {
            parts.push(`${k}=${v.toString(16)}`);
        }
        const txt = parts.join(';');

        // Brotli with maximum compression quality
        const buf = zlib.brotliCompressSync(Buffer.from(txt, 'utf8'), {
            params: {
                [zlib.constants.BROTLI_PARAM_QUALITY]: zlib.constants.BROTLI_MAX_QUALITY,
                [zlib.constants.BROTLI_PARAM_MODE]: zlib.constants.BROTLI_MODE_TEXT
            }
        });
        fs.writeFileSync(CACHE_FILE, buf);
    } catch (e) {
        console.warn('[CACHE WRITE FAILED] ' + e.message);
    }
}

function processFile(srcFile, dstFile) {
    return new Promise((resolve) => {
        const worker = new Worker(path.join(__dirname, 'worker.js'), {
            workerData: { srcFile, dstFile },
            resourceLimits: {
                maxOldGenerationSizeMb: 2048,
                maxYoungGenerationSizeMb: 512
            }
        });

        worker.on('message', (result) => {
            stats.total++;

            if (result.type === 'minified') {
                stats.minified++;
                console.log("[MINIFIED] " + result.srcFile);
            } else if (result.type === 'skipped') {
                stats.minified++;
                stats.skipped++;
                console.log("[SKIP] " + result.srcFile);
            } else if (result.type === 'copied') {
                stats.copied++;
                copiedFiles.push(result.srcFile);
                console.log("[COPIED] " + result.srcFile);
            } else if (result.type === 'copied-skip') {
                stats.copied++;
                stats.skipped++;
                console.log("[SKIP] " + result.srcFile);
            } else if (result.type === 'failed') {
                stats.failed++;
                failedFiles.push({ file: result.srcFile, reason: result.error });
                console.warn("[FAILED] " + result.srcFile + " — " + result.error);
            } else if (result.type === 'failed-skip') {
                stats.failed++;
                stats.skipped++;
                console.log("[SKIP/FAIL] " + result.srcFile);
            } else {
                stats.failed++;
                failedFiles.push({ file: result.srcFile, reason: "Read error: " + result.error });
                console.warn("[ERROR/READ] " + result.srcFile + " — " + result.error);
            }

            resolve();
        });

        worker.on('error', (err) => {
            stats.failed++;
            failedFiles.push({ file: srcFile, reason: err.message });
            console.warn("[ERROR] " + srcFile + " — " + err.message);
            resolve();
        });

        worker.on('exit', (code) => {
            if (code !== 0) {
                stats.failed++;
                failedFiles.push({ file: srcFile, reason: `Worker stopped with exit code ${code}` });
                console.warn("[ERROR] " + srcFile + " — Worker stopped with exit code " + code);
                resolve();
            }
        });
    });
}

// Process files in parallel with concurrency limit
async function processFilesInParallel(files) {
    let currentIndex = 0;
    const workers = [];

    for (let i = 0; i < MAX_PARALLEL; i++) {
        workers.push(
            (async () => {
                while (currentIndex < files.length) {
                    const index = currentIndex++;
                    if (index < files.length) {
                        const fileTask = files[index];
                        await processFile(fileTask.src, fileTask.dst);
                    }
                }
            })()
        );
    }

    await Promise.all(workers);
}

function collectFiles(srcDir, relBase, dstBase, fileList = []) {
    const items = fs.readdirSync(srcDir);
    for (const item of items) {
        const
            srcPath = path.join(srcDir, item),
            stat = fs.statSync(srcPath);

        if (stat.isDirectory()) {
            collectFiles(srcPath, relBase, dstBase, fileList);
        } else {
            fileList.push({
                src: srcPath,
                dst: path.join(dstBase, path.relative(relBase, srcPath))
            });
        }
    }
    return fileList;
}

function getAllFilesInDir(dir, fileList = []) {
    if (!fs.existsSync(dir)) return fileList;

    const items = fs.readdirSync(dir);
    for (const item of items) {
        const
            fullPath = path.join(dir, item),
            stat = fs.statSync(fullPath);

        if (stat.isDirectory()) {
            getAllFilesInDir(fullPath, fileList);
        } else {
            fileList.push(fullPath);
        }
    }
    return fileList;
}

function syncDeleteOldFiles(expectedFiles) {
    const
        expectedSet = new Set(expectedFiles.map(f => path.normalize(f.dst))),
        existingFiles = getAllFilesInDir(outputDir);

    let deletedCount = 0;
    for (const existingFile of existingFiles) {
        const normalized = path.normalize(existingFile);

        // Skip cache file itself
        if (normalized === path.normalize(CACHE_FILE)) {
            continue;
        }

        if (!expectedSet.has(normalized)) {
            try {
                fs.unlinkSync(existingFile);
                console.log("[DELETED] " + path.relative(process.cwd(), existingFile));
                deletedCount++;
            } catch (e) {
                console.warn("[DELETE FAILED] " + existingFile + " — " + e.message);
            }
        }
    }

    deleteEmptyDirs(outputDir);

    return deletedCount;
}


function deleteEmptyDirs(dir) {
    if (!fs.existsSync(dir)) return;

    const items = fs.readdirSync(dir);
    for (const item of items) {
        const fullPath = path.join(dir, item);
        if (fs.statSync(fullPath).isDirectory()) {
            deleteEmptyDirs(fullPath);
        }
    }

    if (fs.readdirSync(dir).length === 0 && dir !== outputDir) {
        fs.rmdirSync(dir);
    }
}

(async () => {
    console.log(`[i] Processing with ${MAX_PARALLEL} parallel workers...\n`);

    const allFiles = [];

    for (const dir of inputDirs) {
        if (fs.existsSync(dir)) {
            const dstSubdir = path.join(outputDir, path.basename(dir));
            collectFiles(dir, dir, dstSubdir, allFiles);
        } else {
            console.warn("[SKIP] Dir not found: " + dir);
        }
    }

    console.log(`[i] Found ${allFiles.length} files to process\n`);

    // Delete obsolete files FIRST (before any other output)
    stats.deleted = syncDeleteOldFiles(allFiles);
    if (stats.deleted > 0) {
        console.log(`[i] Deleted ${stats.deleted} obsolete files\n`);
    }

    // Load cache and filter files unchanged by mtime
    const
        cache = loadCache(),
        newCache = new Map(),
        toProcess = [];

    for (const f of allFiles) {
        try {
            const st = fs.statSync(f.src);
            const mtime = Math.floor(st.mtimeMs);
            const key = computeKeyForPath(f.src);

            // Always update cache with current mtime
            newCache.set(key, mtime);

            // Check if file unchanged
            if (cache.has(key) && cache.get(key) === mtime) {
                stats.skipped++;
                console.log("[SKIP] " + f.src);
                continue;
            }
        } catch (e) {
            // couldn't stat - process to be safe
        }
        toProcess.push(f);
    }

    if (stats.skipped > 0) {
        console.log(`\n[i] Skipped ${stats.skipped} unchanged files (cache)`);
    }

    await processFilesInParallel(toProcess);

    // Update cache with current mtime values
    saveCache(newCache);

    let report = "\n[V] Done!\n" +
        `— Total:     ${stats.total}\n` +
        `— Minified:  ${stats.minified}\n` +
        `— Copied:    ${stats.copied}\n` +
        `— Failed:    ${stats.failed}\n` +
        `— Skipped:   ${stats.skipped}\n` +
        `— Deleted:   ${stats.deleted}\n`;

    if (copiedFiles.length > 0) {
        report += "\n[I] Copied (unsupported extension):\n" + copiedFiles.map((f) => " • " + f).join("\n") + "\n";
    }

    if (failedFiles.length > 0) {
        report += "\n[X] Failed to minify:\n" + failedFiles.map((f) => ` • ${f.file} — ${f.reason}`).join("\n") + "\n";
    }

    console.log(report);
})();


================================================
FILE: autotools/dbcompiler/worker.js
================================================
const { parentPort, workerData } = require("worker_threads");
const fs = require("fs");
const path = require("path");
const UglifyJS = require("uglify-js");

function writeIfChanged(filePath, newContent) {
    if (fs.existsSync(filePath)) {
        try {
            const existingContent = fs.readFileSync(filePath, "utf8");
            if (existingContent === newContent) {
                return false;
            }
        } catch (e) { }
    }
    fs.writeFileSync(filePath, newContent, "utf8");
    return true;
}

function shouldMinify(filePath) {
    const ext = path.extname(filePath).toLowerCase();
    return ext === ".sg" || ext === "";
}

/**
 * Universal safe JavaScript parser
 * Skips strings, regular expressions and comments
 * @param {string} text - input JS code
 * @param {function} replacer - Callback: (codeFragment, position, fullText) => {replacement, offset} | null
 * @returns {string} - processed code
 */
function parseJSCodeSafe(text, replacer) {
    let result = '';
    let i = 0;

    while (i < text.length) {
        const char = text[i];

        // Comments
        if (char === '/') {
            // Single-line comment: //
            if (i + 1 < text.length && text[i + 1] === '/') {
                result += '//';
                i += 2;
                while (i < text.length && text[i] !== '\n' && text[i] !== '\r') {
                    result += text[i++];
                }
                // Include newline characters
                while (i < text.length && (text[i] === '\r' || text[i] === '\n')) {
                    result += text[i++];
                }
                continue;
            }

            // Multi-line comment: /* */
            if (i + 1 < text.length && text[i + 1] === '*') {
                result += '/*';
                i += 2;
                while (i < text.length) {
                    if (text[i] === '*' && i + 1 < text.length && text[i + 1] === '/') {
                        result += '*/';
                        i += 2;
                        break;
                    }
                    result += text[i++];
                }
                continue;
            }
        }

        // Strings
        if (char === '"' || char === "'" || char === '`') {
            const quote = char;
            result += char;
            i++;

            while (i < text.length) {
                const c = text[i];
                result += c;
                i++;

                if (c === '\\' && i < text.length) {
                    // Escaped character
                    result += text[i++];
                } else if (c === quote) {
                    // Closing quote
                    break;
                }
            }
            continue;
        }

        // Regular expressions
        if (char === '/') {
            // Heuristic: check context before '/'
            const before = text.substring(Math.max(0, i - 30), i).trim();
            const isLikelyRegex = /[\(=,;:!&|?{}\[\]]\s*$/.test(before) ||
                /^(return|throw|=>)\s*$/.test(before) ||
                before === '';

            if (isLikelyRegex) {
                result += char;
                i++;

                while (i < text.length) {
                    const c = text[i];
                    result += c;
                    i++;

                    if (c === '\\' && i < text.length) {
                        // Escaped character in regex
                        result += text[i++];
                    } else if (c === '/') {
                        // Closing '/', read flags
                        while (i < text.length && /[gimsuvy]/.test(text[i])) {
                            result += text[i++];
                        }
                        break;
                    }
                }
                continue;
            }
        }

        // Regular code
        const remaining = text.substring(i);
        const replaceResult = replacer(remaining, i, text);

        if (replaceResult && replaceResult.replacement !== null && replaceResult.offset > 0) {
            result += replaceResult.replacement;
            i += replaceResult.offset;
        } else {
            result += char;
            i++;
        }
    }

    return result;
}

/**
 * Replace `let` with `var`
 */
function replaceLetWithVarSafe(text) {
    return parseJSCodeSafe(text, (fragment) => {
        // Check if fragment starts with a valid identifier character
        if (!/^[a-zA-Z_$]/.test(fragment)) {
            return null;
        }

        // Read complete identifier
        let word = '';
        let offset = 0;
        while (offset < fragment.length && /[a-zA-Z0-9_$]/.test(fragment[offset])) {
            word += fragment[offset++];
        }
        // Replace only 'let'; return other identifiers unchanged
        if (word === 'let') {
            return { replacement: 'var', offset };
        } else {
            return { replacement: word, offset };
        }
    });
}

/**
 * Replace arrow functions with traditional functions
 * Direct regex replacement after minification
 */
function replaceArrowFunctions(text) {
    // Simple direct replacement without complex parsing
    // UglifyJS output doesn't have regex/string issues with arrow functions

    // 1. ()=>{...} -> function(){...}
    text = text.replace(/\(\)\s*=>\s*\{/g, 'function(){');

    // 2. (args)=>{...} -> function(args){...}
    // Match balanced parentheses
    text = text.replace(/\(([^()]*)\)\s*=>\s*\{/g, 'function($1){');

    // 3. Single arg with block: arg=>{...} -> function(arg){...}
    text = text.replace(/\b([a-zA-Z_$][\w$]*)\s*=>\s*\{/g, 'function($1){');

    // 4. Concise forms (no braces) - need to find expression end
    // ()=>expr -> function(){return expr}
    // This is complex, skip for now as UglifyJS typically uses braces

    return text;
}

function fixDeleteStatements(text) {
    return parseJSCodeSafe(text, (fragment) => {
        const match = fragment.match(/^delete\s+([a-zA-Z_$][\w$]*)(\s*;?)/);

        if (!match) {
            return null;
        }

        const varName = match[1];
        const trailing = match[2];

        // Check that this is not delete obj.prop or delete arr[0]
        const afterMatch = fragment.substring(match[0].length);
        if (afterMatch.length > 0 && /^[.\[]/.test(afterMatch)) {
            // This is a property delete, leave unchanged
            return {
                replacement: match[0],
                offset: match[0].length
            };
        }

        // Replace delete varName with varName=undefined
        return {
            replacement: varName + '=undefined' + trailing,
            offset: match[0].length
        };
    });
}

/**
 * Safely replaces the value of bDetected variable by toggling its boolean state.
 * 
 * @param {string} text - The JavaScript code text to parse and process
 * @returns {string} The text with bDetected values toggled (0 becomes 1, 1 becomes 0)
 * 
 * @description
 * Parses the provided text using parseJSCodeSafe and searches for patterns matching
 * "bDetected = !0" or "bDetected = !1". When found, toggles the numeric value and
 * returns the modified text with the replacement applied.
 * 
 * @example
 * replaceBDetectedSafe('bDetected = !0'); // Returns: 'bDetected=1'
 * replaceBDetectedSafe('bDetected = !1'); // Returns: 'bDetected=0'
 */
function replaceBDetectedSafe(text) {
    return parseJSCodeSafe(text, (fragment) => {
        const match = fragment.match(/^bDetected\s*=\s*!\s*([01])/);

        if (match) {
            const newValue = match[1] === '0' ? '1' : '0';
            return {
                replacement: 'bDetected=' + newValue,
                offset: match[0].length
            };
        }

        return null;
    });
}

/**
 * Replaces common constructor calls with their simplified equivalents in JavaScript code.
 * 
 * Safely transforms:
 * - `String()` → `""`
 * - `Boolean()` → `!1`
 * - `Number()` → `0`
 * 
 * Only replaces constructors that are not preceded by a dot (.) or identifier character,
 * ensuring that property accesses and method calls are not affected.
 * 
 * @param {string} text - The JavaScript code text to process
 * @returns {string} The text with constructor calls replaced by their simplified forms
 */
function replaceConstructorsSafe(text) {
    return parseJSCodeSafe(text, (fragment, index, fullText) => {
        // Check context: there should be no dot or identifier character before
        const charBefore = index > 0 ? fullText[index - 1] : '';
        if (charBefore === '.' || /[a-zA-Z0-9_$]/.test(charBefore)) {
            return null;
        }

        let match;

        // String() -> ""
        match = fragment.match(/^String\s*\(\s*\)/);
        if (match) {
            return {
                replacement: '""',
                offset: match[0].length
            };
        }

        // Boolean() -> !1
        match = fragment.match(/^Boolean\s*\(\s*\)/);
        if (match) {
            return {
                replacement: '!1',
                offset: match[0].length
            };
        }

        // Number() -> 0
        match = fragment.match(/^Number\s*\(\s*\)/);
        if (match) {
            return {
                replacement: '0',
                offset: match[0].length
            };
        }

        return null;
    });
}

// Main
const { srcFile, dstFile } = workerData;

let result = {
    success: false,
    srcFile: srcFile,
    type: 'unknown',
    error: null
};

try {
    const text = fs.readFileSync(srcFile, "utf8");

    if (shouldMinify(srcFile)) {
        try {
            // Step 1: fix delete statements BEFORE minification
            const fixedText = fixDeleteStatements(text);

            // Step 2: Minification
            const uglifyResult = UglifyJS.minify(fixedText, {
                compress: true,
                mangle: true,
                parse: {
                    bare_returns: true,
                },
                output: {
                    beautify: false,
                    comments: false,
                    semicolons: false,
                },
            });

            if (uglifyResult.error) throw uglifyResult.error;

            // Step 3: Post-processing for legacy compatibility
            const legacyCompatibleCode = replaceConstructorsSafe(
                replaceBDetectedSafe(
                    replaceArrowFunctions(
                        replaceLetWithVarSafe(uglifyResult.code.trim())
                    )
                )
            );

            fs.mkdirSync(path.dirname(dstFile), { recursive: true });
            const wasWritten = writeIfChanged(dstFile, legacyCompatibleCode);

            result.success = true;
            result.type = wasWritten ? 'minified' : 'skipped';
        } catch (e) {
            fs.mkdirSync(path.dirname(dstFile), { recursive: true });
            const wasWritten = writeIfChanged(dstFile, text);

            result.success = false;
            result.type = wasWritten ? 'failed' : 'failed-skip';
            result.error = e.message;
        }
    } else {
        fs.mkdirSync(path.dirname(dstFile), { recursive: true });
        const wasWritten = writeIfChanged(dstFile, text);

        result.success = true;
        result.type = wasWritten ? 'copied' : 'copied-skip';
    }
} catch (e) {
    result.success = false;
    result.type = 'error';
    result.error = e.message;
}

parentPort.postMessage(result);


================================================
FILE: autotools/dbupdater/task.py
================================================
import os
import sys

def count_signatures(base_path='../db'):
    # Verify base path exists
    if not os.path.exists(base_path):
        print(f"Error: Base path '{base_path}' does not exist.")
        return
    
    # Dictionary to hold subfolder and signature count
    signature_count = {}
    
    # Walk through each directory and count .sg files
    for root, dirs, files in os.walk(base_path):
        # Get relative subfolder path
        relative_path = os.path.relpath(root, base_path)
        
        # Skip the root path itself
        if relative_path == "." or ".vscode" in relative_path:
            continue
        
        # Count .sg files in the current directory
        count = sum(1 for file in files if file.endswith('.sg'))
        signature_count[relative_path] = count
    
    # Generate Markdown table
    for subfolder, count in signature_count.items():
        print(f"{subfolder} : {count}")

if __name__ == "__main__":
    # Get base path from command-line argument or use default
    base_path = sys.argv[1] if len(sys.argv) > 1 else '../db'
    count_signatures(base_path)


================================================
FILE: autotools/partner/CONFIG
================================================
COMPILED_MAIN=/dbs_min/db
COMPILED_EXTRA=/dbs_min/db_extra

================================================
FILE: changelog.txt
================================================
3.11
-----------------------------------------------------------------------
[+] Build instructions for openSuse, Fedora, Arch Linux, WSL
[+] Microsoft Store port
[+] Downloads/tray monitoring, system env. variable
[+] Configurable BufferSize
[+] Improved Heuristic module for PE by DosX_dev
[+] New detects and optimization of all scripts (thanks to DosX_dev, hypn0, Kae, BJNFNE and all contributors)
[+] New scanning method: PEiD
[+] Some GUI changes
[+] Many bugs have been fixed
#######################################################################

3.10
-----------------------------------------------------------------------
[+] Bundle for Ubuntu 24.04 and 24.10
[+] APK/DEX/NPM/Amiga support
[+] Improved "Visualization" widget
[+] Improved Heuristic module for PE (thanks to DosX_dev)
[+] New "extra" database for not basic detections
[+] New detects and optimization of all scripts (thanks to DosX_dev, hypn0, Kae and all contributors)
[+] Some GUI changes
[+] Many bugs have been fixed
#######################################################################

3.09
-----------------------------------------------------------------------
[+] Bundle for Ubuntu 23.10
[+] Bundle for Kali Linux 
[+] Bundle for Parrot Linux
[+] Yara widget
[+] New Heuristic module (thanks DosX_dev)
[+] New detects
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.08
-----------------------------------------------------------------------
[+] Bundle for Ubuntu 23.04
[+] Visualization
[+] New widgets
[+] New detects
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.07
-----------------------------------------------------------------------
[+] Bundle for Ubuntu 22.10
[+] New style
[+] New widgets
[+] New detects
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.06
-----------------------------------------------------------------------
[+] Bundle for Arch Linux
[+] VirusTotal analysis
[+] New widgets
[+] New detects
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.05
-----------------------------------------------------------------------
[+] Bundle for Ubuntu 22.04
[+] Bundle for Apple M1 processor
[+] MACHOFAT support
[+] Colored output for console
[+] New detects
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.04
-----------------------------------------------------------------------
[+] Source code Qt6 compatibility
[+] Signed zip bundle for macOS
[+] Signed pkg installer for macOS
[+] New file info module
[+] New console features
[+] New detects
[+] New "All types" mode
[+] Recursive scan
[+] Tree view for DiE engine
[+] Qwt 6.2.0
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.03
-----------------------------------------------------------------------
[+] New detects
[+] Lite version
[+] Folders scan
[+] Console version can export CSV and TSV
[+] CMAKE build system
[+] New translations
[+] Many bugs have been fixed
#######################################################################

3.02
-----------------------------------------------------------------------
[+] Crypto signatures
[+] New MachO widget
[+] Qwt 6.1.6
[+] Linux AppImage
[+] Autotools build system
[+] Many bugs have been fixed
#######################################################################

3.01
-----------------------------------------------------------------------
[+] Qt 5.15.2
[+] x64 version for Windows
[+] New HEX editor
[+] New Disassembler(x86,ARM,MIPS,PPC,M68K)
[+] MIME detection
[+] APK/DEX detection
[+] New translations (Italian, Turkish, Korean, Spanish, French, Portuguese)
[+] Many bugs have been fixed
#######################################################################

3.00
-----------------------------------------------------------------------
[+] Qt 5.12.8
[+] New HEX editor
[+] New Disassembler
[+] New scan engine
#######################################################################

2.06
-----------------------------------------------------------------------
[+] Qt 5.12.4
[+] Many bugs have been fixed.
#######################################################################

2.05
-----------------------------------------------------------------------
[+] Many bugs have been fixed.
[+] JSON output in console version
[+] No UPX build for Windows version
    (DiE packed with UPX has AntiVirus alerts)
#######################################################################

2.04
-----------------------------------------------------------------------
[+] Many bugs have been fixed
#######################################################################

2.03
-----------------------------------------------------------------------
[+] Windows XP support for YARA
[+] New detects
[+] Many bugs have been fixed
#######################################################################

2.02
-----------------------------------------------------------------------
[+] Qt 5.6.3
[+] Qwt 6.1.4
[+] New scanning method: YARA
[+] New detects
[+] Many bugs have been fixed
#######################################################################

2.01
-----------------------------------------------------------------------
[+] New icons and images(Thanks Metabolic)
[+] New scan options "Set column size to contents"
[+] New signatures
[+] New script's functions:
        - bool isExportPresent()
        - bool isTLSPresent()
        - bool isImportPresent()
        - bool isResourcePresent()
        - bool isExportFunctionPresent(QString sFunctionName)
        - bool isExportFunctionPresentExp(QString sFunctionName)
[+] Donate page in About dialog
[+] Many bugs have been fixed
#######################################################################

2.00
-----------------------------------------------------------------------
[+] More than 500 new detects (thanks hypn0 and other contributors)
[+] New experimental scanning method
[+] Many bugs have been fixed
#######################################################################


================================================
FILE: db/.vscode/about.txt
================================================
This directory is responsible for correct recognition of *.sg files by Visual Studio Code. You can delete it if you don't need it.

================================================
FILE: db/.vscode/settings.json
================================================
{
    "files.associations": {
        "*.sg": "javascript"
    }
}

================================================
FILE: db/ACE
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Detect an ACE archive.
// Author: Jason Hood <jadoxa@yahoo.com.au>
/*
   Only tested with 2.04.
*/

includeScript("archive-file");
sName = "ACE";

function detect_ACE(bFile) {
    var nOffset, nSize;

    if (bFile) {
        nOffset = 0;
        nSize = File.getSize();
    } else {
        nOffset = File.getOverlayOffset();
        nSize = File.getOverlaySize();
    }

    if (nSize > 48) {
        if (File.compare("'**ACE**'", nOffset + 7)) {
            bDetected = true;
            sVersion = "2";

            if (File.readByte(nOffset + 6) & 0x80) {
                sOptions = "solid";
            }

            if (File.compare("'UNREGISTERED'", nOffset + 32)) {
                sOptions = sOptions.append("unregistered");
            }

            // Not sure about this...
            var nOffset = File.findSignature(nOffset + 0x20, 128, "000101");
            if (nOffset != -1) {
                nOffset -= 3;
                while (nOffset < File.getSize()) {
                    var nPacked = File.readDword(nOffset + 7);
                    Archive.add(File.readDword(nOffset + 11), nPacked,
                        File.readByte(nOffset + 19) & 16);
                    nOffset += 0x23 + File.readWord(nOffset + 0x21) + nPacked;
                }
                sOptions = sOptions.append(Archive.contents());
            }
        }
    }
}

================================================
FILE: db/APK/_APK.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Android");

function detect() {
    if (APK.isVerbose()) {
        sName = APK.getOperationSystemName();
        sVersion = APK.getOperationSystemVersion();
        sOptions = APK.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/APK/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = APK;
var X = APK;

================================================
FILE: db/APK/library_IL2CPP.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "IL2CPP");

function detect() {
    bDetected = APK.isArchiveRecordPresent("lib/armeabi-v7a/libil2cpp.so");

    sLang = "C#";

    return result();
}

================================================
FILE: db/APK/library_SandHook.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "SandHook");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/arm64-v8a/libsandhook-native.so") ||
        APK.isArchiveRecordPresent("lib/arm64-v8a/libsandhook.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libsandhook-native.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libsandhook.so");

    return result();
}

================================================
FILE: db/APK/library_UnicomSDK.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "UnicomSDK");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/arm64-v8a/libunicomSimplesdk.dat") ||
        APK.isArchiveRecordPresent("assets/arm64-v8a/libunicomsdk.jar") ||
        APK.isArchiveRecordPresent("assets/armeabi-v7a/libdecrypt.jar") ||
        APK.isArchiveRecordPresent("assets/x86/libunicomSimplesdk.dat") ||
        APK.isArchiveRecordPresent("assets/arm64-v8a/libdecrypt.jar") ||
        APK.isArchiveRecordPresent("assets/x86/libunicomsdk.jar") ||
        APK.isArchiveRecordPresent("assets/unicom_resource.dat") ||
        APK.isArchiveRecordPresent("assets/x86/libdecrypt.jar") ||
        APK.isArchiveRecordPresent("assets/classes.jar");

    return result();
}

================================================
FILE: db/APK/library_Unity.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Unity");

function detect() {
    bDetected = APK.isArchiveRecordPresent("lib/armeabi-v7a/libunity.so");

    return result();
}

================================================
FILE: db/APK/package_PackageName.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("package", "");

function detect() {
    var _sName = APK.getAndroidManifestRecord("package");

    if (_sName) {
        sName = _sName;
        sVersion = APK.getAndroidManifestRecord("android:versionName");
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/APK/packer_Kony.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("packer", "Kony");

function detect() {
    bDetected = APK.isArchiveRecordPresent("libkonyjsvm.so");

    return result();
}

================================================
FILE: db/APK/protector_APKProtect.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "APKProtect");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("apkprotect.com/key.dat") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libAPKProtect.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libAPKProtect.so");

    return result();
}

================================================
FILE: db/APK/protector_APKProtector.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "APKProtector");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/ap.others/apkprotect.bin") ||
        APK.isArchiveRecordPresent("assets/ap.src/apkprotect-v1.bin") ||
        APK.isArchiveRecordPresent("assets/ap.src/apkprotect-v2.bin") ||
        APK.isArchiveRecordPresent("assets/ap.src/apkprotect-v3.bin") ||
        APK.isArchiveRecordPresent("lib/arm64-v8a/libapkprotect.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libapkprotect.so") ||
        APK.isArchiveRecordPresent("lib/x86/libapkprotect.so") ||
        APK.isArchiveRecordPresent("lib/x86_64/libapkprotect.so");

    return result();
}

================================================
FILE: db/APK/protector_AlibabaProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AlibabaProtection");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libmobisec.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libmobisec.so") ||
        APK.isArchiveRecordPresent("lib/x86/libmobisec.so");

    return result();
}

================================================
FILE: db/APK/protector_AndroidRepublic.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AndroidRepublic");

function detect() {
    if (APK.isArchiveRecordPresentExp(APK.isArchiveRecordPresent(/assets\/androidrepublic\.org\/(.*)\.png/))) {
        sVersion = "VIP";
        bDetected = true;
    } else if (APK.isArchiveRecordPresentExp("assets/emt.androidrepublic/config.png")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/APK/protector_AppGuard.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AppGuard");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/AppGuard.dgc") ||
        APK.isArchiveRecordPresent("assets/AppGuard0.jar") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libAppGuard.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libAppGuard-x86.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libAppGuard.so");

    return result();
}

================================================
FILE: db/APK/protector_AppSolid.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AppSolid");

function detect() {
    bDetected = APK.isArchiveRecordPresent("assets/high_resolution.png");

    return result();
}

================================================
FILE: db/APK/protector_BaiduProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "BaiduProtection");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/baiduprotect.jar") ||
        APK.isArchiveRecordPresent("assets/libbaiduprotect_x86.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libbaiduprotect.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libbaiduprotect.so") ||
        APK.isArchiveRecordPresent("lib/mips/libbaiduprotect.so") ||
        APK.isArchiveRecordPresent("lib/x86/libbaiduprotect.so");

    return result();
}

================================================
FILE: db/APK/protector_BangBangReinforcement.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "BangBang Reinforcement");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/autostreets.com_cert_chain.cer") ||
        APK.isArchiveRecordPresent("assets/da.js") ||
        APK.isArchiveRecordPresent("assets/img.autostreetscdn.com_cert.cer") ||
        APK.isArchiveRecordPresent("assets/QMUIWebviewBridge.js") ||
        APK.isArchiveRecordPresent("assets/info.y") ||
        APK.isArchiveRecordPresent("assets/main.js") ||
        APK.isArchiveRecordPresent("assets/weex-main-jsfm.js") ||
        APK.isArchiveRecordPresent("assets/weex-rax-api.js") ||
        APK.isArchiveRecordPresent("assets/weex-rax-extra-api.js") ||
        APK.isArchiveRecordPresent("lib/arm/libDexHelper.so") ||
        APK.isArchiveRecordPresent("lib/arm/libdexjni.so") ||
        APK.isArchiveRecordPresent("lib/arm/libDexHelper-x86.so") ||
        APK.isArchiveRecordPresent("com/secneo/apkwrapper");

    if (bDetected) sVersion = "Enterprise";

    return result();
}

================================================
FILE: db/APK/protector_BangcleProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "BangcleProtection");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi/libsecexe.so") ||
        APK.isArchiveRecordPresent("lib/x86/libsecexe.so");

    return result();
}

================================================
FILE: db/APK/protector_DXShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "DXShield");

function detect() {
    bDetected = APK.isArchiveRecordPresent("lib/armeabi/libdxbase.so");

    return result();
}

================================================
FILE: db/APK/protector_DexProtector.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "DexProtector");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/classes.dex.dat") ||
        APK.isArchiveRecordPresent("assets/dp.arm-v7.so.dat") ||
        APK.isArchiveRecordPresent("assets/dp.arm-v8.so.dat") ||
        APK.isArchiveRecordPresent("assets/dp.arm.so.dat") ||
        APK.isArchiveRecordPresent("assets/dp.mp3") ||
        APK.isArchiveRecordPresent("assets/dp.x86.so.dat") ||
        APK.isArchiveRecordPresent("assets/dp.x86_64.so.dat") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libdexprotector.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libdexprotector.so") ||
        APK.isArchiveRecordPresent("assets/dp-lib/dp.kotlin-v1.lua.mph") ||
        APK.isArchiveRecordPresent("assets/dexprotect/classes.dex.dat");

    return result();
}

================================================
FILE: db/APK/protector_DingXiangReinforcement.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "DingXiang Reinforcement");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("com/security/shell/AppStub1") ||
        APK.isArchiveRecordPresent("com/security/inner/stub000");

    return result();
}

================================================
FILE: db/APK/protector_EasyShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "NetEase EasyShield");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/nedata.db") ||
        APK.isArchiveRecordPresent("assets/nedig.properties") ||
        APK.isArchiveRecordPresent("lib/arm/libnesec.so") ||
        APK.isArchiveRecordPresent("lib/arm/libnesec-x86.so") ||
        APK.isArchiveRecordPresent("lib/arm/libnshelper.so") ||
        APK.isArchiveRecordPresent("com/netease/nis/wrapper") ||
        APK.isArchiveRecordPresent("com/netease/nis/wrapper/MyApplication");

    return result();
}

================================================
FILE: db/APK/protector_ExTrus_AppDefence.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.extrus.co.kr/en/products/appdefence
meta("protector", "ExTrus AppDefence");

function detect() {
    bDetected = APK.isArchiveRecordPresent("assets/appdefence_xml");

    return result();
}

================================================
FILE: db/APK/protector_Gemalto.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Gemalto");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/arm64-v8a/libmedl.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libmedl.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libmedl.so") ||
        APK.isArchiveRecordPresent("lib/mips/libmedl.so") ||
        APK.isArchiveRecordPresent("lib/mips64/libmedl.so") ||
        APK.isArchiveRecordPresent("lib/x86/libmedl.so") ||
        APK.isArchiveRecordPresent("lib/x86_64/libmedl.so");

    return result();
}

================================================
FILE: db/APK/protector_Hdus-Wjus.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Hdus-Wjus");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi/libhdus.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libwjus.so");

    return result();
}

================================================
FILE: db/APK/protector_Ijiami.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Ijiami");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/ijiami.ajm") ||
        APK.isArchiveRecordPresent("assets/ijm_lib/armeabi/libexec.so") ||
        APK.isArchiveRecordPresent("assets/ijm_lib/armeabi/libexecmain.so") ||
        APK.isArchiveRecordPresent("assets/ijm_lib/x86/libexec.so") ||
        APK.isArchiveRecordPresent("assets/ijm_lib/x86/libexecmain.so") ||
        APK.isArchiveRecordPresent("assets/ijiami.dat") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libexec.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libexecmain.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libexec.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libexecmain.so") ||
        APK.isArchiveRecordPresent("lib/x86/libexec.so") ||
        APK.isArchiveRecordPresent("lib/x86/libexecmain.so");

    return result();
}

================================================
FILE: db/APK/protector_Jiagu.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Jiagu");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/libjiagu.so") ||
        APK.isArchiveRecordPresent("assets/libjiagu_a64.so") ||
        APK.isArchiveRecordPresent("assets/libjiagu_ls.so") ||
        APK.isArchiveRecordPresent("assets/libjiagu_x64.so") ||
        APK.isArchiveRecordPresent("assets/libjiagu_x86.so");

    return result();
}

================================================
FILE: db/APK/protector_Kiro.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Kiro");

function detect() {
    bDetected = APK.isArchiveRecordPresent("lib/armeabi/libkiroro.so");

    return result();
}

================================================
FILE: db/APK/protector_Kiwi.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "KiwiSecurity");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/crash") ||
        APK.isArchiveRecordPresent("assets/ec_dt.lic") ||
        APK.isArchiveRecordPresent("assets/kwpt.lincense") ||
        APK.isArchiveRecordPresent("lib/arm/libkiwi_dumper.so") ||
        APK.isArchiveRecordPresent("lib/arm/libkiwicrash.so") ||
        APK.isArchiveRecordPresent("lib/arm/libKwProtectSDK.so") ||
        APK.isArchiveRecordPresent("lib/arm/libkwsdataenc.so") ||
        APK.isArchiveRecordPresent("lib/arm/libkadp.so") ||
        APK.isArchiveRecordPresent("com/kiwisec/crash") ||
        APK.isArchiveRecordPresent("com/kiwivm/security") ||
        APK.isArchiveRecordPresent("com/kiwivm/security/StubApplication");

    return result();
}

================================================
FILE: db/APK/protector_LIAPP.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "LIAPP");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/LIAPPClient.sc") ||
        APK.isArchiveRecordPresent("assets/LIAPPClient_x86.sc") ||
        APK.isArchiveRecordPresent("assets/LIAPPEgg.sc") ||
        APK.isArchiveRecordPresent("assets/LIAPPEgg_x86.sc");

    return result();
}

================================================
FILE: db/APK/protector_MedusaH.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "MedusaH");

function detect() {
    bDetected = APK.isArchiveRecordPresent("lib/armeabi-v7a/libmd.so");

    return result();
}

================================================
FILE: db/APK/protector_MobileTencentProtect.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "MobileTencentProtect");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi-v7a/mix.dex") ||
        APK.isArchiveRecordPresent("lib/armeabi/mix.dex");

    return result();
}

================================================
FILE: db/APK/protector_NQShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "NQShield");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/libnqshieldx86.so") ||
        APK.isArchiveRecordPresent("assets/nqdata") ||
        APK.isArchiveRecordPresent("lib/armeabi/libnqshield.so");

    return result();
}

================================================
FILE: db/APK/protector_NagaPTProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "NagaPTProtection");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi/libddog.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libfdog.so");

    return result();
}

================================================
FILE: db/APK/protector_OLLVM-TTL.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "OLLVM-TLL");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libmtprotect.so") ||
        APK.isArchiveRecordPresent("lib/x86/libmtprotect.so");

    return result();
}

================================================
FILE: db/APK/protector_Obfuscapk.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Obfuscapk");

function detect() {
    bDetected =
        APK.isArchiveRecordPresentExp(/assets\/lib\.arm(eabi|64)-v[0-9a-zA-Z]{2}\.[!-~]+\.so/) ||
        APK.isArchiveRecordPresentExp(/assets\/lib\.x86(_64)?\.[!-~]+\.so/);

    return result();
}

================================================
FILE: db/APK/protector_PangXie.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "PangXie");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libnsecure.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libnsecure.so");

    return result();
}

================================================
FILE: db/APK/protector_ProGuard.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "ProGuard");

function detect() {
    bDetected = APK.isArchiveRecordPresent("META-INF/proguard/androidx-annotations.pro");

    return result();
}

================================================
FILE: db/APK/protector_QDBH.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "QDBH");

function detect() {
    bDetected = APK.isArchiveRecordPresent("assets/qdbh");

    return result();
}

================================================
FILE: db/APK/protector_Qihoo360Protection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Qihoo360Protection");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libprotectClass.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libprotectClass.so") ||
        APK.isArchiveRecordPresent("lib/x86/libprotectClass.so");

    return result();
}

================================================
FILE: db/APK/protector_SecNeo.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "SecNeo");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/arm64-v8a/libDexHelper-x86_64.so") ||
        APK.isArchiveRecordPresent("lib/arm64-v8a/libDexHelper.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libDexHelper-x86.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libDexHelper.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libDexHelper-x86.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libDexHelper.so") ||
        APK.isArchiveRecordPresent("lib/x86/libDexHelper.so");

    return result();
}

================================================
FILE: db/APK/protector_SecShell.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "SecShell");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/secData0.jar") ||
        APK.isArchiveRecordPresent("lib/armeabi/libSecShell-x86.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libSecShell.so");

    return result();
}

================================================
FILE: db/APK/protector_TencentLegu.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "TencentLegu");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/0OO00l111l1l") ||
        APK.isArchiveRecordPresent("assets/0OO00oo01l1l") ||
        APK.isArchiveRecordPresent("assets/libshellx-super.2019.so") ||
        APK.isArchiveRecordPresent("assets/o0oooOO0ooOo.dat") ||
        APK.isArchiveRecordPresent("lib/arm64-v8a/libshell-super.2019.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libshell-super.2019.so");

    return result();
}

================================================
FILE: db/APK/protector_TencentProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "TencentProtection");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/tosversion") ||
        APK.isArchiveRecordPresent("tencent_stub");

    return result();
}

================================================
FILE: db/APK/protector_TencentSecurity.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Tencent Security");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/dexMethod_00oo1l1l.dat") ||
        APK.isArchiveRecordPresent("lib/arm/libshell-supervbasic.2019.so") ||
        APK.isArchiveRecordPresent("lib/arm/libshell-superv.2019.so");

    if (bDetected) sVersion = "Enterprise";

    return result();
}

================================================
FILE: db/APK/protector_TongfuShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Tongfu Shield");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/mode") ||
        APK.isArchiveRecordPresent("assets/PK") ||
        APK.isArchiveRecordPresent("assets/virtual") ||
        APK.isArchiveRecordPresent("assets/libegis.a") ||
        APK.isArchiveRecordPresent("lib/arm/libegis.so") ||
        APK.isArchiveRecordPresent("com/payegis/FirstApplication") ||
        APK.isArchiveRecordPresent("com.payegis.entry") ||
        APK.isArchiveRecordPresent("egis") ||
        APK.isArchiveRecordPresent("egis-x86");

    return result();
}

================================================
FILE: db/APK/protector_VDog.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "VDog");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/main000/libhdog-x86.so") ||
        APK.isArchiveRecordPresent("assets/main000/libhdog.so") ||
        APK.isArchiveRecordPresent("assets/main000/libvdog-x86.so") ||
        APK.isArchiveRecordPresent("assets/main000/libvdog.so");

    return result();
}

================================================
FILE: db/APK/protector_Virbox.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://appsec.virbox.com/
meta("protector", "Virbox");

function detect() {
    bDetected =
        (
            APK.isArchiveRecordPresent("libsandhook.so") ||
            APK.isArchiveRecordPresent("libsandhook-native.so")
        ) && (
            APK.isArchiveRecordPresent("libv++_64.so") ||
            APK.isArchiveRecordPresent("libv++.so")
        );

    return result();
}

================================================
FILE: db/APK/protector_Yidun.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Yidun");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("lib/arm64-v8a/libnesec.so") ||
        APK.isArchiveRecordPresent("lib/armeabi-v7a/libnesec.so") ||
        APK.isArchiveRecordPresent("lib/armeabi/libnesec.so") ||
        APK.isArchiveRecordPresent("lib/x86/libnesec.so");

    return result();
}

================================================
FILE: db/APK/protector_build38.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://build38.com
meta("protector", "build38");

function detect() {
    bDetected = APK.isArchiveRecordPresent("__license.tak") || APK.isArchiveRecordPresent("license.tak");

    return result();
}

================================================
FILE: db/APK/protector_iCrypt.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "iCrypt");

function detect() {
    bDetected =
        APK.isArchiveRecordPresent("assets/af.bin") ||
        APK.isArchiveRecordPresent("assets/ijiami.ajm") ||
        APK.isArchiveRecordPresent("assets/ijiami.dat") ||
        APK.isArchiveRecordPresent("assets/IJMDal.Data") ||
        APK.isArchiveRecordPresent("assets/signed.bin") ||
        APK.isArchiveRecordPresent("assets/InteGration_4.5.1.ttf") ||
        APK.isArchiveRecordPresent("assets/libijmDataEncryption.so") ||
        APK.isArchiveRecordPresent("assets/libijmDataEncryption_arm64.so") ||
        APK.isArchiveRecordPresent("assets/libijmDataEncryption_x86.so") ||
        APK.isArchiveRecordPresent("lib/arm/libijm-emulator.so");

    if (bDetected) sVersion = "Enterprise";

    return result();
}

================================================
FILE: db/APK/tool_ApktoolPlus.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("tool", "ApktoolPlus");

function detect() {
    bDetected = APK.isArchiveRecordPresent("lib/armeabi-v7a/libapktoolplus_jiagu.so");

    return result();
}

================================================
FILE: db/APK/tool_SingleJar.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "SingleJar");

function detect() {

    bDetected = APK.getManifestRecord("Created-By") == "singlejar";

    return result();
}


================================================
FILE: db/Amiga/AMOS_Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://en.wikipedia.org/wiki/AMOS_(programming_language)
meta("compiler", "AMOS Basic");

function detect() {
    if (Amiga.compareEP("60$$49fa....397a........b07c....65..303c....3940....43ec....53..6b")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Amiga.compareEP("243c........263c........49fa....294c....294f....48e7808078..7a..7c..2c78....0802")) {
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/AMOS_Compiler_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "AMOS Compiler Cruncher");

function detect() {
    if (Amiga.compareEP("60$$49fa....294c....2c78....294f....48e7808070..103a....b03c....64")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Absoft_AC_Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Absoft AC/BASIC");

function detect() {
    if (Amiga.compareEP("6000$$$$48e780802c78....78..43fa....61..6700....2f002a0043fa")) {
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/Absoft_Fortran.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Absoft Fortran");

function detect() {
    if (Amiga.compareEP("43fa....2449d3fc........d5fc........223c........243c........2f0226482a002449203c")) {
        sVersion = "2.3";
        bDetected = true;
    }

    sLang = "FORTRAN";

    return result();
}

================================================
FILE: db/Amiga/Amiga_E.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Amiga E");

function detect() {
    if (Amiga.compareEP("23cf........6100$$$$23c0........23c8........2c78....43fa....70..4eae....23c0")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("23cf........6100$$$$33fc............23c0........23c8........2c78....33ee............43f9")) {
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("2c78....2a482e00203c........223c........24004eae....4a8066")) {
        sOptions = "type 3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Amiga_font.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("font", "Amiga font");

function detect() {
    if (Amiga.compareEP("70..4e75............................0f80")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Aztec_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Aztec C");

function detect() {
    if (Amiga.compareEP("4ef9########2a4f61..43ec....45ec....b5c966..323c....6b..74..22c251c9")) {
        sVersion = "5.0a";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("4ef9########61..43ec....45ec....b5c966..323c....6b..74..22c251c9")) {
        sVersion = "5.0d-5.2a";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("4efa$$$$61..43ec....45ec....b5c966..323c....6b..74..22c251c9")) {
        sVersion = "5.0d-5.2a";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("4efa$$$$2a4f61..43ec....45ec....b5c966..323c....6b..74..22c251c9")) {
        sVersion = "5.0a";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("4efa$$$$43f9........2851d9ccd9ccd9fc........43ec....45ec....b5c966..323c....6b")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("4efa$$$$61..43f9........45f9........b5c966..323c....6b..74..22c251c9")) {
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("4efa$$$$2a4f61..43f9........45f9........b5c966..323c....6b..74..22c251c9")) {
        sOptions = "type 3";
        bDetected = true;
    }

    sLang = "C";

    return result();
}


================================================
FILE: db/Amiga/BHC3_Relocatable.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "BHC3 Relocatable");

function detect() {
    if (Amiga.compareEP("41fa....2028....0680........223c........2c78....4eae....2240")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/BPack_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "BPack SFX");

function detect() {
    if (Amiga.compareEP("6000$$$$3a002a486100....6100....6100....6100....41fa....217c")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Blitz_BASIC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Blitz BASIC");

function detect() {
    if (Amiga.compareEP("4eb9........60$$207c........227c........4eb9........2c7c........23ce")) {
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/ByteKiller_Clone.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "ByteKiller Clone");

function detect() {
    if (Amiga.compareEP("61$$41f9........43f9........24609bcdd5c920204bed....72..61")) {
        sName += " 8";
        bDetected = true;
    } else if (Amiga.compareEP("6100................41f9........43f9........2460d5c9202072..61")) {
        sName += " 9";
        bDetected = true;
    } else if (Amiga.compareEP("61$$41f9........43f9........2460d5c9202072..61..4a0267..0c42")) {
        sName += " A";
        bDetected = true;
    } else if (Amiga.compareEP("41fa....d1fa....227c........2460d5c94aa0202013f9................72")) {
        sName += " FLT";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Chryseis_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Chryseis Cruncher");

function detect() {
    if (Amiga.compareEP("6000$$$$2f0841fa....208f205f4eba....2e7a....58..4e75")) {
        sVersion = "0.9";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Crunch_Master.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Crunch Master");

function detect() {
    if (Amiga.compareEP("428445fa....41fa....49fa....d1d291fc........43f9........0484")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/DICE_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://aminet.net/package/dev/c/dice-3.16
meta("compiler", "DICE C");

function detect() {
    if (Amiga.compareEP("48e73f3e2c79........244f2f082f00303c")) {
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/Amiga/DMS_FMS-Masher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "DMS/FMS-Masher by ParCon Software");

function detect() {
    if (Amiga.compareEP("6000$$$$48e77efe2448240049fa....47fa....303c....421b51c8....47f9")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Deluxe_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Deluxe Cruncher");

function detect() {
    if (Amiga.compareEP("47fa....41fa....247c........227c........0c10....6700")) {
        sVersion = "1.0-2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Free_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Free Pascal");

function detect() {
    if (Amiga.compareEP("23cf........23c8........6700$$$$4eb9........2e79........4e75")) {
        sVersion = "0.99";
        bDetected = true;
    } else if (Amiga.compareEP("4e55....48ed........23f8............95ca2c79........93c94eae....2040")) {
        sVersion = "1.0.12";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/Amiga/GNU_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "GNU C");

function detect() {
    if (Amiga.compareEP("6000$$$$48e73c2228082600428249f9........240c2c78....43fa....70..4eae....2c40")) {
        sVersion = "3.3.3-3.4.0";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e72022244824002c78....43f9........70..4eae....4a8067..23c0........23c0")) {
        sVersion = "3.3.3-3.4.0";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e7382228082600428249f9........240c2c78....43fa....70..4eae....2c40")) {
        sVersion = "2.95.3";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e72022240824402c78....43f9........70..4eae....4a8067..23c0........2f39")) {
        sVersion = "2.95.2";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$4e55fffc48e73c3a28082a000c85........57c04880340048c2448295ca")) {
        sVersion = "2.90.xx";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$4e55fffc48e73c3a24482a000c85........57c04880340048c24482")) {
        sVersion = "2.7.2.1";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("23c8........23c0........23cf........2c78....23ce........93c94eae....26404aab....6600")) {
        sVersion = "2.7.2.1";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e730222408244023cf........2c78....43f9........70..4eae....204023c8")) {
        sVersion = "2.7.0";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$4e55....48e73f322c082b40....0c80........57c01400")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$4e55....48e73f322c082e000c87........57c01400")) {
        sOptions = "type 2";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/Amiga/HQC_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "HQC Cruncher");

function detect() {
    if (Amiga.compareEP("2c79........4eae....43fa....4eae....4a806700")) {
        sOptions = "by High Quality Crackings";
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/HiSoft_Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://en.wikipedia.org/wiki/HiSoft_Systems
meta("compiler", "HiSoft BASIC");

function detect() {
    if (Amiga.compareEP("267c........6000$$$$7a..383c....263c........3e3c....243c")) {
        sOptions = "1988-94";
        bDetected = true;
    } else if (Amiga.compareEP("267c........6000$$$$7a..383c....363c....3e3c....343c")) {
        bDetected = true;
        sOptions = "1988";
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/High_Pressure_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "High Pressure Cruncher");

function detect() {
    if (Amiga.compareEP("6100$$$$41fa....d1fc........227c........2460d5c92a202020b185")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Jan_Heweliusz_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Jan Heweliusz Cruncher");

function detect() {
    if (Amiga.compareEP("6000$$$$48e7fff643fa....70..2c79........4eae....2a406700")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Lattice_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://en.wikipedia.org/wiki/Lattice_C
meta("compiler", "Lattice C (SAS C)");

function detect() {
    if (Amiga.compareEP("48e77efe2448240049f9........2c78....2f0248e7....266e....222b....67")) {
        sVersion = "5.10";
        bDetected = true;
    } else if (Amiga.compareEP("48e77efe2448240049f9........2c78....47f9........72..203c")) {
        sVersion = "5.04";
        bDetected = true;
    } else if (Amiga.compareEP("2448240049f9........47f9........72..203c........60..26c151c8....2c78")) {
        sVersion = "5.02";
        bDetected = true;
    } else if (Amiga.compareEP("48e77efe4bef....2448240049f9........2c78....294e....294f....42ac")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (Amiga.compareEP("48e77efe4bef....2448240049f9........47f9........72..203c")) {
        sVersion = "1.0";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/Amiga/LhPak_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LhPak SFX");

function detect() {
    if (Amiga.compareEP("60$$2c79........246e....4aaa....6600....41ea....4eae....41ea....4eae")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Master_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Master Cruncher");

function detect() {
    if (Amiga.compareEP("48e7fffe4bfa....41fa....2250d3c9d3c9245158..2b49....d5cad5ca58")) {
        sVersion = "3.0-3.1";
        bDetected = true;
    } else if (Amiga.compareEP("........4bfa....41fa....2250d3c9d3c958..2b49....2b7c")) {
        sVersion = "3.0-3.1";
        sOptions = "Address";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Maxon_C++.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Maxon C++");

function detect() {
    if (Amiga.compareEP("48e780804eb9........4eb9........70..4eb9")) {
        bDetected = true;
    }

    sLang = "C++";

    return result();
}

================================================
FILE: db/Amiga/RexxMasher_(jrms).1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "RexxMasher (jrms) by Joerg Riemer");

function detect() {
    if (Amiga.compareEP("48e7fffe60$$4230....284870..43fa....2c78")) {
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$4a80....53..67..11bc........43fa....228893c9")) {
        sVersion = "1.5-1.6";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e7808043fa....d3fc........228f4bfa....dbfc")) {
        sVersion = "1.3";
        bDetected = true;
    } else if (Amiga.compareEP("6100$$$$48e7808033fc............41fa....6100....203a")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Sound-Tracker_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Sound-Tracker Cruncher");

function detect() {
    if (Amiga.compareEP("61$$4bfa....2c78....203a....90ba....0680........2b40....43fa....d3e9")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Storm_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://www.alinea-computer.de/produkte_details_en.php?product=stormc
meta("compiler", "Storm C");

function detect() {
    if (Amiga.compareEP("2c78....23ce........23cf........226e....4aa9....6600....41e9....2f084eae")) {
        sVersion = "3.0";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/Amiga/TNM_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TNM Cruncher");

function detect() {
    if (Amiga.compareEP("61$$48e7fffe2c78....4bfa....41fa....2050d1c8d1c82250")) {
        sVersion = "1.1";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("2c78....61$$48e7fffe4bfa....41fa....2050d1c8d1c82250")) {
        sVersion = "1.1";
        sOptions = "type 2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/TSK_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TSK Cruncher");

function detect() {
    if (Amiga.compareEP("48e7fffe4bf9........204d23ed............d1ed....52..225552..dbfc")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Time_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Time Cruncher");

function detect() {
    if (Amiga.compareEP("41fa....d1fc........43f9........2460d5c9202072..6100")) {
        sVersion = "1.7-2.2";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe2c79........43fa....4eae....2c404eae....2200243c")) {
        sVersion = "4.2";
        sOptions = "by RAZOR and NETWORK's";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Titanics_Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Titanics Cruncher");

function detect() {
    if (Amiga.compareEP("6000$$$$48e7fff643fa....70..2c78....4e")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e7fff693c92c78....4eae....28404aac....66..41ec....43fa....2288")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Turtle_Smasher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Turtle Smasher");

function detect() {
    if (Amiga.compareEP("41fa....225845fa....24982449d5d8d1d041e8....201072..6100")) {
        sVersion = "1.3-1.41";
        bDetected = true;
    } else if (Amiga.compareEP("43fa....2459204a323c....429851c9....204a45ea....214a....217c")) {
        sVersion = "2.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/Ultimate_Packer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Ultimate Packer");

function detect() {
    if (Amiga.compareEP("6000$$$$598f48e7fffe41fa....20af....41fa....2f48....2c78....203c")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/_Amiga.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "AmigaOS");

function detect() {
    if (Amiga.isVerbose()) {
        sName = Amiga.getOperationSystemName();
        sVersion = Amiga.getOperationSystemVersion();
        sOptions = Amiga.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Amiga/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = Amiga;
var X = Amiga;

================================================
FILE: db/Amiga/compiler_ABasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "ABasiC by MetaComCo");

function detect() {
    if (Amiga.compareEP("23cf........23c0........23c8........42b9........2c79........23ce........93c94eae....28404aac")) {
        sOptions = "1985 type 1";
        bDetected = true;
    } else if (Amiga.compareEP("23cf........23c0........23c8........42b9........42b9........2c79........23ce........93c94eae....28404aac")) {
        sOptions = "1985 type 2";
        bDetected = true;
    } else if (Amiga.compareEP("48e77ffe43fa....22b9........43fa....228843fa....22802c7a....93c9")) {
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/compiler_AmigaBasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "AmigaBasic");

function detect() {
    if (Amiga.compareEP("23c0........23c8........200f48e77efe2a402c79........23ce........23cf")) {
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/compiler_GFA-Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "GFA-Basic");

//temp. detects
function detect() {
    if (Amiga.compareEP("4eb9........203c........4eac....45f9........4eac....4eb9........6100....4eb9")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........7a..383c....363c....70..74..72..7c..6100....383c....363c....70")) {
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........203c........6100....4eb9........4e966100....4e964eb9........4e96203c")) {
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........4eac....4eb9........4e9651ed....4e9645f9........6100....4e96426d")) {
        sOptions = "type 4";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........203c........4eac....45f9........70..41ed....6100....70..2b40....4eb9")) {
        sOptions = "type 5";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........4eb9........0cad............6f..45f9........70..4eac....4eac....67")) {
        sOptions = "type 6";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........50ed....70..4a2d....67..70..52..6600....70..4eac....2b40....202d")) {
        sOptions = "type 7";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........2a3c........283c........263c........203c........74..72..7c..4eac")) {
        sOptions = "type 8";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........41ed....4eac....41ed....20104eac....2b40....226d....70..4eac")) {
        sOptions = "type 9";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........203c........6100....70..223c........6100....2b40....202d....66")) {
        sOptions = "type 10";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........45f9........200a2b40....4eac....3f0041ed....2f08206d....4e90")) {
        sOptions = "type 11";
        bDetected = true;
    } else if (Amiga.compareEP("4eb9........4eb9........4eb9........4eac....426d....203c........72..343c")) {
        sOptions = "type 12";
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/compiler_JForth.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// http://www.jforth.org
meta("compiler", "JForth");

function detect() {
    if (Amiga.compareEP("2238....43fa....228143fa....228143fa....228f283a....2f082f0041fa")) {
        sVersion = "3.1";
        bDetected = true;
    } else if (Amiga.compareEP("49fa....264cd7fc........2c4f9dfc........91cc2d082e006100....2d07")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (Amiga.compareEP("49fa....264cd7fc........2c4f9dfc........91cc2d082e004eac....2d07")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (Amiga.compareEP("49fa....264cd7fc........2c4f9dfc........91cc2d082e006100")) {
        sVersion = "2.x-3.x";
        bDetected = true;
    } else if (Amiga.compareEP("2238....43fa....228143fa....228143fa....228f283a....d8ba....2f082f00")) {
        sVersion = "1.2";
        bDetected = true;
    }

    sLang = "Forth";

    return result();
}

================================================
FILE: db/Amiga/compiler_Multi-Forth.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Multi-Forth");

function detect() {
    if (Amiga.compareEP("6000$$$$43fa....22b9........49fa....294c....294c....294f....42672948....2940....41fa")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$43fa....22b9........49fa....294f....42672948....2940....41fa....2948")) {
        sOptions = "type 2";
        bDetected = true;
    }

    sLang = "Forth";

    return result();
}

================================================
FILE: db/Amiga/compiler_Oberon-A.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Oberon-A");

function detect() {
    if (Amiga.compareEP("2c4f4eb9........6100....42b9........4ef9........70..4eb9........70..6000")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("48e7f0c0203c........52..e5..260072..48412c78....4eae")) {
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("49f9........487a....72..6100$$$$4a2c....6600....50ec")) {
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("487a....72..4eb9........4a0166..6100....70..91")) {
        sOptions = "type 4";
        bDetected = true;
    }

    sLang = "Oberon";

    return result();
}

================================================
FILE: db/Amiga/compiler_PureBasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "PureBasic");

function detect() {
    if (Amiga.compareEP("48e7fffe203c........6100....2840294e....43fa....70..4eae")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe70..6100$$$$223c........2c78....4eee....2c78....4eee")) {
        sOptions = "type 2";
        bDetected = true;
    }

    sLang = "BASIC";

    return result();
}

================================================
FILE: db/Amiga/compiler_VBCC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://en.wikipedia.org/wiki/Vbcc
meta("compiler", "VBCC");

function detect() {
    if (Amiga.compareEP("60..'VBCC '") && Amiga.compareEP("60$$2400244849f90000....294f....2c78....294e")) {
        sVersion = Amiga.getString(Amiga.getEntryPointOffset() + 7, 3);
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/Amiga/cruncher_AddressHead.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "AddressHead");

function detect() {
    if (Amiga.compareEP("41fa....20080680........43fa....2340....43f9........203c")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_ByteKiller.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// http://janeway.exotica.org.uk/release.php?id=66243
meta("cruncher", "ByteKiller");

function detect() {
    if (Amiga.compareEP("41fa....43f9........201822182a182449d1c0d5c12020b185")) {
        sVersion = "1.2-1.3";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe............41fa....43f9........201822182a182449d1c0d5c12020b185")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....43f9........4df9........20182218d1c020102449d5c17a")) {
        sVersion = "3.0";
        sOptions = "type 1"
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....d1fc........4ed0")) {
        sVersion = "3.0";
        sOptions = "type 2"
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe1c3c....4bf9........41fa....2c78")) {
        sName += " Pro";
        sVersion = "1.0";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe1c3c....4bf9........13fc............4e714e7150f9........303c")) {
        sName += " Pro";
        sVersion = "1.0";
        sOptions = "Killer"
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_CopyCat.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "CopyCat");

function detect() {
    if (Amiga.compareEP("487a....48e7fffe61$$2c78....43fa....70..4eae....41fa....43fa....2280")) {
        sVersion = "1.01";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Cranker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Cranker");

function detect() {
    if (Amiga.compareEP("6000$$$$48e780929efc....303c....426751c8....2a4f2c78....227a")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Crunch-Mania.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Crunch-Mania by Thomas Schwarz");

function detect() {
    if (Amiga.compareEP("48e7ffff43fa....2c78....4eae....2c40")) {
        sVersion = "1.8t-1.91";
        sOptions = "Library/Huffman";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ff..3c3c....49fa....4e..4e..4e")) {
        sVersion = "1.8t-1.91";
        sOptions = "Huffman (type 1)";
        bDetected = true;
    } else if (Amiga.compareEP("49fa....7c..4e944e914e942449")) {
        sVersion = "1.8t-1.91";
        sOptions = "Huffman (type 2)";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff7c..49fa....4e94....4e")) {
        sVersion = "1.8t-1.91";
        sOptions = "Huffman (type 3)";
        bDetected = true;
    } else if (Amiga.compareEP("7c..49fa....4e944e914e942449")) {
        sVersion = "1.8t-1.91";
        sOptions = "Huffman (type 4)";
        bDetected = true;
    } else if (Amiga.compareEP("4e7148e7ffff3c3c....49fa....4e944e914e942449")) {
        sVersion = "1.8t-1.91";
        sOptions = "Huffman (type 5)";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe45fa....43f9........221a241a47ea")) {
        sVersion = "1.9t-1.91";
        sOptions = "Address/Huffman";
        bDetected = true;
    } else if (Amiga.compareEP("48e77fff33fc............33fc............33fc............33fc............45fa....49f9........204c")) {
        sVersion = "1.9t-1.91";
        sOptions = "Address/Pro";
        bDetected = true;
    } else if (Amiga.compareEP("4ff9........48e7fffe4bf9........1abc....1abc....1abc")) {
        sVersion = "1.9t";
        sOptions = "Address/Pro/Huffman";
        bDetected = true;
    } else if (Amiga.compareEP("48e77fff45fa....43f9........221a241a47ea....b7c96f")) {
        sVersion = "1.4-1.91";
        sOptions = "Address";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff45fa....221a241a224a287a....d9ccd9cc")) {
        sVersion = "1.4-1.91";
        sOptions = "Simple";
        bDetected = true;
    } else if (Amiga.compareEP("........3c3c....49fa....4e944e914e94244952")) {
        sVersion = "1.4-1.91";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....d1fc........4ed04e94244952")) {
        sVersion = "1.4-1.91";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff7c..4e7149fa....4e944e914e94244952")) {
        sVersion = "1.4-1.91";
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("4ff9........48e77fff45fa....49f9........204c47fa....7e..28db")) {
        sVersion = "1.4-1.8t";
        sOptions = "Address/Pro";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff43fa....2c78....4eba....2c40200e67..4eae")) {
        sOptions = "type 1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Crunch-O-Matic.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Crunch-O-Matic");

function detect() {
    if (Amiga.compareEP("48e7fffe267a....d7cbd7cb588b2c78....224b")) {
        sVersion = "1.0";
        sOptions = "Execute";
        bDetected = true;
    } else if (Amiga.compareEP("287a....d9ccd9cc5c..20140680........41fa....2080")) {
        sVersion = "1.0";
        sOptions = "Picture";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Crunch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Crunch");

function detect() {
    if (Amiga.compareEP("48e7ffff4bfa....4dfa....70..4e962f4c")) {
        sVersion = "1.3-1.4b";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_CrunchyDat.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "CrunchyDat");

function detect() {
    if (Amiga.compareEP("60$$487a....48e7fffe487a....203c........72")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Defjam.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Defjam");

function detect() {
    if (Amiga.compareEP("..f9........7e..303c....3d40....3d40")) {
        sVersion = "3.2-3.6 Pro";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("..f9........7e..303c....4e714e713d40....4e714e71")) {
        sVersion = "3.2-3.6 Pro";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....d1fc........4ed03d40....3d40....3d40")) {
        sVersion = "3.2-3.6 Pro";
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("....43fa....4bf9........287a....204c")) {
        sVersion = "3.6";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("....3e3c....43fa....4bf9........287a....204c")) {
        sVersion = "3.6";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("............43fa....4bf9........287a....204c")) {
        sVersion = "3.6";
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("21fc............4df9........7e..303c....3d40....3d40....3d40")) {
        sOptions = "type 1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_DoubleAction.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "DoubleAction");

function detect() {
    if (Amiga.compareEP("47f9........4e714e714e714e714e714e7143f9........4e714e714e714e714e714e71")) {
        sVersion = "1.0";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("47f9........377c........377c........43f9........12bc....12bc....12bc")) {
        sVersion = "1.0";
        sOptions = "type 2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_DragPack.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "DragPack");

function detect() {
    if (Amiga.compareEP("48e7fffe41f9........43f9........20182218")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe49fa....28fc........41fa....24482248")) {
        sVersion = "2.52";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_FileShield.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "FileShield");

function detect() {
    if (Amiga.compareEP("4879000000004e754e7500000000")) {
        sVersion = "1.x";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_FlashSpeed.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "FlashSpeed");

function detect() {
    if (Amiga.compareEP("48e7c0e041fa....43f9........264970..72..12d00c18....66")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_GnuPacker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "GnuPacker");

function detect() {
    if (Amiga.compareEP("48e7fffe4bfa....4dfa....206d....2248d3ed....30deb1c9")) {
        sVersion = "1.1-1.2";
        sOptions = "One Segment";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_House.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "House (RSI Packer)");

function detect() {
    if (Amiga.compareEP("................................13fc............41fa....43f9........47fa....49f9")) {
        sVersion = "1.4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_ISC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "ISC");

function detect() {
    if (Amiga.compareEP("47fa....d7d3247c........60$$33fc............33fc............41f9")) {
        sVersion = "1.5";
        sOptions = "Pass 3. Bitstream Pass (Huffman-Algorythm) (type 1)";
        bDetected = true;
    } else if (Amiga.compareEP("47fa....d7d3247c........4cdf000e200f4ff9........48e7")) {
        sVersion = "1.5";
        sOptions = "Pass 3. Bitstream Pass (Huffman-Algorythm) (type 2)";
        bDetected = true;
    } else if (Amiga.compareEP("247c........4cdf000e200f4ff9........48e7f0004879")) {
        sVersion = "1.5";
        sOptions = "Pass 1. Normal Compressor type 1";
        bDetected = true;
    } else if (Amiga.compareEP("247c........60$$41fa....227c........287c........47fa")) {
        sVersion = "1.5";
        sOptions = "Pass 1. Normal Compressor type 2";
        bDetected = true;
    } else if (Amiga.compareEP("247c........60$$41fa....287c........47fa....323c....28db")) {
        sVersion = "1.5";
        sOptions = "Pass 2. Comparing Compressor";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Imploder.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Imploder");

function detect() {
    if (Amiga.compareEP("48e7ffff49fa....3c3c....4e944e913c3c")) {
        sVersion = "1.0";
        sOptions = "Protected";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff49fa....3c3c....61..4e913c3c")) {
        sVersion = "1.0-3.1";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e7fff693c92c78....4eae....28404aac....66..41ec....2c78....4eae....4eae....43fa")) {
        sVersion = "1.0-3.1";
        sOptions = "Overlayed Protected type 1";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e7ffff49fa....3c3c....4e944e913c3c....61..51..20112c78....4eae....53")) {
        sVersion = "1.0-3.1";
        sOptions = "Overlayed Protected type 2";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff70..43fa....2c78....4eae....4a8067..2c40")) {
        sVersion = "1.0-3.1";
        sOptions = "Library";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff49fa....3c3c....61..4e917c..61..2f49")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff70..60..70..43fa....4eae....4a8067")) {
        sVersion = "4.0";
        sOptions = "Library";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_MOPacker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "MOPacker");

function detect() {
    if (Amiga.compareEP("48e7fffe4eb9........4cdf7fff4ef9........000003ec")) {
        sOptions = "temp detect";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_MaxPacker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "MaxPacker");

function detect() {
    if (Amiga.compareEP("283c........267a....41fa....d1fa....d7fa....49fa....341c121c101c")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_MegaCruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "MegaCruncher");

function detect() {
    if (Amiga.compareEP("47fa....200b222b....41fa....d1c1226b")) {
        sVersion = "1.0-1.2";
        sOptions = "Address";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe2c78....4bfa....4cdd00034eae....4a8067")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_PackIt.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "PackIt");

function detect() {
    if (Amiga.compareEP("48e7....2c78....2e0e286e....4bfa....42954aac....66..41ec")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Pak.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Pak");

function detect() {
    if (Amiga.compareEP("60$$48e77ffe43fa....2c78....4eae....2c4045fa....202a")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_PowerPacker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "PowerPacker");

function detect() {
    if (Amiga.compareEP("487a....48e7fffe49fa....2054d1c8d1c8")) {
        sVersion = "3.0";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....2050d1c8d1c84a982248")) {
        sVersion = "2.1-3";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$2f0e4dfa....48d6ffff4dee....2d5f")) {
        sVersion = "3.0";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("4e714e71487a....48e7fffe49fa....2054d1c8d1c858")) {
        sVersion = "3.0";
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe2c78....43fa....45fa....2489")) {
        sVersion = "4.0";
        sOptions = "Encrypted (type 1)";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe2c78....203c........4eae....6000")) {
        sVersion = "4.0";
        sOptions = "Encrypted (type 2)";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe2c78....60$$4e714e71283c........4844")) {
        sVersion = "4.0";
        sOptions = "Encrypted (type 3)";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe70..43fa....2c78....4e......4a80")) {
        sVersion = "4.0";
        sOptions = "Library";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe2c78....283c........4e714e71")) {
        sVersion = "3.0";
        sOptions = "Encrypted";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....d1fc........4ed0d1c858")) {
        sVersion = "4.0";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("6100$$$$2a572b7a........59..2c78....4eae....2f17487a....2f57")) {
        sVersion = "4.0";
        sOptions = "type 2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_ProPack.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "ProPack (RNC)");

function detect() {
    if (Amiga.compareEP("487a....48e7fffe487a....203c........72..2c78....4eae")) {
        sOptions = "Mode 1";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe487a....2a574a956700....2a55dbcddbcd")) {
        sOptions = "Key Mode 2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_ReXXMaSHeR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "ReXXMaSHeR");

function detect() {
    if (Amiga.compareEP("6100$$$$48e7808041fa....6100....203a....41f9")) {
        sOptions = "by DCS";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Relokit.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Relokit");

function detect() {
    if (Amiga.compareEP("48e7fffe41fa....70..3028....23c0........23e8............2028")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_S-Exec.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "S-Exec");

function detect() {
    if (Amiga.compareEP("48e7fffe207a....d1c8d1c858..2f0854..4e55....20080680")) {
        sVersion = "1.1";
        sOptions = "by Chas Wyndham";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Shrinkler.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Shrinkler");

function detect() {
    if (Amiga.compareEP("284b241c48e78088e58a2a4c2842241c66")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("49fafffe2f0c2424264c263c........e58a")) {
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("49fa....2f0c2424264ce58a2a4c28422414")) {
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("2413e5..26422c78....48e7....263c........43fa....4eae")) {
        sOptions = "type 4";
        bDetected = true;
    } else if (Amiga.compareEP("243a....e5..26422c78....48e7....43fa....4eae")) {
        sOptions = "type 5";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Spike.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Spike");

function detect() {
    if (Amiga.compareEP("60$$48e7fffe267a....d7cbd7cb588b2c78")) {
        sVersion = "1.1-1.6";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_StoneCracker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "StoneCracker");

function detect() {
    if (Amiga.compareEP("4df9........47f9........41fa....3d58....3d58")) {
        sVersion = "3.10-11b";
        bDetected = true;
    } else if (Amiga.compareEP("41f9........30bc....59..30bc....41f9........47f9")) {
        sVersion = "4.01";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("48e7ffff4bfa....49fa....70..4e944e91")) {
        sVersion = "4.01";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe49fa....2254d3c9d3c9")) {
        sVersion = "4.02a";
        bDetected = true;
    } else if (Amiga.compareEP("45f9........43fa....280ad5d9d3d93c113e217a")) {
        sVersion = "4.02a";
        sOptions = "Address";
        bDetected = true;
    } else if (Amiga.compareEP("4e7145f9........43fa....2a4ad5d9d3d1")) {
        sVersion = "4.10.2-3";
        sOptions = "Address";
        bDetected = true;
    } else if (Amiga.compareEP("2c78....4bfa....4eee....33fc............33fc")) {
        sVersion = "4.10.2-3";
        sOptions = "Address/Pro";
        bDetected = true;
    } else if (Amiga.compareEP("487a....48e7fffe49fa....2654d7cbd7cb")) {
        sVersion = "4.10.2-3";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("4e714e71487a....48e7fffe49fa....2654d7cbd7cb")) {
        sVersion = "4.10.2-3";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe4df9........7e..7c..7a..1e3a....1a3a....1c3a....41fa")) {
        sVersion = "2.70-2.71";
        bDetected = true;
    } else if (Amiga.compareEP("4df9........303c....3d40....3d40....3d40....3d40....4bf9")) {
        sVersion = "2.70-2.71";
        sOptions = "Kill";
        bDetected = true;
    } else if (Amiga.compareEP("4df9........4bfa....49f9........47fa....3d5b....18bc")) {
        sVersion = "2.92";
        bDetected = true;
    } else if (Amiga.compareEP("............4bfa....49f9........45fa....3d5a....18bc....3d5a")) {
        sVersion = "2.99c-d";
        bDetected = true;
    } else if (Amiga.compareEP("4df9........4bfa....49f9........45fa....3d5a....18bc....3c9a18bc")) {
        sVersion = "3.00";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....d1fc........4ed03d58....3d58....16bc....45fa")) {
        sVersion = "3.10";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_Super-Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "Super-Cruncher");

function detect() {
    if (Amiga.compareEP("48e7fffe2c79........4eae....41fa....2268....42a8....d3c9d3c959")) {
        sVersion = "2.7";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_SyncroPacker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "SyncroPacker");

function detect() {
    if (Amiga.compareEP("41fa....225820182648d1c01e201c2045fa....14a0")) {
        sVersion = "4.6";
        bDetected = true;
    } else if (Amiga.compareEP("4df9........3cbc....3d7c........13fc............41fa....21c8....46fc")) {
        sVersion = "4.6 Pro";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_TUC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TUC (The Ultimate Cruncher)");

function detect() {
    if (Amiga.compareEP("48e7fff62a7c........7e..1e1d48471e1d")) {
        sVersion = "1.16d";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("60......2a7c........7e..1e1d48471e1d263c")) {
        sVersion = "1.16d";
        sOptions = "type 2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_TetraCrunch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TetraCrunch");

function detect() {
    if (Amiga.compareEP("41fa....d1fc........227c........2460d5c92020e2..66..61..65..72..76..e2")) {
        sVersion = "1.02";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_TetraPack.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TetraPack");

function detect() {
    if (Amiga.compareEP("7e..41fa................d1fc....................2460d5c92020e2..66")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (Amiga.compareEP("4df9........7e..6000....3d40....3d40....3d40....13fc............41fa")) {
        sVersion = "2.1";
        sOptions = "Pro";
        bDetected = true;
    } else if (Amiga.compareEP("................................204cd1fc........b3cc6e..2049d1fa")) {
        sVersion = "2.2";
        bDetected = true;
    } else if (Amiga.compareEP("4df9........7e..303c....4e714e713d40....3d40....13fc............41fa")) {
        sVersion = "2.2";
        sOptions = "Pro";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_TryIt.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TryIt");

function detect() {
    if (Amiga.compareEP("43fa....4e714e714e714e71264a4e714e714e714e714e714e714e714e714e714bfa")) {
        sVersion = "1.01";
        sOptions = "type 1";
        bDetected = true;
    } else if (Amiga.compareEP("43fa....2e29....45fa....47f9........284b303c....16da51c8")) {
        sVersion = "1.01";
        sOptions = "type 2";
        bDetected = true;
    } else if (Amiga.compareEP("43fa....2e29....45fa....264a4e714e71284b")) {
        sVersion = "1.01";
        sOptions = "type 3";
        bDetected = true;
    } else if (Amiga.compareEP("43fa....4e714e714e714e714e710005....4e714e714e714e714e714e714e714bfa")) {
        sVersion = "1.01";
        sOptions = "type 4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_TurboSqueezer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "TurboSqueezer");

function detect() {
    if (Amiga.compareEP("48e7fffe2c79........207a....d1c8d1c822582848d3c9d3c958")) {
        sVersion = "6.0-8.0";
        bDetected = true;
    } else if (Amiga.compareEP("6000$$$$48e7fffe2c79........207a....d1c8d1c822582848d3c9d3c958")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/cruncher_xpkmaster.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cruncher", "xpkmaster");

function detect() {
    if (Amiga.compareEP("6000$$$$2c78....43fa....4eae....2c4041fa....4eae....2c78")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/joiner_ETA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("joiner", "ETA Text Linker");

function detect() {
    if (Amiga.compareEP("48e7fffe41fa....59..2010e5..58..43fa....2340....2c78....43fa")) {
        sVersion = "0.91-0.99";
        bDetected = true;
    } else if (Amiga.compareEP("48e7fffe41fa....59..2010e5..58..43fa....2340....203a....53..43fa")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/joiner_EXP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("joiner", "EXP ASCII Linker");

function detect() {
    if (Amiga.compareEP("48e7fffe4e7143fa....2c78....4eae....2c404eae....220067..41fa")) {
        sVersion = "1.1";
        sOptions = "1992 by Dr. Gassu //Elysion";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/joiner_Glue.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("joiner", "Glue (ANSI Linker)");

function detect() {
    if (Amiga.compareEP("48e7fffc2c78....93c94eae....2a407a..4aad....66..41ed")) {
        sVersion = "2.3";
        sOptions = "1994 by Bigmama Of Focus Design";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/library_library.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "library");

function detect() {
    if (Amiga.compareEP("70..4e754afc")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/module_DeliTracker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("module", "DeliTracker player");

function detect() {
    if (Amiga.compareEP("70FF4E75'DELIRIUM'")) {
        bDetected = true;
    } else if (Amiga.compareEP("........'DELIRIUM'")) {
        bDetected = true;
        sOptions = "Startup code";
    }

    return result();
}


================================================
FILE: db/Amiga/other_other.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "other");

function detect() {
    if (Amiga.compareEP("70..4e75'WHDLOADS'")) {
        sName = "WHDLOAD object";
        bDetected = true;
    } else if (Amiga.compareEP("70..4e75'AUTOSCPP'")) {
        sName = "SCPP object";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/self-displayer_DPS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "DPS (IFF images self-displayer)");

function detect() {
    if (Amiga.compareEP("43fa....70..2c78....4eae....26406700....43fa....70")) {
        sVersion = "1.0";
        sOptions = "by Foster Hall";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/self-displayer_Iff2ex.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "Iff2ex");

function detect() {
    if (Amiga.compareEP("43f9........203c........2c79........4eae....4a806700....23c0........43f9........203c")) {
        sVersion = "1.0";
        sOptions = "by Pieter van Leuven";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/self-displayer_S-Anim.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "S-Anim");

function detect() {
    if (Amiga.compareEP("4e55....48e7808042ad....93c92c78....4eae....28404aac")) {
        sVersion = "1.1-1.3";
        sOptions = "by Chas Wyndham";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/self-displayer_S-Pic.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "S-Pic");

function detect() {
    if (Amiga.compareEP("4e55....48e7808042ad....93c92c79........4eae....28404aac")) {
        sVersion = "1.2";
        sOptions = "by Chas Wyndham";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/sfx_DIMP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "DIMP");

function detect() {
    if (Amiga.compareEP("6000$$$$327c....48e780c02c78....42a7203c........72..48414eae")) {
        sOptions = "DMS disks packer";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/sfx_DMSSFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "DMS-SFX by SDS Software");

function detect() {
    if (Amiga.compareEP("49f9........2c78....43f9........70..4eae....23c0........2c404eae")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/sfx_LHASFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LHASFX");

function detect() {
    if (Amiga.compareEP("6000$$$$2a484230....49fa....2854d9ccd9cc294f....2c78....43fa")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/sfx_LHSFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LHSFX by Mike Kennedy");

function detect() {
    if (Amiga.compareEP("43f9........23c9........43f9........2c79........4eae....23c0........6700....2c404eae")) {
        sOptions = "1991";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/tool_EFFECT-loader.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("tool", "EFFECT-loader");

function detect() {
    if (Amiga.compareEP("60$$487a....4879........48e7fffe48e780804bfa....43fa....2c78....4eae")) {
        sVersion = "1.5-1.6";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Amiga/tool_VideoTracker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://home.deds.nl/~pvc70/vtindex.htm
meta("tool", "VideoTracker");

function detect() {
    if (Amiga.compareEP("6000$$$$93c92c78....4eae....284070..4aac....66..41ec....2c78")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Archive/_Archive.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Archive");

function detect() {
    if (Archive.isVerbose()) {
        sName = Archive.getFileFormatName();
        sVersion = Archive.getFileFormatVersion();
        sOptions = Archive.getFileFormatOptions();
        
        if (sName) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Archive/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = Archive;
var X = Archive;

================================================
FILE: db/AtariST/_AtariST.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Atari ST");

function detect() {
    if (AtariST.isVerbose()) {
        sName = AtariST.getOperationSystemName();
        sVersion = AtariST.getOperationSystemVersion();
        sOptions = AtariST.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/AtariST/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = AtariST;
var X = AtariST;

================================================
FILE: db/Binary/Amiga_loadable.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG @kaens)

meta("format", "");

function detect() {
    if (Binary.compare("000003F300")) {
        bDetected = true;
        sName = "Amiga loadable file";
        // sOption(outSz(calcAmigaFileSize()), 'sz:');
    } else if (Binary.compare("000003E700")) {
        bDetected = true;
        sName = "Amiga object/library file";
    }

    return result();
}

================================================
FILE: db/Binary/Certificate_cert.WinAuth.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("Certificate", "WinAuth");

function detect() {
    if (Binary.compare("........00020200")) {
        sVersion = "2.0";
        sOptions = "PKCS #7";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/RIFF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("format");

function detect() {
    if (Binary.compare("'RIFF'........'CDR'")) {
        sName = "CorelDraw graphics (.CDR)";
        bDetected = true;
    } else if (Binary.compare("'RIFF'........'AVI '")) {
        sName = "AVI";
        bDetected = true;
    } else if (Binary.compare("'RIFF'........'WEBPVP8'")) {
        sName = "WebP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/ROM_1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Covers cartridge, tape, or CD-delivered software, such as ROM images for various
//videogame systems, and/or for their emulators.
//Also includes snapshots like VSF or SNA, and resource packs like WAD.
// Authors:
//   Kaens TG@kaens
//   (...yes I'm looking at you, you obviously want to add something so go ahead)

meta("ROM", "");

/* beautify ignore:start */
function detect() {

    // this C-like pre-declaration is here because lol Qt6
    var p = 0, i = 0, j = 0, k = 0, l = 0, r = 0, t = 0, x = 0, n = 0, trk = 0, files = 0, sz = -1, fl = -1, sides = -1, ro = -1,
        title = '', tl = '', a = '', c = '', msg = '', artist = '', hw = '', soption = '', bad = '',
        fnames = [];

    if ((X.c("'A2R1'FF0A0D0A ................'DATA'")) || X.c("'A2R'..FF0A0D0A 'INFO'") && isWithin(X.U8(3), 0x32, 0x33)) {
        //ref https://applesaucefdc.com/a2r/ & https://applesaucefdc.com/a2r2-reference/
        sName = "Apple II Applesauce disk archival image (.A2R)"; sVersion = 'v' + X.SA(3, 1);
        if (v1 = X.c("'1'", 3)) { bDetected = true; p = 0x10 } else p = 8;
        meta = bad = '';
        while (p < X.Sz()) {
            var hkhd = X.SA(p, 4), hksz = X.U32(p + 4, v1 ? _BE : _LE); p += 8;
            switch (hkhd) {
                case 'INFO':
                    if (v1) meta = X.SC(p, hksz, 'UTF8').replace(/\x0A/g, ",").replace(/\x09/g, ":"); else {
                        iV = X.U8(p); bDetected = true;
                        switch (X.U8(p + 33)) {
                            case 1: dim = '5¼" SS 40trk 0.25 step'; break;
                            case 2: dim = '3½" DS 80trk Apple CLV'; break;
                            case 3: dim = '5¼" DS 40trk'; break;
                            case 4: dim = '5¼" DS 80trk'; break;
                            case 5: dim = '3½" DS 80trk'; break;
                            case 6: dim = '8" DS'; break;
                            case 7: dim = '3" DS 80trk'; break;
                            case 8: dim = '3" DS 40trk'; break;
                            default: dim = '?'
                        }
                        sOption('disk:' + dim);
                        if (X.U8(p + 34) == 1) sOption('write-protected');
                        if (iV >= 2) {
                            if (t = X.U8(p + 42)) sOption(t, 'min.RAM:', 'k');
                            t = ''; fl = X.U16(p + 40); if (!fl) t = '?'; if (fl & (1 << 0)) t = t.append('][');
                            if (fl & (1 << 1)) t = t.append('][ Plus'); if (fl & (1 << 2)) t = t.append('//e');
                            if (fl & (1 << 3)) t = t.append('//c'); if (fl & (1 << 4)) t = t.append('//e Enhanced');
                            if (fl & (1 << 5)) t = t.append('IIgs'); if (fl & (1 << 6)) t = t.append('//c Plus');
                            if (fl & (1 << 7)) t = t.append('///'); if (fl & (1 << 8)) t = t.append('/// Plus');
                            sOption(t, 'for Apple ');
                        }
                    }
                    break;
                case 'DATA': case 'STRM': case 'RWCP': case 'SLVD': break;
                case 'META': meta = X.SC(p, hksz, 'UTF8').replace(/\x0A/g, ",").replace(/\x09/g, ":"); break
            }
            p += hksz;
        }
        if (p > X.Sz()) bad = bad.addIfNone('!short');
        //if(X.isDeepScan() && X.calculateCRC32(12,sz-12) != X.U32(8)) bad = bad.addIfNone('!badcrc');
        if (bad != '') sVersion = sVersion.appendS('/malformed' + bad, '/')
        if (X.isVerbose()) {
            sOptionT(addEllipsis(meta), 'info:"', '"');
            sOption(outSz(p), 'sz:');
        }
    }

    else if (X.c("'AT8X'") && isWithin(t0p = X.U32(0x1C), 0x24, 0x40) && X.c("0000", t0p + 4)
        && isWithin(t0sz = X.U32(t0p), (t0hdsz = X.U32(t0p + 0x14)) + X.U32(t0p + t0hdsz), 0x1000)
        && isWithin(t0sec = X.U16(t0p + 0xA), 1, 40) && X.U32(t0p + t0hdsz) == 8 + 8 * t0sec) {
        //ref http://www.whizzosoftware.com/sio2arduino/vapi.html
        sName = "Atari VAPI/ATX disk image (.ATX)"; sVersion = 'v' + X.U16(4); bDetected = true;
        if (X.isVerbose()) {
            for (trk = 0, p = t0p, sec = 0; trk < 40 && p < X.Sz(); trk++, p += X.U32(p))
                sec += X.U16(p + 0xA);
            sOption('trk:' + trk + ' sec.total:' + sec + ' sz:' + outSz(p))
        }
    }

    else if (X.c("'<BALLY format=1>'") && X.c("'</BALLY>'", (sz = X.U16(0x11, _LE)) - 8)) {
        sName = "Bally Arcade/Astrocade BASIC tape (.BIN)"; bDetected = true; if (X.isVerbose()) sOption(outSz(sz), 'sz:')
    }

    else if (X.c("0E0000800E..FFFE........FFFFFFFF020000000200..FFFFFFFFFE")
        && [0x1F, 0x2F].indexOf(X.U8(5)) >= 0 && [0x1F, 0x7F].indexOf(X.U8(0x161)) >= 0) {
        sName = "Casio Loopy (big-endian) cartridge (.BIN)"; bDetected = true
    }

    else if (X.c("4C....4C....01'CBM::::::::'") && X.c("FF", 0x333E) && X.c("FF", 0x3980)) {
        sName = "Commodore Plus/4 cartridge (.BIN)"; bDetected = true
    }

    else if (X.c("000003", 0x08) && X.c("'DMC '", 0x100) && X.c("'                                GM 00000000-00'", 0x160)) {
        sName = "AtGames/中娛/愛勝 Firecore digital media cartridge (.BIN)"; bDetected = true
    }

    // else if([0x1F,0x20].indexOf(X.U8(0) >= 0) &&
    //   (X.fSig(1,0x200,"929376..7702") > 0) || X.fSig(1,0x200,"9276..937702") > 0) { // quite a few ROMs mismatch it
    // 	// 2560 is a pretty unique CPU, may be possible to statistically analyse the instructions and go from there
    // 	sName = "Emerson Arcadia 2001 cartridge (.BIN)"; bDetected = true
    // }

    else if (X.c("F50400") && X.c("04", 0x800) && X.c("8383", 0x808) && F.Sz() == 0x1000) {
        sName = "Entex Adventure Vision cartridge (.BIN)"; bDetected = true
    }

    else if ((X.c("55..40..40....00") || X.c("5512521252B0")) && X.U8(1) == X.U8(3)
        && (X.Sz() == 0x2000 || X.Sz() == 0x4000)) {
        sName = "Epoch ゲームポケコン/Game Pocket Computer cartridge (.BIN)"; bDetected = true
    }

    else if (X.c("BBA56EB3E9C5A7A4CCB3D7B2CFA8CEA5CCAAA3A46FB1EFB9BBA56EB3E9C569B6E6A6F4A5F3A6CFA456A675A47BB5'r(vereese gnniee)rB'A1CFA4D5B2B6C442A1CFA473BDB6C4CEA9F3A7EFA7BBA56EB3E9C5ECAD6CA97BB5A1A65DB370AD57A4EFB96EB3E9C5BAAAEAC277A950BBD1B8A3B0EAC277A9'rTdamera kybU inet diMrceoeltcorinscC ro.pa dnF nuethcE tnreatniemtnC ro.pA llr gith seresvrde .iLecsn esip reimttde'002E", 0x2000)
        || X.c("1E00E32AE401E501 E601E7011B48E801 E901EAC401300EEB 01B426ECEED26401 EF26F00108604E30 F201F301F4010128")) {
        sName = "Funtech Super Acan cartridge (.BIN)"; bDetected = true
    }

    else if ((X.c("AA04FFFF68FF") || X.c("AA4E840D196900") || X.c("AA544E85706A90")
        || X.c("AA54E9A7640202") || X.c("AAC0BA69004DCC") || X.c("AA694169146914"))
        && isWithin(X.Sz(), 0x2000, 0x8000) && !(X.Sz() & 0xFFF)) {
        sName = "Hartung Game Master cartridge (.BIN)"; bDetected = true
    }

    else if (X.c("'ZPJ'") && X.c("0003....0003", 0x18) && charStat(X.SA(3, 3)) == 'allnum'
        && charStat(X.SA(6, 13), true).indexOf('allasc' >= 0)) {
        // name db: https://github.com/libretro/libretro-database/blob/master/metadat/no-intro/Konami%20-%20Picno.dat
        sName = "Konami Picno image (.BIN)"; bDetected = true;
        sOption(charStat(X.SA(3, 3)))
        if (X.isVerbose()) {
            var t = X.SA(3, 13); while (t.length && t[t.length - 1] == '+') t = t.slice(0, t.length - 1)
            sOption(t)
        }
    }

    else if (X.c("'Copyright LeapFrog     '00..01010000000080", 0x100)) {
        sName = "Leapfrog Leapster Learning Game System image (.BIN)"; bDetected = true;
        if (X.fSig(1, 0x1000, "'Lil ducked.  The jet zipped past her head.  Dust flew, Lil sneezed, and Leap turned red.  Then Lil got up, about to yell.  Leap gasped, \"Look, Lil!  Your tooth!  It fell!\"'"))
            sVersion = 'Approved Content'; else sVersion = 'unapproved content' //what a way to show something so useless
    }

    else if (!(X.Sz() & 7) && (t = X.fSig(0, 0x1000, "1FA6DEBACC137D74")) >= 0 && !(t & 7)) {
        sName = "Microsoft MSX tape image (.CAS)"; bDetected = true
    }

    else if (X.c("00000000'Root-CPCA00000108-CP00000110'00000000000000000000000000000000000000000000000000000000000000000000000000", 0x2854)) {
        sName = "iQue (N64 for China) CMD (.CMD)"; bDetected = true
    }
    else if (X.c("803712400000000F80....00000014") && X.c("AD0000", 0x1010) && X.c("FF", 0x101E)) {
        sName = "iQue (N64 for China) Z64 image (.Z64)"; bDetected = true
    }

    else if (X.c("'C64 CARTRIDGE   '") && (p = X.U32(0x10, _BE)) >= 0x40 && X.c("'CHIP'", p)) {
        //ref 64copy / formats.zip/CRT.TXT
        bDetected = true; sName = "Commodore 64 cartridge (.CRT)";
        sVersion = "v" + X.U8(0x14) + "." + X.U8(0x15).padStart(2, '0'); bad = '';
        while (p < X.Sz()) {
            if (!X.c("'CHIP'", p)) break;
            var hksz = X.U32(p + 4, _BE), romsz = X.U16(0x0E, _BE);
            if (romsz > hksz - 0x10) bad = bad.addIfNone('!badchipsz');
            if (p + hksz > X.Sz())
                if (p + 0x10 + romsz <= X.Sz()) { //ignore the weird chunk length, use the ROM length
                    p += romsz + 0x10; bad = bad.addIfNone('!badchunk'); continue
                }
                else if (!X.isVerbose() && p + hksz > X.Sz()) { bad = bad.addIfNone('!short') }
            p += hksz
        }
        if (bad != '') sVersion = sVersion.appendS('malformed' + bad, '/');
        if (X.isVerbose()) {
            sOption(X.SC(0x20, 0x20, "Shift_JIS"));
            switch (X.U16(0x16, _BE)) {
                case 0: hw = "normal cartridge"; break;
                case 1: hw = "Action Replay"; break;
                case 2: hw = "KCS Power Cartridge"; break;
                case 3: hw = "Final Cartridge III"; break;
                case 4: hw = "Simons Basic"; break;
                case 5: hw = "Ocean type 1"; break;
                case 6: hw = "Expert Cartridge"; break;
                case 7: hw = "Fun Play, Power Play"; break;
                case 8: hw = "Super Games"; break;
                case 9: hw = "Atomic Power"; break;
                case 10: hw = "Epyx Fastload"; break;
                case 11: hw = "Westermann Learning"; break;
                case 12: hw = "Rex Utility"; break;
                case 13: hw = "Final Cartridge I"; break;
                case 14: hw = "Magic Formel"; break;
                case 15: hw = "C64 Game System/System 3"; break;
                case 16: hw = "WarpSpeed"; break;
                case 17: hw = "Dinamic"; break;
                case 18: hw = "Zaxxon, Super Zaxxon (SEGA)"; break;
                case 19: hw = "Magic Desk/Domark/HES Australia"; break;
                case 20: hw = "Super Snapshot 5"; break;
                case 21: hw = "Comal-80"; break;
                case 22: hw = "Structured Basic"; break;
                case 23: hw = "Ross"; break;
                case 24: hw = "Dela EP64"; break;
                case 25: hw = "Dela EP7x8"; break;
                case 26: hw = "Dela EP256"; break;
                case 27: hw = "Rex EP256"; break;
                case 28: hw = "Mikro Assembler"; break;
                case 29: hw = "reserved"; break;
                case 30: hw = "Action Replay 4"; break;
                case 31: hw = "StarDOS"; break;
                case 32: hw = "EasyFlash"; break;
                default: hw = "?";
            }
            sOption('hw.type: ' + hw + ' /EXROM:' + (X.U8(0x18) ? 'inactive' : 'active')
                + ' /GAME:' + (X.U8(0x19) ? 'inactive' : 'active') + ' sz:' + outSz(p));
        }
    }

    function isDC42() {
        //ref https://www.discferret.com/wiki/Apple_DiskCopy_4.2
        if (X.Sz() < 0x32000 || !X.c("0100", 0x52) || !isWithin(tl = X.U8(0), 1, 0x3F)) return false;
        title = X.SC(1, tl, 'CP1252'); var tcs = charStat(title, true); if (tcs.indexOf('allxsc') < 0) return false;
        if (tl != X.U8(0x478) || title != X.SC(0x479, X.U8(0x478), 'CP1252')) return false; //the volume label, I presume
        var discsz = X.U32(0x40, _BE), tagsz = X.U32(0x44, _BE);
        if (!isWithin(discsz, 0x32000, 0x200000) || (tagsz && discsz * 12 / 512 != tagsz)) return false;
        if (!tagsz && X.U32(0x4C, _BE)) return false;
        sz = 0x54 + discsz + X.U32(0x44, _BE); discszt = Util.divu64(discsz, 1024) + 'k';
        switch (X.U8(0x50)) {
            case 0: discszt += ' GCR CLV ssdd'; break; case 1: discszt += ' GCR CLV dsdd'; break;
            case 2: discszt += ' MFM CAV dsdd'; break; case 3: discszt += ' MFM CAV dshd'; break;
            default: discszt += ' unk.type'
        }
        return true
    }
    if (!bDetected && isDC42()) {
        sName = "Apple DiskCopy 4.2 disk image (.DC42)"; sVersion = discszt; bDetected = true;
        if (X.isVerbose()) {
            sOption(title); sOption(outSz(sz), 'sz:')
        }
    }

    if (!bDetected) if (X.c("'ACT Apricot disk image'1A04") && isAllZeroes(0x18, 0x58)) {
        //ref https://github.com/latchdevel/HxCFloppyImageConverter/blob/master/libhxcfe/trunk/sources/loaders/apridisk_loader/apridisk_format.h
        sName = "Jonathan Marsters's ACT/Apricot PC ApriDisk image (.DSK)"; bDetected = true;
        var cyl = sec = 0, interrupt = false, cmt = by = '';
        for (p = 0x80; p < X.Sz();) {
            var hkhd = X.U32(p), hdsz = X.U16(p + 6), hksz = X.U32(p + 8);
            switch (hkhd) {
                case 0xE31D0000: break; //del
                case 0xE31D0001: //sec
                    if ((t = X.U8(p + 13)) > sec) sec = t; if ((t = X.U16(p + 14) + 1) > cyl) cyl = t;
                    break;
                case 0xE31D0002: cmt = X.SA(p + hdsz, hksz); break;
                case 0xE31D0003: by = X.SA(p + hdsz, hksz); break;
                default: interrupt = true
            }
            if (interrupt) break;
            p += hdsz + hksz;
            if (hkhd == 0xE31D0002) break
        }
        if (X.isVerbose()) {
            sOption(cmt); sOption(by, 'by: '); sOption('cyl:' + cyl + ' sec:' + sec + ' sz:' + outSz(p))
        } else if (p > X.Sz()) sVersion = 'malformed!short'
    }

    else if ((X.c("'EXTENDED CPC DSK File'0D0A'Disk-Info'0D0A") || X.c("'MV - CPCEMU Disk-File'0D0A'Disk-Info'0D0A")
        || X.c("'MV - CPC'")) && isWithin(trk = X.U8(0x30), 20, 84) && isWithin(sd = X.U8(0x31), 1, 2)
        && X.c("'Track-Info'0D0A000000", 0x100)) {
        //ref https://github.com/latchdevel/HxCFloppyImageConverter/blob/master/libhxcfe/trunk/sources/loaders/cpcdsk_loader/*
        sName = "Amstrad CPC disk image (.DSK)"; bDetected = true;
        if (X.c("'E'")) { trksz = 0; sVersion = 'extended' } else trksz = X.U16(0x32) + 1;
        if (X.isVerbose()) {
            sOption(X.SA(0x22, 0xE)); sOption('trk:' + trk + (trksz ? ' trksz:' + trksz : '') + ' sides:' + sd)
        }
    }

    function isEALIB() {
        //from https://aluigi.altervista.org/bms/ealib.bms
        if (!X.c("'EALIB'")) return false;
        n = X.U16(5); var oldp = p = 7;
        for (var i = 0; i < n && p < X.Sz(); i++) {
            p += 0xD; var z = X.U8(p++), ofs = X.U32(p); p += 4;
            if (z > 4 || !isWithin(ofs, p, X.Sz())) return false;
        }
        return true
    }
    if (!bDetected && isEALIB()) {
        sName = "Electronic Arts Library resource pack"; bDetected = true;
        if (X.isVerbose()) sOption(n, 'files:')
    }

    if (!bDetected)
        if (X.c("'FCSX'") && X.U32(4) > X.U32(8) && X.U32(8) <= X.Sz()) { //found this one in a collection of NES ROMs
            sName = "FCSX zlib format (.FCS)"; bDetected = true;
            if (X.isVerbose()) sOptions = 'Zlib @10h, unp.sz:' + X.U32(4) + ' sz:' + outSz(X.U32(8))
        }

    function isPC98FDI() {
        if (!X.c("00000000")) return false;
        var id = X.U32(4), hdrsz = X.U32(8), datasz = X.U32(0xC), bpsec = X.U32(0x10),
            sec = X.U32(0x14), heads = X.U32(0x18), cyl = X.U32(0x1C);
        if ([0x10, 0x30, 0x90].indexOf(id) < 0 || bpsec * sec * heads * cyl != datasz
            || (sz = hdrsz + datasz) > X.Sz() || hdrsz < 0x20) return false;
        if (id == 0x10 && !isWithin(datasz, 0x80000, 0xB6000) //let's allow some space for stupid formatting
            || id == 0x30 && !isWithin(datasz, 0x160000, 0x300000)
            || id == 0x90 && !isWithin(datasz, 0x120000, 0x140000)) return false;
        info = 'disc:' + (id == 0x10 ? "640/720k" : id == 0x30 ? "1.44M" : id == 0x90 ? "1.2M" : '?')
            + ' (' + (datasz / 0x400).toFixed(1) + 'k)';
        info = info.append('hd:' + heads + ' cyl:' + cyl + ' sec:' + sec + ' sz:' + outSz(sz))
        return true
    }
    if (isPC98FDI()) {
        sName = "EPSON's PC-98 disk image (.FDI)"; bDetected = true;
        if (X.isVerbose()) sOption(info)
    }

    //.GG has no clear header...

    if (!bDetected) if (X.c("EB0A9090'IPL1'0000001EA08405B48ECD1BA8", 0x1000) && //empirical and may be incorrect!
        X.c("E9D102'                                                                                NEC 'CADFB0BFC5D9BADDCBDFADB0C08CC592E8836683428358834E8B4E93AE8381836A8385815B8376838D834F8389838020CADEB0BCDEAEDD' 2.'....' Copyright (C) NEC Corporation 1985,'", 0x1400)) {
        sName = "NEC PS-98 hard disk image (.HDI)"; bDetected = true
    }

    else if ((X.c("EB1C904E") || X.c("EB2790B1") || X.c("EB279028") || X.c("EB3C9027") || X.c("EB3C904E"))
        && X.c("000401010002C000D004FE0200080002000000", 0xB)
        || (X.c("EB..90") && X.Sz() == 0x134000)) { // and no real way to detect user disks
        sName = "NEC PC-98 disk image (.HDM)"; bDetected = true
    }

    function isHOBETA() {
        if(X.Sz() < 0x111) return;
        var chk = 0; for (var i=0; i < 0xF; ++i) { if(i < 9 && X.U8(i) < 0x20) return;  chk += X.U8(i) }
        chk = (105+0x101*chk) & 0xFFFF; if(chk != X.U16(0xF)) return;
        sz = X.U16(0xB); addr = X.U16(9); alsz = X.U16(0xD);
        if(!isWithin(alsz, 0x100,0xFF00) || !isWithin(sz, 0x100,0xFF00)
            || addr < 0x4000 /*ROM*/ || addr+sz > 0x10000) return;
        if(sz+(sz%0x100? (0x100-sz%0x100): 0) != alsz) return;
        var tp = X.U8(8);
        return true;
    }
    if(isHOBETA()) {
        sName = 'ZX Spectrum HOBETA wrapper (.HOB)'; bDetected = true;
        sOptions = decAnsi(0,  8, CPSpeccy).trim()+'.'+X.SA(8,1);
        if(X.isVerbose()) sOption('data @11h['+Hex(sz)+'] RAM$'+addr.toString(16)+' sz:'+outSz(0x11+alsz));
        else if(0x11+alsz > X.Sz()) sVersion = 'malformed!short';
    }

    if(!bDetected) if (X.c("'HXCPICFE'") && isWithin(sides = X.U8(0xA), 1, 2)
        && isWithin(baud = X.U16(0xC) * 1000, 150000, 3000000) && (ro = X.U8(0x11)) <= 1) {
        //ref https://github.com/latchdevel/HxCFloppyImageConverter/blob/master/libhxcfe/trunk/sources/loaders/hfe_loader/hfe_format.h
        // & hfe_writer.c & hfe_loader.c
        sName = "HxC PIC/HFE disk image (.HFE)"; sVersion = 'rev.' + X.U8(8); bDetected = true;
        if (X.isVerbose()) {
            const trkencs = ["ISO IBM MFM", "Amiga MFM", "ISO IBM FM", "emulated FM", "unk."],
                ifmodes = ["IBM PC DD", "IBM PC HD", "Atari ST DD", "Atari ST HD", "Amiga DD", "Amiga HD",
                    "Amstrad CPC DD", "generic Shugart DD", "IBM PC ED", "MSX2 DD", "Commodore 64 DD",
                    "emulated Shugart"];
            var trk = X.U8(9), ifmode = X.U8(0x10), tofs = [], t = X.U8(0xB), sz = 0x200, datasz = 0;
            p = 0x200; trkenc = t > 3 ? trkencs[4] : trkencs[t] & 3; ifmode = ifmode <= 0xB ? ifmodes[ifmode] : 'unk.';
            for (i = 0; i < trk && p < X.Sz(); i++, p += 4) {
                datasz += t = X.U16(p + 2)
            }
            t = t & 0x1FF ? 0x200 + (t & 0xFFFFFE00) : t; sz = X.U16(p - 4) * 0x200 + t;
            sOption('trk:' + trk + (sides == 2 ? ' DS' : ' SS'));
            sOption(trkenc, 'trkenc:'); sOption(ifmode, 'floppy mode:'); sOption(ro ? 'write-protected' : '');
            sOption(baud + ' baud = ' + (baud / 8192).toFixed(1) + 'k/s');
            sOption('datasz:' + datasz + ' sz:' + outSz(sz))
        }
    }

    else if (X.c("'CHKH'........00000000") && X.c("'CHKH'........01000000", X.U32(4)) && X.Sz() > 12) {
        //ref https://github.com/latchdevel/HxCFloppyImageConverter/blob/11ee45a77f237846eebdf1c6f1c732e5c0505be5/libhxcfe/trunk/sources/loaders/hxcstream_loader/hxcstream.c#L143
        sName = "HxC Stream Loader disk track (.hxcstream)"; bDetected = true;
    }

    else if (X.c("'CAPS'0000000C1CD573BA'INFO'00000060") && X.c("'IMGE'", 0x6C)) {
        //ref http://info-coach.fr/atari/documents/_mydoc/IPF-Documentation.pdf
        sName = "SPS's KryoFlux Interchangeable Preservation Format disk image (.IPF)"; bDetected = true;
        switch (X.U32(0x048, _BE)) {
            case 0: sVersion = 'no-platform'; break; case 1: sVersion = 'Amiga'; break;
            case 2: sVersion = 'Atari ST'; break; case 3: sVersion = 'PC'; break; case 4: sVersion = 'Amstrad CPC'; break;
            case 5: sVersion = 'ZX Spectrum'; break; case 6: sVersion = 'SAM Coupe'; break;
            case 7: sVersion = 'Acorn Archimedes'; break; case 8: sVersion = 'C64'; break;
            case 9: sVersion = 'Atari 8-bit'; break; default: sVersion = 'unk.'
        }
        sVersion += X.U32(0x18, _BE) == 1 ? ' floppy' : ' unk.media';
        if (X.isVerbose()) {
            for (p = 0x6C, density = '', densities = []; p < X.Sz();) {
                hkhd = X.SA(p, 4); if (!/[A-Z]{4}/.test(hkhd) || !X.c("0000", p + 4)/*a floppy block can't be this long*/) break;
                hksz = X.U32(p + 4, _BE);
                if (hkhd === 'IMGE') {
                    switch (X.U32(p + 20)) {
                        case 3: density = 'Copylock Amiga'; break; case 4: density = 'Copylock Amiga new'; break;
                        case 5: density = 'Copylock ST'; break; case 6: density = 'Speedlock Amiga'; break;
                        case 7: density = 'Speedlock Amiga old'; break; case 8: density = 'Adam Brierley Amiga'; break;
                        case 9: density = 'Adam Brierley & density key Amiga'; break;
                    }
                    if (densities.indexOf(density) < 0) densities.push(density);
                }
                else if (hkhd === 'DATA') p += X.U32(p + 12, _BE);
                p += hksz
            }
            sOption(X.U32(0x28, _BE), 'rev.');
            sOption('tracks:' + X.U32(0x30, _BE) + '-' + X.U32(0x34, _BE) + ' sides:' + (1 + X.U32(0x3C, _BE)));
            sOption(X.U32(0x1C, _BE) == 1 ? 'CAPS' : X.U32(0x1C, _BE) == 2 ? 'SPS' : 'unk.', 'encoder:', ' rev.' + X.U32(0x20, _BE));
            sOption(Hex(X.U32(0x24, _BE), 8), 'cat.ID:'); sOption(densities.join(' + '), 'copy protection:'); sOption('sz:' + outSz(p))
        }
    }

    else if (X.c("'JFDI'") && isWithin(tt = X.U32(0x18), 0x130, X.Sz()) && isWithin(st = X.U32(0x1C), tt, X.Sz())
        && isWithin(dt = X.U32(0x20), st, X.Sz()) && X.c("FFFFFFFF", st - 4) && X.c("FFFFFFFF", dt - 8)
        && (!(dtt = X.U32(0x24)) || isWithin(dtt, dt, X.Sz())) && (!(dst = X.U32(0x28)) || isWithin(dst, dt, X.Sz()))
        && (!(ddt = X.U32(0x2C)) || isWithin(ddt, dt, X.Sz()))) {
        //ref https://gist.github.com/Kaens/a139d96dc429b49788e47ea57e55017d
        sName = "Acorn Archimedes ADFFS JFD disk image (.JFD)"; bDetected = true;
        nV = Util.divu64(nv = X.U32(4, _LE), 100); nv %= 100; sVersion = 'v' + nV + '.' + nv;
        +'+/img v' + ((iv = X.U8(0x14)) >> 5) + '.' + (iv & 0x1F);
        if (X.isVerbose()) {
            sOption('tt:' + Hex(tt) + ' st:' + Hex(st) + ' dt:' + Hex(dt))
            sOption(addEllipsis(decAnsi(0x30, 0x100, CPRISCOS).trim(), 0xC0, 0xA0));
            if ((ds = X.U16(0xE)) > 1) sOptions += ' (' + X.U16(0xC) + '/' + ds + ')';
            sOption('trk:' + Util.divu64(st - tt, 4) + ' sec:' + (Util.divu64(dt - st - tt * 4, 8)));
            if (X.U32(4) >= 204) {
                fl = X.U32(0x130);
                if (fl & (1 << 0)) sOption('write-protected'); if (fl & (1 << 2)) sOption('Protect CMOS req.');
                if (fl & (1 << 3)) sOption('Protect Modules req.'); if (fl & (1 << 5)) sOption('Shift+Break to load');
                sOption('for:');
                if (fl & (1 << 8)) sOption('ARM3'); if (fl & (1 << 9)) sOption('ARM250');
                if (fl & (1 << 10)) sOption('ARM610/710'); if (fl & (1 << 11)) sOption('ARM7500');
                if (fl & (1 << 12)) sOption('StrongArm'); if (fl & (1 << 13)) sOption('ARMv5/v6/v7');
                if (fl & (1 << 16)) sOption('RiscOS 2'); if (fl & (1 << 17)) sOption('RiscOS 3.1');
                if (fl & (1 << 18)) sOption('RiscOS 3.5'); if (fl & (1 << 19)) sOption('RiscOS 3.7');
                if (fl & (1 << 20)) sOption('RiscOS 3.8/4.x'); if (fl & (1 << 21)) sOption('RiscOS 5.x');
                if (fl & (1 << 22)) sOption('RiscOS 6.x');
                if (X.U8(0x134)) sOption('fps:' + (X.U8(0x134) / 2)); if (X.U32(0x138)) sOption('Obey file sz:' + X.U32(0x138));
                sOption('datasz:' + X.U32(8)); if (ddt) sOption('delta data')
            }
        }
    }


    function isSega100h() {
        if (X.Sz() < 0x1000 || !X.c("'SEGA '",0x100)) return [false];
        sus = 0; if(!['  ','RA'].includes(X.SA(0x1B0,2))) sus++;
        sn = X.SA(0x180, 14); if(sn[11] != '-' ) sus++; if(!['GM ', 'AI ', 'OS ', 'BR '].includes(sn.slice(0, 3))) sus++;
        ar = [[X.U32(0x1A0,_BE),X.U32(0x1A4,_BE)+1], [X.U32(0x1A8,_BE),X.U32(0x1AC,_BE)+1]]; //ROM & RAM address ranges
        if (ar[0][1] & 0xFF != 0xFF) sus++; if (ar[1][1] & 0xFF != 0xFF) sus++;
        if (!isWithin(ar[0][1], 0x1000, 0x7FFFFFFF)) sus++; if (!isWithin(ar[1][0], 0xFF0000, 0x7FFFFFFF)) sus++;
        if (sus > 3) return [false];
        if (X.c("'MEGA DRIVE'", 0x100) || X.c("'GENESIS'", 0x100)) return [true, "Sega Mega Drive/Genesis (.MD)"]
        else if (X.c("'32X '", 0x105)) return [true, "Sega Mega Drive + 32X (.32X)"]
        else if (X.c("'EVERDRIVE '", 0x105)) return [true, "Sega Mega Drive (Everdrive ext.)"]
        else if (X.c("'SSF '", 0x105)) return [true, "Sega Mega Drive (Mega Everdrive ext.)"]
        else if (X.c("'MEGAWIFI'", 0x105)) return [true, "Sega Mega Drive (Mega Wifi ext.)"]
        else if (X.c("'PICO '", 0x105)) return [true, "Sega PICO"]
        else if (X.c("'TERA68k", 0x105) || X.c("'TERA286'", 0x105)) return [true, "Sega Tera Drive (.TD)"];
        return [false];
    }
    if ((t=isSega100h())[0]) {
        //ref https://plutiedev.com/rom-header
        sName = t[1]; bDetected = true;
        if((t=sn.slice(12,14)) == [0] || t == '00') sVersion = 'initial'; else sVersion = 'v'+t[0]+'.'+t[1];
        switch (sn.slice(0,2)) {
        case 'GM': sVersion += '/Game'; break;
        case 'AI': sVersion += '/Aid'; break;
        case 'OS': sVersion += '/Boot ROM (TMSS)'; break;
        case 'BR': sVersion += '/Boot ROM (Sega CD)'
        }
        if(X.isVerbose()) {
            title = X.SC(0x120, 0x30, "SJIS").trim(); t = X.SC(0x120, 0x30, "SJIS").trim();
            if(title != t) sOption(title+' / '+t); else sOption(title);
            sOption('ROM@'+Hex(ar[0][0])); if(X.SA(0x1B0,2) === 'RA') sOption('extra RAM');
            ft = '';
            for(i=0x190; i < 0x1A0;) {
                c = X.SA(i++,1); if(c == ' ') break;
                if (c === 'J') { if(X.SA(i++,1) == '6') ft += '#6-button pad'; else ft += '#3-button pad' }
                else if (c === '0') ft += '#Master System pad';
                else if (c === 'A') ft += '#Analog stick';
                else if (c === '4') ft += '#Multitap';
                else if (c === 'A') ft += '#Lightgun';
                else if (c === 'A') ft += '#Activator';
                else if (c === 'A') ft += '#Mouse';
                else if (c === 'A') ft += '#Trackball';
                else if (c === 'A') ft += '#Tablet';
                else if (c === 'A') ft += '#Paddle';
                else if (c === 'A') ft += '#Keyboard/keypad';
                else if (c === 'A') ft += '#RS-232';
                else if (c === 'A') ft += '#Printer';
                else if (c === 'A') ft += '#Sega CD';
                else if (c === 'A') ft += '#Floppy';
                else if (c === 'A') ft += '#Download(?)';
            }
            sOptionT('devices:'+ft);
            sOption('sz:'+outSz(ar[0][1]))
        }
    }


    function isMDR() {
        //ref https://github.com/TomDDG/Z80onMDR_lite/blob/main/Z80onMDR_Lite.c
        if(!X.c("01 ?? 00 00")) return;
        const mdrhdsz = 0xF, mdrdtsz = 0x200, mdrblksz = 0x21F, mdrmaxblk = 0xFE, mdrcartsz = mdrmaxblk*mdrblksz;
        blk = 0;
        var p;
        function chkblk(blkn) {
            var i, crc; p = blkn*mdrblksz;
            if((X.U8(p+15) & 2) && !X.U16(p+17)) return;
            for(crc=i=0; i < mdrhdsz-1; i++) crc = (crc+X.U8(p++)) % 0xFF;  if(crc != X.U8(p++)) return;
            for(crc=i=0; i < mdrhdsz-1; i++) crc = (crc+X.U8(p++)) % 0xFF;  if(crc != X.U8(p++)) return;
            if(!X.U16(p-13)) { p += mdrdtsz+2; return true } //deleted block, skip
            for(crc=i=0; i < mdrdtsz; i++) crc = (crc+X.U8(p++)) % 0xFF;  if(crc != X.U8(p)) return;
            blk++;
            return true
        }
        var sec = m = X.U8(1); if(!sec) return; if(!X.isDeepScan()) m = Math.min(sec,5);
        for(var i=0; i < m && i*mdrblksz < X.Sz(); i++) if(!chkblk(i)) return;
        if(blk < 2) return;
        name = decAnsi(4,10,CPSpeccy); if(X.isDeepScan()) sz = p; else sz = sec*mdrblksz;
        return true
    }
    if(!bDetected && isMDR()) {
        sName = "ZX Microdrive cartridge image (.MDR)"; bDetected = true;
        if(X.isVerbose()) {
            sOption(name);
            sOption((X.isDeepScan()?'blks:'+blk+' ':'')+'sz:'+outSz(sz));
        }
    }

    function isMGT() {
        //ref https://sinclair.wiki.zxnet.co.uk/wiki/MGT_filesystem
        //TODO test on SAM with subdirs, +D, HDD...
        if ([0x32000, 0x64000, 0xC8000].indexOf(X.Sz()) < 0) return false; // single-sided 40-cylinder, ds40/ss80, ds80
        subdir = 0; erased = 0; files = 0;
        var p = 0, ds = X.Sz() > 0x64000, msz = Math.min(X.Sz(), 0xC8000);
        var xroot = X.U8(0xFF); if (xroot > 35) return false; //betaDOS/MasterDOS extra tracks for root
        var zx = [0, 'ZX Spectrum'], sam = [0, 'SAM Coupé'], dd = [0, 'DISCiPLE/+D'], hd = [0, 'HDD'];
        var samboot = X.c("'BOOT'", 0x100); if (samboot) sam[0] += 20;
        var allocmap = []; for (i = 0; i < 195; i++) allocmap.push(0);
        soption = ''; fnames = []; label = ''; sus = 0;
        if (!extIs('mgt')) sus++; //could be gzipped which removes the extension as far as DiE is concerned
        if (X.Sz() != 0xC8000) sus++; //in practice, only ds 80-cyl is seen around
        const fts = [/*0*/'erased', 'ZXBASIC', 'ZXnum.array', 'ZXstr.array', 'ZXcode', 'ZX48ksnap', 'ZXMD', 'ZXscr', 'special',
		/*9*/'ZX128ksnap', 'Opentype', 'ZXexec', 'UNI-DOSdir', 'UNI-DOScreate', '14?', '15?', 'SAMBASIC', 'SAMnum.array',
		/*18*/'SAMstr.array', 'SAMcode', 'SAMscr', 'MasterDOSdir', 'SAMDriverapp', 'SAMDriverbootstrap', 'EDOSNOMEN',
            'EDOSsys', 'EDOSovl', '27?', 'HDOSHdos', 'HDOSHdir', 'HDOSHdisk', 'HDOSHfree/Htmp'];
        if ((X.U8(0) & 0x3F) != 19 && charStat(X.readBytes(0xD2, 10), 1).indexOf('allasc') >= 0) {
            sam[0] += 10; label = X.SA(0xD2, 10).trim()
        }
        //if(xroot) _l2r('mgt',0xFF,xroot+' xroot found!'); if(samboot) _l2r('mgt',0x100,'SAM BOOT found!')
        for (p = _sec = _side = _trk = 0, end = false; _trk < 4 + xroot && p < X.Sz();) {
            for (s = 0; s < 2; s++) { //go through the 2 records per sector
                if (samboot && files == 1) { files++; continue }
                //_l2r('mgt',p,'looking at rec #'+files+'"'+X.SA(p+1,10)+'": T'+_trk+'S'+_side+'s'+_sec+' type '+X.U8(p))
                if (!X.U8(p + 1)) { end = true; continue }
                if (end) sus++; files++;
                var fname1 = X.readBytes(p + 2, 9); if (charStat(fname1, 1).indexOf('allasc') < 0) return false; //space-padded
                var ft = (X.U8(p) & 0x3F); if (ft > 0x1F) return false; //file type
                if (!ft) erased++; else if (isWithin(ft, 1, 11)) zx[0]++; else if (isWithin(ft, 12, 13)) dd[0]++;
                else if (isWithin(ft, 16, 23)) sam[0]++; else hd[0]++;
                var fsecsz = X.U16(p + 0xB, _BE); if (!fsecsz) return false;  //sectors used by the file
                var ftrk0 = X.U8(p + 0xD), fside0 = ftrk0 >> 7; ftrk0 &= 0x7F; if (!isWithin(ftrk0, 0, 79)) return false;
                var fsec0 = X.U8(p + 0xE); if (!isWithin(fsec0, 1, 10)) return false;
                if (!ds) ds = fside0; //double-sided disc. there must be a better way to tell...
                if (!files) { if (ft == 0) sus++; if (X.U8(p) & 0x80) sus++ } //super unlikely the first file's erased or hidden
                for (i = 0; i < 195; i++) { t = X.U8(p + 0xF + i); if (allocmap[i] & t) return false; allocmap[i] |= t }
                if (firstNotOf(p + 0xDC, 11, [0x20, 0xFF]) < 0) sam[0] += 10;
                if (firstNotOf(p + 0xE8, 4, [0xFF]) < 0) sam[0] += 4;
                if (X.U8(p + 0xFA) == 0xFF) sam[0]++; if (X.U8(p + 0xFB) == 0xFF) sam[0]++;
                fnames.push(X.SA(p + 1, 10).trim()
                    + ':' + fts[ft] //file type briefly explained
                    //+'@'+Hex((fsec0+(fside0+ftrk0*2)*10)*0x200) //just the 1st sector address won't be too useful
                );
                if (ft == 21) { subdir++; t = ((fsec0 + (fside0 + ftrk0 * 2) * 10) * 0x200) + 1; if (X.U8(t)) fnames.push('/' + X.SA(t, 10) + '...') }
                if (!s) p += 0x100
            }
            _sec++; if (_sec > 9) { _sec = 0; _side++; if (_side == 1) { _side = 0; _trk++ } }
            p = (_sec + (_side + _trk * 2) * 10) * 0x200;
        }
        if (sus > 5 || !files) return false;
        function am0max() {
            if (!arguments.length) return '';
            var i, r = arguments[0]; for (i = 1; i < arguments.length; i++) if (arguments[i][0] > r[0]) r = arguments[i];
            return r
        }
        sv = am0max(zx, sam, dd, hd)[1] + '/' + (ds ? 'DS' : 'SS');
        return true
    }
    if (!bDetected && isMGT()) {
        sName = "Miles Gordon Technology floppy image (.MGT,.SAD)";
        sVersion = sv; bDetected = 1;
        if (X.isVerbose()) {
            sOption((subdir ? '≈' : '') + (files - erased - subdir) + (erased ? '+' + erased + ' erased' : '') + (subdir ? '+' + subdir + 'subdirs' : ''), 'files:');
            if (files) sOption('(' + addEllipsis(fnames.join('; ')) + ')');
            if (sus) sOption('possibly malformed (level ' + sus + ')');
        }
    }


    if (!bDetected) if (X.c("'NES'1A") && (X.Sz() > 15)) {
            //ref https://www.nesdev.org/wiki/INES & https://www.nesdev.org/wiki/NES_2.0
            sName = "NES ROM image (.nes)"; bDetected = true; malformed = false;
            szprg = X.U8(4) * 16384; szchr = X.U8(5) * 8192;
            flg9 = X.U8(9); //v1.0: ROMs don't use it; v2.0: sz*msb
            flg6 = X.U8(6);
            //fmirroring = (flg6&1)>0; //0 for hrz 1 for vrt, tons of fallout though so better to ignore this
            fstorage = (flg6 & 2) > 0; trainer = (flg6 & 4) * 0x80; f4scrvram = (flg6 & 8) > 0; flg7 = X.U8(7);
            mapper = ((flg6 & 0xF0) >> 4) + (flg7 & 0xF0); fvsunisystem = (flg7 & 1) > 0; fplaychoice10 = (flg7 & 2) > 0;
            fv20_ = ((flg7 & 0x0C) == 8); fv20 = false; szprgmsb = ((flg9 & 0x0F) << 8) * 16384;
            szchrmsb = ((flg9 & 0xF0) << 4) * 8192; ex = region = tv = "";
            sz = 16 + trainer + szprg + szprgmsb + szchr + szchrmsb;
            if (fv20_) fv20 = sz < X.Sz();
            if (fv20) {
                szprg += szprgmsb; szchr += szchrmsb; flg8 = X.U8(8); flg11 = X.U8(11); flg12 = X.U8(12);
                flg13 = X.U8(13); flg14 = X.U8(14); flg15 = X.U8(15); sVersion = "NES v2.0";
                mapper += (flg8 & 0x0F) << 8; submapper = (flg8 & 0xF0) >> 4;
                switch (flg7 & 2) {
                    case 0: sVersion += " #NES/Famicom/Dendy"; break;
                    case 1:
                        sVersion += " #Nintendo Vs. System (";
                        switch (flg13 & 0x0F) {
                            case 0: sVersion += "RP2C03B)"; break; case 1: sVersion += "RP2C03G)"; break;
                            case 2: sVersion += "RP2C04-0001)"; break; case 3: sVersion += "RP2C04-0002)"; break;
                            case 4: sVersion += "RP2C04-0003)"; break; case 5: sVersion += "RP2C04-0004)"; break;
                            case 6: sVersion += "RC2C03B)"; break; case 7: sVersion += "RC2C03C)"; break;
                            case 8: sVersion += "RC2C05-01)"; break; case 9: sVersion += "RC2C05-02)"; break;
                            case 0x0A: sVersion += "RC2C05-03)"; break; case 0x0B: sVersion += "RC2C05-04)"; break;
                            case 0x0C: sVersion += "RC2C05-05)"; break; default: sVersion += "unk.PPU)"
                        }
                        break;
                    case 2: sVersion += " #Nintendo Playchoice 10"; break;
                    default:
                        switch (flg13 & 0x0F) {
                            case 0: sVersion += " #NES/Famicom/Dendy"; break;
                            case 1: sVersion += " #Nintendo Vs. System"; break;
                            case 2: sVersion += " #Nintendo Playchoice 10"; break;
                            case 3: sVersion += " #Famiclone+DecimalMode"; break;
                            case 4: sVersion += " #NES/Famicom+EPSM/plug-through"; break;
                            case 5: sVersion += " #V.R. VT01 red/cyan"; break;
                            case 6: sVersion += " #V.R. Technology VT02"; break;
                            case 7: sVersion += " #V.R. Technology VT03"; break;
                            case 8: sVersion += " #V.R. Technology VT09"; break;
                            case 9: sVersion += " #V.R. Technology VT32"; break;
                            case 0x0A: sVersion += " #V.R. Technology VT369"; break;
                            case 0x0B: sVersion += " #UMC UM6578"; break;
                            case 0x0C: sVersion += " #Famicom Network System"; break;
                            default: sVersion += " #(reserved)"
                        }
                }
                switch (flg12 & 3) {
                    case 0: region = "NA/JP/SK/TW: NTSC NES"; break; case 1: region = "WE/AU: Licenced PAL NES"; break;
                    case 2: region = "Multiple"; break; default: region = "EU/RU/ZH/IN/AF: Dendy"
                }
                switch (flg15 & 0x3F) {
                    case 0x00: break;
                    case 0x01: ex = "Std. Sontrollers"; break;
                    case 0x02: ex = "NES Four Score/Satellite + 2 Std. Controllers"; break;
                    case 0x03: ex = "Famicom 4P Adapter"; break;
                    case 0x04: ex = "Vs. System (1P via $4016)"; break;
                    case 0x05: ex = "Vs. System (1P via $4017)"; break;
                    case 0x06: ex = "(obsolete MAME behaviour)"; break;
                    case 0x07: ex = "Vs. Zapper"; break;
                    case 0x08: ex = "Zapper ($4017)"; break;
                    case 0x09: ex = "2 Zappers"; break;
                    case 0x0A: ex = "Bandai Hyper Shot Lightgun"; break;
                    case 0x0B: ex = "Power Pad Side A"; break;
                    case 0x0C: ex = "Power Pad Side B"; break;
                    case 0x0D: ex = "Family Trainer Side A"; break;
                    case 0x0E: ex = "Family Trainer Side B"; break;
                    case 0x0F: ex = "Arkanoid Vaus Controller (NES)"; break;
                    case 0x10: ex = "Arkanoid Vaus Controller (Famicom)"; break;
                    case 0x11: ex = "2 Vaus Controllers + Famicom Data Recorder"; break;
                    case 0x12: ex = "Konami Hyper Shot Controller"; break;
                    case 0x13: ex = "Coconuts Pachinko Controller"; break;
                    case 0x14: ex = "Exciting Boxing Punching Bag (Blowup Doll)"; break;
                    case 0x15: ex = "Jissen Mahjong Controller"; break;
                    case 0x16: ex = "Party Tap"; break;
                    case 0x17: ex = "Oeka Kids Tablet"; break;
                    case 0x18: ex = "Sunsoft Barcode Battler"; break;
                    case 0x19: ex = "Miracle Piano Keyboard"; break;
                    case 0x1A: ex = "Pokkun Moguraa (Whack-a-Mole Mat & Mallet)"; break;
                    case 0x1B: ex = "Top Rider (Inflatable Bicycle)"; break;
                    case 0x1C: ex = "Double-Fisted"; break;
                    case 0x1D: ex = "Famicom 3D System"; break;
                    case 0x1E: ex = "Doremikko Keyboard"; break;
                    case 0x1F: ex = "R.O.B. Gyro Set"; break;
                    case 0x20: ex = 'Famicom Data Recorder ("silent" keyboard)'; break;
                    case 0x21: ex = "ASCII Turbo File"; break;
                    case 0x22: ex = "IGS Storage Battle Box"; break;
                    case 0x23: ex = "Family BASIC Keyboard + Famicom Data Recorder"; break;
                    case 0x24: ex = "Dongda PEC-586 Keyboard"; break;
                    case 0x25: ex = "Bit Corp. Bit-79 Keyboard"; break;
                    case 0x26: ex = "Subor Keyboard"; break;
                    case 0x27: ex = "Subor Keyboard + Mouse (3x8-bit)"; break;
                    case 0x28: ex = "Subor Keyboard + Mouse (24-bit)"; break;
                    case 0x29: ex = "SNES Mouse ($4017.d0)"; break;
                    case 0x2A: ex = "Multicart"; break;
                    case 0x2B: ex = "2 SNES Controllers"; break;
                    case 0x2C: ex = "RacerMate Bicycle"; break;
                    case 0x2D: ex = "U-Force"; break;
                    case 0x2E: ex = "R.O.B. Stack-Up"; break;
                    case 0x2F: ex = "City Patrolman Lightgun"; break;
                    case 0x30: ex = "Sharp C1 Cassette Interface"; break;
                    case 0x31: ex = "Std. Controller w/swapped ←→/↑↓/BA"; break;
                    case 0x32: ex = "Excalibor Sudoku Pad"; break;
                    case 0x33: ex = "ABL Pinball"; break;
                    case 0x34: ex = "Golden Nugget Casino extra buttons"; break;
                    default: ex = "(unknown)"
                }
                sz = 16 + trainer + szprg + szprgmsb + szchr + szchrmsb
            }
            else {
                if (!(flg7 & 0x0C) && X.c("0000 0000", 12)) sVersion = "iNES";
                else if ((flg7 & 0x0C) == 4) sVersion = "archaic iNES";
                else sVersion = "iNES v0.7 or archaic";

                szprgram = X.U8(8) * 8192; if (!szprgram) szprgram = 8192; //PRG RAM size
                flg10 = X.U8(10);
                switch (flg10 & 3) {
                    case 0: tv = "NTSC"; break;
                    case 2: tv = "PAL"; break;
                    default: tv = "NTSC/PAL"
                }
                if (X.c("0000 0000", X.Sz() - 4)) { fprgram = (flg10 & 0x10) > 0; fbusconflicts = (flg10 & 0x20) > 0 }
                else { fprgram = false; fbusconflicts = false; }
                region = "n/a";
            }
            if (X.isVerbose()) {
                sOption(tv, "tv: "); sOption(region, "region: "); sOption(mapper, "mapper: "); sOption(ex, "expansion: ");
                if (fplaychoice10) sOption("PlayChoice-10"); if (trainer) sOption("trainer");
                if (fstorage) sOption("battery-backed RAM"); sOption(outSz(sz), 'sz:')
            }
        }

        else if (X.c("'MNIB-1541-RAW'..000002..04..06..08..0A")) {
            bDetected = true; sVersion = 'v' + X.U8(0xD);
            sName = "Markus Brenner's MNIB/Peter Rittwage's C64PP NIBTools disk image (.NIB)"
        }

        else if (X.c("01'CD001'01''", 0x53000)) {
            n = X.c("'NERO'", X.Sz() - 8) ? 1 : X.c("'NER5'", X.Sz() - 12) ? 2 : 0;
            sName = (n ? "Nero AG's " : '') + "optical disc image (.NRG)"; if (n) sVersion = "Nero AG/v" + n;
            if (X.isVerbose()) sOptions = X.SA(0x53028, 0x20).trim(); bDetected = true;
        }

        else if (X.c("0D04..00'host_date='") && X.fSig(0, 0x80, "'KryoFlux DiskSystem'")) {
            sName = "SPS's KryoFlux DiskSystem disk sector (.RAW)"; bDetected = true
        }

        else if (X.c("'CAPS'0000000C1CD573BA'DATA'") && X.c("'PACK'", X.U32(0x10, _BE) + 0x14)) {
            //ref https://www.kryoflux.com/download/spsdeclib_5.1_source.zip / Codec/CapsDefinitions.h
            sName = "SPS's KryoFlux CT Raw disk image (.RAW)"; bDetected = true;
            if (X.isVerbose()) {
                for (p = 0xC, trk = unpsz = 0; p < X.Sz();) {
                    hkhd = X.SA(p, 4); if (!/[A-Z]{4}/.test(hkhd) || !X.c("0000", p + 4)/*a floppy block can't be this long*/) break;
                    hksz = X.U32(p + 4, _BE);
                    switch (hkhd) {
                        case 'DATA': hksz += X.U32(p + 12, _BE); break;
                        case 'PACK': unpsz += hksz; hksz = X.U32(p + 12, _BE) + 0x18; break;
                        case 'TRCK': trk++; break
                    }
                    p += hksz
                }
                sOption('trk:' + trk + ' sz:' + outSz(p))
            }
        }

    function isSCL() {
        if (!X.c("'SINCLAIR'") || !isWithin(n = X.U8(8), 1, 128) || X.Sz() < 9 + 14 * n) return false;
        fnames = [], p = 9, i = c = 0; sz = 9 + 14 * n;
        sec = 0; bad = '';
        for (; i < n && sz < X.Sz(); i++, p += 14) {
            var fn = decAnsi(p, 8, CPSpeccy); if (fn.length < 8) return false; fn = fn.trim();
            if (fn[0] === '\x01') fn[0] = '*'; //deleted file
            var ext = decAnsi(p + 8, 1, CPSpeccy); if (!ext.length) return false;
            //I'd test the filenames for sanity but some copyprots are quite insane...
            fnames.push(fn + '.$' + ext); t = X.U8(p + 0xD); sec += t; sz += t << 8;
        }
        if (sz > X.Sz() || sz > 655364) return false; //max available size is 835600-ish so not much of a constraint
        if (X.Sz() >= sz + 4) { // despite the barebones specs there seems to be a CRC at the very end
            for (i = 0; i < sz; c += X.U8(i++)) { } sz += 4;
            if (c != X.U32(i)) bad = '!badcrc' //not returning false; it's not guaranteed that all SCL will have this
        } else bad = '!nocrc'; //...but it is common enough to mark it as malformed if it's absent
        fnames = fnames.join(';'); return true
    }
    if (!bDetected && isSCL()) {
        sName = 'ZX Spectrum floppy disk image (.SCL)'; bDetected = true;
        if (bad.length) sVersion = 'malformed' + bad;
        if (X.isVerbose()) {
            sOption(addEllipsis(fnames, 0xA0)); sOption('sec:' + sec + ' sz:' + outSz(sz))
        }
    }


    function isSCP() {
        if (!X.c("'SCP'") || X.U8(6) > 165 || X.U8(7) > 165 || X.U8(0xA) > 2) return false;
        var p, mtdp = mtdsz = 0, r = X.U8(5), bitw = X.U8(9);
        sz = 0x2B0; if (!bitw) bitw = 2; else bitw >>= 3;
        for (p = 0x10; p < 0x2B0; p += 4) {
            var tdhp = X.U32(p); if (!tdhp) continue; if (!X.c("'TRK'", tdhp)) return false;
            var i = 0; for (q = tdhp + 4; i < r; i++) {
                var tdsz = X.U32(q + 4) * bitw, tdp = X.U32(q + 8) + tdhp;
                if (tdp > mtdp) { mtdp = tdp; mtdsz = tdsz }
                q += 12
            }
        }
        if (mtdp) if (mtdp > X.Sz()) return false; else sz = mtdp + mtdsz;
        return true
    }
    if (!bDetected && isSCP()) {
        sName = "SuperCard Pro disk image (.SCP)"; bDetected = true;
        var v = X.U8(3); if (v) v = 'v' + (v >> 4) + ' rev.' + (v & 0xF); else v = 'v.?';
        var tp = X.U8(4), revolutions = X.U8(5), sttrk = X.U8(6), edtrk = X.U8(7), fl = X.U8(8),
            tpi5in = fl & 2 ? '96' : '48', rpm = fl & 1 ? (fl & 4 ? '360' : '300') : '300/360',
            quality = fl & 8 ? 'normalised' : 'preservation', ro = fl & 0x10 ? 'read/write' : 'read-only', ext = fl & 0x20,
            side = !X.U8(0xA) ? 'double' : (X.U8(0xA) == 1 ? 'bottom' : 'top'), made, dtp;
        if (ext) {
            v = 'app v' + (X.U8(sz + 0x28) >> 4) + '.' + (X.U8(sz + 0x28) & 0xF) +
                'h/w v' + (X.U8(sz + 0x29) >> 4) + '.' + (X.U8(sz + 0x29) & 0xF);
            if (!X.c("'FPCS'", sz + 0x2C)) v += '/malformed!noendtag'; sz += 0x30
        }
        sVersion = v;
        if (X.isVerbose()) {
            switch (tp & 0xF) {
                case 0: dtp = 'CBM'; break; case 1: dtp = 'Amiga'; break; case 2: dtp = 'Apple ]['; break;
                case 3: dtp = 'Atari ST'; break; case 4: dtp = 'Atari 800'; break; case 5: dtp = 'Mac 800'; break;
                case 6: dtp = '360k/720k'; break; case 7: dtp = '1.44M'; break; default: dtp = 'unk.'
            }
            switch (tp >> 4) {
                case 0: made = 'Commodore'; break; case 1: made = 'Atari'; break; case 2: made = 'Apple'; break;
                case 3: made = 'PC'; break; case 4: made = 'Tandy'; break; case 5: made = 'Texas Inst.'; break;
                case 6: made = 'Roland'; break; case 8: made = '(other)'; break; default: made = 'unk.'
            }
            sOption('type ' + dtp + ' by ' + made); sOption('trk:' + sttrk + '-' + edtrk + ' side:' + side);
            sOption(ro); sOption(quality, 'quality:'); sOption(rpm, '', ' rpm');
            sOption(outSz(sz), 'sz:');
        }
    }

    if (!bDetected) if (X.c("EC..A50000") && X.c("EC00", 0x100) && X.c("55AA55AA55AA55AAFFFFFFFFFFFFFFFF0000", 0x110)
        && X.c("FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF", 0x400)
        && X.c("4199015564F0FFFF 201B0C824118EA61 F00107F60301EE1B 0C834118EA617001 07760301EE15140500", 0X4630)) {
        sName = "GamePark GP32 SmartMedia card (.SMC)"; bDetected = true //may not catch all options, but the official games are there
    }

    else if (X.c("'RSY'000300")) {
        //ref http://info-coach.fr/atari/documents/_mydoc/Pasti-documentation.pdf
        sName = "Jorge 'Ijor' Cwik's Pasti disk image (.STX)"; bDetected = true;
        sVersion = 'v3' + (X.U8(11) == 2 ? ' new' : X.U8(11) == 0 ? ' old' : '');
        if (X.isVerbose()) {
            sOption(X.U8(10), 'trk.total:');
            for (i = 0, p = 0x10; i < X.U8(10) && p < X.Sz(); i++, p += X.U32(p)) { }
            sOption(outSz(p), 'sz:')
        }
    }

    else if (X.c("'ZXST'") && charStat(X.readBytes(0x10 + X.U32(0xC), 4), 1).indexOf('allxsc') >= 0
        && X.fSig(8, 0x200, "'Z80R'") > 0 && X.fSig(0x20, 0x200, "'SPCR'") > 0
        && isWithin(V = X.U8(4), 1, 1) && (v = X.U8(5)) <= 5 && (hw = X.U8(6)) <= 16 && (fl = X.U8(7)) <= 1) {
        //ref https://sinclair.wiki.zxnet.co.uk/wiki/ZX-State_format
        sName = 'Spectaculator zx-state file (.SZX)'; sVersion = 'v' + V + '.' + v; bDetected = true;
        switch (hw) {
            case 0: hw = 'ZX Spectrum 16k'; break; case 1: hw = 'ZX Spectrum 48k/+'; break;
            case 2: hw = 'ZX Spectrum 128k'; break; case 3: hw = 'ZX Spectrum +2'; break;
            case 4: hw = 'ZX Spectrum +2A/B'; break; case 5: hw = 'ZX Spectrum +3'; break;
            case 6: hw = 'ZX Spectrum +3e'; break; case 7: hw = 'Pentagon 128'; break;
            case 8: hw = 'Timex Sinclair TC-2048'; break; case 9: hw = 'Timex Sinclair TC-2068'; break;
            case 0xA: hw = 'Scorpion ZS-256'; break; case 0xB: hw = 'ZX Spectrum SE'; break;
            case 0xC: hw = 'Timex Sinclair TS-2068'; break; case 0xD: hw = 'Pentagon 512'; break;
            case 0xE: hw = 'Pentagon 1024'; break; case 0xF: hw = 'ZX Spectrum 48k (NTSC)'; break;
            case 0x10: hw = 'ZX Spectrum 128Ke'; break;
            default: hw = '(unk.)'
        }
        sOption(hw, 'h/w:');
        if (X.isVerbose()) {
            var p = 8;
            while (p < X.Sz()) {
                var hkhd = X.SA(p, 4), hksz = X.U32(p + 4);
                if (!hksz || hksz + p > X.Sz() || charStat(X.readBytes(p, 4), 1).indexOf('allxsc') < 0
                    || hkhd.length < 2 || hkhd.toUpperCase() != hkhd) break;
                p += 8;
                switch (hkhd) {
                    case 'CRTR': sOption(X.SA(p, 0x20), 'in:'); break;
                }
                p += hksz
            }
            sz = p; sOption(outSz(sz), 'sz:')
        }
    }

    else if (/^C64S?\s*tape.*file/.test(X.SA(0, 0x20))) {
        sName = "C64 cassette tape (.T64)"; bDetected = true;
        sVersion = 'v' + X.U8(0x20) + "." + X.U8(0x21).padStart(2, '0');
        if (X.isVerbose()) {
            var files = [], totalent = X.U16(0x22, _LE), usedent = X.U16(0x24, _LE);
            for (i = 0; i < totalent; i++)
                if (i < usedent) files[i] = X.SA(0x50 + i * 0x20, 0x20).trim();
            sOption(usedent, " entries:");
            for (i = 0; i < files.length; i++) sOptions = sOptions.appendS(files[i], " ");
        }
    }

    else if (X.c("'XM7 TAPE IMAGE 0'")) {
        //ref https://github.com/yas-sim/xm7-related-tools/blob/main/t77dec/t77dec.cpp
        //& https://web.archive.org/web/20191207131958/http://xm7.la.coocan.jp:80/xm7/xm7.html
        sName = "Fujitsu FM-7 emulator XM7 tape (.T77)"; bDetected = true
    }

    else if (X.c("'C64-TAPE-RAW'") && X.U8(0xC) < 2) {
        bDetected = true;
        sName = "C64 cassette tape (.TAP)"; sVersion = "v" + X.U8(0xC);
        var sz = X.U32(0x10) + 0x14; if (!X.isVerbose()) { if (sz > X.Sz()) sVersion += '/malformed!short' }
        else sOptions = "sz:" + outSz(sz)
    }

    else if (X.c("'ZXTape!'1A")) { // a bit large
        // from https://www.alessandrogrussu.it/tapir/tzxform120.html
        // & https://www.msx.org/wiki/Emulation_related_file_formats#.TSX
        sVersion = 'v' + X.U8(8) + '.' + X.U8(9).padStart(2, '0'); bDetected = true;
        var ismsx = end = false, x = 0;
        var bad = '', title = '', publisher = '', auth = '', year = '', lang = '', apptype = '', price = '',
            protload = '', org = '', cmt = '', hw = '', sel = '', fnames = [];
        const types = ['B', 'N', 'S', 'C']
        p = 10; while (!end && p < X.Sz()) {
            switch (X.U8(p++)) {
                case 0x10:
                    if (!X.U8(p + 4)) { //loading flag(?)
                        if (charStat(t = X.readBytes(p + 6, 10), 1).indexOf('allasc') < 0) bad = bad.addIfNone('!nonASCIIfn');
                        t = decEncoding(t, CPSpeccy).trim(); tp = X.U8(p + 5);
                        if (!t && tp < 3) bad = bad.addIfNone('!emptyfn');
                        fnames.push(t + '.' + types[tp])
                    }
                    p += 4 + X.U16(p + 2); break;
                case 0x11: p += 0x12 + X.U24(p + 0xF); break;
                case 0x12: p += 4; break;
                case 0x13: p += 1 + 2 * X.U8(p); break;
                case 0x14:
                    if (!X.U8(p + 4) > 8) { end = true; bad = bad.addIfNone('!badnbitsin14') }
                    else p += 0xA + X.U24(p + 7); break;
                case 0x15:
                    if (!isWithin(X.U8(p + 4), 1, 8)) { end = true; bad = bad.addIfNone('!badnbitsin15') }
                    else p += 8 + X.U24(p + 5); break;
                case 0x18: if (!isWithin(X.U8(p + 9), 1, 2)) { end = true; bad = bad.addIfNone('!badcomptypein18') }
                else p += 4 + X.U32(p); break;
                case 0x19: case 0x2A: p += 4 + X.U32(p); break;
                case 0x20: case 0x23: case 0x24: p += 2; break;
                case 0x21: p += 1 + X.U8(p); break;
                case 0x22: case 0x25: case 0x27: break;
                case 0x26: p += 2 + 2 * X.U16(p); break;
                case 0x28:
                    var p1 = p + 2 + X.U16(p), n = X.U8(p + 2); p += 3;
                    for (i = 0; i < n; i++) {
                        var tl = X.U8(p + 2); p += 3;
                        sel = sel.appendS(decAnsi(p, tl, CPSpeccy, 1, Chars0to1FSpeccy), '/'); p += tl
                    }
                    p = p1; break;
                case 0x2B: if (X.U8(p + 4) > 1) { end = true; bad = bad.addIfNone('!badsignalin2B'); }
                else p += 4 + X.U32(p); break;
                case 0x30: cmt = cmt.append('-' + decAnsi(p + 1, X.U8(p), CPSpeccy, 1, Chars0to1FSpeccy).trim() + '-');
                    p += 1 + X.U8(p); break;
                case 0x31: p += 2 + X.U8(p + 1); break;
                case 0x32:
                    var p1 = p + 2 + X.U16(p), n = X.U8(p + 2); p += 3;
                    for (i = 0; i < n; i++) {
                        var tp = X.U8(p++); t = X.SC(p + 1, Math.min(X.U8(p), p1 - p), 'CP1252').trim();
                        switch (tp) {
                            case 0: title = title.append(t); break; case 1: publisher = publisher.append(t); break;
                            case 2: auth = auth.append(t); break; case 3: year = year.append(t); break;
                            case 4: lang = lang.append(t); break; case 5: apptype = apptype.append(t); break;
                            case 6: price = price.append(t); break; case 7: protload = protload.append(t); break;
                            case 8: org = org.append(t); break; case 0xFF: cmt = cmt.appendS(t, ' / '); break;
                            default: cmt = cmt.append(t, '\ninfo#' + tp.toString(16) + ':')
                        }
                        p += 1 + X.U8(p);
                    }
                    p = p1; break;
                case 0x33:
                    var hwin = X.U8(p++);
                    for (i = 0; i < hwin; i++) {
                        var hwtp = X.U8(p++), hwid = X.U8(p++);
                        switch (hwtp) {
                            case 0: hwtp = '[PC]';
                                switch (hwid) {
                                    case 0: hwid = 'ZX Spectrum 16k'; break; case 1: hwid = 'ZX Spectrum 48k/+'; break;
                                    case 2: hwid = 'ZX Spectrum 48k ISSUE 1'; break; case 3: hwid = 'ZX Spectrum 128k +(Sinclair)'; break;
                                    case 4: hwid = 'ZX Spectrum 128k +2 (grey case)'; break; case 5: hwid = 'ZX Spectrum 128k +2A/+3'; break;
                                    case 6: hwid = 'Timex Sinclair TC-2048'; break; case 7: hwid = 'Timex Sinclair TS-2068'; break;
                                    case 8: hwid = 'Pentagon 128'; break; case 9: hwid = 'SAM Coupe'; break;
                                    case 0xA: hwid = 'Didaktik M'; break; case 0xB: hwid = 'Didaktik Gama'; break;
                                    case 0xC: hwid = 'ZX-80'; break; case 0xD: hwid = 'ZX-81'; break;
                                    case 0xE: hwid = 'ZX Spectrum 128k Spanish version'; break;
                                    case 0xF: hwid = 'ZX Spectrum Arabic version'; break;
                                    case 0x10: hwid = 'Microdigital TK 90-X'; break; case 0x11: hwid = 'MicrodigitalTK 95'; break;
                                    case 0x12: hwid = 'Byte'; break; case 0x13: hwid = 'Elwro 800-3'; break;
                                    case 0x14: hwid = 'ZS Scorpion 256'; break; case 0x15: hwid = 'Amstrad CPC 464'; break;
                                    case 0x16: hwid = 'Amstrad CPC 664'; break; case 0x17: hwid = 'Amstrad CPC 6128'; break;
                                    case 0x18: hwid = 'Amstrad CPC 464+'; break; case 0x19: hwid = 'Amstrad CPC 6128+'; break;
                                    case 0x1A: hwid = 'Jupiter ACE'; break; case 0x1B: hwid = 'Enterprise'; break;
                                    case 0x1E: hwid = 'Inves Spectrum+'; break; case 0x1F: hwid = 'Profi'; break;
                                    case 0x20: hwid = 'GrandRomMax'; break; case 0x21: hwid = 'Kay 1024'; break;
                                    case 0x22: hwid = 'Ice Felix HC 91'; break; case 0x23: hwid = 'Ice Felix HC 2000'; break;
                                    case 0x24: hwid = 'Amaterske RADIO Mistrum'; break; case 0x25: hwid = 'Quorum 128'; break;
                                    case 0x26: hwid = 'MicroART ATM'; break; case 0x27: hwid = 'MicroART ATM Turbo 2'; break;
                                    case 0x28: hwid = 'Chrome'; break; case 0x29: hwid = 'ZX Badaloc'; break;
                                    case 0x2A: hwid = 'TS-1500'; break; case 0x2B: hwid = 'Lambda'; break;
                                    case 0x2C: hwid = 'TK-65'; break; case 0x2D: hwid = 'ZX-97'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 1: hwtp = '[ext.storage]';
                                switch (hwid) {
                                    case 0: hwid = 'ZX Microdrive'; break; case 1: hwid = 'Opus Discovery'; break;
                                    case 2: hwid = 'MGT DISCiPLE'; break; case 3: hwid = 'MGT +D'; break;
                                    case 4: hwid = 'Rotronics Wafadrive'; break; case 5: hwid = 'TR-DOS (BetaDisk)'; break;
                                    case 6: hwid = 'Byte Drive'; break; case 7: hwid = 'Watsford'; break;
                                    case 8: hwid = 'FIZ'; break; case 9: hwid = 'Radofin'; break;
                                    case 0xA: hwid = 'Didaktik disk drives'; break; case 0xB: hwid = 'BS-DOS (MB-02)'; break;
                                    case 0xC: hwid = 'ZX Spectrum +3 disk drive'; break;
                                    case 0xD: hwid = 'JLO (Oliger) disk interface'; break;
                                    case 0xE: hwid = 'Timex FDD3000'; break; case 0xF: hwid = 'Zebra disk drive'; break;
                                    case 0x10: hwid = 'Ramex Millenia'; break; case 0x11: hwid = 'Larken'; break;
                                    case 0x12: hwid = 'Kempston disk interface'; break; case 0x13: hwid = 'Sandy'; break;
                                    case 0x14: hwid = 'ZX Spectrum +3e hard disk'; break; case 0x15: hwid = 'ZXATASP'; break;
                                    case 0x16: hwid = 'DivIDE'; break; case 0x17: hwid = 'ZXCF'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 2: hwtp = '[memory addon]';
                                switch (hwid) {
                                    case 0: hwid = 'Sam Ram'; break; case 1: hwid = 'Multiface ONE'; break;
                                    case 2: hwid = 'Multiface 128k'; break; case 3: hwid = 'Multiface +3'; break;
                                    case 4: hwid = 'MultiPrint'; break; case 5: hwid = 'MB-02 ROM/RAM exp.'; break;
                                    case 6: hwid = 'SoftROM'; break; case 7: hwid = '1k'; break; case 8: hwid = '16k'; break;
                                    case 9: hwid = '48k'; break; case 10: hwid = 'memory in 8-16k used'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 3: hwtp = '[sound device]';
                                switch (hwid) {
                                    case 0: hwid = 'classic 128k ZX-compatible AY hw'; break;
                                    case 1: hwid = 'Fuller Box AY hw'; break; case 2: hwid = 'Currah microSpeech'; break;
                                    case 3: hwid = 'SpecDrum'; break; case 4: hwid = 'AY ACB (L:A+C R:B+C) stereo/Melodik'; break;
                                    case 5: hwid = 'AY ABC (L:A+B R:B+C) stereo/Melodik'; break;
                                    case 6: hwid = 'RAM Music Machine'; break; case 7: hwid = 'Covox'; break;
                                    case 8: hwid = 'General Sound'; break; case 9: hwid = 'Intec Electronic Digital Interface B8001'; break;
                                    case 0xA: hwid = 'Zon-X AY'; break; case 0xB: hwid = 'QuickSilva AY'; break;
                                    case 0xC: hwid = 'Jupiter ACE'; break; default: hwid = '(unk.)'
                                } break;
                            case 4: hwtp = '[joystick]';
                                switch (hwid) {
                                    case 0: hwid = 'Kempston'; break; case 1: hwid = 'Cursor/Protek/AGF'; break;
                                    case 2: hwid = 'Sinclair 2 Left (12345)'; break; case 3: hwid = 'Sinclair 1 Right (67890)'; break;
                                    case 4: hwid = 'Fuller'; break; default: hwid = '(unk.)'
                                } break;
                            case 5: hwtp = '[mouse]';
                                switch (hwid) {
                                    case 0: hwid = 'AMX mouse'; break; case 1: hwid = 'Kempston mouse'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 6: hwtp = '[controller]';
                                switch (hwid) {
                                    case 0: hwid = 'Trickstick'; break; case 1: hwid = 'ZX Light Gun'; break;
                                    case 2: hwid = 'Zebra Graphics Tablet'; break; case 3: hwid = 'Defender Light Gun'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 7: hwtp = '[serial port]';
                                switch (hwid) {
                                    case 0: hwid = 'ZX Interface I'; break; case 1: hwid = 'ZX Spectrum 128k'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 8: hwtp = '[parallel port]';
                                switch (hwid) {
                                    case 0: hwid = 'Kempston S'; break; case 1: hwid = 'Kempston E'; break;
                                    case 2: hwid = 'ZX Spectrum +3'; break; case 3: hwid = 'Tasman'; break;
                                    case 4: hwid = "DK'Tronics"; break; case 5: hwid = 'Hilderbay'; break;
                                    case 6: hwid = 'INES Printerface'; break; case 7: hwid = 'Z LPrint Interface 3'; break;
                                    case 8: hwid = 'MultiPrint'; break; case 9: hwid = 'Opus Discovery'; break;
                                    case 10: hwid = 'Standard 8255 chip with ports 31+63+95'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 9: hwtp = '[printer]';
                                switch (hwid) {
                                    case 0: hwid = 'ZX Printer/Alphacom 32 & compat.'; break;
                                    case 1: hwid = 'Generic printer'; break; case 2: hwid = 'EPSON compat.'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 0xA: hwtp = '[modem]';
                                switch (hwid) {
                                    case 0: hwid = 'Prism VTX 5000'; break; case 1: hwid = 'T/S 2050/Westridge 2050'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 0xB: hwtp = '[digitizer]';
                                switch (hwid) {
                                    case 0: hwid = 'RD Digital Tracer'; break; case 1: hwid = "DK'Tronics Light Pen"; break;
                                    case 2: hwid = 'British MicroGraph Pad'; break; case 3: hwid = 'Romantic Robot Videoface'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 0xC: hwtp = '[network adapter]';
                                if (hwid == 0) hwid = 'ZX Interface I'; else hwid = '(unk.)'; break;
                            case 0xD: hwtp = '[keyboard]';
                                if (hwid == 0) hwid = 'Keypad for ZX Spectrum 128k'; else hwid = '(unk.)'; break;
                            case 0xE: hwtp = '[AD/DA converter]';
                                switch (hwid) {
                                    case 0: hwid = 'Harley Systems ADC 8.2'; break;
                                    case 1: hwid = 'Blackboard Electronics'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 0xF: hwtp = '[EEPROM programmer]';
                                switch (hwid) {
                                    case 0: hwid = 'Orme Electronics'; break; case 1: hwid = 'Blackboard Electronics'; break;
                                    default: hwid = '(unk.)'
                                } break;
                            case 0x10: hwtp = '[GPU]';
                                switch (hwid) {
                                    case 0: hwid = 'WRX Hi-Res'; break; case 1: hwid = 'G007'; break; case 2: hwid = 'Memotech'; break;
                                    case 3: hwid = 'Lambda Colour'; break; default: hwid = '(unk.)'
                                } break;
                        }
                        switch (X.U8(p++)) {
                            case 0: hw = hw.append('runs on ' + hwtp + ' ' + hwid); break;
                            case 1: hw = hw.append('uses ' + hwtp + ' ' + hwid); break;
                            case 2: hw = hw.append('runs w/o specifics of ' + hwtp + ' ' + hwid); break;
                            case 3: hw = hw.append("won't run on " + hwtp + ' ' + hwid); break; default: break
                        }
                    } break;
                case 0x35: p += 0x14 + X.U32(p + 0x10); break;
                case 0x5A: if (!X.c("'XTape!'1A", p)) { end = true; p-- } else { x++; p += 9 } break;
                case 0x16: case 0x17: p += X.U32(p); break;
                case 0x34: p += 8; break;
                case 0x40: sOption('snapshot'); p += 4 + X.U24(p + 1); break;
                case 0x4B: ismsx = true; p += 4 + X.U32(p); break; //Kansas City Standard
                default: end = true; p--;// ripper-ready! // bad = bad.addIfNone('!unkID')
            }
        }
        if (ismsx) sName = "ZX Spectrum/MSX tape (.TSX)"; else sName = "ZX Spectrum tape (.TZX)";
        if (bad.length) sVersion = sVersion.appendS('malformed' + bad, '/');
        if (X.isVerbose()) {
            sOptionT(title); if (x > 1) sOption(x, 'x'); sOptionT(auth, 'by:'); sOptionT(year, "'"); sOptionT(publisher, '(c) ');
            sOptionT(lang, 'in:'); sOptionT(apptype, 'apptype:'); sOptionT(price, 'price:');
            sOptionT(org, 'origin:'); sOptionT(protload, 'prot/ldr:'); sOption(hw);
            sOptionT(addEllipsis(cmt, 0xA0)); sOptionT(addEllipsis(fnames.join(','), 0xA0), 'files:');
            sOptionT(sel, 'choices:'); sOption(outSz(p), 'sz:')
        }
    }

    else if (X.c("'UEF File!'00") && X.U8(0xB) <= 2) {
        //ref http://electrem.emuunlim.com/UEFSpecs.html
        sName = "Acorn PC Unified Emulator Format data (.UEF)"; bDetected = true;
        sVersion = 'v' + X.U8(0xB) + '.' + X.U8(0xA);
        var title = info = man = gear = kb = tp = '', interrupt = false;
        for (p = 0xC; p < X.Sz();) {
            var hkhd = X.U16(p), hksz = X.U32(p + 2);
            if ([0, 1, 2, 3, 4, 0xFF].indexOf(hkhd >> 8) < 0) break; //unrelated info follows?
            p += 6; switch (hkhd) {
                case 0x0000: info = info.appendS(X.SA(p, hksz), '/'); break;
                case 0x0001: man = man.appendS(X.SA(p, hksz), ' '); break;
                case 0x0005: gear = 'Acorn ';
                    switch (X.U8(p) >> 4) {
                        case 0: gear += 'BBC Model A'; break; case 1: gear += 'Electron'; break;
                        case 2: gear += 'BBC Model B'; break; case 3: gear += 'BBC Master'; break;
                        case 4: gear += 'Atom'; break
                    }
                    switch (X.U8(p) & 0xF) {
                        case 0: kb = 'any'; break; case 1: kb = 'target PC'; break; case 2: kb = 'host PC'; break
                    }
                    break;
                case 0x0009: title = X.SA(p, hksz); break;
                case 0x0101: case 0x0102: case 0x0103: case 0x0104:
                case 0x0110: case 0x0111: case 0x0112: case 0x0113: case 0x0114: case 0x0115:
                case 0x0116: case 0x0117: case 0x0120: case 0x0131:
                    tp = tp.addIfNone('#tape'); break;
                case 0x0130:
                    switch (X.U8(p)) {
                        case 0: t = 'unit'; break; case 1: t = 'tape'; break; case 2: t = 'disc'; break;
                        case 3: t = 'vtape'; break; case 4: t = 'cartridge'; break; default: 'unk.media'
                    }
                    if (X.U8(p + 1) > 1) t += ' ×' + X.U8(p + 1);
                    if (X.U8(p + 2) > 1) t += (X.U8(p) == 1 || X.U8(p) == 3) ? ' ch:' : X.U8(p) == 2 ? ' ' + X.U8(p + 2) + ' audiotracks' : '..?';
                    info += ' #' + t; break;
                case 0x0200: case 0x0201: case 0x0202: tp = tp.addIfNone('#disc'); break;
                case 0x0300: tp = tp.addIfNone('#ROM');
                    t = 'content:';
                    switch (X.U8(p)) {
                        case 0: t += 'generic'; break; case 1: t += 'OS'; break; case 2: t += 'BASIC'; break;
                        case 3: t += 'language'; break; case 4: t += 'utility'; break; case 5: t += 'filing system'; break;
                        case 6: t += 'h/w driver'; break; case 7: t += 'game'; break; default: t += 'unk'
                    } info += ' #' + t; break;
                case 0x0301: tp = tp.addIfNone('#ROM'); break;
                case 0x0400: case 0x0401: case 0x0402: case 0x0403:
                case 0x0410: case 0x0411: case 0x0412: case 0x0420:
                    tp = tp.addIfNone('#snapshot'); break;
                case 0xFF00: info += '#emu:' + X.SA(p, hksz); break;
                case 0x0100: break; //the "implicit data chunk"! eh?
                default:
                    if (hkhd > 0xFF00) tp = tp.addIfNone('#customdata');
                    else interrupt = true // unknown chunk = unrelated tailing data?
            }
            if (interrupt) { p -= 6; break }
            //_log(Hex(p-6)+' > '+Hex(hkhd));
            p += hksz
        }
        sVersion += tp;
        if (X.isVerbose()) {
            sOption(title); sOptionT(info, 'info:'); sOptionT(man, 'manual:');
            sOptionT(gear, 'gear:'); sOptionT(kb, 'layout:');
            sOption(outSz(p), 'sz:')
        }
    }

    else if (X.c("'UNIF'???????? 0000 0000 0000 0000 0000 0000 0000") && (X.Sz() > 32)) {
        sName = "UNIF NES cartridge (.UNF)"; sVersion = "v" + X.U32(4, _LE); bDetected = true;
        if (X.isVerbose()) {
            p = 8;
            t = ''; mapr = ''; tv = ''; ex = ''; fstorage = lastchunk = false;
            while (p < X.Sz() && !lastchunk) {
                var hkhd = X.SA(p, 4), hksz = X.U32(p + 4); p += 0x08;
                switch (hkhd) {
                    case "MAPR": mapr = X.SA(p, hksz); break;
                    case "NAME": t = X.SA(p, hksz); break;
                    case "TCVI": switch (X.U8(p)) {
                        case 0: tv = "NTSC"; break;
                        case 1: tv = "PAL"; break;
                        case 2: tv = "NTSC/PAL"
                    }
                        break;
                    case "CTRL":
                        var exa = [], bm = X.U8(p);
                        if (bm & 1) exa.push("Std. Controller");
                        if (bm & 2) exa.push("Zapper");
                        if (bm & 4) exa.push("R.O.B.");
                        if (bm & 8) exa.push("Arkanoid Controller");
                        if (bm & 0x10) exa.push("Power Pad");
                        if (bm & 0x20) exa.push("Four Score");
                        if (bm) ex = "#" + exa.join("+");
                        break;
                    case "BATR": fstorage = true; break;
                    case "MIRR": lastchunk = true; break
                }
                p += hksz;
            }
            sOptionT(t);
            sOption(tv);
            sOption(ex, 'expansion: ');
            if (fstorage) sOption('battery-backed RAM');
            if (lastchunk) sOption(outSz(p), 'sz:'); else sVersion += '/malformed!short'
        }
    }

    else if (X.c("'g GCE 198'..80")) {
        sName = "GCE Vectrex cartridge (.VEC)"; bDetected = true;
        if (X.isVerbose()) {
            p = X.fSig(0x11, 0x20, "80"); if (p > 0) sOption(X.SA(0x11, p - 0x11))
        }
    }

    else if (X.c("'VICE Snapshot File'1A")) {
        sName = "C64 VICE emulator snapshot (.VSF)"; bDetected = 1;
        sVersion = 'v' + X.U8(0x13) + '.' + X.U8(0x14).padStart(2, '0');
        p = 0x25; bad = ''
        while (p < X.Sz()) {
            var hkhd = X.SA(p, 0x10), hksz = X.U32(p + 0x12, _BE);
            if (!/([A-Z0-9-]{3,}|Acia1)/.test(hkhd) || !isAllZeroes(p + hkhd.length, 0x10 - hkhd.length)) {
                bad = bad.addIfNone('badchunk'); break
            } else p += hksz;
        }
        if (X.isVerbose()) sOptions = X.SA(0x15, 0xF) + ' sz:' + outSz(sz);
        else if (p > X.Sz()) bad = bad.addIfNone('!short');
        if (bad != '') sVersion = sVersion.appendS('/malformed' + bad, '/')
    }

    function isWAD() {
        //ref https://doomwiki.org/wiki/WAD
        if (!X.c("'IWAD'") && !X.c("'PWAD'")) return false;
        var susBE = 0, en = _LE; // Atari Jaguar port has special stuff: big-endian, the final lump tag
        lumpn = X.I32(4, en); if (lumpn < 0 || lumpn > X.I32(4, _BE)) {
            lumpn = X.I32(4, _BE); if (lumpn > 0) { susBE++; en = _BE } else return false;
        }
        var i = 0, msz = 0, dirp = X.I32(8, en), p = dirp; if (!isWithin(dirp, 12, X.Sz())) return false; else susBE++;
        var lumps = [], maxlump = Math.min(lumpn, 0x40); //a bit too many lumps in a doom2.wad file, too slow
        for (; i < maxlump; i++, p += 0x10) {
            if (p + 0x10 > X.Sz()) return false;
            var ofs = X.I32(p, en), sz = X.I32(p + 4, en); if (ofs < 0 || sz < 0 || !isWithin(ofs, 12, X.Sz())) return false;
            if (X.c("'ENDOFWAD'", p + 8)) susBE++; lumps.push([ofs, sz, X.readBytes(p + 8, 8)]);
        }
        lumps = lumps.sort(function (a, b) { return a[0] - b[0] });
        for (i = 0; i < maxlump; i++) {
            var co = (lumps[i][2][0] & 0x80) > 0; lumps[i][2][0] = lumps[i][2][0] & 0x7F;
            if (charStat(lumps[i][2], true).indexOf('allxsc') < 0) return false;
            if (!co && i < maxlump - 2 && lumps[i][0] + lumps[i][1] > lumps[i + 1][0]) return false
        }
        v = susBE >= 2 ? 'Atari Jaguar' : 'PC';
        return true
    }
    if (!bDetected && isWAD()) {
        sName = "iD Software's Where's All the Data resource pack (.WAD)"; bDetected = true;
        sVersion = X.c("'I'") ? 'initial' : 'patch'; sVersion += '#' + v;
    }

    if (!bDetected) if (X.c("'WOZ'..FF0A0D0A ........ 'INFO'") && isWithin(X.U8(3), 0x31, 0x32)) {
        //ref https://applesaucefdc.com/woz/reference2/
        sName = "Apple II Applesauce disk image (.WOZ)"; sVersion = 'v' + X.SA(3, 1);
        p = 0xC; meta = bad = '';
        while (p < X.Sz()) {
            var hkhd = X.SA(p, 4), hksz = X.U32(p + 4); p += 8;
            switch (hkhd) {
                case 'INFO':
                    iV = X.U8(p); bDetected = true;
                    dim = X.U8(p + 1) == 1 ? '5¼"' : X.U8(p + 1) == 2 ? '3½"' : '?';
                    if (iV >= 2) ds = X.U8(p + 37) == 1 ? ' SS' : X.U8(p + 37) == 2 ? ' DS' : ' ?'; else ds = '';
                    sOption('disk:' + dim + ds);
                    if (X.U8(p + 2) == 1) sOption('write-protected');
                    if (iV >= 2) {
                        if (t = X.U8(p + 42)) sOption(t, 'min.RAM:', 'k');
                        t = ''; fl = X.U16(p + 40); if (!fl) t = '?'; if (fl & (1 << 0)) t = t.append('][');
                        if (fl & (1 << 1)) t = t.append('][ Plus'); if (fl & (1 << 2)) t = t.append('//e');
                        if (fl & (1 << 3)) t = t.append('//c'); if (fl & (1 << 4)) t = t.append('//e Enhanced');
                        if (fl & (1 << 5)) t = t.append('IIgs'); if (fl & (1 << 6)) t = t.append('//c Plus');
                        if (fl & (1 << 7)) t = t.append('///'); if (fl & (1 << 8)) t = t.append('/// Plus');
                        sOption(t, 'for Apple ');
                    }
                    break;
                case 'TMAP': case 'TRKS': case 'FLUX': case 'WRIT': break;
                case 'META': meta = X.SC(p, hksz, 'UTF8').replace(/\x0A/g, ",").replace(/\x09/g, ":"); break
            }
            p += hksz;
        }
        if (p > X.Sz()) bad = bad.addIfNone('!short');
        //if(X.isDeepScan() && X.calculateCRC32(12,sz-12) != X.U32(8)) bad = bad.addIfNone('!badcrc');
        if (bad != '') sVersion = sVersion.appendS('/malformed' + bad, '/')
        if (X.isVerbose()) {
            sOptionT(addEllipsis(meta), 'info:"', '"');
            sOption(outSz(p), 'sz:');
        }
    }


    function isZ80() {
        //from https://github.com/FuseEmulator/fuse-emulator-svn/blob/master/libspectrum/z80.c
        // & https://worldofspectrum.org/faq/reference/z80format.htm
        // basic header len = 30, v2ext = 23, v3ext = 54, xzxext = 55
        if (!extIs('z80') && !extIs('slt')) return false; if (X.Sz() < 1380) return false;
        nv = 0; co = true; joystick = hw = ''; const xhdr = 32, b12 = X.U8(12); if (b12 == 0xFF) b12 = 1;
        var pc = X.U16(6), srx = X.U8(37) & 0x80, hdrsz = 0x1E;
        if (!pc) { //PC register 0 means v2+
            switch (xblk = X.U16(30)) { case 23: nv = 2; break; case 54: case 55: nv = 3; break; default: return false }
            hdrsz += xblk + 2;
            switch (nv) {
                case 2:
                    switch ((X.U8(29) >> 6) && 3) {
                        case 0: joystick = 'cursor'; break; case 1: joystick = 'Kempston'; break;
                        case 2: joystick = 'SinclairI2-L'; break; case 3: joystick = 'SinclairI2-R'
                    } break;
                case 3:
                    switch ((X.U8(29) >> 6) && 3) {
                        case 0: joystick = 'cursor'; break; case 1: joystick = 'Kempston'; break; case 3: joystick = 'SinclairI2-R'; break;
                        case 2: if (X.c("030F0308 03040302 0301", xhdr + 32)) joystick = 'Sinclair2-L'; else joystick = 'custom';
                    } break;
                default: return false
            }
            var tp = X.U8(xhdr + 2), mgttp = X.U8(xhdr + 51);
            if (tp < 7) {
                switch (nv) {
                    case 2:
                        switch (tp) {
                            case 0: hw = 'ZX Spectrum ' + (srx ? '16k' : '48k'); break;
                            case 1: hw = 'ZX Spectrum ' + (srx ? '16' : '48') + 'k & Interface1'; break;
                            case 2: hw = 'ZX Spectrum ' + (srx ? '16' : '48') + 'k & SamRam'; break;
                            case 3: hw = 'ZX Spectrum ' + (srx ? '+2' : '128k'); break;
                            case 4: hw = 'ZX Spectrum ' + (srx ? '+2' : '128k') + ' & Interface1'; break;
                            default: return false
                        }
                        break;
                    case 3:
                        const mgttps = ['MGT EPSON DISCiPLE', 'MGT HP DISCiPLE', 'MGT +D'];
                        mgttp = [0, 1, 16].indexOf(mgttp);
                        switch (tp) {
                            case 0: hw = 'ZX Spectrum ' + (srx ? '16k' : '48k'); break;
                            case 1: hw = 'ZX Spectrum ' + (srx ? '16' : '48') + 'k & Interface1'; break;
                            case 2: hw = 'ZX Spectrum ' + (srx ? '16' : '48') + 'k & SamRam'; break;
                            case 3: if (mgttp < 0) return false;
                                hw = 'ZX Spectrum ' + (srx ? '16' : '48') + 'k & ' + mgttps[mgttp] + ' MGT'; break;
                            case 4: hw = 'ZX Spectrum ' + (srx ? '+2' : '128k'); break;
                            case 5: hw = 'ZX Spectrum ' + (srx ? '+2' : '128k') + ' & Interface1'; break;
                            case 6: if (mgttp < 0) return false;
                                hw = 'ZX Spectrum ' + (srx ? '+2' : '128k') + ' & ' + mgttps[mgttp] + ' MGT'; break;
                            default: return false //won't happen
                        }
                        break;
                    default: return false //won't happen
                }
            } else {
                switch (tp) {
                    case 7: case 8: hw = 'ZX Spectrum ' + (srx ? '+2A' : '+3'); break; case 9: hw = 'Pentagon 128+'; break;
                    case 10: hw = 'Scorpion ZS-256'; break; case 11: hw = 'Didaktik-Kompakt'; break;
                    case 12: hw = 'ZX Spectrum +2'; break; case 13: hw = 'ZX Spectrum +2A'; break;
                    case 14: hw = 'Timex Sinclair TC-2048'; break; case 15: hw = 'Timex Sinclair TC-2068';
                    case 128: hw = 'Timex Sinclair TS-2068'; break;
                    default: return false
                }
            }
            if (X.U8(37) & 0x44) hw += ' + Fuller Box'; else if (X.U8(37) & 4) hw += ' + Melodik';
        } else {
            nv = 1; hw = 'ZX Spectrum 48k';
            co = (b12 & 0x20) > 0;
            switch ((X.U8(29) >> 6) && 3) {
                case 0: joystick = 'cursor'; break; case 1: joystick = 'Kempston'; break;
                case 2: joystick = 'SinclairI2-L'; break; case 3: joystick = 'SinclairI2-R'
            }
        }
        pgs = [];
        if (!co) sz = p = hdrsz + 0xC000; else {
            const maxbsz = nv == 1 ? 0xC000 : 0x4000;
            for (p = hdrsz, i = unpsz = 0; p < X.Sz() && i < 0x40; i++) { //reading blocks, i = blocks count in case of a FP loop
                if (X.c("000000'SLT'", p)) break;
                var hksz = nv == 1 ? 0x10000 : X.U16(p), //compressed chunk size; moot if v.1
                    pg = nv == 1 ? 3 : X.U8(p + 2); // ROM/RAM 'page' number; page 3 is the normal start of a 48k snapshot
                if (pgs.indexOf(pg) >= 0)
                    if (i < 3) return false; else break
                else pgs.push(pg);
                if (nv > 1) p += 3;
                //_l2r('z80',p,'blk '+i+' p.'+pg+' sz '+Hex(hksz))
                if (i > 0) q = p + hksz;
                else for (bsz = b = c = 0, q = p; q < p + hksz && bsz < maxbsz && q < X.Sz();) { //parse a block — a couple times; can be slow
                    if (X.c("EDED", q)) {
                        q += 2; c = X.U8(q++); b = X.U8(q++);
                        if (c < 5 && b != 0xED) return false;
                        bsz += c;
                    } else { q++; bsz++ }
                    if (nv == 1 && X.c("00EDED00", q)) { q += 4; break } // block-end marker
                } //for: parse a block
                if (bsz != maxbsz || (n > 1 && q != p + hksz)) return false;
                p = q; unpsz += bsz;
                if (nv == 1 || pg > 10 || pgs.length > 10) break;
            } //for: reading blocks
            //_l2r('z80',p,'blks:'+i+' pages:'+pgs.join('+')+' unpsz '+Hex(unpsz))
            if (p > X.Sz() || (nv > 1 && !i)) return false;
            sz = p
        }
        if (slt = X.c("000000'SLT'", p)) sltcycle: for (sltsz = 0, sltlv = [], p += 6; p < X.Sz(); p += 8)
            switch (X.U16(p)) {
                case 0: sz += 14 + sltsz; sltinfo = 'SLT levels:' + sltlv.join(','); break sltcycle;
                case 1: sltlv.push(X.U16(p + 2)); sltsz += 8 + X.U32(p + 4); break;
                default: sltsz += 8 + X.U32(p + 4); _l2r('z80', p, 'Unknown block! Please send this file to the author of rom.1.sg'); break //unknown block!
            } else sltinfo = '';
        return true
    }
    if (!bDetected && isZ80()) {
        sName = slt ? 'ZX Spectrum state snapshot + levels (.SLT)' : 'ZX Spectrum state snapshot (.Z80)'; bDetected = true;
        sVersion = 'v' + nv; if (nv == 3 && X.U16(30) == 55) sVersion += 'x'; if (co) sVersion += '/compressed';
        if (X.isVerbose()) {
            sOption(hw, 'on:'); sOption(joystick, 'joystick:');
            if (co) sOption('pages:' + pgs.join('+') + ' unp.sz:' + Util.divu64(unpsz, 1024) + 'k'); if (slt) sOption(sltinfo); sOption(outSz(sz), 'sz:')
        }
    }


    // shaky heuristics follow
    if (!bDetected && X.isHeuristicScan()) {

        function isTAP() {
            //from https://github.com/0sAND1s/HCDisk/blob/master/Tape/tap.cpp
            if (X.Sz() < 17 || X.Sz() < X.U16(0) + 2) return false;
            p = blk = sus = 0; fnames = bad = ''; const types = ['B', 'N', 'S', 'C'];
            while (p < X.Sz()) { //parse the blocks
                hksz = X.U16(p); if (!hksz) return false; p += 2; if (X.Sz() < p + hksz) break;
                var c = 0, tp = X.U8(p); if ([0, 0xFF].indexOf(tp) < 0) break;
                if (p < 0xC000 && blk < 5) { /*CRC test. No need to test the WHOLE file*/
                    for (i = p; i < p + hksz - 1; i++) c ^= X.U8(i); if (c != X.U8(i)) return false;
                }
                if (tp == 0) {
                    //_l2r('tap',p+2,X.readBytes(p+2,10)+':'
                    //	+outArray(X.readBytes(p+2,10),16)
                    //	+' -> '+decEncoding(X.readBytes(p+2,10),CPSpeccy))
                    if (charStat(t = X.readBytes(p + 2, 10), 1).indexOf('allasc') < 0) { sus++; bad = bad.addIfNone('!nonASCII:' + decEncoding(t, CPSpeccy)) }
                    t = decEncoding(t, CPSpeccy).trim();
                    if (!t) if (X.U8(p + 1) < 3) return false; else { sus++; bad = bad.addIfNone('!emptyname') }
                    fnames = fnames.appendS(t + '.' + types[X.U8(p + 1)], ',')
                }
                else fnames = fnames.appendS((hksz - 3), ':');
                if (sus > 2) return false; blk++; p += hksz
            }
            if (!fnames.length && blk) { sus++; bad = bad.addIfNone('!nonameblk0') }
            if (blk < 2 && bad.indexOf('!nonASCII')) sus++;
            //if(X.Sz() != p) sus++;
            if (sus > 2 || !blk || !fnames.length || p < 17) { delete bad; return false }
            return true
        }
        if (isTAP()) {
            sName = 'ZX Spectrum tape (.TAP)'; bDetected = true;
            if (bad.length) sVersion = 'malformed#' + sus + bad;
            if (X.isVerbose()) {
                sOptionT(addEllipsis(fnames, 0xA0), 'blocks:' + blk + ' (', ')');
                sOption(outSz(p), 'sz:')
            }
        }

        // if(extIs('bin'))
        // 	if(X.c("FA33C08E") || X.c("FA33C08E",0x455E0)) { //doens't catch all
        // 		_setResult("ROM","Palm OS disk image (.BIN)",'','')
        // 	}

        if (extIs('rom'))
            if ((X.c("4142") || X.c("4142", 0x4000) || X.c("41421040", 0x3C000)
                || X.c("0002204810A8D08055E0A8B088800280", 0x7FF0)) // the weirdly specific one for Eagle Fighter (JP).rom
                && [0x2000, 0x4000, 0x8000, 0xC000, 0x10000,
                    0x20000, 0x40000, 0x60000, 0x80000, 0x100000].indexOf(X.Sz()) >= 0) {
                _setResult("ROM", "Microsoft MSX/MSX 2 cartridge (.ROM)", '', '')
            }

        if (extIs('sna') && X.Sz() == 49179)
            _setResult("ROM", "ZX Spectrum 48k state snapshot file (.SNA)", '', '')
    }

    return result()
}
/* beautify ignore:end */


================================================
FILE: db/Binary/U-Boot.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://source.denx.de/u-boot/u-boot/-/raw/e4dba4b/include/image.h

meta("format");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("27051956")) { // Image Header Magic Number
            bDetected = true;

            sName = "U-Boot ";
            switch (Binary.readByte(0x1E)) { // Image Type
                case 0: sName += "Invalid Image"; break;
                case 1: sName += "Standalone Program"; break;
                case 2: sName += "OS Kernel Image"; break;
                case 3: sName += "RAMDisk Image"; break;
                case 4: sName += "Multi-File Image"; break;
                case 5: sName += "Firmware Image"; break;
                case 6: sName += "Script file"; break;
                case 7: sName += "Filesystem Image"; break;
                case 8: sName += "Binary Flat Device Tree Blob"; break;
                case 9: sName += "Kirkwood Boot Image"; break;
                case 10: sName += "Freescale IMXBoot Image"; break;
                case 11: sName += "Davinci UBL Image"; break;
                case 12: sName += "TI OMAP Config Header Image"; break;
                case 22: sName += "A list of typeless images"; break;
                case 23: sName += "Rockchip Boot Image"; break;
                case 24: sName += "Rockchip SD card"; break;
                case 25: sName += "Rockchip SPI image"; break;
                case 26: sName += "Xilinx Zynq Boot Image"; break;
                case 27: sName += "Xilinx ZynqMP Boot Image"; break;
                case 28: sName += "FPGA Image"; break;
                case 29: sName += "VYBRID .vyb Image"; break;
                case 30: sName += "Trusted Execution Environment OS Image"; break;
                case 31: sName += "Firmware Image with HABv4 IVT"; break;
                default: return;
            }
        }

        if (bDetected) {
            sVersion = "\"" + Binary.getString(0x20, 0x20) + "\""; // Image Name

            switch (Binary.readByte(0x1C)) { // Operating System
                case 0: sOptions = "Invalid OS"; break;
                case 1: sOptions = "OpenBSD"; break;
                case 2: sOptions = "NetBSD"; break;
                case 3: sOptions = "FreeBSD"; break;
                case 4: sOptions = "4.4BSD"; break;
                case 5: sOptions = "Linux"; break;
                case 6: sOptions = "SVR4"; break;
                case 7: sOptions = "Esix"; break;
                case 8: sOptions = "Solaris"; break;
                case 9: sOptions = "Irix"; break;
                case 10: sOptions = "SCO"; break;
                case 11: sOptions = "Dell"; break;
                case 12: sOptions = "NCR"; break;
                case 13: sOptions = "LynxOS"; break;
                case 14: sOptions = "VxWorks"; break;
                case 15: sOptions = "pSOS"; break;
                case 16: sOptions = "QNX"; break;
                case 17: sOptions = "Firmware"; break;
                case 18: sOptions = "RTEMS"; break;
                case 19: sOptions = "ARTOS"; break;
                case 20: sOptions = "Unity OS"; break;
                case 21: sOptions = "INTEGRITY"; break;
                case 22: sOptions = "OSE"; break;
                case 23: sOptions = "Plan 9"; break;
                case 24: sOptions = "OpenRTOS"; break;
                case 25: sOptions = "ARM Trusted Firmware"; break;
                case 26: sOptions = "Trusted Execution Environment"; break;
                case 27: sOptions = "RISC-V OpenSBI"; break;
                case 28: sOptions = "EFI Firmware"; break;
            }

            switch (Binary.readByte(0x1D)) { // CPU architecture
                case 0: sOptions = sOptions.append("Invalid CPU"); break;
                case 1: sOptions = sOptions.append("Alpha"); break;
                case 2: sOptions = sOptions.append("ARM"); break;
                case 3: sOptions = sOptions.append("Intel x86"); break;
                case 4: sOptions = sOptions.append("IA64"); break;
                case 5: sOptions = sOptions.append("MIPS"); break;
                case 6: sOptions = sOptions.append("MIPS64"); break;
                case 7: sOptions = sOptions.append("PowerPC"); break;
                case 8: sOptions = sOptions.append("IBM S390"); break;
                case 9: sOptions = sOptions.append("SuperH"); break;
                case 10: sOptions = sOptions.append("Sparc"); break;
                case 11: sOptions = sOptions.append("Sparc64"); break;
                case 12: sOptions = sOptions.append("M68K"); break;
                case 13: sOptions = sOptions.append("Nios-32"); break;
                case 14: sOptions = sOptions.append("MicroBlaze"); break;
                case 15: sOptions = sOptions.append("Nios-II"); break;
                case 16: sOptions = sOptions.append("Blackfin"); break;
                case 17: sOptions = sOptions.append("AVR32"); break;
                case 18: sOptions = sOptions.append("STM ST200"); break;
                case 19: sOptions = sOptions.append("Sandbox"); break;
                case 20: sOptions = sOptions.append("NDS32"); break;
                case 21: sOptions = sOptions.append("OpenRISC"); break;
                case 22: sOptions = sOptions.append("ARM64"); break;
                case 23: sOptions = sOptions.append("ARC"); break;
                case 24: sOptions = sOptions.append("AMD x86_64"); break;
                case 25: sOptions = sOptions.append("Xtensa"); break;
                case 26: sOptions = sOptions.append("RISC-V"); break;
            }

            switch (Binary.readByte(0x1F)) { // Compression Type
                case 0: sOptions = sOptions.append("no compression"); break;
                case 1: sOptions = sOptions.append("gzip"); break;
                case 2: sOptions = sOptions.append("bzip2"); break;
                case 3: sOptions = sOptions.append("lzma"); break;
                case 4: sOptions = sOptions.append("lzo"); break;
                case 5: sOptions = sOptions.append("lz4"); break;
                case 6: sOptions = sOptions.append("zstd"); break;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/__MiniExtensionsHeuristic_By_DosX.7.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev
// Updated by BJNFNE

const detect = main;

function main() {
    if (Binary.isHeuristicScan()) {

        const
            currentFileExtension = Binary.getFileSuffix().toLowerCase(),
            isBinaryFile = !Binary.isPlainText(),
            extensionsDb = [
                { ext: ["cmd", "bat"], type: "language", name: "Batch", bin: false },
                { ext: ["html", "htm"], type: "language", name: "HTM", bin: false },
                { ext: ["css"], type: "language", name: "Cascading Style Sheets", bin: false },
                { ext: ["c", "h"], type: "language", name: "C", bin: false },
                { ext: ["cpp", "hpp"], type: "language", name: "C++", bin: false },
                { ext: ["cs"], type: "language", name: "C#", bin: false },
                { ext: ["java"], type: "language", name: "Java", bin: false },
                { ext: ["py"], type: "language", name: "Python 🐓", bin: false },
                { ext: ["json"], type: "language", name: "JavaScript Object Notation", bin: false },
                { ext: ["xml"], type: "language", name: "Extensible Markup", bin: false },
                { ext: ["ini"], type: "format", name: "Configuration File", bin: false },
                { ext: ["yml", "yaml"], type: "language", name: "YAML", bin: false },
                { ext: ["php"], type: "language", name: "PHP", bin: false },
                { ext: ["rb"], type: "language", name: "Ruby", bin: false },
                { ext: ["pl"], type: "language", name: "Perl", bin: false },
                { ext: ["swift"], type: "language", name: "Swift", bin: false },
                { ext: ["rs"], type: "language", name: "Rust", bin: false },
                { ext: ["go"], type: "language", name: "Go", bin: false },
                { ext: ["ts"], type: "language", name: "TypeScript", bin: false },
                { ext: ["kt"], type: "language", name: "Kotlin", bin: false },
                { ext: ["dart"], type: "language", name: "Dart", bin: false },
                { ext: ["lua"], type: "language", name: "Lua", bin: false },
                { ext: ["sh"], type: "language", name: "Bash", bin: false },
                { ext: ["r"], type: "language", name: "R", bin: false },
                { ext: ["scala"], type: "language", name: "Scala", bin: false },
                { ext: ["lisp"], type: "language", name: "Lisp", bin: false },
                { ext: ["clj"], type: "language", name: "Clojure", bin: false },
                { ext: ["asm"], type: "language", name: "Assembly", bin: false },
                { ext: ["vb"], type: "language", name: "VB.NET", bin: false },
                { ext: ["fs"], type: "language", name: "F#", bin: false },
                { ext: ["ps1"], type: "language", name: "PowerShell Script", bin: false },
                { ext: ["ml"], type: "language", name: "OCaml", bin: false },
                { ext: ["hs"], type: "language", name: "Haskell", bin: false },
                { ext: ["vhd"], type: "language", name: "VHDL", bin: false },
                { ext: ["verilog"], type: "language", name: "Verilog", bin: false },
                { ext: ["ada"], type: "language", name: "Ada", bin: false },
                { ext: ["for"], type: "language", name: "Fortran", bin: false },
                { ext: ["pas"], type: "language", name: "Pascal", bin: false },
                { ext: ["m"], type: "language", name: "Objective-C", bin: false },
                { ext: ["v"], type: "language", name: "V", bin: false },
                { ext: ["img", "iso"], type: "format", name: "Disk Image", bin: true },
                { ext: ["dmg"], type: "format", name: "Apple Disk Image", bin: true },
                { ext: ["cab"], type: "format", name: "Cabinet Archive", bin: true },
                { ext: ["dat"], type: "format", name: "Data File", bin: true },
                { ext: ["vmdk"], type: "format", name: "VMware Virtual Disk", bin: true },
                { ext: ["vhd", "vhdx"], type: "format", name: "Virtual Hard Disk", bin: true },
                { ext: ["apk"], type: "format", name: "Android Package", bin: true },
                { ext: ["so"], type: "format", name: "Shared Object Library", bin: true },
                { ext: ["obj"], type: "format", name: "Object File", bin: true },
                { ext: ["a"], type: "format", name: "Static Library", bin: true },
                { ext: ["lib"], type: "format", name: "Library File", bin: true },
                { ext: ["o"], type: "format", name: "Compiled Object File", bin: true },
                { ext: ["pdb"], type: "format", name: "Program Database", bin: true },
                { ext: ["nso"], type: "format", name: "Nintendo Switch Object", bin: true },
                { ext: ["iso"], type: "format", name: "ISO Disk Image", bin: true },
                { ext: ["img"], type: "format", name: "Raw Disk Image", bin: true },
                { ext: ["dylib"], type: "format", name: "Dynamic Library (macOS)", bin: true },
                { ext: ["xex"], type: "format", name: "Xbox Executable File", bin: true },
                { ext: ["rom"], type: "format", name: "ROM Image", bin: true },
                { ext: ["pe"], type: "format", name: "Portable Executable", bin: true },
                { ext: ["bpl"], type: "format", name: "Borland Package Library", bin: true },
                { ext: ["vbx"], type: "format", name: "Visual Basic", bin: true },
                { ext: ["ocx"], type: "format", name: "ActiveX Control", bin: true },
                { ext: ["psd"], type: "format", name: "Photoshop Document", bin: true },
                { ext: ["ai"], type: "format", name: "Adobe Illustrator", bin: true },
                { ext: ["indd"], type: "format", name: "InDesign Document", bin: true },
                { ext: ["xd"], type: "format", name: "Adobe XD", bin: true },
                { ext: ["svg"], type: "format", name: "Scalable Vector Graphics", bin: false },
                { ext: ["blend"], type: "format", name: "Blender Project", bin: true },
                { ext: ["obj"], type: "format", name: "3D Object", bin: true },
                { ext: ["fbx"], type: "format", name: "Autodesk FBX", bin: true },
                { ext: ["stl"], type: "format", name: "STL Model", bin: true },
                { ext: ["gltf", "glb"], type: "format", name: "GLTF/GLB Model", bin: true },
                { ext: ["png"], type: "format", name: "Portable Network Graphics", bin: true },
                { ext: ["jpg", "jpeg"], type: "format", name: "JPEG Image", bin: true },
                { ext: ["bmp"], type: "format", name: "Bitmap Image", bin: true },
                { ext: ["tiff"], type: "format", name: "Tagged Image File Format", bin: true },
                { ext: ["tga"], type: "format", name: "Targa Image", bin: true },
                { ext: ["heic"], type: "format", name: "High Efficiency Image Format", bin: true },
                { ext: ["raw", "cr2", "nef", "orf"], type: "format", name: "RAW Image", bin: true },
                { ext: ["eps"], type: "format", name: "Encapsulated PostScript", bin: true },
                { ext: ["3ds"], type: "format", name: "3D Studio Max", bin: true },
                { ext: ["max"], type: "format", name: "3ds Max Project", bin: true },
                { ext: ["c4d"], type: "format", name: "Cinema 4D Project", bin: true },
                { ext: ["dae"], type: "format", name: "Collada", bin: true },
                { ext: ["skp"], type: "format", name: "SketchUp", bin: true },
                { ext: ["dxf"], type: "format", name: "Drawing Exchange Format", bin: true },
                { ext: ["dwg"], type: "format", name: "AutoCAD Drawing", bin: true },
                { ext: ["iges", "igs"], type: "format", name: "IGES Model", bin: true },
                { ext: ["step", "stp"], type: "format", name: "STEP Model", bin: true },
                { ext: ["vrml", "wrl"], type: "format", name: "VRML Model", bin: true },
                { ext: ["x3d"], type: "format", name: "X3D Model", bin: true },
                { ext: ["mp4"], type: "format", name: "MPEG-4 Video", bin: true },
                { ext: ["bik"], type: "format", name: "Bink Video", bin: true },
                { ext: ["mkv"], type: "format", name: "Matroska Video", bin: true },
                { ext: ["avi"], type: "format", name: "AVI Video", bin: true },
                { ext: ["mov"], type: "format", name: "QuickTime Movie", bin: true },
                { ext: ["flv"], type: "format", name: "Flash Video", bin: true },
                { ext: ["webm"], type: "format", name: "WebM Video", bin: true },
                { ext: ["mp3"], type: "format", name: "MP3 Audio", bin: true },
                { ext: ["wav"], type: "format", name: "Waveform Audio", bin: true },
                { ext: ["aac"], type: "format", name: "Advanced Audio Coding", bin: true },
                { ext: ["ogg"], type: "format", name: "Ogg Vorbis", bin: true },
                { ext: ["m4a"], type: "format", name: "MPEG-4 Audio", bin: true },
                { ext: ["wma"], type: "format", name: "Windows Media Audio", bin: true },
                { ext: ["prproj"], type: "format", name: "Premiere Pro Project", bin: true },
                { ext: ["aep"], type: "format", name: "After Effects Project", bin: true },
                { ext: ["psb"], type: "format", name: "Photoshop Big Document", bin: true },
                { ext: ["cdr"], type: "format", name: "CorelDRAW Image", bin: true },
                { ext: ["afdesign"], type: "format", name: "Affinity Designer", bin: true },
                { ext: ["afphoto"], type: "format", name: "Affinity Photo", bin: true },
                { ext: ["afpub"], type: "format", name: "Affinity Publisher", bin: true },
                { ext: ["sketch"], type: "format", name: "Sketch Project", bin: true },
                { ext: ["xcf"], type: "format", name: "GIMP Image", bin: true },
                { ext: ["kra"], type: "format", name: "Krita Image", bin: true },
                { ext: ["vproj"], type: "format", name: "Vegas Pro Project", bin: true },
                { ext: ["wpd"], type: "format", name: "WordPerfect Document", bin: true },
                { ext: ["vpj"], type: "format", name: "VideoPad Project", bin: true },
                { ext: ["prtl"], type: "format", name: "Premiere Title", bin: true },
                { ext: ["pdn"], type: "format", name: "Paint.NET Image", bin: true },
                { ext: ["tmp", "temp"], type: "format", name: "Temporary file", bin: true },
                { ext: ["tmp", "temp"], type: "format", name: "Temporary file", bin: false },
                { ext: ["mb"], type: "format", name: "Maya Binary Project", bin: true },
                { ext: ["ma"], type: "format", name: "Maya ASCII Project", bin: true },
                { ext: ["lwo"], type: "format", name: "LightWave Object", bin: true },
                { ext: ["lws"], type: "format", name: "LightWave Scene", bin: true },
                { ext: ["obj"], type: "format", name: "Wavefront OBJ", bin: true },
                { ext: ["abc"], type: "format", name: "Alembic", bin: true },
                { ext: ["bgeo"], type: "format", name: "Houdini Geometry", bin: true },
                { ext: ["vdb"], type: "format", name: "OpenVDB", bin: true },
                { ext: ["usd"], type: "format", name: "Universal Scene Description", bin: true },
                { ext: ["usdz"], type: "format", name: "Universal Scene Description (zipped)", bin: true },
                { ext: ["vox"], type: "format", name: "MagicaVoxel", bin: true },
                { ext: ["cob"], type: "format", name: "Caligari Object", bin: true },
                { ext: ["scn"], type: "format", name: "3D Scene", bin: true },
                { ext: ["3dm"], type: "format", name: "Rhinoceros 3D Model", bin: true },
                { ext: ["ztl"], type: "format", name: "ZBrush Tool", bin: true },
                { ext: ["zpr"], type: "format", name: "ZBrush Project", bin: true },
                { ext: ["bip"], type: "format", name: "Character Studio Biped", bin: true },
                { ext: ["3mf"], type: "format", name: "3D Manufacturing Format", bin: true },
                { ext: ["ply"], type: "format", name: "Polygon File Format", bin: true },
                { ext: ["x"], type: "format", name: "DirectX Model", bin: true },
                { ext: ["ms3d"], type: "format", name: "MilkShape 3D Model", bin: true },
                { ext: ["nif"], type: "format", name: "Gamebryo Model Format", bin: true },
                { ext: ["mdl"], type: "format", name: "3D Model", bin: true },
                { ext: ["wrl"], type: "format", name: "VRML World", bin: true },
                { ext: ["fac"], type: "format", name: "Autodesk Face", bin: true },
                { ext: ["xsi"], type: "format", name: "Softimage XSI", bin: true },
                { ext: ["pov"], type: "format", name: "POV-Ray File", bin: true },
                { ext: ["sldprt"], type: "format", name: "SolidWorks Part", bin: true },
                { ext: ["sldasm"], type: "format", name: "SolidWorks Assembly", bin: true },
                { ext: ["slddrw"], type: "format", name: "SolidWorks Drawing", bin: true },
                { ext: ["prt"], type: "format", name: "Creo Parametric Part", bin: true },
                { ext: ["asm"], type: "format", name: "Creo Parametric Assembly", bin: true },
                { ext: ["nds"], type: "format", name: "Nintendo DS ROM", bin: true },
                { ext: ["z64"], type: "format", name: "Nintendo 64 ROM", bin: true },
                { ext: ["n64"], type: "format", name: "Nintendo 64 ROM image (V64)", bin: true },
                { ext: ["pcx"], type: "format", name: "PiCture eXchange", bin: true },
                { ext: ["wbfs"], type: "format", name: "Wii Backup File System", bin: true },
                { ext: ["si"], type: "format", name: "Interleaf File", bin: true },
                { ext: ["wdb"], type: "format", name: "World DataBase", bin: true },
                { ext: ["asp"], type: "format", name: "Active Server Pages", bin: false },
                // Coktel Vision formats:
                { ext: ["vmd"], type: "format", name: "Video and Media Data", bin: true },
                { ext: ["mesh"], type: "format", name: "3D Collide Data", bin: true },
                { ext: ["tot"], type: "format", name: "Script file", bin: true },
                { ext: ["ext"], type: "format", name: "Script resource file", bin: true },
                { ext: ["ide"], type: "format", name: "Script function name offset", bin: true },
                { ext: ["stk", "itk", "jtk", "ltk"], type: "format", name: "STK1.0", bin: true },
                { ext: ["var"], type: "format", name: "Variable file", bin: true },
                { ext: ["cmp"], type: "format", name: "Sprite file", bin: true },
                { ext: ["tts"], type: "format", name: "Text to Speech file", bin: false },
                { ext: ["pag"], type: "format", name: "Update file", bin: false },
                { ext: ["bcd"], type: "format", name: "BCD (Information for new Application)", bin: false },
                { ext: ["bcd1"], type: "format", name: "BCD (Information for Environment)", bin: false },
                { ext: ["cd1"], type: "format", name: "CD1 (Setup Information)", bin: false },
                { ext: ["rxy"], type: "format", name: "Relative Sprite Coordinates", bin: true },
                { ext: ["fra"], type: "format", name: "French text (Francais)", bin: true },
                { ext: ["all"], type: "format", name: "German text (Allemand)", bin: true },
                { ext: ["ang"], type: "format", name: "English text (Anglais)", bin: true },
                { ext: ["esp"], type: "format", name: "Spanish text (Espagnol)", bin: true },
                { ext: ["ita"], type: "format", name: "Italian text", bin: true },
                { ext: ["fnt", "let"], type: "format", name: "Font", bin: true },
                { ext: ["snd"], type: "format", name: "Sound file", bin: true },
                { ext: ["ani"], type: "format", name: "Animation file", bin: true },
                { ext: ["dec"], type: "format", name: "Decal (Background) file", bin: true },
                { ext: ["tbr"], type: "format", name: "Instrument parameters", bin: true },
                { ext: ["mdy"], type: "format", name: "Music score", bin: true },
                { ext: ["err"], type: "format", name: "Error File", bin: false },
                { ext: ["adi"], type: "format", name: "Debug (Adi) File", bin: true },
                { ext: ["bou"], type: "format", name: "Debug (Adibou) File", bin: true },
                { ext: ["pla"], type: "format", name: "Debug (Playtoons) File", bin: true },
                { ext: ["ask"], type: "format", name: "Installation help", bin: false },
                { ext: ["dag"], type: "format", name: "Dialog Text", bin: true },
                { ext: ["seq"], type: "format", name: "Animation Sequence", bin: true },
                { ext: ["scn"], type: "format", name: "Scene File", bin: false },
                { ext: ["rec"], type: "format", name: "Record File", bin: true },
                { ext: ["gam"], type: "format", name: "Savegame File", bin: true },
                { ext: ["lvl"], type: "format", name: "Level File", bin: true },
                { ext: ["stb"], type: "format", name: "STB (OGG)", bin: true },
                { ext: ["adbx"], type: "format", name: "AdibouX", bin: true },
                { ext: ["sav"], type: "format", name: "Save", bin: true },
                // Generic formats:
                { ext: ["flx", "flc"], type: "format", name: "FLIC", bin: true },
                { ext: ["md"], type: "format", name: "Markdown", bin: false },
                { ext: ["map"], type: "format", name: "Mapfile", bin: false },
                { ext: ["def"], type: "format", name: "Definition file", bin: false },
                { ext: ["dbt"], type: "format", name: "Database Text File", bin: true },
                { ext: ["cfg"], type: "format", name: "Config File", bin: true },
                { ext: ["inf"], type: "format", name: "INF file (setup Information file)", bin: true },
                { ext: ["icns"], type: "format", name: "Apple Icon Image format", bin: true },
                { ext: ["mdx"], type: "format", name: "Multidimensional Expressions", bin: true },
                { ext: ["qdat"], type: "format", name: "QuickTime data", bin: true },
                { ext: ["pup"], type: "format", name: "Playstation Update Package", bin: true },
                { ext: ["mps"], type: "format", name: "Mathematical Programming System", bin: true },
                { ext: ["gzf"], type: "format", name: "Ghidra Zip File", bin: true },
                { ext: ["cue"], type: "format", name: "CUE sheet", bin: false },
                { ext: ["cat"], type: "format", name: "Windows Cabinet File", bin: true },
                { ext: ["sdb"], type: "format", name: "Shim Database", bin: true },
                { ext: ["mof"], type: "format", name: "Managed Object Format", bin: false },
                { ext: ["nls"], type: "format", name: "National Language Support", bin: true },
                { ext: ["sse"], type: "format", name: "Streaming SIMD Extensions", bin: true },
                { ext: ["res"], type: "format", name: "Resource file", bin: true },
                { ext: ["md5"], type: "format", name: "MD5 Checksum", bin: false },
                { ext: ["db"], type: "format", name: "Database", bin: true },
                { ext: ["xa"], type: "audio", name: "XA", bin: true },
                { ext: ["torrent"], type: "format", name: "Torrent", bin: true },
                { ext: ["bms"], type: "format", name: "QuickBMS", bin: false },
                { ext: ["gbc"], type: "format", name: "GameBoy Color ROM", bin: true },
                { ext: ["tsv"], type: "format", name: "Tab-Separated Values", bin: false },
                { ext: ["st"], type: "format", name: "ST Disk Image", bin: true },
                { ext: ["str"], type: "format", name: "Streaming Data Movie", bin: true },
                { ext: ["rpt"], type: "format", name: "Report file", bin: false },
                { ext: ["iss"], type: "format", name: "Inno Setup Script", bin: false },
                { ext: ["plist"], type: "format", name: "Property List", bin: false },
                { ext: ["vcd"], type: "format", name: "Value change dump", bin: false },
                { ext: ["gitignore"], type: "format", name: "Git ignore file", bin: false },
                // ScummVM formats:
                { ext: ["gob"], type: "format", name: "Config file (extract_gob_stk)", bin: false },
                // Director formats:
                { ext: ["dxr"], type: "format", name: "Protected Director Movie", bin: true },
                { ext: ["cxt"], type: "format", name: "Adobe Director Protected Cast file", bin: true },
                { ext: ["dcr"], type: "format", name: "Published Shockwave Movie", bin: true },
                { ext: ["cct"], type: "format", name: "Published Shockwave Cast", bin: true },
                { ext: ["cst"], type: "format", name: "Cast file", bin: true },
                { ext: ["xobj"], type: "format", name: "XObjects", bin: true },
                // 3DS formats:
                { ext: ["cia"], type: "format", name: "CTR Importable Archive", bin: true },
                // Amiga formats:
                { ext: ["adf"], type: "format", name: "Amiga Disk File", bin: true },
            ];

        for (var i = 0; i < extensionsDb.length; i++) {
            var extGroup = extensionsDb[i].ext;
            for (var j = 0; j < extGroup.length; j++) {
                if (extGroup[j] === currentFileExtension && extensionsDb[i].bin === isBinaryFile) {
                    if (_getNumberOfResults(extensionsDb[i]) < 1) {
                        _setResult("~" + extensionsDb[i].type, extensionsDb[i].name, String(), "by extension");
                    }
                    return null;
                }
            }
        }
    }
}

================================================
FILE: db/Binary/__MiniJavaScriptHeuristic_By_DosX.7.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function detect() { main(); }

function main() {
    if (Binary.isHeuristicScan()) {
        switch (Binary.getFileSuffix().toLowerCase()) {
            case "js": // JavaScript
            case "jse": // JScript Encoded
            case "jsc": // JavaScript Compiled
            case "sg": // Detect It Easy module
                var options = String();

                if (!Binary.isPlainText()) {
                    options = "bytecode";
                } else {
                    if (Binary.getSize() > 3000) {
                        var scriptContent = Binary.getString(0x00, Binary.getSize());

                        // Split the code into segments that are outside of string literals.
                        // Handle escaping (\", \\', \`) — escaped quotes are not treated as string delimiters.
                        // Also include expressions inside template literals `${...}` as code (they will be scanned).
                        var segments = [],
                            currentSegment = String(),
                            insideString = false,
                            stringDelimiter = String(),
                            isEscaped = false;

                        for (var i = 0; i < scriptContent.length; i++) {
                            var currChar = scriptContent[i];

                            if (insideString) {
                                if (isEscaped) {
                                    isEscaped = false;
                                    continue;
                                }
                                if (currChar === '\\') {
                                    isEscaped = true;
                                    continue;
                                }

                                // For template literals: when encountering `${` include nested expression into current segment
                                if (stringDelimiter === '`' && currChar === '$' && i + 1 < scriptContent.length && scriptContent[i + 1] === '{') {
                                    // skip '{' and start accumulating the expression content
                                    i++; // now scriptContent[i] === '{'
                                    var braceDepth = 1;
                                    // Inside the expression, handle escaping as well
                                    while (i + 1 < scriptContent.length && braceDepth > 0) {
                                        i++;
                                        var innerChar = scriptContent[i];
                                        if (innerChar === '\\') {
                                            // capture escaped char and the next one
                                            currentSegment += innerChar;
                                            if (i + 1 < scriptContent.length) {
                                                i++; currentSegment += scriptContent[i];
                                            }
                                            continue;
                                        }
                                        if (innerChar === '{') { braceDepth++; currentSegment += innerChar; continue; }
                                        if (innerChar === '}') { braceDepth--; if (braceDepth === 0) break; currentSegment += innerChar; continue; }
                                        currentSegment += innerChar;
                                    }
                                    continue;
                                }

                                if (currChar === stringDelimiter) {
                                    insideString = false;
                                    stringDelimiter = String();
                                }
                                // do not copy characters that are inside strings
                            } else {
                                // not inside a string
                                if (currChar === '"' || currChar === "'" || currChar === '`') {
                                    // start of string — finish current segment
                                    if (currentSegment.length > 0) { segments.push(currentSegment); currentSegment = String(); }
                                    insideString = true;
                                    stringDelimiter = currChar;
                                } else {
                                    currentSegment += currChar;
                                }
                            }
                        }

                        if (currentSegment.length > 0) segments.push(currentSegment);

                        for (var segIndex = 0; segIndex < segments.length; segIndex++) {
                            var tokenToProcess = segments[segIndex];
                            if (!/(  |\t)/.test(tokenToProcess) && (
                                /(((var|let|const)[\t ]|\())\b[a-zA-Z](?:,[a-zA-Z]){3,}\b/.test(tokenToProcess) ||
                                /[a-zA-Z][!=]?=?=![01][;,})]/.test(tokenToProcess)
                            )) {
                                options = "minified/compiled";
                                break;
                            }
                        }
                    }
                }

                _setResult("~language", "JavaScript", String(), Binary.isVerbose() ? options : String());

                break;
        }
    }
}

================================================
FILE: db/Binary/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = Binary;
var X = Binary;

includeScript("read");

================================================
FILE: db/Binary/archive.ACE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("ACE");

function detect() {
    detect_ACE(1);

    return result();
}

================================================
FILE: db/Binary/archive.ARJ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

includeScript("arj");

function detect() {
    detect_ARJ(1);

    return result();
}


================================================
FILE: db/Binary/archive.DEFLATE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Authors:
// LinXP
// Kaens (TG@kaens)

meta("archive");

function checkDeflate(start) {
    var br = new BitReader(start),
        tight = 0,
        maxf = Math.min(X.Sz(), 0x100);
    do {
        var f = br.read(1), bt = br.read(2);
        //_log("@"+br.offset+"^"+br.n+" blockType:"+bt+(f?" (final)":""));
        var code = 0,
            _t = [];
        if (!bt) { // copy stored block data
            br.init(start);
            var len = br.read(8);
            len |= br.read(8) << 8;
            var nlen = br.read(8);
            nlen |= br.read(8) << 8;
            if (len != (nlen ^ 0xFFFF)) return 0;
            br.consume(len); // br.meta(br.offset);
            //_log("  len="+len+"="+Hex(len)+"  br.ofs="+Hex(br.offset))
            if (br.offset > X.Sz()) return false;
            if (f) tight = 1
        } else if (bt == 1 || bt == 2) {
            if (bt == 1) { // fixed block
                //for(i=0; i < 24; i++) {}
                tight = 1;
            } else { //dynamic block
                var hlit = br.read(5) + 257;
                if (hlit > 286) return false;
                var hdist = br.read(5) + 1,
                    hclen = br.read(4) + 4;
                //_log("hlit:"+hlit+" hdist:"+hdist+" hclen:"+hclen)
                var lent = [];
                const lentord = [16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15];
                for (i = 0; i < hclen && br.offset < maxf; i++)
                    lent[lentord[i]] = br.read(3);
                _t = createOrderlyHuffmanTable(lent, 19, br);
                if (!_t) return false;
                //_log("after creating a table @"+br.offset+"/"+br.n)
                i = 0;
                while (i < hlit + hdist) {
                    //bitLengthDecoder.decode:
                    if (!_t.length) return false;
                    j = 0;
                    while (_t[j][0] || _t[j][1]) { j = br.read(1) ? _t[j][1] : _t[j][0]; if (!j) return false }
                    //_log("@"+br.offset+"^"+br.n+" code = "+_t[j][2])
                    if (_t[j][2] < 16) { /*auto insert's relevant part*/
                        if (i >= hlit + hdist) return false;
                        i++
                    } else switch (_t[j][2]) { /* beautify preserve:start */
                        case 16: if (i) br.read(2); else return false; break;
                        case 17: for (t = br.read(3) + 3; t; t--); break;
                        case 18: for (t = br.read(7) + 11; t; t--); break;
                        default: return false;
                    } /* beautify preserve:end */
                    if (br.offset > X.Sz()) return false;
                }
                tight = 2;
                f = true
            }
        } else return false; //block type 3 is out
        //if(!X.isDeepScan() && br.ofs() >= maxf) f = true; //to avoid slowing it down with, well, unpacking
    } while (!f);
    if (tight == 1) {
        if (br.offset >= X.Sz()) return false;
        //for(;;) { //TODO
        //    if()
        //}
    }
    return tight
}

function checkZlib(p) {
    if (p + 6 > X.Sz()) return false;
    var c = X.U8(p++);
    if ((c & 0xF) != 8 || (c & 0xF0) > 0x70) return false;
    var start = 2,
        f = X.U8(p++);
    if (f & 0x20) {
        if (p + 8 < X.Sz()) return false;
        start += 4
    }
    if (((c << 8) | f) % 31) return false;
    //_log("zlib, data begins @"+Hex(start))
    if (!checkDeflate(start)) return false;
    cmprlvl = ["fastest", "fast", "default", "max"][f >> 6];
    return true
}

function detect() {
    bad = "";
    if (X.Sz() >= 10 && X.c("1FA1") && checkDeflate(2)) {
        sName = "Gzip hack: Quasijarus Strong Compression (Z.)";
        bDetected = true;
    }
    if (!bDetected && X.c("1F8B")) { //gzip
        method = X.U8(2);
        switch (method) { /* beautify preserve:start */
            case 0: sVersion = "store"; bad = bad.addIfNone("!badalgo"); break;
            case 1: sVersion = "compress"; bad = bad.addIfNone("!badalgo"); break;
            case 2: sVersion = "pack"; bad = bad.addIfNone("!badalgo"); break;
            case 3: sVersion = "lz"; bad = bad.addIfNone("!badalgo"); break;
            case 8: sVersion = "deflate"; break; //the only format gzip won't throw an error about
            default: return false;
        }
        f = X.U8(3);
        fs = [];
        if (f & 1) fs.push("ASCII_FLAG");
        if (f & 2) fs.push("HEADER_CRC");
        if (f & 4) fs.push("EXTRA_FIELD");
        if (f & 8) fs.push("ORIG_NAME");
        if (f & 0x10) fs.push("COMMENT");
        if (f & 0x20) fs.push("ENCRYPTED");
        if (f & 0xC0) fs.push("RESERVED");
        ts = X.I32(5, _LE);
        if (ts <= 0) return false;
        if (X.isVerbose()) {
            switch (X.U8(8)) { //not really meaningful
                case 2: sOption("best"); break;
                case 4: sOption("fast");
            }
            switch (X.U8(9)) {
                case 0: s = "FAT FS (MS-DOS, OS/2, NT/Win32"; break;
                case 1: s = "Amiga"; break;
                case 2: s = "(Open)VMS"; break;
                case 3: s = "Unix"; break;
                case 4: s = "VM/CMS"; break;
                case 5: s = "Atari TOS"; break;
                case 6: s = "HPFS (OS/2, NT)"; break;
                case 7: s = "Macintosh"; break;
                case 8: s = "Z-System"; break;
                case 9: s = "CP/M"; break;
                case 10: s = "TOPS-20"; break;
                case 11: s = "NTFS (NT)"; break;
                case 12: s = "QDOS"; break;
                case 13: s = "Acorn RISCOS"; break;
                case 255: s = "unknown OS"; break;
                default: s = "?"
            } /* beautify preserve:end */
            sOption(s, "OS code:");
        }
        p = 10;
        if (f & 4) p += 4 + X.U16(p + 2, _LE);
        if (f & 8) {
            s = X.SA(p, 1024);
            p += s.length + 1;
            if (X.isVerbose()) sOption(s, 'filename:"', '"');
        }
        if (f & 0x10) {
            s = X.SA(p, 1024);
            p += s.length + 1;
            if (X.isVerbose()) sOptionT(s, "cmt:");
        }
        if (f & 0x2) p += 2;
        if (checkDeflate(p)) {
            sName = "GZIP (.gz)";
            bDetected = true;
            if (X.isVerbose()) sOption(X.U32(X.Sz() - 4, _LE), "unp.sz:")
        } else if (X.isHeuristicScan()) {
            sName = "GZIP (.gz)";
            bDetected = true
        }
    }
    if (!bDetected && X.isDeepScan() && X.isHeuristicScan() && X.calculateEntropy(0x40, 0x100) > 7) {
        for (s = 1; s < 0x40 && !bDetected; s++) {
            if (!bDetected && checkZlib(s)) {
                sName = "Zlib stream (.zlib)";
                sOption("@" + Hex(s));
                sOption(cmprlvl, "lv:");
                bDetected = true
            }
            if (!bDetected && checkDeflate(s) > 1) {
                sName = "Raw Deflate stream";
                sOptions = "@" + Hex(s);
                bDetected = true
            }
        }
    }
    return result();
}


================================================
FILE: db/Binary/archive.LZ4.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

// https://github.com/inikep/lizard/blob/lizard/doc/lizard_Frame_format.md
meta("archive");

function detect() {
    if (Binary.getSize() >= 9) {
        bDetected = true;
        switch (Binary.read_uint32(0x00, _BE)) {
            case 0x02214C18: sName = "LZ4 compressed data, legacy (.LZ4)"; break;
            case 0x04224D18: sName = "LZ4 compressed data (.LZ4)"; break;
            case 0x05224D18: sName = "LZ5 compressed data (.LZ5)"; break;
            case 0x06224D18: sName = "Lizard compressed data (.LIZ)"; break;
            default: bDetected = false;
        }

        if (bDetected) {
            var bFlags = Binary.read_uint8(0x04);
            if (bFlags & 64) { sVersion = "1.0"; }
            if (bFlags & 128) { sVersion = "2.0"; }
            if (bFlags & 64 && bFlags & 128) { sVersion = "3.0"; }
            if (Binary.isVerbose()) {
                if (bFlags & 1) { sOption("PresetDictionary"); }
                if (bFlags & 4) { sOption("ContentChecksum"); }
                if (bFlags & 8) { sOption("ContentSize"); }
                if (bFlags & 16) { sOption("BlockChecksum"); }
                if (bFlags & 32) { sOption("BlockIndependence"); }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive.MS_Compound.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("archive", "Microsoft Compound");

function detect() {
    if (Binary.compare("D0CF11E0A1B11AE1")) {
        const // magic values
            nSub1 = Binary.readWord(0x200),
            nSub2 = Binary.readWord(0x1000);

        if (nSub1 == 0 && nSub2 == 0xFFFD) {
            sType = "installer";
            sName = "Microsoft Installer (MSI)";
        } else if (nSub1 == 0xA5EC) {
            sType = "format";
            sName = "Microsoft Office";
            sVersion = "1997-2003";
        } else {
            sVersion = "Office, 1997-2003";
        }

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/archive.PC_Secure.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("archive", "PC Secure");

function detect() {
    if (Binary.compare("'PCT7'22") || Binary.compare("'PCT'..20284b")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive.RAR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

includeScript("rar-file");

function detect() {
    detect_RAR(1);

    return result();
}


================================================
FILE: db/Binary/archive.ZIP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("zip-file");

function detect() {
    detect_Zip(1);

    return result();
}

================================================
FILE: db/Binary/archive.ZLIB.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("data");
includeScript("zlib");

function detect() {
    if (detect_zlib(Binary, 0)) {
        sName = "ZLIB data";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_7z.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("archive", "7-Zip");

function detect() {
    if (Binary.getSize() >= 64) {
        if (Binary.compare("'7z'BCAF271C")) {
            sVersion = Binary.readByte(6) + "." + Binary.readByte(7);
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/archive_ANC-Cruncher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("archive", "ANC-Cruncher");

function detect() {
    if (Binary.compare("'FVL0'")) {
        sOptions = "use ANC-Cruncher's CRLoad for unpack and run";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_AR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP
// doc-ref: https://en.wikipedia.org/wiki/Ar_(Unix)
includeScript("archive-file");
meta("archive", "The archiver (.AR)");

function detect() {

    function ParseLibInfo() {
        sType = "format";
        sName = "COFF Library (.LIB)";

        var nMachineOffset = Binary.read_uint32(0x48, _BE) + 0x3C,
            nMachine;

        if (Binary.compare("0000FFFF", nMachineOffset)) {
            nMachine = Binary.read_uint16(nMachineOffset + 6);
        } // long format
        else {
            nMachine = Binary.read_uint16(nMachineOffset)
        } // short format
        switch (nMachine) {
            case 0x014c: sVersion = "I386"; break; // Intel 386 or later processors and compatible processors
            case 0x0162: sVersion = "R3000"; break; // MIPS little-endian, 0x160 big-endian
            case 0x01c0: sVersion = "ARM"; break; // ARM little-endian
            case 0x8664: sVersion = "AMD64"; break; // x64
            case 0xAA64: sVersion = "ARM64"; break; // ARM64 little-endian
            case 0x01c4: sVersion = "ARMNT"; break; // Arm Thumb-2 little-endian
            default: sVersion = "Unknown";
        }
    }

    if (Binary.compare("'!<arch>'0A")) {
        bDetected = true;
        var nOffset = 8;
        var nItemCount = 0;

        while (nOffset < Binary.getSize()) {
            sFileName = Binary.getString(nOffset, 0x10).trim();
            nOffset += 0x10;
            nOffset += 0x0C; // modification_timestamp
            nOffset += 0x06; // ownerID
            nOffset += 0x06; // groupID
            nOffset += 0x08; // fileMode
            nFileSize = parseInt(Binary.getString(nOffset, 0x0A));
            nOffset += 0x0A;
            nOffset += 0x02; // endMarker
            switch (sFileName) {
                case "/": ParseLibInfo(); break;
                case "debian-binary": ParseDebInfo(); break;
                case "/\/": break;
                default: Archive.add(nFileSize, nFileSize);
            }
            nOffset += nFileSize;
            if (nFileSize & 1) nOffset += 1; // padding
            nItemCount += 1;
        }

        if (Binary.isVerbose()) sOption(Archive.contents()); // TODO: parse DIR\FILES
    }

    function ParseDebInfo() {
        sName = "Debian Software package (.DEB)";
        sVersion = Binary.getString(nOffset, nFileSize - 1);
    }

    return result();
}

================================================
FILE: db/Binary/archive_ARC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("archive", "FreeARC Archive (.ARC)");

function detect() {
    if (Binary.getSize() >= 9) {

        if (Binary.compare("417243010000")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_ASAR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.mend.io/blog/theres-a-new-stealer-variant-in-town-and-its-using-electron-to-stay-fully-undetected/
meta("archive", "Asar Archive (Electron)");

function detect() {
    if (Binary.getSize() >= 28) {
        if (Binary.compare("04..............................'{\"files\":{'")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/archive_BCSAR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

// https://www.3dbrew.org/wiki/BCSAR
meta("archive", "Nintendo Binary CTR Sound ARchive (.BCSAR)");

function detect() {
    if ((!X.c("'CSAR'FE") && !X.c("'CSAR'FF")) || X.U8(5) == X.U8(6) || X.U8(5) < 0xFE) return;
    var e = X.U8(5) == 0xFE ? _LE : _BE;
    if (X.U32(0x14, e) != 0x2000 || X.U32(0x20, e) != 0x2001 || X.U32(0x2C, e) != 0x2002) return;
    if (!X.c("'STRG'", sp = X.U32(0x18, e)) || !X.c("'INFO'", ip = X.U32(0x24, e)) || !X.c("'FILE'", fp = X.U32(0x30, e))) return;

    bDetected = true;

    sVersion = 'v' + X.U32(8, e).toString(16) + '_' + (e == _LE ? 'le' : 'be');

    if (X.isVerbose()) {
        sOption('filenames:' + X.U32(sp + 0x18, e) + ' sz:' + outSz(X.U32(0xC, e)));
    }

    return result();
}

================================================
FILE: db/Binary/archive_BZip.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// doc-ref: https://github.com/dsnet/compress/blob/master/doc/bzip2-format.pdf

meta("archive", "BZip");

function detect() {
    if (Binary.getSize() >= 9) {
        if (Binary.compare("'BZ0'")) {
            sVersion = "1.0";
            sOptions = "compressed data (.BZ)";
            bDetected = true;
        } else if (Binary.compare("'BZh'") && Binary.compare("314159265359", 0x4)) {
            sName = "BZip2 compressed data (.BZ2)"
            bDetected = true;
        }
        if (bDetected && Binary.isVerbose()) {
            sOptions = "block-size:" + Binary.getString(3, 1) + "00 kb";
        }
    }

    return result();
}


================================================
FILE: db/Binary/archive_CCA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Engines/CNCSA
meta("archive", "Click & Create Archive (.CCA)");

function detect() {
    if (Binary.compare("'PAME'0702")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_CFL3.1.sg
================================================
// https://github.com/horsicq/Detect-It-Easy signature file
// Author: Kaens (TG @kaens)
/* beautify ignore:start */

meta("archive", "Jari Comppa's Compressed File Library 3 file (.CFL)");

function detect() {
    //ref https://solhsa.com/zip/cfl3r3.zip / src/CFL.cpp & CFLResource.cpp
    var startp = t = 0;
    if (!X.c("'CFL3"))
        if (X.c("'3CFL'", X.Sz() - 4))
            if (X.c("'CFL3'", t = X.Sz() - X.U32(X.Sz() - 8))) startp = t;
            else return false;
    var p = X.U32(startp + 4); p += 12 + X.U32(p + 4); if (!X.c("'3CFL'", p)) return false;

    bDetected = true;
    if (X.isVerbose()) {
        if (startp) sOption('begins @' + Hex(startp));
        sOption(outSz(p + 4 - startp), 'sz:')
    }

    return result();
}
/* beautify ignore:end */

================================================
FILE: db/Binary/archive_CKP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// https://www.mobygames.com/game/60768/adiboo-pazirals-secret/ Used by Adiboo & Paziral's Secret (2002/2003)

meta("archive", "CKP");

function detect() {
    if (Binary.compare("'.CKP'0001")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_Cab.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("cab");

meta("archive", "CAB");

function detect() {
    if (!detect_Cab(0, Binary.getSize())) {
        if (Binary.compare("'ISc('")) {
            sName = "InstallShield Cabinet File";
            var nVer = Binary.readWord(4);
            switch (Binary.readByte(7)) {
                case 1:
                    sVersion = (nVer >> 12) & 15;
                    break;
                case 2:
                case 4:
                    sVersion = (nVer / 100).toFixed(2);
                    break;
            }
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_DAA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by PowerISO

// https://github.com/horsicq/Detect-It-Easy/issues/45
// https://isc.sans.edu/diary/The+DAA+File+Format/25246
meta("archive", "Direct Access Archive (.DAA)");

function detect() {
    if (Binary.compare("'DAA'0000000000000000000000004C")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_DCP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Wintermute Engine

// https://wiki.scummvm.org/index.php/Wintermute
meta("archive", "DCP");

function detect() {
    if (Binary.compare("DE AD C0 DE 4A 55 4E 4B")) {
        var copyrightYear = Binary.getString(58, 5).trim();

        if (/^[12]\d{3}$/.test(copyrightYear)) {
            sVersion = copyrightYear;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_DXA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// TODO: Add un-xored variant to this signature
// https://github.com/yumetodo/DxLib/blob/master/source/DxArchive_.h
// https://himeworks.com/tools/dxextract/
meta("archive", "DXA");

function detect() {
    if (Binary.compare("f70ee9a")) {
        sOptions = "Arcanum Knights";
        sVersion = "xored";
        bDetected = true;
    } else if (Binary.compare("e94c..69")) {
        sOptions = "Labyrinth of Touhou 2";
        sVersion = "xored";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_DatPack.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=List_of_games_embedded_in_Adi_4
meta("archive", "DatPack");

function detect() {
    if (Binary.compare("07'DatPack'f75b3500e701")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_DotBundle.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("archive", "DotBundle Project");

function detect() {
    if (Binary.compare("3C70726F6A6563743E0D0A20203C6D61696E65786520706174683D")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/archive_EdgeDataPak.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// https://www.mobygames.com/game/138556/the-energy-thieves/ Used by Adiboo & The Energy Thieves (2004)
// Header of EdgeDataPak (2004) is based on CKP's (2002/2003) format

meta("archive", "EdgeDataPak (.EDP)");

function detect() {
    if (Binary.compare("'.EDP'0001")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_Flatpak.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://flatpak.org/
meta("archive", "Flatpak");

function detect() {
    if (Binary.compare("66 6C 61 74 70 61 6B")) {
        var versionNumber = Binary.getString(24, 33).trim();

        if (/^[a-zA-Z0-9\/._-]{33}/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_GhidraZipFile.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/NationalSecurityAgency/ghidra
meta("archive", "Ghidra Zip File");

function detect() {
    if (Binary.compare("aced000577..2e30212634e92c200000000100")) {
        sOptions = File.cleanString(Binary.getString(0x00000014));
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_GodotPCK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/GDRETools/gdsdecomp/blob/master/utility/pck_creator.cpp
meta("archive", "Godot Pack");

function detect() {
    if (Binary.compare("'GDPC'0100000003000000..000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_HIP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by EvilEngine games

// https://heavyironmodding.org/wiki/EvilEngine/HIP_(File_Format)
meta("archive", "HIP archive");

function detect() {
    if (Binary.compare("'HIPA'00000000'PACK'00000090")) {
        sVersion = Binary.getString(0x58);

        if (sVersion.match(/^[A-Za-z]{3}\s[A-Za-z]{3}\s\d{1,2}\s\d{2}:\d{2}:\d{2}\s\d{4}$/)) {
            sVersion = "Build date: " + sVersion;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_IFP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Grand Theft Auto San Andreas

// https://gtamods.com/wiki/IFP
meta("archive", "Animation file");

function detect() {
    if (Binary.compare("'ANP3'")) {
        var versionNumber = Binary.getString(3, 1).trim();

        if (/^[0-9]{1}/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_IPW.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.mobygames.com/game/8818/island-peril/
meta("archive", "Peril WAD");

function detect() {
    if (Binary.compare("'DT1'00c3030000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_InnoSetup.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/YenForYang/innounp/blob/master/Struct5205u.pas
meta("archive", "Inno Setup");

function detect() {
    if (Binary.compare("'idska32'1a")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_JAM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Lego Racers

// https://github.com/JrMasterModelBuilder/JAM-Extractor
meta("archive", "JAM");

function detect() {
    bDetected = Binary.compare("'LJAM'0000000002000000");

    return result();
}

================================================
FILE: db/Binary/archive_LAB.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://gist.github.com/Gemba/c793590c32a6c121445fa14ed361e51d
meta("archive", "LucasArts Binary Archive");

function detect() {
    if (Binary.compare("'LABN'00000100")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_LRZ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("archive", "Long Range ZIP (.LRZ)");

function detect() {
    if (Binary.getSize() >= 9) {
        if (Binary.compare("'LRZI'")) {
            bDetected = true;
            sVersion = Binary.read_uint8(0x04) + "." + Binary.read_uint8(0x05);

            switch (Binary.read_uint8(0x31)) {
                case 3: break;
                case 4: sOption("BZIP2"); break;
                case 5: sOption("LZO"); break;
                case 6: sOption("LZMA"); break;
                case 7: sOption("GZIP"); break;
                case 8: sOption("ZPAQ"); break;
                default: bDetected = false;
            }
            switch (Binary.read_uint8(0x16)) {
                case 0: break;
                case 1: sOption("encrypted"); break;
                default: bDetected = false;
            }
            switch (Binary.read_uint8(0x15)) {
                case 0: break;
                case 1: sOption("md5"); break;
                default: bDetected = false;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_LZOP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://en.wikipedia.org/wiki/Lzop

meta("archive", "LZOP compressed data");

function detect() {
    if (Binary.getSize() >= 9) {
        bDetected = Binary.compare("89'LZO'000D0A1A0A");
    }

    return result();
}

================================================
FILE: db/Binary/archive_MCS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://thedustedarchives.com/de/monsterized-news/
meta("archive", "MCS");

function detect() {
    if (Binary.compare("'AHFFMACS0200'")) {
        var game = Binary.getString(15, 12).trim();

        if (/^[A-Z/!]{12}/.test(game)) {
            if (X.isVerbose()) sOptions = game;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_MS-WIM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Rewritten by BJNFNE

// https://github.com/libyal/assorted/blob/main/documentation/Windows%20Imaging%20%28WIM%29%20file%20format.asciidoc
meta("archive", "Windows Imaging Format (.WIM)");

function detect() {
    if (Binary.getSize() >= 9) {

        if (Binary.compare("'MSWIM'000000")) {
            if (Binary.isVerbose()) sOptions = "{" + Binary.read_UUID(0x18) + "}";
            bDetected = true;

            switch (Binary.read_uint16(0x12)) {
                case 0: sOption("No compression"); break;
                case 2: sOption("XPRESS compression"); break;
                case 4: sOption("LZX compression"); break;
                case 8: sOption("LZMS compression"); break;
                default: bDetected = false;
            }
            sOption("Part Number:" + Binary.read_uint16(0x28) + "/" + Binary.read_uint16(0x2A));

        } else if (Binary.compare("'WLPWM'000000")) { // https://wimlib.net/
            sName += ", wimlib";
            bDetected = true;
        }

    }

    return result();
}

================================================
FILE: db/Binary/archive_MWD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Frogger

// https://highwayfrogs.net/thread/40/frogger-file-information-megathread
meta("archive", "Medievil WAD");

function detect() {
    if (Binary.compare("44 41 57 4D")) {
        var creationDate = Binary.getString(24, 29).trim();

        if (/^[A-Z][a-z]+, \d{1,2}(?:st|nd|rd|th) [A-Z][a-z]+ \d{4}$/.test(creationDate)) {
            sOptions = "Creation date: " + creationDate;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_P2L.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Engines/PSM
meta("archive", "PSM Soundsystem (.P2L)");

function detect() {
    if (Binary.compare("'PSMLST PSM'")) {
        var versionNumber = Binary.getString(11, 4).trim();

        if (/^[0-9\.]{4}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_PAK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// PAK archive format is more generic, so extend this signature if required.
// http://justsolve.archiveteam.org/wiki/PAK
meta("archive", "PAK");

function detect() {
    if (Binary.compare("'DPAK'0000010018000000")) {
        sVersion = "Lego Creator";
        bDetected = true;
    } else if (Binary.compare("'PACK'7faf000080")) {
        bDetected = true;
    } else if (Binary.compare("'RWPACK'0000000080")) {
        sOptions = "PAK Compiler (Raymond Wilson 2008)"; // https://archive.gamedev.net/archive/reference/articles/article1991.html
        bDetected = true;
    } else if (Binary.compare("'MUDGE4'2e30")) { // https://www.ign.com/games/producer/witan
        sVersion = Binary.getString(8);
        var match = sVersion.match(/(\d{2})\/(\d{2})\/(\d{4}).*Copyright\s+(.+?)(?:\x00|$)/i);
        if (match) {
            sVersion = match[1] + "/" + match[2] + "/" + match[3] + ", " + match[4].trim();
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_PBP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.psdevwiki.com/ps3/PBP
meta("archive", "PlayStation Update Package");

function detect() {
    if (Binary.compare("00 50 42 50")) {
        var psf = Binary.getString(41, 3).trim();

        if (/^[A-Z]{3}/.test(psf)) {
            if (X.isVerbose()) sOptions = psf;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_PEA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://peazip.github.io/pea_help.pdf

meta("archive", "PeaZip (.PEA)");

function detect() {
    if (Binary.getSize() >= 10) {
        if (Binary.compare("EA") && Binary.compare("0000'POD'00", 0x0A)) {
            sVersion = "v" + Binary.read_uint8(0x01) + "." + Binary.read_uint8(0x02)
            bDetected = true;

            if (bDetected && Binary.isVerbose()) {
                switch (Binary.read_uint8(0x3)) {
                    case 0: sOption("NOALGO"); break;
                    case 1: sOption("ADLER32"); break;
                    case 2: sOption("CRC32"); break;
                    case 3: sOption("CRC64"); break;
                    case 16: sOption("MD5"); break;
                    case 17: sOption("RIPEMD160"); break;
                    case 18: sOption("SHA1"); break;
                    case 19: sOption("SHA256"); break;
                    case 20: sOption("SHA512"); break;
                    case 21: sOption("WHIRLPOOL"); break;
                    case 22: sOption("SHA3_256"); break;
                    case 23: sOption("SHA3_512"); break;
                    case 24: sOption("BLAKE2S"); break;
                    case 25: sOption("BLAKE2B"); break;
                    default:
                        bDetected = false;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_PKG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.psdevwiki.com/ps3/PKG_files
meta("archive", "System Software Update Packages");

function detect() {
    if (Binary.compare("7F 50 4B 47")) {
        var contentId = Binary.getString(48, 48).trim();

        if (/^[A-Z0-9]{6,7}-[A-Z0-9]{9}_00-[A-Z0-9]{16,18}$/.test(contentId)) {
            if (X.isVerbose()) sOptions = "ContentID: " + contentId;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_PSARC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.psdevwiki.com/ps3/PlayStation_archive_(PSARC)
meta("archive", "PSARC");

function detect() {
    if (Binary.compare("50534152000100037a6c6962")) {
        sVersion = "1.3";
        sOptions = "zlib";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_PUP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.psdevwiki.com/ps3/Playstation_Update_Package_(PUP)
meta("archive", "PlayStation Update Package");

function detect() {
    if (Binary.compare("'SCEUF'0000....000000")) {
        sVersion = "PS3/PS Vita";
        bDetected = true;
    } else if (Binary.compare("'SLB2'..0000000000....02")) {
        sVersion = "PS4/PS5";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_RVZ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/dolphin-emu/dolphin/blob/500728360cd177466f699962b441363cd1dd9ed7/docs/WiaAndRvz.md
meta("archive", "RVZ");

function detect() {
    if (Binary.compare("'RVZ'")) {
        var gameId = Binary.getString(88, 6).trim();

        if (/^[A-Z0-9]{6}$/.test(gameId)) {
            if (X.isVerbose()) sOptions = "GameID: " + gameId;
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/archive_STK.1.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev
// ---
// Samples by: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV7_Information#STK21_File_Structure
meta("archive", "STK");

function detect() {
    if (Binary.getSize() > 64 && Binary.compare("'STK2.' %%")) {
        var stkMagicSign = Binary.getString(6, 32).trim();

        if (/^[0-9]{10,}[A-Za-z0-9]{5,}/.test(stkMagicSign)) {
            if (X.isVerbose()) sOptions = "Magic signature: " + stkMagicSign;
            sVersion = Binary.getString(3, 3).trim();

            if (/^2\.[0-9]$/.test(sVersion)) {
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_Shaped.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.adventure-treff.de/spiele-datenbank/14049-iron-willy
meta("archive", "Shaped (.SHP)");

function detect() {
    if (Binary.compare("'Shaped'")) {
        var copyrightYear = Binary.getString(28, 4).trim();

        if (/^[12]\d{3}$/.test(copyrightYear)) {
            sOptions = copyrightYear;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_TRE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://modthegalaxy.com/index.php?threads/tre-explorer.11/
meta("archive", "TRE");

function detect() {
    if (Binary.compare("'EERT5000'....0000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_Unity.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("archive", "Unity");

function detect() {
    var nFileVer, sEngineVer, sMinPlayerVer
    if (Binary.getSize() >= 0x07) {
        if (Binary.compare("'UnityFS'00")) {
            sName += "/UnityFS";
            nFileVer = Binary.read_uint32(0x8, _BE);
            sEngineVer = Binary.getString(0x12);
            sMinPlayerVer = Binary.getString(0x0C);
            if (sEngineVer && sMinPlayerVer) {
                sVersion = sVersion.append("FileVer:" + nFileVer);
                sVersion = sVersion.append("EngineVer:" + sEngineVer);
                sVersion = sVersion.append("MinPlayerVer:" + sMinPlayerVer);
                bDetected = true;
            }
        } else if (Binary.compare("'UnityRaw'00")) {
            sName += "/UnityRaw";
            nFileVer = Binary.read_uint32(0x9, _BE);
            sEngineVer = Binary.getString(0x13);
            sMinPlayerVer = Binary.getString(0x0D);
            if (sEngineVer && sMinPlayerVer) {
                sVersion = sVersion.append("FileVer:" + nFileVer);
                sVersion = sVersion.append("EngineVer:" + sEngineVer);
                sVersion = sVersion.append("MinPlayerVer:" + sMinPlayerVer);
                bDetected = true;
            }
        } else if (Binary.compare("'UnityWeb'00")) {
            sName += "/UnityWeb";
            nFileVer = Binary.read_uint32(0x9, _BE);
            sEngineVer = Binary.getString(0x13);
            sMinPlayerVer = Binary.getString(0x0D);
            if (sEngineVer && sMinPlayerVer) {
                sVersion = sVersion.append("FileVer:" + nFileVer);
                sVersion = sVersion.append("EngineVer:" + sEngineVer);
                sVersion = sVersion.append("MinPlayerVer:" + sMinPlayerVer);
                bDetected = true;
            }
        } else if (Binary.read_uint32(0x10, _BE) == 0) {
            sName += "/Unity Asset";
            nFileVer = Binary.read_uint32(0x8, _BE);
            switch (nFileVer) {
                case 9:
                    sEngineVer = Binary.getString(0x14);
                    break;
                case 15:
                    sEngineVer = Binary.getString(0x14);
                    break;
                case 17:
                    sEngineVer = Binary.getString(0x14);
                    break;
                case 20:
                    sEngineVer = Binary.getString(0x14);
                    break;
                case 21:
                    sEngineVer = Binary.getString(0x14);
                    break;
                case 22:
                    sEngineVer = Binary.getString(0x30);
                    break;
            }
            if (sEngineVer && nFileVer <= 22 && nFileVer >= 8) {
                sVersion = sVersion.append("FileVer:" + nFileVer);
                sVersion = sVersion.append("EngineVer:" + sEngineVer);
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_UnrealEngine.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("archive", "UnrealEngine");

function detect() {
    if (Binary.getSize() >= 0x400) {
        if (Binary.compare("C1832A9E")) {
            bDetected = true;
            sName += "\\Unreal Package"
            var nVer = Binary.read_uint16(0x04);
            var nLicVer = Binary.read_uint16(0x06);
            sVersion = sVersion.append(nVer, nLicVer);

        } else if (Binary.compare("E1126F5A", Binary.getSize() - 204)) {
            bDetected = true;
            sName += "\\UE4 package (.PAK)"
            sVersion = Binary.read_uint32(Binary.getSize() - 200);
            switch (Binary.read_uint8(Binary.getSize() - 206)) {
                case 0:
                    break;
                case 1:
                    sOptions = sOptions.append("Index Is Encrypted");
                    break;
                default:
                    bDetected = false;
            }
            sOptions = sOptions.append(Binary.getString(Binary.getSize() - 160));

        }

    }

    return result();
}

================================================
FILE: db/Binary/archive_ViseInstaller.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Installer_VISE
meta("archive", "Vise Installer");

function detect() {
    if (Binary.compare("'ESIV'abbc19")) {
        sOptions = "Big endian";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_XZP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://digiex.net/threads/xzp-tool-v2-0-browse-edit-xbox-360-zxp-files.15990/
meta("archive", "XBox Zip File (.XZP)");

function detect() {
    if (Binary.compare("'BDES'00000001")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_ZPAQ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("archive", "ZPAQ Compressed Archive (.ZPAQ)");

function detect() {
    if (Binary.getSize() >= 9) {
        if (Binary.compare("'7kSt'") && Binary.compare("'zPQ'", 0x0D)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_archives.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: hypn0 <hypn0@mail.ru>, Kaens (TG@kaens), LinXP

meta("archive", "");

function detect() {
    if (Binary.compare("a596fdff")) {
        bDetected = true;
        sName = "FTCOMP";
    } else if (Binary.compare("a596..0a")) {
        bDetected = true;
        sName = "IBMPACK1";
    } else if (Binary.compare("a596feff")) {
        bDetected = true;
        sName = "IBMPACK2";
    } else if (Binary.compare("aced00057704")) {
        bDetected = true;
        sName = "IzPack";
    } else if (Binary.compare("'bvxn'")) {
        bDetected = true;
        sName = "LZFSE";
    } else if (Binary.compare("'SIT!'")) {
        bDetected = true;
        sName = "SIT";
    } else if (Binary.compare("06'SKF3.0'")) {
        bDetected = true;
        sName = "SKF";
    } else if (Binary.compare("'Archive'00................2800000064")) {
        bDetected = true;
        sName = "ArcFS";
    } else if (Binary.compare("'ARCV'0002")) {
        bDetected = true;
        sName = "ARCV 2";
    } else if (Binary.compare("09006bea")) {
        bDetected = true;
        sName = "BFF";
    } else if (Binary.compare("00069a") || Binary.compare("0006d2")) {
        bDetected = true;
        sName = "DCL";
    } else if (Binary.compare("....'-lh'..2d") || Binary.compare("....'-lz'..2d") || Binary.compare("....'-pm'..2d")) {
        sVersion = Binary.getString(2, 5)
        bDetected = true;
        switch (Binary.getString(3, 3)) {
            case "lh0":
            case "lh1":
            case "lh2":
            case "lh3":
            case "lh4":
            case "lh5":
            case "lh6":
            case "lh7":
            case "lhd":
                sName = "LHA (.LHA)";
                break;
            case "lh8":
            case "lh9":
            case "lha":
            case "lhb":
            case "lhc":
            case "lhe":
                sName = "LHA";
                sOptions = "Joe Jared ext (.LHA)";
                break;
            case "lhx":
                sName = "LHA";
                sOptions = "UNLHA32 ext (.LHA)"
                break;
            case "lzs":
            case "lz2":
            case "lz3":
            case "lz4":
            case "lz5":
            case "lz6":
            case "lz7":
            case "lz8":
                sName = "LHA ";
                sOptions = "LArc ext (.LZS)";
                break;
                case "lz7":
            case "pm0":
            case "pm2":
                sName = "LHA archive, PMarc ext (.PMA)";
                break;
            default:
                bDetected = false;
        }
    } else if (Binary.compare("'mflh'0100")) {
        bDetected = true;
        sName = "MVA";
    } else if (Binary.compare("'ViG'....1a")) {
        bDetected = true;
        sName = "PaperPort";
    } else if (Binary.compare("'sqsh'0000")) {
        bDetected = true;
        sName = "SquashFS";
        sOptions = "big endian";
    } else if (Binary.compare("'hsqs'0300")) {
        bDetected = true;
        sName = "SquashFS";
        sOptions = "little endian";
    } else if (Binary.compare("'im001V'......50....0000")) {
        sName = "SW";
        bDetected = true;
        var arch_offset = Binary.readByte(0x0e) + 15;
        if (Binary.compare("1f9d", arch_offset)) {
            sName = "Z";
        } else if (Binary.compare("1f1e", arch_offset)) {
            sName = "PACK 2";
        }
    } else if (Binary.compare("0001000401000100010000000000000000000000000000000000000000000000010101")) {
        bDetected = true;
        sName = "VMS SaveSet";
    } else if (Binary.compare("'ZOO'............'Archive'")) {
        bDetected = true;
        sName = "ZOO";
    } else if (Binary.compare("602213636c00")) {
        bDetected = true;
        sName = "Asymetrix";
    } else if (Binary.compare("453dcd28........................'Compressed ROMFS'")) {
        bDetected = true;
        sName = "CRAMFS";
    } else if (Binary.compare("'IsZ!@'01")) {
        bDetected = true;
        sName = "Zipped ISO Disk Image (.ISZ)";
        switch (Binary.read_uint32(0x10)) {
            case 0:
                sOptions = "no password";
                break;
            case 1:
                sOptions = "password";
                break;
            case 2:
                sOptions = "password, aes128";
                break;
            case 3:
                sOptions = "password, aes182";
                break;
            case 4:
                sOptions = "password, aes256";
                break;
        }
    } else if (Binary.compare("aa59f0000002")) {
        bDetected = true;
        sName = "SaveDskF";
    } else if (Binary.compare("'AlB'1a")) {
        bDetected = true;
        sName = "BeOS package";
    } else if (Binary.compare("'BIGF'00")) {
        bDetected = true;
        sName = "BIGF";
    } else if (Binary.compare("01ca'Copyright (c) Genus Microprogramming, Inc.'")) {
        bDetected = true;
        sName = "GXL";
    } else if (Binary.compare("0100......00ecf9")) {
        bDetected = true;
        sName = "INSA";
    } else if (Binary.compare("..0fd28ccc1f..3c0d8e830dd88f25ac")) {
        bDetected = true;
        sName = "InstallShield ISN";
    } else if (Binary.compare("135d658c3a010200")) {
        bDetected = true;
        sName = "InstallShield";
        sVersion = "3.x"
    } else if (Binary.compare("2aab79d800010000")) {
        bDetected = true;
        sName = "InstallShield INST";
        sVersion = "3.x"
    } else if (Binary.compare("'SZDD'88")) {
        bDetected = true;
        sName = "SZDD";
        sOptions = "by Microsoft";
    } else if (Binary.compare("'KWAJ'88")) {
        bDetected = true;
        sName = "KWAJ";
        sOptions = "by Microsoft";
    } else if (Binary.compare("'MDmd'")) {
        bDetected = true;
        sName = "MDCD";
    } else if (Binary.compare("'MPQ'1a")) {
        bDetected = true;
        sName = "MPQ";
        sOptions = "by Blizzard";
    } else if (Binary.compare("'_MCT'00'KSLZ'789c")) {
        bDetected = true;
        sName = "MSKN 2";
        sOptions = "zlib";
    } else if (Binary.compare("'PACK'............0000")) {
        bDetected = true;
        sName = "PACK";
    } else if (Binary.compare("'PACK'") && File.read_uint32(4, _BE) > 0 && File.read_uint32(4, _BE) <= 3) {
        bDetected = true;
        sName = "Packed git objects (.pack)";
        sVersion = "v" + File.read_uint32(4, _BE);
        sOptions = File.read_uint32(8, _BE) + " object(s)"
    } else if (Binary.compare("FF'tOc'00000002")) {
        sName = "Index of packed git objects (.idx)";
        sVersion = "v" + File.read_uint32(4, _BE);
        bDetected = 1
    } else if (Binary.compare("'RIDX'00000001") && File.read_uint32(8, _BE) > 0 && File.read_uint32(8, _BE) <= 2) {
        sName = "Reverse index of packed git objects (.rev)";
        sVersion = "v1";
        bDetected = true;
        switch (File.read_uint32(8, _BE)) {
            case 1:
                sOptions = "SHA-1 hashes";
                break;
            case 2:
                sOptions = "SHA-256 hashes";
                break;
            default:
                sOptions = "unknown hashes";
        }
    } else if (Binary.compare("00000000000000000000000000007400010074000500")) {
        bDetected = true;
        sName = "PCInstall";
    } else if (Binary.compare("'PP20'09")) {
        bDetected = true;
        sName = "PowerPack";
        sOptions = "by Nico Francois";
    } else if (Binary.compare("edabeedb0300")) {
        bDetected = true;
        sName = "RPM package";
    } else if (Binary.compare("bd01..00..00..000000")) {
        bDetected = true;
        sName = "HUFF";
    } else if (Binary.compare("'SZ '88")) {
        bDetected = true;
        sName = "SZ";
        sOptions = "by Microsoft";
    } else if (Binary.compare("'BAGF'02")) {
        bDetected = true;
        sName = "BAGF";
    } else if (Binary.compare("'PAC - 'a9' BVRP Software 1990-2000'")) {
        bDetected = true;
        sName = "PAC";
        sOptions = "1990-2000 by BVRP Software";
    } else if (Binary.compare("'Cr24'02")) {
        bDetected = true;
        sName = "CRX";
    } else if (Binary.compare("74c42c84e1e5d428")) {
        bDetected = true;
        sName = "InstallShield INX";
        sVersion = "7.x"
    } else if (Binary.compare("5d0000....ffffffffffffffff00180ddd04")) {
        bDetected = true;
        sName = "LZMA";
    } else if (Binary.compare("5d00008000........000000000000")) {
        bDetected = true;
        sName = "LZMA";
    } else if (Binary.compare("1fa0")) {
        bDetected = true;
        sName = "SCO";
    } else if (Binary.compare("'# PaCkAgE DaTaStReAm'")) {
        bDetected = true;
        sName = "Solaris Package";
    } else if (Binary.compare("'SQZE'010000")) {
        bDetected = true;
        sName = "SQZE";
    } else if (Binary.compare("'xar!'001c00010000")) {
        bDetected = true;
        sName = "XAR";
    } else if (Binary.compare("fd'7zXZ'00")) {
        bDetected = true;
        sName = "XZ";
    }

    function isCompress() {
        if (File.getSize() < 3 || !File.compare("1F9D")) return false;
        t = File.read_uint8(2);
        sversion = t & 0x80 ? "new" : "old";
        t &= 0x7F;
        if (t < 9 || t > 16) return false;
        return true;
    }
    if (!bDetected)
        if (isCompress()) {
            sName = "Compress (.Z)";
            sVersion = sversion;
            bDetected = true;
        } else if (Binary.compare("'LZK00'000000")) {
        bDetected = true;
        sName = "LZK00";
    } else if (Binary.compare("032401010100")) {
        bDetected = true;
        sName = "WPK";
    } else if (Binary.compare("'TPWM'")) {
        bDetected = true;
        sName = "TPWM (BlueByte)";
    } else if ((Binary.getSize() >= 500) && (Binary.compare("00'ustar'", 0x100))) {
        bDetected = true;
        sName = "tar";
    } else if (Binary.compare("'LB'0100")) {
        bDetected = true;
        sName = "XFL game resource file (.XFL)";
        sVersion = "v1.0";
        sOptions = sOptions.append(Binary.getString(12, 32));
        sOptions = sOptions.append("& other " + (Binary.readDword(8) - 1) + " files");
    } else if (Binary.compare("FF060000'sNaPpY'")) {
        bDetected = true;
        sName = "Snappy compressed data (.SZ)";
    } else if (Binary.compare("'blkzip'00")) {
        bDetected = true;
        sName = "BulkZip (.BULK)";
    } else if (Binary.compare("AE01'NanoZip 0.09 alpha'")) {
        bDetected = true;
        sName = "NanoZip (.NZ)";
        sVersion = "0.09 alpha";
    } else if (Binary.compare("'CM'2805060000")) {
        bDetected = true;
        sName = "RAZOR (.RZ)";
        sOptions = "by Christian Martelock"
    } else if (Binary.compare("28B52FFD")) {
        bDetected = true;
        sName = "Facebook Zstandard/ZSTD compressed data (.ZST)";
    } else if (Binary.compare("00'APPL'", 0x40) && Binary.compare("00008181", 0x78)) {
        bDetected = true;
        sName = "MacBinary";
    }

    return result();
}


================================================
FILE: db/Binary/archive_archives.ancient.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG@kaens)
// Mostly from the all-encompassing https://github.com/temisu/ancient
//Lots of these formats have very shaky signatures, and some won't even have decompression errors...

meta("archive", "");
/* beautify ignore:start */
debug = 0;

function detect() {
	const maxsz = 0x40000000; var bad = "", xpk = 0, sname = sversion = soptions = "";

	//the following is provisory until the system CRC functions get updated
	const CRC16Table = [
	0x0000,0xc0c1,0xc181,0x0140,0xc301,0x03c0,0x0280,0xc241,0xc601,0x06c0,0x0780,0xc741,0x0500,0xc5c1,0xc481,0x0440,
	0xcc01,0x0cc0,0x0d80,0xcd41,0x0f00,0xcfc1,0xce81,0x0e40,0x0a00,0xcac1,0xcb81,0x0b40,0xc901,0x09c0,0x0880,0xc841,
	0xd801,0x18c0,0x1980,0xd941,0x1b00,0xdbc1,0xda81,0x1a40,0x1e00,0xdec1,0xdf81,0x1f40,0xdd01,0x1dc0,0x1c80,0xdc41,
	0x1400,0xd4c1,0xd581,0x1540,0xd701,0x17c0,0x1680,0xd641,0xd201,0x12c0,0x1380,0xd341,0x1100,0xd1c1,0xd081,0x1040,
	0xf001,0x30c0,0x3180,0xf141,0x3300,0xf3c1,0xf281,0x3240,0x3600,0xf6c1,0xf781,0x3740,0xf501,0x35c0,0x3480,0xf441,
	0x3c00,0xfcc1,0xfd81,0x3d40,0xff01,0x3fc0,0x3e80,0xfe41,0xfa01,0x3ac0,0x3b80,0xfb41,0x3900,0xf9c1,0xf881,0x3840,
	0x2800,0xe8c1,0xe981,0x2940,0xeb01,0x2bc0,0x2a80,0xea41,0xee01,0x2ec0,0x2f80,0xef41,0x2d00,0xedc1,0xec81,0x2c40,
	0xe401,0x24c0,0x2580,0xe541,0x2700,0xe7c1,0xe681,0x2640,0x2200,0xe2c1,0xe381,0x2340,0xe101,0x21c0,0x2080,0xe041,
	0xa001,0x60c0,0x6180,0xa141,0x6300,0xa3c1,0xa281,0x6240,0x6600,0xa6c1,0xa781,0x6740,0xa501,0x65c0,0x6480,0xa441,
	0x6c00,0xacc1,0xad81,0x6d40,0xaf01,0x6fc0,0x6e80,0xae41,0xaa01,0x6ac0,0x6b80,0xab41,0x6900,0xa9c1,0xa881,0x6840,
	0x7800,0xb8c1,0xb981,0x7940,0xbb01,0x7bc0,0x7a80,0xba41,0xbe01,0x7ec0,0x7f80,0xbf41,0x7d00,0xbdc1,0xbc81,0x7c40,
	0xb401,0x74c0,0x7580,0xb541,0x7700,0xb7c1,0xb681,0x7640,0x7200,0xb2c1,0xb381,0x7340,0xb101,0x71c0,0x7080,0xb041,
	0x5000,0x90c1,0x9181,0x5140,0x9301,0x53c0,0x5280,0x9241,0x9601,0x56c0,0x5780,0x9741,0x5500,0x95c1,0x9481,0x5440,
	0x9c01,0x5cc0,0x5d80,0x9d41,0x5f00,0x9fc1,0x9e81,0x5e40,0x5a00,0x9ac1,0x9b81,0x5b40,0x9901,0x59c0,0x5880,0x9841,
	0x8801,0x48c0,0x4980,0x8941,0x4b00,0x8bc1,0x8a81,0x4a40,0x4e00,0x8ec1,0x8f81,0x4f40,0x8d01,0x4dc0,0x4c80,0x8c41,
	0x4400,0x84c1,0x8581,0x4540,0x8701,0x47c0,0x4680,0x8641,0x8201,0x42c0,0x4380,0x8341,0x4100,0x81c1,0x8081,0x4040];
	function _CRC16(ofs,len,acc) {
		if (!len || ofs+len > X.Sz()) return -1;
		for (var i=0; i < len; i++) acc = (acc >> 8) ^ CRC16Table[(acc&0xff) ^ X.U8(ofs+i)];
		return acc
	}
	function CRC16(ofs,len,acc) {
		if(typeof(File.crc16) == "undefined")
			return _CRC16(ofs,len,acc)
		else {
			_log("Please remove the CRC16 implementation from archives.ancient.sg!");
			return File.crc16(ofs,len,acc)
		}
	}
	function CRC16Byte(b, acc) { return (acc >> 8) ^ CRC16Table[(acc&0xff) ^ b] }

	var xpkfault = found = false; //for leaving the recursion real quick. For when/if said recursion does happen.
	function isXPK(reclvl) { if(found) return true;
		if(reclvl >= 4 || xpkfault) {xpkfault = true; return false }
		if(X.c("'XPKF'",xpk) && X.Sz() < 0x2C) { xpkfault = true; return false }
		sz = X.U32(xpk+4,_BE); type = X.SA(xpk+8,4);unpsz=X.U32(xpk+12,_BE);
		if(!sz || !unpsz || sz > maxsz || unpsz > maxsz ) { xpkfault = true; return false }
		flags = X.U8(xpk+0x20); xhdrs = flags&1; haspass = flags&2;
		if(flags&4) hdrsz = 0x26+X.U16(xpk+0x24,_BE); else hdrsz = 0x24;
		if(xpk+sz+8 > X.Sz()) { xpkfault = true; return false }
cccc = [ // They often repeat the other detections below, but more standardised. And repeat we shall.
[/ACCA/,"André Osterhues's Code Compression Algorithm (XPK-ACCA.)"],
[/ARTM/,"Arithmetic encoding compressor (XPK-ARTM.)"],
[/BLZW/,"LZW-compressor by Bryan Ford (XPK-BLZW.)"],
[/BZIP/,"bzip by Julian Seward (XPK-BZIP."],
[/BZP2/,"bzip2 by Julian Sadler (XPK-BZP2.)"],
[/CBR[01]/,"RLE-compressor by Bilbo 1st of Hypenosis (XPK-CBR0.,XPK-CBR1.)"],
[/CRM2/,"Crunch-Mania by Thomas Schwarz, LZH-mode (XPK-CRM2.)"],
[/CRMS/,"Crunch-Mania by Thomas Schwarz, sampled LZH-mode (XPK-CRMS.)"],
[/CYB[12]/,"XpkCybPrefs container by Alexis Nasr (XPK-CYB1.,XPK-CYB2.)"],
[/GZIP/,"DEFLATE by Jean-loup Gailly (XPK-GZIP.)"],
[/DLTA/,"Delta encoding by Stephan Fuhrmann (XPK-DLTA.)"],
[/FAST/,"Fast LZ77 compressor by Christian von Roques (XPK-FAST.)"],
[/FBR2/,"FBR2 CyberYAFA compressor (XPK-FBR2.)"],
[/FRLE/,"RLE-compressor by Jorma Oksanen (XPK-FRLE.)"],
[/HFMN/,"Huffman compressor (XPK-HFMN.)"],
[/HUFF/,"Huffman compressor by Marc Zimmermann (XPK-HUFF.)"],
[/ILZR/,"Incremental Lempel-Ziv-Renau compressor (XPK-ILZR.)"],
[/IMPL/,"File Imploder by Peter Struijk (XPK-IMPL.)"],
[/LHLB/,"LZRW-compressor by Gunther Nikl (XPK-LHLB.)"],
[/LIN1/,"LIN1 LINO packer (XPK-LIN1.)"], [/LIN3/,"LIN3 LINO packer (XPK-LIN3.)"],
[/LIN2/,"LIN2 LINO packer (XPK-LIN2.)"], [/LIN4/,"LIN4 LINO packer (XPK-LIN4.)"],
[/LZBS/,"LZBS CyberYAFA compressor (XPK-LZBS.)"],
[/LZCB/,": LZ-compressor (XPK-LZCB.)"],
[/LZW2/,"LZW2 CyberYAFA compressor (XPK-LZW2.)"], [/LZW3/,"LZW3 CyberYAFA compressor (XPK-LZW3.)"],
[/LZW4/,"LZW4 CyberYAFA compressor (XPK-LZW4.)"],
[/LZW5/,"LZW5 CyberYAFA compressor (XPK-LZW5.)"],
[/ELZX/,"LZX-compressor by Piotr Kasprzyk (XPK-ELZX.)"],
[/SLZX/,"LZX-compressor with delta encoding by Piotr Kasprzyk (XPK-SLZX.)"],
[/MASH/,"LZRW-compressor by Zdenek Kabelac (XPK-MASH.)"],
[/NONE/,"Null compressor by Dirk Stöcker (XPK-NONE.)"],
[/NUKE/,"LZ77-compressor by Christian von Roques (XPK-NUKE.)"],
[/DUKE/,"LZ77-compressor by Christian von Roques, with delta encoding (XPK-DUKE.)"],
[/PWPK/,"Power Peak's PowerPacker by Nico François (XPK-PWPK.)"],
[/PPMQ/,"PPM compressor by Charles Bloom (XPK-PPMQ.)"],
[/(FRHT|RAKE)/,"LZ77-compressor (XPK-FRHT.,XPK-RAKE.)"],
[/RDCN/,"Ross data compression (XPK-RDCN.)"],
[/RLEN/,"RLE-compressor (XPK-RLEN.)"],
[/SDHC/,"Sample delta Huffman compressor (XPK-SDHC.)"],
[/SHR[I3]/,"LZ-compressor with arithmetic encoding by Matthias Meixner (XPK-SHR3.,XPK-SHRI)"],
[/SLZ3/,"SLZ3 CyberYAFA compressor by Niels Fröhling (XPK-SLZ3.)"],
[/SMPL/,"Huffman compressor with delta encoding (XPK-SMPL.)"],
[/SQSH/,"Squash compressor for sampled sounds by John Hendrikx (XPK-SQSH.)"],
[/SASC/,"LZ-compressor with arithmetic and delta encoding (XPK-SASC.)"],
[/SHSC/,"Context modeling compressor by Peter Kunath (XPK-SHSC.)"],
[/TDCS/,"LZ77-compressor by Niels Fröhling (XPK-TDCS.)"],
[/ZENO/,"LZW-compressor (XPK-ZENO.)"],
//the following aren't implemented in Ancient
[/BLFH/,"Blowfish encryption by Bruce Schneider (XPK-BLFH.)"],
[/BZIP/,"Encapsulated Bzip v1 (XPK-BZIP.)"],
[/CAST/,"CAST encryption by Dirk Pauli (XPK-CAST.)"],
[/ENCO/,"Unsafe encryption (XPK-ENCO.)"],
[/DHUF/,"Huffman compressor (lost) (XPK-DHUF.)"],
[/DMCB/,"68881/2 fp-based arithmetic compressor (XPK-DMCB.)"],
[/DMCD/,"68881/2 fp-based arithmetic compressor (XPK-DMCD.)"],
[/DMCI/,"Arithmetic compressor (lost) (XPK-DMCI.)"],
[/DMCU/,"68881/2 fp-based arithmetic compressor (XPK-DMCU.)"],
[/FEAL/,"FEAL-N encryption by Christian von Roques (XPK-FEAL.)"],
[/IDEA/,"IDEA encryption (XPK-IDEA.)"],
[/L2XZ/,"LZMA2 compressor (XPK-L2XZ.)"],
[/LZ40/,"LZ4 compressor (XPK-LZ40.)"],
[/LZMA/,"LZMA2 compressor (XPK-LZMA.)"],
[/NUID/,"IDEA encryption + NUKE (XPK-NUID.)"],
[/SHID/,"IDEA encryption + SHRI (XPK-SHID.)"],
[/TLTA/,"TLTA encoder (lost) (XPK-TLTA.)"] ]
		found = -1;
		for(i=0; i < cccc.length && found < 0; i++) if(cccc[i][0].test(type)) found = i;
		if(found < 0) { xpkfault = true; return false }
		sname = sname.appendS(cccc[found][1],"/n");
		if(xpk+0x24 > X.Sz()) bad = bad.addIfNone("!short");
		else { c = 0; for(i=0; i < 0x24; i++) c ^= X.U8(xpk+i);
			if(c) bad = bad.addIfNone("!badhdr"); }
		//if(X.isDeepScan()) { //TODO check all the chunks; for each: isXPK(reclvl+1); }
		sz += xpk+8;
		return true;
	}
	if(isXPK()) {
		if(X.isVerbose()) sName = "Amiga eXtended PacKer Format container by Dirk Stöcker et al. (XPKF.)";
		else sName = "XPK container (XPKF.)";
		sVersion = sversion+(bad!=""?"malformed"+bad:""); bDetected = 1;
		if(X.isVerbose()) sOptions = sname+"; payload at:"+Hex(hdrsz)+" unp.sz:"+unpsz+" sz:"+outSz()
	}

	else if(X.Sz() > 4 && X.c("'ACCA'"))
		_setResult("archive","André Osterhues's Code Compression Algorithm (ACCA.)","","");

	else if(X.Sz() > 2 && X.c("FF1F"))
		_setResult("archive","Compact by Colin L. McMaster (.C)","","");

	function isCompress() {
		if(X.Sz() < 3 || !X.c("1F9D")) return false;
		t = X.U8(2); sversion = t&0x80 ? "new" : "old"; t &= 0x7F;
		if(t < 9 || t > 16) return false;
		return true
	}
	if(isCompress())
		_setResult("archive","Compress by Spencer Thomas (.Z)",sversion,"");

	function isCrunchMania() {
		if(X.Sz() < 20) return false;
		if(!X.c("'CrM!'") && !X.c("'CrM2'") && !X.c("'Crm!'") && !X.c("'Crm2'")
		  && !X.c("18051973") && !X.c("'CD'B3B9") && !X.c("'DCS!'")
		  && !X.c("'Iron'") && !X.c("'MSS!'") && !X.c("'mss!'")) return false;
		unpsz = X.U32(6,_BE); if(!unpsz || unpsz > maxsz) return false;
		sz = X.U32(10,_BE)+14; if(sz < 15 || sz > X.Sz() || sz > maxsz) return false;
		hdr = X.SA(0,4); switch(hdr) {
		  case "\x18\x05\x19\x73": case "CD\xB3\xB9": case "Iron": case "MSS!":  hdr = "CrM2"; break;
		  case "mss!":  hdr = "Crm2"; break;  case "DCS!":  hdr = "CrM!" }
		var isSampled = hdr[2] == 'm', isLZH = hdr[3] == '2';
		sversion = ["std","std sampled","LZH","LZH sampled"][(isLZH?2:0)+(isSampled?1:0)];
		return true
	}
	if(!bDetected && isCrunchMania()) {
		sName = "Crunch-Mania by Thomas Schwarz (CRM.)"; sVersion = sversion;
		if(X.isVerbose()) sOptions = "unp.sz:"+unpsz+" sz:"+outSz(); bDetected = 1
	}

	function isDMS() { //TODO move to internal CRC16 once that's ready
		if(!X.c("'DMS!'") || X.Sz() < 0x38) return false;
		if(X.U16(0x32,_BE) > 6) return false; bad = '';
		if(_CRC16(4,0x32,0) != X.U16(0x36,_BE)) bad = bad.addIfNone('!badhdr');
		var info = X.U16(10,_BE); if(info&0x20) return false;
		sversion = ''; if(info&2) sversion = "obfuscated";
		p = 0x38; var ctxsz = tsz = acsz = lasttrksz = trks = mintrk = prevtrk = 0;
		var ctxszs = [0,0,0x100,0x4000,0x4000,0x1000,0x2000];
		while(p+20 < X.Sz()) {
			if(!X.c("'TR'",p)) return false;
			ctrk = X.U16(p+2,_BE); if(ctrk < prevtrk) break;
			if(X.isDeepScan())
				if(_CRC16(p,18,0) != X.U16(p+18,_BE)) { bad = bad.addIfNone("!badtrkhdr"); break }
			var mode = X.U8(p+13); if(mode > 6) return false;
			var ctxsz = Math.max(ctxsz,ctxszs[mode]);
			var flags = X.U8(p,12);
			if((mode >= 2 && mode <= 4) || (mode >= 5 && (flags&4)))
				tsz = Math.max(tsz,X.U16(p+8,_BE));
			var hksz = X.U16(p+6,_BE);
			if(p+20+hksz > X.Sz()) return false;
			// ↓ potential to slow the script down:
			if(X.isAggressiveScan())
				if(_CRC16(p+20,hksz,0) != X.U16(p+16,_BE)) {
					bad = bad.addIfNone("!badtrkcrc"); break }
			if(ctrk < 80) {
				if(ctrk >= trks) lasttrksz = X.U16(p+10,_BE);
				if(mintrk > ctrk) mintrk = ctrk; if(ctrk > trks) trks = ctrk;
				prevtrk = ctrk
			}
			p += hksz+20; acsz += hksz;
			if(p > X.Sz()) { bad = bad.addIfNone("!short"); break }
			if(ctrk >= 79 && ctrk < 0x8000) break;
			if(bad) break;
		}
		var trksz = (info&16)?22528:11264; //var rawofs = mintrk*trksz;
		if(mintrk >= trks) bad = bad.addIfNone("!badtrknum");
		unpsz = (trks-mintrk)*trksz+lasttrksz; //imgsz = trksz*80;
		sz = p; if(sz > maxsz) bad = bad.addIfNone("!badcalcsize");
		if(bad) sversion += "/malformed"+bad;
		return true;
	}
	if(!bDetected && isDMS()) {
		sName = "Disk Masher System (DMS.)"; sVersion = sversion;
		if(X.isVerbose()) sOptions = "unp.sz:"+unpsz+" sz:"+outSz(sz); bDetected = 1
	}

	function isFreeze() {
		if(!X.c("1F9E") && !X.c("1F9F")) return false;
		var old = X.c("1F9E");
		sname = sversion = "";
		if(old) {
			if(X.Sz() > 2) {
				var _t = [0,0,1,3,8,12,42,16];
				var lent = [], i = btl = k = 0;
				var br = new BitReader(2);
				for(; i < 8; i++) for(; k < _t[i]; k++) lent[btl++] = i+1;
				_t = createOrderlyHuffmanTable(lent,btl,br); if(!_t) return false;
			}
			sversion = "v1.x = gzip v0.5"
		} else {
			if(X.Sz() < 5) return false;
			t = X.U16(2,_LE); if(t & 0x8000) return false;
			t2 = X.U8(4); if(t2 & 0xC0) return false;
			var _t = [t&1, (t>>1)&3, (t>>3)&7, (t>>6)&0xF, t>>10, t2];
			var count = 62; for(i=0; i < 6; i++) count -= _t[i];
			var weights = 0x100, j = 7;
			for(i=0; i < 6; i++) weights -= _t[i] << j--;
			if(weights < count || count*2 < weights) return false;
			if(!createOrderlyHuffmanTable())
			sversion = "v2.x"
		}
		return true
	}
	if(!bDetected && isFreeze()) {
		sName = "Freeze/Melt by Leonid A. Broukhis (.F,.lzc)"; sVersion = sversion; bDetected = 1
	}

	function isIMP() {
		hdr = X.SA(0,4); switch(hdr) {
		case "ATN!": case "EDAM": case "IMP!": case "M.H.": add = 7; break;
		case "BDPI": add = 0x6E8; break;  case "CHFI": add = 0xFE4; break;
		case "RDC9": case "Dupa": case "FLT!": case "PARA": add = 0; break;
		default: return false;
		}
		unpsz = X.U32(4,_BE); sz = X.U32(8,_BE); sversion = "";
		if(!unpsz || !sz || (sz&1) || (sz < 0xC) || sz+0x32 > X.Sz() || unpsz > maxsz || sz > maxsz) return false;
		if(X.isDeepScan()) {
			crc = X.U32(sz+0x2E,_BE);
			for(i=0; i < sz+0x2E; i += 2) add += X.U16(i,_BE);
			if((add&0xFFFFFFFF) != crc) sversion = "malformed!CRC"
		}
		sz += 0x32;
		return true
	}
	if(!bDetected && isIMP()) {
		sName = "File Imploder by Peter Struijk (FImp.)"; sVersion = sversion;
		if(X.isVerbose()) sOptions = "unp.sz:"+unpsz+" sz:"+outSz(); bDetected = 1
	}

	function isLOB() {
		if(X.Sz() < 12 || !/[\x01\x02\x03]LOB/.test(X.SA(0,4))) return false;
		var nV = X.U8(0); method = X.U8(4); if(!method || method > 6) return false;
		unpsz = 0;
		if(nV === 1) { unpsz = File.read_uint24(5,_BE); if(!unpsz || unpsz > maxsz) return false; }
		sz = 12+X.U32(8,_BE);
		if(method === 2) { var c = 2;
			for(i = 0; i < c; i += 2) { if(sz+c > X.Sz()) return false;
				t1 = X.U8(sz+i); t2 = X.U8(sz+i+1);
				if(t1 != t2) { if(t1 < t2) t1 = t2;  if(c < t1+i+4) c = t1+i+4;  if(c > 1024) return false } }
			sz += c; // the count is also off in Ancient, but it does unpack! (could be an extra 00 at the end)
		}
		sversion = ["BMC: RLE", "HUF: Huffman", "LZW: 12-bit fixed code",
			"LZB: 9 to 12-bit fixed LZW","MSP: LZ variant","MSS: LZSS variant"][method-1]
		  + ["","/double","/triple"][nV-1]
		  +(sz > X.Sz() ? "/malformed!short" : "");
		return true
	}
	if(!bDetected && isLOB()) {
		sName = "LOB's File Compressor aka. Multipak (LOB.)"; sVersion = sversion;
		if(X.isVerbose()) sOptions = (unpsz?"unp.sz:"+unpsz+" ":"")+"sz:"+outSz(); bDetected = 1
	}

	function isMMCMP() {
		if(!X.c("'ziRCONia'0E00") || X.Sz() < 24) return false;
		var blkn = X.U16(0x0C,_LE), blkp = X.U32(0x12,_LE);
		unpsz = X.U32(0x0E,_LE); if(unpsz > maxsz) return false;
		if(blkp+blkn*4 > X.Sz()) return false;
		bad = ""; sz = 0;
		for(i = 0; i < blkn; i++) {
			var t = X.U32(blkp+i*4,_LE); if(t+20 > X.Sz()) return false;
			var bkp = t+X.U32(t+4,_LE)+8*X.U16(t+12,_LE)+20;
			if(sz < bkp) sz = bkp
		}
		return true
	}
	if(!bDetected) if(isMMCMP()) {
		sName = "Music Module Compressor by Emmanuel 'Zirconia' Giasson (MMCMP.)"; nV = X.U16(0x0A,_LE).toString(16).toUpperCase();
		sVersion = "v"+nV[0]+"."+nV.slice(1,3);
		if(X.isVerbose()) sOptions = "unp.sz:"+unpsz+" sz:"+outSz(); bDetected = 1
	}
	else if(X.c("'MMS '00")) {
		sName = "C(ompression)KIT by Mad Man Software (C4-,C4A,C`A)"; bDetected = 1;
	}

	function isPack() {
		if(!X.c("1F1E") && !X.c("1F1F") || X.Sz() < 6) return false;
		old = X.c("1F1F");
		if(old) unpsz = (X.U16(2,_LE) << 16) | X.U16(4,_LE); //PDP-endian
		else { unpsz = X.U32(2,_BE);  t = X.U8(6);
			if(!t || t > 0x18 || 6+t > X.Sz()) return false }
		if(unpsz > maxsz || (old && !unpsz)) return false;
		if(old) { var p = 6; var tree = [];
			var c = X.U16(p,_LE); p += 2; if(c >= 1024) return false;
			for(i=0; i < c; i++) { t = X.U8(p++);
				if(t < 255) tree[i] = t; else { tree[i] = X.U16(p,_LE); p += 2 }
			}
			var detect = true;
			function branch(node,len,bits) { if(!detect) return;
				if(node > c) { detect = false; return }
				if(tree[node]) {
					len++; if(len > 24) { detect = false; return }
					bits <<= 1; branch(node+tree[node],len,bits);
					if(node+1 >= c) { detect = false; return }
					branch(node+tree[node+1],len,bits|1);
				} else if(!len) { detect = false; return }
			}
			branch(0,0,0); return detect
		}
		return true
	}
	if(!bDetected && isPack()) {
		sName = "Pack (.z)"; if(old) sVersion = "old";
		if(X.isVerbose()) sOptions = "unp.sz:"+unpsz; bDetected = 1
	}

	function isPP() {
		if(X.Sz() < 0x10 || !X.c("'PP11'") && !X.c("'PP20'") && !X.c("'PX20'")
		  && !X.c("'CHFC'") && !X.c("'DEN!'") && !X.c("'DXS9'")
		  && !X.c("'H.D.'") && !X.c("'RVV!'")) return false;
		var isObf = false; sversion = "";
		if(X.c("'PX20'")) { if(X.Sz() < 0x12) return false; isObf = true; sversion = "obfuscated" }
		var m = X.U32(isObf?6:4, _BE);
		if(m != 0x9090909 && m != 0x90A0A0A && m != 0x90A0B0B && m != 0x90A0C0C && m != 0x90A0C0D)
			return false;
		if(X.isDeepScan()) {
			t = X.U32(X.Sz()-4,_BE); unpsz = t>>8;
			if(!unpsz || unpsz > maxsz || (t&0xFF) >= 0x20) return false
		}
		return true
	}
	if(!bDetected && isPP()) {
		sName = "Power Peak's PowerPacker by Nico François (PP.)"; sVersion = sversion;
		if(X.isDeepScan() && X.isVerbose()) sOptions = "unp.sz:"+unpsz; bDetected = 1
	}

	else if(!bDetected && X.c("'SFHD'"))
		_setResult("archive","PowerPlayer Music Cruncher by Stephan Fuhrmann (PMC.)","v1.0",
			"lh.library-based, unp.sz:"+X.U32(4,_BE)+" sz:"+outSz(X.U32(8,_BE)+0xC));
	else if(!bDetected && X.c("'SFCD'"))
		_setResult("archive","PowerPlayer Music Cruncher by Stephan Fuhrmann (PMC.)","v2.x",
			"LZRW-compressor, unp.sz:"+X.U32(4,_BE)+" sz:"+outSz(X.U32(8,_BE)+0xC));

	function isRNC() {
		if(!X.c("'RNC'01") && !X.c("'RNC'02") && !X.c("'...'01")) return false;
		unpsz = X.U32(4,_BE); sz = X.U32(8,_BE);
		if(!unpsz || !sz || unpsz > maxsz || sz > maxsz) return false;
		var verified = false; sversion = "";
		if(X.c("'RNC'01"))
			if(X.Sz() <= 0x12) sversion = "old"; else {
				var news = X.U8(0x12), olds = X.U8(sz+0x0B);
				if(!(olds&0x80)) sversion = "new";
				else if((news&3) || !(news&0x7C)) sversion = "old";
				else if(X.Sz() >= sz+0x12
				  && (File.isHeuristicScan() || X.isDeepScan() && CRC16(0x12,sz,0) == X.U16(0x0E,_BE))) {
					sversion = "new"; verified = true
				}  else sversion = "old"
			}
		else if(X.c("'RNC'02"))
			if(X.Sz() <= 0x12) sversion = "old"; else {
				var news = X.U8(0x12), olds = X.U8(sz+0x0A);
				if(!(olds&0x80)) sversion = "new";
				else if((news&0x30) == 0x30) sversion = "old";
				else if(X.Sz() >= sz+0x12
				  && (File.isHeuristicScan() || X.isDeepScan() && CRC16(0x12,sz,0) == X.U16(0x0E,_BE))) {
					sversion = "new"; verified = true
				}  else sversion = "old"
			}
		else if(X.c("'...'01")) version = "new";// else return false
		var hdsz = sversion[0] == "o" ? 0x0C : 0x12; bad = "";
		if(hdsz+sz > X.Sz()) bad = "!short";
		if(X.isDeepScan() && sversion[0] == "n" && !verified && CRC16(0x12,sz,0) != X.U16(0x0E,_BE))
			bad = bad.addIfNone("!badcrc");
		sz += hdsz; if(bad) sversion += "/malformed"+bad;
		return true
	}
	if(!bDetected && isRNC()) {
		sName = "Rob Northen Compressor (RNC"+X.U8(3)+".)"; sVersion = sversion;
		if(X.isDeepScan() && X.isVerbose()) sOptions = "unp.sz:"+unpsz+" sz:"+sz; bDetected = 1
	}
	else if(!bDetected && File.isHeuristicScan() && X.Sz() >= 4 && X.c("1FA0"))
		_setResult("archive","SCO Compress LZH (SCO.)","","");

	function isSQSH() {
		if(!X.c("'SQSH'")) return false;
		return true
	}
	if(!bDetected && isSQSH()) {
		sName = "Squash compressor by John Hendrikx (SQSH.)";
		sOption = "12-bit LZW"; bDetected = 1
	}

	function isStoneCracker() {
		//won't recognise an archive with a zero-length file in it, by design, to minimise FPs
		var ihdr = X.U32(0,_BE), bhdr = X.readBytes(0,3), hdr = X.SA(0,4);
		function _subdetect() {
			if(ihdr >= 0x08090A08 && ihdr <= 0x08090A0E && ihdr != 0x08090A09) { gen = 2; return true }
			if((ihdr&0xFF) >= 8 && (ihdr&0xFF) <= 0x0E)
				if(bhdr[0] != bhdr[1] && bhdr[0] != bhdr[2] && bhdr[1] != bhdr[2]) { gen = 1; return true }
			switch(hdr.slice(0,3)) { case "1AM": gen = 3; return true; case "2AM": gen = 6; return true;
			}
			switch(hdr) {
			case "S300": gen = 3; return true; case "S310": gen = 4; return true; case "S400": gen = 5; return true;
			case "S401": gen = 6; return true; case "S403": case "Z&G!": case "ZULU": gen = 7; return true;
			case "S404": case "AYS!": gen = 8; return true; default: return false
			}
		}
		if(!_subdetect()) return false;
		var _m = []; sz = unpsz = -1;
		function readModes(value) {
			for (var i=0; i < 4; i++) {
				_m[i] = value >> 24; if (_m[i] < 8 || _m[i] > 14) return false;
				value <<= 8;
			}
		}
		function meta() {
			switch(gen) {
			case 1: p = 0x12; if(X.Sz() < p) return false; _m[0] = ihdr;
			 for(i=1; i < 3; i++) { _m[i] = X.U8(i+15); if(_m[i] < 4 || _m[i] > 7) return false }
			 var rlesz = X.U32(4,_BE); if(!rlesz) return false;
			 unpsz = X.U32(8,_BE); if(!unpsz || rlesz > unpsz || unpsz > 0x100000) return false;
			 sz = X.U32(12,_BE); if(!sz || sz > rlesz) return false; break;
			case 2: readModes(ihdr); case 4: case 5: case 6: p = 12; if(X.Sz() < p) return false;
			 unpsz = X.U32(4,_BE); if(!unpsz) return false;
			 sz = X.U32(8,_BE); if(!sz) return false; break;
			case 3: p = 0x10; if(X.Sz() < p) return false; readModes(X.U32(4,_BE));
			 unpsz = X.U32(8,_BE); if(!unpsz) return false;
			 sz = X.U32(12,_BE); if(!sz) return false; break;
			case 7: case 8: p = 0x10; if(X.Sz() < p+2) return false;
			 unpsz = X.U32(8,_BE); if(!unpsz) return false;
			 sz = X.U32(12,_BE)+2; if(sz < 2) return false; break;
			default: return false;
			}
			sz += p; if(sz > X.Sz() || sz > maxsz || unpsz > maxsz) return false;
			return true
		}
		if(gen == 2 && !meta()) gen = 1;
		if(!meta()) return false;
		names = [["?","?"], ["SC","v2.69-81"],["SC","v2.92-99"],["S300","v3.00"],["S310","v3.10-11b"],
		  ["S400","pre-v4.00"],["S401","v4.01"],["S403","v4.02a"],["S404","v4.10"]][gen];
		return true
	}
	if(!bDetected && isStoneCracker()) {
		sName = "StoneCracker by Jouni 'Mr. Spiv' Korhonen ("+names[0]+".)"; sVersion = names[1]; bDetected = 1;
		if(X.isVerbose())
			sOptions = (unpsz >= 0 ? "unp.sz:"+unpsz+" " : "")+(sz >= 0 ? "sz:"+outSz() : "")
	}

	function isTPWM() {
		if(X.Sz() < 12 || !X.c("'TPWM'")) return false;
		unpsz = X.U32(4,_BE); if(!unpsz || unpsz > maxsz) return false;
		return true
	}
	if(!bDetected && isTPWM()) {
		sName = "Turbo Packer by Wolfgang Meyerle (TPWM.)"; if(X.isVerbose()) sOptions = "unp.sz:"+unpsz; bDetected = 1
	}

	function isVice() {
		if(X.c("'Vice'")) { return true }
		else if(!X.c("'Vic2'")) return false;
		else {
			unpsz = X.U32(4); sz = 0xC+X.U32(8,_BE);
			if(!unpsz || unpsz > maxsz || sz < 1036 || sz > maxsz) return false;
		}
		return true
	}
	if(!bDetected && isVice()) {
		sName = "Huffman compressor with RLE ("+X.SA(0,4)+".)"; bDetected = 1;
		if(X.isVerbose() && X.U8(3) == 0x32) sOptions = "unp.sz:"+unpsz+" sz:"+sz
	}

	return result()
}
/* beautify ignore:end */

================================================
FILE: db/Binary/archive_btoa.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("archive", "btoa");

function detect() {
    var sStr = Binary.getString(0, 11);

    if (sStr == "'xbtoa Begin'") {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/archive_cad.DWG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://www.opendesign.com/files/guestdownloads/OpenDesign_Specification_for_.dwg_files.pdf
// https://help.autodesk.com/view/OARX/2018/ENU/?guid=GUID-235B22E0-A567-4CF6-92D3-38A2306D73F3

meta("archive", "AutoCAD Drawing (.DWG)");

function detect() {
    if (Binary.getSize() >= 9) {
        bDetected = true;

        switch (Binary.getString(0, 0x06)) {
            case 'AC1001': sVersion = "R2.22"; break;
            case 'AC1002': sVersion = "R2.50"; break;
            case 'AC1003': sVersion = "R2.60"; break;
            case 'AC1004': sVersion = "R9"; break;
            case 'AC1006': sVersion = "R10"; break;
            case 'AC1009': sVersion = "R11/12"; break;
            case 'AC1012': sVersion = "R13"; break;
            case 'AC1014': sVersion = "R14"; break;
            case 'AC1015': sVersion = "R2000"; break;
            case 'AC1018': sVersion = "R2004"; break;
            case 'AC1021': sVersion = "R2007"; break;
            case 'AC1024': sVersion = "R2010"; break;
            case 'AC1027': sVersion = "R2013"; break;
            case 'AC1032': sVersion = "R2018"; break;
            default: return;
        }
    }

    return result();
}

================================================
FILE: db/Binary/archive_gp7bank.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens TG@kaens

meta("archive", "Arobas Music Guitar Pro 7+ soundbank (.gp7bank)");

function detect() {
    if (!X.c("'AMARCHIVE'..000000") ||
        !X.c("'Samples.xml'00", 0x25) ||
        !X.c("'<?xml'", X.U32(0x19)) ||
        X.U32(0x19) + X.U32(0x21) != X.U32(0x31) // ofs+sz of the xml = next ofs
    ) return false;

    bDetected = true; sVersion = 'v' + X.U8(9);

    if (X.isVerbose()) sOptions = X.U16(0xD) + ' samples';

    return result();
}

================================================
FILE: db/Binary/audio.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Authors:
// Kaens TG@kaens (for all the https://en.wikipedia.org/wiki/Music_tracker stuff)
// hypn0 <hypn0@mail.ru>

// Due to the extreme script file size, many good code practices were sacrificed to ensure it loads
/* beautify ignore:start */

meta("audio", "");
includeScript("chunkparsers");
includeScript("soundchips");
includeScript("bytecodeparsers");
const debug = 0; //verbosity up to 3, where every note/command is shown. Overrides the debug() function; use _l2r()

function isWinCert() {
	// I'll skip WIN_CERTIFICATE+bCertificate things for overlay scans to save time :)
	if(X.Sz() >= (_wcsz=X.U32(0,_LE)) && X.c('00 02 02 00 30', 4)) { // assuming the tag's just present immediately
		_wcp = 9; _wca = X.U8(_wcp++);
		if(_wca < 0x80) {} else if(_wca > 0x80) {
			_wcc = _wca ^ 0x80; for(_wci=_wca=0; _wci < _wcc; _wci++) _wca = (_wca << 8) + X.U8(_wcp++); //big-endian here
		}  else _wca = -1;
		if(_wca > 0 && _wca+_wcp <= _wcsz && X.c("06 09 2A 86 48 86 F7 0D 01 07 02",_wcp)) return true; //handoff to other decectors
	}
	return false
}

function detect() {

	if(isWinCert()) return;

	// this C-like pre-declaration is here because lol Qt6
	var p = 0, i = 0, j = 0, k = 0, l = 0, r = 0, t = 0, x = 0, sz = -1,
		title = '', a = '', c = '', msg = '', info = '', artist = '', soption = '';

	if(X.c("'[1tracker module]'0D0A")) {
		sName = "Shiru's 1tracker module (.1TM)"; bDetected = 1;
		l = X.fStr(1,0x40,"Engine="); if(l >= 0) {
			r = X.fStr(l+7,0x40,".");
			sVersion = "for "+X.SA(l+7,r-l-7)
		}
		if(X.isVerbose()) {
			l = X.fStr(r,0x80,"Title="); if(l >= 0) {
				r = X.fSig(l+6,0x40,"0D0A");
				sOption(X.SA(l+6,r-l-6)) }
			l = X.fStr(r,0x80,"Author="); if(l >= 0) {
				r = X.fSig(l+7,0x40,"0D0A");
				sOption(X.SA(l+7,r-l-7),"by: ") }
			l = X.fStr(r,0x80,"Speed="); if(l >=0 ) {
				r = X.fSig(l+7,0x40,"0D0A");
				sOption(X.SA(l+7,r-l-7),"spd:") }
		}
	}

	else if(X.c("'_A2module_'") && isWithin(nV = X.U8(0xE),1,14)) {
		bDetected = 1; bad = false;
		sName = "subz3ro's AdLib Tracker II module (.A2M)";
		sVersion = "/┤DLiB TR/┤CK3R ][ v"+nV;
		ptn = X.U8(0xF); if(!ptn || ptn>64) bad = "!badptn";
		if(bad) sVersion += "/malformed"+bad;
		else if(X.isVerbose()) sOption('ptn:'+ptn); //TODO extract more, ver.-dependent
	}

	else if(X.c("'_A2tiny_module_'") && isWithin(nV = X.U8(0x13),1,14)) {
		sName = "subz3ro's AdLib Tracker II module (.A2T)"; bDetected = 1; bad = false;
		sVersion = "/┤DLiB TR/┤CK3R ][ v"+nV+' tiny';
		ptn = X.U8(0x14); if(!ptn || ptn>64) bad = "!badptn";
		tmp = X.U8(0x15); spd = X.U8(0x16); rows = X.U16(0x18); trk = X.U8(0x1A);
		if(bad) sVersion += "/malformed"+bad;
		else if(X.isVerbose()) sOption('tempo:'+tmp+' spd:'+tmp+' trk:'+trk+' ptn:'+ptn); //TODO extract more
	}

	else if(X.c("'EXITgB'2018201820182F18201024C94AA80004660A558006A80000000200042200D28924C1D0A8000424C0D1DF2018D1D82018D1D82018201812D804800000000166F660B4610000'H|'017E01610000'Z|'027E02610000'R|'037E03610000'JL'DF7FFF'NuH'E7FFFE7E01610000AC7E02610000A67E03610000A04CDF7FFF'Nu`'0A602260000092600000'~A'FA....4BF900DFF000'p0;|'000000AA0440001064F4'NuK'F900DFF0003007C0FC",0x1A) //check D0h bytes
		) {
		// https://www.exotica.org.uk/wiki/Art_%26_Magic_(team)
		bDetected = 1; sName = "Franck Sauer and Yves Grolet's Art & Magic module (.AAM)";
		if(X.isVerbose()) {
			t = X.fSig(0x8000,Math.min(0xFFFF,X.Sz()),"'EXIT'");
			if(t >= 0) sOption(outSz(t+4),"sz:");
			else sVersion = "malformed!short"
		}
	}

	else if(X.c("'ADLIB'01")) {
		sName = "Martin Fernandez's Adlib module (.ADLIB)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.SA(6,0x100);
			g = X.SA(6+t.length+1,0x100);
			sOption(t); sOption(g,"for: ")
		}
	}

	else if(X.c("'AERO'00000001") && X.U8(0x0F) == 0xCA && X.U8(0x1F) == 0xCA && X.U8(0x2F) == 0xCA) {
		sName = "ioNeo's Aero Studio module (.AERO)"; bDetected = 1;
		if(X.isVerbose()) sOption('sz:'+outSz(X.U32(8)+12))
	}

	else if(X.fSig(20,0x100,"'<aks:song xmlns:aks=\"http://www.julien-nevo.com/ArkosTrackerSong\"") > 0) {
		sName = "Julien Névo's Arkos Tracker 2 module (.AKS)"; sVersion = 'unpacked'; bDetected = 1;
	}

	else if(X.c("'AM01'000000") && X.c("'ASD1'", 0x38) && (amp=X.fSig(0x40,0x1000000,"'AMP'.. ........'ASSH'")) > 0) {
		sName = "New Beat's Ace Tracker module (.AM)"; bDetected = 1;
		maxsz = Math.min(X.Sz(),0x1000000); title = by = bad = ''; ptn = ord = smp = sz = 0; ptns = [];
		p = 0x3C;
		while(p < amp && smp < 0x40 && (t=X.U32(p,_BE))) { p += t; smp++ }  p += 4;
		if(!X.c("'AMP'.. ........'ASSH'",p)) { p = amp; bad = bad.addIfNone('!badsmp'); smp = Math.max(1,smp) }
		ampv = X.U8(p+3)-0x30; if(ampv > 3) bad = bad.addIfNone('!unkver');
		sVersion = 'v'+ampv;
		ins = X.U32(p+4,_BE); p += 12; inss = [];
		for(i=0; i < ins; i++,p+=(ampv == 1? 0xCD: ampv == 2? 0xD1: ampv == 3? 0xD4: 0))
			if((t=X.SA(p+4,20).trim()) != '' && t != 'Empty') inss.push(t)
		if(!X.c("'ASG1'",p)) bad = bad.addIfNone('!badins');
		asg1 = X.fSig(amp,maxsz,"'ASG1'"); ord = ptn = 0;
		if(asg1 < 0) bad = bad.addIfNone('!nosong'); else {
			title = X.SC(asg1+4,20,'CP437'); by = X.SC(asg1+24,20,'CP437')
			for(i=asg1+0x2C; i < asg1+0x12C; i++) if(t=X.U8(i)) { ord = i-asg1-0x2B; if(t > ptn) ptn = t }
		}
		p = asg1+0x12C; apn1 = X.fSig(asg1,0x400,"'APN1'"); ch = ptn_ = -1;
		if(apn1 > 0) {
			if(p != apn1) bad = bad.addIfNone('!badptn'); ptn_ = X.U32(apn1+4,_BE);
			if(ptn != ptn_) bad = bad.addIfNone('!badptn'+ptn+'/'+ptn_);
			for(i=0,p=apn1+8; i < ptn_; i++) {
				t = X.SC(p+4,12,'CP437').trim(); if(t.length && t != 'Empty') ptns.push(t);
				ch_ = X.U16(p,_BE); if(ch_ > ch) ch = ch_;
				p += 16+4*ch_*X.U16(p+2,_BE);
			} sz = p
		} else bad = bad.addIfNone('!noptns');
		if(ch > 16) bad = bad.addIfNone('!badchn');
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(by,'by: ');
			sOptionT(addEllipsis(inss.filter(funSampleName).join(' ')),'ins/msg:"','"');
			sOptionT(addEllipsis(ptns.join(' ')),'ptns:"','"');
			sOption((ch > 0? 'ch:'+ch+' ': '')+'ord:'+ord+' ptn:'+(ptn!=ptn_?ptn+'/':'')+ptn_+' ins:'+ins+' smp:'+smp
				+' xpos:'+X.I32(0x34)+(sz?' sz:'+outSz(sz):''))
		}
	}

	else if(X.c("'ASG1'") && X.c("'APN1'",0x12C)) {
		sName = "New Beat's Ace Tracker module patterns (.ASG)"; bDetected = 1; bad = '';
		title = X.SC(4,20,'CP437'); by = X.SC(24,20,'CP437'); ptn = ord = 0;
		for(p=0x2C; p < 0x12C; p++) if(t=X.U8(p)) { ord = p-0x2B; if(t > ptn) ptn = t }
		ch = -1; ptns = [];
		for(i=0,p=0x134; i < 0xFF; i++) { // unlike what .am has, .asg saves all 255 patterns
			ch_ = X.U16(p,_BE); if(ch_ > ch) ch = ch_; ptnsz = ch_*X.U16(p+2,_BE); p += 4;
			if(ptnsz) { t = X.SC(p,12,'CP437').trim(); if(t.length && t != 'Empty') ptns.push(t); p += 12+4*ptnsz }
		} sz = p;
		if(ch > 16) bad = bad.addIfNone('!badchn');
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(by,'by: '); sOptionT(addEllipsis(ptns.join(' ')),'ptns:"','"');
			sOption((ch > 0? 'ch:'+ch+' ': '')+'ord:'+ord+' ptn:'+ptn+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'AMC V1.2 REPLAY!'") && X.c("0000003C0002	",0x4E)) {
		// ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/AMComposer/src/AMComposer 1.2_v4.asm
		sName = "Marc Hawlitzeck's A.M. Composer module (.AMC)"; bDetected = 1;
		sVersion = "v"+X.SA(5,3);
		if(X.isVerbose()) {
			d0 = X.U32(0x14,_BE); a3 = X.U32(0x18,_BE); d3 = c = 0; p = 0x48; special = '';
			for(smp = 0; p < X.Sz() && p < a3; p += 16) {
				d2 = X.I32(p,_BE) + 2*X.U16(p+4,_BE); smp++; if(d2 > d3) d3 = d2 }  p = d3;
			if(p < X.Sz()) {
				while(p+c < X.Sz() && isWithin(X.U8(p+c),32,126)) c++;
				if(!X.U8(p+c) && p+c+1 == X.Sz()) c++; special = X.SA(p,c)
			}
			sOption(special,'info:"','"');
			sOption('smp:'+smp+' sz:'+outSz(p+c))
		}
	}

	else if(X.c("'<o'EF'QU'EE'RoR'", 0x426) || X.c("'MaDoKaN96'", 0x426)) {
		//ref http://modland.com/pub/documents/format_documentation/AMusic%20(.amd).txt
		sName = "Elyssis AMUSiC module (.AMD)"; bDetected = 1;
		if(X.SA(0x426,1) != "<") sVersion = "xms rip-off"; else sVersion = '<o∩QUεRoR/ε£¥$$ì$ v101%';
		if(X.U8(0x42F) == 0x11) sVersion = sVersion.appendS('packed','/');
		if(X.isVerbose()) {
			sOptionT(X.SA(0,0x18));
			sOptionT(X.SA(0x18,0x18),"by: ");
			for(i=0,smps=[]; i < 26; i++) smps.push(X.SC(0x30+i*0x22,0x16,'CP437').replaceAll('\xFF',' ').trim())
			sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),0x100,0xA0), 'smp/msg:"','"')
			ptn = X.U8(0x3A5)+1; notes = -1;
			if(X.U8(0x42F) == 0x11) {
				p = 0x430+ptn*18; trk = X.U16(p); p += 2;
				for(i=0; i < trk && p < X.Sz(); i++)
					for(r=0,p+=2; r < 64 && p < X.Sz(); ) if((c=X.U8(p++)) & 0x80) r += c & 0x7F; else { p += 2; r++; notes++ }
				sz = p;
			} else sz = 0x430+ptn*0x6C0;
			sOption("ord:"+X.U8(0x3A4)+" ptn:"+ptn+(sz > 0?' sz:'+outSz(sz):''));
		}
	}

	else if(X.c("'ASYLUM Music Format V1.0'00000000 00000000") && X.U8(0x22) <= 0x40
	  && X.Sz() >= 0xA66+0x800*X.U8(0x23)) {
		sName = "Electronic Arts' ASYLUM Music Format module (.AMF)"; bDetected = 1;
		sVersion = "v"+X.SA(0x15,3);
		if(X.isVerbose()) {
			spd0 = X.U8(0x20); bpm0 = X.U8(0x21);
			smp = X.U8(0x22); ptn = X.U8(0x23); ord = X.U8(0x24);
			p = 0x126;
			var allsmpsz = 0; smps = [];
			for(i=0; i < smp; i++) {
				smps.push(decAnsi(0x126+0x25*i,0x16,CP437,true,Chars0to1F).trim());
				allsmpsz += X.U32(0x126+0x25*i+0x19);
			}
			sz = 0xA66+0x800*ptn+allsmpsz;
			sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),0x100,0xA0), 'smp/msg:"','"')
			sOption("spd0:"+spd0+" bpm0:"+bpm0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" smpsz:"+Hex(allsmpsz)+" sz:"+outSz(sz))
		}
	}

	else if(X.c("'Extreme0'01") && X.U8(0xF) <= 0x20) {
		//ref http://modland.com/pub/documents/format_documentation/Extreme's%20Tracker%20v1.3%20(.ams).txt
		sName = "Extreme's Tracker Advanced Module System track (.AMS)"; bDetected = 1;
		//song tech info
		if(X.isVerbose()) {
			cmd = X.U8(9)>>5; sch = (X.U8(9)&0x1F)+1;
			smp = X.U8(10); ptn = X.U16(11); ord = X.U16(13);
			vmch = X.U8(15); xtra = X.U16(16);
			p = xtra + 18; S = []; allsmpsz = 0;
			for(i=0; i < smp; i++,p+=17) {
				var ssz = X.U32(p); allsmpsz += ssz;
				co = X.U8(p+16)&3; b16 = (X.U8(p+16)&0x80)?2:1; S.push([co,ssz,b16]);
			}
			sOptionT(X.SC(p+1,X.U8(p),'CP437')); p += 1+X.U8(p); //skip title
			smps = []; for(i=0; i < smp; i++) { //store smp names
				smps.push(X.SC(p+1,X.U8(p),'CP437')); p += 1+X.U8(p) }
			schs = []; for(i=0; i < sch; i++) { //store "channel" names
				schs.push(X.SC(p+1,X.U8(p),'CP437')); p += 1+X.U8(p) }
			for(i=0; i < ptn; i++) p += 1+X.U8(p); //skip ptn names
			msg = X.readBytes(p+2,X.U16(p),true/*\0 is a space*/); var msg_ = []; p += 2+X.U16(p);
			for(i=0; i < msg.length; i++) { //RLE
				if(msg[i] < 0x80) msg_.push(msg[i]);
				else if(msg[i] <= 0xA0) /*for(j=0; j < msg[i]-0x80; j++)*/ msg_.push(0x20); //too long
				else msg_.push(0x0A); //this RLE uses too_many_spaces as a line break; let's maybe not
			}
			msg = decEncoding(msg_,'CP437'); delete msg_;
			mptn = -1;
			for(i=0; i < ord; i++) { t = X.U16(p+2*i); if(t > mptn) mptn = t }
			mptn++; p += 2*ord;
			for(i=0; i < ptn; i++) p += 4+X.U32(p);
			allsmpcsz = 0;
			for(i=0; i < smp; i++) if(!S[i][0]) p += 8+S[i][1]*S[i][2]; //non-compressed
			else if(S[i][1]) { //compressed & smp size > 0
				p += 4; scosz = X.U32(p); cc = X.U8(p+4); p += 5+scosz; allsmpcsz += scosz
			}
			delete S;
			sOption(addEllipsis(schs.join(' '),0xA0,0x80),'chns:"','"');
			sOption(addEllipsis(msg.trim(),0x100,0x80),'msg:"','"');
			sOption('ord:'+ord+' ptn:'+ptn+(mptn!=ptn?'/'+mptn:'')+' smp:'+smp+' cmd:'+cmd
				+' strk:'+sch+(vmch?' mtrk:'+vmch:'')+' co.smpsz:'+(allsmpcsz*100/allsmpsz).toFixed(1)+'% sz:'+outSz(p))
		}
	}

	else if(X.c("'AMShdr'1A") && X.U8(7) <= 30 && X.U8(9+X.U8(7)) == 2 && X.U8(8+X.U8(7)) <= 2) {
		//ref http://modland.com/pub/documents/format_documentation/Velvet%20Studio%20v2.2,%20Advanced%20Module%20System%20(.ams).txt
		bDetected = 1; p = 8+X.U8(7); nv = X.U8(p);
		sName = "Velvet Studio Advanced Module System track (.AMS)";
		sVersion = "v"+X.U8(p+1)+'.'+nv;
		bad = '';
		ptn = X.U16(p+3); if(ptn > 1024) bad = bad.addIfNone('!badptn');
		ord = X.U16(p+5);
		if(X.isVerbose()) {
			title = X.SC(8,p-8,'CP437');
			ins = X.U8(p+2);
			p += 7; if(X.Sz() < 36+11+ins*2+ord*2+ptn*4) bad = bad.addIfNone('!short');
			if(nv == 2) {
				bpm0 = Math.max(32<<8, X.U16(p)); p += 2; bpm0 = (bpm0>>8)+'.'+(bpm0&0xFF)
				spd0 = Math.max(1,X.U8(p++)); p += 3; flg = X.U16(p); p += 2
			} else {
				bpm0 = Math.max(32,X.U8(p++)); spd0 = Math.max(1,X.U8(p++)); flg = X.U8(p++)
			}
			ch = (flg >> 6)&1?'2':'1';
			linfreqtbl = (flg & 0x40) ? " lnr.freq.tbl.":"";
			midiused = (flg & 0x80) ? " MIDI used":"";
			sOptionT(title);
			inss = []; smps = []; S = []; allsmpsz = allsmpcsz = smp = shd = 0;
			for(i = 0; i < ins; i++) {
				t_ = X.U8(p++); if(t_ > 30) bad = bad.addIfNone('!badins');
				t = X.SC(p,t_,'CP437').trim(); p += t_; if(t != "") inss.push(t);
				inssmp = X.U8(p++);
				if(inssmp) {
					if(nv == 0) p += 100; else p += 124;
					t = X.U8(p++); if(t > 63) bad = bad.addIfNone('!badenv');
					p += t*3+4; t = X.U8(p++); if(t > 63) bad = bad.addIfNone('!badpan');
					p += t*3+4; t = X.U8(p++); if(t > 63) bad = bad.addIfNone('!badvibenv');
					p += t*3; t = X.U8(p);
					shdins = t > 0; if(shdins) shd++; p += 5;
					for(s = 0; s < inssmp; s++) {
						t_ = X.U8(p++); if(t_ > 22) bad = bad.addIfNone('!badsmp');
						t = X.SC(p,t_,'CP437').trim(); p += t_; //if(t != "") smps.push(t);
						ssz = X.U32(p); p += 4; if(!shdins) smp++;
						if(ssz) {
							if(!shdins) { allsmpsz += ssz; sfl = X.U8(p+15);
								co = sfl&3; b16 = (sfl&4)?2:1; S.push([co,ssz,b16]) }
							p += 16
						}
					}
				}
			}
			t_ = X.U8(p++); sOptionT(X.SC(p,t_,'CP437'),'by:'); p += t_; 
			schs = []; for(i=0; i < 32; i++) { //store "channel" names
				schs.push(X.SC(p+1,X.U8(p),'CP437')); p += 1+X.U8(p) }
			// read the description
			msg = X.readBytes(p+11,X.U32(p)-11); msg_ = []; co = X.U8(p+10); p += X.U32(p);
			if(co) { for(i=0; i < msg.length;) { //RLE
					c = msg[i++];
					if(c == 0xFF && msg.length-i >= 2) {
						c = msg[i++]; n = msg[i++];
						if(c != 0x20) for(j=0; j < n; j++) msg_.push(c);
						else if(n <= 0x20) msg_.push(0x20); //not too many spaces in one
						else msg_.push(0x0A); //too many spaces.
					}
					else msg_.push(c);
				}
				msg = decEncoding(msg_,'CP437');
			} else msg = decEncoding(msg,'CP437');
			delete msg_;
			p += ord<<1; //skip the orderlist
			for(i=0; i < ptn; i++) p += 4+X.U32(p); //skip the patterns
			if(p > X.Sz()) bad = bad.addIfNone('!short');
			for(i=0; i < smp; i++)
				if(!S[i][0]) {
			 		p += S[i][1]*S[i][2]; //non-compressed
				} else if(S[i][1]) { //compressed & smp size > 0
					scosz = X.U32(p+4); cc = X.U8(p+9);
					p += 9+scosz; allsmpcsz += scosz
				}
			sz = p;
			sOption(addEllipsis(schs.join(' '),0xA0,0x80),'chns:"','"');
			sOption(addEllipsis(inss.filter(funSampleName).join(' '),0xA0,0x80),'insts/msg:"','"');
			//sOption(addEllipsis(smps.join(' '),0xA0,0x80),'smps/msg:"','"');
			sOption(addEllipsis(msg.trim(),0xA0),'msg:"','"');
			sOption('ch:'+ch+' ins:'+ins+(shd?'+'+shd+'sh':'')+' ord:'+ord+' ptn:'+ptn+
				' bpm0:'+bpm0+' spd0:'+spd0+linfreqtbl+midiused+
				' co.smpsz:'+(allsmpcsz*100/allsmpsz).toFixed(1)+'% sz:'+outSz(sz))
		}
		if(bad) sVersion = sVersion.appendS('malformed'+bad,'/');
	}

	else if(X.c("'AMX ")) {
		//ref http://and.intercon.ru/releases/audio/xsynth/
		sName = "Dmitry 'AND' Andreev's XSynth module (.AMX)"; bDetected = 1
	}

	else if(X.c("'AON4'") || X.c("'AON8'")) {
		// https://www.exotica.org.uk/wiki/Art_of_Noise
		sName = "Bastian 'Twice' Spiegel's Art of Noise/Chorus module (.AON)"; bDetected = 1; ch = X.U8(3)-0x30;
		if(X.isVerbose()) {
			id = X.SA(4,0x2A);
			p = 0x2E; //header skipped
			t = a = d = c = ''; ord = ptn = ins = 0;
			while (p < X.Sz()) {
				if(X.U8(p) == 0x3F) { p += (4-p) & 3; break }
				hkhd = X.readBytes(p,4); if(charStat(hkhd,1).indexOf('allasc') < 0) break;
				hkhd = decEncoding(hkhd,CP437); hksz = X.U32(p+4,_BE); p += 0x08;
				switch (hkhd) {
					case 'NAME': t = X.SC(p,hksz,'CP1252'); break;
					case 'AUTH': a = X.SC(p,hksz,'CP1252'); break;
					case 'DATE': d = X.SC(p,hksz,'CP1252'); break;
					case 'RMRK': c = X.SC(p,hksz,'CP1252'); break;
					case "PLST": ord = hksz; for(i=0; i < ord; i++) if((o=X.U8(p+i)+1) > ptn) ptn = o; break;
					case 'WLEN': for(i=0; i < (hksz>>2); i += 4) if(X.U32(p+i,_BE)) ins++; break;
				}
				p += hksz;
			}
			sOptionT(t); sOptionT(a,"by: "); sOptionT(d,"on: "); sOption(id,"in: ");
			sOption(addEllipsis(c.trim(),0xA0));
			sOption('ch:'+ch+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' sz:'+outSz(p))
		}
	}

	else if(X.c("'ADRVPACK'")) {
		sName = "Petter A. Urkedal's AProSys module (.APS)"; bDetected = 1
	}

	else if(X.c("'ARP.'")) {
		sName = "Major Tom's Player 2 module (.ARP)"; bDetected = 1
	}

	else if(X.c("'ACTIONAMICS SOUND TOOL'",0x3E)) {
		sName = "Michael Kleps's Actionamics Sound Tool module (.AST)"; bDetected = 1;
		sVersion = "v"+X.SA(0x56,3);
	}

	else if(X.c("08'AST '") && isWithin(X.U8(9), 4,8) && X.U16(0xA) <= 1001) {
		// http://justsolve.archiveteam.org/wiki/All_Sound_Tracker_module
		sName = "Patrice 'Cagliostro' Bouchand's All Sound Tracker module (.AST)";
		sVersion = 'v'+X.SA(5,4); bDetected = 1;
		if(X.isVerbose()) {
			L = X.U16(0x0A);
			info = X.SC(0xC,L+1,'CP850'); p = 0xD+L;
			s = "";
			for(i = 0; i < L; i+=0x26) {
				if((t = info.slice(i,i+0x26).trim()).length) s = s.appendS(t,'\n') //skipping the empty lines
			}
			sOption(addEllipsis(s,0x200));
			ord = X.U8(p++); sz = 0;
			for(i=ptn=0; i <= ord; i++) ptn = Math.max(ptn,X.U8(p++)+1);
			fmp = X.I32(p); awp = X.I32(p+4); ptnp = X.I32(p+8);
			awesonp = X.I32(p+0xC); wavep = X.I32(p+0x10); p += 0x14; sz = Math.max(sz,p);
			for(p=fmp,fmi=0,n=X.U8(p++); n < 0xFF && p < X.Sz(); fmi++) { p += 20; n = X.U8(p++) }
			sz = Math.max(sz,p);
			for(p=awp,awes=0,n=X.U8(p++); n < 0xFF && p < X.Sz(); awes++) { p += 51; n = X.U8(p++) }
			for(awei=0,n=X.U8(p++); n < 0xFF && p < X.Sz(); awei++) { p += 39; n = X.U8(p++) }
			for(awed=0,n=X.U8(p++); n < 0xFF && p < X.Sz(); awed++) { p += 3; n = X.U8(p++) }
			p += 2;//cht = X.U8(p++); revt = X.U8(p++);
			p += 9*(14+9) + 9*(56+9)+1; sz = Math.max(sz,p);
			for(p=ptnp,ptn_=0,n=X.U8(p++); n < 0xFF && p < X.Sz(); ptn_++) { p += 2+X.U16(p); n = X.U8(p++) }
			sz = Math.max(sz,p);
			for(p=wavep,wf=0,n=X.U8(p++); n < 0xFF && p < X.Sz(); wf++) { p += 36; n = X.U8(p++) }
			sz = Math.max(sz,p); if(sVersion === 'v0001') sz--; //v01 doesn't have the finalising FF, so EoF is how it ends
			sOption('def:'+X.U8(9)+' ord:'+ord+' ptn:'+ptn+(ptn_!=ptn?'/'+ptn_:'')   +' wavep:'+Hex(wavep)
				+(fmi?' FMins:'+fmi:'')+(awes?' AWEsmp:'+awes:'')
				+(awei?' AWEins:'+awei:'')+(wf?' wf:'+wf:'')+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'AudioSculpture10'00180018")) {
		sName = "Synchron Assembly's Audio Sculpture synth file (.AS)"; bDetected = 1
	}

	else if(X.c("'##synth'0D0A")) {
		sName = "Athaudia's Athtune module (.ATHTUNE)"; bDetected = 1
	}

	else if(X.c("'FORM'.... ....'AXSFUSER'") && X.c("'SHDR'", t=X.U32(0x10,_BE)+0x14)
	  && X.c("'SONG'",X.U32(t+4,_BE)+t+8)) {
	  	//ref https://web.archive.org/web/20141129231503/http://www.resolutionaudio.nl/
		sName = "Resolution's AXS module (.AXS)"; bDetected = 1;
		if(X.isVerbose()) {
			for(ord=ptn=ins=smp=0,sz=X.U32(4,_BE)+8,p=0xC,maxsz=Math.min(sz,X.Sz()); p < maxsz;) {
				hkhd = X.readBytes(p,4); if(charStat(hkhd,1).indexOf('allasc') < 0) break;
				hkhd = decEncoding(hkhd,CP437); hksz = X.U32(p+4,_BE); p += 8;
				switch(hkhd) {
				case 'SONG': ord = hksz >> 3; break;
				case 'BLOK': ptn++; break;
				case 'INST': ins++; break;
				case 'SAMP': smp++; break
				}
				p += hksz
			}
			sOption('ord:'+ord+' ptn:'+ptn+(ins?' syn:'+ins:'')+(smp?' smp:'+smp:'')+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'BBSONG'00'0001'00")) {
		//ref https://github.com/atsidaev/beepola/blob/master/STSong.pas etc.
		sName = "Shiru's Beepola module (.BBSONG)"; bDetected = 1;
		p = 0xC; var layouttag = false;
		ord = orn = ptn = svgptn = svgwarp = phains = 0; bad = title = auth = engine = '';
		while(p < X.Sz()) {
			if(p >= X.Sz()) break;
			if(X.U8(p++) != 0x3A) { p--; break }
			t = X.SA(p,254); p += t.length+1;
//_log(t+' @'+Hex(p));
			switch(t) {
			case 'INFO':
				for(; p < X.Sz();) {
					t = X.SC(p,TOEOF,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'Title': title = xx[1]; break;
					case 'Author': auth = xx[1]; break;
					case 'Engine': engine = xx[1]; break;
					}
				}
				break;
			case 'LAYOUT':
				layouttag = true;
				while(p < X.Sz()) {
					t = X.SC(p,TOEOF,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'LoopStart': lp = +xx[1]; break;
					case 'Length': ord = +xx[1]; ptn = 0;
						for(i=0; i < ord; i++) if(ptn <= (t=X.U8(p++))) ptn = t+1; break;
					}
				}
				break;
			case 'PATTERNDATA':
				while(p < X.Sz()) {
					t = X.SC(p,0x400,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'PatternCount': ptns = +xx[1];
						for(i = 0; i < ptns && p < X.Sz(); i++) {
							t = X.SC(p,0x500,'CP1251'); p += t.length + 1; if(t === ':END') break;
							xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
							if(xx[0] === 'PatternName') p += 8+5*X.U32(p);
						}
						break;
					}
				}
				break;
			case 'SVGPATTERNDATA':
				while(p < X.Sz()) {
					t = X.SC(p,0x400,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'PatternCount': svgptn = +xx[1];
						for(i = 0; i < svgptn && p < X.Sz(); i++) p += 4+16*X.U32(p);
						break;
					}
				}
				break;
			case 'SVGWARPDATA':
				while(p < X.Sz()) {
					t = X.SC(p,0x400,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'PatternCount': svgwarp = +xx[1];
						for(i = 0; i < svgwarp && p < X.Sz(); i++) p += 4+2*X.U32(p);
						break;
					}
				}
				break;
			case 'P1INSTR':
				while(p < X.Sz()) {
					t = X.SC(p,0x400,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'Length': phains = +xx[1]; p += phains; break;
					}
				}
				break;
			case 'SVGORNAMENTS':
				while(p < X.Sz()) {
					t = X.SC(p,0x400,'CP1251'); p += t.length + 1; if(t === ':END') break;
					xx = t.split('='); if(xx.length > 2) xx = [xx[0], xx.slice(1,xx.length).join('=')];
					switch(xx[0]) {
					case 'OrnamentCount': orn = +xx[1];
						for(i = 0; i < orn && p < X.Sz(); i++) p += 4+X.U32(p);
						break;
					}
				}
				break;
			default: bad = bad.addIfNone('!badchunk')
			}
//_log('   ...ends @'+Hex(p));
		}
		if(!layouttag) bad = bad.addIfNone('!corrupt');
		sVersion = 'engine:'+engine; if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(auth,"by: ");
			sOption('ord:'+ord+(lp?' lp:'+lp:'')+' ptn:'+ptn+(svgptn?'+svg':'')
				+(svgwarp?' warp':'')+(orn?' orn':'')+(phains?' phasers':'')+' sz:'+outSz(p))
		}
	}

	else if(X.c("000003F3") && X.U8(0x14)
	  && X.c("70FF4E75'DAGLISH!'",0x20)
	  && X.U32(0x2C,_BE) && X.U32(0x30,_BE)
	  && X.U32(0x34,_BE) && X.U32(0x38,_BE)) {
		bDetected = 1;
		sName = "Ben Daglish's SID (.BDS)"; sVersion = "v1.1";
		if(X.isVerbose()) {
			title = X.SA(0x20+X.U32(0x3C,_BE),0x100);
			auth = X.SA(0x20+X.U32(0x40,_BE),0x100);
			misc = X.SA(0x20+X.U32(0x44,_BE),0x100);
			sOptionT(title);
			x = X.U32(0x38,_BE); if(x > 1) sOption(x,"×");
			sOptionT(auth,"by: ");
			sOptionT(misc);
		}
	}

	else if(/BMF1\.[012]/.test(X.SA(0,6)) && X.Sz() > 8 && X.fSig(6,42,"00") > 6) {
		//ref https://github.com/adplug/adplug/blob/master/src/bmf.cpp
		sName = "The Brain's Easy Adlib module (.BMF)"; sV = X.SA(5,1);
		sVersion = "v1."+sV; bDetected = 1;
		if(X.isVerbose() && sV > '0') {
			p = 6; bad = title = author = "";
			f = X.fSig(p,-1,"00");
			title = X.SA(p,f-p); p += title.length+1; //read title
			f = X.fSig(p,-1,"00"); if(f > 0) {
			author = X.SA(p,f-p); p += author.length+1; //read author
			spd = X.U8(p++);
			if(X.isDeepScan()) {
				fl = X.U32(p); p += 4; ins = 0;
				for(i = 0; i < 32; i++) {
					if(fl&1) { p += 24; if(p > X.Sz()) bad = bad.addIfNone('!short') } fl >>= 1; ins++
				}
				fl = X.U32(p); p += 4; const last = 1023;
				trk = 0; trkend = false;
				for(i = 0; i < 32; i++) {
					if(fl&1) { trk++; trkend = false;
						for(q = 0; p < X.Sz() && !trkend && q <= last; q < last && q++) {
							t = X.U8(p++);
							switch(t) {
							case 0xFE: trkend = true; break; //end of reader
							case 0xFC: case 0x7D: break;  //set marker, loop to marker
							default:
								evnote = t & 0x7F; if(!(t & 0x80)) break;
								t = X.U8(p);
								if(t & 0x80) {
									evdly = t & 0x3F; p++; if(!(t & 0x40)) break;
								}
								t = X.U8(p++);
								if(0x40 <= t) { evvol = t+1-0x40; }
								else if(0x20 <= t && t <= 0x3F) { evins = t+1-0x20; }
								else {
									if(sV == '2') if(1 <= t && t <= 6) p++
								}
							}
						}
					}
					fl >>= 1
				}
				if(!trkend) { bad = bad.addIfNone('!short'); p = -1 }
			}//if deepscan
			}//if author is null-terminated
			else bad = bad.addIfNone('!badtags');
			if(bad != "") sVersion = sVersion.appendS('malformed'+bad,'/');
			sOptionT(title); sOptionT(author,'by: ');
			sOption('spd:'+spd+(X.isDeepScan()?' trk:'+trk+' ins:'+ins+' sz:'+outSz(p):''));
		}
	}

	else if(X.Sz() > 0x180 && X.c("'Buzz'") && isWithin(X.U32(4),1,0xC) && X.c("7C010000",0xC) && X.fSig(8,0x40,"'MACH'") > 0) {
		sName = "Oskari Tammelin's Jeskola Buzz module (.BMX)";  bDetected = 1;
		// Do NOT waste time trying to extract anything else...
		// You'll find the format dox lie and formats differ
		// For example, the no. of machines overlaps with some beta's version string
		// For example, that beta has no float x/y coordinates
		// And there is no signature difference.
	}

	else if(X.Sz() >= 0x6E5C && X.c("0100'ADLIB'9D02A0021C000000") && X.adler32(0,0x6E5C) == 0x1DF2E9B9) {
		sName = 'Instrument bank for Adlib Visual Composer (STANDARD.BNK)'; bDetected = 1;
		if(X.isVerbose()) sOption(outSz(0x6E5C),'sz:')
	}

	else if(X.c("'BRTF'") && ['NAME','INFO'].includes(X.SA(8,4))) {
		sName = "Benjamin 'BeRo' Rousseaux's BeRoTracker module (.BRT)"; bDetected = 1;
		if(X.isVerbose()) {
			p = 8; t = c = q = ''; instmsg = []; sainmsg = [];
			ins = smp = ptn = ord = 0; //TODO figure out how to get ptn
			bpm0 = spd0 = st0 = mvol = rowsperbeat = hltu = hltd = 0; end = false;
			while (!end && p < X.Sz()) {
				hkhd = X.SA(p,4);
				hksz = X.U32(p+4,_LE);
				p += 8;
				switch (hkhd) {
					case "NAME": t = X.UCSD(p); break;
					case "MESS": c = X.SC(p+2,X.U32(p,_LE),'CP1252'); break;
					case "BPMI": rpb = X.U8(p); break;
					case "INFO":
						spd0 = X.U8(p+4); bpm0 = X.U8(p+5);
						st0 = X.U8(p+6); mvol = X.U8(p+10);
						break;
					case "PORD": ord = X.U8(p); break;
					case "PATT": ptn++; break;
					case "PAIN": hltu = X.U8(p+1); hltd = X.U8(p+2); break;
					case "SAIN":
						smp++;
						q = X.UCSD(p+2); if(q.trim().length) sainmsg.push(q);
						break;
					case "INST":
						if(X.U8(p)) ins++;
						q = X.UCSD(p+1); if(q.trim().length) instmsg.push(q);
						break;
					case "DONE": end = true; break;
				}
				p += hksz;
			}
			sOption(t); sOption(c);
			sOption(instmsg.filter(funSampleName).join("\n"),"ins/msg:\n");
			sOption(sainmsg.filter(funSampleName).join("\n"),"smp/msg:\n");
			sOption('bpm0:'+bpm0+' spd0:'+spd0+' ord:'+ord+' ins:'+ins+' smp:'+smp+' hlt:'+hltu+'/'+hltd+
				' RPB:'+rpb+' st.sep0:'+st0+' mixvol:'+mvol+' sz:'+outSz(X.U32(4)+8));
		}
	}

	else if(X.c("01000000") && isWithin(X.U8(4),1,0xF) && X.c("FFFFFFFF",0x34)
	  && X.c("1027",0x15C) && X.c("1027",0x164) && X.c("1027", 0x16C)) {
		sName = "Christer Andersson's BoyScout module (.BSF)"; bDetected = 1
	}

	else if(X.c("'FUCO'") && X.c("'DIGI'",0x4404) && X.c("'DIGP'",0x47F8)) {
		sName = "Anthony J. 'Slates' Bybell's BSI Future Composer module (.BSI)"; bDetected = 1;
		bad = '';
		for(smp=smpsz=i=0; i < 63; i++) {
			if(t=X.U32(0x440C+i*16,_BE)) smp++; smpsz += t;
			if(t > 0x20000) bad = bad.addIfNone('!badsmpsz')
		} if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOption('smp:'+smp+' sz:'+outSz(0x47FC+smpsz))
		}
	}

	else if(X.c("'NuBEATHOVEN'",0x22)) {
		bDetected = 1;
		sName = "Thomas 'Dr.Nobody' Lopatic's Beathoven Synthesizer (.BSS)";
		sVersion = "v"+X.SA(0x2D,3);
		if(X.isVerbose()) {
			title = X.SA(0x6C,0x100);
			auth = X.SA(0x6C+title.length+1,0x100);
			misc = X.SA(0x6C+title.length+auth.length+2,0x100);
			sOptionT(title);
			sOptionT(auth,"by: ");
			sOptionT(misc);
		}
	}

	else if(X.c("'CBA'F9") && X.U8(0x24) == 0x1A && 0x14C+X.U16(0x25)+X.U8(0x29)*0x30 <= X.Sz()
	  && isWithin(X.U8(0x27),1,32) && X.U8(0x2B) && X.U8(0x2C) >= 32) {
		sName = "Chuck Biscuits & Zenic/Heretics' module (.CBA)"; bDetected = 1;
		if(X.isVerbose()) {
			msglen = X.U16(0x25); ch = X.U8(0x27); ptn = X.U8(0x28)+1; ord = X.U8(0x29);
			smp = X.U8(0x2A); spd0 = X.U8(0x2B); tmp0 = X.U8(0x2C);
			for(i=smpsz=0; i < smp; i++) smpsz += X.U32(0x14C+i*0x30+0x24);
			sz = 0x14C + smp*0x30 + ptn*64*5*ch + smpsz;
			msg = X.SC(sz,msglen,"CP437").trim(); sz += msglen;
			sOptionT(X.SA(4,0x20)); //some sample names have user messages but few, no good way to tell
			sOption(addEllipsis(msg,0xC0,0xA0),'msg:"','"');
			sOption('spd:'+spd0+' tempo:'+tmp0+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'<CUD-FM-File>'1ADEE0") && (!X.U8(0x13) && X.c("'CUD-FM-File - SEND A POSTCARD -'",0x601)
	  || X.U8(0x13) && X.c("'YsComp'07'CUD1997'1A04",0x20))) {
		//ref https://github.com/adplug/adplug/blob/master/src/cff.cpp
		sName = "Daniel Eshcbach/CUD's Boom Tracker 4 module (.CFF)"; sVersion = 'v'+X.U8(0x10); bDetected = 1; 
		if(X.U8(0x13)) sVersion += '/LZW-packed';
		if(X.isVerbose()) sOption(outSz(0x20+X.U16(0x11)),'sz:')
	}

	else if(X.c("'CHIPv1.0'")) {
		//ref http://alonecoder.nedopc.com/zx/CHIP14SRC.rar / chip
		sName = "Dmitry 'Alone Coder' Bystrov's Chip Tracker module (.CHI)"; bDetected = 1;
		sVersion = "v"+X.SA(5,1); bad = ''; if(X.Sz() <= 0x100) bad = bad.addIfNone('!badsz');
		ptn = smp = 0; tempo = X.U8(0x28); ord = X.U8(0x29)+1; lp = X.U8(0x30);
		for(i=0; i < ord; i++) { p = X.U8(0x100+i)+1; if(p > ptn) ptn = p; if(p > 31) bad = bad.addIfNone('!badord') }
		sz = 0x200+0x200*ptn;
		for(i=0; i < 16; i++) if(ssz = X.U16(45+i*4)) { smp++; sz += ssz; if(sz&0xFF) sz += 0x100-(sz & 0xFF) }
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(decAnsi(8,0x20,CPSpeccy,false,Chars0to1FSpeccy));
			sOption('tempo:'+tempo+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
		}
	}

	else if(X.c("000003F3") && X.c("70FF4E75'S.PHIPPS'",0x20) &&
	  0 < X.I32(0x40,_BE) < X.Sz() && 0 < X.I32(0x44,_BE) < X.Sz() ) {
		sName = "Simon Phipps/Core Design module (.CORE)"; bDetected = 1;
		if(X.isVerbose()) {
			title = X.SA(0x68,0x100);
			auth = X.SA(0x68+title.length+1,0x100);
			misc = X.SA(0x68+title.length+auth.length+2,0x100);
			sOptionT(title);
			sOptionT(auth,"by: ");
			sOptionT(misc);
		}
	}

	else if(X.c("'CAT '................'FORM'")) {
		sName = "Andreas Öman's Cybertracker module (.CT)"; bDetected = 1;
	}

	else if(X.c("0004'NNTRKMZX'")) {
		sName = "CyberBrain's Cybertracker C64 module (.CT)"; bDetected = 1;
		//ref https://noname.c64.org/download.php/ctmisc/ctfileformat-1_01.html
		sVersion = "v"+X.U8(0x0B)+"."+X.U8(0x0A);
		if(X.isVerbose()) {
			for(sng=0; sng < X.U16(0x4B9,_LE); sng++)
				if(X.U8(0x4BB+sng-1) == 0) break;
			if(sng) {
				sng0ord = X.U8(0x4BB);
				loop0 = X.U8(0x6BD);
				if(sng > 1) sOption("×"+sng+" ord0:"+sng0ord+" loop0:"+loop0);
				else sOption(" ord:"+sng0ord+" loop:"+loop0)
			}
			else sOption("empty");
		}
	}

	else if(X.c("0004'NNTRKINS'")) {
		sName = "CyberBrain's Cybertracker C64 instrument (.CI)"; bDetected = 1;
		sVersion = "v"+X.U8(0x0B)+"."+X.U8(0x0A);
		if(X.isVerbose())
			sOptionT(X.SA(0x1A,0x10))
	}

	else if(X.c("000003F3") && (X.fStr(0x20,0x100,"NuDELIRIUM") > 0)) {
		sName = "DeliTracker player addon or Amiga Custom Module (.CUST)"; bDetected = 1;
		sVersion = "CustomPlay";
		if(X.isVerbose())
			sOptionT(X.SA(X.fStr(0,0x100,"NuDELIRIUM")+20,0x100))
	}

	else if(X.c("'JCH'26026601") && X.c("'Creative Voice File'1A1A000A01291101......C300",0x40)) {
		sName = "Jens Christian 'JCH/Vibrants' Huus's Edlib Tracker samples (.S01)"; bDetected = 1
	}

	else if(X.Sz() < 0xFFFF && (X.c("'JCH'26 026600") || X.c("'JCH'26 026680"))
	  && (X.c("FFFF",X.U16(0x71,_LE)-2) || X.c("FFFF",X.U16(0x73,_LE)-2))) {
		//ref http://ftp.modland.com/pub/documents/format_documentation/Edlib%20Tracker%20(.edl,%20.d00,%20.d01).txt
		msgp = 0; i = 0; //bruteforce-find the message at the end of the file (version-dependent)
		while (i < 4) { t = X.U16(0x71+i,_LE); if(t != 0xFFFF && t > msgp) msgp = t; i += 2 }
		sz = X.fSig(msgp,TOEOF,"FFFF")+2;
		bDetected = 1; bad = 0;
		sName = "Jens Christian 'JCH/Vibrants' Huus's Edlib Tracker module (.D00,.D01)";
		sVersion = "v"+X.U8(7);
		//if(X.U8(6) == 4) bad = 1;
		if(X.U8(0xA) > 1) bad = 1;
		if(bad) sVersion += "/malformed"+bad;
		if(X.isVerbose()) {
			x = X.U8(9);
			sOptionT(X.SC(0x0B,0x20,'CP850'));
			if(x > 1) sOption(x,"×");
			sOptionT(X.SC(0x2B,0x20,'CP850'),"by: ");
			sOptionT(X.SC(msgp,sz-msgp-2,'CP850'));
			sOption(outSz(sz),"sz:")
		}
	}

	else if(X.c("'DBM0'........'NAME'0000002C") && X.U8(4) < 4
	  && X.c("'INFO'0000000A",0x3C) && X.c("'SONG'",0x4E)
	  && X.U16(0x44,_BE) <= 255 && X.U16(0x46,_BE) <= 255
	  && X.U16(0x4A,_BE) <= 1024 && X.U16(0x4C,_BE) >=4
	  && X.U16(0x4C,_BE) <= 254 && !(X.U16(0x4C,_BE)%1)) {
		// ref http://www.digibooster.de/en/format.php
		// & https://www.amigafuture.de/app.php/dlext/details?df_id=5071
		sName = "APC&TCP/Andeas Magerl's DigiBooster Pro module (.DBM)"; bDetected = 1;
		sVersion = "v"+X.U8(4)+"."+X.U8(5).padStart(2,'0');
		p = 8; done = gotinfo = false; bad = ""; if(X.isVerbose()) ord = []; insts = []; titles = [];
		while(!done && p < X.Sz()) {
			hkhd = X.SA(p,4); hksz = X.U32(p+4,_BE); p += 8;
			switch(hkhd) {
			case "INFO": x = X.U16(p+4,_BE); ins = X.U16(p,_BE);
				info = "ch:"+X.U16(p+8,_BE)+" ptn:"+X.U16(p+6,_BE)
				+" ins:"+ins+" smp:"+X.U16(p+2,_BE);
				gotinfo = true;
				break;
			case "SONG": if(!gotinfo) { bad = bad.addIfNone("!badchunkorder"); break }
				if(!X.isVerbose()) break; q = 0;
				while(q+44 < hksz) { t = X.SC(p+q,44,'CP1250').trim(); titles.push(t);
					q += 44; ord.push(X.U16(p+q,_BE)); q += 2+ord[ord.length-1]*2 }
				break;
			case "INST": if(!gotinfo) { bad = bad.addIfNone("!badchunkorder"); break }
				for(i = 0; i < ins; i++) {
					t = X.SA(p+i*50,34).trim(); if(t != "") insts.push(t);
					c3freq = X.U32(p+i*50+34,_BE);
					if(c3freq < 2000 || c3freq > 192000) bad = bad.addIfNone("!badc3freq");
				} break;
			case "SMPL": if(!gotinfo) bad = bad.addIfNone("!badchunkorder"); done = true
			}
			p += hksz;
		}
		if(!done || p > X.Sz()) bad = bad.addIfNone("!short");
		if(bad != "") sVersion = sVersion.appendS("malformed"+bad,"/");
		if(X.isVerbose()) {
			title = X.SA(0x10,0x2C).trim(); sOption(title);
			sOption(titles.join("; "),(!title && title.length == 1 ? "songs:" : ""));
			if(title == "" && !titles.length) sOptionT(X.SA(0xD8,28));
			if(x > 1) sOption(x,"×");
			sOptionT(addEllipsis(insts.join(" "),0x100,0xA0),'smp/msg: "','"');
			info = "ord:"+ord.join("+")+" "+info; sOption(info+" sz:"+outSz(p))
		}
	}

	else if(X.c("'DSNGSEQU'00")) {
		sName = "David Hanney's module (.DH)"; bDetected = 1
	}

	else if(X.c("'DIGI Booster module'00") && X.Sz() >= 0x624 && X.U8(0x19)
	  && X.U8(0x19) <= 8 && X.U8(0x2F) <= 0x7F) {
		sName = "APC&TCP/Andeas Magerl's DigiBooster module (.DIGI)"; bDetected = 1;
		nV = X.U8(0x18); sVersion = "v"+(nV>>4)+"."+(nV&0xF); co = X.U8(0x1A);
		if(sVersion != X.SA(0x14,4).toLowerCase()) sVersion += '/"'+X.SA(0x14,4)+'"';
		if(co) sVersion = sVersion.appendS("co.ptn","/");
		if(X.isVerbose()) {
			sOptionT(decAnsi(0x262,0x20,CPAmiga,true)); msg = []; ch = X.U8(0x19);
			ord = X.U8(0x2F)+1; ptn = X.U8(0x2E)+1;
			smp = ssz = 0;
			for(i=0; i < 31; i++) {
				slen = X.U32(0xB0+4*i,_BE);
				if(slen) { smp++; ssz += slen }
			}
			for(i=0; i < 31; i++)
				msg.push(decAnsi(0x282+0x1E*i,0x1E,CPAmiga,true).trim());
			sz = 0x624;
			if(co) for(i=0; i < ptn && sz <= X.Sz(); i++) sz += 2+X.U16(sz,_BE);
			else sz += 0x100*ptn*ch;
			sz += ssz;
			if(sz > X.Sz() && !X.isVerbose()) sVersion = sVersion.appendS("malformed!short","/");
			sOptionT(addEllipsis(msg.filter(funSampleName).join(" "),0x100,0xA0),'by/msg: "','"');
			sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz))
		}
	}

	else if(X.c("000003F3") && X.c("70FF'NuUNCLEART'",0x20)
	  && X.U8(0x14) && X.U32(0x2C,_BE)
	  && X.U32(0x30,_BE) && X.U32(0x38,_BE)) {
		sName = "Dave 'Uncle Tom' Lowe module (.DL)"; bDetected = 1;
		if(X.isVerbose()) {
			smpip = 0x20+X.U32(0x3C,_BE);
			smpiep = 0x20+X.U32(0x40,_BE);
			if(!smpiep) smp = 0;
			else smp = Math.floor((smpiep-smpip)/14);
			title = X.SA(0x20+X.U32(0x50,_BE),0x100);
			auth = X.SA(0x20+X.U32(0x54,_BE),0x100);
			cmt = X.SA(0x20+X.U32(0x58,_BE),0x100);
			loadsz = 0x20+X.U32(0x5C,_BE);
			sz = 0x20+X.U32(0x60,_BE);
			sza = Hex(X.Sz()-sz); //TODO value different, why? Where does it start?
			smpsz = 0x20+X.U32(0x64,_BE);
			songsz = 0x20+X.U32(0x68,_BE);
			sfx = 0x20+X.U32(0x6C,_BE);
			x = 1;
			d1 = 0x20+X.U32(0x4C,_BE);
			if(d1) {
				a1 = d1;
				while(1) {
					a1 += 16;
					d1 = X.U32(a1,_BE);
//_log("read(0x20+a1:"+Hex(a1)+") = "+Hex(d1));
					if(!d1) break;
					d1 -= X.U8(a1+3);
					if(!d1) break; else x++
				}
			}
			sOptionT(title);
			if(x > 1) sOption(x,"×");
			sOptionT(auth,"by: ");
			sOptionT(cmt);
			sOption("smp:"+smp+" sfx:"+sfx)//+" sz:"+outSz(sz)+" a:"+sza+" smpsz:"+smpsz+" songsz:"+songsz+" loadsz:"+loadsz);
		}
	}

	else if(X.c("'ALL '0000 .... 0000") && X.U8(6) <= 1 && X.U8(10) <= 1) {
		sName = "Bent 'SHOGUN' Nielsen's Delta Music module (.DM)"; sVersion = 'v1.3'; bDetected = 1
	}

	else if(X.c("4A00670003B40C000001670001EC0C000002670A0C000003671270004E7541FA0B680201003F11",4)
	  && X.c("0000'.FNL'",0xBC4)) { //the module data begins at 878h
		sName = "Bent 'SHOGUN' Nielsen's Delta Music 2 module (.DM2)"; sVersion = 'v2.0'; bDetected = 1
	}

	else if(X.c("'DMF'0E")) {
		sName = "Webfoot Digital Sound and Music Interface Advanced Music Format hack (.DMF)";
		sOption("delta samples & no text"); bDetected = 1
	}

	else if(X.c("'DDMF'") && X.U8(4) && X.U8(4) <= 10
		&& X.U16(0x3F) && X.c("'CMSG'", 0x42)) {
		//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_dmf.cpp
		sName = "D-Lusion X-Tracker module (.DMF)"; bDetected = 1;
		nV = X.U8(4); sVersion = "v"+nV;
		p = 0x42; hkhd = hksz = end = lpst = ch = ord = ptn = smp = sz = ptntotallen =  allsmpsz = 0; lped = 0xFFFF;
		while(hkhd != "ENDE" && p < X.Sz()) {
			hkhd = X.SA(p,4); hksz = X.U32(p+4); p += 8;
//_log("@"+Hex(p-4)+" "+hkhd+" ["+Hex(p)+" -> "+Hex(p+hksz)+"]");
			switch(hkhd) {
			case "SEQU": ord = 0;
				if(nV == 3) p += 2; else if(nV == 4) p += 4;
				u = p;
				if(nV >= 3) { lpst = X.U16(u); u += 2 }
				if(nV >= 4) { lpst = X.U16(u); u += 2 }
				if(nV === 4 & !lped) lped = 0xFFFF;
				ord = (p+hksz-u)>>1; break;
			case "PATT":
				var ptnhdsz = nV < 3 ? 9 : 8; u = p;
				ptn = X.U16(u); trk = X.U8(u+2); u += 3;
				ch = trk; if(ch < 1) ch = 1; if(ch > 32) ch = 32;
				for(i = 0; i < ptn; i++) {
					u += ptnhdsz-4;
					var ptnlen = X.U32(u); ptntotallen += ptnlen; u += ptnlen;
				}
				break;
			case "SMPI": u = p; smp = X.U8(u++);
				for(i = 0; i < smp; i++) {
					var snamelen = nV < 2 ? 30 : X.U8(u++);
					var sname = X.SC(u,snamelen,'CP437').trim(); u += snamelen;
					var ssz = X.U32(u); allsmpsz += ssz;
//_log("slen @"+Hex(u)+" = "+Hex(slen));
					u += 4+4+4+2;
					var svol = X.U8(u++), sf = X.U8(u++);
//_log("smp["+i+"] "+sname+" length:"+Hex(slen)+" total:"+Hex(smptotallen)+(svol?"":" ignored"));
					if(nV >= 8) { var libname = X.SC(u,8,'CP437'); u += 8 }
					u += nV > 1 ? 6 : 2;
				}
				break;
			case "SMPD":
				if(!X.c("'ENDE'",p+hksz)) {
					// Simply search for it. It's unique enough.
					// The multiplier of 3 is chosen for stereo + white noise "compression"
					t = X.fSig(p,Math.min(X.Sz()-p, allsmpsz*3),"'ENDE'");
					if(t < 0) { sVersion += "/malformed!noeof"; hkhd = "ENDE"; break }
					else {
						hksz = t-p;
//_log("SMPD length should be "+Hex(hksz));
					}
				}
				break;
			case "ENDE": p -= 4+hksz; break;
			}
			sz = p;
			p += hksz;
		}
		if(hkhd != "ENDE") sVersion += "/malformed!short"; else sz = p;
		if(X.isVerbose()) {
			sOptionT(X.SC(0xD,30,'CP437'));
			sOptionT(X.SC(0x2B,20,'CP437'),"by: ");
			yy = X.U8(0x41);
			if(yy < 80) yyyy = "20"; else yyyy = "19"; yyyy += yy.padStart(2,'0');
			sOptionT(yyyy+"-"+X.U8(0x40).padStart(2,'0')+
				"-"+X.U8(0x3F).padStart(2,'0'),"on: ");
			sOptionT(X.SA(5,8),"in: ");
			cmt = ""; cnt = X.U32(0x46)-1; var linelen = 40, readpos = 0x4B;
			while(cnt) {
				var readlen = Math.min(cnt,linelen,0x200);
				var curline = X.SC(readpos,readlen,'CP437');
				if(curline != "") cmt = cmt.appendS(curline,'\n');
				cnt -= readlen; readpos += readlen;
			}
			sOption(addEllipsis(cmt,0x100,0x80));
			sOption("ch:"+ch+"+1 ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz))
		}
	}

	else if(X.c("'.DelekDefleMask.'")) {
		//ref https://web.archive.org/web/20150226185703if_/http://www.delek.com.ar:80/soft/deflemask/DMF_SPECS.txt
		// It's a pretty damn old document though...
		sName = "Leonardo Demartino's DeFleMask module (.DMF)"; bDetected = 1;
		sVersion = "v"+X.U8(0x10);
		if(X.isVerbose()) {
			switch(X.U8(0x11)) { //TODO add more new chip versions
			case 0x01: sVersion += "#YMU759"; ch = 17; break;
			case 0x02: sVersion += "#Genesis (10ch)"; ch = 10; break;
			case 0x03: sVersion += "#SMS (4ch)"; ch = 4; break;
			case 0x04: sVersion += "#GameBoy (4ch)"; ch = 4; break;
			case 0x05: sVersion += "#PCEngine (6ch)"; ch = 6; break;
			case 0x06: sVersion += "#NES (5ch)"; ch = 5; break;
			case 0x07: case 0x47: sVersion += "#C64 (3ch)"; ch = 3; break;
			case 0x08: sVersion += "#YM2151 (13ch)"; ch = 13; break;
			default: ch = 4 //just 'cause
			}
			sOption(X.UCSD(0x12));
			l = X.U8(0x12); p = 0x12+l+1;
			sOption(X.UCSD(p),"by: ");
			l = X.U8(p); p += l+1+2;
			tbase = X.U8(p++);
			tick1 = X.U8(p++); tick2 = X.U8(p++);
			Hz = X.U8(p++)?"60(NTSC)":"50(PAL)";
			if(X.U8(p++)) Hz = X.U8(p++)+":"+X.U8(p++)+":"+X.U8(p++);
			else p+=3;
			//These have changed over the years it seems, TODO: RE it
			//p++; _ripm = X.U8(p++);
			//arptick = X.U8(p++); p += ch*_ripm;
			//ins = X.U8(p++);
			sOption("tbase:"+tbase+" tck:"+tick1+":"+tick2+" freq:"+Hz); //+" ins:"+ins+" arp.tick:");
		}
	}

	else if(X.c("' M'........'IAN'") && X.c("0000....0000....0000....0000",0x1C) && (smp=X.U32(0x44,_BE)) <= 255
		&& ( !((smpsz=X.U32(0x48,_BE)) && !smp) || (smp && smpsz) ) && isWithin(ins=X.U32(0x3C,_BE),1,255)) {
		sName = "Reinier 'Rhino' van Vliet's Digital Mugician module (.DMU,.MUG)";
		if((sv=X.SA(9,1)) == '/') sVersion = 'v1'; else if(sv == '2') sVersion = 'v2'; bDetected = 1;
		if(X.isVerbose()) {
			x = ord = 0; ptn = X.U16(0x1A,_BE); wf = X.U32(0x40,_BE);
			for (i=0x4C, p = 0x1C, a2 = 0xCC; i < 0xCC; i += 0x10, p += 4) {
				if(!X.U32(i,_BE)) break; if(X.U32(p,_BE) != 1 || X.U32(a2,_BE) || X.U32(a2+4,_BE)) x++;
				a2 += X.U32(p,_BE) << 3;
				t = X.SA(i+4,12); while(t[t.length-1] < ' ') t = t.slice(0,t.length-1); sOptionT(t)
			}
			for(i=0x1C; i < 0x3C; i += 4) ord += X.U32(i,_BE);
			sz = smp*0x20+ins*0x10+smpsz+0x1CC+ptn*0x100+wf*0x80+ord*8;
			if(x > 1) sOption(x,'×');
			sOption('ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp/syn:'+smp+'+'+wf+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'DSM'10") && X.c("1A",0x24) && X.U16(0xB2)-X.U16(0xB0) == 4
	  && X.c("'DSI'10",X.U16(0xB0) << 4) && X.c("'DSI'10",X.U16(0xB0+X.U8(0x27)*2-2) << 4)) {
	  	//see also https://modland.com/pub/documents/format_documentation/Digital%20Audio%20Sound%20Interface%20Kit%20spec%20(.dsm)-v0.1.txt
		sName = "Carlos Hasan's Digital Audio Sound Interface Kit module (.DSM)"; bDetected = 1;
		if(X.isVerbose()) {
			for(i=0xAF; i >= 0x30 && X.U8(i) == 0xFF; i--) {} rord = i-0x2F;
			for(mptn = 0; i >= 0x30; i--) if((t=X.U8(i)+1) > mptn) mptn = t;
			ord = X.U8(0x26); ptn = X.U8(0x28);
			p = X.U16(0xB0)<<4; inss = []; mp = 0;
			for(i=ins=0; i < X.U8(0x27); i++,p+=0x40) {
				if(!X.c("'DSI'10",p)) bad = bad.addIfNone('!badins');
				inss.push(X.SC(p+4,0x20,'CP437').trim());
				var sp = X.U16(p+0x24)<<4; if(sp) ins++; if(sp > mp) mp = sp+X.U16(p+0x26)
			}
			p = 0xB0+X.U8(0x27)*2+ptn*2-2; p = X.U16(p) << 4; p += 2+X.U16(X.U16(p)); //past the last pattern
			sz = Math.max(mp,p);
			sOptionT(X.SC(4,0x20,'CP437'));
			sOption(addEllipsis(inss.filter(funSampleName).join(' '),0xA0),'ins/msg:"','"');
			sOption('ord:'+(rord==ord?'':rord+'/')+ord+' ptn:'+(mptn==ptn?'':mptn+'/')+ptn
				+' ins:'+ins+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'RIFF'........'DSMFSONG'") && X.U16(0x36) <= 128 && X.U16(0x38) <= 128
	  && X.U16(0x3C) <= 256 && X.U16(0x3E) <= 16) {
		sName = "Carlos Hasan's Digital Sound Interface Kit module (.DSM)"; bDetected = 1;
		sVersion = "RIFF";
		if(X.isVerbose()) {
			sOptionT(X.SC(0x14,28,'CP437'));
			sz = X.U32(4)+8; p = 0xC; smp = 0;
			while(p < sz) {
				hkhd = X.SA(p,4); hksz = X.U32(p+4); p += 8;
				if(hkhd == "INST") smp++
				p += hksz;
			}
			if(p > X.Sz()) sVersion += "/malformed!badchunk";//+hkhd+" @"+Hex(p-hksz-8)+"="+Hex(hksz);
			sOption("ch:"+Math.max(1,X.U16(0x3E))+" spd0:"+X.U8(0x42)+" bpm0:"+X.U8(0x43)
				+" ord:"+X.U16(0x38)+"("+X.U16(0x34)+"-"+X.U16(0x36)
				+") ptn:"+X.U16(0x3C)+" smp:"+X.U16(0x3A)+"/"+smp
				+" sz:"+outSz(sz))
		}
	}

	else if(X.c("'DSm'1A20")) {
		sName = "The Loom Syndicate's Dynamic Studio module (.DSM)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(5,20));
			sOptionT(X.SA(25,20),"by: ");
		}
	}

	else if(X.c("'DSFmt1'0D0A")) {
		sName = "Audio Simulation's DreamStation module (.DSS)"; bDetected = 1;
		sVersion = "v1.0";
		if(X.isVerbose()) {
			pt = X.fSig(0,TOEOF,"F0E40001")+4; //the 00/01 at the end is "show info at track load"
			if(pt < 4) pt = X.fSig(0,TOEOF,"F0E40000")+4;
			if(pt >= 4) {
				pa = X.fSig(pt,TOEOF,"0D0A"); t = X.SA(pt,pa-pt); pa += 2;
				pc = X.fSig(pa,TOEOF,"0D0A"); a = X.SA(pa,pc-pa); pc += 2;
				c = X.SA(pc,X.Sz()-pc);
				sOption(t); sOption(a,"by: "); sOption(c)
			}
		}
	}

	else if(X.c("'DS2F0'....'Default'")) {
		sName = "Audio Simulation's DreamStation II module (.DS2)"; bDetected = 1;
		sVersion = "v2";
		if(X.isVerbose()) {
			ts=X.U8(0x62); t=X.SA(0x63,ts);
			pa=0x62+ts+1; as=X.U8(pa); a=X.SA(pa+1,as);
			pc=pa+as+1;  cs=X.U8(pc); c=X.SA(pc+1,cs);
			sOption(t);
			sOption(a,"by: ");
			sOption(c);
		}
	}

	else if(X.c("'MMU2'00")) {
		sName = "Great Valley Products' Digital Sound Studio module (.DSS)"; bDetected = 1;
		sVersion = "v1-3.0";
		if(X.isVerbose()) {
			sOptionT(X.SA(10,32));
			sOption("ord:"+X.I16(0x59C,_BE));
		}
	}

	else if(X.c("'DTL'00") && X.c("0000001000", 0x16)) {
		sName = "Larry Tipton's Drum Traker module (.DTL)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(4,20));
			//sOption('sz:'+outSz(0xD0+(1+X.U16(0x1B))*0xE0))
		}
	}

	else if(X.c("'D.T.'00")) {
		sv = ["S.Q.","VERS"].indexOf(X.SA(0x2A,4));
		if(sv >= 0) {
			sName = "Softjee's Digital Tracker module (.DTM)"; bDetected = 1;
			if(X.isVerbose()) {
				if(sv==0) sOptionT(X.SA(0x16,20))
				//let's play along with Bummtschak here
				else sOptionT(X.SA(0x16,24))
			}
		}
	}

	else if(X.c("'DeFy DTM'")) {
		sName = "DeFy AdLib Tracker module (.DTM)"; bDetected = 1;
		sVersion = "v"+X.SA(9,3);
		if(X.isVerbose()) {
			sOptionT(X.SA(0xD,20));
			sOptionT(X.SA(0x21,20),'by: ');
		}
	}

	else if(X.c("'SONG'........'NAME'")) {
		//ref http://hackipedia.org/browse.cgi/File%20formats/Music%20tracker/Digitrakker/DigiTrekker%20Module%20Format%20by%20Horst%20Beham%20Jr.%20v1.0.txt
		sName = "Horst Beham Jr.'s DigiTrekker module (.DTM)"; bDetected = 1;
		if(X.isVerbose())
			sOptionT(X.SA(0x10,20));
	}

	else if(X.c("48E7F1FE610000964CDF7F8F'NuH'E70010610000'$L'DF0800'NuH'E7F1FE610001844CDF7F8F'NuH'E70010610000'NL'DF0800'NuG'FAFFC651EB05',Q'EB05'PQ'EB05'tQ'EB059833FC000F00DFF09633FC00FF00DFF09E33FC000000DFF0A833FC000000DFF0B833FC000000DFF0C833FC000000DFF0D8'NuG'FAFF80177C00010524177C00010548177C0001056C177C00010590'NuG'FAFF'bJ+'00BA670E'S+'00B96608177C000600B9'Nu`'0003180006")) {
		sName = "David Whittaker's SFX module (.DW)"; bDetected = 1
	}

	else if(X.c("' PWD'03") && X.c("'Master'",0x0E)) {
		sName = "Daniel Werner/ExperimentalScene's DarkWave Studio module (.DWP)"; bDetected = 1
	}

	else if(X.c("'EASO'")) {
		sName = "Morten Grouleff's EarAche module (.EA,.EAS)"; bDetected = 1;
	}

	else if(X.c("'FORM'.... ....'EMODEMIC'")
	  && X.c("'PATT'",pt=0x14+X.U32(0x10,_BE)) && X.c("'8SMP'",q=pt+8+X.U32(pt+4,_BE))) {
		//ref https://github.com/libxmp/libxmp/blob/master/src/loaders/emod_load.c
		sName = "Bo Lincoln's Quadra Composer module (.EMOD)"; bDetected = 1; sVersion = 'v'+X.U16(0x14,_BE);
		smp = X.U8(0x3F); if(smp) smps = []; sz = X.U32(4,_BE)+8;
		for(i=ssz=0,p=0x40; i < smp; i++,p+=0x22) {
			if((t=X.SC(p+4,0x14,'CP1252').trim()) != '') smps.push(t);
			ssz += X.U16(p+2,_BE) << 1;
		}
		bad = ''; if(ssz != X.U32(q+4,_BE)) bad = bad.addIfNone('!badsmplen:'+X.U32(q+4,_BE)+' vs '+ssz)
		ptn = X.U8(++p); p++;  p += 0x1A*ptn;
		// for (i=0; i < ptn; i++,p+=0x1A) if((t=X.SC(p+2,0x14,'CP1252').trim()) != '') smps.push(t);
		if(X.c("'MDIN'",q1=q+8+X.U32(q+4,_BE))) q = q1;
		if(Math.abs(sz-(sz1=q+8+X.U32(q+4,_BE))) > 1) bad = bad.addIfNone('!badlen:'+sz+' vs '+sz1);
		if(sz < sz1) sz = sz1; ord = X.U8(p++); if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT((t=X.SA(0x16,0x14)) === '<sans titre>'? '': t);
			if(smp) sOptionT(addEllipsis(smps.join(' '),0xC0,0xA0),'smp/msg: "','"'); delete smps;
			sOption('bpm:'+X.U8(0x3E)+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'E.M.S. V6.0'..00010000") && isWithin(X.U8(0xB),0x31,0x36)) {
		sName = "Sean 'Odie' Connolly's Electronic Music System module (.EMS)"; bDetected = 1;
		sVersion = "v6."+X.SA(10,2);
		if(X.isVerbose()) {
			//ref ems_player_dis.asm
			a1 = X.U32(0xE,_BE); a2 = X.U32(0x12,_BE); a3 = X.U32(0x16,_BE); p = lb0 = 0x22;
			p += a1; lb4 = p; p += a2; lb8 = p; p += a3; insp = p; sz = p+X.U32(0x1E,_BE);
//_log(Hex(lb0)+'; [4]:'+Hex(lb4)+'; [8]:'+Hex(lb8)+'; insp:'+Hex(insp))
			// p = a2 = lb4; lbdata = a5 = 0x13740;
			// ssp = ( 0 & 0x1F)*0x84; ss1 = X.U16(p+ssp,_BE); ss2 = X.U16(p+ssp+2,_BE);
//_log('subsong @'+Hex(p+ssp)+' has '+Hex(ss1)+' and '+Hex(ss2))
			// In the player, the following bit was copying the modified offsets (of something) to the data buffer:
			// p += ssp+4; p1 = p;
			// for(d1 = 0, ptrs=[]; d1 < 0x20; d1++) { t = X.U32(p,_BE)+p1; p += 4; ptrs.push(t) }
			sOption('sz:'+outSz(sz))
		}
	}

	else if(X.c("'ENF '....'scor'")) {
		sName = "Musitek SmartScore Extended Notation Format sheet music (.ENF)"; bDetected = 1;
		p = 6; staf = brln = 0; hkhd = "dumm";
		while(p < X.Sz()) {
			hkhd = X.SA(p,4);
			if(!/[a-z\[\]\-0-9]{4}/.test(hkhd)) break;
			hksz = X.U16(p+4,_BE);
			if(hkhd === "staf") staf++;
			else if(hkhd === "brln") brln++;
			p += hksz //this format includes signatures into the chunk size
		}
		sOption("staves:"+staf+" bars:"+brln+" sz:"+outSz(p))
	}

	else if(X.Sz() > 0x24 && X.c("'ETracker (C) BY ESI.'",10) ||
	  (X.Sz() > 0x4D4 && (X.c("21B384") ||X.c("21B304")) && X.c("'ETracker (C) BY ESI.'",0x4BD))) {
		//kudos to horsicq for helping narrow down the bad samples in modland files
		sName = " Maciej J. Wołoszyk & Andrzej Siuda's E-Tracker file (.ETC,.SAA)"; bDetected = 1;
		if(X.c("21B384") || X.c("21B304")) { sVersion = "&player"; ofs = 0x4B3 } else ofs = 0;
		p = ofs; x = mp = sz = 0; ords = []; ptns = [];
		while(p < X.Sz()-0x24 && X.c("'ETracker (C) BY ESI.'",p+10)) {
			x++; //TODO not too good for a ripper but there're multitrack files like this, iono
			ordp = p+X.U16(p); if(ordp > mp) mp = ordp;
			ptnp = p+X.U16(p+2); if(ptnp > mp) mp = ptnp;
			smpp = p+X.U16(p+4); if(smpp > mp) mp = smpp;
			ornp = p+X.U16(p+6); if(ornp > mp) mp = ornp; svd = ofs+X.U16(p+6); if(svd > mp) mp = svd;
			if(sz < mp) sz = mp;
			if(x == 1 && sz > X.Sz()) return false;
//_log('Track at '+Hex(p)+': ordp:'+Hex(ordp)+' ptnp:'+Hex(ptnp)+' smpp:'+Hex(smpp)+' ornp:'+Hex(ornp)+' svd:'+Hex(svd))
			ord = lp = xpos = ptn = 0; var ordl = [];
			for(p = ordp; p < X.Sz(); p++) {
				o = X.U8(p);
				if(o == 0xFF) { p++; break }
				else if(o == 0xFE) lp = ord;
				else if(o >= 0x60) xpos = o-0x60;
				else {
					if(x == 1 && o%3) { _log('SAAFault @'+Hex(p)+': trk '+x+' pos not divisible by 3'); return false }
					o = Util.div64(o,3);
					if(x == 1 && o > 0x1F) { _log('SAAFault: trk '+x+' pos over 1Fh'); return false }
					if(o > ptn) ptn = o; ord++
				}
				if(ord > 254) { _log('SAAFault: trk '+x+' pos not divisible by 3'); return false }
			}
			if(!ord) return false; ords.push(++ord); ptns.push(++ptn);
			if(sz < p) sz = p;
			p = ptnp+12*ptn; //a pattern record contains uint16_t pattern offsets for 6 channels
			for(i=ptnp; i < p; i += 2) { //find if the a pattern isn't after its record (doesn't seem to ever happen)
				if((t=X.U16(i)) > mp-ofs) mp = ofs+t;
				if(t < 0x1E) return false;
			}
			if(x == 1 && mp > X.Sz()) return false;
			notes = -1;
			if(t > p) { // the hard way
				p = t+64;
				//parse the last pattern
				p = ptnp; notes = 0; chncnt = [64,64,64,64,64,64];
				for(l=0; l < 64; l++) { //lines
					for(c=0; c < 6; c++) { //channels
						if(chncnt[c]) { chncnt[c]--; continue }
						while(p < X.Sz()) { //ParseChannel
							cmd = X.U8(p++);
							if(cmd >= 0xD2) { chncnt[c] -= cmd-0xD2; break }
							else if(cmd >= 0x72) notes++; //set note cmd-0x72
							else if(cmd >= 0x52) {} //set sample cmd-0x52
							else if(cmd >= 0x51) break; //isn't this just if cmd == 0x51?
							//else if(cmd >= 0x50) {} //set ornament cmd-0x30
							//else if(cmd >= 0x2E) {} //set swap sample channels with "cmd > 0x2E"
							//else if(cmd >= 0x21) {} //set envelope cmd-0x21
							//else if(cmd >= 0x11) {} //set attenuation cmd-0x11
							//else if(cmd >= 0x0F) {} //set noise to "cmd != 0xF? 3: cmd-0xF" (so either 3 or 0!)
							//else {} //set tempo cmd+1
						}
					}
				}
			}
			if(sz < p) sz = p;
			if(ornp == mp)
				if(sz < mp) sz = mp //never happens so no further parsing
			if(smpp == mp)
				if(sz < mp) sz = mp; //ditto
			if(svd == mp) if(sz < mp) sz = mp //ditto
		}
		if(X.isVerbose()) {
			if(x > 1) sOption(x,'×');
			sOption('ord:'+ords.join('+')+(lp?' looped':'')+' ptn:'+ptns.join('+')+(xpos?' xpos:'+xpos:'')
				+(notes>-1?' notes:'+notes:'')+' sz:'+outSz(sz))
		}
	}

	else if((X.Sz() > 2048+6+6)
	  && X.c("00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 0x3E1)
	  && X.c("......00 ......00 ......00 ......00 ......00 ......00 ......00",0x4D4)
		) {
		sName = "EUPHONY module (.EUP)"; bDetected = 1;
		if(X.isVerbose()) {
			sOption(X.SC(0,0x20,'CP932'))
		}
	}

	else if(X.c("'EuGH'") && X.c("'EuSH'",t=8+X.U32(4,_BE))
	  && X.c("'MThd'",t=t+8+X.U32(t+4,_BE)) && X.c("'MTrk'",p=t+8+X.U32(t+4,_BE))) {
		sName = "Fujitsu EUPHONY II/MTR module (.EUX)"; bDetected = 1;
		//from here on it's just a MIDI file
		trk = X.U16(t+0xA,_BE); //seems it's always 100 in this format
		sz = p; txt = by = title = lyr = "";
		for(i=0; i < trk; i++) {
			var readmore = 20;
			if(!X.c("'MTrk'",p) || (i && !X.c("FF2F00",p-3))) { bad += "!badtrk"+i; break }
			len = X.U32(p+4,_BE); p += 8; sz = p;
			while(readmore && p < sz+len && p < X.Sz()) {
				readmore--; dt = readVarUInt(p);
				p += dt[0];
				switch(X.U8(p++)) {
				case 0xF0: case 0xF7: t = readVarUInt(p); p += t[0]+t[1]; break;
				case 0xFF: a = X.U8(p++);
					switch(a) {
						case 0: if(X.U8(p++) != 2) readmore = 0; else p += 4; break;
						case 3: t = readVarUInt(p); p += t[0];
							title = title.append(X.SC(p,t[1],'SJIS')); p += t[1];
							break;
						case 2: t = readVarUInt(p); p += t[0];
							by = by.append(X.SC(p,t[1],'SJIS')); p += t[1]; break;
						case 1: t = readVarUInt(p); p += t[0];
							txt = txt.append(X.SC(p,t[1],'SJIS')); p += t[1]; break;
						case 5: t = readVarUInt(p); p += t[0];
							lyr = lyr.append(X.SC(p,t[1],'SJIS'),"-"); p += t[1];
							break;
						case 4: case 6: case 7: t = readVarUInt(p); p += t[0]+t[1]; break;
						case 0x20: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 1) {
							readmore = 0; bad += "!badprefix@"+(p-t[0]-t[1]) } break
						case 0x2F: t = readVarUInt(p); p += t[0]+t[1]; if(t[1])
							bad += "!badEoTtag@"+(p-t[0]-t[1]); readmore = 0; break;
						case 0x51: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 3) {
							readmore = 0; bad += "!badtempo@"+(p-t[0]-t[1]) } break;
						case 0x54: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 5) {
							readmore = 0; bad += "!badSMPTE@"+(p-t[0]-t[1]) } break;
						case 0x58: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] < 2 || t[1] > 4) {
							readmore = 0; bad += "!badtime@"+(p-t[0]-t[1]) } break;
						case 0x59: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 2) {
							readmore = 0; bad += "!badkey@"+(p-t[0]-t[1]) } break;
						default: t = readVarUInt(p); p += t[0]+t[1]
					} break;
				default:
				}
				if((txt != "" && by != "" && title != "") || p-sz > 0x200) readmore = 0;
			}
			sz += len; p = sz; if(p > X.Sz() && !X.isVerbose()) { bad += "!short"; break }
		} //for..trk
		if(bad) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(by,"by: "); sOptionT(txt);
			sOption((trk>1?'trk:'+trk+' ':'')+'sz:'+outSz(sz))
		}
	}

	else if(X.c("'FAR'FE") && X.c("0D0A1A",0x2C) && X.Sz() > X.U16(0x2F)) {
		//ref https://web.archive.org/web/20151027135146/http://hackipedia.org/File%20formats/Music/Sample%20based/text/Format%20Specifications%20(FAR,%20FSM,%20USM,%20F2R)%20by%20Daniel%20Potter.cp437.txt.utf-8.txt
		bDetected = 1; nV = X.U8(0x31);
		sName = "Daniel Potter/Digital Infinity's Farandole Composer module (.FAR)";
		sVersion = "v"+ (nV>>4) +"."+ (nV&0x0F);
		ch = X.readBytes(0x32,16).filter(function(x){return x==1}).length;
		if(X.isVerbose()) {
			sOptionT(X.SC(4,0x28,'CP437'));
			msgsz = X.U16(0x60); msg = [];
			for(i=0,p=0x62; i < msgsz && p < X.Sz(); i+=132,p+=Math.max(0,Math.min(132,msgsz-i)))
				msg.push(X.SC(p,Math.max(0,Math.min(132,msgsz-i)),'CP437').trim());
			sOptionT(addEllipsis(msg.join(' '),0x100),'msg:"','"');
			p = 0x62+msgsz+0x100; ptn = X.U8(p++); ord = X.U8(p++); lp = X.U8(p++);
			for(i=psz=0; i < 0x100; i++,p += 2) psz += X.U16(p);
			p = X.U16(0x2F)+psz;
			smp = 0; smpm = X.readBytes(p,8); smps = []; p += 8;
			for(i=0; i < 64; i++) if(smpm[i >> 3] & (1 << (i & 7))) smp++;
			for(i=0; i < smp; i++) { smps.push(X.SC(p,0x20,'CP437')); p += 0x30+X.U32(p+0x20) }
			sOptionT(addEllipsis(smps.filter(funSampleName).join(' '),0x100),'smp/msg:"','"');
			sOption('ch:'+ch+' ord:'+(lp?lp+'~':'')+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(p))
		}
	}

	else if(X.c("'FPT'FE") && X.c("0D0A1A",0x24)) {
		//ref https://web.archive.org/web/20151027135146/http://hackipedia.org/File%20formats/Music/Sample%20based/text/Format%20Specifications%20(FAR,%20FSM,%20USM,%20F2R)%20by%20Daniel%20Potter.cp437.txt.utf-8.txt
		sName = "Daniel Potter/Digital Infinity's Farandole Composer pattern (.FPT)"; bDetected = 1;
		if(X.isVerbose())
			sOptionT(X.SC(4,0x20,'CP850'));
	}

	else if(X.c("'FSM'FE") && X.c("0A0D1A",0x24)) {
		//ref https://web.archive.org/web/20151027135146/http://hackipedia.org/File%20formats/Music/Sample%20based/text/Format%20Specifications%20(FAR,%20FSM,%20USM,%20F2R)%20by%20Daniel%20Potter.cp437.txt.utf-8.txt
		sName = "Daniel Potter/Digital Infinity's Farandole Composer sample (.FSM)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SC(4,0x20,'CP850'));
			if(X.U8(0x35)) type = "16bit"; else type = "8bit";
			if(X.U8(0x36)&4) looped = " looped"; else looped = "";
			sVersion = type+looped;
			sOption(outSz(X.U32(0x27)),'sz:');
		}
	}

	else if(X.c("'SMOD'") && X.Sz() > 0x70 && isWithin(X.U32(8,_BE),0x70,X.Sz()) && isWithin(X.U32(0x10,_BE),0x70,X.Sz())
	  && isWithin(X.U32(0x18,_BE),0x70,X.Sz()) && isWithin(X.U32(0x20,_BE),0x70,X.Sz())) {
		//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/FutureComposer13.c
		// & https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/ModuleConverters/ModuleConverter/Formats/FutureComposer13Format.cs
		sName = "Superions' Future Composer module (.FC,.FC13,.SMOD)"; sVersion = "v1.0~3"; bDetected = 1;
		if(X.isVerbose()) {
			ordsz = X.U32(4,_BE); ordsz += ordsz%2; ord = Util.divu64(ordsz,13); if(!ord) ord = 1;
			ptnp = X.U32(8,_BE); ptnsz = X.U32(0xC,_BE); ptn = ptnsz >> 6;
			smpp = X.U32(0x20,_BE); smpsz = X.U32(0x24,_BE); smp = wf = 0;
			sszs = []; for(p=0x28,i=0; i < 10; i++,p+=6) { if(t=X.U16(p,_BE)<<1) smp++; sszs.push(t) }
			for(i=10; i < 90; i++) sszs.push(X.U8(p++)<<1);
			for(i=89; i >= 10; i--) if(sszs[i]) break; wf = i-9; delete sszs;
			sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' wf:'+wf+' sz:'+outSz(smpp+smpsz))
		}
	}

	else if(X.c("'FC14'") && X.Sz() > 0xC0 && isWithin(X.U32(8,_BE),0xC0,X.Sz()) && isWithin(X.U32(0x10,_BE),0xC0,X.Sz())
	  && isWithin(X.U32(0x20,_BE),0xC0,X.Sz()) && isWithin(X.U32(0x24,_BE),0xC0,X.Sz())) {
		//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/FutureComposer14.c
		// & https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/Players/FutureComposer/FutureComposerWorker.cs
		sName = "Superions' Future Composer module (.FC,.FC14)"; sVersion = "v1.4"; bDetected = 1;
		if(X.isVerbose()) {
			ordsz = X.U32(4,_BE); ord = Util.divu64(ordsz,13); if(!ord) ord = 1;
			ptnp = X.U32(8,_BE); ptnsz = X.U32(0xC,_BE); ptn = ptnsz >> 6;
			smpp = X.U32(0x20,_BE); wfp = X.U32(0x24,_BE); smp = 10; rsmp = msmp = wf = 0;
			sszs = []; for(p=0x28,i=0; i < 10; i++,p+=6) sszs.push(X.U16(p,_BE)<<1);
			for(sz=0,i=10; i < 90; i++) { sz += t=X.U8(p++)<<1; sszs.push(t) }
			for(i=89; i >= 10; i--) if(sszs[i]) break; wf = i-9; sz += X.U32(0x24,_BE);
			for(p=smpp,i=0; i < 10; i++) {
				rsmp++; if(sszs[i]) {
					if(X.c("'SSMP'")) { mszs = [];
						p += 4; msmp++; smp--; rsmp--; for(j=0; j < 20; j++, p+=20) mszs.push(X.U16(p+4,_BE)<<1);
						for(j=0; j < 20; j++) if(mszs[j]) rsmp++; smp++
					}
				}
			} delete sszs; delete mszs;
			sOption('ord:'+ord+' ptn:'+ptn+' smp:'+rsmp+(smp!=rsmp?'('+smp+')':'')
				+(msmp?' ssmp:'+msmp:'')+' wf:'+wf+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'FMK!'") && X.U8(0x3C) == 0xF4 && isWithin(X.U8(0x3D),1,2)) {
		sName = "Sami Wilenius's FM-Kingtracker module (.FMK)";
		sVersion = [,'v1.00~03','v1.06+'][X.U8(0x3D)]; bDetected = 1;
		if(X.isVerbose()) {
			text = true; for(i=0; i < 0x38; i++) if(0x20 > X.U8(i+4)) { text = false; break }
			if(text) {
				sOptionT(X.SA(0x04,0x1C));
				sOptionT(X.SA(0x20,0x1C),"by: ");
			}
			sOption('ord:'+X.U8(0x4A)+' ptn:'+X.U8(0x4C)+' ins:'+X.U8(0x4B))
		}
	}

	else if(X.c("'FMTracker'....'The FM Tracker!'")) {
		sName = "Davey W. Taylor's FM Tracker module (.FMT)"; bDetected = 1;
		sVersion = "v"+X.U8(9)+"."+X.U8(10);
		if(X.isVerbose())
			sOptionT(X.SA(0x1F,0x20));
	}

	else if(X.c("'JSR_FMT~")) {
		//ref https://github.com/XorJS/FM-Tracker & https://jsr-productions.com/_blogpost3319ddc.html
		// & https://github.com/XorJS/FM-Tracker/blob/main/FM.ASM
		sName = "Jean-Sebastien 'XorJS' Royer's FM-Tracker module (.FMT)"; bDetected = 1
	}

	else if(X.c("'FMTRK'1A")) {
		sName = "Morten Stenshorne/Sagitta Software's FM Tracker module (.FMT)"; bDetected = 1;
		if(X.isVerbose())
			sOptionT(X.SA(0x10,0x20));
	}

	else if(X.c("000003F3") && X.U8(0x14)
	  && X.c("70FF4E75'F.PLAYER'",0x20) && X.I32(0x40,_BE)) {
		sName = "Paul van der Valk's Future Player module (.FP)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(X.I32(0x2C,_BE)+0x20,0x100));
			x = 1; p = 0x48;
			do { t = X.U32(p,_BE); if(t) x++; p += 8 } while(t);
			if(x > 1) sOption(x,"×");
			sOptionT(X.SA(X.I32(0x30,_BE)+0x20,0x100),"by:");
			sOptionT(outSz(X.I32(0x38,_BE)+0x20),"sz:")
		}
	}

	else if(X.c("'Fred Editor '0000") && X.U16(0xE,_BE) <= 10) {
	//ref https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/ModuleConverters/ModuleConverter/Formats/FredEditorFinalFormat.cs
		p = 0x10+0x401*(x=X.U16(0xE,_BE));
		spds = []; for(i=0x10; i < 0x10+x; i++) if(spds.indexOf(t=X.U8(i)) < 0 ) spds.push(t); 
		if(p < X.Sz()) for(i=0; i < 128 && p < X.Sz(); i++) { trksz = X.U32(p,_BE); p += trksz+4 }
		if(p < X.Sz()) {
			ins = X.U16(p,_BE); p += 2;
			for(i = syn = un = 0; i < ins && p < X.Sz(); i++) {
				switch(X.U8(p+0x53)) {
				case 0xFF: un++; break;
				default: syn++
				}
				p += 0x60; //name & parameters
			}
		}
		smp = X.U16(p,_BE); syn -= smp; p += 2; for(i=0; i < smp && p < X.Sz(); i++) p += 4+X.U16(p+2,_BE);
		if(X.c("12345678",p)) { bDetected = 1; sz = p+4 }
		if(bDetected) {
			sName = "Fred & Julien Clermonte's Fred Editor module (.FRED,.MOD)"; sVersion = 'project';
			if(X.isVerbose()) {
				if(x > 1) sOption(x,'×');
				sOption('tempos:'+spds.sort().join('-')+' ins:'+(ins-un)+(un?'('+ins+')':'')
					+(smp?' smp:'+smp:'')+(syn?' syn:'+syn:'')+' sz:'+outSz(sz))
			}
		}
	}

	if(!bDetected) if(X.c("'FTMN'03") && X.U8(5) < 64 && X.U16(8,_BE) >= 0x1000 && X.U16(8,_BE) < 0x5000
	  && X.U8(0xA) < 12 && X.U8(0xC) < 64 && !(X.U8(0xD) & 0xFC) && X.U8(0xE) && X.U8(0xE) <= 24
	  && X.U8(0xF) >= 4 && X.U8(0xF) <= 96 && X.U8(0xF) == Util.div64(96,X.U8(0xE))
	  && X.U8(0x50) <= 64 && !X.U8(0x51) && X.Sz() >= 0x52+X.U8(5)*32+X.U8(0x50)*4) {
	  	//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_ftm.cpp
		sName = "Jörg W.Schmidt/MAXON's Face the Music module (.FTM)"; sVersion = 'v'+X.U8(4); bDetected = 1;
		if(X.isVerbose()) {
			smp = X.U8(5); msr = X.U16(6,_BE); bpm0 = (1766278.163/X.U16(8,_BE)).toFixed(0);
			fl = X.U8(0xD); fx = X.U8(0x50); gvol0 = X.U8(0xC);
			p = 0x52+smp*32; realsmp = 0;
			for(i=0; i < smp; i++) if(X.U8(0x52+i*32)) realsmp++;
			fxln = 0; ticksper = X.U8(0xE); rowsper = X.U8(0xF);
			for(i=0; i < fx; i++) { t = X.U16(p,_BE); fxln += t; p+=4+4*t }
			if(msr) for(i=0; i < 8; i++) p += 6+X.U32(p+2,_BE);
			if(fl&1) for(i=0; i < realsmp; i++) p += 4+2*(X.U16(p,_BE)+X.U16(p+2,_BE));
			sOptionT(decAnsi(0x10,0x20,CPAmiga));
			sOptionT(decAnsi(0x30,0x20,CPAmiga),'by: ');
			sOption('bpm0:'+bpm0+' ptn:'+msr+' smp:'+realsmp+'/'+smp+' fx:'+fx+'/'+fxln
				+' msr:'+ticksper+'/'+rowsper+(!(fl&1)?' ext.smps':'')+' gvol0:'+gvol0+' sz:'+outSz(p))
		}
	}

	else if(X.c("'FMS!'..000000")) {
		sName = "BleuBleu's FamiStudio module (.FMS)"; bDetected = 1;
		sVersion = "v"+X.U8(4)
	}

	else if(X.c("'FamiTracker Module'") && X.fSig(0x12,0x10,"00'PARAMS'") > 0
	  && X.fSig(0x18,0x100,"00'INFO'") > 0) {
		sName = "Jonathan Liss's FamiTracker module (.FTM)"; bDetected = 1;
		if(X.isVerbose()) {
			itag = X.fStr(0x18,0x100,"INFO");
			sOptionT(X.SA(itag+0x18,0x20));
			sOptionT(X.SA(itag+0x38,0x20),"by: ");
			sOptionT(X.SA(itag+0x58,0x20))
		}
	}

	else if(X.c("'-Furnace '")) {
		// from https://github.com/tildearrow/furnace/blob/master/papers/format.md
		switch(X.SA(9,7)) {
			case 'module-':
				cV = 'm'; bDetected = 1; sName = "tildearrow et al.'s Furnace Tracker module (.FUR)"; break;
			case 'instr.-':
				cV = 'i'; bDetected = 1; sName = "tildearrow et al.'s Furnace Tracker instrument (.FUI)"; break;
			case 'waveta-':
				cV = 'w'; bDetected = 1; sName = "tildearrow et al.'s Furnace Tracker wavetable (.FUW)"; break
			default:
				cv = "?"; bDetected = 1; sName = "unknown tildearrow et al.'s Furnace Tracker file"
		}
		nV = X.U16(0x10,_LE);
		//ref https://github.com/tildearrow/furnace/blob/master/papers/format.md
		//they update it every 0.1 femtosecond, why not help out since you're reading this?
		if(nV < 12) sVersion = "["+nV+"]"; else
		if(nV <= 14) sVersion = "v0.2.x"; else
		if(nV <= 16) sVersion = "v0.3.x"; else
		if(nV <= 27) sVersion = "v0.4.x"; else
		if(nV < 35) sVersion = "["+nV+"]"; else
		if(nV <= 54) sVersion = "v0.5.x"; else
		if(nV < 57) sVersion = "["+nV+"]"; else
		if(nV == 75) sVersion = "v.dev75/April Fools' 0.6pre0"; else
		if(nV <= 99) sVersion = "v.dev"+nV; else
		if(nV == 100) sVersion = "v0.6pre1"; else
		if(nV == 101) sVersion = "v0.6pre1 (dev101)"; else
		if(nV == 102) sVersion = "v0.6pre1 (dev102)"; else
		if(nV <= 115) sVersion = "v.dev"+nV; else
		if(nV == 116) sVersion = "v.0.6pre1.5"; else
		if(nV <= 131) sVersion = "v.dev"+nV; else
		if(nV == 132) sVersion = "v.0.6pre2"; else
		if(nV == 133) sVersion = "v.0.6pre3"; else
		if(nV <= 140) sVersion = "v.dev"+nV; else
		if(nV == 141) sVersion = "Tournament Edition"; else
		if(nV == 142) sVersion = "v.dev"+nV; else
		if(nV == 143) sVersion = "v.0.6pre4"; else
		if(nV <= 145) sVersion = "v.dev"+nV; else
		if(nV == 146) sVersion = "v.Pro (joke edition)"; else
		if(nV <= 157) sVersion = "v.dev"+nV; else
		if(nV == 158) sVersion = "v.0.6pre5"; else
		if(nV <= 160) sVersion = "v.dev"+nV; else
		if(nV == 161) sVersion = "v.0.6pre6"; else
		if(nV == 162) sVersion = "v.0.6pre7"; else
		if(nV <= 165) sVersion = "v.dev"+nV; else
		if(nV == 166) sVersion = "v.0.6pre8"; else
		if(nV <= 168) sVersion = "v.dev"+nV; else
		if(nV == 169) sVersion = "v.0.6pre9"; else
		if(nV <= 170) sVersion = "v.dev"+nV; else
		if(nV == 171) sVersion = "v.0.6pre10"; else
		if(nV == 172) sVersion = "v.0.6pre11"; else
		if(nV == 173) sVersion = "v.0.6pre12"; else
		if(nV == 174) sVersion = "v.0.6pre13"; else
		if(nV == 175) sVersion = "v.0.6pre14"; else
		if(nV <= 176) sVersion = "v.dev"+nV; else
		if(nV == 177) sVersion = "v.0.6pre15"; else
		if(nV == 178) sVersion = "v.0.6pre16"; else
		if(nV == 179) sVersion = "v.0.6pre17"; else
		if(nV == 180) sVersion = "v.0.6pre18"; else
		if(nV == 181) sVersion = "v.0.6"; else
		if(nV <= 191) sVersion = "v.dev"+nV; else
		if(nV == 192) sVersion = "v.0.6.1"; else
		if(nV <= 196) sVersion = "v.dev"+nV; else
		if(nV == 197) sVersion = "v.0.6.2"; else
		if(nV <= 200) sVersion = "v.dev"+nV; else
		if(nV == 201) sVersion = "v.0.6.3"; else
		if(nV <= 211) sVersion = "v.dev"+nV; else
		if(nV == 212) sVersion = "v.0.6.4"; else
		if(nV <= 213) sVersion = "v.dev"+nV; else
		if(nV == 214) sVersion = "v.0.6.5"; else
		if(nV <= 217) sVersion = "v.dev"+nV; else
		if(nV == 218) sVersion = "v.0.6.6"; else
		if(nV == 219) sVersion = "v.0.6.7"; else
		if(nV <= 224) sVersion = "v.dev"+nV; else
		if(nV == 225) sVersion = "v.0.6.8pre1"; else
		if(nV == 226) sVersion = "v.0.6.8pre2"; else
		if(nV == 227) sVersion = "v.0.6.8"; else
		if(nV == 228) sVersion = "v.0.6.8.1";
		else sVersion = "["+nV+"]";
		if(cV === 'i') {
			p = X.U32(0x14,_LE);
			if(p>0 && X.c("'INST'",p)) {
				ity = X.U16(0x10,_LE);
				switch(ity) {
					case 0: sVersion += "/std"; break;
					case 1: sVersion += "/FM (OPM/OPN)"; break;
					case 2: sVersion += "/Game Boy"; break;
					case 3: sVersion += "/C64"; break;
					case 4: sVersion += "/Amiga|smp"; break;
					case 5: sVersion += "/PC Engine"; break;
					case 6: sVersion += "/AY-3-8910"; break;
					case 7: sVersion += "/AY8930"; break;
					case 8: sVersion += "/TIA"; break;
					case 9: sVersion += "/SAA1099"; break;
					case 10: sVersion += "/VIC"; break;
					case 11: sVersion += "/PET"; break;
					case 12: sVersion += "/VRC6"; break;
					case 13: sVersion += "/OPLL"; break;
					case 14: sVersion += "/OPL"; break;
					case 15: sVersion += "/FDS"; break;
					case 16: sVersion += "/Vritual Boy"; break;
					case 17: sVersion += "/Namco 163"; break;
					case 18: sVersion += "/SCC"; break;
					case 19: sVersion += "/OPZ"; break;
					case 20: sVersion += "/POKEY"; break;
					case 21: sVersion += "/PC Speaker"; break;
					case 22: sVersion += "/WonderSwan"; break;
					case 23: sVersion += "/Lynx"; break;
					case 24: sVersion += "/VERA"; break;
					case 25: sVersion += "/X1-010"; break;
					case 26: sVersion += "/VRC6(saw)"; break;
					case 27: sVersion += "/ESS5506"; break;
					case 28: sVersion += "/MultiPCM"; break;
					case 29: sVersion += "/SNES"; break;
					case 30: sVersion += "/Sound Unit"; break;
					case 31: sVersion += "/Namco WSG"; break;
					default: sVersion += "/unk"
				}
				if(X.isVerbose()) {
					wvt = X.U16(p+0x18,_LE);
					smp = X.U16(p+0x1A,_LE);
					sOptionT(X.SC(p+0x0C,0x200,"UTF8"));
					sOption(" wvt:"+wvt+" smp:"+smp);
				}
			} //verbose inst
		} //inst
		if(cV === 'm' && X.isVerbose()) {
			p = X.U32(0x14,_LE);
			if(p>0 && X.c("'INFO'",p)) {
				t = X.SC(p+0x100,0x200,"UTF8");
				p1 = X.fSig(p+0x100,0x200,"00")+1;
				a = X.SC(p1,0x200,"UTF8");
				p1 = X.fSig(p1,0x200,"00")+1;
				ins = X.U16(p+0x16,_LE);
				wvt = X.U16(p+0x18,_LE);
				smp = X.U16(p+0x1A,_LE);
				ptng = X.U32(p+0x1C,_LE);
				freq = X.F32(p+0x0C,_LE);
				A4freq = X.F32(p1,_LE);
				s1spd = X.U8(p+9)+"/"+X.U8(p+0x0A);
				s1ptn = X.U16(p+0x10);
				s1ord = X.U16(p+0x12);
				sOptionT(t);
				sOptionT(a,"by: ");
				chips = []; el = false; i = 0;
				while(!el && (i<32)) {
					switch(X.U8(p+0x20+i)) {
					case 0: el = true; break;
					case 0x01: chips[i] = "YMU759 (17ch)"; break;
					case 0x02: chips[i] = "Genesis (10ch comp.)"; break;
					case 0x03: chips[i] = "SN76489 (SMS) (4ch)"; break;
					case 0x04: chips[i] = "Game Boy (4ch)"; break;
					case 0x05: chips[i] = "PC Engine (6ch)"; break;
					case 0x06: chips[i] = "NES (5ch)"; break;
					case 0x07: chips[i] = "C64 (8580) (3ch)"; break;
					case 0x08: chips[i] = "Arcade (YM2151+SegaPCM) (13ch)"; break;
					case 0x09: chips[i] = "Neo Geo CD (YM2610) (13ch)"; break;
					case 0x42: chips[i] = "Genesis extended (13ch)"; break;
					case 0x43: chips[i] = "SN76489 (SMS) + YM2413 (OPLL) (13ch comp.)"; break;
					case 0x46: chips[i] = "NES+VRC7 (11ch)"; break;
					case 0x47: chips[i] = "C64 (6581) (3ch)"; break;
					case 0x49: chips[i] = "Neo Geo CD extended (16ch)"; break;
					case 0x80: chips[i] = "AY-3-8910 (3ch)"; break;
					case 0x81: chips[i] = "Amiga (4ch)"; break;
					case 0x82: chips[i] = "YM2151 (8ch)"; break;
					case 0x83: chips[i] = "YM2612 (6ch)"; break;
					case 0x84: chips[i] = "TIA (2ch)"; break;
					case 0x85: chips[i] = "VIC-20 (4ch)"; break;
					case 0x86: chips[i] = "PET (1ch)"; break;
					case 0x87: chips[i] = "SNES (8ch)"; break;
					case 0x88: chips[i] = "VRC6 (3ch)"; break;
					case 0x89: chips[i] = "YM2413 (OPLL) (9ch)"; break;
					case 0x8A: chips[i] = "FDS (1ch)"; break;
					case 0x8B: chips[i] = "MMC5 (3ch)"; break;
					case 0x8C: chips[i] = "Namco 163 (8ch)"; break;
					case 0x8D: chips[i] = "YM2203 (6ch)"; break;
					case 0x8E: chips[i] = "YM2608 (16ch)"; break;
					case 0x8F: chips[i] = "YM3526 (OPL) (9ch)"; break;
					case 0x90: chips[i] = "YM3812 (OPL2) (9ch)"; break;
					case 0x91: chips[i] = "YMF262 (OPL3) (18ch)"; break;
					case 0x92: chips[i] = "MultiPCM (28ch)"; break;
					case 0x93: chips[i] = "Intel 8253 (beeper) (1ch)"; break;
					case 0x94: chips[i] = "POKEY (4ch)"; break;
					case 0x95: chips[i] = "RF5C68 (8ch)"; break;
					case 0x96: chips[i] = "WonderSwan (4ch)"; break;
					case 0x97: chips[i] = "Philips SAA1099 (6ch)"; break;
					case 0x98: chips[i] = "OPZ (YM2414) (8ch)"; break;
					case 0x99: chips[i] = "Pokémon Mini (1ch)"; break;
					case 0x9A: chips[i] = "AY8930 (3ch)"; break;
					case 0x9B: chips[i] = "SegaPCM (16ch)"; break;
					case 0x9C: chips[i] = "Virtual Boy (6ch)"; break;
					case 0x9D: chips[i] = "VRC7 (6ch)"; break;
					case 0x9E: chips[i] = "YM2610B (16ch)"; break;
					case 0x9F: chips[i] = "ZX Spectrum (beeper) (6ch)"; break;
					case 0xA0: chips[i] = "YM2612 extended (9ch)"; break;
					case 0xA1: chips[i] = "Konami SCC (5ch)"; break;
					case 0xA2: chips[i] = "OPL drums (YM3526) (11ch)"; break;
					case 0xA3: chips[i] = "OPL2 drums (YM3812) (11ch)"; break;
					case 0xA4: chips[i] = "OPL3 drums (YMF262) (20ch)"; break;
					case 0xA5: chips[i] = "Neo Geo (YM2610) (14ch)"; break;
					case 0xA6: chips[i] = "Neo Geo extended (YM2610) (17ch)"; break;
					case 0xA7: chips[i] = "OPLL drums (YM2413) (11ch)"; break;
					case 0xA8: chips[i] = "Atari Lynx (4ch)"; break;
					case 0xA9: chips[i] = "SegaPCM (DefleMask compat.) (5ch)"; break;
					case 0xAA: chips[i] = "MSM6295 (4ch)"; break;
					case 0xAB: chips[i] = "MSM6258 (1ch)"; break;
					case 0xAC: chips[i] = "Commander X16 (VERA) (17ch)"; break;
					case 0xAD: chips[i] = "Bubble System WSG (2ch)"; break;
					case 0xAE: chips[i] = "OPL4 (YMF278B) (42ch)"; break;
					case 0xAF: chips[i] = "OPL4 drums (YMF278B) (44ch)"; break;
					case 0xB0: chips[i] = "Seta/Allumer X1-010 (16ch)"; break;
					case 0xB1: chips[i] = "Ensoniq ES5506 (32ch)"; break;
					case 0xB2: chips[i] = "Yamaha Y8950 (10ch)"; break;
					case 0xB3: chips[i] = "Yamaha Y8950 drums (12ch)"; break;
					case 0xB4: chips[i] = "Konami SCC+ (5ch)"; break;
					case 0xB5: chips[i] = "tildearrow Sound Unit (8ch)"; break;
					case 0xB6: chips[i] = "YM2203 extended (9ch)"; break;
					case 0xB7: chips[i] = "YM2608 extended (19ch)"; break;
					case 0xB8: chips[i] = "YMZ280B (8ch)"; break;
					case 0xB9: chips[i] = "Namco WSG (3ch)"; break;
					case 0xBA: chips[i] = "Namco 15xx (8ch)"; break;
					case 0xBB: chips[i] = "Namco CUS30 (8ch)"; break;
					case 0xBC: chips[i] = "MSM5232 (8ch)"; break;
					case 0xBD: chips[i] = "YM2612 extra features extended (11ch)"; break;
					case 0xBE: chips[i] = "YM2612 extra features (7ch)"; break;
					case 0xBF: chips[i] = "T6W28 (4ch)"; break;
					case 0xC0: chips[i] = "PCM DAC (1ch)"; break;
					case 0xC1: chips[i] = "YM2612 CSM (10ch)"; break;
					case 0xC2: chips[i] = "Neo Geo CSM (YM2610) (18ch)"; break;
					case 0xC3: chips[i] = "YM2203 CSM (10ch)"; break;
					case 0xC4: chips[i] = "YM2608 CSM (20ch)"; break;
					case 0xC5: chips[i] = "YM2610B CSM (20ch)"; break;
					case 0xC6: chips[i] = "K007232 (2ch)"; break;
					case 0xC7: chips[i] = "GA20 (4ch)"; break;
					case 0xC8: chips[i] = "SM8521 (4ch)"; break;
					case 0xC9: chips[i] = "M114S (16ch)"; break;
					case 0xCA: chips[i] = "ZX Spectrum (beeper/QuadTone) (5ch)"; break;
					case 0xCB: chips[i] = "Casio PV-1000 (3ch)"; break;
					case 0xCC: chips[i] = "K053260 (4ch)"; break;
					case 0xCD: chips[i] = "TED (2ch)"; break;
					case 0xCE: chips[i] = "Namco C140 (24ch)"; break;
					case 0xCF: chips[i] = "Namco C219 (16ch)"; break;
					case 0xD0: chips[i] = "Namco C352 (32ch)"; break;
					case 0xD1: chips[i] = "ESFM (18ch)"; break;
					case 0xD2: chips[i] = "Ensoniq ESS503 (32ch)"; break;
					case 0xD4: chips[i] = "PowerNoise (4ch)"; break;
					case 0xD5: chips[i] = "Dave (4ch)"; break;
					case 0xD6: chips[i] = "NDS (16ch)"; break;
					case 0xD7: chips[i] = "GBA (direct) (2ch)"; break;
					case 0xD8: chips[i] = "GBA (MinMod) (16ch)"; break;
					case 0xD9: chips[i] = "Bifurcator (4ch)"; break;
					case 0xDA: chips[i] = "SCSP (32ch)"; break;
					case 0xDB: chips[i] = "YMF271 (OPX) (48ch)"; break;
					case 0xDC: chips[i] = "RF5C400 (32ch)"; break;
					case 0xDD: chips[i] = "YM2612 XGM (9ch)"; break;
					case 0xDE: chips[i] = "YM2610B extended (19ch)"; break;
					case 0xDF: chips[i] = "YM2612 XGM extended (13ch)"; break;
					case 0xE0: chips[i] = "QSound (19ch)"; break;
					case 0xE1: chips[i] = "PS1 (24ch)"; break;
					case 0xE2: chips[i] = "C64 (6581)+PCM (4ch)"; break;
					case 0xE3: chips[i] = "Watara Supervision (4ch)"; break;
					case 0xE5: chips[i] = "µPD1771C-017 (4ch)"; break;
					case 0xF0: chips[i] = "SID2 (3ch)"; break;
					case 0xF1: chips[i] = "5E01 (5ch)"; break;
					case 0xF5: chips[i] = "SID3 (7ch)"; break;
					case 0xFC: chips[i] = "Pong (1ch)"; break;
					case 0xFD: chips[i] = "Dummy System (8ch)"; break;
					case 0xFE: case 0xFF: chips[i] = "reserved for development"; break;
					default: chips[i] = "unk.";
					}
					if(!el) i++;
				}
				sOption("chips: "+chips.join("+")); //sVersion += #chip1#chip2?
				sOption("ticks="+freq.toFixed(2)+"Hz, A4="+A4freq+"Hz");
				sOption("ins:"+ins+" wvt:"+wvt+" smp:"+smp+" glob.ptn:"+ptng);
				sOption("1st song's spd:"+s1spd+" ptn:"+s1ptn+" ord:"+s1ord);
			} //verbose mod
		} //mod
	}
	else if(X.c("'FWMP'00")) {
		sName = "Capcom/ARC Developments' Forgotten Worlds BGM module (.FW)"; bDetected = 1;
	}
	else if(X.c("'FXSM'")) { //same as AY Amadeus!
		sName = "František Fuka's Fuxoft AY Language module (.FXM)"; bDetected = 1;
	}
	else if(X.c("'GBRF'..00") && isWithin(X.U8(4), 1, 0x30) && isWithin(X.U8(6), 0,3) && isWithin(X.U8(7), 1,3)
	  //&& [...Array(0x10).keys()].every(i => [0, 0xFF].includes(X.U8(0x10+i))) //Qt5 compatibility
	  ) {
		sName = "Gameboy Ripped Format chiptune (.GBR)"; bDetected = 1;
		t = X.SA(0x154,0x13);
		if(t != "") if(/^([a-zA-Z0-9_ -]{4,})/.test(t)) sOptions = sOptions.append(t);
	}
	else if(X.Sz() > 0x70 && X.c("'GBS'01") && X.U8(4) && X.U8(0xD) >= 0xA7) {
		bDetected = 1;
		sName = "Gameboy Sound chiptune (.GBS)";
		if(X.isVerbose())
			sOptionT(X.SA(0x10,0x20));
		tc = X.U8(4); if(tc > 1) sOption(tc,"×");
		if(X.isVerbose()) {
			sOptionT(X.SA(0x30,0x20),"by: ");
			sOptionT(X.SA(0x50,0x20));
		}
	}
	else if(X.c("'GDM'FE") && X.c("0D0A1A'GMFS'",0x44) && X.U16(0x74) <= 9
	  && isWithin(ordp=X.U32(0x76), 0x9D,X.Sz()) && isWithin(ptnp=X.U32(0x7B), 0x9D,X.Sz())
	  && isWithin(smptp=X.U32(0x80), 0x9D,X.Sz()) && isWithin(smpp=X.U32(0x84), 0x9D,X.Sz())) {
		//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_gdm.cpp
		sName = "BWSB General Digital Music module (.GDM)"; bDetected = 1;
		trkr = "";
		if(X.U16(0x4D,_BE)==0) trkr = "2gdm";
		sVersion = "v"+ X.U8(0x4B) +"."+ X.U8(0x4C);
		if(trkr != "") sVersion += "/"+trkr+" v"+X.U8(0x4F)+"."+X.U8(0x50);
		if(X.isVerbose()) {
			ord = X.U8(0x7A)+1; ptn = X.U8(0x7F)+1; smp = X.U8(0x88)+1;
			for(ch=0,i=0x51; i < 0x71; ch+=X.U8(i++) != 0xFF);
			smps = [];
			for(allsmpsz=0,i=0,p=smptp; i++ < smp; p+=0x3E) {
				smps.push(X.SC(p,0x20,'CP437').trim()); allsmpsz += X.U32(p+0x2D)
			}
			switch(Math.max(ordp,ptnp,smptp,smpp)) {
			case ordp: sz = ordp+ord; break;
			case ptnp: for(p=ptnp,i=0; i++ < ptn && p < X.Sz(); p+=X.U16(p)); sz = p; break;
			case smptp: sz = smptp+0x3E*smp; break;
			case smpp: sz = smpp + allsmpsz; break; //the only case I ever saw
			}
			sOptionT(X.SC(0x04,0x20,'CP437'));
			sOptionT(X.SC(0x24,0x20,'CP437'),"by: ");
			sOption(['','ProTracker MOD','Multitracker','Scream Tracker 3','Composer 669 / UNIS 669',
				'Farandole Composer','UltraTracker','Scream Tracker 2','OctaMED',
				'Epic Megagames MASI'][X.U16(0x74)],'orig:');
			sOptionT(X.SC(X.U32(0x89),X.U32(0x8D),'CP437'));
			//Seems absolutely no-one used the message pointers, but samples do have info
			sOptionT(addEllipsis(smps.filter(funSampleName).join('\n'),0xB0),'smp/msg:"\n','"');
			sOption('ch:'+ch+' tmp0:'+X.U8(0x72)+' bpm0:'+X.U8(0x73)+' ord:'+ord+' ptn:'+ptn
				+' smp:'+smp+' sz:'+outSz(sz))
		}
	}
	else if(X.c("'GLUE'B8B3AABA")) {
		//TODO reverse & find calcsize
		sName = "Lars 'GlueMaster' Malmborg's GlueMon module (.GLUE)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(8,8));
			ins = X.U8(0x7F);
			ord = X.U8(0x9E); ptn = 0;
			for(i=0; i < ord; i++) { t = X.U8(0x9F+i); if(t != 0xFF && ptn < t) ptn = t }
			ptn++;
			sOption("ord:"+ord+" ptn:"+ptn+" ins:"+ins)
		}
	}
	else if(X.c("'NuFREDGRAY'",0x22)) {
		sName = "Fred Gray's module (.GRAY)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.SA(0x50,0x100); pn = 0x50+t.length+1;
			a = X.SA(pn,0x100); pn += a.length+1;
			c = X.SA(pn,0x100);
			sOptionT(t); sOptionT(a,"by: "); sOptionT(c)
		}
	}
	else if(X.c("'GTK'") && isWithin(X.U8(3),1,4) && X.U16(0xC4,_BE) <= 255 && isWithin(X.U16(0xC6,_BE),1,256)
	  && isWithin(X.U16(0xC8,_BE),1,32) && (ord = X.U16(0xCA,_BE)) <= 256 && X.U16(0xCC,_BE) <= ord
	  || X.c("'GT2'") && (X.U8(3) > 5 && X.U32(4,_BE) == 0xE4 || X.U32(4,_BE) == 0xEC+2*X.U16(0xEA,_BE))
	  && isWithin(X.U16(0xCA,_BE),1994,9999)) {
		//GTK from http://ldesoras.free.fr/src/gt2/dev_gtk.zip / formats.txt
		//GT2 from mod_gt2.cpp
		//+ input from the author (http://ldesoras.free.fr)
		bDetected = 1;
		sigv = 0; bad = '';
		switch(X.U8(2)) {
			case 0x4B: sName = "Laurent 'Dumbo' de Soras's Graoumf Tracker module (.GTK)"; sVersion = "Amiga "; sigv = 1; break;
			case 0x32: sName = "Laurent 'Dumbo' de Soras's Graoumf Tracker 2 module (.GT2)"; sVersion = "PC " ; sigv = 2;
		}
		v = X.U8(3); sVersion += "v"+v;
		if(sigv == 1  && v < 6) switch(v) {
			case 1: sVersion += "/GT v0.7"; break;
			case 2: sVersion += "/GT v0.726"; break;
			case 3: sVersion += "/GT v0.731"; break;
			//lost in time
		}
		else {
			 if(v == 9) sVersion += "/GT r27"; //TODO maybe track down some other values
		}
		tracker = statln = '';
		if(sigv == 1) { //m68k GTK
			t = X.SC(4,0x20,'ISO8859-1').trim(); d = xc = "";
			c = X.SC(0x24,0xA0,'ISO8859-1').trim(); //the author says he never implemented this
			trk = X.U16(0xC8,_BE); ord = X.U16(0xCA,_BE); smp = 0; smprecs = X.U16(0xC4,_BE);
			rows = X.U16(0xC6,_BE); lp = X.U16(0xCC,_BE); smpinfosz = v <= 2 ? 0x30 : 0x40;
			sszofs = v == 1 ? 32 : 28; if(v >= 3) sszofs += 16; if(v >= 2) sszofs += 4;
			smp = smpsz = 0; p = 0xCE; for(i=0; i < smprecs; i++) {
				if(ssz = X.U32(p+sszofs,_BE)) { smpsz += ssz; smp++ }; p += smpinfosz;
				if(ssz%2) bad = bad.addIfNone('!oddsmpsz') }
			ptn = 0; for(i=0; i < ord; i++) { if((pt=X.U16(p,_BE)) > ptn) ptn = pt; p += 2 } ptn++;
			nn = v == 4 ? 5 : 4;
			songsz = 0x2CE + smprecs*smpinfosz + ptn*rows*trk*nn; //hdr, smpinfo, order, ptns
			sz = songsz+smpsz;
			statln = 'trk:'+trk+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+(lp?' lp:'+lp:'')+' sz:'+outSz(sz)
		}
		else { //x86 GT2
			t = X.SA(8,0x20).trim();
			d = X.U16(0xCA,_BE)+"-"+X.U8(0xC9).padStart(2,'0')+"-"+X.U8(0xC8).padStart(2,'0');
			c = X.SA(0x28,0xA0).trim(); tracker = X.SA(0xCC,0x18);
			pn = songhk = spd = bpm = ord = lp = mptn = ptn = ins = smp = trk = 0; sz = -1; xc = [];
			if(v < 6) { spd = X.U16(0xE4,_BE); bpm = X.U16(0xE6,_BE) }
			while(pn < X.Sz()) {
				hkhd = X.SA(pn,4); hksz = X.U32(pn+4,_BE); pn += 8;
				switch (hkhd) {
				case 'SONG': ord = X.U16(pn,_BE); lp = X.U16(pn+2,_BE);
					mptn = 0; p = pn+4; for(i=0; i<ord; i++,p+=2) mptn = Math.max(mptn,X.U16(p,_BE));
					mptn++; songhk++; break;
				case 'PATD': case 'PAIN': case 'PAFX': case 'PAMI': ptn++;
					trk = Math.max(trk, X.U16(pn+0x16,_BE)); break;
				case 'INST': ins++; break;
				case 'SAMP': case 'SAM1': case 'SAM2': smp++; break;
				case 'XCOM': xcc = X.U16(pn,_BE);
					xc = xc.push(X.SA(pn+2,xcc).trim());
					break;
				case 'TCN2':
					bpm = X.U16(pn+2,_BE)+(X.U16(pn+4,_BE) ? '.'+X.U16(pn+4,_BE) : '');
				case 'ENDC': sz = pn+hksz-8;
					break
				}
				pn += (hksz-8 > 0)? hksz - 8 : 0;
				if(sz >= 0) break; //or one could see a mod with no ENDC. gimmekuh!.gt2 (v==1)? Any modern TCN2 thing?
				if(charStat(next = X.SA(pn,4)).indexOf('allasc') < 0 //check for all 4ccs being ok
				  || next.toUpperCase() != next) break;
			}
			if(!songhk) bad = bad.addIfNone('!noSONG');
			if(sz <= 0) { sz = pn; bad = bad.addIfNone('!noendtag') }
			if(ptn != mptn) ptn = mptn+'/'+ptn;
			statln = statln.appendS((bpm?'bpm0:'+bpm+' ':'')+(spd?'spd0:'+spd+' ':'')+'trk:'+trk
				+' ord:'+ord+(lp?' lp:'+lp:'')+' ptn:'+ptn+' ins:'+ins+' smp:'+smp+' sz:'+outSz(sz),' ')
		}
		if(X.isVerbose()) {
			sOption(t); sOption(d,'on:'); sOption(tracker,'in:'); sOption(c);
			if(xc.length) sOption(addEllipsis(xc.join('\n'),0x100,0xA0),'msg: "','"');
			sOption(statln)
		}
		if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/')
	}
	else if(X.c("'NuH.DAVIES'",0x22)) {
		sName = "Howie Davies's module (.HD)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.SA(0x64,0x100); pn = 0x64+t.length+1;
			a = X.SA(pn,0x100); pn += a.length+1;
			c = X.SA(pn,0x100);
			sOptionT(t);
			sOptionT(a,"by: ");
			sOptionT(c);
		}
	}
	else if(X.c("'HESM'00") && isWithin(X.U8(7),0x7D,0xFE) && X.c("FFF8", 8)
	  && isWithin(X.I8(0xA),-8,0x20) && isWithin(X.I8(0xB),-8,0x20) && isWithin(X.I8(0xC),-8,0x20)
	  && isWithin(X.I8(0xD),-8,0x20) && isWithin(X.I8(0xE),-8,0x20) && X.c("'DATA'", 0x10)
	  && [0,0xE0].indexOf(X.U8(0x14)) >= 0 && X.c("002000000000000000", 0x17) && X.Sz() >= 0x100) {
	 	//ref https://github.com/libgme/game-music-emu/blob/master/gme/Hes_Emu.cpp
		sName = "Hudson Entertainment System multitrack tune (.HES)"; bDetected = 1;
		sVersion = "v"+X.U8(4); startsong = X.U8(5); reqaddr = X.U16(6);
		dtsz = X.U32(0x14); dtaddr = X.U32(0x18);
		if(X.isVerbose()) {
			t = a = c = ""; p = 0x40;
			function getText() { if(X.U8(p)) {
				var len = 0x20; if(X.U8(p+0x1F) && !X.U8(p+0x2F)) len = 0x30; //some are longer than t'others
				var s = X.readBytes(p,len), z = s.indexOf(0); if(z < 0) return '';
				if(charStat(s.slice(0,z),1).indexOf('asc') < 0) return '';
				p += len; s = decEncoding(s,CP437,true,Chars0to1F); if(s == '<?>') return ''; else return s
			} else return '' }
			if(X.U8(p) >= 0x20) { sOptionT(getText()); sOptionT(getText(),"by:"); sOptionT(getText()) }
			sOption('from:'+startsong+' sz:'+outSz(dtaddr+dtsz))
		}
	}
	else if(X.c("'GTI5'")) {
		sName = "Lasse 'Faust' Öörni's GoatTracker 2 Instrument (.INS)"; bDetected = 1
	}
	else if(X.c("'ISM!V1.2'")) {
		sName = "Hans Bergstedt's Sound Invasion Music System/In Stereo! module (.IS)"; bDetected = 1;
		sVersion = "v"+X.SA(5,3);
		if(X.isVerbose())
			sOptionT(X.SA(0x24,25))
	}
	else if(X.c("'IS20DF10STBL'")) {
		sName = "Hans Bergstedt's Sound Invasion Music System/In Stereo! module (.IS20)"; bDetected = 1;
		sVersion = "v2.0";
	}
	else if(X.c("'IXS!'")) {
		sName = "Sahara Surfers' iXalance module (.IXS)"; bDetected = 1; sVersion = 'compressed';
		if(X.isVerbose()) {
			sOptionT(X.SA(0x18,0x20)); sOption(outSz(0x38+X.U32(0x10)),'sz:')
		}
		//Unpacked module detection is in the sanity checks
	}
	else if((X.c("'MUSE'DEADBEAF") || X.c("'MUSE'DEADBABE")) && X.U32(16)+24 == X.U32(8)) {
		sName = "Jazz Jackrabbit 2 container (.J2B)/Galaxy Sound System module";
		sVersion = "compressed"; bDetected = 1;
		if(X.isVerbose())
			sOption('sz:'+X.U32(8))
		//TODO: confirm if zlib extraction available; if so, derive the module info too
		//Unpacked module detection is in the sanity checks
	}
	else if(X.c("'NuJ.FLOGEL'",0x22)) {
		sName = "Janko Mrsic-Flogel's module (.JMF)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.SA(0x54,0x100); pn = 0x54+t.length+1;
			a = X.SA(pn,0x100); pn += a.length+1;
			c = X.SA(pn,0x100);
			sOptionT(t); sOptionT(a,"by: "); sOptionT(c)
		}
	}
	else if( X.c("2B7C.... ........ 2B7C.... ........ 2B7C.... ........ 2B7C.... ........ 303C00FF 32004EB9 ........ 4E75")
	  && X.I32(2,_BE) >= 0x2E) {
		sName = "Steve Turner's module (.JPO)"; bDetected = 1;
		if(X.isVerbose()) {
			//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SteveTurner/src/Steve%20Turner_v4.asm
			ofs = X.U32(2,_BE);
			p1 = p = X.U32(0x12,_BE)-ofs+0x2E;  d1 = 10;
			while(p <= Math.min(X.Sz(),0x100000)) {
				t = X.U16(p,_BE); if(t == 0xF0FF) break; p += 2;
				d0 = t; if(d0 > d1) d1 = d0;
			}
			sz = X.fSig(p1+d1,TOEOF,"FF"); if(sz > 0) sz++;
			p = X.U32(0xA,_BE)-ofs+0x2E; x = 0; // e4ec~e4fe
			while(p < X.Sz()) { d0 = X.U16(p,_BE)&0xFFF0; if(d0) break; p += 0x0C; x++ }
			if(X.c("2b7c0004449c0faa2b7c000479840fa22b7c00047ab40fa62b7c000458980fae"))
				x = 5; // paradroid90.jpo
			d0 = 0x14+X.U32(0x1A,_BE)-ofs;
			smp = (X.U32(d0,_BE) >> 2)-1;
			smpsz = X.U32(d0+4,_BE);
			if(x > 1) sOption(x,"×"); sOption("smp:"+smp+" smpsz:"+Hex(smpsz)+" sz:"+outSz(sz))
		}
	}
	else if((X.c("'KSCC'") && !X.U8(0xE) && !(X.U8(0xF) & 0xE0)) || //&meant to be 0xF0 but majutsushi*.kss have 0x10 there
	  (X.c("'KSSX'") && !X.U32(0x14))) {
		// ref https://sourceforge.net/p/nezplug/code/HEAD/tree/nezplug/trunk/src/nes/m_kss.c & trunk/in_nez.txt
		sName = "Konami's KSS chiptune (.KSS)"; bDetected = 1;
		if(X.c("'KSSX'")) { nv = 1; sVersion = "extended" } else nv = 0;
		bnk = X.U8(0xD) & 0x7F; bnk16 = X.U8(0xD) & 0x80 ? 1 : 2;
		if(bnk) sVersion = sVersion.appendS('banks'+(bnk16 == 1?'8k':'16k'), ',');
		chip = X.U8(0xF);
		if(X.isVerbose()) if(X.c("'MBM'",0x20)) sOptionT(X.SA(0x24,0x34));
		sz = 0x10+X.U8(0xE)+X.U16(6)+0x2000*bnk*bnk16;
		hnmmode = rammode = false; scc = true; ch = 1;
		if(chip & 2) {
			sVersion = sVersion+'#SEGA-MkIII(SMS)';
			if(chip & 4) { sVersion = sVersion+'/GameGear-Stereo'; ch = 2 }
			else sVersion = sVersion+'/SMS-SNG(SN76489)';
			if(chip & 1) sVersion = sVersion+'/FM-UNIT(YM2413)';
			if(chip & 0x88) rammode = true;
			scc = false
		} else {
			if(chip & 0x10) {
				if(chip & 8) { sVersion = sVersion+'#MSX-AUDIO-STEREO'; ch = 2 }
				else { sVersion = sVersion+'#MSX-AUDIO'; hnmmode = true }
			} else sVersion = sVersion+'#MSX-AUDIO';
			if(chip & 1) sVersion = sVersion+'/MSX-MUSIC';
 			if(chip & 0x80) { rammode = true; scc = false }
			else {
				rammode = (chip & 4) != 0; scc = !rammode
			}
		} 
		if(rammode) sVersion = sVersion+'/RAM'; if(scc) sVersion = sVersion+'/SCC';
		if(hnmmode) sVersion = sVersion+'/牌の魔術師DAC';
		if(nv) if(X.U8(0xE) >= 0xB) if(X.isVerbose()) {
			x1 = X.U16(0x18); x2 = X.U16(0x1A);
			if(x2-x1 > 1) sOption('subsongs '+x1+'-'+x2);
		}
		if(X.isVerbose()) sOption('ch:'+ch+(bnk?' ex.bnk:'+bnk:'')+' sz:'+outSz(sz))
	}
	else if(X.c("'cyd!song'") && X.U8(8) < 30) { //v27 was the last I saw, give it time...
		//ref https://github.com/kometbomb/klystron/tree/master/src/snd/music.c , .h : mus_load_song_RW
		sName = "Tero 'kometbomb' Lindeman's Klystrack/Klystron module (.KT)"; bDetected = 1;
		v = X.U8(8); sVersion = "v"+v;
		if(X.isVerbose()) {
			p = 9;
			if(v >= 6) ch = X.U8(p++); else if(v > 3) ch = 4; else ch = 3;
			timesig = X.U8(p++)+"/"+X.U8(p++);
			if(v >= 17) p += 2; //seqstep
			ins = X.U8(p++);  ptn = X.U16(p); p += 2;
			nseq = []; for(i=0; i < ch; i++,p+=2) nseq[i] = X.U16(p);  //seq cnt per channel
			len = X.U16(p); p += 2; /*lp = X.U16(p);*/ p += 2;
			if(v >= 12) p++; //master_volume
			spd = X.U8(p++); spd2 = X.U8(p++);
			rate = X.U8(p++); //bpm?...
			if(v > 2) { fl = X.U32(p); p += 4 } else fl = 0; if(v >= 9) p++; if(v >= 16) p++; //flags, mulpd, ptcin
			tlen = 17; if(v >= 11) tlen = X.U8(p++);
			if(v >= 5) tlen = Math.min(tlen,65);
			sOptionT(X.SC(p,tlen,'CP1250')); p += tlen;
			if(v >= 10) fx = X.U8(p++); else if(fl&1) fx = 1;
			if(fx)
				if(v >= 10) for(i=0; i < fx; i++) { //inner_load_fx
					if(v >= 22) { nsz = X.U8(p++); /*_l2r('kt',p,'fx#'+i+': '+X.SA(p,nsz));*/ if(nsz) p += Math.min(nsz,32) }
					p += 9; if(v < 27) p++; if(v < 21) p++;
					if(v >= 27) p += 6*16; else p += 4*8;//taps
					p++; if(v >= 19) p++;
				} else p += 8*8*fx;
			if(v >= 13) p += ch*2;//dfltvol,dfltpan
			insn = [];
			for(i=0; i < ins; i++) {
				p += 0x11; p += 2*X.U8(p)+1; //progsteps
				p += 7; if(v >= 20) p++;//finetune
				nsz = (v < 11)? 16: Math.min(X.U8(p++),33);
				insn.push(X.SC(p,nsz,'CP1250').trim()); p += nsz;
				if(v >= 1) p += 4;
				if(v >= 7) p += 3;
				if(v >= 10) p++; //fx_bus
				if(v >= 11) p += 3;
				if(v >= 18) p++;
				if(v >= 12) wt_entry = X.U8(p++); else wt_entry = 0;
				if(v >= 23) p += 11;
				if(v >= 25) p++;
				if(v >= 23) fm_wave = X.U8(p++); else fm_wave = 0;
			}
			ord = 0; //????
			for(i=0; i < ch; i++) { ord = Math.max(nseq[i],ord); if(v < 8) p += 6*nseq[i]; else p += 5*nseq[i] }
			notes = 0;
			for(i=0; i < ptn; i++) {
				steps = X.U16(p); p += 2;
				if(v >= 24) p++; //colour
				if(v < 8) {
					s = v < 2? 3: 6; p += steps*s;
				} else {
					slen = (steps >> 1)+(steps&1); packed = X.readBytes(p,slen); p += slen;
					for(s=c=0; s < steps; s++) {
						bits = ((s&1) || (s == steps-1))? packed[c] & 0xF : packed[c] >> 4;
						if(bits&1) { p++; notes++ } if(bits&2) p++;
						if(bits&4) { ctl = X.U8(p++); if(v >= 14) bits |= ctl & ~7 }
						if(bits&8) p += 2; if(bits&0x80) p++;
						if(s&1) c++
					}
				}
			}
			maxwt = 0;
			if(v >= 12) {
				maxwt = X.U8(p++);
				for(i=0; i < maxwt; i++) {
					sn = X.U32(p+8);
					p += 0x16;
					if(sn) if(v < 15) p += sn*2;
					else { dtsz = X.U32(p)/*in bits*/; p += 4+Util.divu64(dtsz+7,8) }
				}
			}
			wts = [];
			if(v >= 26) for(i=0; i < maxwt; i++) {
				t = X.U8(p++); wts.push(X.SC(p,t,'CP1250').trim()); p += t
			}
			sOptionT(addEllipsis(insn.filter(funSampleName).join(',')),'ins/msg:"','"');
//			sOptionT(addEllipsis(wts.filter(funSampleName).join(',')),'smp/msg:"','"');
			sOption('ch:'+ch+' tsig:'+timesig+' rate:'+rate+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' wt:'+maxwt
				+' notes:'+notes+' spd:'+spd+'-'+spd2+' fx:'+fx+' sz:'+outSz(p))
		}
	}
	else if(X.c("'cyd!inst'") ) {
		sName = "Tero 'kometbomb' Lindeman's Klystrack instrument (.KI)"; bDetected = 1
	}
	else if(X.c("'cyd!efex'") ) {
		sName = "Tero 'kometbomb' Lindeman's Klystrack effects (.KF?)"; bDetected = 1
	}
	else if( X.c("'ADL '0000....'MDhd'00000008000080..00000080'MThd'00000006000200..01E0'MTrk'0000....00FF03")
	  || ( X.U32(0,_LE)==X.Sz() && X.c("'AD'",4) ) ) {
		sName = "Lucas Arts Adlib chiptune (.LAA)"; bDetected = 1;
		if(X.SA(0,4)==="ADL ") sVersion = "new"; else sVersion = "old"
	}
	else if( X.c("'Liquid Module:'") ||
	  ( (X.isHeuristicScan() || X.c("'NO'"))
		 && extIs("liq"))
	  ||  X.c("21",0x01D6) && X.c("21",0x0AD2) && X.c("21",0x0BE6)
	  && X.c("FF",0x0ED4) && X.c("FF",0x0EE8) ) {
		sName = "Nir Oren's Liquid Tracker module (.LIQ)"; bDetected = 1;
		sVersion = X.SA(0x41,0x14).trim();
		if(X.isVerbose()) {
			if(X.SA(0,2) == "NO")
				sOptionT(X.SA(5,0x14))
			else if(X.SA(0,3) == "Liq") {
				sOptionT(X.SA(0x0E,0x32));
				sOptionT(X.SA(0x0E,0x0F),"by: ");
			}
		}
	}
	else if(X.Sz() > 0x38 && X.c("'LME'00") && X.fSig(4,0x20,"00") < 0 && !X.U32(0x24,_BE)) {
		//ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/LME/src/LMEv3.asm
		sName = "Steve 'Leggless' Hasler module (.LME)"; bDetected = 1;
		if(X.isVerbose()) {
			info = decAnsi(4,0x20,CPAmiga).trim(); songsz = 0x2C+X.U32(0x34,_BE);
			d3 = ins = Util.divu64(X.U32(0x38,_BE) - (i=X.U32(0x28,_BE)), 58);
			x = (i-0x10) >> 4; i += 0x28; smp = synsmp = smpsz = 0;
			for(d7 = 3; d3; d3--, i += 0x3A)
				if(!(t=X.U32(i,_BE))) synsmp++
				else if(t > d7) { d7 = t; smpsz += X.U16(i+4,_BE) << 1; smp++ }
			steps = (X.U32(0x30,_BE) - X.U32(0x2C,_BE)) >> 2; sz = songsz+smpsz;
			if(x > 1) sOption(x,'×');  sOption(info,'info:"','"');
			sOption('steps:'+steps+' ins:'+ins+' sz:'+outSz(sz))
		}
	}
	else if(X.c("'sa-team 89a'10610A6108610678006000",0x16C)
	  && X.c("'dynamite89'",0x234) && isWithin(X.U16(0x50A,_BE), 0,15)) {
		sName = "Oscar Giesen & Marco Swagerman's Music Assembler module (.MA)"; bDetected = 1; if(X.isVerbose()) {
//ref https://web.archive.org/web/20071010162252/http://www.exotica.org.uk/tunes/formats/ma/ma_v0.zip / ma_fmt.txt
			x = ptn = 0; vp = []; ptns = []; ord = []; ch = [];
			for(p=0x4B0,i=0; i < 40; i++,p+=2) vp[i] = 0x622+X.U16(p,_BE);
			for(i=0; i < 40; i+=4) { ch_ = ord_ = 0;
				for(j=i; j < i+4 && j < 40; j++) if(X.U8(vp[j]) != 0xFE) ch_++;
				if(ch_) {
					for(j=i,p=vp[j]; j < i+4 && p < X.Sz(); p+=2)
						if((t=X.U8(p)) == 0xFE) break; else if(t == 0xFF) j++;
						else { ord_++; if(ptns.indexOf(t) < 0) ptns.push(t) }
					if(ord_) { x++; ord.push(ord_) }
					ch.push(ch_)
				}
			}
			if(x > 1) sOption(x,'×');
			insp = 0x622+X.U32(0x5B6,_BE); ins = Util.divu64(vp[0]-insp,0x18);
			sOption('ch:'+ch.join('/')+' ord:'+ord.join('+')+' ptn:'+ptns.length+' ins:'+ins+' sz:'+outSz(0x622+X.U32(0x5AE,_BE)))
		}
	}
	else if(X.c("'MADG'") ) {
		sName = "B. Birney's PlayerPro module (.MAD)"; bDetected = 1;
		if(X.isVerbose())
			sOption(X.SA(4,0x12))
	}
	else if(X.c("D040D0404EFB")) {
		sName = "Mark Cooksey's module (.MC)"; sVersion = "new"; bDetected = 1
	}
	else if(X.c("'MDC'1A 00080040")) {
		//from https://github.com/ValleyBell/MidiConverters/blob/master/mdc2mid.c
		sName = "かるちゃん/CUL.'s music creative driver module (.MDC)"; bDetected = 1;
		info = ''; maxsz = Math.max(X.Sz(),65536);
		sz = X.U32(8,_BE); p = X.U32(0x14,_BE); midires = X.U16(0x2C,_BE);
		if(p && p < maxsz && (t=X.fSig(p,maxsz,'0D0A1A')) > 0) info = X.SC(p,t-p,'Shift_JIS');
		p = trkp = X.U32(0x10,_BE); x = X.U16(p,_BE); if(x > 0x20) sVersion = '!badsongcnt';
		for(i=ch=0,p+=2; i < Math.min(x,0x20); i++,p+=8) if(ch < X.U8(p+5)) ch = X.U8(p+5)
		if(X.isVerbose()) {
			sOptionT(info); if(x > 1) sOption(x,'×'); sOption('ch:'+ch+(sz?' sz:'+outSz(sz):''));
		}
	}
	else if(X.c("'DMDL'..'IN'")) {
		sName = "Digitrakker module (.MDL)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(0x0B,32));
			sOptionT(X.SA(0x2B,20),"by: ");
		}
	}
	else if(X.c("'MMDC'")) { //before the more generic compare("'MMD'")
		sName = "Tony Crowther's packed MED module (.MMDC)"; bDetected = 1;
		if(X.isVerbose()) sOption(outSz(X.U32(4,_BE)),"sz:")
	}
	else if(X.c("000001001100010014000000'GameBoy Music Module'")) {
		sName = "Paragon 5/Beyond Game Boy Tracker module (.MGB)"; bDetected = 1
		//it's proprietary and seemingly packed in some manner, not easy to extract data. TODO?
	}
	else if(X.c("'MGT'11BD'MCS'")) {
		sName = "Megatracker module (.MGT)"; bDetected = 1;
		sOptionT(X.SA(0x3A,0x20))
	}
	else if(X.c("'MThd'") && X.c("'MTrk'",8+X.U32(4,_BE)) && X.U16(8,_BE) <= 2) {
		//ref. spec. from midi.org: RP-001_v1-0_Standard_MIDI_Files_Specification_96-1-4.pdf
		sName = "Standard MIDI File (.MID)"; sVersion = "v1.0";
		nV = X.U16(8,_BE); bad = ""; bDetected = 1;
		switch(nV) {
		case 0: sVersion += " t.0:one track"; break;
		case 1: sVersion += " t.1:tracks"; break;
		case 2: sVersion += " t.2:tracks+tempo"
		}
		bDetected = 1;
		charset = 'SJIS'; //'CP1252'
		trk = X.U16(0x0A,_BE); if(trk > 1) sOption(trk,"trk:");
		if(nV == 0 && trk != 1) bad += "!badvertrk";
		sz = p = 0x0E; txt = by = title = lyr = "";
		for(i=0; i < trk; i++) {
			var readmore = 20; //mostly enough to catch the info messages; set to 0xFFFFFFFF for all of 'em
			if(!X.c("'MTrk'",p) || (i && !X.c("FF2F00",p-3))) { bad += "!badtrk"; break }
			len = X.U32(p+4,_BE); p += 8; sz = p;
			while(readmore && p < sz+len && p < X.Sz()) {
				readmore--; dt = readVarUInt(p);
//logpart1="@"+Hex(p)+" on "+dt+": ";
				p += dt[0];
				switch(X.U8(p++)) {
				case 0xF0: case 0xF7: t = readVarUInt(p); p += t[0]+t[1]; break;
				case 0xFF: a = X.U8(p++);
//_log(logpart1+"["+readVarUInt(p)+"] meta event "+Hex(a));
					switch(a) {
						case 0: if(X.U8(p++) != 2) readmore = 0; else p += 4; break;
						case 3: t = readVarUInt(p); p += t[0];
							title = title.append(X.SC(p,t[1],charset).trim()); p += t[1];
							break;
						case 2: t = readVarUInt(p); p += t[0];
							by = by.append(X.SC(p,t[1],charset).trim()); p += t[1]; break;
						case 1: t = readVarUInt(p); p += t[0];
							txt = txt.append(X.SC(p,t[1],charset).trim()); p += t[1]; break;
						case 5: t = readVarUInt(p); p += t[0];
							lyr = lyr.append(X.SC(p,t[1],charset,"-").trim()); p += t[1];
							break;
						case 4: case 6: case 7: t = readVarUInt(p); p += t[0]+t[1]; break; //ins., lyrics, markers, cues
						case 0x20: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 1) {
							readmore = 0; bad += "!badprefix@"+(p-t[0]-t[1]) } break
						case 0x2F: t = readVarUInt(p); p += t[0]+t[1]; if(t[1])
							bad += "!badEoTtag@"+(p-t[0]-t[1]); readmore = 0; break;
						case 0x51: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 3) {
							readmore = 0; bad += "!badtempo@"+(p-t[0]-t[1]) } break;
						case 0x54: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 5) {
							readmore = 0; bad += "!badSMPTE@"+(p-t[0]-t[1]) } break;
						case 0x58: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] < 2 || t[1] > 4) {
							readmore = 0; bad += "!badtime@"+(p-t[0]-t[1]) } break;
						case 0x59: t = readVarUInt(p); p += t[0]+t[1]; if(t[1] != 2) {
							readmore = 0; bad += "!badkey@"+(p-t[0]-t[1]) } break;
						default: t = readVarUInt(p); p += t[0]+t[1]
					} break;
				default: //p += readVarUInt(p)[0];
//_log(logpart1+"default...");
				}
				if((txt != "" && by != "" && title != "") || p-sz > 0x200) readmore = 0;
			}
			sz += len; p = sz; if(p>X.Sz()) { bad += "!short"; break }
		} //for..trk
		if(bad) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(by,"by: "); sOptionT(txt);
			sOption(outSz(sz),"sz:")
		}
	} else if(X.c("'SMF2CLIP'")) {
		//ref. spec. from midi.org: M2-104-UM, MA06
		sName = "MIDI Clip File (.midi2)"; sVersion = "v2.0"; bDetected = 1;
	}
	else if(X.c("'MKJamz'")) {
		sName = "MK-Jamz module (.MKJ)"; bDetected = 1
	}
	else if(X.c("'MLEDMODL'000000")
	  && X.c("'VERS'",X.U32(8,_BE)+12)) {
		sName = "Musicline Editor module (.ML)"; bDetected = 1;
		p = 4; //header skipped
		t = ""; c = ""; x = 0; ch = smp = ins = ptn = 0;
		while (p < X.Sz()) {
			hkhd = X.SA(p,4); hksz = X.U32(p+4,_BE);
//_log(hkhd+': ['+Hex(p)+'..'+Hex(p+hksz)+']')
			if(charStat(hkhd).indexOf('allasc') < 0) break; //break off if it doesn't look like a 4cc
			p += 8;
			switch (hkhd) {
			case "VERS":
				v = X.U16(p,_BE); //skips MODL and VERS 4cc+4sz
				sVersion = "v"+(v>>8)+"."+((v&0xF0)>>4)+(v&0x0F);
				break;
			case "TUNE":
				x ++; t = t.appendS(X.SC(p,hksz,'CP1252').trim(),'; ');
				tmp0 = X.U16(p+0x20,_BE); spd0 = X.U8(p+0x22,_BE);
				groove = X.U8(p+0x23,_BE); ch = X.U8(p+0x27);
				//v0.79 through v1.06 = hksz broken, v1.10+ good, no samples of 1.07~1.09 :( We'll calc
				//if(v <= 0x106) {
				chsz = 0; hksz = 0x28; //we'll recalc the chunk size instead
				for(i=0; i < ch; i++) { chsz += X.U32(p+hksz,_BE); hksz += 4 }
				hksz += chsz; //fetch chdata sizes, skip data
				//}
				break;
			case "INFO":
				q = 0;
				while(q < hksz) {
					z = X.fSig(p+q,hksz-q,"00");
					if(z > -1) l = z-p-q;
					else l = hksz;
					c += X.SC(p+q,l,'CP1252')+"\n";
					q += l+1;
				} break;
			case "PART": ptn++; break
			case "INST": ins++; break
			case "SMPL":
				smp++; p += 6; break;
			}
			p += hksz;
		}
		if(X.isVerbose()) {
			if(x > 1) sOption(x,'×');
			sOptionT(t); sOptionT(addEllipsis(c,0xA0,0x80),'msg: "','"');
			sOption('ch:'+ch+' ptn:'+ptn+' ins:'+ins+' smp:'+smp+' sz:'+outSz(p));
		}
	}
	else if(X.c("'FORM'........'MMV8SDAT'................'SE'")) {
		sName = "Thomas Winischhofer's Music Maker EXT module (.MM8,.MM4)"; bDetected = 1;
		sVersion = "v8";
		if(X.isVerbose()) {
			sOptionT(X.SA(0x1A,0x14));
			sOptionT(X.SA(0x36,0x29));
			sOption(outSz(X.I32(4,_BE)+8),"sz:")
		}
	}
	//TODO insert the SDATA format of Music Maker
	else if(X.c("'SEI1XX'00")) { //TODO find more than 2 files to test on :)
		sName = "Music Maker STD instrument (.IP)"; bDetected = 1;
		sVersion = "v8 old";
	}
	else if(X.c("'MO3'")) {
		sName = "MO3 MOD module (.MO3)"; bDetected = 1
	}
	else if(X.c("'RASP'",0x438)) {
		// TODO find out what format it was...
		sName = "Generic module (.MOD)"; bDetected = 1;
		sVersion = X.SA(0x438,4);
		if(X.isVerbose()) {
			sOptionT(X.SC(0,0x14,"IBM850"));
			sOptionT(X.SC(0x14,0x16,"IBM850"),"by/inst: ")
		}
	}
	else if(X.c("08'MONOTONE'") && X.Sz() >= 0x15F) {
		//ref https://github.com/MobyGamer/MONOTONE/blob/master/MTSRC/MT_SONG.PAS
		sName = "MONOTONE module (.MON)"; bDetected = 1;
		sVersion = "v"+X.U8(0x5B);
		if(X.isVerbose()) {
			sOptionT(X.UCSD(0x09));
			sOptionT(X.UCSD(0x32));
			ptn = X.U8(0x5C); trk = X.U8(0x5D); cellsz = X.U8(0x5E);
			ord = 0; i = 0x5F; do { t = X.U8(i++); if(t != 0xFF) ord++ } while(i < 0x15F && i != 0xFF)
			sOption('trk:'+trk+' ord:'+ord+' ptn:'+ptn+' sz:'+outSz(0x15F+0x40*ptn*trk*cellsz));
		}
	}
	else if(/SONG[0-9.]{4}(COMP|NORM)/.test(X.SA(0,12))) {
		sName = "Megastation track (.MS)"; bDetected = 1;
		sVersion = "v"+X.SA(4,5).toLowerCase()
	}
	else if(/SNGM[0-9.]{4}(COMP|NORM)/.test(X.SA(0,12))) {
		sName = "Megastation MOD module (.MSM)"; bDetected = 1;
		sVersion = "v"+X.SA(4,5).toLowerCase()
	}
	else if(X.c("'MSOB'00000026") && X.c("FFFF0000",0x24) && (x=X.U16(0x28,_BE)) > 0) {
		sName = "Medley module (.MSO)"; bDetected = 1;
		if(X.isVerbose())
			if(x > 1) sOption(x,'×')
	}
	else if(X.c("'MTC1'00") && X.U8(5) < 0x10 && X.Sz() >= (sz=X.U32(4,_BE)+8)) {
		sName = "Multi-track Container module (.MTC)"; bDetected = 1;
		if(X.isVerbose()) {
			name = auth = c = ''; p = 8; x = 0; //ignoring PROP--it's never useful
			while(p < sz) {
				hkhd = X.SA(p,4); hksz = X.U32(p+4,_BE); p += 8;
				switch(hkhd) {
				case "NAME": name = name.addIfNone(decAnsi(p,hksz,CPSpeccy),'/'); break;
				case "AUTH": auth = auth.addIfNone(decAnsi(p,hksz,CPSpeccy),'/'); break;
				case "ANNO": c = c.addIfNone(decAnsi(p,hksz,CPSpeccy),'/'); break;
				case "TRCK": x++; break
				}
				p += hksz; if(p%2) p++
			}
			sOptionT(name); sOptionT(auth,'by:'); sOptionT(addEllipsis(c,0xA0));
			sOption('trk:'+x+' sz:'+outSz(sz))
		}
	}
	else if(X.c("'mpu401tr'92'kk'EE'r'")) {
		sName = "MPU-401 Trakker Adlib module (.MTK)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.UCSD(0x18); sOptionT(t);
			sOptionT(X.SA(0x18+t.length+2),"by: ")
		}
	}
	else if(X.c("'MTM'")) {
		//ref https://github.com/libxmp/libxmp/blob/master/docs/formats/Mtm-form.txt
		sName = "StarScream/Renaissance's Multitracker module (.MTM)"; bDetected = 1;
		v=X.U8(3); sVersion = "v"+(v>>4)+"."+(v & 0x0F);
		if(X.isVerbose()) {
			sOptionT(X.SA(4,20));
			trk = X.U16(24); ptn = X.U8(26);
			ord = X.U8(27)+1; csz = X.U16(28);
			nos = X.U8(30); bpt = X.U8(32); smpsz = 0;
			for(i=66+22; i < 66+22+nos*37; i += 37) smpsz += X.U32(i);
			pxc = 194+nos*37+trk*192+(ptn+1)*32*2;
			c = X.SA(pxc,csz); sz = pxc+csz+smpsz;
			if(c.length < csz) c = c.trim()+' <...>';
			sOptionT(c);
			sOption('trk:'+(trk+1)+' ord:'+(ord+1)+' ptn:'+(ptn+1)+' smp:'+nos+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'MT20'") && X.Sz() >= 0x184 && X.U8(9) == 2
	  && X.U16(0x70) < 64 && X.U16(0x6A) <= 0x100) {
		//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_mt2.cpp
		sName = "MadTracker 2 module (.MT2)"; nV = X.U8(8); bDetected = 1;
		sVersion = "v"+X.U8(9)+"."+nV.toString(16).padStart(2,'0');
		bad = "";
		ord = X.U16(0x6A); loop = X.U16(0x6C);
		ptn = X.U16(0x6E); trk = X.U16(0x70);
		flags = X.U32(0x76);
		ins = X.U16(0x7A); smp = X.U16(0x7C);
		hasdrums = X.U16(0x17E) != 0; //:477
		if(hasdrums) dptn = X.U16(0x180); else dptn = 0; // this one line's :789
		p = 0x184+(hasdrums?0x112:0); //180 = filehdr+hasdrums+orders
		addp = p+X.U32(p-4); msg = ""; vst2 = 0; igskip = 0;
//_log("addp @"+Hex(addp));
		smpszs = []; insszs = []; inss = []; smps = []; extsmp = [];
		while(p < addp) { //:578
			hkhd = X.SA(p,4); hksz = X.U32(p+4); p += 8;
			switch(hkhd) {
				case "MSG": showmsg = X.U8(p);
					msg = X.SC(p+1,hksz-1,'CP1252')
					  .replace("\r","\n").replace("\n\n","\n"); break;
				case "SUM": artist = X.SC(p+6,hksz-6,'CP1252');
					if(artist == "Unregistered") artist == ""; break;
				case "VST2": vst2 = X.U32(p); break;
			}
			p += hksz
		}
//_log("ptns @"+Hex(p));
		if(p > addp) bad = bad.addIfNone("!badaddsz");
		else if(p > X.Sz()) bad = bad.addIfNone("!short");
		else {
			for(i=0; i < ptn && p < X.Sz(); i++) p += 6+((X.U32(p+2)+1)&~1)
//_log("drums? @"+Hex(p));
			if(hasdrums) { //:786
				for(i=0; i < dptn && p < X.Sz(); i++) { //:811
					p += 2+X.U16(p)*32 }
			}
//_log("atmt @"+Hex(p));
			if(flags & 2) { //automation; 8 is drum autn., 0x10 is master autn.
				env = trk + (flags & 8) + ((nV >= 0x50) ? vst2 : 0) + ((flags & 0x10) ? 1 : 0);
				for(q = 0; q < ptn; q++)
					for(var e = 0; e < env && p+4 <= X.Sz(); e++) {
						if(nV >= 3) { fl = X.U32(p); p += 8 }
						else { fl = X.U16(p); p += 4 }
						while(fl) {
							if(fl&1) p += 0x104; fl >>= 1;
							if(fl<0)fl=-fl //fixes something suspiciously like a JS glitch
						}
					}
			}
		}
//_log("ins @"+Hex(p));
		if(p > X.Sz()) bad = bad.addIfNone("!short");
		else {
			for(i=0; i < 255; i++) {
				if(!msg && inss.length < 3) {
					t = X.SC(p,0x20,'CP1252'); if(t.trim() != "") inss.push(t) }
				dtlen = X.U32(p+0x20); if(dtlen == 0x20) dtlen += 0x18C;
				if(nV > 1 && dtlen) dtlen += 4;
				if(dtlen) igskip += X.U16(p+0x24)<<3; p += 0x24+dtlen;
			}
		}
//_log("smp @"+Hex(p));
		if(p > X.Sz()) bad = bad.addIfNone("!short");
		else {
			for(i=0; i < 256; i++) {
				if(!msg) {
					t = X.SA(p,0x20); if(i < smp && t.trim() != "") smps.push(t) }
				dtlen = X.U32(p+32); p += 0x24;
				if(dtlen && i < smp) {
					slen = X.U32(p); sfl = X.U8(p+10);
					if(sfl&5) smpszs.push({"ext":1,"slen":0}); else if(slen) smpszs.push({"ext":0,"slen":slen});
					p += dtlen;
				}
			}
			p += igskip;
			if(p > X.Sz()) bad = bad.addIfNone("!short");
			else for(i=0; i < smp && p < X.Sz(); i++) {
				if(smpszs[i]["ext"]) {
					slen = X.U32(p); p += 0x10;
					iextsmp.push(X.SA(p,slen));
					p += slen;
				} else p += smpszs[i]["slen"];
			}
		}
		if(bad != "") sVersion += "/malformed"+bad
		if(X.isVerbose()) {
			sOptionT(X.SA(0x2A,0x40));
			if(msg != "")
				if(showmsg) sOption(addEllipsis(msg,0x80),"msg: ");
				else sOption("("+addEllipsis(msg,0x80)+")","msg: ");
			else if(inss.length) sOption("\""+addEllipsis(inss.join(" "),200)+"\"","ins/msg:");
			else if(smps.length) sOption("\""+addEllipsis(smps.join(" "),200)+"\"","smp/msg:");
			sOption("ord:"+ord+" loop:"+loop+" ptn:"+ptn+(hasdrums?"+"+dptn:"")+" ins:"+ins+
			  " smp:"+smp+(extsmp.length > 0 ? " ext.smp: ["+extsmp.join(",")+"]" : "")+
			  " trk:"+trk+(hasdrums?"+8":"")+(vst2?("vst2:"+vst2):"")+" sz:"+outSz(p))
		}
	}

	else if(X.c("'MTRAC'") && X.U8(0x31) == 0x1A) {
		sName = "Pyro-Fyre/Arkham's Master Tracker module (.MTR)"; bDetected = 1;
		//TODO parse master tracker
		// x = X.readBytes(0,X.fSig(0,TOEOF,"1A"));
		// tt = X.SA(5,20).trim();

		// if(v!=null) sVersion = "v"+v;
		// if(X.isVerbose())
		//     sOptionT(X.SA(0x2A,0x40))
	}
	else if(X.c("3C4F3123 20391E00 1FdF1F9F 0C020C05 04040407 1AF60627")) {
		sName = "Packen/ぱっくん Software MUAP98/みゅあっぷ tone data (TONES.DTA)"; bDetected = 1;
		if(X.isVerbose()) sOption(outSz(6400),'sz:')
	}
	else if(X.c("'MVSM1'")) {
		sName = "Kaneda's MVSTracker Suite module (.MUS)"; bDetected = 1
	}
	else if(X.c("'MUS'1A") && (X.U16(4) >= X.U16(6))) {
		sName = "idSoft's DOOM music module (.MUS)"; bDetected = 1;
		if(X.isVerbose())
			sOption(outSz(X.U16(4)),'sz:')
	}
	else if(X.c("'MXM'00") && isWithin(X.U32(4),1,256) && X.U32(8) < X.U32(4)
	  && isWithin(X.U32(0xC),1,255) && X.U32(0x10)) {
		// from https://www.cubic.org/source/mxmplay-1.6.zip / xm2mxm.cpp
		sName = "Niklas 'pascal' Beisert's MXMplay module (.MXM)"; bDetected = 1;
		if(X.isVerbose()) {
			ord = X.U32(4); lp = X.U32(8); ch = X.U32(0xC); ptn = X.U32(0x10); ins = X.U32(0x14);
			spd0 = X.U8(0x18); bpm0 = X.U8(0x19);
			sOption('spd0:'+spd0+' bpm0:'+bpm0+' ch:'+ch+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn+' ins:'+ins)
		}
	}
	else if(X.c("'MXTX'00")) {
		sName = "David 'Talin' Joiner & Joe Pearce's MaxTrax/Music-X module (MXTX.+SMPL.)"; bDetected = 1
	}
	else if(X.c("'TWNNSNG1'00")) { // looks like the first ProTrekkr was called this
		sName = "J.A.A. 'Arguru' Ruis's NoiseTrekker module (.NTK)"; bDetected = 1;
		sVersion = "v1.6b";
		if(X.isVerbose())
			sOption(X.SA(9,20))
	}
	else if(X.c("'TWNNSNG2'00")) { // looks like the first ProTrekkr was called this
		sName = "J.A.A. 'Arguru' Ruis's NoiseTrekker module (.NTK)"; bDetected = 1;
		sVersion = "v2.0";
		if(X.isVerbose())
			sOption(X.SA(9,20))
	}
	else if((X.c("'TWNNSNG'..00") && ["6","G","I"].indexOf(X.SA(7,1) >= 0))
	  || X.c("'PROTREK'")) {
		//ref https://github.com/hitchhikr/protrekkr/blob/c321b1995d127fc232d8ea50e359d7e2603882b8/src/ptk.cpp#L2434
		sName = "J.A.A. 'Arguru' Rius et al.'s ProTrekkr module (.PTK)"; bDetected = 1;
		sVersion = "v"+X.SA(0x7,1);
		if(X.isVerbose()) // this stuff has compression in most versions, TODO?
			if(sVersion == "v6") sOption(X.SA(9,20))
	}
	else if(X.c("'NESM'1A") || X.c("'NSFE'")) {
		//ref http://www.nesdev.org/wiiki/NSF
		sName = "Nintendo Sound Format audio (."; bDetected = 1;
		sig = X.SA(0,4);
		if(sig === "NSFE") filever = "NSFe";
		else if(X.U8(5) == 2) filever = "NSF2";
		else filever = "NSF";
		sName += filever+")";
		INFOready = false; NEND = false; hkhd = ""; pn = 4;
		nsf2jump = palntsc = sz = -1; spd = ""; vrc7repl = 0;
		playtime = Number(0); g=""; t=""; a=""; c=""; taut=[]; tlbl=[]; xc="";
		if(filever === "NSFe") {
			if(X.isVerbose()) //no base header, find INFO first
			  while(pn < X.Sz()){
				hksz = X.U32(pn,_BE); hkhd = X.SA(pn+4,4);
				if(hkhd === "INFO") break;
				else pn += hksz+8;
			}
			nsf2jump = 0;
		}
		else { //NSF v1/2 have a hardplaced header, let's read that
			bDetected = 1;
			sVersion = "";
			if(X.isVerbose()) {
				palntsc = X.U8(0x7A);
				chip = X.U8(0x7B);
				tc = X.U8(6); t = X.SA(0x0E,0x20);
				a = X.SA(0x2E,0x20); c = X.SA(0x4E,0x20);
			}
			INFOready = true;
			nsf2jump = X.U24(0x7D,_LE);
			pn += nsf2jump; //NSF v1 files ALSO can have this jump... orz
		}
		// at this point we're standing at the first hunk unless it's a pure NSF, and at "INFO" for NSFe
		if(nsf2jump >= 0 && filever === "NSFe" && X.isVerbose())
			while(pn < X.Sz() && !NEND) {
				hksz = X.U32(pn,_LE); hkhd = X.SA(pn+4,4); pn+=8;
				switch (hkhd) {
					case "NEND": //end of hunks
						NEND = true; break;
					case "INFO": //really shouldn't happen with nsf1/2
						if(INFOready) break;
						palntsc = X.U8(pn+6);
						chip = X.U8(pn+7);
						tc = X.U8(pn+7);
						INFOready = true; break;
					case "RATE":
						spd = "rate :: NTSC: "+X.U16(pn,_LE)+" ticks";
						palspd = X.U16(pn+2,_LE);
						if(palspd > 0) spd += ", PAL: "+palspd+" ticks";
						dendyspd = X.U16(pn+4,_LE);
						if(dendyspd > 0) spd += ", Dendy: "+dendyspd+" ticks";
						break;
					case "VRC7":
						vrc7repl = X.U8(pn); break;
					case "time":
						for(i=0; i*4 < hksz; i++) {
							if(i*4 >= hksz) curtime=-1
							else curtime = X.I32(pn+i*4,_LE);
							if(curtime < 0) curtime = 2*60000; //default time: 2 minutes :V
							playtime += curtime/1000;
						} break;
					case "auth":
						apn = 0;
						g = X.SC(pn,0x100,"UTF8"); apn+=g.length+1;
						a = X.SC(pn+apn,0x100,"UTF8"); apn+=a.length+1;
						c = X.SC(pn+apn,0x100,"UTF8"); apn+=c.length+1;
						c += ", rip: "+X.SC(pn+apn,0x100,"UTF8");
						break;
					case "taut":
						if(X.isDeepScan()) {
							apn = 0;
							while(apn < hksz) {
								trkauth = X.SC(pn+apn,hksz-apn,"UTF8"); apn += trkauth.length+1;
								taut.push(trkauth)
							}
						} break;
					case "tlbl":
						if(X.isDeepScan()) {
							apn = 0;
							while(apn < hksz) {
								trklbl = X.SC(pn+apn,hksz-apn,"UTF8"); apn += trklbl.length+1;
								tlbl.push(trklbl)
							}
						} break;
					case "text":
						if(X.isDeepScan())
							xc = X.SC(pn,hksz,"UTF8");
				}
				pn += hksz; sz = pn;
			}
		if(X.isVerbose() && INFOready) {
			switch(palntsc) {
				case 0: sVersion += " NTSC"; break;
				case 1: sVersion += " PAL"; break;
				case 2: sVersion += " NTSC/PAL"
			}
			if(chip&0x01) sVersion += "#VRC6";
			if(chip&0x02) switch(vrc7repl) {
				case 1: sVersion += "#YM2413"; break;
				default: sVersion += "#VRC7" }
			if(chip&0x04) sVersion += "#FDS";
			if(chip&0x08) sVersion += "#MMC5";
			if(chip&0x10) sVersion += "#Namco163";
			if(chip&0x20) sVersion += "#Sunsoft5B";
			sOptionT(t);
			if(tc > 1) sOption(tc,"×");
			sOptionT(a,"by: ");
			sOptionT(c);
		}
		if(X.isVerbose()) {
			if(playtime > 1)
			  sOption(new Date(Math.round(playtime*1000)).toISOString().substr(11, 8),"Playtime: ");
			if(Math.max(tlbl.length,taut.length)>0) sOption("[Tracks]");
			for (i=0; i < Math.max(tlbl.length,taut.length); i++) {
				if(i < tlbl.length) ttlbl = tlbl[i];
				else ttlbl = "#"+(i+1);
				if(i < taut.length) ttaut = " by: "+taut[i];
				else ttaut = "";
				sOption(ttlbl+ttaut)
			}
			if(xc != "") sOption(xc,"[Commentary]: ");
			if(sz > -1) sOption(outSz(sz),"sz:")
		}
	}
	else if(X.c("'OKTASONGCMOD'00000008") && X.c("'SAMP'00000480", 0x18)
	  && X.c("'SPEE'00000002....'SLEN'00000002....'PLEN'00000002....'PATT'00000080", 0x4A0)
	  && X.c("'PBOD'", 0x546)) {
		sName = "Armin Sander's Oktalyzer module (.OK,.OKT,.OKTA)"; bDetected = 1;
		sVersion = 'v'+X.U16(0x14,_BE)+'.'+X.U16(0x16,_BE).padStart(2,'0');
		if(X.isVerbose()) {
			for(p=0x20,smp=0,smps=[]; p < 0x4A0; p += 0x20) {
				if((t=decAnsi(p,0x14,CPAmiga).trim()) != '') smps.push(t); if(X.U32(p+0x14,_BE)) smp++;
			}
			sOption(addEllipsis(smps.join(' ')),'smp/msg:"','"');
			tmp0 = X.U16(0x4A8,_BE); ptn = X.U16(0x4B2,_BE); ord = X.U16(0x4BC,_BE); rsmp = 0;
			p = 0x546; while(p < X.Sz() && rsmp < smp) {
				hkhd = X.SA(p,4); if(charStat(hkhd,1).indexOf('allasc') < 0) break;
				hksz = X.U32(p+4,_BE); if(hkhd === 'SBOD') rsmp++; p += 8+hksz
			}
			sOption('tmp0:'+tmp0+' ord:'+ord+' ptn:'+ptn+' smp:'+(rsmp!=smp?rsmp+'/':'')+smp+' sz:'+outSz(p))
		}
	}
	else if(X.c("'Onyx Music File'1A0001") && X.c("80808080",0x18E)) {
		// ref ftp://http.modland.com/pub/documents/format_documentation/Onyx%20Music%20File%20(.omf).txt
		sName = "Altar/Onyx's Onyx Music File (.OMF)"; bDetected = 1;
		if(X.isVerbose()) {
			ch = X.U8(0x192)+1;
			ptn = X.U8(0x193)+1;
			ord = X.U8(0x194)/2+1;
			title = X.SA(0x195,0x1F).trim();
			sn = []; smp = smpsz = 0;
			for(i=0; i < 31; i++) {
				t = X.SA(0x1B4+i*0x1C,21).trim(); if(t.length) sn.push(t);
				t = X.U16(0x1CC+i*0x1C); if(t) { smpsz += t; smp++ }
			}
			for(i=0,p=0x51A; i < ptn; i++) p += 3+X.U8(p+2)*0x100; sz = p+smpsz+smp*3;
			for(i=0; i < smp; i++) p += 3+X.U16(p+1); if(p != sz) sVersion = 'malformed!badsmpcnk';
			sOptionT(title); sOptionT(addEllipsis(sn.filter(funSampleName).join(' ')),'smp/msg:"','"');
			sOption('ch:'+ch+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
		}
	}
	else if((X.c("'Org-02'") || X.c("'Org-03'")) && X.Sz() >= 114) {
		sName = "Amaya 'Pixel' Daisuke's Organya/ORG Maker module (.ORG)"; bDetected = 1;
		if(X.U8(5) === 0x32) sVersion == "v1"; else sVersion = "v2";
		if(X.isVerbose()) {
			c = ins = 0; for(i=0; i < 16; i++) {
				t = X.U16(0x16+6*i); if(t) { ins++; c += t }
			}
			sOption("ins:"+ins+" tempo:"+X.U16(6)+" rhythm:"+X.U8(8)
			  +"/"+X.U8(9)+" notes:"+c+" sz:"+outSz(114+(c<<3)))
		}
	}
	else if(X.c("'OBISYNTHPACK'") && X.Sz() > 0x510 && ( X.c("0100",0x50C) || !X.U32(0x50C,_BE) )) {
		sName = "Karsten 'Obi' Obarski's Synth Pack module (.OSP+SMP.set)"; bDetected = 1;
		if(X.isVerbose()) { //from initplayer RE
			p = a2 = 0xC; // @650
			for(x = ord = 0, d1 = 0x40; p < X.Sz() && d1--;) {
				d2 = X.U32(p,_BE); p += 4; if(!d2) break; ord++; d2 &= 0xFFFF;
				if(d2 == 0xF0) x++; // @656~664
			}
			for(d3 = d6 = 0; a2 < X.Sz() && d6 < 0x40;) { // @668~698
				d4 = X.U32(a2,_BE); a2 += 4;
				if(!d4) { if(X.U32(a2,_BE)) d6++;
				} else {
					d4 &= 0xFF00;
					if(d4 == 0xFE00 || d4 == 0xFC00) d3++;
					d6++;
				}
				if(d6 >= 0x40) break;
			}
			if(d3 > x) { x = d3; ord = d6 } // @69a~6a0
			if(X.c("2000",0xC) || X.c("FE",0xE)) x = 7; // @6a2~6b8
			d1 = 0x100;
			if(p < X.Sz()) p = 0x10C; ptn = 0; // @6bc~6c4
			for(; p < X.Sz() && d1--;) { if((t = X.U8(p)) > ptn) ptn = t; p += 4 } // @6c6~6d2
			if(p < X.Sz()) p = 0x50C; // @6d6...
			if(!X.U32(0x50C,_BE)) // to @6fe
				p += (ptn+1)*0x180; //
			else {
				for(; p < X.Sz(); p += 2) if(!X.U16(p,_BE)) break;
				for(p += X.U16(p-2,_BE); p < X.Sz(); p += 2) if(X.c("FFFFFFFF5FFF",p)) break; // @6e8~f2
				p += 6;
			}
			if(x > 1) sOption(x,'×');
			sOption('ord:'+ord+' ptn:'+ptn+' sz:'+outSz(p))
		}
	}
	else if(X.c("'OBISYNTHPACK'")) { //this must be the sample set
		for(p=0xC,i=smp=0; p < X.Sz() && i < 0x40; i++) {
			t = X.U32(p+4,_BE)-X.U32(p,_BE); p += 4; if(t) smp++;
		} p -= 4; sz = X.U32(p,_BE);
		if(sz <= X.Sz()) {
			sName = "Karsten 'Obi' Obarski's Synth Pack's sample set (SMP.SET)"; bDetected = 1;
			if(X.isVerbose()) sOption('smp:'+smp+' sz:'+outSz(sz))
		}
	}
	else if(X.c("00800404 1214191C 1FCE26D6 328E35EA 3CF23CF2") && X.c("0C000384000000000000",0x80)) {
		// I'm specifically detecting the one for Dyter-07 here
		for(p=0,i=smp=0; p < X.Sz() && i < 0x40; i++) {
			t = X.U16(p+2,_BE)-X.U16(p,_BE); p += 2; if(t) smp++;
		} p -= 2; sz = X.U16(p,_BE);
		if(sz <= X.Sz()) {
			sName = "Synth Pack's sample set (SMP.SET)"; sVersion = "headerless"; bDetected = 1;
			if(X.isVerbose()) sOption('smp:'+smp+' sz:'+outSz(sz))
		}		
	}
	else if(X.c("'PACG'........'PAIN'") && (t=X.fSig(0xC,0x100,"'SOIN'")+8) > 0x10 && X.U16(t+2)
	  && X.U8(t+4) && X.c("4005",t+5) && X.U32(4)+8 <= X.Sz()) {
	  	//ref http://hackipedia.org/browse.cgi/File%20formats/Music%20tracker/PAC%2c%20SBStudio%20II/SBStudio%20II%20by%20Henning%20Hellstrom%20v1%2e04%20%281994%29%2etxt
		sName = "Henning Hellström's SBStudio II module (.PAC)"; bDetected = 1;
		p = 8; sz = p+X.U32(4);
		title = tracker = bad = ''; end = trk = ord = ptn = spd0 = bpm0 = smp = 0;
		while (p < X.Sz()) {
			hkhd = X.SA(p,4); if(charStat(hkhd).indexOf('allasc') < 0) break;
			hksz = X.U32(p+4); p+=0x08; //chunk header = 4xfourcc + 4xsize
			switch (hkhd) {
			case "SND ": smp++; break;
			case "SOIN": spd0 = X.U8(p); bpm0 = X.U8(p+1); ptn = X.U16(p+2); trk = X.U8(p+4); break;
			case "SONA": title = X.SC(p,hksz,'CP850'); break;
			case "SOOR": ord = hksz>>1; break;
			case "PAOR": tracker = X.SC(p,hksz,'CP850'); break;
			case "END ": end = 1; break
			}
			p += hksz; if(end) break
		}
		if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(title); sOption(tracker,'in: ');
			sOption('trk:'+trk+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(X.U32(4)+8))
		}
	}
	else if(X.c("'PLM'1A..10") && isWithin(ch=X.U8(0x36),1,32)
	  && X.Sz() >= 4*((smp=X.U8(0x5C))+(ptn=X.U8(0x5D))+(ord=X.U16(0x5E,_LE)))
	  && firstNotOf(0x3C,0x20,[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15]) < 0) {
		sName = "Alex 'Statix' Evans' Disorder Tracker 2 module (.PLM)"; bDetected = 1;
		p = X.U8(4); ofs = rsmp = 0; rptn = []; ptns = []; smps = []; mp = [0,'unk']; bad = '';
		for(i=0; i < ord; i++,p+=4) if(rptn.indexOf(t = X.U8(p+3)) < 0) rptn.push(t);
		for(i=0; i < ptn; i++,p+=4) {
			if((t = X.U32(p)) > mp[0]) mp = [t,'ptn'];
			t = X.SC(t+7,25,"CP437").trim(); if(t.length) ptns.push(t)
		}
		for(i=0; i < smp; i++,p+=4) {
			if((t = X.U32(p)) > mp[0]) mp = [t,'smp'];
			if(!t) continue; //fixes juice music... 10-8 eve again
			if(!X.c("'PLS'1A",t)) bad = bad.addIfNone('!badsmpsig:'+X.SA(t,4));
			if(!isWithin(X.I8(t+0x32),-1,15)) bad = bad.addIfNone('!badsmppan');
			if(X.U8(t+0x33) > 64) bad = bad.addIfNone('!badsmpvol');
			smps.push(X.SC(t+6,0x20,'CP437').trim());
			if(X.U32(t+0x43)) rsmp++;
		}
		rptn = rptn.length;
		if(p > X.Sz()) bad = bad.addIfNone('!short'); sz = Math.max(mp[0],p);
		switch(mp[1]) {
		case 'ptn': sz = mp[0]+X.U32(mp[0],_LE); break;
		case 'smp': sz = mp[0]+X.U8(mp[0]+4)+X.U32(mp[0]+0x43,_LE); break
		}
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(X.SC(6,0x30,'CP437'));
			//sOption(addEllipsis(ptns.join(', '),0xE0),'ptn:"','"');
			sOption(addEllipsis(smps.filter(funSampleName).join(' '),0xE0),'smp/msg:"','"');
			sOption('ch:'+X.U8(0x36)+' bpm0:'+X.U8(0x3A)+' spd0:'+X.U8(0x3B)+' ord:'+ord
				+' ptn:'+(rptn != ptn? rptn+'/':'')+ptn+' smp:'+(rsmp != smp? rsmp+'/':'')+smp+' sz:'+outSz(sz));
		}
	}
	else if(X.c("'PLX'") && X.U8(3) <= 2 && X.U8(4) && X.U16(7) < X.Sz() && X.U16(9) < X.Sz() && X.U16(11) < X.Sz()) {
		//ref https://adplug.github.io/library/entry/Palladix.html
		sName = "Rainbow Arts' Palladix Sound System module (.PLX)"; bDetected = 1;
		if(X.isVerbose()) {
			for(ch=0,p=7; p < 17; p+=2) if(X.U16(p)) ch++;
			sOption('ch:'+ch)
		}
	}
	else if(X.c("FFFFE002E102")) {
		sName = "Achim Haertel's POKEYNoise chiptune (.PN)"; bDetected = 1
	}
	else if(X.c("01080B08 E1079E32 30363100 000078D8 A2FF9A20 1B082000")) {
		sName = "Aleksi Eeben's Polyanna module (.PRG)"; sVersion = "v1.0&player"; bDetected = 1;
		if(X.isVerbose()) sOption('sz:'+outSz(0x5801))
		//TODO add info
	}
	else if(X.c("'PSA'00") && 0x34 < X.U32(0x28,_BE) < X.Sz()
	  && 0x34 < X.U32(0x2C,_BE) < X.Sz()
	  && 0x34 < X.U32(0x30,_BE) < X.Sz()) {
		sName = "Professional Sound Artists module (.PSA)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(0x4,0x14));
			//ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/PSA/PSA_v2.asm
			d2 = X.U32(0x28,_BE);
			x = (d2-56) >> 3; if(x > 1) sOption(x,"×");
			d3 = X.U32(0x2C,_BE); d0 = X.U32(0x30,_BE);
			ins = ((d3-d2) >> 6); d3 = ins;
			synsmp = 0; smp = 0; allsmpsz = 0; d7 = 3;
			while(d3) { //hop
				ts = X.U32(d2,_BE); //ins size?
				if(ts) {
					if(ts < d7) {
						d7 = ts;
						smpsz = (X.U16(d2,_BE)+4) << 1;
						allsmpsz += smpsz;
						smp++
					}
				} else synsmp++; //synth
				d2 += 64; d3--
			}
			sz = X.U32(36,_BE); songsz = sz-allsmpsz; ptn = (songsz-d0) >> 10;
			sOption("ptn:"+ptn+" ins:"+ins+" smp:"+smp+" syn.smp:"+synsmp+" songsz:"+songsz+" sz:"+outSz(sz))
		}
	}

	else if(X.c("'PSF'")) {
		//ref https://gist.github.com/SaxxonPike/a0b47f8579aad703b842001b24d40c00
		nV = X.U8(3);
		if(nV > 0) {
			bDetected = 1;
			sName = "Neil Corlett's Portable Sound Format module (.";
			switch(nV) {
				case 0x01: sName += "PSF,.PSF1,.MINIPSF,.MINIPSF1)"; sVersion = "Playstation"; break;
				case 0x02: case 0x03: sName += "PSF2,.MINIPSF2)"; sVersion = "Playstation 2"; break;
				case 0x11: sName += "SSF,.MINISSF)"; sVersion = "Saturn"; break;
				case 0x12: sName += "DSF,.MINIDSF)"; sVersion = "Dreamcast"; break;
				case 0x21: sName += "USF,.MINIUSF)"; sVersion = 'Ultra64'; break;
				case 0x22: sName += "GSF,.MINIGSF)"; sVersion = 'Gameboy'; break;
				case 0x23: sName += "SNSF,.MINISNSF)"; sVersion = 'Super Nintendo'; break;
				case 0x24: sName += "2SF,.MINI2SF)"; sVersion = 'Nintendo DS'; break;
				case 0x25: sName += "NCSF,.MININCSF)"; sVersion = 'Nintendo DS Nitro Sound'; break;
				case 0x41: sName += "QSF,.MINIQSF)"; sVersion = 'Capcom Q-Sound'; break;
				//case ??:  sName += "DCSF,.MINIDCSF)"; sVersion = '?'; break;
				default: sName += "*SF,.MINI*SF)"; sVersion = "unk.console";
			}
			sVersion = "v"+Hex(nV)+" "+sVersion;
			if(X.isVerbose()) {
				//fs1 = Math.max(X.Sz()-0x200,0); fs2 = Math.min(X.Sz(),0x200);
				//ptags = X.fSig(fs1,fs2,"'[TAG]'")+5;
				ptags = X.U32(8,_LE)+0x15; sig2 = false;
				if(0x15 < ptags && ptags < X.Sz()) sig2 = X.SA(ptags-5,5) === "[TAG]";
				if(!sig2) { //coincides with pv==2
					ptags = X.U32(4,_LE)+0x15;
					if(0x15 < ptags && ptags < X.Sz()) sig2 = X.SA(ptags-5,5) === "[TAG]";
				}
				if(sig2) {
					tags = X.SC(ptags,X.Sz()-ptags,"UTF8").trim();
					a=""; g=""; t=""; y=""; l="";
					tagl = tags.split('\n');
					  for (i=0; i<tagl.length;i++) {
						tag = tagl[i].split("=");
						switch (tag[0]) {
							case "length": l = tag[1]; break;
							case "title": t = tag[1]; break;
							case "game": g = tag[1]; break;
							case "artist": a = tag[1]; break;
							case "copyright": if(a=="") a = tag[1]; break;
							case "year": y = tag[1]; break;
							case "dsfby","psfby","ssfby": if(a=="") a = tag[1]; break;
						}
					  }
					sOption(t);
					sOption(a,"by: ")
					sOption(y,"'");
					sOption(g,"for: ");
					sOption(l,"len ");
				}
				else sVersion += " library";
			}
			if(X.Sz() < 0x300) sVersion += " header"
		}
	}
	else if(X.c("'PSG'1A")) { sName = "Kirill Kolpakov's fMSX/x128 PSG chiptune (.PSG)"; bDetected = 1 }
	else if(X.c("'EPSG'1A")) {
		//ref https://web.archive.org/web/20070919070829/http://maxheadroom.no-ip.com/ay/formats_epsg.php
		sName = "Kirill Kolpakov's Extended PSG chiptune (.EPSG)"; bDetected = 1; hw = X.U8(5);
		switch(hw) {
		case 0: sVersion = "ZX Spectrum 128k"; break;
		case 1: "Pentagon"; break;
		}
		if(hw<2 && !X.c("00000000 000000000000",6)) sVersion += "/malformed"
	}
	else if(X.c("'PSG2'")) {
		//ref https://web.archive.org/web/20070919070829/http://maxheadroom.no-ip.com/ay/formats_epsg.php
		sName = "PSG2 chiptune (.PSG2)"; bDetected = 1;
	}
	else if((X.c("'PSM '") || X.c("'PSM'FE")) && X.fStr(8,10,'FILE') >= 0 && X.fStr(16,50,'MAINSONG') >= 0) {
		sName = "Epic Megagames MASI module (.PSM)"; bDetected = 1;
		if(X.isVerbose()) {
			pt = X.fStr(16,50,"MAINSONGTITL");
			if(pt>0) {
				ts = X.U32(pt+12);
				sOptionT(X.SA(pt+16,ts));
			}
			sOption(outSz(X.U32(4)+12),'sz:')
		}
	}
	else if(X.c("'PSY'..'SONG")) {
		sName = "J.M.A. Segura/Psycledelics' Psycle Modular Music Creation Studio module (.PSY)"; bDetected = 1;
		sV = X.SA(3,1); sVersion = "v"+sV;
		if(X.isVerbose()) {
			switch(sV) {
				case "0": case "1":
					sOptionT(X.SC(0x08,0x20,'CP1252'));
					sOptionT(X.SC(0x28,0x20,'CP1252'),"by: ");
					sOptionT(X.SC(0x48,0x80,'CP1252')); break;
				case "2":
				//ref https://sourceforge.net/p/psycle/code/HEAD/tree/trunk/psycle-core/src/psycle/core/psy2filter.cpp
					sOptionT(X.SC(0x08,0x20,'CP1252'));
					sOptionT(X.SC(0x28,0x20,'CP1252'),"by: ");
					sOptionT(X.SC(0x48,0x80,'CP1252'));
					bpm = X.I32(0xC8); ord = X.I32(0x191);
					trk = X.I32(0x195); ptn = X.I32(0x199);
					p = 0x19D;
					if(X.isDeepScan()) {
						inss = []; vsts = []; macs = []; waves = mach = 0; bad = "";
						for(i=0; i < ptn; i++) { rows = X.I32(p); p += 0x24+0xA0*rows }
						p += 4; inss = [];
						for(i=0; i < 0xFF; i++) { t = X.SC(p,0x20,'CP1252').trim();
							if(t != "" && t != "empty") inss.push(t); p += 0x20 }
						p += 0x37CC; //_log("waves @"+Hex(p))
						if(p > X.Sz()) bad = bad.addIfNone("!short");
						else for(i=0; i < 0xFF && p < X.Sz(); i++)
							for(w=0; w < 0x10 && p < X.Sz(); w++) { t = X.U32(p); p += 4;
//if(t || p+t*2 > X.Sz()) _log("wave["+i+","+w+"] @"+Hex(p)+" ["+Hex(t)+"]: "+X.SC(p,0x20,'CP1252').trim());
								if(t) { if(!w) waves++; p += 0x2D; var st = X.U8(p++)+1; p += t<<st }
							}
//_log("vsts @"+Hex(p));
						if(p > X.Sz()) bad = bad.addIfNone("!short");
						else for(i=0; i < 0x100; i++) {
							t = X.U8(p++); if(t) {
//_log("vst["+i+"] @"+Hex(p));
								t = X.SC(p,0x80,'CP1252').trim(); if(t != "") vsts.push(t);
								p += 0x80; t = X.I32(p); p += 4+t*4;
							}
						}
//_log("mach @"+Hex(p));
						m = []; for(i = 0; i < 128; i++) { t = X.U8(p++); if(t) mach++; m[i] = t }
						t = oldt = 0;
						const mtMa=0,mtRM=1,mtDi=2,mtSa=3,mtDe=4,mtF2=5,mtGa=6,mtFl=7,mtPl=8,
						  mtVI=9,mtVF=10,mtSc=11,mtAB=12,mtA1=13,mtA2=14,mtA21=15,mtDu=255;
						for(i=0; i < 128; i++) if(m[i]) {
							t = X.I32(p+8); p += 12;
							tn = X.SA(t===mtPl?p+0x100:p, 0x10);
							tpn = t === mtPl ? X.SA(p,0x100) : ""; ts = tn+tpn;
//_log("ts: "+ts+", oldt = "+oldt);
							nonascii = false; for(q=0; q < ts.length; q++)
								if(ts[q] < " " || ts[q] > "~" || /["+?*]/.test(ts[q])) {nonascii = true; break }
							if(((15 < t && t < 255) || ts.length < 2 || nonascii) && oldt === mtPl) {
								bad = bad.addIfNone("!pluginDefinedDataSize"); break
							}
							else if(15 < t && t < 255) { bad = bad.addIfNone("!badMachineType"); break }
							oldt = t;
							switch(t) {
							case mtPl: macs.push(tn);
								t = X.I32(p+0x110); p += 0x114+4*t;
//_log("   ["+macs[macs.length-1]+"] post-"+Hex(t)+" vals @"+Hex(p));
								p += 0x181; break;
							case mtVI: case mtVF: vsts.push(tn); p += 0x197; break;
							default: macs.push(X.SA(p,0x10)); p += 0x191
							}
						}
						if(p > X.Sz()) bad = bad.addIfNone("!short");
//_log("patch 0 @"+Hex(p));
						p += 5*0xFF; //patch 0
						if(p > X.Sz()) bad = bad.addIfNone("!noP0");
//_log("patch 1 @"+Hex(p));
						p += 0x40;
						if(p > X.Sz()) bad = bad.addIfNone("!noP1");
//_log("patch 2 @"+Hex(p));
						if(p < X.Sz() && X.U8(p++))
							p += 4+X.U32(p);
						if(bad != "") sVersion += "/malformed"+bad;
						if(inss.length) sOption("inss: ["+inss.join(",")+"]");
						if(vsts.length) sOption("vsts: ["+vsts.join(",")+"]");
						if(macs.length) sOption("mcn: ["+macs.join(",")+"]");
						sOption("ord:"+ord+" ptn:"+ptn+" trk:"+trk+" bpm:"+bpm+" mach:"+mach+" smp:"+waves+" sz:"+outSz(p));
					} //isdeep
					else sOption("ord:"+ord+" ptn:"+ptn+" trk:"+trk+" bpm:"+bpm);
					break;
				case "3":
				//ref https://sourceforge.net/p/psycle/code/HEAD/tree/trunk/psycle-core/src/psycle/core/psy3filter.cpp
					nV = X.I32(8);
					sVersion+="/"+nV;
					p = 0x10+X.U32(0x0C); //chunk header = 4xfourcc + 4xver + 4xsize
					hkn = X.U32(0x10,_LE);
					t=''; a=''; c=''; trk=0; bpm=0; ptnlns=0; ptn=0; mac=0; ins=0; eins=0;
					while (hkn > 0) {
						hkhd = X.SA(p,4);
						hkn--;
						cV = X.U32(p+4,_LE);
						hksz = X.U32(p+8,_LE);
						p+=0x0C;
						switch (hkhd) {
							case "INFO":
								p1 = p;
								if((cV & 0xFF00)==0) {
									t = X.SC(p1,128,'CP1252'); p1+=t.length+1;
									a = X.SC(p1,64,'CP1252'); p1+=a.length+1;
									c = X.SC(p1,0xFFFF,'CP1252'); p1+=c.length+1;
									if(cV == 0) hksz=t.length+a.length+c.length+3 //bug workaround
								}
								break;
							case "SNGI":
								if((cV & 0xFF00) == 0) {
									trk=X.I32(p,_LE);
									if(cV==0) hksz = 11*4+trk*2; //bug workaround
									bpm=X.I16(p+4,_LE) + X.I16(p+6,_LE)/100.0;
								}
								break;
							case "SEQD":
								if((cV & 0xFF00) == 0)
									seqlen=X.I32(p+4,_LE);
								break;
							case "PATD":
								if((cV & 0xFF00) == 0) {
									_idx = X.I32(p,_LE);
									ptnlns = X.I32(p+4,_LE);
									ptnn = X.SA(p+0x0C,0x20);
									p1=p+0x0C+ptnn.length+1;
									ptnsz = X.I32(p1,_LE);
									ptn++; p1+=4;
									if((cV == 0) && (p1+ptnsz == p+hksz+4)) hksz += 4; //bug workaround
								}
								break;
							case "MACD":
								mac++;
								//bugfix impossible here, let's pretend it won't happen and move on
								break;
							case "INSD":
								ins++;
								break;
							case "EINS":
								if((cV & 0xFFFF0000) == 0x10000) {
									eins = X.U32(p,_LE)
									//and again, pretending there's no bug (and no samples)
								}
								break;
						}
						p += hksz;
					}
					sOptionT(t); sOptionT(a,"by: "); sOptionT(c);
					sOption("bpm:"+bpm+" trk:"+trk+" ptnlns:"+ptnlns+
						" mac:"+mac+" ptn:"+ptn+"/idx:"+_idx+" ins:"+ins+" eins:"+eins+" sz:"+outSz(p));
					break;
				case "4":
				//ref https://sourceforge.net/p/psycle/code/HEAD/tree/trunk/psycle-core/src/psycle/core/psy4filter.cpp
					sVersion+="/future";
					//yet another zipped-xmls format
			}
		}
	}

	else if(X.c("'PSMP'") && [0,0x10].indexOf(X.U8(4)) >= 0) {
		sName = 'Sega MegaDrive Pre-SMP chiptune (.PSZ)'; bDetected = 1;
		sVersion = X.U8(4)? 'BE': 'LE';
		if(X.isVerbose()) sOption('tempo:'+X.U8(5))
	}

	else if(X.c("'PTCOLLAGE-'") || X.c("'PTTUNE--20'")) {
		//ref source code / pxtnService.cpp, pxtnDescriptor.cpp
		bDetected = 1;
		v1 = X.SA(2,1);
		if(v1 === "T") { rough = 10; //used for clocking
			sName = "Amaya 'Pixel' Daisuke's pxtone tune (.PTTUNE)" }
		else { rough = 1;
			sName = "Amaya 'Pixel' Daisuke's pxtone project (.PTCOP)" }
		dt = X.SA(10,6);
		if(dt <= "050227") { sV = "v.x1x"; nV = 1 }
		else if(dt <= "050608") { sV = "v.x2x"; nV = 2 }
		else if(dt <= "060115") { sV = "v.x3x"; nV = 3 }
		else if(dt <= "060930") { sV = "v.x4x"; nV = 4 }
		else if(dt <= "071119") { sV = "v5"; nV = 5 }
		d = dt.substr(0,2)+"-"+dt.substr(2,2)+"-"+dt.substr(4,2);
		sVersion = sV+"/20"+d;
		switch(nV) {
			case 1: case 2: p = 0x10; break;
			case 3: case 4: p = 0x14; break;
			default: p = 0x14
		}
		t = c = bad = ""; bclock = lclock = bnum = btempo = bps = ch = 0; bEnd = false;
		while(!bEnd && p < X.Sz()) {
			hkhd = X.SA(p,8); hksz = X.U32(p+8,_LE);
//_l2r('px',p,hkhd)
			switch (hkhd) {
				case "PROJECT=":
					t = X.SC(p+12,0x10,"Shift_JIS");
					btempo = X.F32(p+0x1C,_LE).toFixed(0);
					bclock = X.I16(p+0x20,_LE);
					bnum = X.I16(p+0x22,_LE);
					break;
				case "evenMAST": //x4x
					if(X.U16(p+12,_LE) != 3)
						sVersion += "/unk";
					else {
						var p_ = X.fSig(p+3,0x100,"'textNAME'")-12;
						if(p_ > -12) p = p_-hksz;
						else {
							p_ = X.fSig(p+3,0x100,"'textCOMM'")-12;
							if(p_ > -12) p = p_-hksz;
						}
					}
					break; //not gonna parse what vari-read gives me
				case "MasterV5": //x5x
					if(hksz != 0xF) bad = bad.addIfNone('!badv5fmt');
					bclock = X.I16(p+12)*rough;
					bnum = X.I8(p+14);
					btempo = X.F32(p+15).toFixed(0);
					lmeas = (X.I32(p+0x17)/(bnum*bclock)).toFixed(0);
//_l2r('px',p+15+12,'So, the last measure is '+lmeas+' at tempo '+btempo);
					break;
				case "Event V5":
					var e, evtn = X.U32(p+12,_LE);
					q = p+11;
					for(e=0; e < evtn; e++) { //hksz is broken in this chunk so it's like this, and yes it is slow
						for(i=0; i < 5; i++) { if(X.U8(++q) < 0x80) break }
						q += 2;
						for(i=0; i < 5; i++) { if(X.U8(++q) < 0x80) break }
					}
					hksz = 4+q-p-11;
					break;
				case "textNAME":
					t = X.SC(p+12,hksz,"Shift_JIS"); break;
				case "textCOMM":
					c = addEllipsis(X.SC(p+12,hksz,"Shift_JIS"),0xA0); break;
				case "assiWOIC": ch++; break;
				case "END=====": case "pxtoneND":
					bEnd = true; break
			}
			p += 12+hksz;
		}
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad, '/');
		if(X.isVerbose()) {
			if(t != "no name") sOption(t);  sOptionT(c);
			if(bclock+btempo+bnum > 0)
				sOption('ch:'+ch+" bpm:"+btempo+" bclock:"+bclock+" bnum:"+bnum);
			sOption(outSz(p),"sz:")
		}
	}

	else if(X.c("'PTNOISE-'")) {
		sName = "Amaya 'Pixel' Daisuke's pxtone Noise instrument (.PTNOISE)"; bDetected = 1
	}

	else if(X.c("'PTVOICE-'")) {
		sName = "Amaya 'Pixel' Daisuke's pxtone Voice instrument (.PTVOICE)"; bDetected = 1;
		if(X.isVerbose()) sOption(outSz(X.U32(0x0C)+0x10),"sz:")
	}

	else if(X.c("'PTMF'",0x2C) && X.U8(0x1C) == 0x1A && X.U8(0x1E) <= 2 && isWithin(ch=X.U16(0x26),1,32)
	  && (ord=X.U16(0x20)) < 256 && isWithin(ins=X.U16(0x22),1,255) && isWithin(ptn=X.U16(0x24),1,128)) {
		// ref https://web.archive.org/web/20151027135201if_/http://hackipedia.org/File%20formats/Music/Sample%20based/text/Poly%20Tracker%20module%20format.cp437.txt.utf-8.txt
		sName = "Lone Ranger/AcmE's Poly Tracker module (.PTM)"; bDetected = 1;
		sV = Hex(X.U16(0x1D)); sVersion = "v"+sV.substr(0,1)+'.'+sV.substr(1,2);
		bad = '';
		for(sn=[],i=mp=rsmp=0,p=0x260; i < ins; i++,p+=0x50) {
			if(X.U8(p) & 3) { rsmp++; t = X.U32(p+0x12); if(mp < t) { mp = t; sz = t+X.U32(p+0x16) } }
			t = X.SC(p+0x30,0x1C,'CP437').trim(); if(t.length) sn.push(t);
		} sz = Math.max(sz,p);
		if(!rsmp) bad = bad.addIfNone('!badsmpavl');
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(X.SC(0,0x1C,'CP437')); sOption(addEllipsis(sn.join(' ')),'ins/msg:"','"');
			sOption('ch:'+ch+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp:'+rsmp+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'RAD by REALiTY!!'")) {
		//ref https://www.3eality.com/Public/Releases/RAD/radv2_0a.zip source/validate20.cpp
		// & https://www.3eality.com/Public/Releases/RAD/radv1_1a.zip player.asm
		sName = "Shayde & Rogue & Void's Reality ADlib Tracker module (.RAD)"; bDetected = 1;
		sV = (nV = X.U8(0x10)).toString(16);
		sVersion = "v"+sV[0]+"."+sV[1]; bad = "";
		if(X.isVerbose()) {
			al = X.U8(0x11);
			fbpm = nV > 0x20 && (al & 0x20); // in v2.1, if the bpm flag is set, bpm != 125 and is the next byte
			if((nV == 0x10 && (al & 0x80)) || nV >= 0x20) { //desc present
				l = 0x12; if(fbpm) l += 2;
				desc = ""; maxdesc = 250; cutoff = false;
				r = X.fSig(l,X.Sz()-32-l,"00"); p = r+1;
				if(r < 0) { maxdesc = 0; bad = bad.addIfNone("!baddesc") }
				else if(r > l+maxdesc) { r = l+maxdesc; cutoff = true }
				tmp = X.readBytes(l,r-l);
				for(i=0; desc.length < maxdesc && i < r-l; i++)
					switch(tmp[i]) {
					case 0: i = r-l; break;
					case 1: desc += "\n"; break;
					default:
						if(tmp[i] < 0x20) for(j=0; j < tmp[i] && desc.length <= maxdesc; j++) desc += " ";
						else desc += String.fromCharCode(tmp[i])
					}
				if(cutoff) { desc += "..." } sOptionT(desc);
			} else p = 0x12;
			spd0 = al&0x1F;
			if(fbpm) bpm = X.U16(0x12); else bpm = 125;
			ins = 0;
//_l2r('rad',p,'pre-ins')
			insns = [];
			while(p < X.Sz()) {
				insn = X.U8(p++); if(!insn || p > X.Sz()) break;
				ins++;
				if(nV == 0x10) p += 11;
				else if(nV == 0x21) {
					nmlen = X.U8(p++); insns.push(X.SA(p,nmlen));
					p += nmlen;
					rm = X.U8(p); riff = rm & 0x80; midi = (rm&7)==7;
					if(midi) p += 7; else p += 24;
					if(riff) p += X.U16(p)+2;
				} else bad = bad.addIfNone("!badver");
			}
//_l2r('rad',p,'pre-orderlist')
			ord = X.U8(p++); p += ord; //TODO parse jumps
			if(!ord || ord > 128) bad = bad.addIfNone("!badord");
//_l2r('rad',p,'pre-ptns')
			ptn = ptns = 0;
			if(nV > 0x20) while(p < X.Sz()) { if((t = X.U8(p++)) == 0xFF) break;
				ptns++; if(ptn <= t) ptn = t+1;  p += 2+X.U16(p);
			}
			else { //v1
				for(i=mptn=0; i < 32; ++i,p+=2) { if(t=X.U16(p)) ptn++;
					mptn = Math.max(mptn,t); if(t > X.Sz()) bad = bad.addIfNone('!short')
				}
				if(mptn) for(p=mptn,end=false; !end && p < X.Sz();)  { //parse the last ptn
					t = X.U8(p++);
//_l2r('rad1',p-1,'newptnline #'+Hex(t&0x7F)+(t&0x80?'::last':''))
					if(t & 0x80) end = true; //line
					while(p < X.Sz()) { t = X.U8(p); p += 2; if(X.U8(p++) & 0x07) p++; if(t & 0x80) break } //notes/fx in line
				}
			}
			if(!ptn) bad = bad.addIfNone("!badptn"); if(!ins) bad = bad.addIfNone("!badins");
			riff = riffs = 0;
			if(nV > 0x20) {
//_l2r('rad2',p,'pre-riffs')
				while(p < X.Sz()) {
					if((t = X.U8(p++)) == 0xFF) break;  riffs++; if(riff < t) riff = t;  p += 2+X.U16(p);
				}
				sOptionT(addEllipsis(insns.filter(funSampleName).join(' '),0x100),'ins:"','"');
				sOption('spd0:'+spd0+' bpm:'+bpm+' ord:'+ord+' ptn:'+ptns+(ptn!=ptns?'/'+ptn:'')
					+' ins:'+ins+' riffs:'+riffs+(riff!=riffs?'/'+riff:''))
			}
			else sOption('spd0:'+spd0+' bpm:'+bpm+' ord:'+ord+' ptn:'+ptn+' ins:'+ins)
			if(bad) sVersion += "/malformed"+bad
			sOption('sz:'+outSz(p))
		}//isVerbose
	}

	else if(X.c("'RAWADATA'") && X.Sz() > 10) {
		sName = "Raw OPL Capture chiptune (.RAW)"; bDetected = 1;
		if(X.isVerbose() && (X.isDeepScan() || X.Sz() < 0xFFFF)) { //may take a sec
			//taken from https://github.com/adplug/adplug/blob/master/src/raw.cpp
			p = 10; len = (X.Sz()-10) >> 1;
			tagdata = false; t = a = d = ""; next = 0;
			for(i=0; i < len && p < X.Sz(); i++) {
				x = (tagdata ? 0xFFFF : X.U16(p));
				p += 2;
				if(!tagdata && x==0xFFFF) { //trying to stop at the RAW EOF data marker
					tagcode = X.U8(p++);
					if(tagcode == 0x1A) tagdata = true; //tag marker found
					else if(!tagcode && charStat(X.readBytes(p,5),true).includes('allxsc')) { //old comment (music archive 2004)
						d = X.SA(p,1023); p += 1023; tagdata = true }
					else p--;
				}
			}
//_logIt('@'+Hex(p)+' tagdata? '+tagdata);
			if(tagdata && p+40 <= X.Sz()) { //searching for tags
				title = X.SA(p,40); p += 40;
				if(X.U8(p++) != 0x1B) { //if not, skip "author"
					p--;
					if(X.U8(p) >= 0x20) { //older version tag, eg. stunts.raw
						a = X.SA(p,60); p += 60;
						d = X.SA(p,1023); p += 1023;
						next = 2; //end_section
					} else p--;
					next = 1; //desc_section
				}
				if(!next) {
					a = X.SA(p,40); p += 40
				}
				if(next == 1) { next = 0;
					if(X.U8(p++) != 0x1C) next = 2;
					if(!next) {
						d = X.SA(p,1023); p += 1023
					}
				}
			}
			sOption(title); sOption(a,'by: '); sOption(d)
		} //isDeepVerbose
		if(X.isVerbose()) sOption(X.U16(8),'clkspd:')
	}

	else if(X.c("'RNS0'") && X.c("'>>> Chunk Start <<<'00", 9)) {
		sName = "Eduard Müller's Renoise module (.RNS)"; bDetected = 1;
		sV = X.SA(3,4); sVersion = "v"+sV;
		if(sV < "05") sVersion += "/RN<1.1.1";
		else if(sV === "05") sVersion += "/RN1.1.1";
		else if(sV < "015") sVersion += "/RN<1.2.7";
		else if(sV === "015") sVersion += "/RN1.2.7";
		else if(sV < "018") sVersion += "/RN<1.5.2";
		else if(sV === "018") sVersion += "/RN1.5.2";
		else sVersion += "/RN>1.5.2"
		if(X.isVerbose()) {
			p = 9;
			while (p < X.Sz()) {
				if(!X.c("'>>> Chunk Start <<<'00",p)) break;
				p += 20;
				if(X.c("'Header V00         '00",p)) {
					sOptionT(X.SC(p+20,20,'CP1252'));
					sOptionT(X.SC(p+40,20,'CP1252'),"by: ");
					sOptionT(X.SC(p+60,20,'CP1252'),"style: ");
					break;
				}
				else if(X.c("'Header V01         '00",p)) {  p += 20;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252')); p+=sz+4;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252'),"by: "); p+=sz+4;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252'),"style: ");
					break;
				}
				else if(X.c("Header V02         '00",p)) {  p += 20;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252')); p+=sz+4;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252'),"by: "); p+=sz+4;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252'),"style: "); p+=sz+4+5;
					sz = X.U32(p); sOptionT(X.SC(p+4,sz,'CP1252'));
					break;
				}
				p = X.fSig(p+1,TOEOF,"''>>>  Chunk End  <<<'00");
				if(p == -1) break;
				p += 20
			}
		}
	}
	else if(extIs("xrns") && X.c("'PK'0304")) {
		//TODO when ZIP parsing is available
		sName = "Eduard Müller's Renoise module (.XRNS)"; sType = '~audio'; sVersion = "xml"; bDetected = 1
		//versions vs doc_version:
		// 10: 1.9.1    14: 2.0.0    15: 2.1.0    21: 2.5.1    22: 2.6.1    30: 2.7.0, 2.7.1, 2.7.2
		// 37: 2.8.2    54: 3.0.1    63: 3.1.0    65: 3.3.2    66: 3.4.2
	}
	else if(extIs("xrdp") && X.fStr(0,0x100,"<FilterDevicePreset")>=0) {
		sName = "Eduard Müller's Renoise filter device preset (.XRDP)"; bDetected = 1;
		p = X.fStr(20,0x100,"doc_version=");
		if(p < 0) sVersion = "malformed";
		else {
			sVp = X.SA(p,0x10); sVersion = "v"+/doc_version=\"(\d*)\"/.exec(sVp)[1]
		}
	}
	else if(extIs("xrni") && X.c("'PK'0304")) {
		//TODO when ZIP parsing is available
		sName = "Eduard Müller's Renoise instrument (.XRNI)"; sType = '~audio'; sVersion = "xml"; bDetected = 1
	}
	else if(extIs("xrno") && (X.fStr(0,0x100,"<SampleModulationSet")>=0)) {
		sName = "Eduard Müller's Renoise sample modulation set (.XRNO)"; bDetected = 1;
		p = X.fStr(15,0x100,"doc_version=");
		if(p < 0) sVersion = "malformed";
		else {
			sVp = X.SA(p,0x10); sVersion = "v"+/doc_version=\"(\d*)\"/.exec(sVp)[1]
		}
	}
	else if(extIs("xrnt") && (X.fStr(0,0x100,"<RenoiseDeviceChain")>=0)) {
		sName = "Eduard Müller's Renoise effect chain (.XRNT)"; bDetected = 1;
		p = X.fStr(15,0x100,"doc_version=");
		if(p < 0) sVersion = "malformed";
		else {
			sVp = X.SA(p,0x10); sVersion = "v"+/doc_version=\"(\d*)\"/.exec(sVp)[1]
		}
	}
	else if(extIs("xrnt") && X.c("'PK'0304")) {
		sName = "Eduard Müller's Renoise effect chain (.XRNT)"; sVersion = "v<3.0"; bDetected = 1
	}
	else if(extIs("xrnz") && (X.fStr(0,0x100,"<InstrumentPhrase")>=0)) {
		sName = "Eduard Müller's Renoise instrument phrase (.XRNZ)"; bDetected = 1;
		p = X.fStr(15,0x100,"doc_version=");
		if(p < 0) sVersion = "malformed";
		else {
			sVp = X.SA(p,0x10); sVersion = "v"+/doc_version=\"(\d*)\"/.exec(sVp)[1]
		}
	}

	else if(X.c("'NuRIFFRAFF'",0x22)) {
		sName = "Riff Raff module (.RIFF)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.SC(0x64,0x100,'CP1252');
			a = X.SC(0x64+t.length+1,0x100,'CP1252');
			c = X.SC(0x64+t.length+a.length+2,0x100,'CP1252');
			sOptionT(t); sOptionT(a,"by: "); sOptionT(c)
		}
	}

	else if(X.c("'RON_KLAREN_SOUNDMODULE!'00", 0x28)) {
		sName = "Ron Klaren module (.RK)"; bDetected = 1
	}

	else if(X.c("'RTMM '") && X.U8(0x25) == 0x1A &&  X.c("'RTND'",0x2A+X.U16(0x28)+X.U32(0x88))) {
		sName = "Arnaud Hasenfratz's Real Tracker module (.RTM)"; bDetected = 1;
		sVersion = "v"+X.SA(0x37,7)+'/'+Hex(X.U16(0x26));
		if(X.isVerbose()) {
			rtmmxds = X.U32(0x88);
			sOptionT(X.SC(5,0x20,'CP1252'));
			sOptionT(X.SC(0x3E,0x20,'CP1252'),"by: ");
			sOptionT(X.SC(0x8C,0x20,'CP1252'),"orig.: ");
			sOption('ch:'+X.U8(0x60)+' spd0:'+X.U8(0x66)+' bpm0:'+X.U8(0x67)
				+' ord:'+X.U16(0x62)+' ptn:'+X.U16(0x64)+' ins:'+X.U8(0x61))
		}
	}

	else if(X.c("01FF..3EFF32018079FEFF2846320280B7201301FF013E1CED79053E02ED79AF320180C9") && X.c("21A9843D280E232347237E2BB67820F6232318EF5E23567AB328D22B2224803EFE320E823E08325280C35C80", 0x26)) {
		sName = "František Fuka/Fuxoft's Samadeus module (.samadeus)"; bDetected = 1;
		//TODO reverse and extract info
	}

	else if(X.c("00000000 00000200",0x0C) && X.c("00")
	  && X.U16(0x18,_LE) === X.U16(0x40,_LE)
	  && X.c("00'ST-Module.'", 0x4B7)) {
		sName = "Oliver 'BSC' Mayer's Amstrad CPC Soundtrakker module (.STK)"; bDetected = 1;
		datasz = X.U16(0x18,_LE); sz = datasz + 0x80;
		if(sz < X.Sz()) sVersion = "malformed";
		crc = 0; for(i=0; i < 67; i++) crc += X.U8(i); crc &= 0xFFFF;
		if(crc != X.U16(0x43)) sVersion += sVersion != "" ? "!badCRC" : "/malformed!badCRC";
		if(X.isVerbose())
			sOptionT(X.SA(1,8));
			sOption(outSz(sz),"sz:")
	}

	else if(X.c("00000000 00000200",0x0C) && X.c("00")
	  && X.U16(0x18,_LE) === X.U16(0x40,_LE)
	  && X.SA(1,8) === X.SA(0xB10,8)) {
		sName = "Oliver 'BSC' Mayer's Amstrad CPC Soundtrakker 128K module (.128)"; bDetected = 1;
		datasz = X.U16(0x18,_LE); sz = datasz + 0x80;
		if(sz < X.Sz()) sVersion = "malformed";
		crc = 0; for(i=0; i < 67; i++) crc += X.U8(i); crc &= 0xFFFF;
		if(crc != X.U16(0x43)) sVersion += sVersion != "" ? "!badCRC" : "/malformed!badCRC";
		if(X.isVerbose())
			sOptionT(X.SA(1,8));
			inst = []; ins = 0;
			for(i=0; i < 16; i++) if(![0,0x20].indexOf(X.U8(0xB18+8*i))) {
				ins++; inst.push(X.SA(0xB18+8*i,8).trim())
			} //TODO confirm that that's how to count the instruments
			sOption(inst);
			sOption("ins:"+ins+" sz:"+outSz(sz))
	}

	else if(X.c("00'ST-Module.'",0x437)) {
		sName = "Oliver 'BSC' Mayer's Amstrad CPC Soundtrakker module (.STK)"; bDetected = 1;
		sVersion = "headerless"
	}

	else if(X.Sz() > 0x20 && /S98[0-3]/.test(X.SA(0,4))
	  && X.U32(4) <= 0x20 && !X.U32(0xC)
	  && (!X.U32(0x10) || isWithin(X.U32(0x10),0x20,0x800000))
	  && X.U32(0x14) < 0x20000
	  && (!X.U32(0x18) || isWithin(X.U32(0x18),X.U32(0x14),0x800000)) //the highest loop point I saw is 2FB39Ah @ "Snatcher/47 staffroll2.s98"
	  && X.U32(0x1C) <= 0x40) {
		//ref https://www.purose.net/befis/download/lib/t98/ins98131s.zip / s98spec1.txt
		// & http://www.purose.net/befis/download/kmp/old/s98spec2.txt
		// & https://github.com/rururutan/s98spec3/blob/master/s98spec3-ja.txt
		sName = "Ru³'s S98 chiptune (.S98)"; bDetected = 1;
		nv = X.U8(3)-0x30; sVersion = 'v'+nv; dev = X.U32(0x1C);
		if(!dev || (nv >= 2 && !X.U32(0x20))) sVersion += '#OPNA(YM2608)@7.6MHz';
		else for(i=0,p=0x20; i < dev && X.U32(p); i++,p+=0x10) {
			clk = (X.U32(p+4)/0x100000).toFixed(1)+'MHz';
			if((dt=X.U32(p)) > 16) sVersion += '#unk@'+clk;
			else sVersion += '#'+['',
				'PSG(YM2149)','OPN(YM2203)','OPN2(YM2612)','OPNA(YM2608)','OPM(Y2151)',
				'OPLL(YM2413)','OPL(YM3526)','OPL2(YM3812)','OPL3(YMF262)',
				'unk0A','unk0B','unk0C','unk0D','unk0E','PSG(AY-3-8910)','DCSG(SN76489)'][dt] + '@'+clk
			}
		bad = ''; 
		if(X.U32(0x14) > X.Sz() || X.U32(0x18) > X.Sz()) bad += '!short';
		if(X.U32(0x10) > X.Sz()-7) bad += '!badmetadata';
		if(bad.length) sVersion += '/malformed'+bad;
		if(X.isVerbose()) {
			a = c = s = g = ti = y = '';
			switch(nv) {
				case 0: case 1: case 2:
					p = X.U32(0x10);
					if(p > 0)
						sOptionT(X.SC(p,0x40,'Shift_JIS').replace('\\','￥'));
					pk = X.U32(0x0C);
					if(pk) { sVersion += ' compressed';
						sOption("Please send this file over Telegram to @kaens, the detection author! It's unique and needs research") }
					break;
				case 3:
					ptags = X.U32(0x10);
					if(ptags > 6 && X.c("'[S98]'",ptags)) {
						ptags += 5;
						bUTF8 = X.c("EFBBBF",ptags); //if BOM's there
						if(bUTF8) tags = X.SC(ptags,0x200,'UTF8');
						else tags = X.SC(ptags,0x200,'Shift_JIS');
						tagl = tags.split('\x0A');
						for (i=0; i < tagl.length; i++) {
							tag = tagl[i].split("=");
							switch (tag[0]) {
								case 'title': case 'ｔｉｔｌｅ': ti = tag[1]; break;
								case 'game': case 'ｇａｍｅ': g = tag[1]; break;
								case 'system': case 'ｓｙｓｔｅｍ': s = tag[1]; break;
								case 'artist': case 'ａｒｔｉｓｔ': a = tag[1]; break;
								case 'year': case 'ｙｅａｒ': y = tag[1]; break;
								case 'copyright': case 'ｃｏｐｙｒｉｇｈｔ': if(a=="") a = tag[1]; break;
								case 's98by': case 'ｓ９８ｂｙ': if(a=="") a = tag[1]; break;
								case 'comment': case 'ｃｏｍｍｅｎｔ': c = tag[1]; break;
							}
						}
						sOption(ti); sOption(a,'by: '); sOption(y, y.length < 4? "y'": 'y');
						sOption(g,'for: '); sOption(s,'on: '); sOption(c);
						if(ptags > 6 && X.c("'[S98]'",ptags-5) && (t=X.fSig(ptags,0x300,"00")) > -1)
							sOption(outSz(t+1),'sz:')
						break
					} //if correct tag
					else if(ptags > 6)
						t = X.SC(ptags,0x40,'Shift_JIS').replace('\\','￥') //if it's some text—shouldn't happen in v3
			}//switch nv
		}//isVerbose
	}

	else if(X.c("'SAP'0D0A") && (p=X.fSig(3,TOEOF,"0D0AFFFF")) >= 3 && X.U16(p+4) < X.U16(p+6)) {
		//ref https://asap.sourceforge.net/sap-format.html
		sName = "Adam Bienias's Slight Atari Player chiptune (.SAP)"; bDetected = 1;
		if(X.isVerbose()) {
			bad = false; t=""; a=""; dt=""; tp=""; tm="";
			taghunk = X.SA(5,p);
			if(taghunk.length > 5) {
				tags = taghunk.split("\x0D\x0A");
				for(i=0; i < tags.length; i++) {
					tagdiv = tags[i].indexOf(" ");
					tagl = tags[i].substr(0,tagdiv);
					tagr = tags[i].substr(tagdiv+1,tags[i].length);
					switch(tagl) {
						case "NAME": if(tagr != '"<?>"') t = tagr.substr(1,tagr.length-2); break;
						case "AUTHOR": if(tagr != '"<?>"') a = tagr.substr(1,tagr.length-2); break;
						case "DATE": if(tagr != '"<?>"') dt = tagr.substr(1,tagr.length-2); break;
						case "TYPE": sVersion = "t."+tagr; break;
						case "TIME": tm = tagr; break
					}
				}
			}
			if(bad) sVersion += "/malformed";
			sOption(t); sOption(a,"by: "); sOption(dt,"'"); sOption(tm,"len: ");
			t = parseAtariBinary(p+2); sOption(t[1].length,'binblks:'); sOption(outSz(t[0]),'sz:')
		}
	}

	else if(X.c("'SC68 Music-file / (c) (BeN)jamin Gerard / SasHipA-Dev  '00'SC68'........'SCFN'")) {
		sName = "SC 68000 programmatic chiptune (.SC68)"; bDetected = 1;
		if(X.isVerbose()) {
			hdrl = X.SA(0,0x100).length+1;
			p = hdrl; //header skipped
			t=''; a=''; cp=''; st=''; df=-1; x=0; ef=false; mn = [];
			while (p < X.Sz()) {
				hkhd = X.SA(p,4);
				hksz = X.U32(p+4,_LE);
				p += 0x08; //chunk header = 4xfourcc + 4xsize
				switch (hkhd) {
					case "SC68": if(hksz+hdrl != X.Sz()) sVersion = "malformed"; hksz = 0; break;
					case "SCFN": t = X.SC(p,hksz,'CP1252'); break;
					case "SCDF": df = X.U32(p,_LE)+1; break;
					case "SCMN":
						mn.push(X.SC('CP1252',p,hksz));
						if(st=="" || df==mn.length)
							st = mn[mn.length-1];
						break;
					case "SCAN": a = X.SC(p,hksz,'CP1252'); break;
					case "SCCN": cp = X.SC(p,hksz,'CP1252'); break;
					case "SCEF": ef = true; p = X.Sz(); break
				}
				p += hksz;
			}
			sOptionT(t); if(mn.length > 1) sOption(mn.length,"×");
			sOptionT(mn.join(";"));
			sOptionT(a,"by: "); sOptionT(cp,"(c)"); sOption(outSz(p),"sz:")
			if(!ef) sVersion = "malformed!short"
		}
	}

	else if(X.c("'shro'020000")) {
		sName = "Mario Paint's Shroom module (.SHO)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(7,0x20));
			sOptionT(X.SA(0x27,0x20),"by: ")
		}
	}

	else if(X.c("'PSID'") || X.c("'RSID'")) {
		v1 = X.SA(0,1); bDetected = 1;
		if(v1 == "P")  sName = "PlaySID programmatic chiptune (.SID, .PSID)";
		else sName = "RealSID programmatic chiptune (.SID, .RSID)";
		v2 = X.U16(4,_BE);
		sVersion = "v"+Hex(v2);
		bad = '';
		x = X.U16(0x0E,_BE);
		if(!isWithin(x, 1,256)) bad = bad.addIfNone('!badsubsongs');
		else if(x > 1) sOption(x,"×");
		startSong = X.U16(0x10,_BE);
		if(startSong > x) bad = bad.addIfNone('!badstartsong');
		dataOfs = X.U16(0x06,_BE);
		if((v2 == 1 && dataOfs != 0x0076) || (v2 == 2 && dataOfs != 0x007C))
			bad = bad.addIfNone('!baddatap');
		loadAddr = X.U16(0x08,_BE);
		if(v1=="R" && isWithin(loadAddr, 1,0x07E7)) bad = bad.addIfNone('!badloadp');
		initAddr = X.U16(0x0A,_BE);
		if(v1=="R" && !isWithinRanges(initAddr, [[0x7E8,0x9FFF], [0xC000,0xCFFF]]))
			bad = bad.addIfNone('!badinitp');
		flags = X.U16(0x76,_BE);
		if(v1=="R" && ((flags >> 1) & 1) && initAddr > 0)
			bad = bad.addIfNone('!badinitp2');
		sidn = 1;
		if(v2 == 0x4E) sidn += (dataOfs-0x7C) >> 1; else {
			if(v2 >= 3 && !((a2=X.U8(0x7A))&1) && !isWithinRanges(a2, [[0,0x41],[0x80,0xDF]])) sidn++;
			if(v2 >= 4 && !((a3=X.U8(0x7B))&1) && a2 != a3 && !isWithinRanges(a3, [[0,0x41],[0x80,0xDF]])) sidn++;
		}
		var sidt = [0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0]; //upto 16SID
		switch((flags >> 4) & 3) { case 1: sidt[0] = 1; break; case 2: sidt[0] = 2; break; case 3: sidt[0] = 3; break }
		if(v2 >= 3) switch((flags >> 6) & 3) {
			case 1: sidt[1] = 1; break; case 2: sidt[1] = 2; break; case 3: sidt[1] = 3; break; default: sidt[1] = sidt[0] }
		if(v2 == 0x4E) for(i=2,q=0x7C; i < sidn; i++,q+=2) switch((X.U16(q,_BE) >> 4) & 3) {
			case 1: sidt[i] = 1; break; case 2: sidt[i] = 2; break; case 3: sidt[i] = 3; break; default: sidt[i] = sidt[0]
		} else  if(v2 >= 4) switch((flags >> 8) & 3) {
			case 1: sidt[2] = 1; break; case 2: sidt[2] = 2; break; case 3: sidt[2] = 3; break; default: sidt[2] = sidt[0] }
		if(sidn > 1) sVersion += "/"+sidn+"SID";
		sidtt = [0, 0, 0, 0]; //count different chips
		for(i=0; i < sidn; i++) sidtt[sidt[i]]++;
		for(i=0; i < 4; i++) if(sidtt[i]) sVersion += ' #'+['unk','6581','8580','6581&8580'][i] + (sidtt[i]>1? '×'+sidtt[i]:'');
		switch((flags & 0x0C) >> 2) {
			case 1: sVersion += "/PAL"; break;
			case 2: sVersion += "/NTSC"; break;
			case 3: sVersion += "/PAL&NTSC"; break;
		}
		if(bad > 0) sVersion += "/malformed"+bad;
		if(X.isVerbose()) {
			t = X.SC(0x16,0x20,'CP1252'); if(t == "<?>") t = ""; sOptionT(t);
			a = X.SC(0x36,0x20,'CP1252'); if(a == "<?>") a = ""; sOptionT(a,"by: ");
			c = X.SC(0x56,0x20,'CP1252'); if(c == "<?>") c = ""; sOptionT(c);
		}
	}

	else if(X.c("00 FF00FF00 9100FF00 FF008000 92..00967F 01", 0x07)
	  && X.c("9908", 0x1542)) {
		sName = "Tony 'Nissimo' Willams' Sound Images module (.SIG)"; sVersion = 'gen.2'; bDetected = 1
	}

	else if(X.c("0100FEFF09000000'ALIM3'")) {
		sName = "Ruben Ramos 'baktery' Salvador's Skale Tracker module (.SKM)"; bDetected = 1;
		if(X.isVerbose()) sOptionT(X.SA(0x19));
	}

	else if(X.c("'<track'") && (X.fStr(6,0x100,"rowhighliohtingminor=")>0)) {
		sName = "Benjamin 'BeRo' Rousseaux's Picatune module v1 (.SMUFI) or v2 (.PT2)"; bDetected = 1;
		if(X.isVerbose()) {
			s = X.SC(0,0x100,"UTF8");
			t = /.*name="([^"]*)".*/.exec(s);
			if(t != null) sOptionT(t[1]);
			a = /.*author="([^"]*)".*/.exec(s);
			if(a != null) sOptionT(a[1],"by: ");
			spd = /.*speed="([^"]*)".*/.exec(s);
			bpm = /.*bpm="([^"]*)".*/.exec(s);
			if(spd != null) sVersion+=" spd: "+spd[1];
			if(bpm != null) sVersion+=" bpm: "+bpm[1];
		}
	}

	else if(X.c("'SNGs'") && X.Sz() > 0x10 && X.U8(0xA) <= X.U8(7) && X.U8(0xB) <= 0x1E && isWithin(X.U8(0xC),0,0x78)
	  && isWithin(X.U8(0xD),1,30) && isWithin(X.U8(0xE),1,30)) {
	  	//TODO RE reading additional data
	  	// blocks: SMP SYN BNK SNG BLK TMP
		sName = "BlueMoon's Sound Club for DOS module (.SN)"; bDetected = 1;
		if(!(ord=X.U8(7))) sVersion = 'malformed!0ord';
		if(X.isVerbose()) {
			sOptionT(X.SA(0x0F,0x1A));
			lp = X.U8(0xA); gvol = X.U8(0xB)*5; tx = X.U8(0xC); tpb = X.U8(0xD); bpms = X.U8(0xE);
			sOption('rhythm:'+tpb+'/'+bpms+' ord:'+X.U8(7)+' ins:'+X.U8(4)+' gvol:'+gvol+'%')
		}
	}

	else if(X.c("'SN2'") && isWithin(X.U32(0x13),0,0x78) && isWithin(X.U32(0x17),1,30) && isWithin(X.U32(0x1B),1,30)
	  && X.c("'NAM'",0x1F) && X.c("'SEQ'",0x26+X.U32(0x22))) {
		sName = "Bluemoon's Sound Club for Windows module (.SN2)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(addEllipsis(X.SA(0x26,X.U32(0x22)))); sz = X.U32(3)+7;
			lp = X.U32(0x0F); tx = X.U32(0x13); tpb = X.U32(0x17); bpms = X.U32(0x1B);
			//TODO instead of a quartic approximated curve, find out the actual calculation lol
			tempop = Math.round(200 - tx*(4.27246 - tx*(0.0603477 + tx*(-0.000453202 + 1.33871*tx/1000000))));
			p = 0x26+X.U32(0x22); ord = ptn = ins = 0;
			end = false; while(!end && p < X.Sz()) {
				hkhd = X.SA(p,3); hksz = X.U32(p+3); p += 7;
				switch(hkhd) {
				case 'PAT': ptn++; break;
				case 'SEQ': ord = Util.divu64(hksz,4); break;
				case 'INS': ins++; break;
				}
				p += hksz
			}
			sOption('rhythm:'+tpb+'/'+bpms+' tempo: '+tempop+'% ord:'+ord+(lp?' lp:'+lp:'')
				+' ptn:'+ptn+' ins:'+ins+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'SNDH'",0x0C) && (X.isHeuristicScan() || X.c("6000............6000"))) {
		//ref https://sndh.atari.org/files/sndhv21.txt
		sName = "Atari ST Sound Header module (.SND,.SNDH)"; sVersion = "uncompressed"; bDetected = 1;
		if(X.isVerbose()) {
			p = 0x10; title=artist=yr=""; totaltime = i = 0; x = 1;
			while(i < 10 && p < X.Sz()) {
				t = X.SA(p,4); if(t === "TIME") {
					for(j=0; j < x; j++) totaltime += X.U16(p+4+j*2,_BE);
					tlen = 4+x*2-1; if((p+tlen+1)%2) tlen++;
				}
				else { t = X.SA(p,Math.min(X.Sz()-p),0x100); tlen = t.length }
				if(tlen >= 4) {
					hd = t.substr(0,4); tag = t.substr(4,tlen);
					switch(hd) {
						case "TITL": if(tag.substr(0,7) != "Unknown") title = tag; break;
						case "COMM": if(tag.substr(0,7) != "Unknown") artist = tag; break;
						case "YEAR": yr = tag; break;
						case "HDNS": i = 8; break;
						default: if(/##\d\d/.test(hd)) x = hd.slice(2,4);
							else if(/#!\d\d/.test(hd)) if((p+tlen+1)%1) tlen++;
							break;
					}
				}
				p += tlen+1; i++
			}
			sOptionT(title); if(x > "01") sOption(x,"×"); sOptionT(artist,"by: "); sOptionT(yr,"'");
			if(totaltime) sOption(secondsToTimeStr(totaltime,"time:"));
		}
	}

	else if(X.c("'FMC!'")) {
		sName = "Lasse 'Faust' Öörni's Faust Music Creator module (.SNG)"; bDetected = 1;
		if(X.isVerbose())
			sOptionT(X.SA(4,20));
	}

	else if(/GTS[25!]/.test(X.SA(0,4)) && X.U8(0x64) <= 32) {
		//ref https://github.com/leafo/goattracker2/blob/a78e7e5273bfbeb17c3777b1f5ceb63b8e6b4667/src/gsong.c#L177
		sName = "Lasse 'Faust' Öörni's GoatTracker module (.SNG)"; bDetected = 1;
		nV = X.U8(3)-0x30; if(nV < 0) nV = 1;
		if(nV >= 2) sVersion = 'v2.'+nV; else sVersion = 'v1.x';
		x = X.U8(0x64); p = 0x65; ords = []; ptn = mptn = 0; bad = '';
		for(ordc = 0; p < X.Sz(); ) { q = X.U8(p); if(!X.c("FF",p+q)) break;
			for(i=0, p++; i < q; i++) if((t=X.U8(p++)) <= 0xCF && t+1 > mptn) mptn = t+1;
			ordc++; ords.push(q); p++ }
		ch = 3; if(ordc == x*6) { sVersion += ' stereo'; ch = 6 }
		else if(ordc != x*3) bad = bad.addIfNone('!badordcnt');
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		ins = nV >= 2? X.U8(p++): 31; inss = [];
		for(i=0; i < ins; i++) {
			t = X.SC(p+(nV > 1? 9: 8),0x10,'CP1250').trim(); if(t.length) inss.push(t);
			if(nV > 1) p += 0x19; else p += 0x18+2*(X.U8(p+7)>>1);
		}
		for(i=0; i < (nV == 1? 0: nV == 2? 3: 4); i++) p += 1+2*X.U8(p); //skip the tables
		ptn = X.U8(p++); for(i=0; i < ptn; i++) p += 1 + (nV == 1? 1: 4) * X.U8(p);
		if(nV == 1 && X.Sz() != p) p += 0x100; //the (optional?) filtertable at the end
		if(X.isVerbose()) {
			sOptionT(X.SC(4,0x20,'CP1250'));
			if(x > 1) sOption(x,'×');
			sOptionT(X.SC(0x24,0x20,'CP1250'),'by: ');
			sOptionT(X.SC(0x44,0x20,'CP1250'));
			sOptionT(addEllipsis(inss.join(', '),0xA0),'ins/msg:"','"');
			for(i=0, ordc = []; i < ords.length/ch; i++) {
				for(c = j = 0; j < ch; j++) c += ords[i*ch+j];
				ordc.push(c)
			}
			sOption('ch:'+ch+' ord:'+ordc.join('+')+' ptn:'+(ptn == mptn? mptn: '/'+ptn)+' ins:'+ins+' sz:'+outSz(p))
		}
	}

	else if(X.c("'ObsM'")) {
		sName = "Jonne Valtonen's SNG Player module (.SNG)"; bDetected = 1;
		if(X.U8(0x0B)) sVersion += "compressed";
		len = X.U16(4,_LE); if(len>X.Sz()) sVersion += "malformed";
		if(X.isVerbose()) {
			//ref https://github.com/adplug/adplug/blob/master/src/sng.cpp
			start = X.U16(6,_LE);
			loop = X.U16(8,_LE); delay = X.U16(0x0A,_LE);
			sOption("len:"+Hex(len)+" start:"+Hex(start)+" loop:"+Hex(loop)+" delay:"+delay)
		}
	}

	else if(X.c("'RJP'3.'SMOD'")) {
		sName = "Richard Joseph's module (.SNG)"; bDetected = 1;
		sVersion = "v"+X.SA(3,1)
	}

	else if(X.c("'SYNC'") || X.c("'SYNB'")) {
		sName = "Synder SNG-player module (.SNG)"; bDetected = 1;
		sVersion = "ver."+X.SA(3,1);
		if(X.isVerbose()) sOption(X.SA(0x10,0x200))
	}

	else if(X.c("'SYND'....'S0'")) {
		sName = "Synder Tracker module (.SNG)";  bDetected = 1; //TODO unpack & read tags
		sVersion = "ver."+X.SA(3,1)
		//if(X.isVerbose()) sOption(X.SA(0x10,0x200))
	}

	else if(X.c("'SYND'") || X.c("'SYNF'") || X.c("'SYNH'")) {
		sName = "Synder SNG-player Stereo module (.SNG)"; bDetected = 1;
		sVersion = "ver."+X.SA(3,1);
		if(X.isVerbose()) sOption(X.SA(0x10,0x200))
	}

	else if(isWithin(t = ((X.U8(0)+1) << 4) + ((X.U8(1)+1) << 7) + 0x365,0x366,X.Sz())
	  && (/df\d:/.test(X.SA(t,4)) || /[sS]amples/.test(X.SA(t,7)))) {
		//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/ZoundMonitor/src/ZoundMonitor_v1.asm
		sName = "AJ [Activas]'s ZoundMonitor module (.SNG + Samples/)"; bDetected = 1;
		if(X.isVerbose()) {
			ptn = X.U8(1)+1; ord = X.U8(3)+1; spd = X.U8(4);
			for(p=5,smp=0; p < 0x32F; p+=0x36) if(X.U8(p+4)) smp++;
			sOption('spd:'+spd+' ord:'+ord+' ptn:'+ptn+' smp:'+smp
				+' len '+secondsToTimeStr(1+Util.divu64(spd*ord*32,50))+' sz:'+outSz(t+101))
		}
	}

	else if(X.c("'RJP'3. 0000 0000")) {
		sName = "Richard Joseph's module instruments (.INS)"; bDetected = 1;
		sVersion = "v"+X.SA(3,1)
	}

	else if(X.c("'SNES-SPC700 Sound File Data'")) {
		// ref http://snesmusic.org/files/spc_file_format.txt   and snippets from
		// http://www.alpha-ii.com/Source/SAmp310s.rar/snes/id666.cpp, .h
		sName = "Nintendo SNES SPC chiptune (.SPC)"; bDetected = 1;
		sVersion = "v0."+X.U8(0x24);
		if(X.isVerbose()) {
			id666inhdr = X.U8(0x23)==0x1A;
			t=""; a=""; c=""; g=""; dumper=""; emu="";
			preferBin = false;
			if(id666inhdr){
				t = X.SA(0x2E,0x20);
				g = X.SA(0x4E,0x20);
				dumper = X.SA(0x6E,0x10);
				dumpdate = X.SA(0x9E,11);
				emu = X.U8(0xD2);
				if(emu>=0x30 && emu<=0x39)
					emu -= 0x30;
				switch(emu) {
					case 1: emu = "ZSNES"; break;
					case 2: emu = "Snes9x"; break;
					case 3: emu = "ZST2SPC"; break;
					case 4: emu = "ETC"; break;
					case 5: emu = "SNEShout"; break;
					case 6: emu = "ZSNESW"; break;
					default: emu = ""
				}
				c = X.SA(0x7E,0x20);
				slen = X.SA(0xA9,3); lp=X.SA(0xAC,4);
				if((slen+lp+dumpdate).length < 5) {
					chnDis = X.U8(0xD1);
					if(chnDis == 1 && emu == "") bin = true; else bin = preferBin;
				} else if( /[0-9/]*/.test(slen+lp+dumpdate) ) { //id666 text format
					songlen = Number(slen); //in seconds
					a = X.SA(0xB1,0x20);
				} else {
					bin = true;
					//check songlen bitness
					songlen = X.U8(0xA9)<<16+X.U8(0xAA)<<8+X.U8(0xAB); //in seconds
					a = X.SA(0xB0,0x20);
				}
			}
			else
				t = X.SA(0x30,0x14);
			sOption(t); sOption(g,"for: "); sOption(a,"by: "); sOption(c);
			if(emu != "") sVersion += " "+emu;
		}
	}

	else if(X.c("'STK1.0SONG'") && [1,2,3].indexOf(X.U8(0x34)) >= 0
	  && X.U8(0x35) <= X.U8(0x3A) && X.U8(0x36) <= X.U8(0x35)
	  && X.U8(0x38) <= 0x3F && X.U8(0x39) <= 5) {
		// format details here: https://modland.com/pub/documents/format_documentation/STarKos%20(.sks).md
		sName = "Julien 'Targhan' Nevo's STarKos module (.SKS)"; bDetected = 1;
		bad = "";
		switch(X.U8(0x39)) {
		case 0: hz = 13; break;  case 1: hz = 25; break;  case 2: hz = 50; break;
		case 3: hz = 100; break;  case 4: hz = 150; break;  case 5: hz = 300; break;
		default: hz = 0; bad = bad.addIfNone("!badRepFreq")
		}
		xpos = X.I8(0x37).toString(); if(xpos[0] != "-") xpos = "+"+xpos;
		spd0 = X.U8(0x38); ord = 1+X.U16(0x3A);
		ptn = -1; rows = ptnxpos = 0; p = 0x3C;
		for(i=0; i < ord*4; i++) {
			if((i%4) == 3) rows += X.U8(p)+1;
			else { t = X.U8(p); if(ptn < t) ptn = t; if(X.I8(p+1)>>1) ptnxpos++ }
			p += 2
		} ptn++;
		insns = [];
		const ifHard = 0x80, ifPitch = 0x40, ifArp = 0x20, ifNoiseEtc = 0x10;
		for(ins = 0; p < X.Sz() && ins < 0x100; ins++) {
			insn = X.U16(p); p += 2;
			if(insn == 0xFFFF) break;
			ip = p; isz = X.U16(ip); p += 4;
			iend = 1+X.U8(p+2);
			p += 5;
			iname = X.SA(p,8).trim(); p += 8; if(iname != "") insns.push(iname);
			if(X.isDeepScan())
			for(l = 0; l < iend; l++) {
				x = X.U8(p++);
				if(!x) continue;
				if((x & ifHard)) {
					y = X.U8(p++); if(x & 8) p++; if(y & 0x40) p++; if(x & 2) p++;
					if(x & 4) p += 2; if(x & 0x10) p += 2; if(x & 0x20) p += 2
				} else {
					if(x & ifNoiseEtc) { y = X.U8(p++);
						if(y & 0x40) { p += 2;
							if(x & (ifArp | ifPitch)) { bad = bad.addIfNone("!badinsflags"); ins=l=0xFFFE; break }
						}
					}
					if(x & ifArp) p++; if(x & ifPitch) p += 2
				}
			} else p = ip+isz;
		}
		for(sptn = 0; p < X.Sz(); sptn++) {
			curptn = X.U16(p); p += 2; if(curptn == 0xFFFF) break;
			p += X.U8(p)
		}
		if(X.isDeepScan()) notecnt = 0;
		if(p < X.Sz() && ins < 0xFFFE) for(i = 0; i <= ptn; i++) {
			curptn = X.U16(p); p += 2;
			if(curptn != 0xFF && curptn != 0xFFFF && curptn > 0x200) { bad = bad.addIfNone("!badnptn"); break }
			if(curptn == 0xFFFF) break;
			pp = p; psz = X.U16(pp);
			if(X.isDeepScan()) {
				p += 2; var pvol = pins = -1, lc = 0;
				while(p < Math.min(X.Sz(), pp+psz)) {
					var ppitch = 0, lnp = p,
						pfnote = pfvol = pfpitch = false;
					x = X.U8(p++);
					if(x == 0xFF) break;
					else if(x & 0x80) lc += x & 0x7F;
					else if(x >= 0x60)
						switch(x & 0xF) {
						case 0: pfvol = true; pfpitch = false; pvol = 0xF - X.U8(p++);
							if(pvol < 0) { bad = bad.addIfNone("!badptnvol0"); i = ptn; p = pp+psz; break; }
						case 1: pfvol = false; pfpitch = true; ppitch = - X.U8(p++); break;
						case 2: pfvol = pfpitch = true;  pvol = 0xF - X.U8(p++);
							if(pvol < 0) { bad = bad.addIfNone("!badptnvol2"); i = ptn; p = pp+psz }
							ppitch = - X.U8(p++); break;
						case 3: pfnote = true; pnote = "rst"; break;
						case 4: pfnote = true; pnote = "spl"; pins = X.U8(p++); break;
						}
					else {
						pfnote = true;
						y = X.U8(p++);
						pfvol = !(y & 0x40);
						if(pfvol) pvol = 0xF - (y & 0xF);
						if(pins < 0 || !(y & 0x20)) pins = X.U8(p++);
						pfpitch = y & 0x10;
						if(pfpitch) ppitch = - X.I8(p++);
					}
					if(pfnote) notecnt++;
					lc++
				} //single pattern cycle
			} else p = pp+psz;
		} //patterns cycle
		if(p > X.Sz()) bad = bad.addIfNone("!short");
		if(bad != "") sVersion = sVersion.appendS("malformed"+bad,"/");
		if(X.isVerbose()) {
			sOptionT(X.SA(0x14,0x20));
			sOptionT(X.SA(0x0A,0x0A),"by: ");
			sOption("spd0:"+spd0+(xpos!="+0"?" xpos:"+xpos:"")+" ord:"+ord+" ptn:"+ptn+"+"+sptn+" ins:"+ins
				+(ptnxpos?" ptn.xpos:"+ptnxpos:"")+" smp.ch:"+X.U8(0x34)+" rep.freq:"+hz+"Hz"
				+" loop:"+(X.U8(0x36) ? Hex(X.U8(0x36))+"-" : "")
				+Hex(X.U8(0x35))+(X.isDeepScan()?" notes:"+notecnt:" rows:"+rows)+" sz:"+p)
		}
	}//.SKS

	else if(!X.U8(0) && X.c("'SK10'",0x80) && [1,2,3].indexOf(X.U8(0x86)) >= 0
	  && [13,25,50,100,150,300].indexOf(X.U16(0x87)) >= 0 && X.U16(0x18) == X.U16(0x40)) {
		//from https://web.archive.org/web/20240331033458_nf/https://www.grimware.org/doku.php/documentations/software/starkos/start#tweaking.the.song
		sName = "STarKos module (.BIN)"; sVersion = "compiled/ofs:80h"; bDetected = 1;
		crc = 0; for(i=0;i<67;i++) crc += X.U8(i); crc &= 0xFFFF;
		if(crc != X.U16(0x43)) sVersion += "/malformed!badCRC";
		if(X.isVerbose()) {
			sOption(X.SA(1,8).trim()+"."+X.SA(9,3).trim());
			sOption(X.U16(0x87)+"Hz");
			sOption(Hex(X.U16(0x84)),"base:");
			sOption(outSz(X.U24(0x40)+0xBC),"sz:");
		}
	}

	else if(X.c("'Nu!SOPROL!'", 0x22)) {
		sName = "Holger Gehrmann's Sound Programming Language/SOPROL module (.SPL)"; bDetected = 1;
		if(X.isVerbose()) {
			t = X.SA(0x58,0x100);
			a = X.SA(0x58+t.length+1,0x100);
			c = X.SA(0x58+t.length+a.length+2,0x100);
			sOptionT(t); sOptionT(a,"by: "); sOptionT(c)
		}
	}

	if(/SPM[\x01-\x02]/.test(X.SA(0,4))) {
		//ref http://aminet.net/mus/edit/stonefree1.lha
		sName = "Emmanuel Marty & Michael Lavaire's Stonetracker module (.SPM)";
		sVersion = "v"+X.U8(3); bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(decAnsi(4,0x20,CPAmiga));
			//TODO find chunks and read the extra info
		}
	}

	if(/SPS[\x01-\x02]{2}/.test(X.SA(0,5)) && X.c("'psn'",6+0x20*(smp=X.U8(5)))) {
		sName = "Emmanuel Marty & Michael Lavaire's Stonetracker sample bank (.SPS)";
		sVersion = "v"+X.U8(3); bDetected = 1;
		if(X.isVerbose()) {
			for(i=smpsz=0,smps=[]; i < smp; i++)
				if((t=decAnsi(0x20*i+6,8,CPAmiga).trim()).length) smps.push(t);
			sOption(addEllipsis(smps.join(' ')),'smp/msg:"','"'); sOption('smp:'+smp)
		}
	}

	else if(X.c("'SPU'00") || X.c("'SPU1'") ||
		(X.fSig(X.Sz()-6,TOEOF,"1D80FF"))>-1) {
		bDetected = 1; sName = "Eternal SPU chiptune (.SPU)";
		if(X.c("'SPU'")) {
			if(!X.U8(3)) sVersion = "v0"; else sVersion = "v1"; }
		else sVersion = "headerless";
		if(X.isVerbose() && (sVersion != "headerless")) {
			game = X.SC(4,0x40,"Shift_JIS");
			title = X.SC(0x44,0x40,"Shift_JIS");
			sOptionT(title); sOptionT(game, "game: ");
			artist = X.SC(0x84,0x20,"Shift_JIS"); sOptionT(artist,"by: ");
			cmt = X.SC(0xA4,0xF00,"Shift_JIS"); sOptionT(cmt);
		}
	}

	else if(X.c("'SPEEDY-SYSTEM'")) {
		bDetected = 1; sName = "Speedy System module (.SS)"; sVersion = "v1"
	}

	else if(X.c("'ZXAYST11'")) {
		sName = "Sound Tracker module (.ST1, .ST11)"; bDetected = 1;
		sVersion = "v1.1/uncompiled";
		if(X.isVerbose()) {
			t_= X.U8(0x17); t = X.SA(0x18,t_-1).trim();
			if(t != "Some SoundTracker Song") sOption(t);
		}
	}

	else if(X.c("'STP3'")) {
		sName = "Soundtracker Pro II module (.STP)"; bDetected = 1;
	}

	else if(X.c("48E7FFFE 4DFA.... 4A2E") && isWithin(X.I8(6),-1,6) && [0x61,0x66].indexOf(X.U8(0xC)) >= 0) {
		sName = "SUNtronic module (.SUN)"; bDetected = 1
	}

	else if(X.c("'SVOX'00000000")) {
		sName = "SunVox module (.SUNVOX)"; bDetected = 1;
		if(X.isVerbose()) {
			p=8;
			t=''; bpm=0; spd=0; tme=0; ptn=0; blk=0;
			while (p < X.Sz()) {
				hkhd = X.SA(p,4); if(charStat(hkhd).indexOf('allasc') < 0) break;
				hksz = X.U32(p+4,_LE); p += 8;
				switch(hkhd) {
					case "VERS":
						nV = X.U32(p,_LE); aV=[];
						for(i=0; i < 4; i++) aV[3-i] = (nV>>(8*i))&0xFF;
						sVersion += "v"+aV.join("."); break;
					case "BVER":
						nB = X.U32(p,_LE);
						if(nB != nV) { aV = [];
							for(i=0; i < 4; i++) aV[3-i] = (nB>>(8*i))&0xFF;
							sVersion += "/v"+aV.join(".");
						}
						break;
					case "NAME": t = X.SA(p,hksz); break;
					case "BPM ": bpm = X.U32(p,_LE); break;
					case "SPED": spd = X.U32(p,_LE); break;
					case "TIME": tme = X.U32(p,_LE); break;
					case "SNAM": blk++; break;
					case "PDTA": ptn++; break;
				}
				p += hksz;
			}
			sOptionT(t);
			if(bpm > 0) sOption(bpm,"bpm:"); if(spd > 0) sOption(spd,"spd:");
			if(tme > 0) sOption(tme,"len:"); if(ptn > 0) sOption(ptn,"ptn:"); if(blk > 0) sOption(blk,"blk:");
			sOption(outSz(p),'sz:')
		}
	}

	else if(X.c("'SymM'")) {
		//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_symmod.cpp
		// & https://github.com/patricklyte/SymphonieFx
		sName = "Patrick Meng's Symphonie module (.SYMMOD)"; bDetected = 1;
		sVersion = "v"+X.U32(4,_BE);
		if(X.isVerbose()) {
			p=8;
			title=''; bpm='?'; done=false; ch=0; len=0; extsmp=false; pro=false;
			while (p < X.Sz()) {
				hkhd = X.I32(p,_BE); hkhx = Hex(X.U32(p,_BE)); hksz = 4;
//_l2r('symmod',p,hkhd+' / '+hkhx)
				if(done || charStat(hkhd).indexOf('allasc') < 0) break;
				p += 0x04; //chunk header = 4xtype (the following will change by chunk type)
				switch (hkhd) {
					case -16:
						pklen=X.U32(p,_BE); hksz+=pklen; o=4; //InfoText RLE-COMPRESSED YO
						if(pklen>=10 && X.c(p+o,"'PACK'FFFF")) if(!X.isDeepScan()) { p = 0; break } else {
							o+=6; unplen = X.U32(p+o,_BE); o+=4;
							maxlen = pklen-10; if(0xFFFFFFFF/170 >= maxlen) maxlen *= 170; else maxlen = 0xFFFFFFFF;
							if(unplen > maxlen) unplen = maxlen;
							done = false; ofs = 0; left = unplen;
							while(!done && o < hksz) {
								tp = X.I8(p+o); o++;
								switch(tp) {
								case 0:
									l = X.U8(p+o); o++;
									if(left >= l) {
										t += X.SA(p+o,l);
										o += l; left -= l;
									} else done=true;
									break;
								case 1:
									l = X.U8(p+o); o++;
									dw = X.SA(p+o,4); o += 4;
									if(left >= l*4 && o < pklen) {
										left -= l*4;
										while(l--) t += dw;
									} else done = true;
									break;
								case 2:
									dw = X.SA(p+o,4); o += 4;
									if(left >= l*4 && o<pklen) {
										unp += dw+dw;
										left -= 8;
									} else done = true;
									break;
								case 3:
									l = X.U8(p+o); o++;
									if(left >= l) left-=l;
									else done = true;
									break;
								case -1: done = true; break;
								default: sVersion += "/malformed"; done = true; break;
								}//switch
							}
						} else //if no RLE sig:
						title = X.SC(p+o,hksz,'CP1252'); break;
					case -1: ch = X.I32(p,_BE); break; //NumChannels
					case -2: len = X.I32(p,_BE); if(len > 1024) len = "malformed"; break; //TrackLength
					case -3: case -4: case -5: break;
					case -7: extsmp = true; break; //ExternalSamples
					case 10: case 11: case 12: pro=true; break; //Sample Boost/Detune/Phase
					case -6: bpm = Math.round(1.24*Math.min(X.I32(p,_BE),800)); break; //Tempo
					case -12: hksz = 0; break; //EmptySample
					case -10: case -11: case -13: case -14: case -15: case -17: case -18:
					case -19: case -20: case -21: hksz+=X.I32(p,_BE); break;
					default: _l2r('symmod',p,hkhd+"/"+hkhx+" ("+Hex(hksz,8)+"): ?!?!?!?!?!");
				}
				p += hksz;
			}
			sOption(title);
			sOption('ch:'+ch+' bpm:'+bpm+' len:'+len+(done?'sz:'+outSz(p):''));
			if(extsmp) sOption("extsmp"); if(pro) sVersion+="/Pro"
			}
	}

	else if(X.c("'Synth'") && !X.c("'esi'",5)) {
		sName = "C. 'Mr Soundwave' Herbst & B. MIkic/BrainTrace Design's Synthesis module (.SYN)"; bDetected = 1;
		if(X.c("'Synth'",0x1F0E)) {
			sVersion = "v"+X.SA(0x1F13,3);
			if(X.isVerbose()) {
				sOptionT(X.SA(0x1F32,0x1B));
				sOptionT(X.SA(0x1F4E,0x100))
			}
		} else {
			sVersion = "v"+X.SA(5,3);
			if(X.isVerbose()) {
				sOptionT(X.SA(0x24,0x1B));
				sOptionT(X.SA(0x40,0x100))
			}
		}
	}

	else if(X.c("'SYNTRACKER-SONG:'00")) {
		sName = "Bastian 'flink'/'twiCe' Spiegel's SynTracker module (.SYNMOD)"; bDetected = 1;
		if(X.isVerbose()) {
			t1 = X.SC(0x14,0x20,'CP1252'); sOptionT(t1,"title/inst: ");
			t2 = X.SC(0x34,0x20,'CP1252'); sOptionT(t2);
			t3 = X.SC(0x54,0x20,'CP1252'); sOptionT(t3);
		}
	}

	else if(X.c("'T0AST'")) {
		// ref T0AST.src.zip/ SoundEnginePlayer.pas, synth.pas
		// Kudos to BeRo for the tracker sources
		sName = "Benjamin 'BeRo' Rousseaux's The 0ok Amazing Synth Tracker module (.T0AST)"; bDetected = 1;
		if(X.c("'0OK'",5)) { nV = 1; sVersion = "v1"; } else
		if(X.c("010001",5)) { nV = 2; sVersion = "v2"; } else
			{ nV = -1; sVersion = "v.unk"; }
		function info() {
			if(nV == 1) p = 0x1DA;
			else if(nV == 2) p = 0x34A;
			else return;
			drummode = X.U8(p++);
			chipmode = X.U8(p++);
			chs = X.U8(p++); ch = 0;
			if(chs > 16) { sVersion += "/malformed"; return; }
			for(i=0; i<16; i++)
				if(X.U8(p++)) { ch++; p += 3; }
			ins = 0;
			for(i=0; i<16; i++)
				if(X.U8(p++)) { ins++; p += 25; }
			ord = X.U16(p,_LE); p += 2+ord;
			ptn = 0; notes = 0;
			for(k=0; k<=255; k++)
				if(X.U8(p++)) { //gotta do what you gotta do
					ptn++;
					for(i=0; i<chs; i++) {
						j = 0;
						while(j < 0x40) {
							b = X.U8(p++);
							if(b & 0x80) { //RLE!
								c = b & 0x7F;
								if(c) {
									p++;
									while(c && j < 0x40) { notes++; j++; c--; }
								}
								else j++;
							}
							else { //just skipping the note parameters
								if(b&0x01) p++; if(b&0x02) p++; if(b&0x04) p++;
								if(b&0x08) p++; if(b&0x10) p++; if(b&0x20) p++;
								if(b&0x40) {
									c = X.U8(p++);
									while(c && j < 0x40) { notes++; j++; c--; }
								}
								else { notes++; j++; }
							}
						}
					}
				}
			loop = X.U8(p++);
			t_ = X.U32(p,_LE); p += 4;
			t = X.SC(p,t_,'CP1252'); p += t_;
			a_ = X.U32(p,_LE); p += 4;
			a = X.SC(p,a_,'CP1252'); p += a_;
			c_ = X.U32(p,_LE); p += 4;
			c = X.SC(p,c_,'CP1252'); p += c_
			sOption(t);
			sOption(addEllipsis(a,0x80),"by: ");
			sOption(addEllipsis(c,0x100),'msg:"','"');
			sOption("ch:"+ch+" ins:"+ins+" ord:"+ord+" ptn:"+ptn+" notes:"+notes+" loop:"+loop+" sz:"+outSz(p));
		}
		if(X.isVerbose() && nV != -1) info();
	}

	else if(X.c("'T0ASTINS'")) {
		sName = "Benjamin 'BeRo' Rousseaux's The 0ok Amazing Synth Tracker instrument file"; bDetected = 1;
		if(X.isVerbose()) sOption(outSz(8+25),"sz:")
	}

	else if(X.c("4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900")
		&& X.U32(0x2C,_BE)-X.U32(0x2,_BE) == 0xA0
	  || 
		X.c("601A") && (X.c("1010",0x1C) || X.c("1012",0x1C)) && (t=X.I32(0x22,_BE)) > 0
	  	&& t == X.I32(0x26,_BE) && t == X.I32(0x2A,_BE) && t == X.I32(0x2E,_BE)
	  ) {
		sName = "Tim Follin & Mike D.'s Follin Player II module (.TF)";
		sVersion = 'f.'+(X.U8(0) == 0x4E?'0':'1'); bDetected = 1
}

	else if(X.c("'TFMD'")) {
		sName = "Shiru's TFM Music Maker tune (.TFD)"; bDetected = 1;
		if(X.isVerbose()) {
			p = 4;
			t = X.SA(p,0x200); //I've seen CP1251 and CP936 already, nobody seems to care
			p = X.fSig(p,0x200,"00")+1;
			a = X.SA(p,0x200);
			p = X.fSig(p,0x200,"00")+1;
			c = X.SA(p,0x200);
			sOptionT(t); sOptionT(a,"by: "); sOptionT(c);
		}
	}

	else if(X.c("'TFMfmtV2'")) { // this format is very similar to VGE
		sName = "Shiru's TFM Music Maker module (.TFE)"; bDetected = 1;
		if(X.isVerbose()) {
			p = 0;
			//WELP, time to read the entire file, or at least the fun part
			x = [], tobuf = true, p = 0, b = 0x3F; // '?' by default. If this pops up, the file's garbled
			for(n=0, c = X.U8(p++); n < 0x223DD9 && p < X.Sz(); ) {
				// The logic is:
				// a byte is read and if it's not 0x80, put to buffer (and memorised)
				// if the following byte is 80, it's RLE:
				// 	 - the following byte gives 7 bits of the number of repeats of the memorised byte
				//   - if the length byte's bit 7 is set, this is the last byte, otherwise adds the next higher 7 bits
				//	 - if the length is 0, store 0x80
				//	 - else store the memorised byte repeats-1 times
				if(tobuf && n > 0x312) tobuf = false;
				if(c != 0x80) { b = c; n++; c = X.U8(p++); if(tobuf) x.push(b) }
				else {
					c = X.U8(p++); next = true; reps = shl = 0;
					while (next && shl < 57 && p < X.Sz()) { //read the vari-len int
						next = !(c & 0x80); c &= 0x7F; reps |= Util.shlu64(c,shl); shl += 7; c = X.U8(p++)
					}
					if(!reps) { if(tobuf) x.push(0x80); n++ } //special case for the RLE character
					else { reps -= 1; n += reps; shl = 0; if(tobuf) for(j=0; j < reps; j++) x.push(b) }
				}
			} p--;
			spd1 = x[8]; spd2 = x[9]; intlv = x[0xA]; ord = x[0xB]; if(!ord) ord = 256; lp = x[0xC];
			d1 = x[0x0D]+(x[0x0E] << 8); d2 = x[0x0F]+(x[0x10] << 8); saves = x[0x11]+(x[0x12] << 8);
			d1 = '20'+(d1&0x7F).padStart(2,'0')+'-'+(((d1>>7)&0xF)+1).padStart(2,'0')+'-'+(((d1>>11)&0x1F)).padStart(2,'0');
			d2 = '20'+(d2&0x7F).padStart(2,'0')+'-'+(((d2>>7)&0xF)+1).padStart(2,'0')+'-'+(((d2>>11)&0x1F)).padStart(2,'0');
			auth = decEncoding(x.slice(0x13,0x52),CP1251); //I've seen CP1251 and CP936 already, but yeah
			title = decEncoding(x.slice(0x53,0x94),CP1251);
			cmt = decEncoding(x.slice(0x93,0x214),CP1251);
			for(i=ptn=0; i < ord; i++) if(x[i+0x213]+1 > ptn) ptn = x[i+0x213]+1;
			sz = n == 0x223DD9 ? p : -1; if(sz < 0) sVersion = sVersion.appendS('malformed:'+Hex(n),'/');
			sOptionT(title); sOptionT(auth,'by: '); sOptionT(cmt);
			sOption('on: '+d1+(d1 != d2? ' to '+d2: ''));
			sOption('spd:'+spd1+'/'+spd2+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn+" intlv:"+intlv+' saves:'+saves+(X.isDeepScan()? ' sz:'+outSz(sz):''));
		}
	}

	else if(X.Sz() >= 0x386 && isWithin(X.U8(0x25),1,4) && (bin=parseAtariBinary())[0] > 0
	  && X.c("0E158D",6) && X.c("8D150E",0x1A) && X.U16(0x1D) == bin[1][0][1]
	  && (X.c("'TMC SONG FILE 2.0'",9) || X.c("D4CDC3A0 D3CFCEC7A0 C6C9CCC5A0 B2AEB0",9))) {
		//ref http://atariki.krap.pl/index.php/TM2
		sName = "Marcin 'Jaskier' Lewandowski's Theta Music Composer (.TM2)"; sVersion = 'v2.0'; bDetected = 1; bad = '';
//		sOption(decAnsi(6,0x17,CPATASCII,0,Chars0to1FATASCII))
		for(ins=0,p0=0x10000,p=0x86; p < 0x106; p++) {
			t = ((X.U8(p+0x280) << 8) | X.U8(p))-X.U16(2)+6; if(t < 0) break;
			if(t > 0)
				if(!isWithin(t,0x380,bin[1][0][1]+6)) bad = bad.addIfNone('!badinsp');
				else { if(p0 > t) p0 = t;  if(X.U8(t) != 0xFF) ins++ }
		}
		for(ptn=0,p=0x106; p < 0x206; p++) {
			t = ((X.U8(p+0x100) << 8) | X.U8(p))-X.U16(2)+6; if(t < 0) break;
			if(t > 0)
				if(!isWithin(t,0x380,bin[1][0][1])) bad = bad.addIfNone('!badptnp');
				else { if(p0 > t) p0 = t; if(X.U8(t) != 0xFF) ptn++ } //some patterns may be actually used despite being empty
		}
		for(ord=(p0-0x386)/0x11,p=0x386,pt=-1; p < p0; p += 0x11) {
			for(q=p+1; q < p+0x11; q += 2) if(X.U8(q) >= pt) pt = X.U8(q)+1; //actually used pattern number
			if(isWithin(X.U8(p+16),0x41,0x7F)) bad = bad.addIfNone('!badord');
			if(X.I8(p+16) <= 0) break //loop or end
		}
		if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
		if(X.isVerbose()) {
			for(p=0x26, t=''; p < 0x86; p += 0x20)
				t = t.appendS(decAnsi(p,0x20,CPATASCII,0,Chars0to1FATASCII).trim(),' | ');
			sOption(t);
			if(!(t=X.U8(0x1F))) t = 'mono';  else if(isWithin(t,1,0x3F)) t = 'stereo';
			else if(isWithin(t,0x40,0x7F)) t = 'RMT stereo'; else t = 'quadro';
				sOption('ch:'+t+' spd0:'+X.U8(0x24)+' ticks:'+X.U8(0x25)+' ord:'+ord
				+' ptn:'+ptn+(pt!=ptn? '/'+pt:'')+' ins:'+ins+' sz:'+outSz(bin[0]))
		}
	}

	else if(X.c("0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F", 0x14)
	  && X.c("FFFF001000000030000000", 0x181)) {
		sName = "N.J. Luuring Jr.'s The Musical Enlightenment module (.TME)"; bDetected = 1;

	}

	else if(X.Sz() >= 0x3000 && X.c("'TRK01/TV.ES.'")) {
		sName = "Adam Davidson & Ramjet & Toxic Volume's RamTracker module (.TRK)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SC(0x0F,0x20,'CP850'));
			sOptionT(X.SC(0x2F,0x20,'CP850'),"by: ");
			p = 0x453; ptn = -1; ord = 0;
			for(;;) { t = X.U8(p++); if(t >= 0xFE || p > X.Sz()) break;
				ord++; if(ptn < t) ptn = t }
			ptn++;
			sOption("ord:"+ord+" ptn:"+ptn)
		}
	}

	else if(X.c("'S'8F'NG.'") && /[BW][48]/.test(X.SA(5,2))
	  && (pp=X.fSig(8,0x80*(ch=X.U8(6)-0x30),"DD48")) > 0 && !(pp % 2)) {
		//ref the eagleplayer BladePacker(?!)
		sName = "Unique Development/BladePacker's module (UDS.+SMP.)"; bDetected = 1;
		if(X.isVerbose()) {
			ptn = mptn = 0; maxp = Math.min(X.Sz(), 0x10000);
			bw = X.SA(5,1) == 'B'? 1: 2; ord = (pp-8) >> (bw+1);
			for(p = 8; p < pp; p++) if((t=X.U8(p)+1) > mptn) mptn = t;
			p += 2; t = 0;
			if(bw == 1) for(; X.U16(p,_BE) != 0xD8F1 && p < maxp; ) { //for() twice for speed opt
				if((q=X.U8(p++)) > t) t = q; if((q=X.U8(p++)) > t) t = q }
			else
				for(; (q=X.U16(p,_BE)) != 0xD8F1 && p < maxp; p += 2) if(q > t) t = q;
			ptnp = p; ptn = (p-pp-2) >> (bw+5); p += 2 + ((t+1) << 2); //if p > Sz undetect
			sz = p;
			//subsongs @f732:
			p = o = x = 0; a2 = pp+2;
			_f742: for(; p < maxp; ) {
				p = 8 + o * ch;
				if(p != pp) {
					a0ch = a0 = p+ch; o++;
					_f756: for(; p < maxp; ) {
						a0 = pp+2+(X.U8(p++) << (bw+5));
						_f76a: for(d6 = 0x40; d6 && p < maxp; ) {
							if(bw == 1) d1 = X.U8(a0++); else { d1 = X.U16(a0,_BE); a0 += 2 }
							d1 <<= 2;
							if([0x2C,0x20].indexOf(X.U8(ptnp+4+d1)) >= 0) {
								x++;
								continue _f742
							}
							else {
								if(--d6) continue _f76a;
								if(p != a0ch) continue _f756; else continue _f742;
							}
						}
					}
				} else break _f742;
			}
			if(!x) x = 1; if(x > 1) sOption(x,'×');
			sOption('ch:'+ch+' ord:'+ord+' ptn:'+(mptn==ptn?'':mptn+'/')+ptn+' sz:'+outSz(sz))
		}
	}

	else if((X.Sz() > 0x133) && X.c("'MAS_UTrack_V00'") && isWithin(X.U8(0xE),0x31,0x34)
	  && X.Sz() > X.U8(0x2F)*0x20+0x50) {
		//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_ult.cpp
		sName = "Marc 'MAS' Schallehn's UltraTracker module (.ULT)"; bDetected = 1;
		nV = X.U8(0xE)-0x30; sVersion = 'v'+['<1.4','1.4','1.5','1.6'][nV-1]; bad = '';
		msgn = X.U8(0x2F); p = 0x30+msgn*0x20;
		smp = X.U8(p++); smpsz = 0; smps = [];
		for(i=0; i < smp; i++) {
			t = X.SC(p,0x20,'CP437').trim(); if(t != '') smps.push(t);
			ssz = X.U32(p+0x38) - X.U32(p+0x34);
			if(ssz < 0) bad = bad.addIfNone('!badsmpsz');
			else smpsz += ((X.U8(p+0x3D)&4)? 2: 1)*ssz; //16-bit flag
			if(nV >= 4) p += 0x42; else p += 0x40;
		}
		for(i=ord=mp=0; i < 0x100; i++) if((o=X.U8(p++)) < 0xFE) { ord++; if(mp < o) mp = o }
		ch = X.U8(p++)+1; ptn = X.U8(p++)+1; mp++;
		p += ch;
		for(c=notes=0; c < ch; c++) for(t=0; t < ptn && p < X.Sz(); t++) {
			row = 0;
			while(row < 64) {
				rp = 1; b = X.U8(p++); if(b == 0xFC) { rp = X.U8(p++); b = X.U8(p++) }
				note = isWithin(b,1,96); p += 4; if(rp+row > 64) rp = 64-row;
				if(!rp) break; row += rp; if(note) notes += rp;
			}
		}
		if(p > X.Sz()) bad = bad.addIfNone('!short');
		sz = p + smpsz;
		if(bad != '') sVersion = sVersion.appendS('/malformed'+bad,'/');
		if(X.isVerbose()) {
			sOptionT(X.SC(0x0F,0x20,'CP437'));
			specialmsg =
				(msgn==23&&sz==297221&&ch==7&&ord==20&&ptn==29&&smp==17&&notes==1572); //Handleless - :) falling and flying :(.ult
			for(p=0x30,i=0,msg=[]; i < msgn; i++) {
				t = decAnsi(p,0x20,CP437,Chars0to1F); if(!specialmsg) t = t.trim();
				if(t != '') msg.push(t); p += 0x20
			}
			msg = addEllipsis(msg.join(specialmsg?'\n':' '), specialmsg?0x2000:0xC0, specialmsg?0x2000:0xA0);
			sOption(msg, 'msg:'+(specialmsg?'\n':'"'), specialmsg?'\n':'"');
			if(!msg.length) sOption(addEllipsis(smps.join(','),0x80,0x60),'smp/msg:"','"');
			sOption('ch:'+ch+' ord:'+ord+' ptn:'+mp+(ptn!=mp?'/'+ptn:'')
				+' smp:'+smp+' notes:'+notes+' sz:'+outSz(sz))
		}
	}

	else if(X.c("'VGEfmtV'") && isWithin(nV=X.U8(7)-0x30,1,3)) { // this format is similar to TFM Music Maker
		sName = "Shiru's VGM Music Maker module (.VGE)"; bDetected = 1;
		sVersion = 'v'+nV; ord = -1; //TODO determine whether to unpack from 0 or 0x10, and RE v1
		if(X.isVerbose()) {
			p = 0; ptn = 1; n = next = 0; tobuf = true; x = [];
			if(nV > 1) for(c = X.U8(p++); n < 0x6E59D1 && p < X.Sz(); ) { //see description in .TFM
				if(tobuf && n > 0x327) tobuf = false;
				if(c != 0x80) { b = c; n++; c = X.U8(p++); if(tobuf) x.push(b) }
				else {
					c = X.U8(p++);
					if(nV == 1 && !c) { x.push(0x80); n++; c = X.U8(p++); continue }
					next = true; reps = shl = 0;
					while (next && shl < 57 && p <= X.Sz()) { //read the vari-len int
						next = !(c & 0x80); c &= 0x7F; reps |= Util.shlu64(c,shl); shl += 7; c = X.U8(p++)
					}
					if(!reps) { if(tobuf) x.push(0x80); n++ } //special case for the RLE character
					else { reps--;
						n += reps; shl = 0; if(tobuf) for(i=0; i < reps; i++) x.push(b) }
				}
			} else p = 1;
			p--;
			switch(nV) {
			// case 1: // n/a for now: the compression seems to be kinda quirky, the algo fails
			// 	spd1 = x[0x10]; spd2 = x[0x11]; intlv = x[0x12];
			// 	d1 = x[0x14]+(x[0x15] << 8); d2 = x[0x16]+(x[0x17] << 8); saves = x[0x18]+(x[0x19] << 8);
			// 	ord = x[0x1B]; lp = x[0x1C];
			// 	break;
			case 2:
				spd1 = x[0x10]; spd2 = x[0x11]; intlv = x[0x12];
				d1 = x[0x14]+(x[0x15] << 8); d2 = x[0x16]+(x[0x17] << 8); saves = x[0x18]+(x[0x19] << 8);
				ord = x[0x1B]; lp = x[0x1C];
				break;
			case 3:
				spd1 = x[0x1A]; spd2 = x[0x1B]; intlv = x[0x1C];
				ord = x[0x25]; lp = x[0x26];
				d1 = x[0x1F]+(x[0x20] << 8); d2 = x[0x21]+(x[0x22] << 8); saves = x[0x23]+(x[0x24] << 8);
				break
			}
			if(nV != 1) { //TODO VGE does something different here
				if(ord > 1) for(i=0; i < 255; i++) if((t=x[0x227+i])+1 > ptn) ptn = t+1;
				d1 = '20'+(d1&0x7F).padStart(2,'0')+'-'+(((d1>>7)&0xF)+1).padStart(2,'0')+'-'+(((d1>>11)&0x1F)).padStart(2,'0');
				d2 = '20'+(d2&0x7F).padStart(2,'0')+'-'+(((d2>>7)&0xF)+1).padStart(2,'0')+'-'+(((d2>>11)&0x1F)).padStart(2,'0');
			} else { d1 = d2 = spd1 = spd2 = intlv = saves = '?'; lp = 0 }; //TODO same
			auth = decEncoding(x.slice(0x27,0x67),CP1251); //I've seen CP1251 and CP936 already, but yeah
			title = decEncoding(x.slice(0x67,0xA7),CP1251);
			cmt = decEncoding(x.slice(0xA7,0x227),CP1251);

			sz = n == 0x6E59D1? p : -1; sOptionT(title); sOptionT(auth,'by: '); sOptionT(cmt);
			sOption('on: '+d1+(d1 != d2? ' to '+d2: ''));
			sOption('spd:'+spd1+'/'+spd2+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn
				+' intlv:'+intlv+' saves:'+saves+' sz:'+outSz(sz));
		}
	}

	else if( X.c("'Vgm '") && X.Sz() >= (eof = X.U32(4)+4)
	  && (nV = X.U32(8)) && nV < 0x300 //give'em time tho
	  && ( !X.U32(0x14) || X.c("'Gd3 '",X.U32(0x14)+0x14) )) {
		//ref https://vgmrips.net/wiki/VGM_Specification
		// & https://vgmrips.net/wiki/GD3_Specification
		bDetected = 1; bad = '';
		nV = 1000*(nV>>12)+100*((nV>>8)&0xF)+10*((nV>>4)&0xF)+(nV&0xF); //BCD be like...
		sName = "Video Game Music chiptune stream (.VGM)";
		eoh = X.U32(0x34)+0x34; if(nV < 150 || eoh == 0x34) eoh = 0x40;
		if(nV >= 150 && eoh < 0x40) bad = '!dataofs';
		sVersion = "v"+(nV/100).toFixed(2);
		if(X.isVerbose()) {
			tags = []; //11 of them
			gd3p = X.U32(0x14,_LE)+0x14;
			if(gd3p > 0x14)
			if(X.SA(gd3p,4) === "Gd3 ") {
				sVersion += "/Gd3 v"+(X.readBytes(gd3p+4,4).join("")/100);
				taglen = X.U32(gd3p+8,_LE); gd3p += 12;
				if(gd3p+taglen > X.Sz()) bad = bad.addIfNone('!tagsz');
				i = 0;
				while(i < 11 && gd3p <= X.Sz()) {
					tpos = X.fSig(gd3p,TOEOF,"0000");
					if(tpos >= 0) {
						tags[i] = X.SU16(gd3p,taglen);
						gd3p += tags[i].length*2+2;
					}
					else {
						tags[i] = ""; gd3p += 2
					}
					i++;
				}
				if(i < 11) bad = bad.addIfNone('!tagnum'); else tagn = Math.max(0,i-1);
				sOption(slashTag(tags[0],tags[1])); sOption(slashTag(tags[6],tags[7]),"by: ");
				sOption(slashTag(tags[2],tags[3]),"for: "); sOption(slashTag(tags[4],tags[5]),"on: ");
				sOption(tags[8],"date: "); sOption(tags[9],"ripper: "); sOption(tags[10],"notes: ")
			}
			smp = X.U32(0x18); if(!smp) bad = bad.addIfNone('!badlen');
			lp = X.U32(0x1C)+0x1C; lpsmp = X.U32(0x20);
			if(lp >= eof || lpsmp > smp) {lp = 0; bad = bad.addIfNone('!badloop') }
			rate = X.U32(0x24);
			if(nV > 100) if(!rate) rate = 'n/a'; else
				if(rate == 50) rate += 'Hz(PAL)'; else if(rate == 60) rate += 'Hz(NTSC)'; else rate += 'Hz';
			chips = [[0xC,'SN76489',0], [0x10,'YM2413',0], [0x2C,'YM2612',110], [0x30,'YM2151',110],
				[0x38,'SegaPCM',151], [0x40,'RF5C68',151], [0x44,'YM2203',151], [0x48,'YM2608',151],
				[0x4C,'YM2610/B',151], [0x50,'YM3812',151], [0x54,'YM3526',151], [0x58,'Y8950',151],
				[0x5C,'YMF262',151], [0x60,'YM278B',151], [0x64,'YMF271',151], [0x68,'YMZ280B',151],
				[0x6C,'RF5C164',151], [0x70,'PWM',151], [0x74,'AY8910',151], [0x80,'GameBoyDMG',161],
				[0x84,'NES_APU',161], [0x88,'MultiPCM',161], [0x8C,'uPD7759',161], [0x90,'OKIM6258',161],
				[0x98,'OKIM6295',161], [0x9C,'K051649/K052539',161], [0xA0,'K054539',161],
				[0xA4,'HuC6280',161], [0xA8,'C140',161], [0xAC,'K053260',161], [0xB0,'Pokey',161],
				[0xB4,'QSound',161], [0xB8,'SCSP',171], [0xC0,'WonderSwan',171], [0xC4,'VSU',171],
				[0xC8,'SAA_1099',171], [0xCC,'ES5503',171], [0xD0,'ES5505/ES5506',171],
				[0xD8,'X1-010',171], [0xDC,'C352',171], [0xE0,'GA20',171], [0xE4,'Mikey/Atari_Lynx',172]
			]; chipn = 0;
			xhdr = 0; if(nV >= 170) { t = X.U32(0xBC); if(t) xhdr = t+0xBC; if(xhdr) {
				xhdsz = X.U32(xhdr); if(!xhdsz) { xhdr = 0; bad = bad.addIfNone('!badxhdr') } } }
			for(i=0; i < chips.length; i++) {
				if(chips[i][0] >= eoh || (xhdr && chips[i][0] > xhdr)) break; clk = X.U32(chips[i][0]);
				b30 = Util.shru64(clk,30); b31 = b30 >> 1; b30 &= 1; clk &= 0x3FFFFFFF;
				if(nV < chips[i][2] || !clk) continue; chipn++;
//_log('@'+Hex(chips[i][0])+' b30:'+b30+' b31:'+b31+' clk:'+clk);
				chip = chips[i][1]; //tentatively
				switch(chips[i][0]) { //all the devils in the details
				case 0xC: if(b30 && b31) chip = 'T6W28';
					if(nV <= 151 && !(X.U8(0x2B)&4)) chip += "/GGStereo";
					break;
				case 0x10: if(nV <= 101 && clk > 5000000) chip = 'YM2612'; break;
				case 0x2C:
					if(nV >= 151) if(b31) chip = 'YM3438';
					if(nV <= 101) { clk1 = X.U32(0x10)&0x3FFFFFFF; if(clk1 > 5000000) clk = clk1 }
					break;
				case 0x30:
					if(nV >= 151) if(b31) chip = 'YM2164';
					if(nV <= 101) { clk1 = X.U32(0x10)&0x3FFFFFFF; if(clk1 < 5000000) clk = clk1 }
					break;
				case 0x4C: if(b31) chip = 'YM2610B'; else chip = 'YM2610'; break;
				case 0x74:
					switch(X.U8(0x78)) {
					case 0: break;  case 1: chip = 'AY8912'; break;  case 2: chip = 'AY8913'; break;
					case 3: chip = 'AY8930'; break;  case 4: chip = 'AY8914'; break;
					case 0x10: chip = 'YM2149'; break;  case 0x11: chip = 'YM3439'; break;
					case 0x12: chip = 'YMZ284'; break;  case 0x13: chip = 'YMZ294'; break;
					default: chip += "-ish"
					}
					break;
				case 0x84: if(b31) chip += '/FDS'; break;
				case 0x90: if(X.U8(0x94)&8) chip += '12bit'; else chip += '10bit'; break;
				case 0x9C: if(b31) chip = 'K052539'; else chip = 'K051649'; break;
				case 0xA8:
					switch(X.U8(0x96)) {
					case 0: chip = 'C140+NamcoSystem2'; break; case 1: chip = 'C140+NamcoSystem21'; break;
					case 2: chip = '219_ASIC+NamcoNA-1/2'; break; default: chip += "-ish"
					}
					break;
				case 0xCC: chip += ':'+X.U8(0xD4)+'ch'; break;
				case 0xD0: if(b31) chip = 'ES5506'; else chip = 'ES5505'; chip += ':'+X.U8(0xD5)+'ch'; break;
				}
				sVersion = sVersion.appendS(chip/*+'@'+clk*/,'#');
			}
			volmod = -1; if(eoh > 0x7C) {
				volmod = X.U8(0x7C); if(volmod > 0xC0) volmod -= 0x100; if(volmod == -63) volmod = -64;
				volmod = (2^(volmod/0x20))*100; volmod = Math.round(volmod)+'%' }
			if(chipn > 2) bad = bad.addIfNone('!toomanychips');
			if(eof < X.Sz())
				if(X.SA(eof,4) == "Vgm ") sOption("multisong");
				else sOption("+extra data");
			sOption('rate: '+rate+' len: '+secondsToTimeStr(Util.divu64(smp+22000,44100))+(lp?' looped':'')
				+(volmod !== -1 && volmod !== ' 100%'?' vol: '+volmod:'')+(xhdr?' xhdr':'')
				+' sz:'+outSz(eof))
		}
		if(bad != '') sVersion = sVersion.appendS("malformed"+bad,'/')
	}

	else if(X.Sz() > 0x8C2 && X.c("0033'T1'") && [1,2].includes(X.U8(4)) && X.U8(5) <= 1 && X.U8(6) <= 10
	  && !X.U16(7) && X.U8(9) && X.U8(0xC) <= X.U8(0xB)) {
		//ref http://www.kahlin.net/daniel/victracker/vt-2.0/fileformat.txt
		sName = "Daniel Kahlin's VIC-TRACKER module (.VT)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(0x19E,0x10)); //TODO? https://c64os.com/post/Vic20C64SuperChart
			x = 0; minst = 0xFFF; maxed = 0;
			for(p=0xA; p < 0x42; p+=4) {
				if(!X.U8(p+1)) continue;
				minst = Math.min(minst,X.U8(p)); maxed = Math.max(maxed,X.U8(p+1)); x++
			}
			for(ptn=0,p=0x3C2; p < 0x7C2; p++) ptn = Math.max(X.U8(p),ptn); ptn++;
			if(x > 1) sOption(x,'×');
			sOptionT(X.SA(0x1AE,0x10),"by: "); sOptionT(X.SA(0x1BE,0x10),"'");
			sOption('ptn:'+ptn+' sz:'+outSz(0x8C2+0x40*ptn))
		}
	}

	else if(X.fSig(X.Sz()-0x20,TOEOF,"'VSS0'00") > -1) {
		//TODO thaaat's not a good way to detect a thing...
		sName = "Tomas Partl's Voodoo Supreme Synthesizer audio (.VSS)"; bDetected = 1
	}

	else if(X.c("6000") && X.c("48E7FFFE610000",0x04)
		&& X.c("4CDF7FFF'Nu'",0x0C)) {
		sName = "Wally Beben's module (.WB)"; bDetected = 1
	}

	else if(X.c("'WSRF'",X.Sz()-0x20) && X.c("EA",X.Sz()-0x10)) {
		//ref http://daifukkat.su/docs/wsman/#wsr
		sName = "WonderSwan R programmatic chiptune (.WSR)"; bDetected = 1;
		p = X.Sz()-0x20;
		sVersion = "v"+X.U8(p+4);
		if(X.isVerbose()) {
			sOption(Hex(X.U8(p+0x18)),"CartID:")
			pub = X.U8(p+0x16);
			switch(pub) {
			case 0: sOption("(invalid publisher)"); break;
			case 1: sOption("Bandai"); break;
			case 2: sOption("Taito"); break;
			case 3: sOption("Tomy"); break;
			case 4: sOption("Koei"); break;
			case 5: sOption("Data East"); break;
			case 6: sOption("Asmik Ace"); break;
			case 7: sOption("Media Entertainment"); break;
			case 8: sOption("Nichibutsu"); break;
			case 0x0A: sOption("Coconuts Japan"); break;
			case 0x0B: sOption("Sammy"); break;
			case 0x0C: sOption("Sunsoft"); break;
			case 0x0D: sOption("Mebius"); break;
			case 0x0E: sOption("Banpresto"); break;
			case 0x10: sOption("Jaleco"); break;
			case 0x11: sOption("Imagineer"); break;
			case 0x12: sOption("Konami"); break;
			case 0x16: sOption("Kobunsha"); break;
			case 0x17: sOption("Bottom Up"); break;
			case 0x18: sOption("Kaga Tech"); break;
			case 0x19: sOption("Sunrise"); break;
			case 0x1A: sOption("Cyber Front"); break;
			case 0x1B: sOption("Mega House"); break;
			case 0x1D: sOption("Interbec"); break;
			case 0x1E: sOption("Nihon Application"); break;
			case 0x1F: sOption("Bandai Visual"); break;
			case 0x20: sOption("Athena"); break;
			case 0x21: sOption("KID"); break;
			case 0x22: sOption("HAL Corporation"); break;
			case 0x23: sOption("Yuki Enterprise"); break;
			case 0x24: sOption("Omega Micott"); break;
			case 0x25: sOption("Layup"); break;
			case 0x26: sOption("Kadokawa Shoten"); break;
			case 0x27: sOption("Shall Luck"); break;
			case 0x28: sOption("Squaresoft"); break;
			case 0x2B: sOption("Tom Create"); break;
			case 0x2D: sOption("Namco"); break;
			case 0x2E: sOption("Movic(?)"); break;
			case 0x2F: sOption("E3 Staff(?)"); break;
			case 0x31: sOption("Vanguard"); break;
			case 0x32: sOption("Megatron"); break;
			case 0x33: sOption("Wiz"); break;
			case 0x34: sOption("Capcom"); break;
			default: sOption("(unknown publisher)")
			}
			sOption(X.U8(p+5),"1sttrk: ");
		}
	}
	else if(X.c("3026b2758e66cf11a6d900aa0062ce6c")) { //TODO organise to a non-module file
		sName = "Windows Media (.WMV/WMA)"; bDetected = 1
	}
	else if(X.c("'XAD!'")) {
		sName = "Riven the Mage's Exotic AdLib module (.XAD)"; bDetected = 1;
		if(X.isVerbose()) {
			sOptionT(X.SA(0x04,0x24));
			sOptionT(X.SA(0x28,0x24),"by: ");
		}
	}

	else if(X.c("'Extended Module: '") && X.c("1A",0x25) && isWithin(X.U16(0x48),1,256)) {
		//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_xm.cpp et al.
		V = X.U16(0x3A); charset = 'CP437';
		sName = "Fast Tracker 2 Extended module (.XM)"; bDetected = 1;
		text = tracker = mVlsw = bad = ""; insns = []; smpns = [];
		hdrp = 0x3C; hdrsz = X.U32(hdrp); restartp = X.U16(hdrp+6); flags = X.U16(hdrp+0x0E);
		linearSlides = flags & 1; xFilter = flags & 0x1000;
		ord = X.U16(hdrp+4); chn = X.U16(hdrp+8); ptn = X.U16(hdrp+0x0A); ins = X.U16(hdrp+0x0C);
		tmp0 = X.U16(hdrp+0x10); bpm0 = X.U16(hdrp+0x12);
		var ptnhdp = p = hdrp+hdrsz;
	   if(V >= 0x104) for(i=0; i < ptn; i++) p += X.U32(p)+X.U16(p+7);
		const verUnknown = 0, verOldModPlug = 1, verNewModPlug = 2, verMPfBiDi = 4, verOpenMPT = 8,
		verConfirmed = 0x10, verFT2Generic = 0x20, verOther = 0x40, verFT2Clone = 0x80,
		verPlayerPRO = 0x100, verDigiTrakker = 0x200, verUNMO3 = 0x400, verEmptyOrders = 0x800;
		var isMadTracker = isOMPTMade = isOXM = mixlevCompatFT2 = false;
		madewith = verUnknown;
		if(X.c("'FastTracker v2.00   '",0x26) && hdrsz === 276) { //version detection pt.1/9001
			if(V < 0x104) madewith = verFT2Generic | verConfirmed;
			else if((t=X.fSig(0x11,0x14,"00")) >= 0) { //song title space or zero padded?
				if(restartp)
					madewith = verFT2Clone | verNewModPlug | verEmptyOrders;
				else if(t == 0x24) // just the last character's zero
					madewith = verFT2Clone | verNewModPlug | verPlayerPRO | verEmptyOrders;
				else if(firstNotOf(t+1,0x24-t,0x20) < 0) // space-padded ascii-z?!
					madewith = verPlayerPRO | verConfirmed;
				else
					madewith = verFT2Clone | verNewModPlug | verEmptyOrders;
			}
			else if(restartp) madewith = verFT2Generic | verNewModPlug;
			else madewith = verFT2Generic | verNewModPlug | verPlayerPRO;
		}
		else if(X.c("'FastTracker v 2.00  '",0x26)) madewith = verOldModPlug;
		else {
			madewith = verUnknown | verConfirmed;
			tracker = X.SC(0x26,0x14,charset).trim();
			if(X.c("'OpenMPT '",0x26)) madewith = verOpenMPT | verConfirmed | verEmptyOrders;
			else if(X.c("'MilkyTracker '",0x26)) { if(!X.c("'       '",0x32)) mixlevCompatFT2 = true }
			else if(X.c("'Fasttracker II clone'",0x26)) madewith = verFT2Generic | verConfirmed;
			else if(X.c("'MadTracker 2.0'00",0x26)) {
				isMadTracker = true; if(X.c("00000000",0x35)) tracker = 'MadTracker 2';
				else tracker = 'MadTracker 2 (registered)'
			}
			else if(X.c("'*Converted '",0x26) && X.c("'-File*'",0x34)) {
				madewith = verDigiTrakker | verConfirmed; tracker = 'Digitrakker' }
		}
		if(xFilter && (madewith & verNewModPlug))
			madewith = verFT2Clone | verNewModPlug | verConfirmed | verEmptyOrders;
		//back on track
		smp = smpReserved = 0; insp = p; anyADPCM = anyInsSmp = false; sflags = [];
			smpsz = lastsmphdsz = lastinstp = lastsmpreserved = -1;
		if(!ord && !verEmptyOrders) ord = 1; //a fix for dark lighthouse.xm
		for(i=0; i < ins; i++) {
			if(p+4 > X.Sz()) { bad = bad.addIfNone('!short'); break }
			ihdsz = X.U32(p); if(!ihdsz) ihdsz = 263; instp = X.U8(p+0x1A);
			inst = X.SC(p+4,0x16,'CP437').trim(); if(inst.length) insns.push(inst);
			smpn = X.U16(p+0x1B); smphdsz = X.U32(p+0x1D);
			if(madewith == verOldModPlug) { madewith |= verConfirmed;
				if(ihdsz == 245) { mVlsw = "1.00.00.A5"; tracker = "ModPlug Tracker 1.0 alpha" }
				else if(ihdsz == 263) { mVlsw = "1.00.00.B3"; tracker = "ModPlug Tracker 1.0 beta" }
				else madewith = verUnknown | verConfirmed;
			} else if(!smpn) {
				if(ihdsz == 263 && !smphdsz && (madewith & verNewModPlug)) madewith |= verConfirmed;
				else if(ihdsz != 29 && (madewith & verDigiTrakker)) madewith &= ~verDigiTrakker;
				else if((madewith & (verFT2Clone|verFT2Generic)) && ihdsz != 33) madewith = verUnknown;
				if(ihdsz != 33) madewith &= ~verPlayerPRO;
				else if(smphdsz > 40 && (madewith & verPlayerPRO)) {
					if(anyInsSmp || (lastsmphdsz != -1 && smphdsz != lastsmphdsz))
						madewith = verPlayerPRO | verConfirmed;
					lastsmphdsz = smphdsz
				}
			}
			if(lastinstp == -1) lastinstp = instp;
			else if(lastinstp != instp && (madewith & verFT2Generic)) {
				madewith &= ~verFT2Generic; madewith |= verFT2Clone;
			}
			vls = X.U8(p+40+0xC3); vle = X.U8(p+40+0xC4); vef = X.U8(p+40+0xC8);
			pls = X.U8(p+40+0xC6); ple = X.U8(p+40+0xC7); pef = X.U8(p+40+0xC9);
			midichecks = X.U8(p+40+0xD0) | X.U8(p+40+0xD1) | X.U16(p+40+0xD2) | X.U8(p+40+0xD6);
			p += ihdsz; smp += smpn;
			if(p > X.Sz()) { bad = bad.addIfNone("!short"); break }
			if(V >= 0x104) sflags = [];
			var ssizes = [], slens = 0;
			if(smpn) {
				anyInsSmp = true;
				if(midichecks) madewith &= ~(verOldModPlug | verNewModPlug | verPlayerPRO);
				if(ihdsz != 0x107 || instp) madewith &= ~verPlayerPRO;
				if(!(madewith & verConfirmed) && (madewith & verPlayerPRO))
					if(!(vef & 4) && vls == 0xFF && vle == 0xFF
					  || !(pef & 4) && pls == 0xFF && ple == 0xFF) {
					  	madewith &= ~verNewModPlug; madewith |= verConfirmed
					}
				for(j=0; j < smpn; j++) {
					slen = ssizes[j] = X.U32(p); //lpst @ p+4, lpsz @ p+8, vol0 @ p+0xC, relnote @ p+0x10
					var sft = X.I8(p+0xD), sf = X.U8(p+0xE), sp = X.U8(p+0x0F), sr = X.U8(p+0x11),
					  sname = X.SC(p+0x12,22,'CP437'), snt = sname.trim(); smpReserved |= sr;
					smpns.push(snt);
					isADPCM = (sr === 0xAD) && !(sf&0x30); //flags sample16bit=10h and sampleStereo=20h
					if(sr && sr != 0xAD) madewith &= ~(verOldModPlug | verNewModPlug | verOpenMPT);
					if(lastsmpreserved == -1) lastsmpreserved = sr;
					else if(lastsmpreserved != sr) madewith &= ~verPlayerPRO;
					if(sp != 128) madewith &= ~verPlayerPRO;
					if((sft&0xF) && sft != 127) madewith &= ~verPlayerPRO;
					sflags.push([sf, isADPCM]); if(isADPCM) anyADPCM = true;
					slens += isADPCM ? 16+(slen+1 >> 1) : slen;
					p += 40; //not smphdsz; considering there are files with smphdsz = 0...
					if((madewith & (verFT2Generic | verFT2Clone)) && (madewith & (verNewModPlug | verPlayerPRO))
					  && !(madewith & verConfirmed) && (sr > 22 || sname.slice(sr).indexOf(' ') < 0)) {
						madewith &= ~verFT2Generic; madewith |= verFT2Clone | verConfirmed
					}
					if((sf&3) === 3 && (madewith & verNewModPlug)) madewith |= verMPfBiDi;
				} //read the instrument's samples info
				smpsz += slens;
				if(V >= 0x104) { if(X.c("'OggS'",p)) isOXM = true; p += slens }
			} //if smpn
		} //for i in ins
		if(!smpReserved && (madewith & verNewModPlug) && X.fSig(0x11,0x14,"00") > -1)
			madewith |= verConfirmed;
		if(V < 0x104) {
			for(i=0; i < ptn; i++)
				p += X.U32(p)+X.U16(p+(V == 0x102 ? 6 : 7));
			if(X.c("'OggS'",p)) isOXM = true;
			p += smpsz
		}
		basesz = p;
		if(tracker == "") {
			if((madewith&verDigiTrakker) && !smpReserved && (lastinstp ? lastinstp : -1) == -1)
				tracker = "Digitrakker";
			else if(madewith&verFT2Generic)
				tracker = "FastTracker 2 or compatible";
			else tracker = "Unknown"
		}
		//catch plugins, settings, messages from various XM flavours
		fx = 0; xt = "";
		while(p+6 < X.Sz()) {
			t = X.SA(p,4); it = X.U32(p);
			if(it && X.U16(p+4)
			  && (t === "228\x04" || (it & 0x80808080) || !(it & 0x60606060))) {
				//I haven't seen files with that to see how that goes so we'll just cut here!
				break
			}
			if(t === "text") {
				t = X.U32(p+4); p += 8; xt = xt.append("t");
				text = X.SC(p,t,'CP437').trim(); p += t;
				madewith &= ~verPlayerPRO; madewith |= verConfirmed
			} else if(/F[0-9X]\d\d/.test(t)) {
				t = X.U32(p+4); if(p+8+t <= X.Sz()) { p += 8+t; fx++ }
				madewith |= verConfirmed
			} else if(t === "MIDI") {
				t = X.U32(p+4); madewith &= ~verPlayerPRO; madewith |= verConfirmed;
				if(p+8+t <= X.Sz()) { p += 8+t; xt = xt.append("m") }
			} else if(t === "CHFX" || t === "CNAM" || t === "PNAM") {
				t = X.U32(p+4); if(p+8+t <= X.Sz()) p += 8+t;
				madewith &= ~verPlayerPRO; madewith |= verConfirmed
			} else if(t === "XTPM") {
				p += 4; xt = xt.append("x");
				madewith &= ~verPlayerPRO; madewith |= verConfirmed; isOMPTMade = true;
				t = X.SA(p,4);
				while(p+7 < X.Sz()) {
					if(!X.U8(p)) { p++; break }
					code = X.SA(p,4); icode = X.U32(p);
					if(code === "STPM" || code === "228\x04"
					  || (icode & 0x80808080) || !(icode & 0x60606060))
						break;
					prsz = X.U16(p+4); p += 6;
					for(i=0; i < ins; i++) p += prsz }
			} else if(t === "STPM") {
				p += 4; xt = xt.append("s"); madewith &= ~verPlayerPRO; madewith |= verConfirmed;
				while(p+6 < X.Sz()) {
					if(!X.U8(p)) { p++; break }
					if(X.c("'VWSL'",p)) { v = 0;
						function itV(v) { return v.slice(0,1)+'.'+v.slice(1,3)+'.'+v.slice(3,5)+'.'+v.slice(5,7) }
						switch(X.U16(p+4)) {
						case 1: v = X.U8(p+6); break; case 2: v = X.U16(p+6); break;
						case 3: v = X.U24(p+6); break; case 8: v = X.U64(p+6); break;
						default: v = X.U32(p+6) }
						if(v) mVlsw = itV(v.toString(16).toUpperCase().padStart(7,'0')); break;
					}
					p += 6+X.U16(p+4)
				}
			} else break;
		}
		if(madewith & verConfirmed)
			if(madewith & verMPfBiDi) {
				mVlsw = "1.11"; tracker = "ModPlug Tracker 1.0-11";
			} else if((madewith & verNewModPlug) && !(madewith & verPlayerPRO)) {
				mVlsw = "1.16"; tracker = "ModPlug Tracker 1.0-16";
			} else if((madewith & verNewModPlug) && (madewith & verPlayerPRO)) {
				mVlsw = "1.16"; tracker = "ModPlug Tracker 1.0-16 / PlayerPRO";
			} else if(!(madewith & verNewModPlug) && (madewith & verPlayerPRO))
				tracker = "PlayerPRO";
		if(X.c("'OpenMPT '",0x26)) {
			mVlsw = X.SA(0x2E,12).trim(); madewith = verOpenMPT|verConfirmed;
		}
		if(isOMPTMade && mVlsw < "1.17") mVlsw = "1.17";
		if(mVlsw >= "1.17") tracker = "OpenMPT v"+mVlsw;
		sz = p;
		charset = (mVlsw != "" || isMadTracker) ? 'CP1252' : 'CP437';
		if(X.isVerbose()) {
			sOptionT(X.SC(0x11,0x14,charset));
			sOptionT(tracker,"in:");
			if(isOXM) sOption("OggMod FastTracker 2 (.OXM)","via:");
			if(text.length) sOption(addEllipsis(text,0x100));
			if(insns.length) sOption(addEllipsis(insns.filter(funSampleName).join(' '),0x100),'ins/msg:"','"');
			if(smpns.length) sOption(addEllipsis(smpns.filter(funSampleName).join(' '),0x100),'smp/msg:"','"')
			var info = 'chn:'+chn+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp:'+smp;
			if(fx) info += ' fx:'+fx; if(xt.length) info += ' xt:'+xt;
			if(sz != basesz) info += " base_sz:"+basesz; info += " sz:"+outSz(sz); sOption(info)
		}
		sVersion = "v"+(V>>8)+"."+(V&0xFF)+bad+(anyADPCM?"/ADPCMpacked":"");
	}

	else if(X.c("'FORM' 0000000E 'XDIRINFO'  00000002 .... 'CAT ' ........ 'XMIDFORM' ........ 'XMID'")) {
		bDetected = 1;
		sName = "Extended MIDI chiptune (.XMI,.C55,.PCS)";
		if(X.isVerbose()) {
			if((x=X.U8(0x14)) > 1) sOption(x,'×')
			sOption(outSz(0x1E+X.U32(0x1A,_BE)),'sz:')
		}
	}

	else if(X.c("'ofTAZ!'")) {
		sName = "Davey W. Taylor's Extra Simple Music module (.XSM)"; bDetected = 1
	}
	else if(/YM\d!/.test(X.SA(0,4)) || X.c("'YM3b!'")
		  || /YMT\dLeOnArD!/.test(X.SA(0,0xC)) || X.c("'MIX1LeOnArD!'")) {
		//ref https://github.com/cpcsdk/libstsound/blob/master/Ymload.cpp
		bDetected = 1; bad = ''; frm = smp = voc = loop = ddn = 0;
		sName = "ST-Sound chiptune stream (.YM)";
		sV = X.SA(0,4).replace(/!/g,"");
		switch(sV) {
		case "YM1": sVersion = "YM1"; break;
		case "YM2": sVersion = "MADMAX specific"; break;
		case "YM3": sVersion = "YM-Atari"; break;
		case "YM3b": sVersion = "YM-Atari+loopinfo";
			loop = X.U32(X.Sz()-4,_LE); break;
		case "YM4": sVersion = "YM-Atari extended"; break;
		case "YM5": case "YM6": sVersion = "Generic YM2149 extended"; break;
		case "MIX1": sVersion = "Atari Remix digital"; break;
		case "YMT1": case "YMT2": sVersion = "YM-Tracker"; break;
		}
		if(["YM2","YM3","YM3b"/*,"YM4"*/].indexOf(sV) >= 0) //No YM4 in the wilderness, ignoring
			frm = Util.divu64(X.Sz()-4,14);
		if(["YM5","YM6","YMT1","YMT2","MIX1"].indexOf(sV) >= 0) {
			if(X.SA(4,8)!="LeOnArD!") bad = bad.addIfNone('!badsig');
			if((["YM6!","YMT1","YMT2"].indexOf(sV) >=0)
				&& (X.SA(X.Sz()-4)!="End!")) bad = bad.addIfNone('!badfilesz');
			//if(sV==="YM4") p=0x1C; else
			if(["YM5","YM6"].indexOf(sV) >= 0) {
				ddn = X.U16(0x14,_BE);
				loop = X.U32(0x1C,_BE);
				p = X.U16(0x20,_BE)+0x22;
				for(i=0; i < ddn; i++) {
					ds = X.U16(p,_BE); p += 2+ds; if(p >= X.Sz()) {bad = bad.addIfNone('!tooshort'); break}
				}
			} else
			if(sV === "MIX1") {
				p = 0x18;
				smp = X.U32(0x10,_BE);
				mixblk = X.U32(0x14,_BE);
				for(i=0;i<mixblk;i++) p+=12; //u32 smpst,smplen; u16 repeat,rplfreq skipped
			} else
			if(["YMT1","YMT2"].indexOf(sV) >= 0) {
				ddn = X.U16(0x18,_BE);
				voc = X.U16(0x0D,_BE);
				frm = X.U32(0x10,_BE);
				p = 0x1E;
			}
			//read the three tags from here
			if(p>=X.Sz()) bad = bad.addIfNone('!nodata');
			else {
				t = p; t_ = X.fSig(p,TOEOF,"00")-p;
				if(t_ >= 0) {
					p += t_+1; a = p; a_ = X.fSig(p,TOEOF,"00")-p;
					p += a_+1; c = p; c_ = X.fSig(p,TOEOF,"00")-p;
					p += c_+1;
					if(["YM5","YM6"].indexOf(sV) >= 0)	
						if(!X.c("'End!'",p+((frm = X.U32(0xC,_BE)) << 4))) {
							bad = bad.addIfNone('!badframes'); sOption("frm/frames: "+(frm<<4)+"/"+(X.Sz()-p-4)) }
				}
			}
			if(X.isVerbose()) {
				sOptionT(X.SA(t,t_));
				sOptionT(X.SA(a,a_),"by: ");
				sOptionT(X.SA(c,c_));
			}
		}
		if(X.isVerbose()) {
			if(voc) sOption(voc,"voc:");
			if(smp) sOption(outSz(p+smp),'sz:');
			if(ddn) sOption(ddn, "digidrums:")
			if(frm) sOption('len:'+frm+' sz:'+outSz(p+(frm<<4)+4));
		}
		if(bad != '') sVersion= sVersion.appendS('malformed'+bad,'/')
	}
	else if(X.c("'YMST'")) {
		sName = "Nicolas 'Mr.Styckx' Pomarede's MYST ST-YM module (.YMST,.YM)"; bDetected = 1;
		if(X.isVerbose()) {
			for(i=0,p=4; i < 48; i++) { p += 8; if(!X.U16(p-8,_BE)) break }
			t = p; t_ = X.fSig(p,TOEOF,"00")-p;
			if(t_ >= 0) {
				p += t_+1; a = p; a_ = X.fSig(p,TOEOF,"00")-p;
				p += a_+1; c = p; c_ = X.fSig(p,TOEOF,"00")-p;
				if(X.isVerbose()) {
					sOptionT(X.SA(t,t_));
					sOptionT(X.SA(a,a_),"by: ");
					sOptionT(X.SA(c,c_));
				}
			}
		}
	}

// pure signature detection end


// AND NOW,
// THE HEAVIEST STUFF GOES DOWN HERE
// THE SANITY CHECK-STYLE DETECTION
// (* It's still hella fast tho, no worries)

function isAYAmadeus() {
	//the underlying format is the same as FXM
	//ref https://vgmrips.net/wiki/AY_File_Format
	if(!X.c("'ZXAYAMAD'") || X.U8(9) > 3) return false;
	authp = 0x0C+X.I16(0x0C,_BE); if(authp < X.Sz()) auth = authp?X.SA(authp,0x100):''; else return false;
	miscp = 0x0E+X.I16(0x0E,_BE); if(miscp < X.Sz()) misc = miscp?X.SA(miscp,0x100):''; else return false;
	x = X.U8(0x10)+1; p = 0x12+X.I16(0x12,_BE); if(p > X.Sz()) return false;
	titles = []; for(i=0; i < x; i++,p+=4) if(t = p+X.I16(p,_BE))
		if(t < X.Sz()) titles.push(X.SA(t,0x100).trim()); else return false;
	return true
}
if(!bDetected && isAYAmadeus()) {
	sName = "František Fuka/Fuxoft's AY Amadeus module (.AMAD)";
	sVersion = [X.U8(8)?'Rel '+X.U8(8):'', X.U8(9)?'Plr '+X.U8(9):''].join(' ').trim();
 	if(X.isVerbose()) {
		sOptionT(titles.join(',')); if(x > 1) sOption(x,'×');
		if(authp) sOptionT(auth,'by: '); if(miscp) sOptionT(misc);
	}
}


function isAYEmul() {
	// ref https://vgmrips.net/wiki/AY_File_Format
	if(!X.c("'ZXAYEMUL'") || X.U8(9) > 3) return false;
	authp = 0x0C+X.I16(0x0C,_BE);
	if(authp < X.Sz()) auth = authp?X.SC(authp,0x100,'CP1250'):''; else return false;
	miscp = 0x0E+X.I16(0x0E,_BE);
	if(miscp < X.Sz()) misc = miscp?X.SC(miscp,0x100,'CP1250'):''; else return false;
	x = X.U8(0x10)+1; p = 0x12+X.I16(0x12,_BE); if(p > X.Sz()) return false;
	titles = []; for(i=0; i < x; i++,p+=4) if(t = p+X.I16(p,_BE))
		if(t < X.Sz()) titles.push(X.SC(t,0x100,'CP1250').trim()); else return false;
	return true
}
if(!bDetected && isAYEmul()) {
	sName = "Sergej Bulba's AY Emul chiptune (.EMUL)"; bDetected = 1;
	sVersion = [X.U8(8)?'Rel '+X.U8(8):'', X.U8(9)?'Plr '+X.U8(9):''].join(' ').trim();
 	if(X.isVerbose()) {
		sOptionT(titles.join(',')); if(x > 1) sOption(x,'×');
		if(authp) sOptionT(auth,'by: '); if(miscp) sOptionT(misc);
	}
}


function isBobsAdlib() {
	if(!X.c("'CBMF'")) return false;
	//ref https://github.com/adplug/adplug/blob/master/src/bam.cpp
	// & https://rpg.hamsterrepublic.com/ohrrpgce/BAM_Format
	p = 4; notes = ins = 0; var songend = false, m = Math.min(X.Sz(), 0x10000), v = [];
	for(i=0; i < 16; i++) v[i] = false;
	while(!songend && p < m) {
		while(!songend && (b=X.U8(p++)) < 0x80 && p < m)
			if(isWithin(b, 1,0xF) || isWithin(b, 0x40,0x4F) || isWithin(b, 0x71,0x7E)) return false; //per draft 3
			else switch(b>>4) {
			case 0: if(!X.isHeuristicScan()) songend = true; break; //this isn't guaranteed!
			case 1: if(!v[b-0x10]) return false; p++; notes++; break; //start note
			case 2: break; //stop note
			case 3: v[b-0x30] = true; p += 11; break; //define ins
			case 5: break; //set label
			case 6: p++; break; //jump
			case 7: //end of chorus
			default: break;
			}
		//if b >= 0x80 it's a pause
	}
	if(!X.isHeuristicScan()) {
		if((!songend && m < X.Sz()) || notes < 0x10) return false; //we'll ignore the "zero at the start" stupid files unless you really want them, but then the detection becomes much worse
		for(i=0; i < 16; i++) if(v[i]) ins++;  if(!ins) return false; //
	}
	return true
}
if(!bDetected && isBobsAdlib()) {
	sName = "Bob's Adlib Music module (.BAM)"; bDetected = 1
	sOption('ch:'+ins+' notes:'+notes+' sz:'+outSz(p))
}


function isCMF() {
	if(!X.c("'CTMF'")) return false;
	if(!isWithin(X.U16(4),0x100,0x101) || !isWithin(X.U16(8),0x25,X.Sz()-1)) return false;
	//ref https://github.com/adplug/adplug/blob/master/src/cmf.cpp
	// & https://moddingwiki.shikadi.net/wiki/CMF_Format
	nV = X.U16(4,_LE); ic = 0 /*invalid values for heuristics*/; bad = '';
	pins = X.U16(6,_LE); pmus = X.U16(8,_LE); //instruments, music ptr
	if(pmus <= pins) {ic++; bad = bad.addIfNone('!badptr') }
	if(nV >= 0x101) { p = 0x28; ins = X.U16(0x24) } else { p = 0x25; ins = X.U8(0x24) }
	if((t=Util.divu64(pmus-pins,0x10)) != ins) { ic++; bad = bad.addIfNone('!inconsistentinscnt'+t) }
	tp = X.U16(0x0E,_LE); if(tp && !isWithin(tp,p,pins-1)) { tp = 0; ic++; bad = bad.addIfNone('!badptr') }
	ap = X.U16(0x10,_LE); if(ap && !isWithin(ap,p,pins-1)) { ap = 0; ic++; bad = bad.addIfNone('!badptr') }
	cp = X.U16(0x12,_LE); if(cp && !isWithin(cp,p,pins-1)) { cp = 0; ic++; bad = bad.addIfNone('!badptr') }
	ch = 0; for(i=0x14; i < 0x24; i++) { if((t=X.U8(i)) == 1) ch++; else if(t > 1) ic++} if(!ch) ic++;
	sz = X.fSig(pmus,Math.min(0x10000,X.Sz()),"FF2F00");
	if(sz < 0) { sz = X.fSig(pmus,Math.min(0x10000,X.Sz()),"FF2FFE"); bad = bad.addIfNone('!badeof')}
	if(sz > 0) sz += 3;
	return ic < 5
}
if(!bDetected && isCMF()) {
	sName = "Creative Labs' Creative Music Format chiptune (.CMF)"; bDetected = 1;
	sVersion = "v"+(nV>>8)+"."+(nV&0xFF);
	if(bad != '') sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		if(tp) sOptionT(addEllipsis(X.SC(tp,0x100,'CP437')));
		if(ap) sOptionT(addEllipsis(X.SC(ap,0x100,'CP437')),"by: ");
		if(cp) sOptionT(addEllipsis(X.SC(cp,0x100,'CP437')));
		if(nV >= 0x101 && X.U8(sz) == 0xFF) sz++; //a lot of v1.1 CMFs end in FF, enough to be significant?
		sOption('ch:'+ch+' ins:'+ins+' sz:'+outSz(sz))
	}
}


function isDSym() {
	//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_dsym.cpp
	// & https://sourceforge.net/p/xmp/libxmp/ci/master/tree/src/loaders/sym_load.c
	if(X.Sz() < 90 || !X.c("02011313 1412010B") || X.U8(8) > 1 || !isWithin(ch=X.U8(9), 1,8)
	  || (ord=X.U16(0xA)) > 4096 || (ptn=X.U16(0xC)) > 4096) return;
	var infolen = X.U24(0x0E), smpsz = [], smpnsz = [];
	smp = 0; p = 0x11;
	for(i=0; i < 63; i++,p++) {
		smpnsz[i] = X.U8(p); if(!(X.U8(p) & 0x80)) { smp++; smpsz[i] = X.U24(p+1); p += 3 } }
	title = X.UCSD(p); p += 1+X.U8(p);
	var ac = X.readBytes(p,8); p += 8; if(p > X.Sz()) return;
	//TODO? lzw unpacking and whatnot
	return true
}
if(!bDetected && isDSym()) {
	sName = "Oregan Developments' Digital Symphony module (.DSYM)"; sVersion = 'v'+X.U8(8); bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(title); sOption('ch:'+ch+' ord:'+ord+' ptn:'+ptn+' smp:'+smp);
	}
}


function isDigitalFM() {
	//ref https://verhaagr.home.xs4all.nl/dfm.zip / dfm.pas
	if(!X.c("'DFM'1A") || X.U8(4) > 1 || [0,1,0x63].indexOf(X.U8(5)) < 0 || X.U8(6) > 0x20
	  || !isWithin(tmp0=X.U8(0x27), 5,0x1F)) return;
	inss = [];
	for(i=0,p=0x28; i < 32; i++,p+=12) if(X.U8(p) > 11) return; else inss.push(X.UCSD(p));  p += 0x160;
	for(ord=ptn=i=0; i < 128 && X.U8(p+i) != 0x80; i++,ord++) ptn = Math.max(ptn,X.U8(p+i)+1);
	for(i++; i < 128; i++) if(X.U8(p+i)) return;
	p += 0x80; optn = X.U8(p++);
	//from here the original code ignores the pattern count and just keeps reading patterns until EoF!
	for(rptn=next=0; rptn < optn && p < X.Sz(); rptn = next+1) {
		next=X.U8(p++); for(i=0; i < 64*9; i++) if(X.U8(p++) & 0x80) p++
	}
	return true
}
if(!bDetected && isDigitalFM()) {
	sName = "Rene Verhaag's Digital-FM module (.DFM)";
	sVersion = 'v'+X.U8(4)+'.'+X.U8(5).padStart(2,'0'); bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SC(7,32,'CP1252'));
		sOptionT(addEllipsis(inss.filter(funSampleName).join(' ')),'ins/msg:"','"');
		sOption('ch:'+X.U8(6)+' tmp0:'+tmp0+' ord:'+ord
			+' ptn:'+(ptn!=optn?ptn+'/':'')+(rptn!=optn?rptn+'/':'')+optn+' sz:'+outSz(p));
	}
}


function isDRO() {
	//ref https://github.com/ValleyBell/libvgm/blob/master/player/droplayer.cpp
	if(!X.c("'DBRAWOPL'")) return;
	if((t = X.U32(8)) & 0xFF00FF00) { sVersion = 'v0'; mV = MV = 0 }
	else if(!(t & 0x0000FFFF)) { mV = X.U16(8); MV = X.U16(0xA) }
	else { MV = X.U16(8); mV = X.U16(0xA) }
	if(MV > 3) return;
	//we only know about v2 but it may happen one day
	if(MV) sVersion = 'v'+MV+'.'+mV.padStart(2,'0'); db = '';
	switch(MV) {
	case 0:
		db = 'DOSBox 0.62'; lenMS = X.U32(8); dtsz = X.U32(0xC);
		hw = X.U8(0x10); dtofs = 0x11; //fallthrough
	case 1:
		if(MV == 1) {
			db = 'DOSBox 0.63'; lenMS = X.U32(0xC); dtsz = X.U32(0x10);
			hw = (t=X.U32(0x14)) <= 0xFF ? t : 0xFF; dtofs = 0x18;
		}
		if(hw == 1) hw = 2; else if(hw == 2) hw = 1;
		fmt = 0; co = 0; break;
	case 2:
		db = 'DOSBox 0.73'; dtsz = X.U32(0xC) << 1; lenMS = X.U32(0x10); hw = X.U8(0x14);
		fmt = X.U8(0x15); co = X.U8(0x16); ds = X.U8(0x17); dl = X.U8(0x18); regcmdcnt = X.U8(0x19);
		dtofs = 0x1A+regcmdcnt; if(regcmdcnt > 0x80) regcmdcnt = 0x80; regmap = X.readBytes(0x1A,regcmdcnt);
		//scan init block
		if(hw == 1) {
			p = dtofs; opl3on = 0; reginit = []; for(i=0; i < 0x200; i++) reginit[i] = false;
			while(p < X.Sz()) {
				t = X.U8(p); if(t == ds || t == dl) break; if((t & 0x7F) >= regcmdcnt) break;
				creg = ((t & 0x80) << 1) | regmap[t & 0x7F]; reginit[creg] = true; if(creg == 0x105) opl3en = X.U8(p+1);
				p += 2
			}
			if(reginit[0x105] && (opl3en & 1)) hw = 2;
		}
		hw = ['YM3812 (OPL2)', 'YM3812 (Dual OPL2)', 'YMF262 (OPL3)'].indexOf(hw);
		if(hw === -1) hw = 'YMF262(portshift)';
	}
	return true
}
if(!bDetected && isDRO()) {
	sName = "DOSBox Raw OPL chiptune (.DRO)";
	sVersion = sVersion.appendS(hw,'#'); bDetected = 1;
		if(X.isVerbose()) {
			sOption('len: '+secondsToTimeStr(Util.divu64(lenMS+500,1000))+' via: '+db+' packed:'+co
				+' sz:'+outSz(dtofs+dtsz))
		}

}


function isFunktracker() {
	if(X.Sz() < 0x8FF || !X.c("'Funk'")) return false;
	//ref https://sourceforge.net/p/xmp/libxmp/ci/master/tree/docs/formats/FORMAT.FunktrackerGOLD
	sz = X.U32(8); if(!isWithin(sz,0x8FF,0x100000)) return false;
	t = X.U32(4); sV = X.SA(0x0C,4); bad = ''; sus = 0;
	if(/F2\d\d/.test(sV))
		sversion = "R2 GOLD "+(1980+((t>>9)&0x7F))+"-"
		  +((t>>5)&0xF).padStart(2,'0')+"-"+(t&0x1F).padStart(2,'0')+" ";
	else sversion = "R1";
	if(/F[2vk]\d\d/.test(sV)) ch = X.SA(0x0E,2);
	else { sversion += "b"; ch = 8; sus++ }
	switch((t>>20)&0xF) {
	case 1: case 2: t = "IBM"; break; case 3: t = "Intel 386"; break;
	case 4: t = "Intel 486"; break; case 5: t = "Pentium"; break; case 6: t = "Linux"; break;
	case 7: t = "FreeBSD"; break; case 8: t = "N/A"; break; default: t = "unk.system" }
	sversion += "#"+t;
	switch((t>>16)&0xF) {
	case 0: t = "SB 2.0"; break; case 1: t = "SB Pro"; break;
	case 2: t = "GUS+ch.pan"; break; case 3: t = "SB compatible"; break;
	case 4: t = "SB 16"; break; case 5: t = "GUS"; break; case 6: t = "conversion"; break;
	case 7: t = "Pro Audio Spectrum"; break; case 8: t = "Voxware /dev/dsp 8 bit"; break;
	case 9: t = "Voxware /dev/dsp 16 bit"; break; case 15: t = "unk.soundcard"; break;
	default: t = "soundcard N/A" }
	sversion += ":"+t;
	if(!X.isVerbose() && X.Sz() < sz) bad = bad.addIfNone('!short');
	ord = 0; ptn = -1; for(i = 0; i < 256; i++) {
		t = X.U8(0x11+i); if(t == 0xFF) break; ord++;
		if(t > 0x79)
			if(X.isHeuristicScan()) { bad = bad.addIfNone("!badord") }
			else return false;
		else if(t > ptn) ptn = t;
	} ptn++;
	lp = X.U8(0x10); if(lp != 0xFF && lp > ord) bad += "!badloop";
	smp = sus = 0; smps = [];
	for(i = 0x190; i < 0x8BF; i += 0x20) {
		if(!isWithin(X.U8(i),1,0x4F)) return false; //vol		
		if(X.U32(i+0x18)) smp++; //length
		if(charStat(X.readBytes(i+1,0x13),1).indexOf('allasc') < 0) sus++; if(sus > 3) return false
		smps.push(X.SC(i+1,0x13,'CP437').trim()) //smp name; charset TBD
	}
	return true
}
if(!bDetected && isFunktracker()) {
	sName = "Jason Nunn's Funktracker module (.FNK,.Funk)"; sVersion = sversion; bDetected = 1;
	if(bad != "") sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		bpm = X.U8(4); bits = bpm&1 ? 16 : 8; bpm >>= 1; var sine = bpm >> 6;
		bpm &= (1<<6)-1; if(sine) bpm = 125-bpm; else bpm = 125+bpm;
		sOptionT(addEllipsis(smps.filter(funSampleName).join(' ')),'smp/msg:"','"');
		sOption('ch:'+ch+' bpm0:'+bpm+' ord:'+(lp!=0xFF?lp+'~':'')+ord+' ptn:'+ptn
			+' smp:'+smp+' ' +bits+'bit sz:'+outSz(sz))
	}
}


function isPreTracker() {
	  	//ref https://git.platon42.de/chrisly42/PretrackerRaspberryCasket/src/branch/main/src/raspberry_casket.asm lines 257+
	if(!X.c("'PRT'") || !isWithin(ins=X.U8(0x40), 1,0x40)) return;
	if(!isWithin(nV=X.U8(3), 10,50)) return;
	if(nV < 30) if(!(ptn=[X.U8(0x3D)])[0] || !(ord=[X.U8(0x3E)])[0] || (lp=[X.U8(0x3C)])[0] > ord[0]) return;
	x = 1; p = 0x5A; ptnp = [];
	if(nV >= 30) x = X.U8(p++); if(!x) return;
	if(nV >= 30) { ord = []; lp = []; ptn = []; }
	var steps = [];
	for(i=0; i < x; i++) {
		lp.push(X.U8(p++)); ptn.push(X.U8(p++)); steps.push(X.U8(p++));
		ord.push(X.U8(p++)); ptnp.push(X.U32(p,_BE)); p += 4;
//_l2r('prt',i,'ord:'+lp[i]+'-'+ord[i]+' ptn:'+ptn[i]+' steps:'+steps[i]+' +pp:'+Hex(ptnp[i]))
		p += ord[i]*4*2;
		//if(!ord[i] || ptnp[i] < 0x5B+8) return
		for(i=0; i < x; i++) ptnp[i] += p;
		mpp = (function(){var i=ptnp.indexOf(Math.max.apply(null,ptnp));return [ptnp[i],steps[i]];}());
//_l2r('prt',p,outArray(ptnp,16)+' s'+outArray(steps,16)+' ->'+outArray(mpp,16))
	}
	//ptn data
//_l2r('prt',p,'ptn')
//p = mpp[0]+3*mpp[1];
//_l2r('prt',p,outArray(X.readBytes(p,6),16))
// TODO: Pink's PreTracker WIP
	return X.Sz() > p
}
if(!bDetected && isPreTracker()) {
	sName = "Manfred 'Pink' Linzner's PreTracker module (.PRT)"; bDetected = 1;
	if(nV < 25) sVersion = "v<0.3"; else
	if(nV == 25) sVersion = "v0.3~0.866"; else
	if(nV == 26) sVersion = "v0.87~0.92"; else
	if(isWithin(nV, 27,29)) sVersion = "v.[0.93~1.5)"; else
	if(nV == 30) sVersion = "v1.5+";
	else sVersion = "v.TODO";
	if(X.isVerbose()) {
		sOptionT(X.SA(0x14,0x14));
		if(x > 1) sOption(x,'×');
		sOptionT(X.SA(0x28,0x14),"by: ");
		sOption('ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn+' ins:'+ins+' wf:'+(wf=X.U8(0x41)))
	}
}


function isComebackTracker() {
	//ref REing PreTracker 1.5 which has CBT beta import routines
	if(X.Sz() < 0x64 || !X.c("'CBT'") || !isWithin(nV=X.U8(3), 1,12)) return;
	// ecx = 0x10; eax = ecx+1; max = Math.min(0x10000,X.Sz());
	// while(X.U8(ecx++));
	return true
}
if(!bDetected && isComebackTracker()) {
	sName = "Manfred 'Pink' Linzner's Comeback Tracker module (.CBT)"; bDetected = 1;
	sVersion = 'v'+nV+'β'
}


function isProSoundMaker_c() {
	//ref https://ay.strangled.net/Ay_Emul30.src.7z /Help/html/ay_ru_fmt_psm.htm
	bad = ''; sus = lp = 0; m = Math.min(X.Sz(), 0x4000);
	var ordp = X.U16(0); if(!isWithin(ordp,8,0xFF)) { sus++; bad += '!badpos' }
	var smpp = X.U16(2); if(!isWithin(smpp, ordp,0x1FF)) { sus++; bad += '!badsmp' }
	var ornp = X.U16(4); if(ornp && !isWithin(ornp, smpp,0x4FF)) { sus++; bad += '!badorn' }
	var ptnp = X.U16(6); if(!isWithin(ptnp, ornp,0x5FF)) { sus++; bad += '!badptn' }
	title = '';
	if(ordp >= 0xD) {
		var idfound = X.c("'psm1'00", 8), titlep = idfound? 0xD: 8;
		if(titlep < ordp) title = decAnsi(titlep,ordp-titlep,CPSpeccy);
		if(idfound) sus -= 2
	}
	if(sus > 2) return;
	var ords = [], smps = [0], orns = [0], ptns = [];
	for(p=ordp,ord=ptn=0; p < m; ord++) {
		var o = X.U8(p++); t = X.U8(p); var ti = X.I8(p++);
		if(o == 0xFF) { if(t == 0xFF) break;  if(t & 0x80) { if((t & 0x1F) >= ord) return; else lp = t & 0x1F } break }
		if(!isWithin(ti, -36,36) || ord > 100 || o > 32) return;
		if(!ords.includes(o)) ords.push(o); if(o >= ptn) ptn = o+1;
	} if(!ord) return;
	q = X.U16(smpp); smp = (q-smpp) >> 1;
	for(p=smpp; p < q; p+=2) if(!isWithin(t=X.U16(p), smpp,ornp)) return; else if(!smps.includes(t)) smps.push(t);
	if(ornp == ptnp) orn = 0; else { q = X.U16(ornp); orn = (q-ornp) >> 1;
		for(p=ornp; p < q; p+=2) if(!isWithin(t=X.U16(p), ornp,ptnp)) return; else if(!orns.includes(t)) orns.push(t) }
	tmp = [100, 0];
	for(i=0,p=ptnp; i < ptn; i++) {
		if(!isWithin(t=X.U8(p++), 2,50)) return;
		if(tmp[0] > t) tmp[0] = t;  if(tmp[1] < 1) tmp[1] = t;
		for(j=0; j < 3; j++,p+=2)
			if(!isWithin(t=X.U16(p), ptnp,m)) return;
			else { if(!ptns.includes(t)) ptns.push(t) }
	}
	ptns.sort(function(a,b){return a-b}); if(Util.divu64(ptns[0]-ptnp,7) != ptn) return;
	for(i=1; i < ptns.length; i++) if(!isWithinRanges(t=X.U8(ptns[i]-1), [0xFF,[0xB8,0xF8]])) { sus++; if(sus > 5) return }
	// parse the highest pattern, find size
	for(p=ptns.pop(); p < m;) {
		c = X.U8(p++);
		if(c == 0xFF) break;
		if(isWithin(c, 0xB1,0xB7) || c == 0xFC) p++;
		else if(c == 0xF9) p += 4;
		else if([0xFD, 0xFE].includes(c)) return
	}
	sz = p;
	return true
}
if(!bDetected && isProSoundMaker_c()) {
	sName = "Denis 'Dexus' Dratov's Pro Sound Maker module (.PSM)"; sVersion = 'compiled'; bDetected = 1; 
	if(sus>0 || bad.length) sVersion += '/malformed'+bad+'/sus'+sus;
	if(X.isVerbose()) {
		sOptionT(title);
		sOption('tmp:'+tmp[0]+(tmp[0] == tmp[1]?'':'-'+tmp[1])+' ord:'+(lp?lp+'~':'')+ord
			+' ptn:'+ptn+' smp:'+smp+(orn?' orn:'+orn:'')+' sz:'+outSz(sz))
	}
}


function isProtrackerIFF() {
	if(!X.c("'FORM'........ 'MODLVERS'00000016") || !X.c("'INFO'00000048",0x1E)
	  || !X.c("'CMNT'000001A4",0x66) || !X.c("'PTDT'",0x20A)) return false;
	info = cmt = dt = pt = sv = ''; smp = ord = ptn = tmp0 = 0; sz = X.U32(4,_BE)+8;
	maxsz = Math.min(sz,X.Sz());
	p = 0x1E; while (!bDetected && p < maxsz) {
		hkhd = X.SA(p,4); hksz = X.U32(p+4,_BE); if(charStat(hkhd,1).indexOf('allasc') < 0) break;
		switch (hkhd) {
		case 'INFO': info = decAnsi(p+8,0x20,CPAmiga).trim();
			smp = X.U16(p+0x28,_BE); ord = X.U16(p+0x2A,_BE);
			ptn = X.U16(p+0x2C,_BE); bpm0 = X.U16(p+0x30,_BE);
			var dd = X.U16(p+0x34,_BE); if(!isWithin(dd,1,31)) return false;
			var mm = X.U16(p+0x36,_BE); if(!isWithin(mm,0,12)) return false;
			var yy = X.U16(p+0x38,_BE); if(isWithin(yy,30,88)) return false;
			dt = (1900+yy)+'-'+mm.padStart(2,'0')+'-'+dd.padStart(2,'0')+' '
				+X.U16(p+0x3A,_BE).padStart(2,'0')+':'+X.U16(p+0x3C,_BE).padStart(2,'0')
				+':'+X.U16(p+0x3E,_BE).padStart(2,'0');
			pt = secondsToTimeStr(X.U16(p+0x40,_BE)*3600+X.U16(p+0x42,_BE)*60+X.U16(p+0x44,_BE));
			break;
		case 'CMNT': auth = decAnsi(p+8,0x20,CPAmiga).trim(); if(auth === 'UNNAMED AUTHOR') auth = '';
			cmt = decAnsi(p+0x28,hksz-0x20,CPAmiga).trim(); break;
		case 'PTDT': return true
		}
		p += hksz
	}
}
if(!bDetected && isProtrackerIFF()) {
	sName = "ProTracker IFF-wrapped module (.PTM)"; bDetected = 1;
	sv = X.SA(0x18,6).trim(); if(!sv.length) sv = 'v3.6'; sVersion = sv;
	if(X.isVerbose()) {
		sOption(info); sOption(auth,'by: '); sOption(cmt);
		sOption(dt,'on '); sOption(pt,'len ');
		sOption('bpm0:'+bpm0+' ord:'+ord+' ptn:'+ptn+' smp:'+smp);
		sOption(outSz(sz),'sz:')
	}
}


function isS3M() {
	//ref https://moddingwiki.shikadi.net/wiki/S3M_Format
	//from https://github.com/OpenMPT/openmpt/blob/master/soundlib/S3MTools.h & Load_s3m.cpp
	// & http://asle.free.fr/prowiz/prowiz.src.zip / r/S3M.c
	if(!X.c("'SCRM'", 0x2C) || !X.c("10",0x1D) || [1,2].indexOf(X.U8(0x2A)) < 0 || X.Sz() < 0x60) return false;
	keepmidims = fmttrkstr = trknc = isST3 = isSchism = false;
	tracker = lswv = bad = ''; sus = 0;
	if(!X.c("1A",0x1C)) {sus++; bad = bad.addIfNone('!badsig1a') }
	z1 = X.U16(0x1E); if(z1) { sus++; bad = bad.addIfNone('!badsig0') }
	ord = X.U16(0x20); if(ord & 1) { sus++; bad = bad.addIfNone('!oddord') }
	smp = X.U16(0x22); ptn = X.U16(0x24);
	fl = X.U16(0x26); cwtv = X.U16(0x28); tv = cwtv >> 12; wtv = cwtv & 0xFFF; fmtv = X.U16(0x2A);
	gvol = X.U8(0x30); spd = X.U8(0x31); tmp = X.U8(0x32); mvol = X.U8(0x33); uc = X.U8(0x34);
	usept = (X.U8(0x35) && 0xFC) > 0; r2 = X.U16(0x36); special = X.U16(0x3E);
	ch = 4; for(i=0; i < 0x20; i++) if(X.U8(0x40+i) != 0xFF) ch = i+1;
	t = Hex(cwtv); sv = t.substr(1,1)+'.'+t.substr(2,2).padStart(2,'0');
	switch(tv) {
	case 0x208 & tv: tracker = 'Akord'; break;
	case 1: if(X.c("'SCLUB2.0'",0x36)) tracker = 'Sound Club 2';
		else if(cwtv == 0x1320 && !special && !(ord & 0xF) && !uc && !(fl & ~0x50) && usept) {
			if(mvol) { lswv = '1.16'; tracker = 'ModPlug Tracker/OpenMPT 1.17' }
			else { lswv = '1.00.00.A0'; tracker = 'ModPlug Tracker 1.0 alpha' }
			keepmidims = trknc = true
		} else if(cwtv == 0x1320 && !special && !uc && !fl && !usept) {
			if(gvol == 64 && mvol == 48) tracker = 'PlayerPRO';
			else tracker = 'Velvet Studio' //TODO attribute in a brief way
		} else if(cwtv == 0x1320 && !special && !uc && fl == 8 && !usept)
			tracker = "J.Lim's Impulse Tracker < 1.03";
		else {
			isST3 = true; if(cwtv == 0x1320) tracker = "Psi's Scream Tracker 3.20-21"; else {
				tracker = "Psi's Scream Tracker"; fmttrkstr = true }
		} break;
	case 2: fmttrkstr = cwtv != 0x2013; if(fmttrkstr) tracker = 'Imago Orpheus'; else tracker = 'PlayerPRO';
		trknc = true; break;
	case 3: if(cwtv == 0x3320) tracker = 'Impulse Tracker 1.03';
		else { if(r2 > 0x214) tracker = "Impulse Tracker 2.15";
			else if(isWithin(wtv,0x215,0x217))
					tracker = 'Impulse Tracker 2.14p'+(wtv == 0x215? '1-2': wtv == 0x216? '3': '4-5');
				else tracker = 'Impulse Tracker '+((wtv&0xF00)>>8)+'.'+(wtv&0xFF).toString(16).padStart(2,'0');
		}
		// if(cwtv >= 0x3207 && X.U32(0x38)) {} // could decode the total edit time here if you wanted
		trknc = true; break;
	case 4: if(cwtv == 0x4100) tracker = 'BeRoTracker';
		else {
			isSchism = true;
			var dt = 734016 + (wtv < 0xFFF? wtv-0x050: r2);
			var y = Util.div64(dt*10000+14780, 3652425);
			var ddd = dt - (365*y + Util.div64(y,4) - Util.div64(y,100) + Util.div64(y,400));
			if(ddd < 0) { y--; ddd = dt - (365*y + Util.div64(y,4) - Util.div64(y,100) + Util.div64(y,400)) }
			var mi = Util.div64(100*ddd+52, 3060);
			tracker = 'Schism Tracker '+(y+Util.div64(mi+2,12)).padStart(4,'0')+'-'
				+((mi+2)%12+1).padStart(2,'0')
				+'-'+(ddd - Util.div64(mi*306+5,10) + 1).padStart(2,'0')
		}
		trknc = true; break;
	case 5: if((cwtv >> 8) == 0x57) { tracker = 'NESMusa'; fmttrkstr = true
		} else if(!r2 && uc == 16 && X.U8(0x41) != 1) { tracker = 'Liquid Tracker'; fmttrkstr = true
		} else if(cwtv != 0x5447) {
			v = wtv << 16; if(v >= 0x01290000) v |= r2;
			function itV(v) { return v.slice(0,1)+'.'+v.slice(1,3)+'.'+v.slice(3,5)+'.'+v.slice(5,7) }
			lswv = itV(v.toString(16).toUpperCase().padStart(7,'0')); tracker = 'OpenMPT '+lswv
		} else tracker = "Dumbo's Graoumf Tracker";
		break;
	case 6: tracker = 'BeRoTracker'; break;
	case 7: tracker = "BeRo's CreamTracker"; break;
	default:
		if(cwtv == 0xCA00) tracker = 'Camoto';
	}
	if(sus >= 2) return false;
	if(fmttrkstr) tracker += ' '+sv;
	charset = lswv != ''? 'CP1252': 'CP437';
	p = 0x60+ord+smp*2; max = sz = 0;
	for (i=0; i < ptn; i++) {
		var p1 = X.U16(p+i*2) << 4;
		if(!p1) continue;
		if (p1 > max) { max = p1; sz = max + X.U16(p1) }
	}
	if(sz%16) sz += 16-(sz%16);
	if(usept) { var anyunpannedch = false; p += ptn*2;
		for(i=0; i < ch; i++)
			if(isST3 && isWithin(X.U8(0x40+(i&0xFF)), 16, 29) && X.U8(p+i) < 0x10)
				anyunpannedch = true;
		if(ch < 32 && lswv.indexOf('1.16') >= 0)
			if(anyunpannedch) tracker = 'ModPlug Tracker 1.16/OpenMPT 1.17';
			else tracker = 'ModPlug Tracker'
	}
	p = 0x60+ord; anysmp = anyADPCM = false; gus = 0; smps = [];
	for(i=0; i < smp; i++) {
		si = X.U16(p+i*2) << 4; if(!si) continue; else if(si > X.Sz()) { bad = bad.addIfNone('!short'); continue }
		st = X.U8(si); ssz = X.U32(si+0x10); t = X.SC(si+0x30,0x1C,charset).trim(); if(t != '') smps.push(t);
		if(st < 2) {
			if(ssz) {
				anysmp = true; sf = X.U8(0x1F);
				if(!anyADPCM && X.U8(si+0x14) == 4 && !(sf & 6)) anyADPCM = true }
			gus |= X.U16(si+0x28) }
		if(X.U8(si) === 1) {
			sofs = X.U16(si+14) << 4;
			if (sofs > max) {
				if (sf & 4) ssz *= 2; //16-bit
				max = sofs; if(sz < max+ssz) sz = max+ssz;
			}
		}
	}
	usegus = gus > 1;
	if(isST3 && anysmp && !gus && cwtv != 0x1300) {
		isST3 = false; tracker = 'Unknown';
		if(cwtv == 0x1301 && !uc) {
			if(!(fl & ~0x50) && (mvol & 0x80) && usept) tracker = "Laurent Clévy's UNMO3";
			else if(!fl && gvol == 48 && mvol == 176 && tmp == 150 && !usept)
				tracker = "Slixter's deMODifier";
			else if(!fl && gvol == 64 && (mvol & 0x7F) == 48 && spd == 6 && tmp == 125 && !usept)
				tracker = "Zab/Kosmic's To-S3M"
		}
	} else if(isST3) tracker += usegus? ' (GUS)': ' (SB)';
	if(anyADPCM) tracker += ' (ADPCM packed)';
	return true
}
if(!bDetected && isS3M()) {
	sName = "Sami 'Psi' Tammilehto's ScreamTracker 3 module (.S3M)"; bDetected = 1;
	if(sus) sVersion = sVersion.appendS('malformed'+bad+' sus'+sus,'/');
	if(X.isVerbose()) {
//if(!spd || spd == 0xFF && isST3) spd = 6; if(tmp < 33) tmp = isST3? 125: 32; //fixes for playback, include?
		sOptionT(X.SC(0,0x1C,charset)); sOption(tracker,'in:');
		sOption(addEllipsis(smps.join(' '),0xA0),'smp/msg:"','"');
		sOption('ch:'+ch+' tempo0:'+tmp+' spd0:'+spd+' ord:'+ord+' ptn:'+ptn+' smp:'+smp
			+' gvol:'+gvol+' smpvol:'+(mvol&0x7F)+(mvol&0x80?'/mono':'/stereo')+' sz:'+outSz(sz));
	}
}


function isMlatAT() {
	if(!X.c("'MAD+'")) return;
	ord = X.U8(0xB9); ptn = X.U8(0xBA); tmr = X.U8(0xBB);
	for(i=0,p=0xBC; i < ptn*32*9; i++) if(isWithin(X.U8(p++),0x60,0xFD)) return;
	for(i=0; i < ord; i++) if(!isWithin(X.U8(p++), 1,ptn)) return;
	return true
}
if(!bDetected && isMlatAT()) {
	sName = "Mlat Adlib Tracker module (.MAD)"; bDetected = 1;
	//if(bad.length) sVersion = 'malformed'+bad;
	if(X.isVerbose()) sOption('ord:'+ord+' ptn:'+ptn+' sz:'+outSz(p))
}


function isProtoTracker() {
	if(!X.c("'SONG'") ) return;
	//ref https://github.com/kometbomb/prototracker/blob/master/doc/FORMAT.TXT
	//TODO tighten somewhat
	sz = X.U32(4,_LE); p = 8;
	v = X.U8(p++); trk = v >= 1? X.U8(p++):4; fxprm = v >= 17? X.U8(p++): 1;
	fxc = v >= 17? X.U8(p++): 0;
	title = X.SC(p,0x1000,'CP1250'); p += title.length+1;
	ptnr = X.U8(p++)+1; seqr = X.U8(p++)+1;
	if(!ptnr || !seqr) return; mcr = 0;
	for(i=eof=0; p < X.Sz() && !eof; p += X.U32(p+4)) {
		switch(X.SA(p,4)) {
		case 'SEQU': if(X.U8(p+8) > seqr) return; i |= 1; break;
		case 'PATT': i |= 0x10; break;
		case 'MACR': i |= 0x100; mcr = X.U8(p+8); break;
		default: if(i < 0x11) return;  eof = 1
		}
	}
	sz = p;
	return true
}
if(!bDetected && isProtoTracker()) {
		sName = "Tero 'kometbomb' Lindeman's ProtoTracker module (.SONG)";  bDetected = 1;
		sVersion = sVersion = "v"+v;
		if(X.isVerbose()) {
			sOption(title);
			sOption('trk:'+trk+(fxc?' fx:'+fxc:'')+(mcr?' mcr:'+mcr:'')+' sz:'+outSz(sz))
		}
}


function isBeaverSweeper() {
	// ref https://www.pouet.net/prod.php?which=19993 /src/gtk_format.*, isSynth/*
	if(!X.c("'+SNT'")) return;
	// read synth:
	//   read samples
	for(i=smp=0,p=4; i < 32; i++) if(X.U8(p) > 7) return; else if(X.U8(p++) & 1) {
		var ssz = X.U24(p); p += 3+ssz*2; var lpst = X.U24(p), lped = X.U24(p+3); p += 6;
		if(lpst > ssz || lped > ssz || lped < lpst) return;
		if(ssz) smp++
	}
	//   read ins
	vs = [];
	function parseType() {
			switch(X.U8(p++)) {
			case 1/*env*/: if(X.U8(p+0xB) > 1 || !isWithin(X.F32(p+3),-0.1,1.1)) return; p += 0xC; break;
			case 2 /*LFO*/: if(X.U8(p+1) > 1 || X.U8(p+7) > 1) return; p += 0xE; break;  case 3 /*ctlr*/: p += 5; break;
			case 4 /*oscr*/: if(X.U8(p+9) > 1) return; p += 0x37; break;
			case 5 /*flt*/: if(X.U8(p+1) > 1) return; p += 0x1D; break;  case 6 /*distortion*/: p += 9; break;
			case 7 /*delay*/: p += 0x18; break;  case 8 /*chorus*/: if(X.U8(p+0x18) > 1) return; p += 0x19; break;
			default: return;
			}
		return true
	}
	function parseTypes() {
		var nr = X.U8(p++); for(var i=0; i < nr && p < X.Sz(); i++) if(!parseType()) return;
		return true;
	}
	for(i=ins=0; i < 16 && p < X.Sz(); i++) { //for each instrument:
		var v = X.U8(p++);
		p += v; //polyvoice array
		if(v) ins++;
		for(j=0; j < v && p < X.Sz(); j++) { //...for each voice: 
			p+=2; //note range
			if(!parseTypes()) return; //modulators
			p += 1+55*X.U8(p); //oscillators
			if(X.U8(p) > 8) return; //max inserts
			if(!parseTypes()) return;
			p += 0xA; //modulation
		}
		t = X.U8(p++); if(t > 1) return;  if(t) if(!parseType()) return; //distortion
		t = X.U8(p++); if(t > 1) return;  if(t) p += 0xC1; // arpeggiator
	}
	p += 0x140; //instr. mixer settings
	for(i=0; i < 3; i++) { //load effect chains
		fl = X.U8(p++);
		if(fl&1) if(!parseType()) return;  if(fl&2) if(!parseType()) return;  if(fl&4) if(!parseType()) return;
	}
	if(!X.c("'-SNT'",p)) return; p += 4;
	//read the main module
	if(!X.c("'GOAT'",p)) return;
	bad = ''; nv = X.U16(p+4); ch = X.U8(p+6); ptn = X.U8(p+7); ins = X.U8(p+8);
	bpm0 = X.U8(p+9); if(!bpm0) bpm0 = 125;  p += 12;
	var chlens = []; ord = 0;
	for(i=0; i < ch; i++) {
		var id = X.U8(p++);
		if(nv == 0x102) t = X.U8(p++); else { t = X.U16(p); p += 2 }
		ord = Math.max(t,ord);
		for(j=0; j < t; j++) {
			f = X.U16(p); p += 2; if(f > 0x100) bad = bad.addIfNone('!badchnum');
			if(f) for(k=0x100; k; k>>=1) if(f&k) p++
		}
	}
	var ptsz = 64, rows;
	for(i=0; i < ptn; i++) {
		var id = X.U8(p++);
		if(nv == 0x102) rows = X.U8(p++); else { rows = X.U16(p); p += 2 }
		if(!rows) bad = bad.addIfNone('!badptnrows');
		for(j=0; j < rows; j++) {
			f = X.U32(p); p += 4; if(f) for(k=0x10000; k; k>>=1) if(f&k) p += 4
		}
	}
	return true
}
if(!bDetected && isBeaverSweeper()) {
	sName = "Fredrik 'Gnilk' Kling & Stefan 'Steffo' Hållén & Zyrax's Beaver Sweeper module (.GTK)";
	sVersion = 'v'+nv.toString(16).padStart(4,'0');
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/'); bDetected = 1;
	if(X.isVerbose()) {
		sOption('ch:'+ch+' bpm0:'+bpm0+' ord:'+ord+' ptn:'+ptn+(ins?' ins:'+ins:'')+' smp:'+smp+' sz:'+outSz(p))
	}
}


function isAnders0land() {
	//ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Anders0land/SRC_Anders0land/Anders 0land_v1.asm
	if(!X.c("'mpl'")) return false;
	p = X.U32(4,_BE); if(p > X.Sz() || (p&1)) return false;
	songp = p+8;
	if(!X.c("'mdt'",p)) return false;
	p += X.I32(p+4,_BE); if(p > X.Sz() || (p&1)) return false;
	if(!X.c("'msm'",p)) return false;
	p += X.I32(p+4,_BE); if(p < X.Sz()) return false;
	sz = p;
	smpp = songp+X.I32(songp-4,_BE);
	smpsz = X.I32(smpp-4,_BE);
	smp = (X.I16(songp+20,_BE) - X.I16(songp+18,_BE)) >> 2;
	songsz = songp-8;
	x = (X.I16(songp+4,_BE) - X.I16(songp+2,_BE)) >> 2;
	p = X.I16(songp,_BE);
	ord = X.I16(songp+6,_BE)-p-X.I32(songp+p+12,_BE);
	return true
}
if(!bDetected && isAnders0land()) {
	sName = "Anders 'Zonix' 0land's Music & Player module (.HOT)"; bDetected = 1;
	sVersion = "v"+X.SA(3,1);
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption("ord:"+ord+" smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz));
		sOption(outSz(sz),"sz:")
	}
}


function isUNIMOD() {
	// ref https://github.com/sezero/mikmod/blob/master/libmikmod/loaders/load_uni.c
	if(!/(UN0[4-6].*|APUN\x01[1-6])/.test(X.SA(0,6))) return;
	p = 4; voc = 0; var v, e;
	if(X.SA(3,1) != 'N') { v = X.U8(3)-0x30; if(v > 6) v = X.U16(4,_BE) } else v = 0x100;
	if(v >= 6) { e = _BE;
		if(v == 6) p++; else { v = X.U16(p,e); p+=2 }
		flg = X.U16(p,e); p+=2;
		ch = X.U8(p++);
		voc = X.U8(p++);
		ord = X.U16(p,e); ptn = X.U16(p+2,e); trk = X.U16(p+4,e); ins = X.U16(p+6,e);
		smp = X.U16(p+8,e); reppos = X.U16(p+0xA,e); p+=0xC;
		spd0 = X.U8(p++); tmp0 = X.U8(p++); vol0 = X.U8(p++);
		if(v >= 0x106) { bpmlimit = X.U16(p,e); p+=2 }
		else bpmlimit = 32;
	}
	else { e = _LE;
		ch = X.U8(p++);
		ord = X.U16(p,e); p+=2;
		if(v == 5) { lp = X.U16(p,e); p+=2 } else lp = 0;
		ptn = X.U16(p,e);
		trk = X.U16(p+2,e);
		ins = X.U16(p+4,e); p += 6;
		smp = 0; spd0 = X.U8(p++); tmp0 = X.U8(p++);
		p += 256+32; // positions+panning
		flg = X.U8(p++);
		bpmlimit = 32;
	}
	sv = X.SA(3,1) == 'N'? 'v.APlayer': 'v'+Hex(v);
	if((v < 6 && !(isWithin(ch,1,32) || isWithin(ord,1,256))) || lp > ord || !trk || !ptn
	  || !isWithin(ins,1,256) || !spd0 || !tmp0) return;
	titlesz = X.U16(p,_LE); titlep = p+2; p += 2+titlesz;
	if(v < 0x102) {
		origssz = X.U16(p,_LE); origsp = p+2;
		p = p1 = p+2+origssz; p = origsp+origssz;
	} else origssz = 0;
	cmtsz = X.U16(p,_LE); cmtp = p+2; p += 2+cmtsz;
	if(v >= 6) {
		if(v >= 0x100) p += ord*2; else p += ord;
		p += ch*3;
	}
	smps = []; inss = []; smpsz = 0;
	if(v >= 6) {
		for(i=0; i < smp; i++) { //loadsmp6
			smpsz += X.U32(p+7,e); t = X.U16(p+0x23,_LE); p += 0x25; smps.push(X.SC(p,t,'CP437').trim()); p += t
		}
		for(i=0; i < ins; i++) { //loadinstr6
			p += 13;
			pt = X.U8(p+1); p += 6 + (v>=0x100? 0x20: pt)*4;
			pt = X.U8(p+1); p += 6 + (v>=0x100? 0x20: pt)*4;
			pt = X.U8(p+1); p += 6 + (v>=0x100? 0x20: pt)*4;
			if(v >= 0x103) p += 240*smp; else p += 120*smp;
			t = X.U16(p,_LE); p += 2; inss.push(X.SC(p,t,'CP437').trim()); p += t
		}
	} else {
		for(i=0; i < ins; i++) { //loadinstr5
			smpn = X.U8(p); smp += smpn; p += 0xD1;
			t = X.U16(p,_LE); p += 2; if(t) { inss.push(X.SC(p,t,'CP437').trim()); p += t }
			for(j=0; j < smpn; j++) {
				smpsz += X.U32(p+5,e);
				t = X.U16(p+0x13,_LE); p += 0x15; if(t) { smps.push(X.SC(p,t,'CP437').trim()); p += t }
			}
		}
	}
	p += 2*ptn + 2*ch*ptn;
	for(i=0; i < trk; i++) p += X.U16(p,e)+2;
	sz = p+smpsz;
	return true
}
if(!bDetected && isUNIMOD()) {
	sName = "Otto Chrons/libmikmod UNIMOD/UNITRK module (.UNI)"; sVersion = sv; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SC(titlep,titlesz,'CP437'));
		if(origssz) sOptionT(X.SA(origsp,origssz),"orig: ");
		sOptionT(X.SC(p1+2,X.U16(p1),'CP437'));
		sOption(addEllipsis(inss.filter(funSampleName).join(' ')),'ins/msg:"','"');
		// sOption(addEllipsis(smps.filter(funSampleName).join(' ')),'smp/msg:"','"');
		sOption('ch:'+ch+(voc?'/'+voc:'')+' spd0:'+spd0+' tmp0:'+tmp0+' trk:'+trk
			+' ord:'+(lp?lp+'~':'')+ord+' ptn:'+ptn+' ins:'+ins+(smp?' smp:'+smp:'')+' sz:'+outSz(sz))
	}
}


function isD00nohdr() {
	// ref https://github.com/adplug/adplug/blob/master/src/d00.h & .cpp
	if(X.Sz() < 40 || X.Sz() >= 0xFFFF) return false;
	if(X.c("0001.... 000D00") && X.c("FFFF",0xB)) nV = 0;
	else if(X.c("01..01.. 000F00") && X.c("FFFF",0xD)) nV = 1; else return false;
	seqp = X.U16(3,_LE); if(seqp < 13 || seqp > X.Sz()) return false; // ptr to sequence pointer table
	x = 1;
	seqtest = X.fSig(seqp+18+9,TOEOF,"0000000000 FFFF")-seqp; // reserved bytes are 0; endmark follows 
	while (seqtest > 0x20) { x++; seqtest -= 0x20; if(!X.c("0000000000",seqp+seqtest)) return false }
	//there may be several sequence tables but they end the same
	trkp = t = X.U16(5,_LE); if(!X.c("FFFF",trkp-2) || trkp < 13) return false; // ptr to track pointer table
	insp = X.U16(7,_LE); if(!X.c("FFFF",insp-2) || insp < 13) return false; // to instrument pointer table
	sz = X.U16(9,_LE); if(!X.c("FFFF",sz-2) || sz < 13) return false; // to message
	if(nV == 1) { sfxp = X.U16(11,_LE); if(!X.c("FFFF",sfxp+8)) return false; } // to sfx
	if(Math.abs(trkp-seqp) < 20 || Math.abs(trkp-insp) < 20 || Math.abs(seqp-insp) < 20) return false;
	oldp = trkp; p = X.U16(trkp,_LE);
	ip = 0, once = 0; // count pointers out of order, heuristic
	while(t < trkp+18 && trkp < X.Sz()) { // check 9 pointers from TPoin for validity
		if(t === trkp) p = oldp = t; // for the first pointer
		if(p) oldp = p;
		p = X.U16(t,_LE); if(!p || p < trkp || p > X.Sz()) return false;
		if(!X.c("FFFF",p-2)) { once++; if(once > 1) return false }
		if(p < oldp) { ip++; if(ip > 2) return false } // some D00s do have pointers out of order
		q = p; while(!X.c("FFFF",q) && q < X.Sz()) q += 2; //check the table data for having a FFFF somewhere near
		if(!X.c("FFFF",q)) { _log("D00nohdr: boh. t="+Hex(t)+" p="+Hex(p)+" q="+Hex(q)); return false; }
		t += 2
	}
	msg = ""; t = X.fSig(sz,0x200,"FFFF"); if(t > 0) { // the message exists and ends in FFFF
		msg = X.SC(sz,t-sz,'CP437').trim(); sz = t+2
	} else { // the message may exist but it may also be garbage, checking...
		msg = X.readBytes(sz,Math.min(sz+0x100,X.Sz())-sz);
		c = charStat(msg,1); if(c.indexOf("allxsc") >= 0) {
			msg = decEncoding(msg,CP437); sz += msg.length; msg = msg.trim()
		} else msg = ''
	}
	return true;
}
if(!bDetected && X.isDeepScan() && isD00nohdr()) {
	sName = "Jens Christian 'JCH/Vibrants' Huus's Edlib Tracker module (.D00)?"; sVersion = "old v"+X.U8(0); bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOptionT(addEllipsis(msg,0x100,0x80),'msg:"','"');
		sOption("sz:"+outSz(sz))
	}
}


function isProtrackerMOD() {
	//from https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_mod.cpp
	if(X.Sz() < 0x43C) return false;
	var b = X.readBytes(0x438,4), s = X.SA(0x438,4), hdr = 0x43C/*1084*/, plist = 0x3B8/*952*/, msmp = 0x1F;
	var isStarTrekker = isGenericMCh = isMdKd = maybeWOW = isHMNT = isInconexia = isNoiseTracker
	  = setMODVBlankTiming = hasLongSmp = hasEmptySmpwVol = hasRepLen0 = false;
	var maybeAS = 0, ibtrsh = 40; //typical threshold for invalid bytes (in samples); _FRAGILE is 1

	//test signatures
	if(/(M\.K\.|M!K!|PATT|NSMS|LARD)/.test(s)) {
		chn = 4; tracker = "generic Protracker-compatible";
		if(s === "M.K.") { isMdKd = true; maybeWOW = true } }
	else if(/(M&K!|FEST|N\.T\.)/.test(s)) {
		chn = 4; if(s === "N.T.") tracker = "Pex 'Mahoney' Tufvesson & Anders 'Kaktus' Berkeman's NoiseTracker";
		else { tracker = "Pex 'Mahoney' Tufvesson & Anders 'Kaktus' Berkeman's His Master's NoiseTracker"; isHMNT = true }
		isNoiseTracker = true }
	else if(/O[KC]TA/.test(s)) { chn = 8; tracker = "Armin Sander's Oktalyzer" }
	else if(/CD[68]1/.test(s)) { chn = b[2]-0x30; tracker = "Christian Dahl et al.'s Octalyser STE (Atari)" }
	else if(compareArrays(b, [0x4D,0,0,0]) || compareArrays(b, [0x38,0,0,0])) {
		if(b[0] === 0x38) chn = 8; else chn = 4; ibtrsh = 1; // fragile, needs more detects!
		tracker = "Inconexia demo"; isInconexia = true }
	else if(/FA0[4-8]/.test(s)) { chn = b[3]-0x30; tracker = "Digital Tracker"; hdr = 0x440 }
	else if(/(FLT|EXO)[48]/.test(s)) {
		chn = b[3]-0x30; if(chn == 4) maybeAS++;
		isStarTrekker = setMODVBlankTiming = true; tracker = "Startrekker";
	}
	else if(/[1-9]CHN/.test(s)) { chn = b[0]-0x30; isGenericMCh = true; tracker = "generic MOD-compatible" }
	else if(/[1-9][0-9]C[HN]/.test(s)) {
		chn = b[0]*10+b[1]-0x210; isGenericMCh = true; tracker = "generic MOD-compatible" }
	else if(/TDZ[1-3]/.test(s)) { chn = b[3]-0x30; tracker = "Twaddler and Dr. Zon's TakeTracker" }
	//else if(/\.M\.K/.test(s)) { chn = 4; swapBytes = true } just one hacked module, TODO after fast patches are in
	else if(/WARD/.test(s)) { chn = 8; isGenericMCh = true; tracker = "generic MOD-compatible" }
	else return false;
	if(!chn) return false;
	restartpos = X.U8(plist-1);
	//test samples
	p = 0x14; wowsmpsz = ib = 0;
	for(; p < 0x3B6; p += 0x1E) {
		var ssz = X.U16(p+0x16,_BE)<<1; //length
		wowsmpsz += ssz;
		if(!isHMNT && !hasLongSmp && ssz >= 0x20000) hasLongSmp = true;
		var sft = X.U8(p+0x18), svol = X.U8(p+0x19), sls = X.U16(p+0x1A,_BE)<<1, sll = X.U16(p+0x1C,_BE)<<1;
		if(sft || (ssz && svol != 0x40)) maybeWOW = false; if(sft > 15) ib++; //finetune <= 15
		if(svol > 0x40) ib++; //volume <= 64
		if(!ssz && svol == 0x40) { hasEmptySmpwVol = true;
			if(maybeAS && !sls && sll <= 2) maybeAS++ }
		if(sls > ssz) ib++; //loopstart. looplen gets weird, it's ok
		if(!hasRepLen0 && ssz && !sll) hasRepLen0 = true;
		if(ib > ibtrsh) return false;
	}
	isFLT8 = isStarTrekker && (chn == 8);
	var smpsz31 = wowsmpsz;
	if(restartpos) maybeWOW = false; if(!maybeWOW) wowsmpsz = 0;
	if(maybeAS >= 2) tracker += '/Audio Sculpture'

	//test patterns
	function cntBadPtnData(ofs) {
		var c = 0;
		for(i = 0; i < chn*64; i++)
			if(X.U8(ofs+(i<<2)) & 0xE0) c++;
		return c
	}
	//get real ptn:
	ord = X.U8(plist-2); if(!ord) return false;
	ol = X.readBytes(plist,0x80); //orderlist
	if(ord > 0x80) ord = 0x80;
	else if(!ord) { ord = 0x80; while(ord > 1 && !ol[ord-1]) ord-- }
	ptn = iptn = optn = 0; i = plist;
	for(i=0; i < 0x80; i++) {
		if(isFLT8) ol[i] /= 2; var pt = ol[i];
		if(pt < 0x80 && pt >= ptn) { ptn = pt+1; if(i < ord) optn = ptn } //official patterns
		if(ptn >= iptn) iptn = ptn+1 // illegal patterns
	}
	//weirdness checks
	var alignedfsz = X.Sz() & ~1;
	if(wowsmpsz && wowsmpsz+hdr+ptn*8*256 == alignedfsz) {
		if(cntBadPtnData(hdr+ptn*4*256) < 16) chn = 8; //⚠no good for ripping -- best to err toward no WOW
	}
	else if(ptn != optn && cntBadPtnData(hdr+optn*chn*256) > 64) ptn = optn;
	if(iptn > ptn && hdr+ssz+iptn*chn*256 == alignedfsz) ptn = iptn;

	if(maybeWOW && chn === 8) { tracker = "Mod's Grave"; isGenericMCh = true }
	if(restartpos >= ord || (restartpos == 0x78 && chn === 4)) restartpos = 0; //because that's actually bpm

	var onlyAmigaNotes = true, fix7BitPanning = leftPan = extPan = maxPan = 0;
	if(!isNoiseTracker) {
		isNoiseTracker = isMdKd && !hasEmptySmpwVol && !hasLongSmp;
		p = hdr;
		for(pt = 0; pt < ptn; pt++) {
			var ptnbrk = 0;
			for(; p < pt*chn*256; p += 4) {
				var d = X.readBytes(p,4);
				var np = ((d[0]&0xF)<<8) | d[1]; // note period
				if(np && np != 0xFFF) {
					if(onlyAmigaNotes && (np < 113 || np > 856)) onlyAmigaNotes = isNoiseTracker = false;
				}
				var cmd = d[2]&0xF, prm = d[3] /*, dsmp = (d[2]>>4) | (d[0]&0x10)*/;
				if((cmd > 6 && cmd < 0xA) || (cmd == 0xE && prm > 1)
					|| (cmd == 0xF && prm > 0x1F) || (cmd == 0xD && ++ptnbrk > 1))
					isNoiseTracker = false;
				if(cmd == 8) {
					if(prm > maxPan) maxPan = prm;
					if(prm < 0x80) leftPan = true;
					else if(prm > 0x8F && prm != 0xA4) extPan = true;
				}
			}
		}
		fix7BitPanning = leftPan && !extPan && maxPan >= 0x30;
	}
	if(onlyAmigaNotes && !hasRepLen0 && ['M.K.','M!K!','PATT'].indexOf(s) >= 0) {}
	else if(!onlyAmigaNotes && restartpos == 0x7F && isMdKd && restartpos+2 >= ord)
		tracker = "Sami 'Psi/Future Crew' Tammilehto's Scream Tracker";
	//modsize
	sz = hdr+ptn*chn*256;
	if(sz > X.Sz()) return false;
	p = 0x14; smp = 0; songsz = sz; ib = 0; smps = [];
	var anyADPCM = 0;
	for(; p < 0x3B6; p += 0x1E) {
		if(!isHMNT) { //His Master's Noise have data in sample titles
			t = X.readBytes(p,22,true); t = decEncoding(t,CPAmiga).trim(); if(t.length) smps.push(t)
		}
		var ssz = X.U16(p+0x16,_BE)*2;
		if(ssz) smp++;
		//if(isMdKd && onlyAmigaNotes && !hasEmptySmpwVol) ssz = Math.max(ssz,X.U16(p+0x1C,_BE)*2);
		if(X.c("'ADPCM'",sz)) { anyADPCM++; ssz = (ssz+1>>1)+5+16; }
		sz += ssz;
	}
	if(X.c("8BBEB4BA 8BADBEBC B4BAAD",sz)) {
		var exts = '', ext = [];
		while(sz < X.Sz() && isWithin(X.U8(sz) ^ 0xDF, 0xA,0x7F)) ext.push(X.U8(sz++)^0xDF);
		exts = decEncoding(ext,CP437);
		tracker = "Twaddler and Dr. Zon's TakeTracker";
		if(/\ version\ \d+\./.test(exts)) tracker +=' v' + /\ version\ (\d[^!]+)/.exec(exts)[1];
//		if(smps.length) smps.unshift('/'); smps.unshift(exts);
	}
	else if(isMdKd && X.c("001155332211",sz)) {
		tracker = 'Tetra Music Editor:'+X.U24(sz+6,_BE).padStart(6,'0'); sz += 9
	}
	if(anyADPCM && !isInconexia) tracker += ' (ADPCM packed: '+anyADPCM+')';
	return true
}
if(!bDetected && isProtrackerMOD()) {
	sName = "Amiga Freelancers' Protracker module (.MOD)"; bDetected = 1;
	sVersion = X.SA(0x438,4);
	if(X.isVerbose()) {
		sOptionT(decAnsi(0,20,CPAmiga));
		sOption(tracker,'in: ');
		sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),200),'smp/msg:\"','"');
		sOption('ch:'+chn+' ord:'+ord+' ptn:'+(optn!=ptn?optn+'/':'')+ptn+(iptn!=ptn?'('+iptn+')':'')
			+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isKRIS() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/ChipTracker/ChipTracker_v3.asm
	// & https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_kris.cpp
	if(X.Sz() < 0x7C0+0x100 || !X.c("'KRIS'",0x3B8)) return false;
	ord = X.U8(0x3BC); if(ord > 0x80) return false;
	loop = X.U8(0x3BD); if(loop > 0x7F || (loop < 0x7F && loop >= ord)) return false;
	const ibtrsh = 40; //typical threshold for invalid bytes (in samples); _FRAGILE is 1
	p = 0x16; var totalsmpsz = ib = 0; smp = synwf = 0; smps = [];
	for(var i=0; i < 31; p += 0x1E, ++i)
		if(!X.U8(p)) {
			var maxwf = Math.max(X.U8(p+1),X.U8(p+5),X.U8(p+10),X.U8(p+19));
			if(maxwf && maxwf >= synwf) synwf = maxwf+1;
		} else {
			t = X.SC(p,20,"IBM850").trim(); if(t != "" && t != "\x01") smps.push(t);
			var ssz = X.U16(p+0x16,_BE)*2; //length
			totalsmpsz += ssz;
			var sft = X.U8(p+0x18);
			if(sft & 0xF0) ib++; //finetune <= 15
			var svol = X.U8(p+0x19); if(svol > 0x40) ib++; //volume <= 64
			if(X.U16(p+0x1A,_BE)*2 > ssz) ib++;
			if(ib > ibtrsh) return false;
			smp++
		}
	ptn = 0; p = 0x3BE;
	ord = X.U8(0x3BC);
	for(i=0; i < (ord << 2); i++,p+=2) if(ptn < X.U8(p)) ptn = X.U8(p);
	ptn++;
	sz = 0x7C0+(synwf<<6)+(ptn<<8)+totalsmpsz;
	return true;
}
if(!bDetected && isKRIS()) {
	sName = "Krister Wombell's ChipTracker module (.KRIS,.MOD)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption(X.SA(0,16));
		sOptionT(addEllipsis(smps.join(" "),200),'smp/msg:\"','"');
		sOption('ord:'+(loop && loop < 0x7F? loop+'-':'')+ord+' ptn:'+ptn+' smp:'+smp+(synwf? ' synwf:'+synwf: '')+' sz:'+outSz(sz));
	}
}


function isMTNICE() {
	//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_ice.cpp
	if(X.c("'MTN'000000",0x5B8)) tracker = "MnemoTroN's SoundTracker";
	else if(X.c("'IT10'00",0x5B8)) tracker = "Icepic's IceTracker 1.0~2'";
	else return false;
	smp = smpsz = 0; smps = [];
	for(p=20; p < 20+30*31; p+=30) {
		t = decAnsi(p,22,CPAmiga).trim(); if(t != '') smps.push(t);
		ssz = X.U16(p+22,_BE); if(ssz) smp++; smpsz += ssz
	}
	ord = X.U8(p++); ptn = X.U8(p++); if(ord > 128) return false;
	for(i=0; i < 128*4; i++) if(X.U8(p++) > ptn) return false;
	sz = 0x5BC+ptn*64*4+smpsz;
	return true
}
if(!bDetected && isMTNICE()) {
	sName = tracker+" module (.ST26,.ICE)"; sVersion = "v2.6"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(decAnsi(0,0x14,CPAmiga));
		sOptionT(addEllipsis(smps.join(' '),0x80),'smps/msg:"','"')
		sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+sz)
	}
}


function isMVXModule() {
/*header:
1 dword: 'MVM\0'
1 byte: BPM
1 byte: ticks per beat
1 dword: song length in rows
1 byte: machine count
    N byte: machine IDs (N = machine count)
    N byte: machine order (N = machine count)
1 byte: machine connection count
    N * 3 bytes: machine connections (source, target, volume)*/
	if(!X.c("'MVM'00") || !X.U8(4) || !X.U8(5) || X.U32(6) > 10000 || !X.U8(0xA)) return;
	var idsm = [], ordm = [], lstm = [];
	p = 10; mach = X.U8(p++); for(i=0; i < mach; i++) idsm.push(X.U8(p++));
	for(i=0; i < mach; i++) { t = X.U8(p++); if(ordm.indexOf(t) >= 0) return; ordm.push(t); lstm.push(i) }
//_l2r('idsm',0,outArray(idsm)); _l2r('ordm',0,outArray(ordm.sort()));
	var cnx = X.U8(p++);
	for(i=0; i < cnx; i++) {
		var src = X.U8(p++), tgt = X.U8(p++); p++;
		if(src > mach || tgt > mach || src == tgt) return;
		lstm = lstm.filter(function() { return lstm.indexOf(src) < 0 && lstm.indexOf(tgt) < 0 })
	}
	if(lstm.length) return; //all machines must have connections, otherwise it's an export failure
	return true
}
if(!bDetected && isMVXModule()) {
	sName = "Gargaj/Conspiracy's MVX Module (.MVM)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption('bpm0:'+X.U8(4)+' ticks:'+X.U8(5)+' rows:'+X.U32(6)+' machines:'+mach)
	}
}


function isOctaMed() {
	//from http://fileformats.archiveteam.org/wiki/OctaMED_module_(MED)
	// & https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/ModuleConverters/ModuleConverter/Formats/Med4Format.cs
	// & https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/Players/Med/MedWorker.cs
	if(!/MED[\x02-\x04]/.test(X.SA(0,4))) return false;
	nV = X.U8(3); switch(nV) {
		//TODO find the non-\x04 files to test on
		case 2: sVersion = "v1.12"; break;
		case 3: sVersion = "v2.00"; break;
		case 4: sVersion = "v2.10+"; break;
	}
	x = 1; p = sz = ptn = ord = trk = midi = syhy = smp = realsmp = 0; smps = []; cs = bad = "";
	if(nV < 3) {
		//TODO
	} else {
		//going through the sample info
		var smpbmp0 = X.U8(4); p = 5;
		while(smpbmp0) {
			if(smpbmp0&1) { var smpbmp = X.U8(p++);
				while(smpbmp) { smp += smpbmp&1; smpbmp >>= 1 } }
			smpbmp0 >>= 1;
		}
		for(i=0; i < smp; i++) {
			fl = X.U8(p++); smpnl = X.U8(p++);
			smps.push(X.SA(p,smpnl)); p += smpnl;
			if(!(fl&1)) p+=2; if(!(fl&2)) p+=2; if(!(fl&4)) p++; if(!(fl&8)) p++;
			if(!(fl&0x30)) svol = X.U8(p++); if(svol > 0x40) return false;
			if(!(fl&0x40)) p++;
		}
		for(i = 62; i >= 0; i--) if(smps[i] && smps[i].length) {realsmp = i+1; break }
		ptn = X.U16(p,_BE); ord = X.U16(p+2,_BE); if(!ord || ord > 0x100) return false;
		p += 4; for(i=0; i < ord; i++) if(X.U8(p++) > ptn) return false;
		extsmp = !(X.U8(p+3)&8);
		tmp0 = X.U16(p,_BE)+"//"+X.U16(p+4,_BE); p += 26;
		for(i=0; i < 16; i++) if(X.U8(p++) > 0x40) return false;
		mvol = X.U8(p++); if(mvol > 0x40) return false;
		if(p > X.Sz()) return false;
		function SkipMidi() { var f = X.U32(p,_BE); p += 4;
			for (var i=0; i < 32; i++) { if(f < 0) f = -f; if((f & 0x80000000)) {midi++; p++ } f <<= 1 } }
		if(nV === 3) { SkipMidi(); SkipMidi() }
		for(i=0; i < ptn; i++) {
			var hdsz = X.U8(p++);
			var ptntrk = X.U8(p); if(trk < ptntrk) trk = ptntrk;
			var rows = X.U8(p+1), hksz = X.U16(p+2,_BE);
//_log("ptn["+i+"] @"+Hex(p)+": ("+Hex(hdsz)+") -> "+Hex(p+hdsz+hksz)+"], rows:"+rows+" trk:"+ptntrk);
			p += hdsz+hksz;
		}
		if(!extsmp) {
			var br = new BitReader(p,_BE), smp2process = 0; br.read(1);
			for(i=0; i < realsmp; i++) smp2process += br.read(1); delete br;
//_log("found "+smp2process+" samples to process");
			p += 8; for(i=0; i < smp2process; i++) {
				hksz = X.U32(p,_BE); hktp = X.U16(p+4,_BE); p += 6;
//_log("smp["+i+"] ("+Hex(p)+" -> "+Hex(p+hksz)+")")
				if(hktp == 0xFFFF || hktp == 0xFFFE) syhy++; p += hksz;
			}
		}
		if(X.c("'MEDV'",p))
			while(p+8 <= X.Sz() && /[A-Z]{4}/.test(X.SA(p,4))) {
				hkhd = X.SA(p,4); hksz = X.U32(p+4,_BE); p += 8;
				switch(hkhd) {
				case "MEDV": sVersion = "v"+X.U8(p+2)+'.'+X.U8(p+3).padStart(2,'0'); break;
				case "ANNO": cs = X.SC(p,hksz,'CP1252'); break;
				case "HLDC": break;
				default: _log("Unknown MED header: "+hkhd) //shouldn't exist but you know how they get
				}
				p += hksz
			}
	}
	sz = p;
	if(sz > X.Sz()) bad = "!short";
	return true
}
if(!bDetected && isOctaMed()) {
	sName = "OctaMED module (.MED)"; bDetected = 1;
	if(bad != "") sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		sOptionT(cs);
		while(smps[smps.length] == '') delete(smps[smps.length]);
		if(smps.length) sOption("["+smps.join(",")+"]","smps:");
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+(realsmp != smp ? "("+realsmp+")" : "")
		  +(extsmp?"(ext.)":"")+(syhy?" synth+hybrid:"+syhy:"")+(midi?" midi:"+midi:"")+" trk:"+trk+" tmp0:"+tmp0
		  +" mvol:"+mvol+" sz:"+outSz(sz))
	}
}


function isOctaMedMMD() {
	//from https://web.archive.org/web/20220109073109if_/http://www.textfiles.com/programming/FORMATS/med-form.txt
	if(!X.c("'MMD'")) return false;
	nV = X.U8(3)-48; if(nV < 0 || nV > 3) return false;
	switch(nV) {
		case 0: sname = "MED module (.MED,.MMD0)"; sversion = "v2.1 Med MoDule 0"; break;
		case 1: sname = "OctaMED Professional module (.MED,.MMD1)"; sversion = "v.3.00-4.x"; break;
		case 2: sname = "OctaMED Professional module (.MED,.MMD2)"; sversion = "v5.x"; break;
		case 3: sname = "OctaMED Professional module (.MED,.MMD3)"; sversion = "v6.x?"; break;
	}
	ptnsp = X.U32(0x10,_BE); if(ptnsp < 0x34) return false;
	smpsp = X.U32(0x18,_BE); if(smpsp && smpsp < 0x34) return false;
	expp = X.U32(0x20,_BE); if(expp > X.Sz()) return false;
	sec = p = 0; sngp = X.U32(p+8,_BE);
	if(sngp < 0x34 || sngp > 0xFFFFFEFF-63*8) return false;
	if(X.Sz() < Math.max(sngp+63*8+0x100, ptnsp, smpsp?smpsp:0x34, expp+0x34)) return false;
	songname = anno = iinfo = ""; ch = 4; xsngs = X.U8(0x33); x = expp?xsngs+1:1;
	if(expp) {
		psongname = X.U32(expp+0x2C,_BE);
		if(psongname) {
			songnamelen = X.U32(expp+0x30,_BE);
			if(songnamelen)
				songname = X.SC(psongname,songnamelen,'CP1252');
		}
		pannotxt = X.U32(expp+0x0C,_BE);
		if(pannotxt > 0) {
			annolen = X.U32(expp+0x10,_BE);
			anno = X.SC(pannotxt,annolen,'CP1252');
		}
		pMMDInstrInfo = X.U32(expp+0x14,_BE);
		if(pMMDInstrInfo > 0)
			iinfo = X.SC(expp,40,'CP1252');
	} //if expp
	ptn = 0; ord = []; var ptntp = X.U32(0x10,_BE);
	for(i=0; i < x; i++) {
		p = sngp+63*8;
		ptn1 = X.U16(p,_BE); if(ptn1 > 0x7FFF) ch = 4; ptn += ptn1;
		for(j = 0; j < ptn1; j++) {
			pj = j*4+ptntp; if(pj > X.Sz()) continue;
			pj = X.U32(pj,_BE); if(pj > X.Sz()) continue;
			pj = nV < 1 ? X.U8(pj+4) : X.U16(pj+4,_BE); if(pj > ch) ch = pj
		}
		if(nV < 2) { ord[0] = X.U16(p+2,_BE); if(ord[0] > 256) return false }
		else {
			sec = X.U16(p+2,_BE); trk = X.U16(p+0x10,_BE);
			if(!trk || trk > 0x40) return false;
			sectp = X.U32(p+8,_BE); if(sectp+sec*2 > X.Sz()) continue;
			playseqtp = X.U32(p+4,_BE); nplayseq = X.U16(p+0x12,_BE);
			secs = []; for(j = 0; j < sec; j++) secs.push(X.U16(sectp+j*2,_BE));
			for(j = 0; j < secs.length; j++) if(j <= nplayseq)
				ord.push(X.U16(X.U32(playseqtp,_BE)+0x28,_BE));
		}
		expp = X.U32(sngp+0x20,_BE);
		if(expp && (X.U32(expp,_BE) < sngp || expp > X.Sz())) { x = i+1; break }
		sngp = X.U32(expp,_BE);
	}
	smp = X.U8(p+0x11B); if(smp > 63) return false;
	return true
}
if(!bDetected && isOctaMedMMD()) {
	sName = sname; sVersion = sversion; bDetected = 1;
	if(X.isVerbose()) {
		if(songname != "<unnamed>" && songname != "<ohne Namen>")
			sOption(songname);
		sOptionT(anno);
		sOptionT(iinfo,"ins0:");
		if(x > 1) sOption(x,"×");
		sOption((X.isDeepScan()?"ch:"+ch+" ":"")+"ord:"+ord.join("+")+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(X.U32(4,_BE)))
	}
}


function isAHX() {
	//ref http://lclevy.free.fr/exotica/ahx/ahxformat.txt
	// & https://github.com/pete-gordon/hivelytracker/blob/master/Replayer_Windows/hvl_replay.c
	if(X.Sz() < 30) return false;
	if(X.c("'THX'0.")) fmt = "ahx";
	else if(X.c("'HVL'0.")) fmt = "hvl";
	else return false;
	bad = 0;
	var b6 = X.U8(6);
	trk0saved = b6 >> 7;
	switch((b6 >> 4) & 7) {
	case 0: spd = "50Hz"; break;
	case 1: spd = "100Hz"; break;
	case 2: spd = "150Hz"; break;
	case 3: spd = "200Hz"; break;
	default: bad++; spd = "?Hz"
	}
	ord = X.U16(6,_BE) & 0xFFF;
	if(ord > 999) bad++; if(!ord || ord > 1024) bad++;
	if(fmt === "ahx") {
		lp = X.U16(8,_BE); if(lp >= ord) bad++;
	}
	else chn = (X.U8(8) >> 2)+4;
	if(bad > 1) return false;
	trl = X.U8(10); if(!trl || trl > 64) return false;
	trk = X.U8(11);
	ins = X.U8(12); if(ins > 63) return false;
	sub = X.U8(13);
	if(fmt === "ahx") {
		sz = 14+sub*2+ord*8+trk*trl*3; if(!trk0saved) sz += trl*3
		for(i=0; i < ins; i++) {
			var spls = X.U8(sz+21);
			sz += 22+spls*4;
		}
	}
	else {
		sz = 16+sub*2+ord*chn*2;
		if(trk0saved) i = 1; else i = 0;
		for(; i <= trk; i++)
			for(j=0; j < trl; j++) {
				if(X.U8(sz) == 0x3F) { sz++; continue }
				sz += 5;
			}
		for(i=0; i < ins; i++) {
			var spls = X.U8(sz+21);
			sz += 22+spls*5;
		}
	}
	title = "";
	for(i=0;i <= ins;i++) { var r = sz;
		while(X.U8(sz) && sz<X.Sz()) sz++;
		if(!i) title = X.SA(r,sz-r); sz++
	}
	if(sz > X.Sz()) bad++;
	return true
}
if(!bDetected && isAHX()) {
	if(fmt === "ahx") {
		sName = "Abyss' Highest eXperience module (.AHX)";
		if(!X.U8(3)) sVersion = "v1.00~1.27"; else sVersion = "v2.0+";
	}
	else
		sName = "Hively Tracker module (.HVL)";
	bDetected = 1;
	if(bad) sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		if(title != "") sOption(title); if(sub) sOption(sub,"×");
		n=0; p = 14+sub*2+ord*8; c = trk*trl; if(!trk0saved) c += trl; hp = false;
		for(i=0;i < c;i++) {
			note = X.U8(p+i*3)>>2; if(note) n++;
			if(note > 60) if(fmt == "ahx") hp = true;
		}
		if(hp) sVersion += "/hi-pitch!"
		if(fmt === "ahx")
			sOption("spd:"+spd+" ord:"+ord+" lp:"+lp+" trk:"+trk+" ins:"+ins+" notes:"+n+" sz:"+outSz(sz))
		else
			sOption("ch:"+chn+" spd:"+spd+" ord:"+ord+" trk:"+trk+" ins:"+ins+" notes:"+n+" sz:"+outSz(sz))
	}
}


function isPha() {
	// ref http://asle.free.fr/prowiz/prowiz.src.zip / r/pha.c
	if(X.Sz() < 0x3C0 || !X.c("000003C0",8)) return;
	//!(X.U8(0) < 0x30 && isWithin(X.U8(2), 0x60,0x80) && X.U8(3) <= 0x40 && X.U8(4) < 0x10 && X.c("00400600", 0x1B6)
	ins = 0; smp = []; var allsmpsz = olds = 0;
	for(p=0; p < 0x1B2; p+=14) {
		if(X.U8(p+3) > 0x40 || (ssz=X.U16(p,_BE)) < X.U16(p+4,_BE)) return; //vol > 64, smpsz < lpstart
		if(!isWithin(sofs=X.U32(p+8,_BE), 0x3C0,X.Sz()) || sofs%2) return; // smpp
		allsmpsz += ssz << 1; if(X.U16(p,_BE)) ins++; if(!smp.includes(sofs)) smp.push(sofs);
		if(p && Math.abs(sofs-olds) > 2) return;
		olds = sofs + (ssz << 1)
	}
	smp = smp.length;
	if(!isWithin(allsmpsz, 3,31*65535)) return;
	var ptnM = 0, ptnm = 0xFFFFFFFF; ptn = [];
	for(p=0x1C0; p < 0x3C0; p+=4) {
		t = X.U32(p,_BE); if(t+2 < allsmpsz+0x3C0 || t > X.Sz()) return;
		ptnM = Math.max(ptnM,t); ptnm = Math.min(ptnm,t);
		if(!ptn.includes(t)) ptn.push(t);
	}
	if(ptnm%2 || Math.abs(0x3C0+allsmpsz-ptnm) > 2) return;
	for(ord=127,p = 0x3B8; p > 0x1C0; p-=4,ord--) if(X.U32(p,_BE) != t) break; else t = X.U32(p,_BE);
	ptn = ptn.length; p = ptnM;
	for(i = 0; i < 0x100; i++) if(X.U8(p) >= 0xC0) { i += 254-X.U8(p+1); p += 2 } else p += 4;
	sz = p;
	return true
}
if(!bDetected && isPha()) {
	sName = "Azatoth/Phenomena's Pha Packer module (.PHA)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption('ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isSTM() {
	//ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_stm.cpp
	t = X.readBytes(0x14,8); for(i = 0; i < 8; i++) { if(t[i] < 0x20 || t[i] >= 0x7F) return false }
	function _isstm() {
		if([0x1A,2].indexOf(X.U8(0x1C)) < 0) return false;
		if([1,2].indexOf(X.U8(0x1D)) < 0) return false;
		if(!X.c("02",0x1E)) return false;
		if([0,10,20,21].indexOf(X.U8(0x1F)) < 0) return false;
		if(X.U8(0x21) > 0x40) return false;
		gvol = X.U8(0x22);
		if(gvol > 0x40 && gvol != 0x58) return false;
		nVm = X.U8(0x1F); ptn = X.U8(0x21);
		if(nVm) maxord = 128; else maxord = 64;
		minsz = 0x30+31*0x20+maxord+ptn*256; if(X.Sz() < minsz) return false;
		smp = 0; ord = -1; tracker = "Sami 'Psi' Tammilehto's Scream Tracker 2 module"; ext = "STM"; return true
	}
	function _isstx() {
		if(!X.c("'SCRM'",0x3C)) return false;
		ptnsz = X.U16(0x1C); if((ptnsz < 64 && ptnsz != 0x1A) || ptnsz > 0x840) return false;
		if(X.U16(0x1E) || X.U32(0x26) || X.U32(0x2C) != 1) return false;
		t = X.U8(0x2A); if(t > 0x40 && t != 0x58) return false;
		ptn = X.U16(0x30); if(ptn > 64) return false;
		smp = X.U16(0x32); if(smp > 96) return false;
		ord = X.U16(0x34); if(ord > 0x81 && ord != 0x101) return false;
		ptntp = X.U16(0x20)<<4; smptp = X.U16(0x22)<<4; chtp = X.U16(0x24)<<4;
		minsz = 0x40 + Math.max(ptntp+ptn*2, smptp+smp*2, chtp+32+ord*5); if(X.Sz() < minsz) return false;
		if(findIntersections([[ptntp,ptn*2], [smptp,smp*2],[chtp,32+ord*5]]).length) return false;
		for(p=chtp+32,i=0; i < ord; i++,p+=5) {
			t = X.U8(p); if(t > 63 && t != 99 && t != 255) return false;
		}
		tracker = "Sami 'Psi' Tammilehto's Scream Tracker Music Interface Kit module"; ext = "STX"; return true;
	}
	isstm = _isstm(); if(!isstm) { isstx = _isstx(); if(!isstx) return false }
	sz = sz1 = minsz; smpn = []; max = 0;

	if(isstm) { //STM things
		for(i = 0; i < 31; i++) {
			zero = X.U8(0x30+i*0x20+12);
			if(zero && zero != 46) return false;
			smpn.push(X.SC(0x30+i*0x20,12,'CP437').trim());
			var sofs = X.U16(0x30+i*0x20+0x0E,_LE) << 4;
			var ssz = X.U16(0x30+i*0x20+0x10,_LE);
			if(ssz && sofs > 0x30 && sofs < X.Sz()) {
				if(ssz) sz1 = sofs+ssz;
				//Actually it seems that if ssz is 1 it still must be 0, but then it'll just ignore
				//  the potentially interesting byte, so let's rip it too, just in case.
				if(sz1 > sz) sz = sz1;
				//We won't count it towards the smp counter though, that one's for the meaningful stuff.
				if(ssz > 1) smp++
			}
		}
		for(i=0; i < maxord; i++) {
			t = X.U8(0x410+i);
			if(t === 99 || t === 255) t = 255;
			else if(t > 63) return false;
			else ord++;
		} ord++;
	}
	else if(isstx) { //STX things
		p = smptp; for(i = 0; i < smp; i++) {
			si = X.U16(p+i*2) << 4;
			smpn.push(X.SC(si+0x30,28,'CP437').trim());
			if(!si) continue;
			if(X.U8(si) === 1) {
				sofs = X.U16(si+14)<<4;
				if(sofs > max) {
					ssz = X.U32(si+16); if(X.U8(si+31)&4) ssz *= 2; //16bit
					//if(ssz%16) ssz += 16-ssz%16; //the padding. Although STM2STX.EXE v1.0 doesn't pad
					max = sofs; if(sz < max+ssz) sz = max+ssz
				}
			}
		}
		fmt = 1;
		if(ptntp && ptnsz != 0x1A) {
			p = X.U16(ptntp) << 4;
			if(p > X.Sz())
				if(X.isHeuristicScan()) {
					bad = bad.addIfNone("!badptnp"); return true
				}
				else return false;
			if(X.U16(p) === ptnsz) fmt = 0;
		}
		for(i=0,p=ptntp; i < ptn; i++,p+=2) {
			if((t=(X.U16(p)<<4)) > X.Sz())
				if(X.isHeuristicScan()) {
					bad = bad.addIfNone("!badptnp"); return true
				}
				if(fmt == 0 && X.U16(t) > 0x840) return false
		} 
	}
	else return false; return true
}
if(!bDetected && isSTM()) {
	sName = tracker+" (."+ext+")"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SC(0,0x14,'CP437'));
		sOptionT(addEllipsis(smpn.filter(funSampleName).join(' ')),'smp/msg: "','"');
		if(ext === "STM") sVersion = "v"+X.U8(0x1E)+"."+nVm;
		else /*STX*/ sVersion = "v1."+fmt;
		tmp0 = X.U8(0x20); gvol = X.U8(0x22);
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" gvol:"+gvol+" sz:"+outSz(sz))
	}
}


function isIT() {
	//from https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_it.cpp et al.
	// Now, this detection is TOO MUCH
	// I'm still going to do as much as I can, but people should have a choice to live without most of it :D
	// Which is to say, do NOT use deepscan unless you need calcsize
	var t = 0;
	if(X.c("'IMPM'")) type = "it";
	else if(X.c("'tpm.'")) type = "mpt";
	else return false;
	ord = X.U16(0x20,_LE); if(!ord) t++;
	ins = X.U16(0x22,_LE); if(ins > 0x63) t++;
	smp = X.U16(0x24,_LE); if(smp > 255) t++;
	ptn = X.U16(0x26,_LE); if(!ptn && !X.isHeuristicScan()) t++;
	if(X.Sz() < 0xC0+4*(ins+smp+ptn)) return false; //itfileheader size
	cwtv /*make*/ = X.U16(0x28,_LE); cmwt /*compat*/ = X.U16(0x2A,_LE);
	flags = X.U16(0x2C,_LE); special = X.U16(0x2E,_LE);
	gvol = X.U8(0x30); if(gvol > 0x80) t++;
	mvol = X.U8(0x31); if(mvol > 0x80) t++;
	spd0 = X.U8(0x32); if(!spd0) t++;
	tmp0 = X.U8(0x33); if(tmp0 < 31) t++;
	sep = X.U8(0x34); if(sep > 0x80) t++;
	msglen = X.U16(0x36,_LE); msgofs = X.U32(0x38,_LE); if(msgofs+msglen > X.Sz()) t++;
	if(t > 2) return false; bad = ""; if(t) bad = bad.addIfNone("!badinitinfo");
	pwd = X.U8(0x35);
	nreserved = X.U32(0x3C,_LE); sreserved = X.SA(0x3C,4);
	tracker = auth = ""; mVlsw = mVcw = sV ="?"; ch = 1; cord = 0; sz = -1;
	var mptp = 0, lastsmpofs = 0; type = "it"; chnm = []; insnlst = []; smpnlst = [];
	if(X.isDeepScan()) {
		//The DeepScan part of the crazily complex Impulse Tracker/MPTM detection
		//Would be much easier if we didn't have to calculate the size! But we do, so there we go.
		const ITSampleSz = 0x50, ITHistorySz = 8, verLoadLimit = 0x1000;
		const sEmbedMsg = 1, sEditHistory = 2, sEmbedPtnHL = 4, sEmbedMIDIC = 8;
		const fEmbedMIDIC = 0x80, fEFR = 0x1000;
		var interpretModPlugMade = false; var FFchnpan = X.fSig(0x40,0x40,"FF") >= 0;
		var mptV = 0;
		function itV(v) { return v.slice(0,1)+'.'+v.slice(1,3)+'.'+v.slice(3,5)+'.'+v.slice(5,7) }

		//TODO this↓ part is not ripper-friendly but thankfully also likely unnecessary:
		if(X.c("'tpm.'")) { type = "mpt";
			p = X.Sz()-4; mptp = X.U32(p,_LE);
			if(X.c("'228'04'mptm'",mptp)) sz = X.Sz(); else mptp = 0;
		} else {
			if(0x888 < cwtv <= 0xFFF) {
				p = X.Sz()-4; mptp = X.U32(p,_LE);
				if(0x100 <= mptp < X.Sz()-4)
					if(X.c("'228'04'mptm'",mptp)) {
						type = "mpt"; sz = X.Sz(); if(cwtv >= verLoadLimit) {
							sV = "future"; charset = "UTF8"; extsmp = 0;  return true }
					} else mptp = 0;
				//if the above fails, there's a near-zero chance the ords will be misread and everything goes oof
				//that's expected behaviour, as the v1.17.02.46 format was experimental :)
			}
			//detecting made-with, part 1 of 3496987
			if(type === "it") {
				if((cwtv & 0xF000) === 0x5000) {
					mptV = (cwtv&0xFFF) << 16;
					if(X.c("'OMPT'",0x3C)) interpretModPlugMade = true;
					else if(mptV >= 0x01290000) mptV |= nreserved & 0xFFFF;
					mVlsw = itV(mptV.toString(16).toUpperCase().padStart(7,'0'));
				} else if(cwtv === 0x888 || cmwt === 0x888) {
					interpretModPlugMade = true; mVlsw = "1.17.00.00";
				} else if(cwtv === 0x214 && cmwt === 0x202 && !nreserved) {
					mVlsw = "1.09.00.00"; tracker = "ModPlug Tracker b3.2 - 1.09";
					interpretModPlugMade = true
				} else if(cwtv === 0x300 && cmwt === 0x300 && !nreserved
							&& ord === 256 && sep === 128 && !pwd) {
					mVlsw = "1.17.02.20"; interpretModPlugMade = true
				}
			}
		}
		var b32ord = -1, lastord = 0;
		// 32bit orders: a deprecated format. OpenMPT 1.17.02.46 - 1.17.02.48.
		if(type === "mpt" && 0x88A < cwtv && cwtv <= 0x88D) {
			p = 0xC0; if(X.U16(p,_LE)) return false; p += 2;
			b32ord = X.U32(p,_LE); p += 4;
			if(b32ord > 256 || X.Sz() < p+b32ord*4) return false
		} else p = 0xC0;
		if(b32ord >= 0) ord = b32ord;
		for(i=0; i < ord; i++)
			if(b32ord < 0) { o = X.U8(p++);
				if(o === 0xFE) lastord = 0xFFFE; else { cord++; if(o === 0xFF) lastord = 0xFFFF } }
			else { o = X.U32(p,_LE); p += 4; lastord = o; cord++ }

//_log("read pointers & find the smallest @"+Hex(p));
		//TODO maybe, at some point in the future, autodetect b32ord
		//by making sure these pointers actually lead to intended things, and trying the b32 way if not
		minp = 0xFFFFFFFF;
		var insp = []; for(i=0; i < ins; i++) { t = X.U32(p,_LE); p += 4;
			if(t <= p || t > X.Sz()) return false;
			q = X.readBytes(t+0x20,0x1A,true); q = decEncoding(q,CP437,false).trim(); if(q != "") insnlst.push(q);
			if(sz < t) sz = t;  if(t && t < minp) minp = t; insp.push(t) }
		var smpp = []; for(i=0; i < smp; i++) { t = X.U32(p,_LE); p += 4;
			if(t > X.Sz()) bad = bad.addIfNone("!short");
			q = X.readBytes(t+0x14,0x1A,true); q = decEncoding(q,CP437,false).trim(); if(q != "") smpnlst.push(q);
			if(sz < t) sz = t; if(t && t < minp) minp = t; smpp.push(t) }
		var ptnp = []; for(i=0; i < ptn; i++) { t = X.U32(p,_LE); p += 4;
			if((t > 0x1E && t <= p) || t > X.Sz()) return false;
			if(sz < t) sz = t; if(t && t < minp) minp = t; ptnp.push(t) }
		if(special & sEmbedMsg) { minp = Math.min(minp,msgofs);
			if(sz < msgofs+msglen) sz = msgofs+msglen }
		var possiblyUNMO3 = cmwt === 0x214 && (!cwtv || cwtv === 0x214)
		  && !X.U16(0x1E) && !pwd && !nreserved && !(flags & 0xC0);
		if(possiblyUNMO3 && !ins && smp && p+4*smpp.length+2 <= minp) {
			var oldUNMO3 = true;
			for(i=0; i < smp; i++)
				if(X.U32(p)) { oldUNMO3 = false; p -= i*4; break } else p += 4;
			if(oldUNMO3) tracker = "UNMO3 <= v2.4";
		}
		if(possiblyUNMO3 && !cwtv) tracker = "UNMO3 v0/1";
		if(special & sEditHistory) {
			//is edit history stored?
			var nflt = X.U16(p);
			if(X.Sz() > p+nflt*8 && p+nflt*8 <= minp) {
				p += 2+nflt*8;
				if(possiblyUNMO3 && !nflt)
					if(special & sEmbedPtnHL) tracker = "UNMO3 <= 2.4.0.1";
					else tracker = "UNMO3"
			}
		} else if(possiblyUNMO3 && special <= 1 && !X.U16(p)) {
			tracker = "UNMO3 <= 2.4"; p += 2
		}
		var hasMIDIC = (flags & fEmbedMIDIC) || (special & sEmbedMIDIC), u = 0;
		if(hasMIDIC) p += 0x1320; if(p > X.Sz()) return false;
//_log("chunks expected @"+Hex(p));
		var isBeroTracker = hasPluginChunks = hasMPTM = false;
		while(p+9 < X.Sz()) {
			hkhd = X.SA(p,4); hksz = X.U32(p+4,_LE);
//_log(hkhd+":"+Hex(p));
			if(hkhd === "MODU") isBeroTracker = true;
			else if(hkhd === "CNAM") { ch = hksz/20; u = p+8; hasMPTM = true;
				for(i = 0; i < ch; i++) {
					t = X.SA(u,20).trim(); u += 20;
					if(t != "") chnm.push(t);
				}
			}
			else if(hkhd === "PNAM") hasMPTM = true;
			else if(hkhd === "CHFX" || /F[X0-9]\d\d/.test(hkhd)) hasPluginChunks = true;
			if(["IMPI","IMPS","XTPM","STPM"].indexOf(hkhd) >= 0
			  || p+8+hksz > X.Sz() || p >= msgofs)
				break;
			//PNAM may have fun info but that's for when someone feels less tedium otherwise
			else p += 8+hksz
		}
		if(cwtv === 0x217 && cmwt === 0x200 && !nreserved && !isBeroTracker) {
			if(hasMPTM || (ord > 0 && lastord == 0xFFFF) || FFchnpan) {
				mVlsw = "1.16.00.00"; tracker = "ModPlug Tracker 1.09-16";
			} else {
				mVlsw = "1.17.00.00"; tracker = "OpenMPT 1.17 (compat.export)";
			}
			interpretModPlugMade = true
		}

		var lastsmpofs = (smp > 0 ? smpp[smp-1]+ITSampleSz : p); var lastsmpco = false;

// Deriving the size of just the last sample (it might already be tasking indeed)
		const/*for IT sample flags*/ s16b=2,sSt=4,sCo=8;
		const/*for cvt flags*/ cSS=1,cBE=2,cD=4,cTo16=8,cOPL=0x40,cExt=0x80,cPCM=0xFF;
		 //Possible codec values:
		 //"sPCM" "uPCM" "dPCM" "fPCM" "IT214" "IT215" "AMS" "DMF" "MDL" "8d16"
		 //"ADPCM" "MT2" "fPCM15" "fPCM23" "fPCMn" "sPCMn" "uLaw" "aLaw"
		extsmp = []; var possibleXMconv = false;
		Ss = []; //for gathering all info
		maxsmpofs = -1;
		for(i=0; i < smp; i++) {
			if(!smpp[i]) continue;
			if(smpp[i] > X.Sz()) { bad = bad.addIfNone("!short"); continue }
			if(!X.c("'IMPS'",smpp[i])) bad = bad.addIfNone("!badsmp");
//_log(X.SA(smpp[i]+4,13)+": "+decAnsi(smpp[i]+0x14,0x1A,CP437,false).trim()+" @"+Hex(smpp[i]))
			var sf = X.U8(smpp[i]+0x12); var cvt = X.U8(smpp[i]+0x2E);
			var slen = X.U32(smpp[i]+0x30); var smpofs = X.U32(smpp[i]+0x48);
			S = { "ofs":0, "slen":0,
				"bits":(sf & s16b)? 16 : 8, "chn":1,// 1 channel if mono, 2 if joint or split stereo
				"en":"LE","codec":"sPCM","bps":0,"length":0 //length is calculated from length in samples
			};
			p = smpofs; S["ofs"] = smpofs; S["slen"] = slen;
			if(cvt === cOPL) p += 12;
			else if(cvt === cExt) {
				t = readVarUInt(p); extsmp.push(X.SA(p+1,t[1]));
				p += t[0]+t[1]; }
			else if(X.c("'fLaC'",smpofs)) { S["codec"] = "FLAC" }
			else if(X.c("'OggS'",smpofs)) { S["codec"] = "Ogg" }
			else { //GetSampleFormat
				S["codec"] = (cvt & cSS) ? "sPCM" : "uPCM";
				if((sf & sSt) && cwtv >= 0x214) S["chn"] = 2;
				if(sf & sCo)
					S["codec"] = (cvt & cD) ? "IT215" : "IT214";
				else {
					if(!(sf & s16b) && cvt == cPCM) S["codec"] = "ADPCM";
					else {
						if(cvt & cBE) S["en"] = "BE";
						if(cvt & cD) S["codec"] = "dPCM";
						if(cvt & cTo16) S["codec"] = "8d16"
					}
				}
				switch(S["codec"]) {
				case "sPCM": case "uPCM": case "dPCM": case "fPCM": case "MT2": case "fPCM15":
				case "fPCM23": case "fPCMn": case "sPCMn": S["bps"] = S["bits"]; break;
				case "8d16": S["bps"] = 16; break;
				case "ADPCM": S["bps"] = 4; break; //encoded header size for this one is 16, 0 otherwise
				case "uLaw": case "aLaw": S["bps"] = 8; break;
				//case "IT214": case "IT215": case "AMS": case "DMF": case "MDL": S["bps"] = 0; //and
				default: S["bps"] = 0 //variable length-encoded
				}
				if(!S["bps"]) lastsmpco = true; //...and we'll decompress it further down
				else {
					S["length"] = slen*S["chn"]*(S["bps"]>>3);
					p += S["length"];
				}
				Ss[i] = S;
			} //GetSampleFormat
			if(lastsmpofs < p) lastsmpofs = p; if(sz < lastsmpofs) sz = lastsmpofs;
			if(S["codec"] === "uPCM" && slen) possibleXMconv = true;
//_log(X.SA(smpp[i]+0x14,0x1A)+" @"+Hex(smpofs)+": sf:"+Hex(sf)+" ["+S["codec"]+"] slen:"+slen+" ch:"+S["chn"]+" bps:"+S["bps"]+" bits:"+S["bits"]+", ends @"+Hex(smpofs+S["length"]));
		}
// Load_it.cpp:845
		if(possibleXMconv && cwtv === 0x204 && cmwt === 0x200 && !special && !nreserved
		  && (flags & (~8)) === 0x15 && gvol === 128 && mvol === 48
		  && sep === 128 && !pwd && !msglen) {
			for(i=0; i < 64; i++) if([0x20,0x40].indexOf(X.U8(0x40+i)) < 0) {
				possibleXMconv = false; break } //testing pans
			if(possibleXMconv) for(i=0; i < 64; i++) if(X.U8(0x80+i) != 0x40) {
				possibleXMconv = false; break } //testing vols
			if(possibleXMconv) for(i=20; i < 26; i++) if(X.U8(4+i)) {
				possibleXMconv = false; break } //testing songname
			if(possibleXMconv) tracker = "XM Conversion"
		}
// Load_it.cpp:885 :: Scan all of the patterns to see how many channels we need
		for(i=0; i < ptn; i++) { t = ptnp[i];
			if(!t || t > X.Sz()) continue;
			var len = X.U16(t,_LE), rows = X.U16(t+2,_LE); t += 4;
			if(!rows || rows > 0x400 || t+4 > X.Sz()) continue; p = t+4;
			var chnMask = [], row = 0;
			while(row < rows && p < X.Sz()) {
				var y = X.U8(p++); if(!y) { row++; continue }
				var c = y&0x7F; if(c) c--;
				if(y&0x80) chnMask[c] = X.U8(p++);
				if(chnMask[c] & 0x0F) if(ch <= c && c < 0x7F) ch = c+1;
				if(chnMask[c] & 1) p++;  if(chnMask[c] & 2) p++;
				if(chnMask[c] & 4) p++;  if(chnMask[c] & 8) p += 2;
			}
			if(lastsmpofs < p) lastsmpofs = p; if(sz < lastsmpofs) sz = lastsmpofs
		}
		if(!ch) ch = 1;
//find the expected length of the final compressed sample
		if(lastsmpofs) { p = lastsmpofs;
			if(lastsmpco) {
				S = Ss[Ss.length-1];
				//smp length calc
				if(S["bps"])
					if(S["bps"]%8) S["length"] = (S["codec"] == "ADPCM"?16:0)
							+Math.ceil((slen+1)/2*S["ch"]);
					else S["length"] = (S["codec"] == "ADPCM"?16:0)
							+S["slen"]*S["bps"]/8*S["chn"];
				else { //let the crazy shit begin.
					// ref https://github.com/nicolasgramlich/AndEngineMODPlayerExtension/blob/master/jni/loaders/itsex.c
					// but mainly OpenMPT's SampleIO::ReadSample :142
					if(S["bps"] == 4 && S["chn"] == 1 && S["en"] == "LE" && S["codec"] == "ADPCM") {
						S["length"] = 16+(S["slen"]+1)/2; p += S["length"]
					} else if(S["slen"] > 1 && (S["codec"] === "IT214" || S["codec"] === "IT215")) { //:165
						// Let's try a quick-n-dirty first.
						var u = p, ulen = 0, quickndirty = 0;
						while(u < X.Sz() && ulen < S["slen"] /*packers have their limits*/) {
							if(X.c("'XTPM'",u) || X.c("'STPM'",u) || X.c("'228'04'mptm'",u))
								{ quickndirty = 1; p = u; break }
							ucsz = X.U16(u,_LE); ulen += ucsz; u += 2+ucsz;
						}
						if(quickndirty) { p = u } else {
						//orrrr if no MPTX block is present, we gotta do it the hard way I guess :<
						//ITDecompression(file,sample,getencoding=it215)
						var bit_n = bit_buf = cend = readdef = 0;
						function readBits(b) {
							while(bit_n < b) { bit_buf |= Util.shlu64(X.U8(p++),bit_n); bit_n += 8 }
							var v = bit_buf & (Util.shlu64(1,b) - 1); bit_buf = Util.shru64(bit_buf,b); bit_n -= b;
							//if(p <= X.Sz()) return v; else return 0 }
							return v }

						if(S["bits"] == 16) { fetchA=4, lowerB=-8, upperB=7, defW=17 }
						else { fetchA=3, lowerB=-4, upperB=3, defW=9 }
						for(c = 0; c < S["chn"]; c++) { //ITCompression.cpp:322
							var rs = S["slen"], v = csz = clen = topbit = 0;
							cend = p;
							while(rs && p < X.Sz()) { //:325
								csz = X.U16(p,_LE); p += 2; cend = p+csz;
								if(!csz) { readdef = 10; _log("IT @"+Hex(p)+" malformed sample?"); continue }
								if(cend > X.Sz()) { c = 0xE0F; bad = bad.addIfNone("!short"); break }
								clen = Math.min(rs, 0x8000>>(S["bits"]>>4));
								var w = defW; bit_buf = bit_n = 0;
								while(clen && p < X.Sz()) { //:357
									if(w > defW) {
//_log("! IT @"+Hex(p)+" w="+Hex(w)+" > "+defW+" rs:"+rs+" clen:"+Hex(clen)+" cend:"+Hex(cend));
										bad = bad.addIfNone("!badITsmp"); rs = 0; break }
									v = readBits(w); topbit = 1<<(w-1);
									if(w < 7) {
										if(v == topbit) {
											v = readBits(fetchA)+1; if(v >= w) v++; w = v; continue
										}
									} else if(w < defW) {
										if(v >= topbit+lowerB && v <= topbit+upperB) {
											v -= topbit-1+lowerB; if(v >= w) v++; w = v;
											continue
										}
									} else if(v & topbit) { w = (v&0xFF)+1; continue }
									clen--; rs--
								}
							}
							if(p > X.Sz()) bad = bad.addIfNone("!short");
						} } //if quickndirty else
					} //if IT215||IT214
					else if(S["codec"] === "FLAC") {
						//TODO, or maybe not
					} else if(S["codec"] === "Ogg") {
						//TODO, or maybe not
					} else if(S["codec"] === "AMS" && S["chn"] == 1) { //SampleIO:170
						//TODO test it at least
						sOption("\n!!! Please send this file to the detector dev!!! Poor fella hasn't any to test on")
						var srcsz = X.U32(p+4,_LE), pc = X.U8(p+8);
						S["length"] = srcsz+9
					} else if(S["codec"] === "8d16" && S["chn"] == 1 && S["bps"] == 16) {
						sOption("\n!!! Please send this file to the detector dev!!! Poor fella hasn't any to test on")
						//TODO CopyMonoSample<SC::DecodeInt16Delta8>(sample, source, fsize)
					} else if(S["codec"] === "MDL" && S["chn"] == 1 && S["bps"] <= 16) {
						var srcsz = X.U32(p); S["length"] = 4+srcsz
					} else if(S["codec"] === "DMF" && S["chn"] == 1 && S["bps"] <= 16) {
						sOption("\n!!! Please send this file to the detector dev!!! Poor fella hasn't any to test on")
						//TODO DMFUnpack, or not to do
					} else if((S["codec"] === "uLaw" || S["codec"] === "aLaw") /*TODO && mono or stereoInterleaved */ && S["bps"] == 16) {
						S["length"] = S["slen"]*S["chn"]
					}
				} //actual length teller
				if(sz < p) sz = p
			}
		}
		var bLoadXIProps = false;
		if(X.c("'XTPM'",p)) { // 'MPTX'
			p += 4;
			while(p+6 < X.Sz()) {
				t = X.SA(p,4); it = X.U32(p);
				if(t === "STPM" || t === "228\x04" || (it&0x80808080) || !(it&0x60606060)) break;
				var prsz = X.U16(p+4,_LE); p += 6;
				for(i=0; i < ins; i++) p += prsz
			}
			bLoadXIProps = true;
			if(sz < p) sz = p;
		}
// Load_it.cpp:978
		interpretModPlugMade |= bLoadXIProps;
// Load_it.cpp:985
		if(X.c("'STPM'",p)) {
			p += 4;
			while(p+7 < X.Sz()) {
				t = X.SA(p,4); it = X.U32(p);
				prsz = X.U16(p+4,_LE);
				if(t === "228\x04" || t == "228\x02") { mptp = p; break; } //TODO check for 228\x02TC!
				if((it&0x80808080) || !(it&0x60606060) || p+6+prsz > X.Sz()) break;
				p += 6;
				switch(t) {
				case "...C": var chn = 0;
					switch(prsz) {
					case 2: chn = X.U16(p,_LE); break; case 3: chn = X.U24(p,_LE); break;
					case 4: chn = X.U32(p,_LE); break; default: chn = X.U8(p) }
					if(chn > ch) ch = chn; break;
				case ".VWC": var v = 0;
					switch(prsz) {
					case 1: v = X.U8(p); break; case 2: v = X.U16(p,_LE); break;
					case 3: v = X.U24(p,_LE); break; case 8: v = X.U64(p,_LE); break;
					default: v = X.U32(p,_LE) }
					if(v) mVcw = itV(v.toString(16).toUpperCase().padStart(7,'0')); break;
				case "VWSL": var v = 0;
					switch(prsz) {
					case 1: v = X.U8(p); break; case 2: v = X.U16(p,_LE); break;
					case 3: v = X.U24(p,_LE); break; case 8: v = X.U64(p,_LE); break;
					default: v = X.U32(p,_LE) }
					if(v) mVlsw = itV(v.toString(16).toUpperCase().padStart(7,'0')); break;
				case "AUTH":
					auth = X.SC(p,prsz,"UTF8"); break;
				}
				p += prsz;
			}
			if(sz < p) sz = p;
		}

		tunings = 0;
		if(X.c("'HSCT'",p)) { //the first-ever way of storing the tunings in an mptm
//tuningCollection.cpp
			var skip = false; var v = X.I32(p+4,_LE); p += 8;
			if(v == 1) { //can't find any files to test  this
				sOption("Please send this file to the detection author!!! This is ultra-rare, how did you make it?!");
				p += X.U32(p); p += 4+Math.min(256,l)
			} else if( v == 2 ) {
//_log("tunings text: "+X.UCSD(p));
				p += 1+X.U8(p);
			} else { skip = true; bad = bad.addIfNone("!badtuningver") }
			if(!skip) {
				tunings = X.U32(p+2); p += 6;
				t = X.fSig(p,0x1000,"'FSCT'"); if(t >= p) p = t+4;
			}
			if(sz < p) sz = p;
		}
		else if(X.c("'228'04'mptm'",p)) { //TODO there can be old-ass tunings instead here
			if(!mptp) mptp = p;
// Load_it.cpp:1299
			function readaintle(bits) { //ReadAdaptiveInt32LE et al.
				var b = 0, add = 0, r = 0, oldp = p;
				if(p+1 < X.Sz()) {  b = X.U8(p++);
					if(bits == 16) add = b & 1;  else if(bits == 32) add = b & 3;
					else if(bits == 64) add = (1<<(b&3))-1;  else return 0;
					if(bits == 16) r = b >> 1;  else r = b >> 2;
					for(var i=0; i < add; i++) {  b = 0;
						if(p+1 < X.Sz()) { b = X.U8(p++); r |= b << ((i+1)*8-2);
						} else return 0 }
				} else return 0;
				return r
			}
// serialization_utils.cpp:399
			function mptBeginRead() {
				if(!X.c("'228'",p)) return false; posstart = p; p += 3;
				var l = X.U8(p++); h = X.SA(p,l); p += l;
				flagbyte = 0; hd = X.U8(p++);
				idbytes = ((hd & 3) === 3) ? 4 : (hd & 3); twochar = hd&(1<<6);
				hsz = readaintle(32);
				if(hsz > 1) { t = X.U8(p++); if(!t) flagbyte = X.U8(p); p += hsz-1 }
				if(hd & (1<<4)) t = readaintle(64); var srlV = itV(t.toString(16).toUpperCase().padStart(7,'0'));
				if(mVlsw === "?") mVlsw = srlV+"[mptinfo]";
				if(hd & (1<<5)) p += X.U8(p++); //:477
				if(flagbyte & 1) { t = X.U8(p++);
					if(t&1) idbytes = 65535; else idbytes = t >> 1 }
				fes = 0; if(flagbyte & (1<<1)) fes = readaintle(32); //:496
				hasstartpos=hd&(1<<2); hassz=hd&(1<<3); hasid=idbytes; hasdesc=hd&(1<<7);
				hasmap = hasid || hasstartpos || hassz || hasdesc;
				if(flagbyte&(1<<2)) { t = readaintle(16); //:512
//_log("  @"+Hex(p)+" desc["+t+"]:"+(twochar ? X.SC(p,t,"UTF8") : X.SA(p,t)));
				   p += t*(twochar ? 2 : 1) }
				if(flagbyte&(1<<3)) p += 5; //:517
				entries = readaintle(64); //if(entries > 16000) break;
				if(hasmap) t = readaintle(64); if(p > X.Sz()) return false; //:533
				//endOfHdrData = rposEndOfHdrData = p-posstart;
				rposMapBegin = hasmap ? t : p-posstart;
				return true
			}

			if(mptBeginRead()) {
// serialization_utils.cpp:558
//I've left the pieces of map code intact in case there's fun in finding out what MPT-only tweaks there are
				if(hasmap || fes) {
					p = posstart+rposMapBegin;
					//var idArray = [], mapdata = [];
					for(i=0; i < entries && p < X.Sz(); i++) {
						var idsz = idbytes;
						if(idsz == 65535) idsz = readaintle(16);
						// md = {"idlen":idsz, "idpos":oldEnd, "id:":"", "rposst":0, "rposend":0, "sz":-1 }
						// var oldEnd = mapdata.length; if(idsz) md["id"] = X.SA(p,idsz);
						p += idsz;
						if(hasstartpos) /*md["rposst"] =*/ readaintle(64);
						if(!fes) { if(hassz) /*md["sz"] =*/ readaintle(64) } //else md["sz"] = fes
						// if(md["sz"] >= 0 && !hasstartpos)
						//     md["rposst"] = !i ? 0 : mapdata[i-1]["rposst"] + mapdata[i-1]["sz"];
						if(hasdesc) { t = readaintle(16); p += t*(twochar ? 2 : 1) }
						//mapdata.push(md)
					}
				} //posmapend = p
			}
			if(sz < p+4) sz = p+4; if(X.U32(p,_LE) != mptp) bad = bad.addIfNone("!badmptptr");
		} //if 228.mptm

// Load_it.cpp:1158
		if(mVlsw === "?" && cwtv === 0x888) mVlsw = "1.17.00.00";
		if(mVlsw != "?" && tracker === "") {
			tracker = "OpenMPT";
			//not sure how many people care about these but...
			isCompatX = (cwtv&0xF000) === 0x5000;
			if(mVlsw === "1.17.00.00" && sreserved != "OMPT") isCompatX = false;
			if(isCompatX) tracker += " (compat. export)";
			else if((mVlsw > "1.17.02.54" && mVlsw < "1.18.02.00" && mVlsw != "1.18.00.00")
			  || (mVlsw > "1.18.02.00" && mVlsw.slice(mVlsw.length-2,mVlsw.length) != "00"))
				tracker += " (test build)"
		}
		else {
			var STdv = 734016 + (cwtv === 0x1FFF ? nreserved : cwtv-0x1050);
			switch(cwtv >> 12) {
			case 0:
				if(isBeroTracker) tracker = "BeRoTracker";
				else if(cwtv === 0x214 && cmwt === 0x200 && flags === 9 && !special
				  && !X.U16(0x3E) && !ins && ptn+1 === ord && gvol === 128 && mvol === 100
				  && spd === 1 && sep === 128 && !pwd && !msglen && !msgofs && !nreserved)
					tracker = "OpenSPC conversion";
				else if(cwtv === 0x214 && cmwt === 0x200 && !X.U16(0x3E) && !nreserved) {
					mVlsw = "1.00.00.A5"; tracker = "ModPlug Tracker 1.00a5"; interpretModPlugMade = true
				} else if(cwtv === 0x214 && cmwt === 0x214 && sreserved === "CHBI")
					tracker = "ChibiTracker";
				else if(cwtv === 0x214 && cmwt === 0x214 && special <= 1 && !pwd && !nreserved
				  && (flags&0x10A6) === 4 && smp > 1 && X.c("'XXXXXXXX.YYY'",smpp[1]+4))
					tracker = "CheeseTracker";
				else if(!cwtv && tracker === "") tracker = "Unknown";
				else if(cmwt < 0x300 && tracker === "") {
					if(cmwt > 0x214) tracker = "Impulse Tracker 2.15";
					else if(isWithin(cwtv,0x215,0x217))
						tracker = 'Impulse Tracker 2.14p'+(cwtv == 0x215? '1-2': cwtv == 0x216? '3': '4-5');
					else tracker = 'Impulse Tracker '+((cwtv&0xF00)>>8)+'.'+(cwtv&0xFF).toString(16).padStart(2);
					//a good place to find the total edit time if you care
				}
				break;
			case 1:
				// function SchismEpoch(y,m,d) { var mm = (m+9)%12; var yy = y-mm/10;
				//     return yy*365 + yy/4 - yy/100 + yy/400 + (mm*306+5)/10 + d-1 }
				var mk = cwtv & 0xFFF;
				if(mk <= 0x50) tracker = "Schism Tracker 0."+mk.toString(16);
				else {
					var dt = 734016 + (mk < 0xFFF ? mk-0x050 : nreserved);
					var y = Util.div64(dt*10000+14780, 3652425);
					var ddd = dt - (365*y + Util.div64(y,4) - Util.div64(y,100) + Util.div64(y,400));
					if(ddd < 0) { y--; ddd = dt - (365*y + Util.div64(y,4) - Util.div64(y,100) + Util.div64(y,400)) }
					var mi = Util.div64(100*ddd+52, 3060);
					tracker = "Schism Tracker "+(y+Util.div64(mi+2,12)).padStart(4,'0')+"-"
						+((mi+2)%12+1).padStart(2,'0')
						+"-"+(ddd - Util.div64(mi*306+5,10) + 1).padStart(2,'0')
				} break;
			case 4: tracker = "pyIT "+((cwtv&0xF00)>>8)+"."+((cwtv&0xFF).toString(16)); break;
			case 6: tracker = "BeRoTracker"; break;
			case 7:
				if(cwtv === 0x7FFF && cmwt === 0x215) tracker = "munch.py";
				else tracker = "ITMCK "+((cwtv>>8)&0xF)+"."+((cwtv>>4)&0xF)+"."+(cwtv&0xF);
				break;
			case 0xD:
				if(cwtv == 0xDAEB) tracker = "spc2it";
				else if(cwtv == 0xD1CE) tracker = "itwriter";
				else tracker = "unknown";
			}
		}
	} //if isDeepScan
	if(mVlsw != "?") { charset = 'CP1252'; if(mVcw == "?") sV = mVlsw; else if(mVcw != mVlsw) sV = "cw:"+mVcw+"/lsw:"+mVlsw; else sV = mVcw }
	else { charset = 'CP437'; if(mVcw != "?") sV = mVcw }
	var badc = 0; for(i=0;i<bad.length;i++) if(bad[i] == "!") badc++;
	if(badc < 3) return true
}
if(!bDetected && isIT()) {
	if(type === "it") sName = "Impulse Tracker module (.IT)";
	else /*if(type === "mpt")*/ sName = "OpenMPT module (.MPTM)";
	//else if(type === "alike") sName = "Impulse Tracker-alike ["+X.SA(0,4)+"] module (.IT?)";
	bDetected = 1;
	if(sV != "?") sVersion = "v."+sV; if(bad != "") sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		sOptionT(decAnsi(4,26,charset));
		if(X.isDeepScan()) {
			sOption(tracker,"in: ");
			sOptionT(auth,"by: ")
			sOption(addEllipsis(extsmp.join(", "),0x40,0x30),'ext.smp: "','"');
			sOption(addEllipsis(chnm.join(", "),0x50,0x30),'ch.names: "','"')
		}
		if(special & 1)
			sOptionT(addEllipsis(X.SC(msgofs,Math.min(msglen,0x100),'CP437'),0xC0),'msg: "','"');
		sOption(addEllipsis(insnlst.filter(funSampleName).join(" "),0x80,0x30),'ins/msg: "','"');
		sOption(addEllipsis(smpnlst.filter(funSampleName).join(" "),0x80,0x30),'smp/msg: \"','"');
		if(X.isDeepScan())
			sOption('bpm0:'+tmp0+' spd0:'+spd0+' ch:'+ch+' ord:'+ord+(ord != cord?'('+cord+')':'')
				+' ptn:'+ptn+' ins:'+ins+' smp:'+smp+(tunings?"tunings:"+tunings:"")+" sz:"+outSz(sz))
		else
			sOption('bpm0:'+tmp0+' spd0:'+spd0+' ch:'+ch+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp:'+smp)
	}
}


function isJ2B() {
	if(X.c("'RIFF'........'AM  '")) align = 1;
	else if(X.c("'RIFF'........'AMFF'")) align = 0;
	else return false; if(!X.c("C5",0x58)) return false;
		sz = X.U32(4,_LE)+8; p = 0x0C; ok = ord = ptn = smp = ins = 0; mptn = -1;
		insts = []; t = "";
		while(p < sz && p < X.Sz()) {
			hkhd = decAnsi(p,4,'CP437',false); hksz = X.U32(p+4,_LE); p += 8;
			switch(hkhd) {
			case "INIT": case "MAIN": ok=1; break;
			case "ORDR": ord = hksz; loop = X.U8(p);
				for(i=p+1; i<p+hksz; i++) if(mptn < X.U8(i)) mptn = X.U8(i); mptn++; break;
			case "PATT": ptn++; break;
			case "RIFF": smp++; break;
			case "INST": ins++;
				t = X.readBytes(p+2,25,true); t = decEncoding(t,'CP437').trim();
				if(t != "") insts.push(t.trim());
				insn = X.U8(p+1); subsmp = X.U16(p+30,_LE);
				q = p+0xE1;
				while(q < p+hksz) {
					hhd = decAnsi(q,4,CP437); hsz = X.U32(q+4); q += 8;
					if(hhd == "SAMP") smp++;
					t_ = decAnsi(q,0x100,CP437);
					q += hsz;
if(debug>0)if(q < p+hksz && ["SAMP","INST"].indexOf(decAnsi(q,4,'CP437')) < 0) _log(" | ^WTF J2B @"+Hex(q-hsz)+"->"+Hex(q))
				}
				break
			}
			p += hksz+align*(hksz&1)
		}
	if(p > sz || !ok || !ord || !ptn || (!smp && !ins)) return false;
	return true
}
if(!bDetected && isJ2B()) {
	sName = "Jazz Jackrabbit 2/Galaxy Sound System module (.J2B)"; sVersion = "v."+(align?"__":"FF"); bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SA(0x14,64));
		sOptionT(addEllipsis(insts.join('\n'),0x100,0xA0),'msg:"','"');
		sOption("ord:"+ord+" loop:"+loop+" ptn:"+mptn+(mptn!=ptn ? "/"+ptn : "")
			+(ins?" ins:"+ins:"")+(smp?" smp:"+smp:"")+" sz:"+outSz(sz))
	}
}


function isRHST() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/RobHubbard_ST/src/Rob%20Hubbard%20ST_v2.asm
	 if(!X.c("00407F40 00C081C0") || !X.c("41FAFFEE",0x38)) return false;
	p = 180; const max = Math.min(0x10000,X.Sz());
	do { t = X.U16(p,_BE); p += 2 } while(p < max && t != 0x4E75); //findplay 
	if(p > max) return false;
	playp = p;
	do { t = X.U16(p,_BE); p += 2 } while(p < max && t != 0xDFFC); //findend
	if(p > max) return false;
	p += 4; endp = p;
	do { t = X.U16(p,_BE); p += 2 } while(p < max && t != 0x4E75); //findinit
	if(p > max) return false;
	do { t = X.U16(p,_BE); p += 2 } while(p < max && t != 0x7E02); //findIt1
	if(p > max) return false;
	songp = p+X.U16(p+2,_BE)+2;
	d0 = X.U32(songp,_BE)>>2; x = d0/3;
	a1 = p = songp;
	for(d5=0; d0--;) { //find the max ptr
		p = songp+X.U32(a1,_BE); a1 += 4;
		while(p < max) { t = X.U32(p,_BE); p += 4; if(!t) break; if(t > d5) d5 = t }
	}
	sz = songp+d5;
	do t = X.U8(sz++); while(t != 0x87);
	return true
}
if(!bDetected && isRHST()) {
	sName = "Rob Hubbard ST module (.RHO)"; sVersion = "v1.1"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");	
		sOption(outSz(sz),"sz:")
	}
}

function isASC1() { //basically ASC0 + loop pos
	//ref https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundASC1
	if(X.Sz() < 9) return false;
	ptntp = X.U16(2,_LE); ord = X.U8(8); //patterns table ptr & num of positions
	if(ptntp-ord != 9 && ptntp-ord != 72) return false;
	smptp = X.U16(4,_LE); if(smptp > X.Sz()) return false; //samples table ptr
	orntp = X.U16(6,_LE); if(orntp > X.Sz()) return false; //ornaments table ptr
	if(X.U16(smptp,_LE) != 0x40 || X.U16(orntp,_LE) != 0x40) return false;
	ptn = 0; for(i=0; i < ord; i++) { p = X.U8(9+i); if(ptn < p) ptn = p }
	ptn++; if(X.U16(ptntp,_LE) != ptn*6) return false;
	j = X.U16(orntp+0x40-2,_LE)+orntp;
	while((j < X.Sz()) && (j < 65535) && !(X.U8(j)&0x40))  j += 2;
	bad = '';
	if(j > 65534 || j >= X.Sz())
	  if(X.isHeuristicScan()) bad = '/malformed!short';
	  else return false;
	sz = j+2; delay = X.U8(0); loop = X.U8(1);
	return true
}
if(!bDetected && isASC1()) {
	sName = "A.'Andrew Strikes Code' Sendetskii/Power of Sound's ASC/Advanced Sound Master module (.ASC)"; sVersion = 'v1.x-2.x'+bad; bDetected = 1;
	//TODO find out how exactly to credit this one
	if(X.isVerbose()) {
		pt = X.fSig(8,0x80,"'ASM COMPILATION OF '")+0x13;
		if(pt > 8) {
			pa = X.fSig(pt+0x13,0x20,"' BY '");
			sOptionT(X.SA(pt,pa-pt)); sOptionT(X.SA(pa+4,0x14),'by: ')
		}
		sOption('ord:'+ord+' ptn:'+ptn+' delay:'+delay+' loop:'+loop+' sz:'+outSz(sz))
	}
}


function isASC0() {
	//ref https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundASC0
	if(X.Sz() < 8) return false;
	ptntp = X.U16(1,_LE); ord = X.U8(7); //patterns table ptr & num of positions
	if(ptntp-ord != 8 && ptntp-ord != 71) return false;
	smptp = X.U16(3,_LE); if(smptp > X.Sz()) return false; //samples table ptr
	orntp = X.U16(5,_LE); if(orntp > X.Sz()) return false; //ornaments table ptr
	if(X.U16(smptp,_LE) != 0x40 || X.U16(orntp,_LE) != 0x40) return false;
	ptn = 0; for(i=0; i < ord; i++) { p = X.U8(8+i); if(ptn < p) ptn = p; }
	ptn++; if(X.U16(ptntp,_LE) != ptn*6) return false;
	j = X.U16(orntp+0x40-2,_LE)+orntp;
	while((j < X.Sz()) && (j < 65535) && !(X.U8(j)&0x40))  j += 2;
	bad = '';
	if(j > 65534 || j >= X.Sz())
		if(X.isHeuristicScan()) bad = '/malformed!short';
		else return false;
	sz = j+2; delay = X.U8(0);
	return true
}
if(!bDetected && isASC0()) {
	bDetected = 1; sVersion = 'v0.x'+bad;
	sName = "Andrei 'Andrew Strikes Code' Sendetskii/Titus's Advanced Sound Master module (.AS0)";
	if(X.isVerbose()) {
		pt = X.fSig(7,0x80,"'ASM COMPILATION OF '")+0x13;
		if(pt > 7) {
			pa = X.fSig(pt+0x13,0x20,"' BY '");
			sOptionT(X.SA(pt,pa-pt)); sOptionT(X.SA(pa+4,0x12),'by: ')
		}
		sOption('ord:'+ord+' ptn:'+ptn+' delay:'+delay+' sz:'+outSz(sz))
	}
}


function isGlobalTracker() {
//ref https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundGTR
	if(X.Sz() < 296) return;
	p = 0x29; var adr = X.U16(5), mp = 0, old = X.U16(p-2)-adr, t;
	for(i=0; i < 14; i++) { t = X.U16(p)-adr; //sample ptrs check
		if(t-old < 6 || (t-old-2) % 4 || t > X.Sz()) return;  p += 2; old = t }
	old = X.U16(p)-adr; p += 2;
	for(i=0; i < 15; i++) { t = X.U16(p)-adr; //ornament ptrs check
		if(t-old < 3 || t > X.Sz() || t-old != 2+X.U8(old+1) /* orn. loop end */) return;  p += 2; old = t }
	sz = t+2+X.U8(t+1); //it's always the ornaments that come last, so we'll take the last one
	old = X.U16(p)-adr; p += 2;
	for(i=1; i < 32*3; i++) { t = X.U16(p)-adr; //pattern ptrs check
		if(t-old < 3 || t > X.Sz()) return;  p += 2; old = t }
	ord = X.U8(p++); lp = X.U8(p++); if(lp > ord) return;
	for(i=0; i < ord; i++) if(X.U8(p++) % 6) return; // all positions must be divisible by 6
	if(X.U16(0x65) != p) return; // start of PatChns; must match the pointer to PatChns[0]
	return true
}
if(!bDetected && isGlobalTracker()) {
	sName = "Doctor Max/Global Corp.'s' Global Tracker module (.GTR)"; bDetected = 1;
	sVersion = 'v'+(X.U8(4)>>4)+'.'+(X.U8(4)&0xF);
	if(X.isVerbose()) {
		dly = X.U8(0); ptn = X.U8(0x125); lp = X.U8(0x126);
		sOptionT(X.SA(7,0x20));
		sOption('ord:'+(lp>0?lp+'-':'')+ord+' ptn:'+ptn+' delay:'+dly+' sz:'+outSz(sz));
	}
}


function isBPSoundMon() {
	//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/BP-Soundmonitor.c
	// & src/BS02-92.S for BPSM version
	if(X.Sz() < 0x200) return false;
	old = false; bad = "";
	if(!/V\.\d/.test(X.SA(0x1A,3)))
		if(X.c("'BPSM'",0x1A)) old = true; else return false;
	ord = X.U16(0x1E,_BE); if(525+ord*16 > X.Sz()) return false;
	allsmpsz = smp = 0;
	for(i=0; i < 15; i++) {
		if(X.U8(0x20+i*0x20) == 0xFF) continue;
		sn = X.readBytes(0x20+i*0x20,0x18); if(charStat(sn,CS_ALL).indexOf('xsc') < 0) return false;
		slen = X.U16(0x20+0x18+i*0x20,_BE)<<1; lp = X.U16(0x3A+i*0x20,_BE);
		lpl = X.U16(0x3A+i*0x20,_BE); svol = X.U16(0x3E+i*0x20,_BE);
		if(lpl > slen || lp-1 > slen || lpl-1 > slen) return false;
		if(svol > 0x60) return false; else if(svol > 0x40) bad = bad.addIfNone("!badvol")
		allsmpsz += slen; if(slen) smp++
	}
	sz = 0x200+allsmpsz+ord*0x10;
	if(!old) sz += X.U8(0x1D)*0x40; //what IS this value?
	ptn = 0;
	for(i=0; i < ord*16; i+=4) { p = X.U16(0x200+i,_BE); if(p>ptn) ptn = p }
	sz += ptn*0x30;
	return true
}
if(!bDetected && X.isDeepScan() && isBPSoundMon()) {
	bDetected = 1;
	sName = "Brian Postma's SoundMon module (.BP)";
	if(old) sVersion = "old"; else sVersion = "v"+X.SA(0x1C,1);
	if(X.Sz() < sz) bad = bad.addIfNone("!short");
	if(bad != "") sVersion = sVersion.appendS("malformed"+bad,'/');
	if(X.isVerbose()) {
		sOptionT(X.SA(0,0x1A));
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz));
	}
}


function isFuchs() {
	//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/FuchsTracker.c
	if(X.Sz() < 0xC0 || !X.c("'SONG'",0xC0) || !X.c("'INST'",0xC8+X.U32(0xC4,_BE))) return false;
	allsmpsz = X.U32(0x0A,_BE);
	if(allsmpsz <= 2 || allsmpsz >= 65535*16) return false;
	smpdescs = 0; smp = 0;
	for(i=0; i < 16; i++) {
		ssz = X.U16(0x0E+i*2,_BE); if(ssz) smp++;
		lpst = X.U16(0x4E+i*2,_BE); if(ssz < lpst) return false;
		if(X.U8(0x2E+i*2) > 0x40) return false; //vol
		smpdescs += ssz
	}
	if(smpdescs <= 2 || smpdescs > allsmpsz) return false;
	ord = X.U8(0x6F); if(!ord || ord > 0x28) return false;
	ptn = 0; //last pattern
	for(i=0; i < 0x28; i++) {
		pt = X.U8(0x71+i*2); if(pt > 40) return false; if(pt > ptn) ptn = pt }
	ptn++; k = ptn*1024; if(k+204 > X.Sz()) return false;
	sz = smpdescs+k+204;
	return true
}
if(!bDetected && isFuchs()) {
	sName = "Andreas Fuchs's FuchsTracker module (.FUCHS)";
	bDetected = 1;
	if(X.isVerbose()) sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
}


function isGMC() {
	//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/GMC.c
	// & https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_gmc.cpp
	if(X.Sz() < 444 || !X.c("000000",0xF0)) return;
	//smp descriptions
	allsmpsz = 0; j = 0; smps = [];
	for(k=p=0; k < 15; k++,p+=0x10) {
		o = X.U32(p,_BE); if(o > 0x7FFFFF || (o&1)) return; //ofs
		l = X.U16(p+4,_BE)<<1; //length
		if(l > 0xFFFF) return;
		if(X.U8(p+6)) return; //zero byte
		if(X.U8(p+7) > 0x40) return; //vol
		a = X.U32(p+8,_BE); if(a > 0x7FFFFF || (a&1)) return; //address
		n = X.U16(p+0xC,_BE); //looplen
		if(n > 2 && n > l) return;
		if(X.U16(p+0xE,_BE) & 1) return; //datastart
		allsmpsz += l;
		if(l) smps.push([o,l]);
	}
	if(allsmpsz <= 4) return;
	smps.sort(function(a,b){return a[0]-b[0]});
	for(k=0; k < smps.length-1; k++)  if(smps[k][0]+smps[k][1] > smps[k+1][0]) return;
	ord = X.U8(0xF3); //ptn table size
	if(!isWithin(ord, 1, 0x64)) return;
	ptn = 0; ords = [];
	for (i=0; i < 100; i++) { //ptn order table
		p = X.U16(0xF4+i*2,_BE);
		if (p & 0x3FF) return;
		if(i < ord) { p >>= 10; if(p > ptn && p != 63) ptn = p }
	} ptn++;
	if(ptn > 64) return;
	m = notes = badnotes = badled = 0; end = false; p = 0x1BC; nps = [];
	if(p+ptn*0x400 > Math.min(X.Sz(),0xFFFC)) return;
	for (i=0; i < ptn && !end; i++) { //test pattern data
		badnotes = badled = 0;
		for (j = 0; j < 256 && !end; j++,p+=4) {
			d = X.readBytes(p,4);
			np = (d[0]<<8)+d[1];
			if(np && np != 0xFFFE)
				if(isWithin(np, 113,856)) {
					notes++; if(!nps.includes(np)) nps.push(np);
					if(notes > 100 && !X.isDeepScan()) end = true;
				}
				else badnotes++;
			d[2] &= 0xF;
			if(d[2] == 3 && d[3] > 0x40) badnotes++; //vol effect
			if(d[2] == 4 && d[3] > 0x63) return;
			if(d[2] == 5 && d[3] > ord+1) return;
		}
	if(badnotes > 16) { if(debug>0)_log("GMCFault: over 16 bad notes"); return}
	}
	nps = nps.length;
	if(!notes) return;
	if(nps <= 2 && !X.isHeuristicScan()) return; // that's not music...
	sz = 0x1BC + ptn*0x400 + allsmpsz;
	return true
}
if(!bDetected && isGMC()) {
	bDetected = 1;
	sName = "Andreas Tadic's Game Music Creator module (.GMC)";
	if(X.isVerbose()) {
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smps.length
			+((X.isDeepScan() || notes < 100) ? " notes:"+notes+"("+nps+" diff.)" : '')
			+" sz:"+outSz(sz)); if(X.Sz() < sz) sVersion = "malformed!short"
	}
}


function isMoonBlaster() {
	//ref https://www.msx.org/wiki/Moonblaster_file_format
	//TODO check for the sanity of more values passed to MSX-AUDIO, like instr/vol
	if(X.Sz() < 0x179) return false;
	ord = X.U8(0); ofs = unpsz = 0;
	if(ord > 220 && ord < 255) return false; //not sure if the manual is right about 220 being the maximum
	if(ord == 255) { ofs = 1; ord = 200 } //a subformat. Always 200 positions, 01-filled; all offsets are +1
	else ord++;
	for(i=0; i < 0x20; i++) if(X.U8(0xA3+ofs+i) > 0x16) { /*_log('MBM: instr/vol error');*/ return false }
	tmp0 = X.U8(ofs+0xCD); if(!tmp0) { /*_log('MBM: tempo = 0 error');*/ return false }
	p = ofs+0x178+ord; ptn = -1; for(i=ofs+0x178; i < p; i++) { t = X.U8(i); if(t > ptn) ptn = t }
	// Start pattern number is 1, no need to ptn++. Funnily, the manual says patterns start from 0
	if(ptn < 1) return false;
	ptnp = p+ofs; ptn1 = oldp = X.U16(ptnp);
	if(ptn1 > X.Sz()) { /*_log('MBM: ptn1 @'+Hex(ptn1)+">"+Hex(X.Sz()));*/ return false }
	for(i=0; p < X.Sz() && i < ptn; i++) {
		p = X.U16(ptnp+i*2);
		if(!i) unpsz = p; // patterns should start from the current unpsz
		if(p < ptnp+i*2 || p > X.Sz()) {
			/*_log('MBM: ptn ptr['+Hex(i)+'] error @'+Hex(ptnp+i*2)+': '+Hex(p));*/ return false }
		if(i && p-oldp > 0x100) { /*_log('MBM: ptn too large @'+Hex(ptnp+i*2));*/ return false }
		oldp = p;
	}
	if(!ofs) { p = ptnp+i*2;
		if((unpsz != p || p > X.Sz())) { /*_log('MBM: pattern offset error: p='+Hex(p));*/ return false }
	} else p = ptn1
	//decruncher: going over all the patterns at once
	while(p < X.Sz()) { c = X.U8(p++);
		if(!c) break; else if(c <= 0xF2) unpsz++; else /*decrunching 0's*/ unpsz += c-0xF2;
	}
	if(!isWithin(p, 0x178,0x3DC0)) return false;
	sz = p;
	return true
}
if(!bDetected && isMoonBlaster()) {
	//MUS is "FST-song", MBM is song, MBK is drumkit, MBV is voice-e, MBB is voice-b, MBS is samples
	sName = "Remco Schrijvers et al.'s MSX MoonBlaster for MoonSound module (.MBM)";
	bDetected = 1; if(ofs) sVersion = '200-pos.ver.';
	drumkit = X.SA(ofs+0x140,8).trim();
	if(drumkit != 'NONE') sVersion = sVersion.appendS('+'+drumkit+'.MBK','/');
	if(X.isVerbose()) {
		sOption(X.SA(ofs+0xCF,40).trim());
		sOption('tempo0:'+tmp0+' ord:'+ord+' ptn:'+ptn+' unpsz:'+unpsz+' sz:'+outSz(sz))
	}
}


function isProTracker1_sp() {
	//PT1's project file
	//TODO()
}


function isProTracker1_c() {
	//ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/aym/protracker1.cpp
	// & https://ay.strangled.net/Ay_Emul30.src.7z/Formats.pas -> FoundPT1
	if(X.Sz() < 0x66) return;
	tempo = X.U8(0); if(!isWithin(tempo, 2,15)) return; //delay
	ptntp = X.U16(0x43); if(ptntp >= X.Sz()) return; //patterns table pointer
	numofpos = X.U8(1);// if(len == 0) return; //numofpositions, can be corrupted?
	loop = X.U8(2);
	j = 0; j1 = 65535;
	for(i=0; i < 0x10; i++) { //samples pointers
		sp = X.U16(3+i*2); if(sp > X.Sz()) return;
		if(j < sp) j = sp;
		op = X.U16(0x23+i*2); if(op > X.Sz()) return;
		if(op && j1 > op) j1 = op
	}
	if((j1 < 0x67) || (j < 0x67) || (j > 65534) || (j > X.Sz())
	  || (j + X.U8(j) * 3 + 2 != j1)) return;
	for(i=j=0; i < 0x10; i++) { //ornaments pointers
		op = X.U16(0x23+i*2,_LE); if(op > X.Sz()) return;
		if(j < op) j = op
	}
	if(j < 0x67) return;
	len = j+0x40; if(len > 0x10000 || len > X.Sz()+1) return;
	j = 0x63;
	while(j <= ptntp && X.U8(j) < 0xFF) j++;
	if(j+1 != ptntp) return;
	ord = j-0x63; if(loop > ord) return;
	return true
}
if(!bDetected && isProTracker1_c()) {
	sName = "Golden Disk ProTracker module (.PT1)"; sVersion = "v1.x/compiled"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SA(0x45,0x1E)); //musicname
		sOption("tempo:"+tempo+" ord:"+ord+" len:"+len)
	}
}


function isProTracker2() {
	//ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/aym/protracker2.cpp
	// & https://ay.strangled.net/Ay_Emul30.src.7z /Players.pas & /Help/html/ay_ru_fmt_pt2.htm
	if(X.Sz() < 132) return; //the smallest pt2 in all actual collections is 521 bytes long
	tmp = X.U8(0); if(!isWithin(tmp,2,15)) return;
	const maxsz = X.Sz()+X.isHeuristicScan()*0x200;
	ord = X.U8(1); lp = X.U8(2); if(!ord || lp > ord || 0x83+ord > maxsz-2) return;
	smp0 = X.U16(3); orn0 = X.U16(0x43); if(orn0-smp0 > maxsz+2 || orn0 < smp0) return;
	ptnp = X.U16(0x63); if(!isWithin(ptnp,0x65,orn0)) return;  smp = orn = 0;
	for(i=mps=0,p=3; i < 0x20; i++,p+=2) { t = X.U16(p); if(t > mps) mps = t;
		if(t) { smp++; if(!isWithin(t,0x65,maxsz-2)) return }
	}
	for(mp=0; i < 0x30; i++,p+=2) { t = X.U16(p); if(t > mp) mp = t;
		if(t) { orn++; if(orn <= 2 && !isWithin(t,Math.max(mps,orn0),maxsz)) return }
		//just check the first two orns. Ornament records seem to be optional, and,
		//despite the pointers being present, some modules are just cut off early 
	}
	for(p=0x83,ptn=i=0; i <= 0xFF; i++,p++) {
		if(p > X.Sz()-2) return; if((o=X.U8(p)) == 0xFF) break; if(o > ptn) ptn = o
	} ptn++; p++;
	if(ord != i || ptnp != p) return;
	for(rptn=0; p < X.Sz(); rptn++,p+=2) { if(!(t=X.U16(p))) break; else if(!isWithin(t,ptnp+ptn*6,X.Sz())) return }
	if(rptn != ptn*3) return;  sz = mp+2+X.U8(mp);
	return true
}
if(!bDetected && isProTracker2()) {
	sName = "Golden Disk ProTracker module (.PT2)"; sVersion = 'v2.x'; bDetected = 1;
	if(X.isVerbose()) {
		nc = charStat(t=X.readBytes(0x65,0x1E), 1);
		if(nc.indexOf('allxsc') >= 0) sOptionT(decEncoding(t,CPSpeccy)); else sOption('<broken title>');
		sOption('tmp:'+tmp+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn+' smp:'+smp+' orn:'+orn+' sz:'+outSz(sz))
	}
}


function isProTracker3(ofs) { //PT3's detection but sanity checks because SOME people -_-
	//ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/aym/protracker3_compiled.cpp
	// & https://ay.strangled.net/Ay_Emul30.src.7z /Help/html/ay_ru_fmt_pt3.htm
	// & https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/aym/turbosound.cpp
	if(X.Sz()-ofs < 0xCA) return; p = 0; var maxsz = Math.min(65535,X.Sz()+X.isHeuristicScan()*0x200);
	var smps=[], orns=[], trks=[], ptns=[]; bad = '';
	function re(msg) { if(debug>1)_l2r('pt3',p,msg); return }
	ttn = X.U8(ofs+0x63); if(ttn > 4) if(X.isHeuristicScan()) bad = bad.addIfNone('!badtuning'); else return;
	tmp0 = X.U8(ofs+0x64); if(!tmp0) return;
	ord = X.U8(ofs+0x65); ptnp = ofs+0xCA+ord;
	if(ptnp != X.U16(ofs+0x67)+ofs || ptnp > X.Sz()-2) return re('!badptnp+'+Hex(ptnp));
	lp = X.U8(ofs+0x66); if(lp > ord-1) return re('!badlp');
	orn = smp = mp = 0; if(!ofs) ptnp0 = ptnp;
	for(p=ofs+0x69; p < ofs+0xA9; p+=2) if(X.U16(p)) smp++;  for(; p < ofs+0xC9; p+=2) if(X.U16(p)) orn++;
	for(ptn=i=0,p=ofs+0xC9; i <= 0xFF; i++) { if((o=X.U8(p++)) == 0xFF) break; if(o%3) return;
		if(ptns.indexOf(o/3) < 0) ptns.push(o/3); if(o/3 > ptn) ptn = o/3 }
	ptn++; if(!i || i != ord) return re('!realord:'+i+' != ord:'+ord);
	t = X.readBytes(ofs,10); tracker = '';
	if(charStat(t,1).indexOf('allasc') >= 0) { t = decEncoding(t,CPSpeccy);
		if(t == 'ProTracker') { tracker = 'Pro Tracker'; sv = 'v'+X.SA(ofs+0xB,4).trim(); nv = X.U8(ofs+0xD)-0x30 }
		else if(t == 'Vortex Tra') { tracker = 'Vortex Tracker ]['; sv = 'v'+X.SA(ofs+0x12,4).trim(); nv = 7 }
		else { tracker = '"'+X.SA(ofs,14)+'"'; sv = 'v3.x'; nv = 7 }
	} else { tracker = 'hacked Pro Tracker'; sv = 'v3.x'; nv = 7 }
	//track parser
	function isTrkIn(tracks,track) {
		for(var i=0; i < tracks.length; i++) if(tracks[i][0] == track[0]) return true;  return }
	for(i=notes=0; i < ptn*3 && p < maxsz; i++,p+=2) {
		// echo track addresses, pertinent to debugging:
		// 6F3, 719, 745...
		if(!isWithin(t=X.U16(p)+ofs, p,maxsz)) return re('!badptnp2:'+Hex(t));
		if(ptns.indexOf(Util.divu64(i,3)) < 0) continue;
		trk = [t,0]; if(isTrkIn(trks,trk)) continue;
		var lines = 0, eot = false;
		trkparse: while(!eot && lines < 256 && t < maxsz) {
			eol = false; z = 0; // counter of all effect parameters
			while(!eol && t < X.Sz()) {
				if((x=X.U8(t++)) == 0) eol = eot = true;
				else if(x == 1 || x == 8) z += 3;  else if(x == 2) z += 5;  else if([3,4,6,9].indexOf(x) >= 0) z++;
				else if(x == 5) z += 2;  else if(x == 7) bad = bad.addIfNone('!badcmd07h');
				else if(x == 0x10) { x = X.U8(t++); y = X.U16(0x69+x)+ofs; if(smps.indexOf(x) < 0) {
					if(y > ofs && !isWithin(y, ptnp,maxsz)) bad = bad.addIfNone('!badsmp'); smps.push(x) } }
				else if(x < 0x20) { t += 2; x = X.U8(t++); y = X.U16(0x69+x)+ofs; if(smps.indexOf(x) < 0) {
					if(y > ofs && !isWithin(y, ptnp,maxsz)) bad = bad.addIfNone('!badsmp'); smps.push(x) } }
				else if(x < 0x40) { /* could check if this isn't channel B but may be too much */ }
				else if(x < 0x50) { x &= 0xF; if(orns.indexOf(x) < 0) { orns.push(x); if(mp < (y=X.U16(ofs+0xA9+x*2)+ofs)) mp = y } }
				else if(x < 0xB0) { notes++; eol = true } else if(x == 0xB0) { /*envoff*/ }
				else if(x == 0xB1) { lines += X.U8(t++) } else if(x < 0xC0) t += 2; else if(x == 0xC0) eol = true;
				else if(x < 0xD0) { /*setvol*/ } else if(x == 0xD0) eol = true;
				else if(x < 0xF0) { x = (x&0x1F)<<1; y = X.U16(ofs+0x69+x)+ofs; if(smps.indexOf(x) < 0) {
					if(y > ofs && !isWithin(y, ptnp,maxsz)) bad = bad.addIfNone('!badsmp1'); smps.push(x) } }
				else { x &= 0xF; if(orns.indexOf(x) < 0) { orns.push(x); if(mp < (y=X.U16(ofs+0xA9+x*2))) mp = y }
					x = X.U8(t++); y = X.U16(ofs+0x69+x)+ofs; if(smps.indexOf(x) < 0) {
						if(y > ofs && !isWithin(y, ptnp,maxsz)) bad = bad.addIfNone('!badsmp2'); smps.push(x) } }
			}
			lines++; t += z; z = 0; if(lines > 256) if (!X.isHeuristicScan()) return re('!badlines'); else bad = bad.addIfNone('!badlns')
		}//trkparse
		trk[1] = t-trk[0]; if(!isTrkIn(trks,trk)) trks.push(trk); if(mp < t) mp = t
	}//all tracks parsed
//	function tupleSort(lst) { function sf(a, b) { if(a[0] != b[0]) return a[0]-b[0]; else return a[1]-b[1] } return lst.sort(sf) }
//_l2r('pt3',0,outArray(tupleSort(trks),16)+'::: '+outArray(findGaps(trks,0),16)+' :: '+outArray(findIntersections(trks,true),16))
	if(t=findIntersections(trks,true).length) if(!X.isHeuristicScan() || t > 5) return re('trackxsections');
		else bad = bad.addIfNone('!trkxsec'); //so there are some broken files, like echo.pt3 (5753 bytes)
	if(t=findGaps(trks,0).length) if(!X.isHeuristicScan() || t > 5) return re('trackgaps');
		else bad = bad.addIfNone('!trkgap'); //tracks are monolithic BUT SOME PEOPLE
	rsmp = smps.length; rorn = orns.length; rptn = ptns.length; if(!rptn || rsmp > 32) return re('!rptn='+rptn+',rsmp='+rsmp);
	if(X.fStr("compilation of",10,20) < 0 && !rsmp) return re('!nosmp');
	sz = mp+2+X.U8(mp+1); //ornaments! either at the last orn ptr, or just straight after the patterns
	return true
}
if(!bDetected && isProTracker3(0)) {
	sName = "Golden Disk ProTracker module (.PT3)"; sVersion = sv; bDetected = 1;
	tsmode = nv >= 5 && (X.U8(0x62) != 0x20 || X.c("'Vortex Tra'",sz) || X.c("'ProTracker 3'",sz));
	if(X.isVerbose()) info1 = 'tmp0:'+tmp0+' ord:'+(lp?lp+'-':'')+ord
			+' ptn:'+(rptn!=ptn?rptn+'/':'')+ptn+' smp:'+(rsmp!=smp?smp+'/':'')+rsmp
			+' orn:'+(rorn!=orn?rorn+'/':'')+orn+' notes:'+notes;
	sz1 = sz; ord1 = ord; tmp1 = tmp0;
	if(tsmode) if(!isProTracker3(sz) || ord1 != ord || tmp1 != tmp0) tsmode = false;
	if(tsmode) { //TurboSound container? check the footer, should be nearby (or isn't a footer)
		if((t=X.fSig(sz,0x200,"'02TS'")) > sz) if(X.SA(t-6,4) === X.SA(t-12,4)) if(sz1 == X.U16(t-8,_LE)) {
			sVersion += '[TurboSound:'+X.SA(t-6,4)+']'; sz = t+4;
		}
		else if(nv >= 7) sVersion += '/TurboSound'; else bad = bad.addIfNone('badTSver')
	}
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		if(X.c("'by ",0x3F)) { sOptionT(decAnsi(0x1E,0x20,CPSpeccy)); sOptionT(decAnsi(0x42,0x20,CPSpeccy),'by: ') }
		sOptionT(tracker,'in: ');
		switch(ttn) {
			case 0: sOption('tuning 0: 1625000Hz PT3.3'); break;
			case 1: sOption('tuning 1: Sound Tracker'); break;
			case 2: sOption('tuning 2: ASM/PSC 1.75MHz'); break;
			case 3: sOption('tuning 3: RS 1625000Hz'); break;
			case 4: sOption("tuning 4: Ivan Roshchin's Natural Cmaj/Am"); break;
			default: sOption('tuning '+ttn+'/custom')
		}
		sOption((tsmode?'chip#1: ':'')+info1);
		if(tsmode) {
			sOption('chip#2: ptn:'+(rptn!=ptn?rptn+'/':'')+ptn+' smp:'+(rsmp!=smp?smp+'/':'')+rsmp
			+' orn:'+(rorn!=orn?rorn+'/':'')+orn+' notes:'+notes);
		}
		sOption(outSz(sz),'sz:')
	}
}


function isProSoundCreator_c(v14/*must take 0 or 1*/) {
	//from https://ay.strangled.net/Ay_Emul30.src.7z /Players.pas → FoundPSC
	switch(v14) { case 1: sv = 'v1.04+'; break; case 0: sv = 'v1.00~3'; break; default: return }
	const max = Math.min(X.Sz(),0x10000); if(max < 0x4E) return;
	var sap = X.U16(0x45), ordp = X.U16(0x47), ornp = X.U16(0x4A); //sample pointer table begins from 4Ch
	if(!isWithin(sap, 0x4E,max) || !isWithin(ordp, 0x4E,max-11)
		|| !isWithin(ornp, 0x4E,Math.min(max,0x8C)) || ornp % 2) return;
	var o0 = X.U16(ornp)+v14*ornp, s0 = X.U16(0x4C)+v14*0x4C, t = X.U16(ornp-2)+v14*0x4C;
	if(s0 > Math.min(ornp+0x40,X.Sz()-5) || o0 >= max || t >= max || o0-t < 8 || (o0-t) % 6 != 2) return;
	for(p=s0+4,smp=0; p < max && (X.U8(p) & 0x20); p += 6) smp++;
	if(p > 0xFFFE || p > X.Sz()) return;
	if(ornp-0x4C-2 > 0) { if(p+3 != X.U16(0x4E)+v14*0x4C) return } else if(p+4 != o0) return;
	p = ordp+1; if(X.U8(p) == 0xFF) return;
	for(ord=ptn=0; p+3 < max;) {
		if(!isInside(X.U16(p+1), o0,ordp) || !isInside(X.U16(p+3), o0,ordp) || !isInside(X.U16(p+5), o0,ordp)) return;
		p += 8; ord++;
		if(X.U8(p) == 0xFF) { if(X.U8(p-1) >= ord) return;  lp = X.U8(p-1); break }
		else ptn = Math.max(ptn,X.U8(p-1)+1)
	}
	sz = p+3; dly = X.U8(0x49);
	ftitle = charStat(X.readBytes(0,0x18),true).indexOf('allasc') >= 0;
	fby = charStat(X.readBytes(0x2E,0x17),true).indexOf('allasc') >= 0;
	return true
}
if(!bDetected && (isProSoundCreator_c(1) || isProSoundCreator_c(0))) {
		sName = "Viktor 'KVA' Kuźmin's Pro Sound Creator module (.PSC)"; //Виктор Кузьмин
		sVersion = sv+'/compiled'; bDetected = 1;
		if(X.isVerbose()) {
			if(ftitle) sOptionT(decAnsi(0x19,0x14,CPSpeccy,false,Chars0to1FSpeccy));
			if(fby) sOptionT(decAnsi(0x31,0x14,CPSpeccy,false,Chars0to1FSpeccy),"by: ");
			sOption('ord:'+(lp>0?'('+lp+'-)':'')+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
		}
	}


function isFTC() {
	//from https://ay.strangled.net/Ay_Emul30.src.7z /Players.pas → FoundFTC
	//if(X.c("'Module: '") && X.c("';Fast Tracker v1.00'", 0x32)) // we KNOW someone broke this in their music
	if(X.Sz() < 0xD7) return; const max = Math.min(0x10000,X.Sz());
	switch(X.U8(0x32)) { case 0x3B: notet = 0; break; case 1: notet = 1; case 2: notet = 2; default: return }
	if((ptnp=X.U16(0x4B)) >= X.Sz()) return false;	if(X.U16(0x92) <= X.U16(0x52)) return false;
	for(p=0xD4,ptn=0; p < 0x1D4 && p < X.Sz() && X.U8(p) < 0x80; p += 2, ord++) ptn = Math.max(ptn,X.U8(p)+1);
	lp = X.U8(0x46); if(p >= 0x1D4 || lp > ord) return;
	var ofs = X.U16(ptnp) - (ptn*6 + ptnp+2); if(ofs < 0) return;
	if(X.U16(0x52)-ofs >= X.Sz() || ptnp >= X.U16(0x52)-ofs || X.U16(0x92)-ofs >= X.Sz()) return;
	var ornpm = 0xFFFF, ornpM = 0, msmpp = 0;
	for(p=0x52; p < 0x92; p+=2) msmpp = Math.max(msmpp,X.U16(p));
	for(; p < 0xD4; p+=2) { ornpm = Math.min(ornpm,X.U16(p)); ornpM = Math.max(ornpM,X.U16(p)) }
	if(msmpp-ofs >= Math.min(65534,X.Sz()) || ornpm-ofs >= max || ornpM-ofs >= max
	  || msmpp <= ptnp || msmpp+3+(X.U8(msmpp-ofs+2)+1)*5 != ornpm) return;
	sz = msmpp+3+(X.U8(msmpp-ofs+2)+1)*2-ofs;
	if(sz < ptnp) return false;
	return true
}
if(!bDetected && isFTC()){
	sName = "S.'Orion' Matveev & A.'Sand' Plużnikov's Fast Tracker module (.FTС)";
	//Сергей Матвеев & Александр Плужников
	bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SA(8,0x2A));
		sOption('ord:'+(lp>0?'('+lp+'-)':'')+ord+' ptn:'+ptn+(ofs?' ofs:'+Hex(ofs):'')+' sz:'+outSz(sz))
	}
}

function isSoundTrackerProF() {
	//ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/aym/soundtracker.cpp
	// & https://ay.strangled.net/STPDocs.7z -> Xplay79f.txt
	if(X.Sz() < 3009+576) return false; //header + patterns
	for(p=smp=0; smp < 15; smp++) {
		for(i=0; i < 32; i++) if(X.U8(p++) > 0x0F) return false; //levels
		for(i=0; i < 32; i++) if(X.U8(p++) & 0x20) return false; //noises
		for(i=0; i < 32; i++) { p++; if(X.U8(p++) > 0x1F) return false } //additions
		for(i=0; i < 2; i++) if(X.U8(p++) > 0x1F) return false; //loops
	}
	for(i=0; i < 0x100; i++) { if(!isWithin(X.U8(p),1,0x20)) return false; p += 2 } //positions
	// at this point, p should be 15*0x82
	if(X.U8(p++) & 0x80) return false;
	p += 32*17; //ornaments
	dly=X.U8(p++); if(!isWithin(dly,1,0xF)) return false;
	pts=X.U8(p); if(!isWithin(pts,1,0x40)) return false;
	return true;
}
if(!bDetected && isSoundTrackerProF()) {
	sName = "Stanislav 'KSA' Kuzin's Sound Tracker Pro module (.STF,.F)";
	sVersion  = "uncompiled/packed"; bDetected = 1;
	if(X.isVerbose()) {
		sOption('dly:'+dly+' pts:'+pts)
	}
}


function isSoundTrackerPro() {
	//from https://ay.strangled.net/STPDocs.7z -> stp.txt
	tmp = X.U8(0); if(!isWithin(tmp,1,50)) return;
	const max = X.Sz()-2;
	var ordtp = X.U16(1,_LE);  ord = X.U8(ordtp); lp = X.U8(ordtp+1); //ord, loop, orderlist and ptn transpose
	if(!isWithin(ordtp,10,max) || lp > ord || !ord) return;
	var ptntp = X.U16(3,_LE); if(!isWithin(ptntp,ordtp+2+ord*2,max)) return; //pattern offsets
	var orntp = X.U16(5,_LE); if(!isWithin(orntp,10,max)) return; //ornament offsets
	var smptp = X.U16(7,_LE); if(!isWithin(smptp,10,max)) return; //sample offsets
	sz = smptp+30; if(sz > X.Sz()) return;  var ptnp = [], smpp = [];
	for(i=0; i < ord; i++)
		if(X.U8(ordtp+2+i*2)%6 || !isWithin(t=X.U16(ptntp+i*2,_LE),10,max)) return false; else if(ptnp.indexOf(t) < 0) ptnp.push(t)
	for(i=0; i < 15; i++)
		if(!isWithin(t=X.U16(smptp+i*2),10,max)) return; else if(smpp.indexOf(t) < 0) smpp.push(t);
	ptn = ptnp.length; smp = smpp.length; if(!ptn) return;
	return true;
}
if(!bDetected && isSoundTrackerPro()) {
	sName = "Stanislav 'KSA' Kuzin's Sound Tracker Pro module (.STP)"; sVersion  = "compiled"; bDetected = 1;
	if(X.isVerbose()) {
		if(X.c("'KSA SOFTWARE COMPILATION OF '",10)) sOptionT(X.SC(0x26,0x19,'CP1251'));
		sOption('tmp:'+tmp+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isSQTracker() {
	//ref https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundSQT
	if(X.Sz() < 17) return false;
	sz = X.U16(0); if(X.Sz() < sz) return false;
	smptp = X.U16(2); if(smptp < 10) return false; //samples table ptr
	orntp = X.U16(4); ptntp = X.U16(6); //ornaments & patterns table ptrs
	postp = X.U16(8); lpp = X.U16(0xA); //positions table ptr & loop ptr
	if(orntp <= smptp+1) return false; if(ptntp < orntp) return false;
	if(postp <= ptntp) return false; if(lpp < postp) return false;
	membase = smptp-10; //to eventually realign to file, not memory
	if(lpp-membase >= sz) return false;
	i = postp-membase; b = X.U8(i); if(!b) return false; //can't have 0 patterns
	ord = 0; ptn = 0;
	while(b) { //find the highest pattern #
		if(i+7 >= sz) return false;
		ord++;
		if(ptn < (t = b&0x7F)) ptn = t; i += 2; b = X.U8(i);
		if(ptn < (t = b&0x7F)) ptn = t; i += 2; b = X.U8(i);
		if(ptn < (t = b&0x7F)) ptn = t; i += 3; b = X.U8(i)
	} ptn++;
	p = X.U16(smptp-membase+2);
	if(p-ptntp != ptn*2) return false;
	p = 12; len = i+7;
	if(len != sz) return false;
	t = X.U16(12);
	for(i = 1; i <= (orntp-smptp)>>1; i++) {
		p += 2; j3 = X.U16(p);
		if(j3-t != 0x62 && (sz != 1337 || ord != 10 || ptn != 11)) return false;
		t = j3;
	}
	for(i = 1; i <= (ptntp-orntp)>>1; i++) {
		p += 2; j3 = X.U16(p);
		if(j3-t != 0x22) return false;
		t = j3;
	}

	return true;
}
if(!bDetected && isSQTracker()) {
	sName = "Jiří 'George' Koudelka's Scalex Qjeta Tracker module (.SQT)"; sVersion  = "compiled"; bDetected = 1;
	sOption('ord:'+ord+' ptn:'+ptn+' sz:'+outSz(sz))
}


function isSTC() {
	//ref https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundST
	if(X.Sz() < 6) return false;
	tempo = X.U8(0); if(tempo == 0 || tempo > 0x20) return false; //delay
	postp = X.U16(1,_LE); if(postp<0x7E || postp>X.Sz()) return false; //positions ptr
	orntp = X.U16(3,_LE); if(orntp<0x7E || orntp>X.Sz()) return false; //ornaments ptr
	ptntp = X.U16(5,_LE); if(ptntp<0x7E || ptntp>X.Sz()) return false; //patterns ptr
	ord = X.U8(postp)+1;
	j2 = ptntp - orntp; if(j2 == 0) return false; //j2<0: ST, >0: S_SONIC
	fID = false;
	if(j2 > 0) { if((j2%0x21) > 0) return false; }
	else if((j2%0x21) > 0) {
		if((j1<55) || (((j1-55)%0x21) > 0)) return false;
		fID = true; //we'll check for a preset ID at the end
	}
	j = X.U8(postp)*2+3;
	if(j2 < 0) { if(j+j2 != 0) return false; }
	else if(j+postp-orntp != 0) {
		if((ptntp < 82) || (j+postp-ptntp+55 != 0)) return false;
		fID = true;
	}
	j = orntp+0x21;
	if(j > 65535 || j > X.Sz()) return false;
	while(j) { j--; if(X.U8(j) > 0) return false; if(j == orntp) break }
	j = ptntp; j1 = 0; j2 = 0; ptn = 0;
	while((j+6 <= X.Sz()) && (j+6 < 65536) && (X.U8(j) < 0xFF)) {
		//find the highest channel data pointer
		j++; //ptn #
		j2 = X.U16(j,_LE); if(j1 < j2) j1 = j2; j += 2; //channel A data ofs
		j2 = X.U16(j,_LE); if(j1 < j2) j1 = j2; j += 2; //ditto B
		j2 = X.U16(j,_LE); if(j1 < j2) j1 = j2; j += 2; //ditto C
		ptn++
	}
	if((X.U8(j) < 0xFF) ) return false;
	if(j1 > X.Sz()) return false;
	if(X.U8(j1-1) < 0xFF) return false;
	bad = 0; //some modules are a bit more broken! Like "- unknown/ay5.stc" which lost some of its final bytes
	while(1) { //scan through the channel data at the end of file
		if(0x83 <= X.U8(j1) <= 0x8E) j1++; //I don't get what this does, no docs either
		j1++;
		if(j1 > 65535) return false;
		if(j1 > X.Sz())
			if(X.isHeuristicScan()) { bad = 1; break }
			else return false;
		if((X.U8(j1) == 0xFF) || (j1 == X.Sz())) break
	}
	if(X.U8(j1) == 0xFF) len = j1+1; else len = X.Sz();
	// len = X.U16(0x19,_LE); // because ~somebody~ used it for names
	if(fID)
	  if( (X.SA(ptntp-55,29) != 'SOUND TRACKER COMPILATION OF ') &&
		(X.SA(ptntp-55,28) != 'KSA SOFTWARE COMPILATION OF ') ) return false;

	return true;
}
if(!bDetected && X.isDeepScan() && isSTC()) {
	sName = "Jarosław 'BZYK' Burczyński's Sound Tracker module (.STC,.ZXS)"; sVersion  = "v1.x"; bDetected = 1;
	if(bad) sVersion += "/malformed"+bad;
	sz = X.U16(0x19,_LE); i_d = X.SA(7,18);
	if(['SONG BY ST COMPILE','SONG BY MB COMPILE','SONG BY ST-COMPILE',
	  'SOUND TRACKER v1.1','S.T.FULL EDITION  ','SOUND TRACKER v1.3'].indexOf(i_d) >= 0)
		msg = '';
	else
		msg = i_d;
	if(sz != X.Sz()) { //the message must've hit the size field, HAPPENS
		sz = len;
		if(X.isVerbose()) sOption("ord:"+ord+" ptn:"+ptn);
		if(32 <= (sz&0xFF) <= 0x7F) {
			msg += String.fromCharCode(sz&0xFF);
			if(32 <= (sz>>8) <= 0x7F) msg += String.fromCharCode(sz>>8)
		}
	}
	if(X.isVerbose()) { sOptionT(msg,"msg: "); sOption('ord:'+ord+' ptn:'+ptn+' sz:'+outSz(sz)) }
}


function isST3() {
	//ref https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundST3
	if(X.Sz() < 8) return;
	orntp = X.U16(5); if(orntp > X.Sz()-6) return; //ST3 ornaments/STC patterns table ptr
	ptntp = X.U16(7); //ST3 patterns table ptr
	j1 = ptntp-orntp; if(j1 <= 0) return;
	smptp = X.U16(3); //samples table ptr
	j2 = orntp-smptp; if(j2 <= 0) return;
	ordp = X.U16(1); //orderlist ptr
	j3 = smptp-ordp; if(j3 > X.Sz()) return;
	j4 = ordp-9; if(j4 <= 0) return;
	if(j4 % 130) {
		if(j4 < 55 || (j4-55) % 130) return;
		fID = true
	} else fID = false;
	smp = X.U8(smptp); if(!isWithin(smp, 1,16)) return; // smp # , j5
	p = smp*130 + 9 + (fID? 55: 0);
	if(ordp != p) return;
	ord = X.U8(p); if(!ord) return; //pos # , j6

	for(i=0,ptn=0; i < ord; i++) ptn = Math.max(ptn+1,X.U8(p+1+i*2))
	p += ord*2+1; if(smptp != p && smptp != p+2) return;
	orn = X.U8(orntp); if(!orn || orn > 16) return; // orn # , j7
	p = smptp+smp*2+1+orn*32; if(orntp != p) return;
	p += orn*2+1; if(X.U16(ptntp) != p) return;
	base = X.U16(smptp+1)-9;
	if(fID) base -= 55; if(base < 0) return;
	p = X.U16(orntp+1)-base;
	if(p != smptp+smp*2+1) return;
	for(i=p; i < p+32; i++) if(X.U8(i)) return;
	j8 = -1; p = ordp+2;
	for(i=0; i < ord; i++) {
		b = X.U8(p); if(b % 6) return;
		if(j8 < b) j8 = b; p += 2
	}
	bad = '';
	sz = ptntp+j8+6; if(sz-1 > X.Sz()) bad = bad.addIfNone('!short');
	if(base+p > 65536) return;
	return true;
}
if(!bDetected && X.isDeepScan() && isST3()) {
	sName = "S.T. Music's Recompiler v2 rebuilt STC module (.ST3)"; sVersion  = "v3.0"; bDetected = 1;
	if(bad && !X.isVerbose()) sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		if(fID) {
			sOptionT(decAnsi(9,55,CPSpeccy,false,Chars0to1FSpeccy));
			if(!X.c("'KSA SOFTWARE COMPILATION OF '",9)) sOption(X.SA(9,28),'in: ');
		}
		sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' delay:'+X.U8(0)+" @"+Hex(base)+" sz:"+outSz(sz));
	}
}


function isSidMon1() {
	//ref http://asle.free.fr/prowiz/prowiz.src.zip / r/sidmon1.c
	// & https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/sidmon1/SIDMon1.0.s
	//I'm just used to calling the base ofs "a0" at this point
	a0 = X.fSig(0,0xFFFF,"41FA.... ....FFD4 43FA.... 228841FA ....D1E8 FFD843FA");
	if(a0 < 0 || (a0&1) || a0 > X.Sz()) return false;
	bad = "";
	p = X.U16(a0+2,_BE); msgp = a0+p+2; if(msgp < a0+16 || msgp > X.Sz()) return false;
//if(debug&&a0)_log("init @"+Hex(a0)+", p="+Hex(p));
	playp = X.fSig(a0+0x10,a0+msgp-6,"4E7548E7FFFE"); if(playp < 0 || (playp&1)) return false;
	smpd = X.U16(a0+2+p-2,_BE); ordp = X.U16(a0+2+p-6,_BE);
	ptnp = X.U16(a0+2+p-10,_BE); if(!smpd || !ordp || !ptnp) return false;
//_log("smpd:"+Hex(a0+2+p+smpd)+" ordp:"+Hex(a0+2+p+ordp)+" ptnp:"+Hex(a0+2+p+ptnp));
	if(a0+2+p+smpd > X.Sz() || a0+2+p+ordp > X.Sz()) return false;
	if(smpd <= ordp && smpd != 1) return false;
	ptn = (ordp-ptnp) >> 6; ord = 0; smps = [];
	if(smpd == 1) { //no samples, traversing orderlist
		ord++; pt = a0+2+p+ordp;
		if(pt+4 > X.Sz()) { sz = pt; return true; } // 1 position
		pt += 4; t = 1; sz = ordp-ptnp;
		while(t < sz) { t = X.U32(sz,_BE); if(sz+4 > X.Sz() || !t) return true; sz += 4 }
		sz -= 4; ord--
	}
	else { //samples present
		ord = (smpd-ordp) >> 2;
		smpd += a0+2+p; //now an absolute offset
		sdsz = X.U16(smpd+2,_BE); smp = sdsz >> 5;
		if(smpd+sdsz > X.Sz() || sdsz%32) return false;
//_log("smpinfo: ["+Hex(sdsz)+"/"+Hex(smp)+"]")
		if(!sdsz) for(;; sdsz += 0x20) { //guess manually
			if(sdsz+0x24 > X.Sz()) return false;
			stp = X.U32(smpd+sdsz+4,_BE); //smp start ofs
			k = X.U32(smpd+sdsz+8,_BE); //loop start ofs?
			endp = X.U32(smpd+sdsz+0xC,_BE); //loop end ofs or smp end ofs
			if(stp > k || k >= endp) break; smp++;
//_log("  smp found @"+Hex(sdsz))
			t = decAnsi(smpd+sdsz+0x10,0x10,CPAmiga).trim(); if(t != "") smps.push(t)
		}
		mendp = 0;
		for(i=0; i < smp; i++) {
			endp = X.U32(smpd+i*0x20+0xC,_BE); if(endp > mendp) mendp = endp;
			t = decAnsi(smpd+i*0x20+0x10,0x10,CPAmiga); if(t != "") smps.push();
		}
//_log("mendp:"+Hex(mendp)+" @"+Hex(smpd+sdsz+4+mendp));
		sz = smpd+sdsz+4+mendp;
		if(sz > X.Sz()) bad = bad.addIfNone("!short");
	}
	return true;
}
if(!bDetected && X.isDeepScan() && isSidMon1()) {
	sName = "SIDMon module (.SID1,.SMN,.SID)"; sVersion  = "v1"; bDetected = 1;
	if(bad != '') sVersion = sVersion.appendS("malformed"+bad,'/');
	if(X.isVerbose()) {
		t = decAnsi(msgp,0x100,CPAmiga).trim();
		if(t != "SID-MON BY R.v.VLIET  (c) 1988") sOptionT(t);
		sOptionT(addEllipsis(smps.join(','),200),'smps:');
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz));
	}
}


function isSidMon2() {
//from https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/Players/SidMon20/SidMon20Worker.cs
	if(X.Sz() < 0x5A) return false;
	if(!X.c("'SIDMON II - THE MIDI VERSION'", 0x3A)) return false;
	ord = X.U8(2)+1; spd0 = X.U8(3); smp = X.U16(4,_BE);
	ofs = 0x3A+X.U32(6,_BE); songlenlen = X.U32(0xA,_BE); ofs += songlenlen; //yes
	if(ofs != 0x5A) return false;    
	p = 0x0E;
	for(i = 0; i < 10; i++) {
		t = X.U32(p,_BE); if(t > 0x0FFFFF || !t) return false;
		switch(i) {
		case 0: var ordt = [ofs,t]; break;
		case 1: if(t != ordt[1]) return false; var notexpost = [ofs,t]; break;
		case 2: if(t != notexpost[1]) return false; break;
		case 3: if(t % 32) return false; break;
		case 7: if(t != smp) return false; var smpt = [ofs,t]; break;
		case 8: trk = t >> 1; break;
		case 9: var trkt = [ofs,t]; break;
		}
		p += 4; ofs += t; if(ofs > X.Sz()) return false
	}
	ofs = trkt[0]+trkt[1]; if(ofs&1) ofs++;
	smpsz = 0; smps = [];
	for(p = smpt[0]; p < smpt[0]+smpt[1]; p += 0x40) {
		smpsz += X.U16(p+4,_BE) << 1;
		t = decAnsi(p+0x20,0x20,CPAmiga).trim(); if(t != "") smps.push(t)
	}
	sz = ofs+smpsz;  smp >>= 6;
	return true
}
if(!bDetected && isSidMon2()) {
	sName = "SIDMon II module (.SID2)"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SA(7,0x20));
		sOptionT(X.SA(0x27,0x20),"in: ");
		sOptionT(addEllipsis(smps.join(','),0x100),'smp/msg:"','"');
		sOption("trk:"+trk+" ord:"+ord+" smp:"+smp+" sz:"+outSz(sz))
	}
}


function isDigiIllu() {
	//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/DigitalIllusion.c
	if(X.Sz() < 17) return false;
	smp = X.U16(0,_BE); if(smp > 31) return false;
	ordp = X.U32(2,_BE); if(ordp < smp*8+2) return false; //orderlist ptr
	ptndp = X.U32(6,_BE);  if(ptndp-ordp > 0x80 || X.U8(ptndp-1) != 0xFF) return false; //pattern data ptr
	smpdp = X.U32(10,_BE); if(smpdp > 0xFFFF) return false; //sample data ptr
	if(ptndp <= ordp+1 || smpdp <= ordp) return false;
	if(ordp > X.Sz() || ptndp > X.Sz()) return false;
	allsmpsz = 0;
	for(j=0; j < smp; j++) {
		ssz = X.U16(j*8+14,_BE)<<1; if(ssz > 0xFFFF) return false;
		lst = X.U16(j*8+18,_BE)<<1; if(lst > ssz) return false;
		lsz = X.U16(j*8+20,_BE)<<1;
		if(lsz > ssz+2 || lst+lsz > ssz+2 || (lst && lsz <= 2)) return false;
		if((lst || lsz > 2) && !ssz) return false;
		if(X.U8(16+j*8) > 0xF || X.U8(17+j*8) > 0x40) return false; //ft & vol checks
		allsmpsz += ssz
	}
	if(allsmpsz <= 2) return false;
	for(i=ordp,ptn=0; i < ptndp-1; i++) if((t=X.U8(i)) > 0x80) return false; else if(t >= ptn) ptn = t+1;
	sz = allsmpsz+smpdp;
	return true
}
if(!bDetected && isDigiIllu()) {
	sName = "Digital Illusions Creative Entertainment packed module (.DI)"; bDetected = 1;
	if(sz > X.Sz() && !X.isVerbose()) sVersion = "malformed!short";
	if(X.isVerbose()) {
		sOption('ord:'+(ptndp-ordp-1)+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz));
	}
}


function isImagoOrpheus() {
	//ref https://sourceforge.net/p/xmp/libxmp/ci/master/tree/src/loaders/imf_load.c
	if(!X.c("'IM10'",0x3C)) return false;
	if(X.U16(0x20) > 0x100 || X.U16(0x22) > 0x100 || X.U16(0x24) > 0xFF
	  || !X.U8(0x30) || X.U8(0x31) < 0x20 || X.U8(0x32) > 0x40 || X.I8(0x33) < 4) return false;
	ord = X.U16(0x20); ptn = X.U16(0x22); ins = X.U16(0x24); spd = X.U8(0x30); bpm = X.U8(0x31);
	ch = chon = 0; chns = [];
	var t,rs,r,psz,b,nsmp;
	for(p=0x40; p < 0x240; i++,p+=0x10) { // name[12]+chorus+rev+pan+status
		if(X.isVerbose()) { t = X.SC(p,12,'CP437').trim(); if(t.length) chns.push(t) }
		if(X.U8(p+15) <= 1) ch++; if(!X.U8(p+15)) chon++;
	}
	if(!ch) return false;
	for(notes=i=0,p=0x340; i < ptn && p < X.Sz(); i++) {
		psz = X.U16(p)-4; rs = X.U16(p+2); if(rs > 0x100) return false; p += 4;
		if(X.isDeepScan()) while(--psz >= 0 && p < X.Sz()) {
			b = X.U8(p++); if(b == 0) { r++; if(r >= rs) return false; continue }
			if(b&0x20) { if([0xA0,0xFF].indexOf(X.U8(p++)) < 0) notes++; p++; psz -= 2 }
			if(b&0x80) { p += 2; psz -= 2 }  if(b&0x40) { p += 2; psz -= 2 }
		} else p += psz;
	}
	if(p > X.Sz()) return false;
	inss = []; smps = [];
	for(smp=i=0; i < ins; i++) {
		if(X.isVerbose()) { t = X.SC(p,32,'CP437').trim(); if(t.length) inss.push(t) }
		p += 0x180; //skip name,map, reserved, all the envelopes, sample flags, fadeout
		if((nsmp=X.U16(p-6)) > 0xFF) return false;
		if(!X.c("'II10'",p-4) && X.U32(p-4)) return false;
		for(j=0; j < nsmp; j++,smp++) {
			if(X.isVerbose()) smps.push(X.SC(p,13,'CP437').trim());
			var ssz = X.U32(p+0x10), lps = X.U32(p+0x14), lpe = X.U32(p+0x18), f = X.U8(0x30);
			if(ssz > 0x100000 || lps > 0x100000 || lpe > 0x100000) return false;
			if(X.U8(p+0x24) > 0x40/*vol*/) return false;
			p += 0x40;
			if(!X.c("'IS10'",p-4) && !X.c("'IW10'",p-4)) return false;
			p += ssz
		}
	}
	return true
}
if(!bDetected && isImagoOrpheus()) {
	sName = "Imago Orpheus module (.IMF)"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SC(0,0x20,'CP437'));
		sOptionT(addEllipsis(inss.join(' ')),'insts/msg:"','"');
		sOptionT(addEllipsis(smps.filter(funSampleName).join(' ')),'smps/msg:"','"');
		sOption('spd0:'+spd+' bpm0:'+bpm+' ch:'+chon+(ch==chon?'':ch)
			+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp:'+smp+(notes?' notes:'+notes:'')+' sz:'+outSz(p));
	}
}



function isPMD() {
	// ref https://raw.githubusercontent.com/ValleyBell/MidiConverters/master/pmd_SeqFormat.txt
	// & https://web.archive.org/web/20220928062748/https://lithcore.cn/2318/
	// & https://github.com/mistydemeo/pmdmini/blob/master/src/pmdmini.c
	// & https://gitlab.com/bunnylin/supersakura/blob/dev/doc/mus/pmd.md
	// & https://github.com/stuerp/foo_input_pmd/blob/master/PMD/PMD.cpp
	if(X.Sz() < 37 || !isWithin(nV=X.I8(0), -1,2/*0xF*/)) return false;
	if(X.U16(1) == 0x1A) var nptr = 13; else if(X.U16(1) == 0x18) var nptr = 12; else return false;
	function re(p,t) { if(debug>1)_l2r('pmd',p,t); return false }
	function trktxt(n) {
		if(n < 0) return '??';
		else if(n < 6) return 'FM '+(n+1);
		else if(n < 9) return 'SSG '+(n-5);
		else if(n === 9) return 'OPNA ADPCM B';
		else if(n === 10) return 'OPNA Rhythm';
		else if(n === 11) return 'Rhythm Subs';
		else if(n === 12) return  'FM insts';
		else return '??'
	}
var trkpt = []; //debug
	for(i=0,oldchn=X.U16(1); i < nptr; i++) { //ptrs to the 11 tracks, rhythm funcs, (maybe optionally?) FM insts
		p = X.U16(1+i*2); if(/*p &&*/ !isWithin(p, 0x1A,X.Sz()-1)) return re(p,'!badtrkp');
trkpt.push(Hex(p+1)+': '+trktxt(i)); //debug
		if(isWithin(i, 1,11) && X.U8(p) != 0x80) return re(p,'!badtrkend'+X.U8(p)); //data blocks end in 80h
		if(isWithin(i, 1,10) && p <= oldchn) return re(p,'!badtrkp'); // not sorted right
		if(!i && X.U8(p) == 0xC6) for(j=p+1; j < p+9; j+=2)
			if((t=X.U16(j)) && !isWithin(t, p,X.Sz()-1)) return re(p,'!badC6trkp');
		oldchn = p;
	}
//_l2r('pmd','',trkpt.join(' || ')); //debug
	rhosz = (X.U16(0x17)-X.U16(0x15)-1); rhysz = (X.U16(0x19)-X.U16(0x17)-2) >> 1;
	rho = rhy = 0;
	var rhy1 = oldrhy = 0, rhy0 = 0xFFFFFF;
	if(rhosz > 0) for(q=X.U16(0x15)+1; q < X.U16(0x17)+1; q++) {
		//rhythm subroutine orderlist, most likely? the first byte seems to be the number of loops
		t = X.U8(q);
//_l2r('rho',q,'#'+Hex(t))
		if(t == 0x80) break; if(t >= rhy && t < 0x80) rhy = t+1; //just sometimes, rhy-orderlist items like F6 happen
		rho++
	}
	if(rhysz > 0 && rhosz > 0) for(q=X.U16(0x17)+1; q < rhy0 && q < X.U16(0x19)-1 && rhy1 < rhy; q+=2) {
		//rhythm subroutine pointers; the last 2 bytes are probably about the version
		t = X.U16(q)+1;
//_l2r('rhy',q,'*'+Hex(t))
		if(!isWithin(t, q,X.Sz())) break;//_l2r('rhy',q,'OOBrhyptr '+Hex(t));
		if(!rhy1) rhy0 = t;
		if(t >= 0xFE00 || X.U16(0x19)-q < 2) break;
		rhy1++; oldrhy = t;
	}
	bad = ''; ttype = ''; extra = -1; sV = '';
	if(rhysz >= 4) {
		extrap = p-3; extra_type = X.U8(extrap+2);
		if(!isWithin(extra_type, 0x40,0x4F)) bad = bad.addIfNone('!badxtype'+Hex(extra_type));
		if(extra_type < 0x42) ttype = "PCP/P86";
		else if(extra_type < 0x48) ttype = "PPS";
		else if(nV == -1) ttype = "FM Towns"; else ttype = "PPZ";
		extra = X.U16(extrap,_LE)+1;
		if(!isWithin(extra, 1,X.Sz()))
			bad = bad.addIfNone('!'+Hex(extra)+' out of '+Hex(extrap-1));
		else for(i=0; i < 4; i++) {
			p = X.U16(extra+i*2,_LE);
			if(p < 27 || p+1 > X.Sz()) bad = bad.addIfNone('!extrapOOB'+Hex(extra))
		}
	}
//else _l2r('fe',p-1,'version?'+Hex(X.U8(p-1)));
	return true
}
if(!bDetected && isPMD() ) {
	bDetected = 1;
	sName = "Masahiro 'Kajapon' Kajihara's Professional Music Driver module (.M,.M2)";
	sVersion = nV >= 0? 'v'+nV+'/'+['OPN/OPNA','OPM','OPL2',,,,,,,,,,,,,,][nV]: '';
	sVersion = sVersion.appendS(/*'t'+Hex(extra_type).substr(0,2)+":"+*/ttype/*+" tagptrs:"+Hex(extra)*/,' ');
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		fnames = [];
		if(extra > 0) {
			if(extra_type >= 0x48) {
				n = X.SC(X.U16(extra,_LE)+1,0x100,"Shift_JIS"); extra+=2;
				if(n != "") fnames.push("PPZ:"+n)
			}
			if(extra_type >= 0x42) {
				n = X.SC(X.U16(extra,_LE)+1,0x100,"Shift_JIS"); extra+=2;
				if(n != "") fnames.push("PPS:"+n)
			}
			n = X.SC(X.U16(extra,_LE)+1,0x100,"Shift_JIS"); extra+=2;
			if(n != "") fnames.push("PPC/P86:"+n);
			title = X.SC(X.U16(extra,_LE)+1,0x100,"Shift_JIS");
			if(title == "\x1A") title = "";
			artist = X.SC(X.U16(extra+2,_LE)+1,0x100,"Shift_JIS");
			if(artist == "\x1A") artist = "";
			arenji = X.SC(X.U16(extra+4,_LE)+1,0x100,"Shift_JIS");
			if(arenji == "\x1A") arenji = "";
			rem = X.SC(X.U16(extra+6,_LE)+1,0x100,"Shift_JIS");
			if(rem == "\x1A") rem = "";
			sOption(title);
			sOption(artist,"by: ");
			sOption(arenji,"mixed by: ");
			sOption(rem);
			sOption(fnames.join(", "),"fn: ");
		}
		t = X.U8(X.U16(0x15)+1);
		sOption('rhyord:'+rho+(rho?(t?'×'+t:'')+' rhy:'+rhy:''))
	}
}


function isMUAP98() {
	//ref http://ohta.music.coocan.jp/packen/data/muap641s.lzh / NAX.ASM & PLAY4.ASM
	function re(p,t) { if(debug>1)_l2r('muap',p,t); return false }
	if(X.Sz() < Math.max(X.U16(0x20),0x26) ) return false;
	ch = notes = sz = sus = 0; msg = ''; var t;
	for(i=oldp=0; i < 0x11; i++) {
		t = X.U16(i*2);
		if(!isWithin(t, Math.max(0x18,oldp),X.Sz()))
			return re(i*2,'!ptr#'+i+'OOB '+outArray([t,oldp,X.Sz()],16));
		if(i && X.U8(t-1) != 0xFC) return re(t-1,'!FC@');
		if(X.U8(t) != 0xFC) {
			var r = parseMUAP98(t, X.isDeepScan()?BCParseToEoF:BCParseToReasonable, i);
			if(r[0] == BCInvalidFormat) return false;
			notes += r[0]; msg = msg.appendS(r[3],'\n'); ch++; if(sz < r[4]) sz = r[4]; sus += r[5]
		} else if(sz < t+1) sz = t+1;
		oldp = t
	}
	if(sus > ch*3) return false;
	bad = sus?'suspicious'+sus:'';
	return true
}
if(!bDetected && isMUAP98()) {
	sName = "Packen/ぱっくん Software MUAP98/みゅあっぷ Object chiptune (.O,.OX+TONES.DTA)"; bDetected = 1;
	if(bad.length) sVersion = bad;
	if(X.isVerbose()) {
		sOptionT(msg); //actually meant to display lyrics
		sOption('ch:'+ch+(X.isDeepScan()?' notes:'+notes+' sz:'+outSz(sz):''));
	}
}


function isRobHubbardRH() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/RobHubbard/src/RobHubbard_v7.asm
	//the FX files not included -- TODO
	if(!X.c("6000.... 6000.... 6000.... 6000.... 6000....  41FA.... ........ 4E7541FA"))
		return false; //Check2
	a2 = 0x40; d4 = 8;
	do { //loop2
		if(X.U16(a2,_BE) == 0x2418) break;
		a2 += 2; d4--
	} while(d4);
	if(!d4) return false; //found2
	smp = d3 = X.U8(a2-1)+1;
	a2 = 0x36; d4 = 5;
	do { //loop3
		if(X.U16(a2,_BE) == 0x41FA) break;
		a2 += 2; d4--
	} while(d4);
	if(!d4) return false; //found3
	a2 += 2;
	a4 = a2;
	d4 = a2+X.U16(a2,_BE)+2; //minus a3 = moduleptr, 0 in our case
	if(X.U16(a4+2,_BE) == 0xD1FC) d4 += 0x40;
	a3 = d4-2; //again +moduleptr; then moduleptr[a6] = a3 (puts in sampleptr); a6 += 4;
	d5 = 0; a2 = a3;
	do { //loop4
		d1 = X.U32(a3,_BE);
		if(d1 > 0x10000) return false;
		d1 += 6;
		d5 += d1;
		a3 += d1;
		d3--
	} while(d3);
	if(X.U16(a3,_BE) != 0x4E71) return false; //at the EOF now
	a3 = 0; a0 = 130+a3;
	d0 = 10;
	do { //loop
		if(X.U16(a0,_BE) == 0x41EB) { a0 += 2; break }
		a0 += 2; d0--;
	} while(d0);
	if(!d0) return false; //else found
	d1 = 0;
	d2 = X.U16(a0,_BE);
	a3 += d2;
	do { //hop
		a3 += 18; d1++;
	} while(X.U16(a3,_BE));
	d2 = a2-a3;
	do { //petla
		b = X.U8(a3);
		if(b != 0x84)
			if(b != 0x85)
				{ a3++; d2--; if(d2 < 0) break; else continue }
		d0++; a3++; d2--
	} while(d2 >= 0);
	songsz = d4;
	sz = d4+d5;
	steps = d0;
	x = d1;
	return true;
}
if(!bDetected && X.isDeepScan() && isRobHubbardRH()) {
	sName = "Rob Hubbard's module (.RH)"; sVersion = "v1.4"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption("smp:"+smp+" steps:"+steps+" songsz:"+songsz+" sz:"+outSz(sz))
	}
}


function isPuma() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/PumaTracker/src/PumaTracker_v2.asm
	//ref http://lclevy.free.fr/amiga/exotic/puma_str.txt
	// && https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_puma.cpp
	ord = X.U16(12,_BE)+1; if(ord > 256) return false;
	ptn = X.U16(0xE,_BE); if(!ptn || ptn > 128) return false;
	synsmp = X.U16(0x10,_BE); if(!isWithin(synsmp,1,32)) return false; //"number of sound data"
	loop = X.U16(0x12,_BE); 	bad = ''; if(loop >= ord) bad = bad.addIfNone('!badloop');
	if(charStat(X.readBytes(0,12),1).indexOf('allxsc') < 0) return false;
	for(p=0x50,i=mp=0; i < ord && p < X.Sz(); p+=14,i++) //verify orderlist integrity
		for(c=0; c < 4; c++) {
			if((pt=X.U8(p+c*3)) >= 0x80 || !isWithin(X.I8(p+c*3+2),-0x30,0x30)) return false;
			if(pt > mp) mp = pt
		}
	if(i < ord) return false; mp++;
	minsz = p+ptn*8+4+synsmp*16+4; if(minsz >= X.Sz()) return false;
	for(i=0; i < ptn; i++) { //test all patterns
		if(!X.c("'patt'",p)) return false; p += 4; row = 0;
		for(;row < 32; p += 4) {
			var d = X.readBytes(p,4); if(d[0]%2 || !isWithin(d[3],1,32-row)) return false; row += d[3]
		} }
	if(!X.c("'patt'",p)) return false; p += 4;
	smp = msmpp = mssz = evc = 0; plim = Math.min(X.Sz(),0x100000);
	for(i = 0; i < 10; i++) { //test waveform tables
		smpp = X.U32(0x14+i*4,_BE); if(!smpp) continue;
		ssz = X.U16(0x3C+i*2,_BE); if(ssz&1) ssz--; ssz <<= 1;
		if(smpp < minsz || smpp > 0x100000) return false;
		if(smpp > msmpp) { msmpp = smpp; mssz = ssz}
		smp++;
	}
	function checkScript(isVol) {
		var isFirst = true;
		while(p+4 < X.Sz()) {
			var d = X.readBytes(p,4); p += 4;
			if(isFirst && isVol && d[0] != 0xC0) return false;
			switch(d[0]) {
			case 0xA0: evc++; break;
			case 0xB0: evc++; return !(d[1] & 3);
			case 0xC0: if(!isVol) return false; evc++; break;
			case 0xD0:
				if(isVol) return false; evc++;
				if(d[1]&1)/*freezes playback*/ bad = bad.addIfNone('!oddpitch'); break;
			case 0xE0: evc++; return true;
			default:
				if(!isVol && decEncoding(d,CPAmiga) === 'inst') { p -= 4; return evc > 0 }
				return false;
			}
			isFirst = false;
		}
		return evc > 0
	}
	for(i=0; i < synsmp && p < X.Sz(); i++) {
		if(!X.c("'inst'",p)) return false; p += 4;
		if(!checkScript(true)) return false;
		if(!X.c("'insf'",p)) return false; p += 4;
		if(!checkScript(false)) return false;
	}
	if(!X.c("'inst'",p)) return false; p += 4
	if(p > X.Sz()) { sz = -1; bad = bad.addIfNone('!short'); return true }
	sz = Math.max(msmpp+mssz, p);
	return true;
}
if(!bDetected && isPuma()) {
	sName = "PumaTracker module (.PUMA)"; sVersion = "v1.1"; bDetected = 1;
	if(bad != '') sVersion = sVersion.appendS('/malformed'+bad,'/');
	if(X.isVerbose()) {
		sOption(decAnsi(0,0x0C,CPAmiga).trim());
		sOption('ord:'+ord+' ptn:'+mp+(mp!=ptn?'/'+ptn:'')+(smp?' wf.smp:'+smp:'')
			+' syn.smp:'+synsmp+(loop?' lp:'+loop:'')+' events:'+evc+' sz:'+outSz(sz))
	}
}


function isSeanConran() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SeanConran/src/Sean Conran_v3.asm
	//Check2
	if(X.c("0FFF0FE2") || X.c("10000FE2")) {
		if(!X.c("0FC40FA7 0F8B0F6E",4)) return false; //test1
		p = 0x124; //start searching for initp from here
		a0 = 8;
	}
	else
		if(X.c("0F1C0F0E 0F000EF2 0EE40ED6")) {
			p = 0x1C4;
			a0 = 0xA8; //skip to LastCheck
		}
		else return false;
	do { //InitPlayer.FindInit
		t = X.U32(p,_BE); if(!t) return false;
		p += 2; if(p > X.Sz()) return false
	} while([0x45FA,0x43F9,0x41F9].indexOf(t>>16) < 0);
	initp = p-2;
	//LastCheck
	a0 += 0x11C;
	for(d1 = 0; d1 < 0x80; d1++) { //CheckSFX
		if(X.c("7F7F7F7F",a0) || X.c("FFFF",a0)) return false;
		a0 += 2
	}
	// a0 = GetListData(0);
	x = IntAddress = 0; Twin = false;
	do { //Next
		t = X.U16(p,_BE);
		p += 2; if(p > X.Sz()) return false
	} while([0x7000,0x7200].indexOf(t) < 0);
	if(t === 0x7000) { //OneSub
		x = 1;
		// do { //FindSongs
		//     t = X.U16(p,_BE); p += 2; if(p > X.Sz()) return false
		// } while(t != 0x41FA);
		// FirstPos = p+X.I16(p,_BE);
	}
	else { //t=0x7200
		while(!x && p < X.Sz()) {
			if(X.c("00000000",p)) return false;
			if(X.c("21C80070",p)) { //OK4
				// t = p-4; IntAddress = t+X.I16(t,_BE);
				p += 2;
				if(X.c("00003B76",0x24C)) Twin = true;
			} else {
				if(X.c("43FA",p)) {
					t = p+2+X.I16(p+2,_BE); //OK0
					// songsp = t;
					x = (X.I16(t,_BE)-t) >> 3;
				}
				else if(X.c("43EA",p)) {
					t = X.I16(p+2,_BE); //OK2
					// songsp = t;
					x = (X.I16(t,_BE)-t) >> 3;
				}
				else p += 2
			}
		}
		if(!x || p >= X.Sz()) return false
	}
	// there are more checks... although they aren't really necessary here
	return true
}
if(!bDetected && isSeanConran()) {
	sName = "Sean Conran module (.SCR)"; sVersion = "v1.2"; bDetected = 1;
	if(Twin) sVersion += "/Megatwins"
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
	}
}


function isBenDaglish() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/BennDaglish/Benn Daglishv3.asm
	if(!X.c("6000....6000.... ....6000")) return false; //Check2
	d1 = X.I16(0x02,_BE); if(d1 <= 0 || (d1&1) || d1 > X.Sz()) return false;
	a0 = a1 = a3 = d1+2;
	d1 = X.I16(0x06,_BE); if(d1 <= 0 || (d1&1) || d1 > X.Sz()) return false;
	d1 = X.I16(0x0C,_BE); if(d1 <= 0 || (d1&1) || d1 > X.Sz()) return false;
	if(!X.c("3F006100",a1)  || !X.c("3D7C",a1+6)
	  || !X.c("41FA",a1+12)) return false;

	d0 = 0x7F;
	while(d0) //.l6
		if(X.c("D040D040 D04041FA",a0)) {
			a0 += 8;
			a1 = a0+X.I16(a0,_BE); //note the value's signed
			break;
		}
		else {
			a0 += 2; d0--; if(!d0 || a0 > X.Sz()) return false
		}
	x = 0;
	BD_L7: while(1) {
		d2 = 4;
		while(d2) {
			d0 = X.U16(a1,_BE) & 0xFC00;
			a1 += 2; if(a1 > X.Sz()) return false;
			if(d0) { // .not_subsong
				x--; //last subsong
				if(x < 0) x == 0;
				break BD_L7
			}
			else d2--
		}
		x++
	}
	x++;

	//size calc
	// incorrect on some files like 3d galax.bd or super cars.bd
	// but that's what EaglePlayer has, UADE debugger-tested
	d5 = d6 = 0;
	d0 = 0x80;
	while(d0) { //.l9
		t = X.U16(a0,_BE);
		a0 += 2; if(a0 > X.Sz()) return false;
		if(t === 0x41FA) break; else d0--
	} if(!d0) return false;
	smpi1 = a0+X.U16(a0,_BE); //.ok6 .. SampleInfo1
	a0 = 12+X.I16(12,_BE);
	d0 = 0x80; //.l10
	while(d0) { d0--;
		if(X.c("D040D040 41FA",a0)) break;
		else a0 += 2;
		if(a0 > X.Sz()) return false
	}
	if(d0) { //.ok7
		a0 += 6;
		d0 = X.I16(a0,_BE);
		if(d0&1) a0 = 0;
		else {
			a0 += d0;
			if(X.I16(a0,_BE)) a0 = 0
		}
	} else a0 = 0;
	smpi2 = a0; //.ok8

	a0 = smpi1;
	while(1) { //.com1
		d0 = X.U32(a0,_BE);
		a0 += 4; if(a0 > X.Sz()) return false;
		// Interestingly, the UAE emu sets flags on "move"!
		// So ↓ is a d0 check, would've probably been a0 on a real machine
		if(!d0) break;
		if(d0 >> 16) { a0 -= 4; break }
	}
	a0 -= 8; //.ok9
	smp1 = (a0 - smpi1) >> 2;
	d0 = smpi2;
	if(d0) {
		a0 = d0;
		while(1) { //.com2
			d0 = X.U32(a0,_BE);
			a0 += 4; if(a0 > X.Sz()) return false;
			if(!d0) break;
			if(d0 >> 16){ a0 += 4; break }
		}
		a0 -= 8; //.ok10
		smp2 = (a0 - smpi2) >> 2;
	}
	else smp2 = 0;
	//.one_smp_info

	// calc size #1
	d3 = smp1;
	a2 = smpi1+X.I32(smpi1,_BE); //rel.ptr to smpinfo1 table #0?
	d1 = X.I32(a2,_BE);
	d2 = X.U16(a2+8,_BE);
	i = d4 = 0;
	do { //.l11
		i++; if(i === smp1) break;
		a2 = smpi1+X.I32(smpi1+(i<<2),_BE);
		  if(a2 < 20 || a2 > X.Sz()) return false;
		d4 = X.I32(a2,_BE);
		if(d1 > d4) continue;
		if(d1 != d4) {
			if(d4 != X.I32(a2+4,_BE))
				d6 = X.U16(a2+10,_BE);
			else d6 = 0;
			d5 = X.U16(a2+8,_BE);
		} else {
			d5 = X.U16(a2+8,_BE);
			if(d2 > d5) continue;
		}
		d1 = d4; d2 = d5
	} while(i < smp1);

	//.ok11
	d2 += d6;
	sz = smpi1+d1+(d2<<1);

	// calc size #2
	if(smpi2) {
		d3 = smp2 << 2;
		a2 = smpi2+X.I32(smpi2,_BE);
		d1 = X.I32(a2,_BE);
		d2 = X.U16(a2+8,_BE);
		i = d6 = 0;
		do {
			i += 4; if(i === d3) break;
			a2 = smpi2+X.I32(smpi2+i,_BE);
			if(a2 < 20 || a2 > X.Sz()) return false;
			d4 = X.I32(a2,_BE);
			if(d1 > d4) continue;
			if(d1 != d4) {
				if(d4 != X.I32(a2+4,_BE))
					d6 = X.U16(a2+10,_BE);
				else d6 = 0;
				d5 = X.U16(a2+8,_BE);
			} else {
				d5 = X.U16(a2+8,_BE);
				if(d2 > d5) continue;
			}
			d1 = d4; d2 = d5
		} while(i < d3);

		d2 += d6;
		a1 = smpi1 + d1 + (d2<<1);
		if(sz < a1) sz = a1;
	}
	return true
}
if(!bDetected && X.isDeepScan() && isBenDaglish()) {
	sName = "Ben Daglish's module (.BD)"; sVersion = "v1.2"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
			sOption("smp:"+smp1+"+"+smp2+" sz:"+outSz(sz));
	}
}


function isAndrewParton() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Andrew Parton/SRC_AndrewParton/Andrew Parton_v2.asm
	if(!X.c("'BANK'")) return false;
	for(i=0; i < 20; i++)
		if(X.U32(4+(i<<2),_BE) >= 0x200000) return false;
	for(i=0; i < 40; i++)
		if(X.U32(0x54+(i<<2),_BE) >= 0x10000) return false;
	p = 0x54; q = 4; smp = 0;
	smpt = [];
	s = 0x1E4;
	for(i=0; i < 20; i++) {
		t = X.U32(q,_BE); q += 4;
		if(t) {
			smpt.push(X.SA(s,16).trim());
			smp++; s += 16 + X.U32(p,_BE);
		}
		p += 4
	}
	smpsz = s;
	bad = false;
	while(s < X.Sz()) {
		t = X.U8(s); s += 1;
		if(t === 0xFF) break;
	}
	if(s > X.Sz())
		if(X.isHeuristicScan()) bad = true;
		else return false;
	if(X.U8(s) === 0x2F) { sz = s+1; songsz = sz-smpsz }
	else {sz = s; bad = true }
	return true
}
if(!bDetected && X.isDeepScan() && isAndrewParton()) {
	sName = "Andrew Parton's module (.BYE)"; sVersion = "v1.2"; bDetected = 1;
	if(bad) sVersion += "/malformed";
	if(X.isVerbose())
		sOption("smp:"+smp+" songsz:"+songsz+" smpsz:"+smpsz+" sz:"+outSz(sz))
}


function isAshleyHogg() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Ashley Hogg/SRC_AshleyHogg/Ashley Hogg_v1.asm
	p = 0;
	for(i=0; i < 4; i++) {
		if(!X.c("6000",p)) return false; p += 2;
		d2 = X.I16(p,_BE); if(d2 <= 0 || (d2&1)) return false; p += 2
	}
	if(X.c("6000",p)) { //new check
		p += 2;
		d2 = X.I16(p,_BE); if(d2 <= 0 || (d2&1)) return false; p += 2;
		if(!X.c("6000",p)) return false; p += 2;
		d2 = X.I16(p,_BE); if(d2 <= 0 || (d2&1)) return false;
		p += d2;
		if(!X.c("48E7FFFE 6100",p)) return false; p += 6;
		p += X.I16(p,_BE);
		if(!X.c("4DF9 00DFF000",p)) return false;
		sV = "new";
	} else //old check
		if(X.c("303C0000 662233C0",p))
			sV = "old";
		else return false;

	if(sV === "new") { //new format
		a2 = special = 0x1C;
		a0 = X.I16(2,_BE);
		title = X.SA(special,X.fStr(special,a0-a2,"  ")-a2).trim();
		//skipped a cycle that replaces twin spaces with enters in the info
		do {
			t = X.U16(a0,_BE); a0 += 2;
		} while(t != 0x45FA || a0 > X.Sz());
		a2 = a0; a0 += X.I16(a0,_BE);
		if(a0 > X.Sz()-2)
			if(X.isHeuristicScan()) bad = true; else return false;
		d0 = X.I16(a0,_BE);
		x = d0 >> 2;
		a0 += d0 + X.I16(a0-2,_BE);
		do {
			if(a0 > X.Sz()-2)
				if(X.isHeuristicScan()) bad = true; else return false;
			t = X.I16(a0,_BE); a0 += 2;
		} while(t != 0x03F2);
		sz = a0;
		info = 'title: "'+title+'" sz:'+outSz(sz)
	}
	else { //old format
		special = 0;
		a2 = 16;
		a0 = 2; a0 += X.U16(a0,_BE);
		do { t = X.I16(a0,_BE); a0 += 2; } while(t != 0x1970 || a0 > X.Sz());
		a1 = a0-4; a1 += X.I16(a1,_BE);
		do { t = X.I16(a0,_BE); a0 += 2; } while(t != 0x41FA || a0 > X.Sz());
		a0 += X.I16(a0,_BE);
		x = (a1-a0) >> 4;
		do { t = X.U16(a2,_BE); a2 += 2; } while(t != 0xC2FC || a0 > X.Sz());
		a2 += 4; smpip = a2+X.U16(a2,_BE);
		do { t = X.U16(a2,_BE); a2 += 2; } while(t != 0x47FA || a0 > X.Sz());
		a0 = a2; a2 += X.U16(a2,_BE);
		songsz = a2;
		do { t = X.U16(a0,_BE); a0 += 2; } while(t != 0x49FA || a0 > X.Sz());
		do { t = X.U16(a0,_BE); a0 += 2; } while(t != 0x49FA || a0 > X.Sz());
		a0 += X.U16(a0,_BE);
		smp = (a0-smpip)/0x2C;
		d1 = 0; a1 = smpip;
		a3 = 0x54F3; //value copied from a debugging session ¯\(。⊿°)/¯
		do { //NextInfo
			d2 = X.I32(a1+0x20,_BE);
			if(d2 >= 0 && d1 <= d2) { d1 = d2; a3 = a1 }
			a1 += 0x2C
		} while(a0 > a1);
		d0 = X.U16(a3+0x28,_BE);
		d1 += d0+d0;
		smpsz = d1;
		sz = songsz+smpsz;
		info = "smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)+" sz:"+outSz(sz)
	}
	return true
}
if(!bDetected && X.isDeepScan() && isAshleyHogg()) {
	sName = "Ashley Hogg's module (.ASH)"; sVersion = sV; bDetected = 1;
	if(bad) sVersion += "/malformed";
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption(info)
	 }
}


function isCinemaware() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Cinemaware/Cinemaware.asm
	if(!X.c("'IBLK'")) return false;
	d2 = X.U8(4);
	if(!d2 || d2 > 0x80) return false;
	a1 = 0x16+0x8A*d2;
	aseq = X.fSig(a1,0x104,"'ASEQ'");
	if(aseq < 0 || (aseq&1)) return false;
	p = aseq+4; sz = 0; bad = false;
	do {
		sz += 5;
		if(sz+p > X.Sz())
			if(X.isHeuristicScan()) { bad = true; break }
			else return false;
	} while(!X.c("102F00",sz+p-3));
	sz += p; ord = Math.floor((sz-p)/100);
	return true
}
if(!bDetected && X.isDeepScan() && isCinemaware()) {
	sName = "Cinemaware module (.CIN)"; bDetected = 1;
	if(bad) sVersion = "malformed";
	if(X.isVerbose()) {
		sOption("ord:"+ord+" sz:"+outSz(sz)+ " (sans ext.samples)")
	}
}


function isCustomMade() {
	//ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/CustomMade/CustomMade_v1.asm
	if(X.Sz() < 3000) return false;
	if(X.c("6000.... 6000") || X.c("4EF9.... ....4EF9")
	  || X.c("4EB9.... ....4EF9")) {
		p = 8; var found = false;
		do {
			if(X.c("42280030 42280031 42280032",p)) found = true;
			p += 2
		} while(!found && p < 0x198);
	}
	if(!found) return false;
	else if(!X.isVerbose()) return true;
	//otherwise let's dig in for smp, synthsmp, and subsongs!
	p = q = d0 = d5 = 0; d7 = 0x800; org = 0; smpi = 0; songst = 0;
	bad = false;
	while(d7 && p < X.Sz()) {
		if((c=X.U32(p,_BE)) === 0xD04149FA) { /*lp @d366*/
			d0 = X.I16(p+4,_BE); q = p+d0+4;
			Table = q;
		}
		else if([0x48E7F8FC, 0x48E7FFFE].includes(c)) { /*play/ptntab @d37e; 2.0 @d38e*/
			d6 = a3;
			if(!d6 || org) d6 = 20;  else { q = p-a3; /*play-oldplay*/ d5 -= q; /*nowadr-dx*/ org = d5 }
			while(d6-- >= 0) { /* 2.lp */
				t = X.U16(p,_BE); p += 2; if(t === 0x41FA) { d0 = X.I16(p,_BE)/*2.2: @d3ae*/; songst = q = p+d0; break }
			}
		}
		else /*3 @d3bc*/ if(c === 0xE94847F0) /*ptoff*/ { d1 = X.I16(p+4,_BE) }
		else /*4 @d3cc*/ if(c === 0x00BFD500) { /*oldplay*/
			tmrval = (X.U8(p-1) << 8) + X.U8(p+7);
//_log("tmrval:"+Hex(tmrval));
			//tmrval = d0;
			if(!X.c("4E71",p+20)) {
				if(X.c("21FC",p+28)) a3 = X.U32(p+30,_BE);
				else if(X.c("C000",p+32)) a3 = X.U32(p+32,_BE);
				else a3 = X.U32(p+22,_BE);
			}
		}
		else /*6 @d410*/ if(c === 0x42A8001C) /*smpinfo*/ { d0 = X.I16(p+6,_BE); smpi = q = p+d0+6; }
		else if([0xE44843FA, 0xE448207B].includes(c)) { /*oldvoc1 7.1 @d438*/
			if(a4) {
				d0 = X.I16(p+4,_BE); // @d43c
				a4 -= X.I32(p+d0+4,_BE); //voc0-oldvoc0
				if(!org) { d5 -= a4; org = d5 }
			}
		}
		else /*8 @d44e*/ if(c === 0x48E700F0) /*voc0*/ { d0 = X.I16(p+6,_BE); /* @d456*/; a4 = p+d0+6; }

		/*lp_c @d45e*/
		p += 2; if(c === 0x1AC01940) break; /* -> @ex, because p is unused there */
		d7--;
	}
	songst += d1; // @ex @d46c
	for(x=0,p=songst+1; p < X.Sz(); x++,p+=16) /*Find*/ if(X.c("DFF0A0",p)) break;
	if(p > X.Sz()) { bad = true; return true }

	smp = synsmp = 0;
	for(p=smpi; !X.U32(p+28,_BE); p+=0x20) {
		a2 = X.U32(p,_BE)-org; a24 = X.U16(a2+4,_BE);
		if(a24 === 2 || a24 === 16) smp++;  else synsmp++;
	}
	return true
}

if(!bDetected && isCustomMade()) {
	sName = "Ivo Zoer & Ron Klaren's CustomMade module (.CM)"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		//sOption("Origin:"+Hex(org)+" SongsTab:"+Hex(songst)+" SamplesInfo:"+Hex(smpi)+" Table:"+Hex(Table))
		sOption("smp:"+smp+" syn:"+synsmp+" timer:"+tmrval)
	}
}


function isDaveLoweNew() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/DaveLoweNew/src/Dave Lowe New.s
	// ref Dave Lowe New_v2.asm
	a1 = 0; d1 = X.I16(0,_BE);
	if(d1 === 4) { if(!X.U32(0x18,_BE))  a1 += 4 }
	else if(d1 === 8)  a1 += 4;
	else return false;
	a1 += 4; a2 = a1;
	for(d2=0; d2 < 4; d2++) { //FirstCheck
		if(X.I16(a1,_BE)) return false; a1 += 2;
		d1 = X.I16(a1,_BE); a1 += 2; if(d1 <= 0 || (d1&1)) return false;
	}
	for(d0=0; d0 < 4; d0++) { //SecondCheck
		a1 = d1 = X.I32(a2,_BE); a2 += 4;
		d2 = X.I32(a1,_BE);
		if(X.I16(a1,_BE)) return false; a1 += 2;
		d1 = X.I16(a1,_BE); a1 += 2;
		if(d1 <= 0 || (d1&1)) return false;
		a1 = d2;
		t = X.I16(a1,_BE);
		if(t === 0x30) { a1 += 2; t = X.I16(a1,_BE); }
		if(t === 12) {
			a1 += 6;
			t = X.I16(a1,_BE); a1 += 2;
			if(t === 4) break;
		}
	}
	d2 = X.I32(a1,_BE); if(X.I16(d2,_BE) != 1) return false;
	a1 = a2 = d2 >> 16; if(a1) return false;
	fmt = 1;
	if(!X.U32(0x18,_BE)) {
		fmt = 0;
		x = (X.I16(2,_BE)-8) >> 5
	}
	else {
		x = 0; p = X.U16(0,_BE);
		while(p < X.Sz()) {
			t = X.I16(p,_BE); p += 2; if(t) break;
			t = X.I16(p,_BE); p += 2; if(!t || (t&1)) break;
			x++
		}
		x >>= 2
	}
	bad = ''; sz = 0; a1 = d2;
	while(a1 < X.Sz()) {
		a2 = a1; a1 -= 14;
		if(X.I16(a1,_BE) != 1) break
	}
	//smpi = a2;
	t = X.I16(a2-2,_BE);
	if(t != 8 && t != 0) a2 += 14;
	sz = 0; smp = 0;
	while(a2 < X.Sz()) { //CheckInfo
		t = X.I16(a2,_BE); if(t != 1) break; else smp++;
		a2 += 2;
		d2 = X.I32(a2,_BE); a2 += 6; t = X.I32(a2,_BE);
		if(t > d2) d2 = t;
		if(d2 > sz) sz = d2;
		a2 += 6
	}
	if(sz > X.Sz()) bad = bad.addIfNone("!short");
	if(a2 >= X.Sz()) { bad = bad.addIfNone("!badsmpinfo"); return true }
	sz += 0xFE;
	return true
}
if(!bDetected && X.isDeepScan() && isDaveLoweNew()) {
	sName = 'Dave "Uncle Art" Lowe New module (.DLN)'; bDetected = 1;
	sVersion = "f."+fmt; if(bad != "") sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption("smp:"+smp+" sz:"+outSz(sz));
	}
}


function isDesire() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Desire/src/Desire_v1.asm
	if(X.Sz() <= 2500) return false;
	a2 = 0; a0 = 8;
	for(d1=0; d1 < 4; d1++) { if(!X.c("00010101",a0)) return false; a0 += 16 }
	a1 = 400+a0;
	do {
		if(a0 === a1) return false;
		t = X.I16(a0,_BE); a0 += 2;
	} while(t != 0x49FA);
	a0 += 2;
	if(!X.c("45F900DF F000357C 00FF009E 41FA",a0)) return false; a0 += 14;
	a0 += X.I16(a0,_BE);
	if(a0 != a2) return false;
	a1 = 0xF0;
	do { t = X.U16(a1,_BE); a1 += 2
	} while(t != 0x49FA && a1 < X.Sz()); a1 -=2; //FindPlay
	do { t = X.U16(a1,_BE); a1 += 2 //FindSongs
	} while(t != 0x47FA && a1 < X.Sz());
	a2 = a1+20; a1 += X.I16(a1,_BE); x = 0; a1++;
	do { //CheckSongs
		d1 = X.U8(a1); a1++; if(d1) x++; else break;
	} while(d1 != X.U8(a1) && a1 < X.Sz());
	do { t = X.U16(a2,_BE); a2 += 2 //Find1
	} while(t != 0xE341 && a2 < X.Sz());
	do { t = X.U16(a2,_BE); a2 += 2 //Find2
	} while(t != 0x47FA && a2 < X.Sz());
	smptsz = a1 = a2+X.I16(a2,_BE);
	do { t = X.U16(a2,_BE); a2 += 2 //Find3
	} while(t != 0x47FA && a2 < X.Sz());
	a3 = a2; a2 += X.I16(a2,_BE); smpp = a2;
	a0 = a2; d4 = a1-a2; a2 = a1+d4; smp = 0;
	do { t = X.I16(a1,_BE); a1 += 2; if(t) smp++; } while(a1 < a2); //NextS,NoSamp
	do { t = X.U16(a3,_BE); a3 += 2 //Find4
	} while(t != 0x47FA && a3 < X.Sz());
	a3 += 2;
	d6 = X.U16(a3,_BE) & 0x0E00;
	if(d6) d6 >>= 9; else d6 = 8;
	ruch = d6; //Skip8
	d1 = X.I16(a0,_BE); songsz = d2 = d1 << d6;
	t= d1;d1=d2;d2 =t; d5 = 0;
	do { //NextOff
		d0 = X.I16(a0,_BE); a0 += 2;
		if(d0 > d2) { d2 = d0; d5 = X.U16(a0+d4-2,_BE) }
	} while(a0 < smptsz);
	d2 <<= d6; d5 <<= 1; d2 += d5;
	sz = d2; smpsz = sz-songsz
	return true
}
if(!bDetected && X.isDeepScan() && isDesire()) {
	sName = "Desire player module (.DSR)"; bDetected = 1;
	sVersion = "v1.0";
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption("smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)+" sz:"+outSz(sz))
		if(sz < X.Sz()) sVersion += "/malformed!short"
	}
}


function isDavidWhittaker() {
	// from https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/Players/DavidWhittaker/DavidWhittakerWorker.cs
	// <space>sfx.dw not detected, -sfx.dw may be detected sometimes
	if(X.Sz() < 2048) return;
	const sl = Math.min(X.Sz(), 0x4000); //search buffer length
	//and now for the NP routine ExtractInfoFromInitFunction
	sz = x = ch = smp = sqwfsmp = i = 0;
	for(; i < sl; i += 2) if(X.U16(i,_BE) == 0x47FA && (X.U8(i+2) & 0xF0) == 0xF0) break;
	if(i >= sl-6) return;
	sofs = i+2+X.I16(i+2,_BE);
	for(; i < sl && i < X.Sz(); i += 2) if(X.U16(i,_BE) ==0x6100) break; if(i >= sl-6) return;
	sinit = i; ssmpsinit = i;
//_log("ssmpsinit:"+Hex(ssmpsinit))
	if(X.U16(i+4,_BE) == 0x6100) ssmpsinit = i+6+X.I16(i+6,_BE);
	for(i = ssmpsinit; i < sl; i += 2) if(X.U16(i,_BE) == 0x4A2B) break;
	if(i >= sl-36) return;
	if(X.U8(i+4) != 0x66) {
		for(i = sinit; i < sl; i += 2) if(X.U16(i,_BE) == 0x41EB) break;
		if(i >= sl-36) return;
		smpdp = sofs+X.I16(i+2,_BE);
		i += 4; if(X.U8(i+4) != 0x72) return;
		smp = X.U8(i+5)+1;
		for(; i < sl-4; i += 2) if(X.c("41EB....E34F",i)) break;
		if(i >= sl-4) return false;
		chvolp = sofs+X.I16(i+2,_BE);
//_log("@"+Hex(i)+" smpdatap:"+Hex(smpdp))
		//extract subsong info:
		for(i = sinit; i < sl; i += 2) if(X.c("41EB....17",i)) break;
		if(i >= sl-4) return;
		sstp = sofs+X.I16(i+2,_BE);
		is32bp = true; old = true;
	}
	else {
		old = false;
		if(!X.U8(i+5)) i += 2;
		if(X.U16(i+6,_BE) != 0x41FA) return;
		smpdp = X.I16(i+8,_BE)+i+8;
		i += 10; if(X.c("2748....D0FC",i)) {
			smpdp += X.U16(i+6,_BE);
			i += 12; if(X.U16(i,_BE) != 0xD0FC) return;
			smpdp += X.U16(i+2,_BE); i += 4
		}
//_log("@"+Hex(i)+" smpdatap:"+Hex(smpdp))
		if(!X.c("4BFA....72",i)) return false;
		smpip = X.I16(i+2,_BE)+i+2;
		smp = X.U8(i+5)+1;
		for(i = sinit; i < sl-4; i += 2) if(X.U16(i,_BE) == 0x41FA && X.U8(i+4) != 0x4B) break;
		if(i >= sl-4) return;
		if(X.U16(i+4,_BE) != 0x1230 && X.U16(i+4,_BE) != 0x3770) return;
		sstp = i+2+X.I16(i+2,_BE);
		i += 4; for(; i < sl-8; i += 2) if(X.U16(i,_BE) == 0x41FA && X.U8(i+4) != 0x23) break;
		if(i >= sl-8) return;
		if(X.U16(i+4,_BE) == 0x2070) is32bp = true;
		else if(X.U16(i+4,_BE) == 0x3070) is32bp = false;
		else return;
	}
//_log("sstp:"+Hex(sstp))
	//load sample info, get size:
	p = smpdp;
	for(i = 0; i < smp; i++) {
		ssz = X.U32(p,_BE); p += 6;
//_log("smpd["+i+"] @"+Hex(p-6)+" sz:"+outSz(ssz));
		if(p+ssz > X.Sz()) { bad = bad.addIfNone("!short"); return true }
		p += ssz; sz = p;
	}
	for(i = 0; i < sl; i += 2) if(X.U16(i,_BE) == 0x47FA) {
		if(i >= sl-10) return;
		if (X.c("4A2B....67",i+4)) {
			if([0x33FC, 0x177C, 0x08B9].includes(X.U16(i+10,_BE))) continue;
			break
		}
	}
	splay = i;
//_log("splay:"+Hex(i))
	ch = 0;
	for(i = splay; i < splay + 200; i += 2) if(X.U8(i) == 0x7E) {
		ch = X.U8(i+1);
		if(!ch) {
			for(; i < splay + 500; i += 2)
				if([0xBE7C, 0xBE3C].includes(X.U16(i,_BE))) { ch = X.U8(i+3); break }
		} else ch++;
		break
	}
	if(!ch) return;
//_log("ch:"+ch)
	//square waveforms?
	for(i = splay; i < splay+100; i += 2)
		if(X.c("207A.... 303A",i)) {
			sqwfsmp = (X.I16(i+2,_BE)+i+2 - smpip)/12;
			if(![0x31BC, 0x11BC].includes(X.U16(i+14,_BE))) return;
			if((X.U8(i+20) & 0xF0) != 0x50 || X.U8(i+21) != 0x6B) return;
			if(X.U16(i+24,_BE) != 0x0C6B) return false;
			if(![0x31BC, 0x11BC].includes(X.U16(i+38,_BE))) return;
			if(X.U16(i+48,_BE) != 0x0C6B) return;
		}
	//find diff.player parts, just the sanity checks
	if(old) {
		for(i = splay; i < sl; i += 2) if(X.U16(i,_BE) == 0x7000) break;
		if(X.U8(i+2) != 0x10) return;
		var rdtrkcmdp = i
	} else {
		for(i = splay; i < sl; i += 2) if(X.U16(i,_BE) == 0x5368) break;
		if(i >= sl-16 || X.U8(i+4) != 0x67) return;
		var rdtrkcmdp = X.U8(i+5)+i+6;
		if(X.U8(i+12) != 0x66) return;
		for(i = rdtrkcmdp; i < sl; i += 2) if(X.c("45FA.... 322D",i)) break;
		if( i >= sl-6) return;
		i = X.U16(i+2,_BE)+i+2;
		if(i >= sl-72*2) return;
		if(![0x1000, 0x2000].includes(X.U16(i,_BE))) return;
	}
	//checks for transposes:
	for(i = rdtrkcmdp; i < sl; i += 2) if(X.U16(i,_BE) == 0x6B00) break;  if(i >= sl-6) return;
	var endlyc = endlym = false; //:667
	for(i = splay; i < splay + 100; i += 2) if(X.U16(i,_BE) == 0x103A) {
		endlyc = true; if(X.U16(i+6,_BE) == 0xC0FC) endlym = true; break }
//_log("@"+Hex(i)+" dlyc?"+endlyc+" dlym?"+endlym)
	x = 0; p = sstp; minpp = 0xFFFFFFFF; //:966
	sngspd = dlyspd = 0; bad = "";
	while(p+8 < minpp) {
		if(endlyc) { sngspd = X.U8(p++); dlyspd = X.U8(p++) }
		else { sngspd = X.U16(p,_BE); p += 2; dlyspd = 0 }
		if(sngspd > 0xFF) break;
		for(i = 0; i < ch; i++) {
			if(is32bp) { t = X.U32(p,_BE); p += 4 }
			else { t = X.U16(p,_BE); p += 2 }
			if(minpp > sofs+t) minpp = sofs+t;
//_log(x+" ordp:"+Hex(t))
		}
		if(p > X.Sz()) { bad = bad.addIfNone("!short"); break }
		x++
	}
	return true
}
if(!bDetected && X.isDeepScan() && isDavidWhittaker()) {
	sName = "David Whittaker's module (.DW)";
	if(old) sVersion = "old"; else sVersion = "new"; bDetected = 1;
	if(bad != "") sVersion += "/malformed"+bad;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption("ch:"+ch+" smp:"+smp+(sqwfsmp ? " sqwf.smp:"+sqwfsmp : "")
			+" spd:"+sngspd+" sz:"+outSz(sz))
	}
}


function isFashionTracker() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/FashionTracker-v1.0/FashionTracker.asm
	if(!X.c("13FC0040 ........ 4E710439 0001") || !X.c("66F44E75 48E7FFFE",18)) return;
	a2 = 0; bad = "";
	while(X.U16(a2,_BE) != 0x2379 && a2 <= 1000) a2 += 2; //FindOri
	if(a2 > 1000) //corrupt module
		if(X.isHeuristicScan()) bad = "!badorigin"; else return;
	org = X.U32(a2-4,_BE);
	a2 = 0; d1 = 1;
	do { //GetValues:
		// a3 = smplen    a3+4 = smpp      a3+8 = smplp
		// a3+12 = smpn+vol      a3+16 = ptn     a3+20 = songpositions
		if(X.U16(a2,_BE) == 0x23D1) { // L???
			smplen = X.I32(a2+8,_BE)-org;
			smpp = X.I32(a2-6,_BE)-org;
			smplp = X.I32(a2+24,_BE)-org;
			smpnvol = X.I32(a2-30,_BE)-org;
			d1 -= 6;
		}
		else if(X.U32(a2,_BE) == 0xC0FC0400) { //NoL
			ptn = X.I32(a2+6,_BE)-org;
			d1 += 3;
		}
		else if(X.U32(a2,_BE) == 0x0C790400) { //NoPa
			songpos = X.I32(a2+12,_BE)-org;
			len = X.I32(a2+34,_BE);
			d1 += 2;
		}
		a2 += 2 //NextW
	} while(a2 < 1000);
	if(d1)
		if(X.isHeuristicScan()) bad = bad.addIfNone("!badval"); else return;
	a1 = smpp; songsz = X.I32(smpp,_BE)-org;
	d0 = X.I32(a1-4,_BE) << 1;
	a2 = smplen; d1 = a1-a2; a1 += d1; d1 >>= 2; smp = d1;
	d1 = X.I32(a1-4,_BE)-org;
	sz = d0+d1; smpsz = sz-songsz;
	a1 = songpos; a2 = a1+len; ptn = 0;
	do { t = X.U8(a1); if(ptn < t) ptn = t; a1++ } while(a1 < a2); //GetPat
	ptn++;
	d1 = (d0-1)*6; d0 = d1; d1 *= 0x376B;
	dur = Math.floor(d1*64/(709379-3));
	return true
}
if(!bDetected && X.isDeepScan() && isFashionTracker()) {
	sName = "Fashion Tracker module (.EX)"; bDetected = 1;
	sVersion = "v1.0"; if(bad) sVersion += "/malformed."+bad;
	if(X.isVerbose()) {
		sOption("ord:"+len+" ptn:"+ptn+" smp:"+smp+" songsz:"+songsz+" sz:"+outSz(sz))
	}
}


function isSMUS() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SonixMusicDriver/Sonix Music Driver_v1.asm
	a0 = a1 = 0; title = inst = ''; format = "Aegis Sonix Music Driver";
	if(X.c("'FORM'")) {
		if(!X.c("'SMUSSHDR'",8) || !X.U8(0x17) || !X.c("'NAME'",0x18)) return;
		d1 = X.U32(0x1C,_BE); if(d1 >> 31) return;  t_ = d1;
		d1 = (d1+1) & 0xFFFFFFFE; a1 = 0x20+d1;
		if(X.c("'SNX1'",a1)) {
			a1 += 4;
			d1 = X.U32(a1,_BE); if(d1 >> 31) return;  a1 += 4;
			d1 = (d1+1) & 0xFFFFFFFE; a1 += d1;
		} else format = "Electronic Arts' Simple Musical Score";
		insinfp = a1;
		realsmp = []; ins = 0;
		do { //MoreIns
			if(!X.c("'INS1'",a1)) return; a1 += 4;
			d1 = X.U32(a1,_BE); if(d1 >> 31) return;  a1 += 4;
			d1 = (d1+1) & 0xFFFFFFFE; if((d1 >> 24) > 0x3F) return;
			if(X.U8(a1+1)) return;
			realsmp.push(X.U8(a1));
			a1 += d1; ins++
		} while(!X.c("'TRAK'",a1));
		sz = a1; trk = 0; while(sz < X.Sz()) {
			hkhd = X.SA(sz,4); hksz = X.U32(sz+4,_BE);
			if(hkhd != "TRAK") break; trk++; sz += 8+hksz }
//_log("trk:"+trk+" sz:"+outSz(sz))
		title = X.SA(0x20,t_);
		fmt = 2; ext = "smus"
	}
	else {
		if(!(X.U16(0,_BE) & 0xF0)) {
			d3 = 20; d1 = 4;
			while(d1) {
				d2 = X.I32(a0,_BE); if(d2 <= 0 || (d2&1)) return;
				a0 += 4; d3 += d2; d1--
			}
			if(d3 >= X.Sz()) return;
			a0 += 4; d1 = 4;
			while(d1) {
				t = X.U16(a0,_BE); if(!(t & 0x8000)) return;
				if(t != 0xFFFF) if((t >> 16) > 0x84) return;
				a0 += X.I32(a1,_BE); a1 += 4; d1--
			}
			if(!X.U8(a0)) return;
			sz = X.fSig(a0,0x200,"0000");
			if(sz > 0) {
				while(a0 < sz) {
					inst = inst.appendS(X.SA(a0,t=X.fSig(a0,0x200,"00")-a0),'; '); a0 += t+1; }; sz += 2; }
			fmt = 0; ext = "snx"
		}
		else { //TinyCheck
			if(X.Sz() < 333) return;
			a1 = 0x30; if(X.I32(a1,_BE) != 0x140) return;
			a1 += 4; d1 = 3;
			while(d1) { //NextPos2
				d2 = X.I32(a1,_BE); a1 += 4;
				if(d2 <= 0 || (d2&1) || d2 > X.Sz()) return;
				if(X.I16(d2,_BE) != -1) {
					if(X.I32(d2,_BE) || X.I16(d2+4,_BE)) return;
					t = X.U8(d2+6); if(!isWithin(t,0x80,0x82)) return;
				}
				d1--
			} sz = X.fSig(d2,0x200,"FFFF"); if(sz > 0) sz += 2;
			fmt = 1; ext = "tiny"
		}
	}
	return true
}
if(!bDetected && isSMUS()) {
	sName = format+" module (."+ext+")"; sVersion = "f."+fmt; bDetected = 1;
	if(X.isVerbose()) {
		if(title.length) sOption(title);
		if(inst.length) sOption(inst,'+instr.:"','"');
		sOption('sz:'+outSz(sz))
	}
}


function isAMBK() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/ambk/AMOS.s
	if(X.c("'AmBk'")) a0 = p = 4; else if(X.c("C0")) a0 = p = 0; else return false;
	//if(!X.c("80",p+4)) return false;
//_log('AmBk: '+Hex(X.U32(p+4,_BE)&((1<<28)-1)));
	if(!X.c("'Music   '",p+8)) return false;
	p += 0x14; p += X.I32(p,_BE);
	if(X.I16(p,_BE) != 6) return false; p += 2; r = p;
	p += X.I16(p+2,_BE)-2;
	p = X.I16(p,_BE); if(p != -2) if(p) return false;

	title = X.SA(r+0x0C,0x20);
	p = r+0x1E+X.I16(r+0x1E,_BE); ord = -1;
	do { ord++; d1 = X.I16(p,_BE); p += 2; } while(p < X.Sz() && d1 >= 0);
	if(a0) d3 = 4+(X.I32(a0+4,_BE) & 0xFFFFFF);
	else d3 = X.I32(a0,_BE) & 0xFFFFFF; sz = d3+8;
	bad = ""; if(sz > X.Sz()) bad = bad.addIfNone("!short");
	p = r+X.I16(r+6,_BE);
	ptn = 0;
	while(p < X.Sz()) { //.such
		d1 = X.I16(p,_BE); p += 2; if(d1 < 0) break;
		if(d1 > ptn) ptn = d1
	}
	ptn++;
	if(!X.I16(p,_BE)) p += 2;
	if(X.I16(p,_BE) != ptn) bad = bad.addIfNone("!badptn");
	q = a0+0x20; smp = d1 = X.I16(q,_BE); q += 0x10;
	d7 = 0;
	while(d1 && q < X.Sz()) {
		d2 = X.I16(q,_BE);
		if(!d2) d2 = X.I16(q-6,_BE);
		d7 += d2 << 1; q += 0x20; d1--
	}
	smpsz = d7;
	songsz = sz-d7;
	return true
}
if(!bDetected && X.isDeepScan() && isAMBK()) {
	sName = "François Lionet's AMOS Music Bank module (.ABK)"; bDetected = 1;
	if(bad != "") sVersion = "malformed"+bad;
	if(X.isVerbose()) {
		sOption(title);
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+/*" smpsz:"+Hex(smpsz)+" songsz:"+Hex(songsz)+*/" sz:"+outSz(sz))
	}
}


function isTuneFish4() {
	// taken from tunefish src\tunefish4player\tf4player.cpp
	ins = X.I16(0,_LE); if(ins > 32) return false;
	if(!X.c("'INST'",4+ins*2)) return false; t = 8+ins*114;
	if(!X.c("'SONG'",t)) return false;
	t += 4; songsz = 0; for(i=0; i<ins; i++) songsz += X.U16(4+i*2,_LE);
	if(!X.c("'ENDS'",t+songsz*4)) return false;
	sz = t+songsz*4+4;
	return true;
}
if(!bDetected && X.isDeepScan() && isTuneFish4()) {
	sName = "TuneFish module (.TF4)"; sVersion  = "v4"; bDetected = 1;
	if(X.isVerbose())
		sOption("ins:"+ins+" tempo:"+X.U16(2,_LE)+" songsz:"+Hex(songsz)+" sz:"+outSz(sz))
}


function isJH() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Jochen_Hippel_ST/Jochen Hippel_v1.asm
	a0 = 0; tfmx = 0;
	if(X.c("'MCMD'")) { fmt = -1; tfmx = a0 }
	else if(X.c("48E7FFFE")) {
		fmt = -1; a0 += 4; d1 = 0;
		if(!X.c("61",a0)) return false;
		d1 = X.U8(a0+1); if(!d1 || (d1&1)) return false; a0 += d1+2;
		if(!X.c("2F006100",a0)) return false; a0 += 4+X.I16(a0+4,_BE);
		if(!X.c("41FA",a0)) return false;
		if(!X.c("41FA",a0+0x12)) return false;
		a0 += 0x14; a0 += X.I16(a0,_BE);
		if(!X.c("'MCMD'",a0)) return false;
		tfmx = a0
	} else { // NoMCMD
		fmt = 0;
		if(!X.c("60",a0++)) return false;
		d1 = X.U8(a0++);
		if(!d1) {
			fmt = 1; d1 = X.I16(a0,_BE); if(d1 < 0 || (d1&1)) return false;
			if(!X.c("6000",a0+2)) return false;
			a0 += d1;
			if(!X.c("48E7FFFE",a0)) return false; a0 += 4;
		} else { // No3
			if(d1&1) return false; a0 += d1;
			if(!X.c("48E7FFFE",a0)) return false; a0 += 4;
			if(!X.c("6100",a0)) return false; a0 += 2; //astaroth.hip, prince.hip fail this one and have more jumps, iono
			a0 += X.I16(a0,_BE);
			if(!X.c("2F006100",a0)) return false; a0 += 4;
			a0 += X.I16(a0,_BE);
			if(!X.c("41FA",a0)) return false; a0 += 0x14;
		} // Later:
		t = X.c("41FA",a0); a0 += 2;
		if(!t) { t = X.c("41FA",a0); a0 += 2; if(!t) return false }
		a0 += X.I16(a0,_BE);
		tfmx = a0;
		if(!X.c("'TFMX'00",a0)) return false; a0 += 4;
		if(!X.I16(a0+0x0C,_BE)) { fmt = "sfx"; sz = 0; x = 1; return true }
		d1 = (2+X.I16(a0,_BE)+X.I16(a0+2,_BE)) << 6;
		d2 = (1+X.I16(a0+4,_BE))*X.I16(a0+8,_BE);
		d3 = (1+X.I16(a0+6,_BE))*12;
		d1 += d2+d3+(1+X.I16(a0+0x0C,_BE))*6+0x20;
		a0 += d1+0x0E;
		if(X.I32(a0,_BE)) return false; a0 += 4;
		d2 = X.I16(a0,_BE); if(!d2) return false;
		d2 *= 2; if(d2 != X.I32(a0+0x1A,_BE)) return false;
	}
	sz = a0 = 0; x = 1; a1 = a0+tfmx;
	if(fmt < 0) { d0 = 0; d1 = 0x12 } else { d0 = 2; d1 = 0x20 }
	d0 += X.I16(a1+4,_BE)+X.I16(a1+6,_BE); d0 <<= 6;
	d0 += d1; if(fmt < 0) d1 = 0; else d1 = 1;  d1 += X.I16(a1+8,_BE); ptn = d1;
	d1 *= X.I16(a1+0x0C,_BE); d0 += d1;  if(fmt < 0) d1 = 0; else d1 = 1;
	d1 += X.I16(a1+0x0A,_BE); d1 *= 12; d0 += d1;  a2 = subp = a1+d0; d1 = 1;
	if(fmt < 0) { d2 = X.I16(a1+0x0E,_BE); d1 = d2<<3 }
	else { d2 = X.I16(a1+0x10,_BE); d1 = (d1+d2)*6 }
	x = d2; d0 += d1; a2 = smpinfop = a1+d0;
	if(fmt < 0) { d1 = X.I16(a1+0x10,_BE); d2 = 0x1C }
	else { d1 = X.I16(a1+0x12,_BE); d2 = 0x1E }
	smp = d1; d1 *= d2; d0 += d1;
	smpp = a2 = a1+d0; a1 = smpp; if(fmt < 0) a1 += 2;
	smpsz = X.I16(a1-8,_BE)*2+X.I32(a1-0x0C,_BE);
	songsz = a2-a0; sz = songsz+smpsz;
	return true
}
if(!bDetected && X.isDeepScan() && isJH()) {
	if(fmt < 0) ext = ".MCMD"; else ext = ".SOG";
	sName = "Jochen 'Mad Max' Hippel's module ("+ext+",.HIP)"; sVersion = "f."+fmt; bDetected = 1;
	if(X.Sz() < sz) sVersion += "!short";
	if(X.isVerbose()) {
		if(x>1) sOption(x,"×");
		sOption("ptn:"+ptn+" smp:"+smp+/*" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)+*/" sz:"+outSz(sz))
	}
}


function isJH7V() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Jochen_Hippel_7V/Jochen Hippel 7V_v2.asm
	p = 0;
	if(X.c("6000")) { p = 2;
		d1 = X.I16(p,_BE); if(d1 <= 0 || (d1&1)) return false; p = d1+2;
		p = 4+X.fSig(p,20,"308141FA"); if(p < 4) return false;
		d1 = X.I16(p,_BE); if(d1 <= 0 || (d1&1)) return false;
		p += d1;
	}
	if(!X.c("'TFMX'00",p)) return false;
	d0 = d1 = ( 2+X.I16(p+4,_BE) + X.I16(p+6,_BE) ) << 6;
	d0 += 0x20;
	ptn = d2 = X.I16(p+8,_BE)+1;
	d3 = (X.I16(p+0x0A,_BE)+1)*0x1C;
	d2 *= X.I16(p+0x0C,_BE);
	d0 += d2;
	d1 += d2 + d3;
	if(X.U8(p+4+d0)) txt = X.SA(p+4+d0,24);
	else txt = "";
	x = X.I16(p+0x10,_BE);
	d2 = (x+1) << 3;
	ins = X.I16(p+0x12,_BE);
	insip = p+d1+d2+0x20;
	if(X.I32(insip+0x12,_BE)) return false; //1st smp ofs
	d2 = 2*X.I16(insip+0x16,_BE);
	if(!d2) return false;
	if(d2 != X.I32(insip+0x16+0x1E-4,_BE)) return false;
	var mofs = 0; var msz = 0; //find max ofs instead of one just from last smp, just in case
	for(i=0;i < ins;i++) {
		var sofs = X.I32(insip+i*0x1E+0x12,_BE);
		var ssz = X.U16(insip+i*0x1E+0x16,_BE);
		if(sofs >= mofs) { mofs = sofs; msz = ssz } }
	smpp = insip+ins*0x1E;
	sz = smpp+mofs+msz*2;
//_log("insip:"+Hex(insip)+" smpp:"+Hex(smpp)+" sz:"+outSz(sz));
	return true;
}
if(!bDetected && X.isDeepScan() && isJH7V()) {
	sName = "Jochen 'Mad Max' Hippel's module (.HIP7,.S7G)"; sVersion = "7V"; bDetected = 1;
	if(!X.c("'TFMX'")) sVersion += "+replayer";
	if(X.Sz() < sz) sVersion += "!short";
	if(X.isVerbose()) {
		if(txt != "") sOptionT(txt);
		if(x>1) sOption(x,"×");
		sOption("ptn:"+ptn+" ins:"+ins+" sz:"+outSz(sz))
	}
}


function isJHCoSo() {
	//from uade Jochen_Hippel_COSO player, check routine @ e476t
	//initplayer disassembly: d e5c0 500
	if(!X.c("'COSO'")) return false;
	if(!X.c("'TFMX'",0x20)) return false;
	if(!X.I16(0x30,_BE) || !X.I16(0x40,_BE)) return false;
	var songsz = X.I32(0x1C,_BE); if(songsz > X.Sz()) return false;
	//@e4ac:
	a2 = X.I32(4,_BE); d6 = d7 = 0;
	d0 = X.I16(0x24,_BE); //ord?
	do { if(a1 > X.Sz()) return false;
		a1 = X.I16(a2,_BE); a2 += 2;
		if(X.U8(a1) === 0xE2)
			if(X.U8(a1+1)&0x80) d7++; else d6++;
	d0--} while(d0 >= 0);
	if(d7 >= d6) return false;
	ptn = X.I16(0x28,_BE)+1; smp = X.I16(0x32,_BE);
	a0 = X.I32(0x18,_BE)+smp*10; //_log("a0:"+Hex(a0));
	smpsz = X.I32(a0-10,_BE) + X.I16(a0-6,_BE)*2;
	sz = songsz+smpsz;
	x = X.I16(0x30,_BE);
	return true
}
if(!bDetected && X.isDeepScan() && isJHCoSo()) {
	sName = "Jochen 'Mad Max' Hippel's module (.HIPC)"; sVersion = "packed"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,"×");
		sOption("ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz));
	}
}


function isJHST() {
	//from http://wt.exotica.org.uk/files/sources/SRC_JochenHippelST.lzx
	//Test routine @e3fc, init @e57e
	a0 = a1 = a4 = d4 = 0; d1 = 0x80; d0 = X.Sz(); bad = msg = "";
	//func @e84e, returns d0 = 2 if this:
	while(d1) {
		if(a0 > X.Sz() || a1 > X.Sz()) return false;
		if(d1 != 0x80) { //detect the files that start with MMME,TFMX,COSO
			t = X.I16(a1,_BE); a1 += 2;
			if(t === 0x41FA) { d2 = X.I16(a1,_BE); if(d2 >= 0 && !(d2&1)) a0 = a1+d2 }
		}
		if(X.c("'MMME'",a0)) { d0 = 2; break; }
		else if(X.c("'TFMX'",a0)) {
			if(X.I16(a0+4,_BE) >= 0x200) d0 = 0;
			else if(!X.I16(a0+0x10,_BE)) d0 = 0;
			else { // function @e8b0
				//func.@e8b0~e8c8
				d0 = X.I16(a0+4,_BE); a1 = a0+0x20; d6 = d7 = 0;
				do { if(X.U8(a1) === 0xE2) // in func.e928
						if(X.U8(a1+1)&0x80) d6++; else d7++;
					a1 += 0x40;
				d0--} while(d0 >= 0);
				if(d6 > d7) d0 = 2; else d0 = 5; //@e8a8
			}
			break;
		}
		else if(X.c("'COSO'",a0)) {
			if(!X.I16(a0+0x30)) return false; //FX check
			if(!X.I32(a0+0x18)) return false;
			if(X.c("'TFMX'",a0+0x20)) { //@e984
				a2 = a0+X.I32(a0+4,_BE); d6 = d7 = 0;
				d0 = X.I16(a0+0x24,_BE);
				do {
					if(X.I16(a0+0x40,_BE)) { a1 = a0+X.I16(a2,_BE); a2 += 2 }
					else { a1 = a0+X.I32(a2,_BE); a2 += 4 }
					if(a1 > X.Sz()) return false;
					if(X.U8(a1) === 0xE2) {
						if(X.U8(a1+1)&0x80) d7++; else d6++;
					}
				d0--} while(d0 >= 0);
				if(d7 < d6) d0 = 4; else d0 = 2
			}
			else if(X.c("'MMME'",a0+0x20)) d0 = 2; else d0 = 0;
			break;
		}
		d0 -= 2;
		d1--
	}
	if(d0 != 2) return false;
	if(X.c("'LSMP'",a0+0x1C)) lsmp = 1; else lsmp = 0;
	//a0 -= a4; if(a0 && debug)_log("pc+@e170 (mod ofs?): "+a0);

	//size calc
	d0 = X.Sz()-a0; d4 = a0; songsz = smpsz = 0; sz = sz1 = -1;
	if(!X.c("'COSO'",a0) && !X.c("'MMME'",a0+0x20)) { sV = "unpacked";
		d6 = a0; d1 = 2; a2 = a0;
		d1 = (2+X.I16(a0+4,_BE)+X.I16(a0+6,_BE)) << 6;
		d2 = (1+X.I16(a0+8,_BE)) * X.I16(a0+0xC,_BE);
		d3 = (1+X.I16(a0+0xA,_BE))*12; //e5f8
		d1 += d2+d3; d2 = 2+X.I16(a0+0x10,_BE);
		d1 += (d2+X.I16(a0+0x12,_BE))*6+0x20;
		d2 = 0x20; d3 = d7 = 0; //e612
		d0 -= d1;
		if(d0 < 0) /*@e814*/ { d0 = 0x1C; bad = bad.addIfNone("!short") }
		else if(d0 > 0) { //e618
			a1 = d1+a2;
			t = X.I16(a1,_BE);
			if(t === 0x80 || t === 0x100) {
				d7 = a1;
				do { d3 = X.I16(a1,_BE); a1 += 8;
				} while(X.I16(a1,_BE) && a1 < X.Sz()); //e63e
				d0 -= d3; if(d0 < 0)
					d0 = 0x1C;
			}
			else { t >>= 8; p = a1+1; msg = [];
				while(t && p < X.Sz()) { msg.push(t); t = X.U8(p++); }
				msg = decEncoding(msg,CPAmiga,1,Chars0to1FLF)
			}
		}
		d0 = d1; smpsz = d3;
		songsz = d1; sz = a0+songsz+smpsz; sz1 = (msg != "" ? sz+msg.length+1 : sz);
		x = X.U16(a0+0x10,_BE); if(x > 100) return false
	} else { sV = "packed"; a1 = a0; d3 = 0;
		d3 = (1+X.I16(a0+0x32,_BE))*6; d2 = d3+X.I32(a0+0x18,_BE);
		d3 = 0; d0 -= d2;
		if(d0 < 0) /*@e814*/ d0 = 0x1C;
		if(d0 > 0) {
			a1 += d2; t = X.I16(a1,_BE);
			if(t == 0x80 && t == 0x100) {
				do { d3 = X.I16(a1,_BE); a1 += 8;
				} while(X.I16(a1,_BE) && a1 < X.Sz());
			d0 -= d2;
			 if(d0 < 0)
				d0 = 0x1C
		} else { t >>= 8; p = a1+1; msg = [];
				while(t && p < X.Sz()) { msg.push(t); t = X.U8(p++); }
				msg = decEncoding(msg,CPAmiga,1,Chars0to1FLF)
			}
		}
		/*d2 += d4;*/ songsz = d2; smpsz = d3; sz = a0+d3+d2;
		if(msg.length < 3) msg = "";
		sz1 = (msg.length ? sz+msg.length+1 : sz);
		x = X.U16(a0+0x30,_BE); if(x > 100) return false;
	}
	return true;
}
if(!bDetected && isJHST()) {
	sName = "Jochen 'Mad Max' Hippel's Atari ST module (.HST,.SOC,.SOG)"; bDetected = 1
	sVersion = sV; if(bad != "") sVersion = sVersion.appendS("malformed"+bad,"/");
	if(X.isVerbose()) {
		sOptionT(msg,'msg:"','"');
		info = "";
		if(lsmp) info = info.appendS("ext.samples"," ")
		if(sz > 0) info = info.appendS("sz:"+outSz(sz, sz1)," ");
		if(smpsz) info = (/*"songsz:"+Hex(songsz)+" "+*/"smpsz:"+Hex(smpsz)).appendS(info," ");
		if(x > 1) info = ("×"+x).appendS(info," ");
		sOption(info)
	}
}


function isEMS() {
	//ref UADE's EMS player disassembly: run with -d then "f d3c2"
	if(X.Sz() <= 0x53A) return false; // fault is @d432
	if(X.U8(0) != 1) return false;
	if(X.U8(1) > 0x25) return false;
	t = X.I16(2,_BE); if(!t || t > 0x80) return false;
	d1 = X.U16(4,_BE); if(d1 > 0x3F) return false; d = d1 & 0xFF;
	p = 6;
	while(p < 0x86) { t = X.U8(p); p++; if(d < t) return false; }
	c = 0;
	for(p = 0x13A; p < 0x53A; p += 4) { //@d40c
		t = X.I16(p,_BE); if(t < 0) return false;
		if(t)
			if([
			  0x6B0, 0x650, 0x5F4, 0x5A0, 0x54C, 0x500, 0x4B8, 0x474,
			  0x434, 0x3F8, 0x3C0, 0x38A, 0x358, 0x328, 0x2FA, 0x2D0,
			  0x2A6, 0x280, 0x25C, 0x23A, 0x21A, 0x1FC, 0x1E0, 0x1C5,
			  0x1AC, 0x194, 0x17D, 0x168, 0x153, 0x140, 0x12E, 0x11D,
			  0x10D, 0xFE, 0xF0, 0xE2, 0xD6, 0xCA, 0xBE, 0xB4,
			  0xAA, 0xA0, 0x97, 0x8F, 0x97, 0x7F, 0x78, 0x71
			  ].indexOf(t) < 0)
				return false;
			else c++;
	}
	if(!c) return false;
	return true
}
if(!bDetected && X.isDeepScan() && isEMS()) {
	sName = "Editeur Musical Sequentiel module (.EMS)"; bDetected = 1;
}


function isDZ() {
	//from https://zakalwe.fi/uade/uade3/uade-3.03.tar.bz2 / uade/amigasrc/playes/dz/DariusZendeh_mod.s
	if(X.Sz() < 0x500 || !X.c("48E7..F0 41FA.... 4CD80600")) return false;
	if(X.c("78",2) && X.c("0C0000FF",0xC)) sversion = "strange";
	else
		if(!X.c("00",2) || !X.fSig(0xC,0x240,"700033FC 000F00DF F09641FA"))
			return false;
	soptions = "";
	if(X.c("4A44",0xC)) {
		sversion = "type 1";
		if(X.isVerbose()) {
			p = X.fSig(0,0x80,"0C04.... 66..41FA");
			if(p >= 0) soption = "×"+(X.U16(p+2,_BE)+3)
		}
	}
	else if(X.c("4A00",0xC)) sversion = "type 2";
	else if(X.c("0C00",0xC)) sversion = "type 3";
	return true
}
if(!bDetected && isDZ()) {
	sName = 'Darius "Mark II" Zendeh module (.DZ)'; sVersion = sversion; sOptions = soptions; bDetected = 1
}


function isMkII() {
	//ref reversing of the eagleplayer
	// & http://old.exotica.org.uk/tunes/formats/mk2/mk2_v1.zip
	if(!X.c("41FA",4) || X.Sz() < 0x500) return false;
	//if(X.fSig(0x200,0x200,"'.ZADS89.'")>=0) ← Some zero-fill it--not used by the replayer
	p = 8; i = 0x120;
	do { t = X.c("E742",p); p += 2; if(t) break; i-- } while(i); if(!i) return false;
	do { t = X.c("41FA",p); p += 2; if(t) break; i-- } while(i); if(!i) return false;
//_log("mkII 41FA search: i="+i+" @"+p)
	a3 = p; p += X.I16(p,_BE); //p goes to sampleinfo
	d5 = X.I16(a3+2,_BE); //d5 is maybe (or not) "move.w (a0+d2+?), (a3+?)"
	i = 0x18; do { t = X.c("D1FA",a3); a3 += 2; if(t) break; i-- } while(i);
//_log("mkII D1FA search: i="+i+" @"+a3)
	if(!i) {
		if(d5 == 0x3770) return false; d5 = 0; a5 = a3-0x1C; i = 0x10;
	} else { a5 = a3; a3 += X.I16(a3,_BE) }
//_log("mkII: 3770 and a5 + a3skip")
	do { t = X.c("41FA",a5); a5 -= 2; if(t) break; i-- } while(i);
//_log("mkII: 5, i="+i+" @"+Hex(a5))
	return i
}
if(isMkII()) {
	//DZ and MkII may detect some modules together, meaning a player of either format will play them
	_setResult("audio","Darius Zendeh's Mark II Sound System module (.MK2)","",""); bDetected = 1 //bDetected is for counting
}


function isJamCracker() {
	//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/JamCracker.c
	if(!X.isHeuristicScan() && !X.c("'BeEp'")) return false;
	smp = X.U8(5);
	if(!smp || (smp > 0x1F)) return false;
	if(X.U8(6+smp*40) > 0) return false;
	allsmpsz = 0;
	for(k=0; k < smp; k++) {
		l = X.U32(38+k*40,_BE);
		if(!l || (l > X.Sz())) return false;
		allsmpsz += l;
	}
	ord = X.U16(6+smp*40,_BE);
	if(ord > 0xFF) return false;
	ptns = 6+smp*40+2;
	ptn = X.U16(ptns+ord*6,_BE);
	if(ptn > 0xFF) return false;

	ptn0 = X.U32(ptns+2,_BE);
	ptns += ord*6;
	trkdtsz = X.U32(ptns-4,_BE)-ptn0;
	addlns = X.U8(ptns-5)*4*8;
	sz = ptns + 2 + ptn*2 + allsmpsz + trkdtsz + addlns; //doesn't include the Xag tags
	return true
}
if(!bDetected && isJamCracker()) {
	sName = "JamCracker/Pro module (.JAM,.JC)"; bDetected = 1; bad = "";
	if(X.isHeuristicScan()) {
		if(sz+19 == X.Sz()) { //obviously not for rippers
			sVersion = "v1.0a (Xag)";
			if(X.isVerbose()) sOptionT(X.SA(sz,19)); //this version adds these
			sz += 19;
		}
		if(!X.c("'BeEp'")) bad = bad.addIfNone("!badsig");
	}
	if(sz > X.Sz()) bad = bad.addIfNone("!short");
	if(bad != "") sVersion = sVersion.appendS("malformed"+bad,"/");
	if(X.isVerbose())
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz));
}


function isJBM() {
	//ref https://github.com/adplug/adplug/blob/master/src/jbm.cpp
	//TODO for ex. demo3.jbm has a pointer to outside of the file,
	//  and it seems to work in a player but these are sanity checks ffs... Dunno this format
	if(X.U16(0,_LE) != 2) return false;
	if(!X.c("00FF01FF02FF03FF04FF05FF06FF07FF08FF09FF0AFFFD00", 0x36
)) return false; //just from the files modland has, 'cause the detection's' wonky
	seqt = X.U16(4,_LE); if(!seqt || seqt < 30 || seqt >= X.Sz()) return false;
	inst = X.U16(6,_LE); if(!inst || inst <= seqt || inst >= X.Sz()) return false;
	ins = (X.Sz()-inst) >> 4;
//_log("fs="+Hex(X.Sz())+", inst="+Hex(inst)+", ins="+ins);
	mptn = 0xFFFF; ch = 0; trk=[];
	for(i=0; i < 11; i++) {
		p = X.U16(10+i*2,_LE); trk[i] = p;
		if(p) { ch++;
			if(p <= seqt || p >= inst) return false;
			if(p < mptn) mptn = p
		}
	}
//_log("trk:"+trk);
	ptn = (mptn-seqt) >> 1;
//_log("("+mptn+"-"+seqt+")/2="+ptn);
	for(i=0; i < 5/*ptn*/; i++) { //TODO make a full check when the format is more clear!
		if(trk[i]) {
			p = X.U16(seqt+i*2,_LE);
//_log(seqt+"["+i+"*2]="+Hex(p));
			if(X.U16(p-1,_LE) != 0xFDFF) return false;
			if(p <= seqt || p >= inst) return false;
		}
	}
	i = X.U16(2,_LE); tmr = (1193810.0 / (i ? i : 0xFFFF)).toFixed(2);
	return true
}
if(!bDetected && X.isHeuristicScan() && isJBM()) {
	sName = "Johannes Bjerregaard Adlib module (.JBM)"; bDetected = 1;
	if(X.isVerbose())
		sOption("tmr:"+tmr+" ch:"+ch+" ptn:"+ptn+" ins:"+ins)
}


function isSoundFX() {
	//from https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_sfx.cpp
	// & https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SoundFX/src/SoundFX_V2.asm
	if(X.c("'SONG'",0x3C) && X.Sz() > 0x294) msmp = 15;
	else if(X.c("'SO31'",0x7C) && X.Sz() > 0x4B4) msmp = 31;
	else return false;
	hdrp = 4*msmp; smptp = hdrp+0x14; ordp = smptp+msmp*30;
	ord = X.U8(ordp); if(ord > 128) return false;
	t = X.U16(hdrp+4,_BE); if(t < 178 /*== 0*/) return false;
	tmp0 = (14565*122/t).toFixed(0); spd0 = 6;
	smp = smpsz = ic = 0; smps = [];
	for(i=0; i < msmp; i++) {
		ssz = X.U32(i*4,_BE); if(ssz > 0x20000) return false; smpsz += ssz; if(ssz) smp++;
		t = X.readBytes(smptp+i*30,20);
		for(c=0; c < 20; c++) if(t[c] && t[c] < 0x20) ic++; if(ic >= 128) return false;
		t = decEncoding(t,CPAmiga);
		if(t.trim() != "") smps.push(t.trim())
		smth = X.U16(smptp+i*30+2,_BE);
	}
	return true
}
if(!bDetected && isSoundFX()) {
	sName = msmp == 15 ? "SoundFX module (.SFX)" : "SoundFX 2 / MultiMedia Sound module (.MMS)";
	if(msmp == 15) sVersion = 'v1.0-8'; bDetected = 1;
	if(X.isVerbose()) {
		p += 2; ptn = 0;
		for(i=ordp+2; i < ordp+2+ord; i++) { t = X.U8(i); if(t > ptn) ptn = t } ptn++;
		sz = ordp + 0x82 + ptn*0x400 + smpsz; if(msmp == 31) sz += 6;
		lp = X.U8(ordp+1); if(lp > ord) sVersion = sVersion.appendS('malformed!badloop','/');
		//unk = X.readBytes(hdrp+6,14); unksum = 0; for(i=0;i<unk.length;i++) unksum += unk[i];
		//if(unksum > 0) sOption('unk.bytes:'+unk);
		sOption('tmp0:'+tmp0+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+(lp?' loop:'+lp:'')+' sz:'+outSz(sz))
	}
}


function isJesperOlsen() {
	//ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Jesper_Olsen/Jesper Olsen_v1.asm
	fmt = ''; smp = smpp = 0; sz = -1; x = 1;
	if(X.c("6000")) {//old
		p = 0; d1 = 3;
		do {
			if(!X.c("6000",p)) return false;
			if((t = X.I16(p+2,_BE)) <= 0 || t % 2) return false; p += 4
		} while(d1--);
		p = p0 = 6+X.I16(6,_BE);
		if(!X.c("4A406B00",p)) { //even older
			p -= 4;
			if(X.c("C0FC",p)) p += 2;
			else
				for(i=0; i < 16 && p < X.Sz(); i++,p+=2)
					if(X.c("02800000",p)) { if(!X.c("00FFC0FC",p+4)) return false; p += 8; break }
			if(p > X.Sz()) return false;
			mulu = X.I16(p,_BE); p += 800; q = p+900;
			while(p < X.Sz()) {
				if(X.c("6AE064E0",p)) break;
				p += 2; if(p === q) return false
			}
			if(p > X.Sz()) return false;
			fmt = 'old'; p = p0;
			while(p < X.Sz()) { t = X.I16(p,_BE); p += 2;
				if(t >= 0 && (t & 0x40FA) == 0x40FA) { t = X.I16(p,_BE); p += 2; if(t >= 0) break } }
			p += t-2; var songp_in_explayp = p;
			x = X.I16(p,_BE)-p;
			if(x < mulu) x = 1; else x = Util.divu64(x,mulu);
			//p is now in a2 and a1 is the filesize
			while(p < X.Sz()) {
				if(X.c("'FORM' 0000???? '8SVXVHDR'",p)) { if(!smpp) smpp = p; smp++; p += 4+X.I32(p+4,_BE)+2 }
				p += 2; if(p >= X.Sz()) break
			}
			if(p > X.Sz()) return false; sz = p;
			p = 0xA+X.I16(0xA,_BE);
			while(p < X.Sz()) { t = X.c("43FA",p); p += 2; if(t) break }
			var Lea = p, VoiceTmp = p+X.I16(p,_BE); p += 2; //skipping the part about a flag
			d1 = X.c("6000",12) ? "7FFE" : "7FFF";
			while(p < X.Sz()) { t = X.c(d1,p); p += 2; if(t) break }
			while(p < X.Sz()) { t = X.c("336C",p); p += 2; if(t) break }
			var Value = X.I16(p+2,_BE)
			//now, I'm not very sure if we _need_ Lea, VoiceTmp, Value for our purposes, but we have'em!
		} else {
			if(!X.c("000641FA",p+4)) return false; p += 8;
			p += X.I16(p,_BE)+4; if(!X.c("00017FFF",p)) return false;
			fmt = 'second';
			p = p0+8+X.I16(p0+8,_BE); var SongPtr = p;
			p += 8; x = 0; d2 = X.I32(p+0xA,_BE);
			while(p < X.Sz()) { if(d2 != X.I32(p+0xA,_BE)) break; x++; p += 0x1A }
			p = smpp = SongPtr+X.I32(SongPtr,_BE); //smpinfo
			while(p < X.Sz()) {
				if(X.c("'FORM' 00?????? '8SVXVHDR'",p)) { smp++; p += 4+X.I32(p+4,_BE)+2 }
				p += 2; if(p >= X.Sz()) break
			}
			if(p > X.Sz()) return false; sz = p;
			p = SongPtr; d1 = X.U32(p,_BE); d2 = X.U32(p+0x12,_BE);
			if(d2 <= d1) p += d1; //that'll be our song size
			else {
				d3 = d2-X.I32(p+0x16,_BE);
				sz = d2+d3+p; if(sz == 35944) x -= 1; //I don't have this file to test
				if(sz > X.Sz()) return false;
				//d3 <<= 2; p += X.I32(p,_BE); d3 += p; songsz = d3; smpsz = sz-songsz
			}
		}
	} else if(X.c("0000 ???? 00017FFF")) { //the Harald Hårdtand game is once again different
		var z = 0; for(p = 8; p < 0x10; p += 2) {
			t = X.I16(p,_BE); if(!t) { z++; continue }
			if(t < 0 || t%2 || !(X.c("7FFF",t-2) || X.c("7FFE",t-4))) return false;
		} if(z > 1) return false;
		p = 2+X.I16(2,_BE);
		if(p > X.Sz() || !X.c("'FORM' 00?????? '8SVXVHDR'",p)) return false;
		while(p < X.Sz()) {
			if(X.c("'FORM' 00?????? '8SVXVHDR'",p)) { smp++; p += 4+X.I32(p+4,_BE)+2 }
			p += 2; if(p >= X.Sz()) break
		}
		if(p > X.Sz()) return false;
		sz = p; fmt = 'harald'
	} else { //this detection is a tad broken in the eagleplayer
		if((p = X.U16(0,_BE)) > 0x200 || p < 4 || p % 2) return false; p += 2;
		for(i=2; i < p; i += 2) if((t = X.I16(i,_BE)) <= 0 || t % 2 || !X.c("7FFF",t-2)) return false;
		fmt = 'latest';
		x = X.U16(0,_BE); p = smptp = X.U16(x+2,_BE); d3 = X.U16(x,_BE); x >>= 1; x--;
		if(x != 1) if(X.c("0000",d3-6) || !X.c("7F00",d3-4)) x--;
		smp0p = X.U16(p,_BE); var lo = hi = X.U24(smp0p+0xF,_BE);
		smp = ssz = 0;
		while(p < smp0p && smp < 128) { if(p > X.Sz()) return false;
			smp++; pp = X.U16(p,_BE);
			sofs = X.U24(pp+0xF,_BE);
			if(lo > sofs) lo = sofs;
			if(hi <= sofs) {
				hi = sofs; ssz = X.I16(pp+0x12,_BE);
				if(!X.c("'BODY'",sofs-8)) { //a raw sample
					//the original test was if(!X.U8(pp+0xE)) - this fails with, say, georgglaxo ingame.jo
					sofs = X.U32(pp+0x14,_BE);
					if(sofs > hi) { hi = sofs; ssz = 2*X.U16(pp+0x18,_BE) }
				}
			}
			if(hi > X.Sz()) return false;
			if(pp < smp0p) smp0p = pp;
//_log('smp '+smp+'. @'+Hex(pp)+' maxofs:'+Hex(hi)+' ssz0E:'+Hex(X.U24(pp+0xF,_BE))+' ssz18:'+Hex(X.U16(pp+0x18,_BE))
//+(X.c("'BODY'",sofs-8)?' IFF ['+Hex(X.U32(sofs-4,_BE))+'-'+Hex(sofs+X.U32(sofs-4,_BE))+']':' raw'))
			p += 2;
		}
		if(X.c("'BODY'00'",lo-8)) lo = X.fSig("'FORM'00??????",lo-150,lo-20); songsz = lo;
		if(X.c("'BODY'00'",hi-8)) hi += X.U32(hi-4,_BE); //BODY tag skip
		else hi += ssz<<1;
		sz = hi;
	}

	return true;
}
if(!bDetected && isJesperOlsen()) {
	sName = "Jesper Olsen's module (.JO)"; sVersion = fmt; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×'); sOption('smp:'+smp+' sz:'+outSz(sz))
	}
}


function isJasonBrooke() {
	//from reversing the eagleplayer
	// SubSongs at +04; SongSize at +14; Samples at +1C; CalcSize at +24;
	// SamplesSize at +2C; ord at +34; SynthSamples at +3C
	// LoadSize at +0C; SynthSamples at +3C; Steps at +44; AuthorName at +4C => F2;
	// Prefix at +54 => 139
	fmt = ''; p = 0;
	function findPlus(s) { while(p < X.Sz()) { t = X.c(s,p); p += 2; if(t) break } }
	function findOrPlus(s) { while(p < X.Sz()) { if(X.c(s,p)) break; p += 2 } }
	function minusFind(s) { while(p > 0) { p -= 2; if(X.c(s,p)) break } }
	if(X.c("48E7F0F0")) { if(!X.c("424047FA FFF84A2B",4)) return false; fmt = 'old'; // -1
		if(!X.isVerbose()) return true;
		a0 = p = 12; findPlus("43FA"); d7 = p+X.U16(p,_BE)+1;
		findPlus("228A"); p += 2; d2 = p-8+X.U16(p-8,_BE); //the first synsmp ptr?
		findPlus("137B"); d6 = a4 = p+X.U16(p,_BE)-1; x = 1;
		while(d6 < X.Sz()) { d6 += 10; if(!X.U16(d6,_BE)) break; if(X.U8(d6)) break; x++ }
		minusFind("48E7"); var hi, lo = X.U16(a4+2,_BE); //p & a4 -> stack
		for(d0 = x; d0--;) { //d852~62
			a4 += 2; for(d3=4; d3--;) { t = X.U16(a4,_BE); a4 += 2; if(lo > t) lo = t }
		}
		p = lo; lo = hi = X.U16(p,_BE); p += 2;
		do { //d870~84
			t = X.U16(p,_BE); p += 2; if(t) { if(t < lo) lo = t; if(t > hi) hi = t; }
		} while(p < d7);
		a3 = lo; synsmp = (lo-d2)>>7;
		p = hi;
		while(p < X.Sz()) if([0x85,0x87].indexOf(X.U8(p)) >= 0) break; else p++; //d89a~ac
		d0 = 0; do { //d8ae~c6
			while(a3 < X.Sz()) if([0x85,0x87].indexOf(X.U8(a3)) >= 0) break; else a3++;
			a3++; d0++
		} while(a3 < p);
		p++; a3 = d6; if(a3) { //d8c8~f6
			for(d1=0x80,found=false; d1-- && !found;) { t = X.c("41FA",a3); a3 += 2; if(t) found = true }
			if(found) { //d8de
				a3 += X.U16(a3,_BE);
				while(a3 < X.Sz()) { if(X.c("FF",a3+4) || X.c("FF",a3+6)) a3 += 0x12; else break }
				p = a3;
			}
			sz = p; steps = d0 //d8fa
		}
	}
	else {
		p = 0xAC; while(p < 0xE0) { t = X.c("48E7",p); p += 2; if(t) break } if(p > 0xE0) return false; 
		if(!X.c("F8FC",p) && !X.c("F8F8",p)) return false;
		if(!X.c("08F90001 00BFE001 33FC0780 00DFF09A 47FA",p+2)) return false;
		p += 0x14; if(0x10000-p-X.U16(p,_BE)) return false;
		fmt = 'new'; if(!X.isVerbose()) return true; p = 0;
		findPlus("48E7"); findPlus("49F9"); p += 6; findPlus("7600"); d0 = X.U16(p-10,_BE);
		findOrPlus("10320000"); a4 = p-2+X.U16(p-2,_BE);
		findPlus("48E7"); p = a3 = p-6; findPlus("43FA"); p += X.U16(p,_BE)-1;
		a4 -= p; d3 = Util.divu64(a4,0x12); x = 1; d2 = 0;
		for(; p < X.Sz(); x++) { //d74e~5c
			p += 0x12; d2 = X.U16(p,_BE); if(X.U8(p,_BE)) break; d2--; if(d2 <= 0) break; }
		if(d3 < x) x = d3; //d75e~64
		p = a3; minusFind("45FA"); d0 = p = p-2+X.U16(p-2,_BE);
		p += 4; synsmp = smp = d5 = 0; smpp = p;
		while(p < X.Sz()) {
			if((t = X.U32(p,_BE)) > d0) { //d784~a8
				if(!smp) d5 = t; if(t <= d5) d5 = a4 = t; smp++; p += 10; if(p > a4) break;
			} else { synsmp++; p += 10 }
		}
		i = smp+synsmp; sz = 0; p = smpp;
		while(i-- && p < X.Sz()) { t = X.U32(p,_BE)+X.U16(p+4,_BE); if(sz < t) sz = t; p += 10 } //~d7cc
	}
	return true
}
if(!bDetected && isJasonBrooke()) {
	sName = "Jason C. Brooke's module (.JB,.JCB)"; sVersion = fmt; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption((fmt=='new'?'wf.smp:'+smp:'steps:'+steps)+' syn.smp:'+synsmp+' sz:'+outSz(sz))
	}
}


function isKrisHatlelid() {
	// SubSongs at +04; SamplesSize at +0C; Length at +14; Samples at +1C
	if(!X.c("000003F3 00000000 00000003 00000000 00000002 ???????? 40?????? 00000001 000003E9"))
		return false;
	twofiles = false; p = 0x30;
	d1 = X.U32(0x14,_BE) & ~(1<<30); if(X.U32(0x24,_BE) != d1) return false;
	if(X.c("60000016",0x28)) { if(!X.c("0000ABCD",0x2C)) return false } else p = 0x18;
	if((p == 0x30 && !X.c("B07C0000",0x40)) || p == 0x18) {
		if(!X.c("41F90000 00004E75",p+0x10)) return false; twofiles = true
	}
	p = 0x40; smpp = 0;
	while(!smpp && p < X.Sz()) { t = X.fSig(p,TOEOF,"'FORM'"); if(!t%2) smpp = t; else p = Math.max(t+1,p+1) }
	if(smpp < 0) return false;
	smp = 0;
	while(p < X.Sz()) { if(!X.c("'FORM' ???????? '8SVXVHDR'",p)) break; smp++; p += 4+X.U32(p+4,_BE) }
// var psz = X.fSig(0x24,0x40,"000003EA")+4; if(psz < 4) return false; sz = psz+4+(X.U32(psz,_BE)<<2);
// if((t = (X.U32(sz,_BE)>>3)<<3) != 0x3EC) _log(" the chunk at sz is not 3EC but "+Hex(t));
// else t = X.U32(sz+4,_BE);
// if(p != sz) _log("sz differs! "+Hex(sz)+" vs "+Hex(p))
// TODO parse hunks↑ tooб AND detect/debug SubSongs!
	sz = p;
	return true;
}
if(!bDetected && isKrisHatlelid()) {
	sName = "Kris Hatlelid's module (.KH"+(twofiles?'+SONGPLAY':'')+")"; bDetected = 1;
	if(X.isVerbose()) {
		sOption('sz:'+outSz(sz))
	}
}


function isKefrensSoundMachine() {
	//ref https://github.com/tonioni/WinUAE/blob/master/prowizard/rippers/KefrensSoundMachine.c
	if(X.Sz() < 1537) return false;
	if(X.U8(15) != 0x61) return false;
	for(k=0; k < 15; k++)
		if(X.U8(54+k*32) > 0x40) return false;
	trks = 0;
	for(k=0; k < 1024; k++) {
		k_ = X.U8(k+512);
		if(k_ == 0xFF) break;
		if(k_ > trks) trks = k_;
	}
	if(k == 1024) return false;
	if(trks == 0) return false;
	if(1536 + trks*192 + 64*3 > X.Sz()) return false;
	for(k=0; k <= trks; k++)
		for(l=0; l < 64; l++)
			if(X.U8(1536 + k*192 + l*3) > 0x24) return false;

	allsmpsz = smp = 0;
	for(k=0; k<15; k++) { t = X.U16(52+k*32,_BE); if(t) smp++; allsmpsz += t }
	sz = (trks+1)*192 + allsmpsz + 1536;
	return true
}
if(!bDetected && isKefrensSoundMachine()) {
	sName = "Jess D. 'Razmo' Skov-Nielsen's Kefrens Sound Machine module (.KSM)"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SA(2,13));
		sOption("trk:"+trks+(smp?" smp:"+smp:'')+" sz:"+outSz(sz));
		if(sz > X.Sz()) sVersion = "malformed!short"
	}
}


function isPaulRobotham() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_teamPaulRobotham/src/Paul%20Robotham_v1.asm
	trk = X.U16(0,_BE); d2 = X.U16(2,_BE); d3 = X.U16(4,_BE); smp = X.U16(6,_BE); p = 8;
	if(!trk || trk > 4 || !d2 || !d3 || !smp) return false;
	mp = 0; trks = [];
	for(d1=trk;d1;d1--) { t = X.U32(p,_BE); p += 4; if((t>>16) || !t) return false; trks.push(t); if(mp < t) mp = t } //stpos
//_log('PaulRobotham: StartPos -> '+Hex(p));
	for(;d2;d2--) { t = X.I32(p,_BE); p += 4; if(t <= 0 || t%2) return false; if(mp < t) mp = t } //Next1
	d2 = X.I32(p,_BE);
//_log('PaulRobotham: Next1 -> '+Hex(p))
	for(;d3;d3--) { t = X.I32(p,_BE); p += 4; if(t <= 0 || t%2) return false; if(mp < t) mp = t } //Next2
//_log('PaulRobotham: Next2 -> '+Hex(p))
	p += smp*12; if(p != d2) return false;
	for(d2=15;d2;d2--,p+=16) if(!X.c("3F3F3F3F 3F3F3F3F 3F3F3F3F 3F3F3F3F",p)) return false;
	return true
}
if(!bDetected && isPaulRobotham()) {
	sName = "Paul Robotham's module (.DAT+.SSD)"; bDetected = 1;
	if(X.isVerbose()) sOption('trk:'+trk+' smp:'+smp)
}


function isDMM() {
	// ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/digital/digitalmusicmaker.cpp
	for(i=0; i < 6; i++) if(!(0xC0 <= X.U8(i*2+1) <= 0xFF)) return false;
	ptnsz = X.U8(0x0C); if(ptnsz & 0x87) return false;
	ptn = -1; for(i=0; i < 0x32; i++) {
		j = X.U8(0x0E+i); if(j > 0x17) return false;
		if(j > ptn) ptn = j;
	} ptn++;
	tempo = X.U8(0x40); if(tempo < 3 || tempo > 30) return false;
	loop = X.U8(0x41); if(loop > 0x32) return false;
	ord = X.U8(0x43); if(!ord || ord > 0x32) return false;
	hss = X.U8(0x44); if(hss < 2 || hss > 0x38) return false;
	bad = false; smp = 0;
	for(i=0; i < 16; i++) {
		smpst = X.U16(0x5A+i*16+9,_LE);
		smplm = X.U16(0x5A+i*16+12,_LE);
		smplp = X.U16(0x5A+i*16+14,_LE);
		if(smpst > smplm || smpst < 49152 || smplm < 49152) return false;
		if(smplp < 49152 || smplp > smplm || smpst > smplp
		  || (smplm > 49152 && smplm-smplp < 6)) {
			bad = true;
			if(!X.isHeuristicScan()) return false
		}
		if(smpst < smplm) smp++;
	}
	return true
}
if(!bDetected && X.isDeepScan() && isDMM()) {
	bDetected = 1; sVersion = "v1.x"; if(bad) sVersion += "/malformed";
	sName = "Vasilii 'BACA' Pakhomov/LAVE's Digital Music Maker module (.DMM)";
	if(X.isVerbose())
		sOption("tempo:"+tempo+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" loop:"+loop)
}


function isComposerC67() {
	// from https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_c67.cpp
	if(X.Sz() < 0xBA2) return false; //7A2+400
	spd = X.U8(0); if(!isWithin(spd,1,15)) return false; ord = 0; ptn = [];
	for (i=0; i < 256; i++) if((o=X.U8(0x6A2+i)) != 0xFF) { // check orders
		if(o >= 128) return false; if(i > ord) ord = i; if(ptn.indexOf(o) < 0) ptn.push(o) }
	ord++; ptn = ptn.length; nonz = false; lp = X.U8(1); if(lp > ord) return false; smp = opl = smpsz = 0;
	for (i=0; i < 32; i++) { // checking sample records
		if(X.U8(2+i*13+12) || X.U32(0x1A2+i*16) || X.U8(0x3A2+i*13+12)) return false;
		var _l = X.U32(0x1A2+i*16+4), _ls = X.U32(0x1A2+i*16+8), _le = X.U32(0x1A2+i*16+12);
		if(_l > 0xFFFFF) return false; if(_l && _le < 0xFFFFF && (_le > _l || _ls > _le)) return false;
		_opl = !X.c("00000000 00000000 000000",0x542+i*11);
		if(X.U8(0x542+i*11) & 0xF0) return false;
		if(X.U8(0x542+i*11+5) & 0xFC) return false;
		if(X.U8(0x542+i*11+10) & 0xFC) return false;
		if(_l) { smp++; smpsz += _l }  if(_opl) opl++;
	}
	bad = false; ptnend = notes = 0;
	for (i=0; i < 128; i++) { // checking patterns
		p = 0xBA2+X.U32(0x7A2+i*4,_LE); ptnlen = X.U32(0x9A2+i*4,_LE);
		if(!bad) bad = (ptnlen < 3 || ptnlen > 0x1000);
		if(p > 0xFFFFFF || (X.Sz() < p+ptnlen)) return false;
		if(p+ptnlen > ptnend) ptnend = p+ptnlen;
		for(r = 0; p < ptnend;) {
			var cmd = X.U8(p++);
			if(cmd <= 0xC) { p += 2; notes++ }
			else if(cmd >= 0x20 && cmd <= 0x2C) p++;
			else if(cmd == 0x40) r += X.U8(p++);
			else if(cmd == 0x60) break;
			else return false
		}
		if(r > 64) return false;
	}
	sz = ptnend+smpsz;
	return smp+opl > 0
}
if(!bDetected && isComposerC67()) {
	sName = "Thomas 'Tran' Pytel's CDFM/Composer 670 module (.C67)"; bDetected = 1;
	if(bad) sVersion = "malformed!badptn";
	if(X.isVerbose()) sOption('spd:'+spd+' ord:'+ord+(lp?' lp:'+lp:'')+' ptn:'+ptn+' smp:'+smp+' fm:'+opl+' notes:'+notes+' sz:'+outSz(sz))
}


function isSeanConnolly() {
	//from UADE player check RE
	if(!X.c("6000.... 6000.... 6000")) return false;
	a0 = 2+X.I16(2,_BE);
	if(X.c("48E77FFE E98841FA",a0)) v = 2;
	else if(X.c("48E740F0 4A006B0A",a0)) v = 3;
	else return false;
	return true
}
if(!bDetected && isSeanConnolly()) {
	sName = "Sean 'Odie' Connolly\'s module (.SCN)"; sVersion = "v"+v; bDetected = 1
}


function isAVP() {
	//from reversing the eagleplayer
	d1 = "48E7FCFE"; a0 = 0;
	if(X.c(d1)) { // @d440 -> d47c
		if(X.c("45FA",0xDC)) return false;
		if(!X.c("E9417000 41FA",4)) return false;
		if(X.c(d1,0x94) || X.c(d1,0xA4) || X.c(d1,0xA8)) {
			fmt = 0; base = 8; return true }
		else return false
	} else if(X.c("2F0841FA")) { //@d444 -> d4ac
		a0 += 4; a0 += X.I16(a0,_BE) + 0x1C;
		if(!X.c("45FA",a0+0xDC)) return false;
		a0 += 4; if(!X.c("E9417000 41FA",a0)) return false; a0 += 4;
		if(X.c(d1,a0+0x8C) || X.c(d1,a0+0x9C) || X.c(d1,a0+0xA0)) {
			fmt = 0; base = a0; return true }
	} else if(X.c(d1,0x1C)) { //@d44c -> d4b0
		a0 += 0x1C; if(!X.c("45FA",a0+0xDC)) return false;
		a0 += 4; if(!X.c("E9417000 41FA",a0)) return false; a0 += 4;
		if(X.c(d1,a0+0x8C) || X.c(d1,a0+0x9C) || X.c(d1,a0+0xA0)) {
			fmt = 0; base = a0; return true }
	} else if(X.c("6000")) { //@d452 -> d4d0
		if(!X.c("6000.... 6000.... 6000.... 6000.... 6000.... 6000.... 6000",4)) return false;
		if(X.c("6000",0x20) && !X.c("6000",0x24)) return false;
		a0 = 0xE; a0 += X.I16(a0,_BE);
		if(X.c(d1,a0)) { //@d50e -> d4be
			if(!X.c("45FA",a0+0x10C) && !X.c("E942",a0+0x112)) return false;
			a0 += 4; if(!X.c("E9417000 41FA",a0)) return false; a0 += 4;
			if(X.c(d1,a0+0x8C) || X.c(d1,a0+0x9C) || X.c(d1,a0+0xA0)) {
				fmt = 0; base = a0; return true }
		}
		a0 = 0x1A+X.I16(0x1A,_BE); if(!X.c(d1+"43FA",a0)) return false;
		fmt = 1; base = a0; return true
	} else { //@d45a
		do { if(X.c("2F0841FA",a0+0x1C)) break; a0 += 2 } while(a0 < 0xA);
		if(a0 == 0xA) return false; //else -> d46e
		i = 0x4C; do { if(X.c(d1,a0)) break; a0 += 2; i-- } while(i);
		if(!i) return false; //else -> d4be
		if(!X.c("45FA",a0+0x10C) && !X.c("E942",a0+0x112)) return false;
		a0 += 4; if(!X.c("E9417000 41FA",a0)) return false; a0 += 4;
		if(X.c(d1,a0+0x8C) || X.c(d1,a0+0x9C) || X.c(d1,a0+0xA0)) {
			fmt = 0; base = a0; return true }
	}
	return false
}
if(!bDetected && isAVP()) {
	sName = "Martin Walker's Activision Pro module (.AVP)"; sVersion = "f."+fmt; bDetected = 1;
	if(X.isVerbose()) {
		sOption(Hex(base),"base:");
		//TODO: derive some info using NP
	}
}


function isJP() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/JasonPage/src/Jason%20Page_v5.s
	fmt = 0;
	if(X.c("0002") && !(X.U8(3)&1)) for(;;) {
		t = X.I16(4,_BE); if(t&1) break; if(X.I16(t)&1) break;
		d0 = X.I16(0x30,_BE); if(d0 > X.Sz()) break;
		for(a1 = 2; a1 <= 0x2E; a1 += 2) {
			t = X.U16(a1,_BE); if(!t || (t&1) || t > X.Sz() || d0 <= t) break;
		}
		if(a1 < 0x30) break;
		if((X.U16(t,_BE)&0xF00) == 0xF00) fmt = 2; else fmt = 1; break
	}
	if(!fmt)
		if(X.I16(0,_BE) || X.I16(0x80,_BE) || !X.c("00000CBE",0x84)
		  || !X.c("000308BE",0xCB6) || !X.c("000309BE",0xCBA)) return false;
		else fmt = 3;
	smpsz = smp = 0; x = 1;
	if(fmt == 3) {
		sz = X.U32(0x8BA,_BE)+2; if(sz < 0x8BC || sz > X.Sz()) return false;
		t0 = X.U32(0,_BE);
		for(i = 4; i < 0x80; i += 4) {
			t1 = X.U32(i,_BE); t = t1-t0; if(t < 0) return false;
			smpsz += t; if(t) smp++; t0 = t1 }
		smpsz += 0x80;
		if(sz == 7382 && smpsz == 19290) x = 16 /*realms ingame*/;
		else { x = 0; a1 = 0x6BE; do {
				d0 = X.U32(a1,_BE); a1 += 4; if(X.U16(d0,_BE) == 0xFF00) break; x++
			} while(a1 < sz) }
	} else {
		sz = X.U16(0x30,_BE); a0 = X.U16(0xC,_BE)+2; a1 = X.U16(0x1C,_BE); x = (a1-a0)>>1;
		for(i = X.U16(2,_BE); i < sz-4; i += 4) { slen = X.U32(i,_BE); smpsz += slen; if(slen) smp++ }
	}
	return true;
}
if(!bDetected && isJP()) {
	switch(fmt) {
	case 1: sName = "Jason Page's module (.JP)"; break; case 2: sName = "Jason Page's module (.JPN)"; break;
	case 3: sName = "Jason Page's old module (.JP)"; } sVersion = "f."+fmt; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption("smp:"+smp+" smp.sz:"+smpsz+" song sz:"+outSz(sz))
	}
}


function isMikeDavies() {
	//ref reversing the eagleplayer
	a2 = 0xF2;
	if(!X.c("0C40",a2)) { a2 -= 6; if(!X.c("33C0",a2)) return false }
	if(!X.c("48E7FFFE 61064CDF 7FFF4E75",a2-12)) return false;
	a2 = X.fSig(a2,0xFFFF,"6000")+2; if(a2 < 2) return false;
	t = X.I16(a2,_BE); if(!t || t < 0 || (t&1)) return false;
	a2 += t; if(!X.c("2D58",a2)) return false;
	a2 = 0;
	function findOrPlus(s) { while(a2 < X.Sz()) { if(X.c(s,a2)) break; a2 += 2 } } // couple helper functions
	function plusAndFind(s) { while(a2 < X.Sz()) { a2 += 2; if(X.c(s,a2-2)) break } }
	function errorP(s) { if(debug>1)_log('MikeDavies: '+s); patchClear(); return false }
	var a4 = []; // the "wach get out!!!" memory part. Local vars
	//we skip a4.push(0) *2 unlike the original code, so analogously, a4[] points @d138 instead of d134
	findOrPlus("48E7FFFE"); a4.push(a2>>16); a4.push(a2&0xFFFF); //d3a2~d3ae
	findOrPlus("33FC0001"); //d3b0~d3ba
	a2 += 4; rel = X.U32(a2,_BE);
	plusAndFind("41F9"); a4.push(a2>>16); a4.push(a2&0xFFFF);
	d1 = X.I32(a2,_BE); //d3c0~d3c8
	plusAndFind("B1FC"); d0 = X.U32(a2,_BE); //d3ca-d3d0
	x = d0 = (d0-d1) >> 4;

	plusAndFind("41F9"); a4.push(a2>>16); a4.push(a2&0xFFFF); //d3da~d3e0
	plusAndFind("B1FC"); a4.push(a2>>16); a4.push(a2&0xFFFF); //d3e2~d3e8
	plusAndFind("303C"); //d3ea~d3ee
	findOrPlus("48E7FFFE ........ 6100"); a4.push(a2>>16); a4.push(a2&0xFFFF); //d3f6~d40a
	plusAndFind("41F9"); a4.push(a2>>16); a4.push(a2&0xFFFF);
	d2 = X.U32(a2,_BE); //d40c~d414
	plusAndFind("B1FC"); d3 = X.U32(a2,_BE); //d416~d41c
	d3 = d4 = d3-d2; var mo = d3%0x18; d3 = Util.divu64(d3,0x18); //d41e~d42e
	if(mo) {
		d4 += 4; mo = d4%0x18; d4 = Util.divu64(d4,0x18);
		if(mo) return errorP('@d436 error 5'); //originally, error code 5
		d3 = d4;
		if(X.c("4654443C",0x7D8)) { //d44c~44; patch #1 adjusting 3 positions
			a3 = 0x770;
			for(d4=2; d4 >= 0; d4--) {
				a3 -= 4; wpU32be(a3+4,rpU32be(a3));
			}
		}
	}
	a4.push(d3>>16); a4.push(d3&0xFFFF); //d45a
	plusAndFind("4BF9"); d5 = rpU32be(a2)-rel; //d45c~64
	if(a2 > X.Sz()) return errorP('@d464 a2 too high');
	if(!X.isDeepScan()) { patchClear(); return true }

	a4.push(d5>>16); a4.push(d5&0xFFFF); //d466
	a4.push(0); //d468
	a5 = 0x4ED2; a4.push(a5>>16); a4.push(a5&0xFFFF); //d46a; delitrackerglobals

	//d472~d4fa: patch #2 (changes certain offsets in the player code to relative)
	a3 = (a4[0]<<16)+a4[1];
	p2cycle: while(a3 < X.Sz()) { //from d472...
		switch(rpU16be(a3)) {
		case 0x33EE: case 0x33FC: a3 += 2; //d4ce & ↓
		case 0x3039: case 0x33C0: case 0x33C1: case 0x3C39: case 0x41F9:
		case 0x4279: case 0x4A79: case 0x4BF9: case 0x4DF9: case 0x5379: case 0xB1FC: //d4d0
			a3 += 2; a3_ = rpU32be(a3); if((a3_>>16) == 0x00DF) break;
			wpU32be(a3,a3_-rel); a3 += 4; break;
		case 0x33F9: //d4de
			a3 += 2; a3_ = rpU32be(a3);
			if((a3_>>16) == 0x00DF) a3 += 4; else { wpU32be(a3,a3_-rel); a3 += 4 }
			a3_ = rpU32be(a3); if((a3_>>16) != 0x00DF) { wpU32be(a3,a3_-rel); a3 += 4 } break;
		default: a3 += 2; if(a3 >= d5) break p2cycle;
		}
	}
	d4 = d3; //d4fe
	a2 = (a4[10]<<16)+a4[11]; //d500
	a2 = rpU32be(a2); //d504
	a2_ = rpU32be(a2)-rel; wpU32be(a2,a2_); //d506~8
	d2 = a2_; //d50a~c
	d5 = a2_+2*rpU32be(a2+4); a2 += 0x18; a2_ = rpU32be(a2); d3 -= 2; //patch1; d50e~1a
	if(d3 > 0x80) return errorP('@d51a badsmp:'+Hex(d3));
	while(d3 >= 0) { //d51c & d53a
		a2_ -= rel; wpU32be(a2,a2_); //d51e~d520
		if(d5 <= a2_) d5 = a2_+2*rpU32be(a2+4);
		if(d2 > a2_) d2 = a2_; //d530~d534
		a2 += 0x18; a2_ = rpU32be(a2); //patch1
	d3--}
	a4.push(a2>>16); a4.push(a2&0xFFFF); //d53e. a2+4 = start of samples
	a2 = rpU32be((a4[4]<<16)+a4[5]); //d540~4
	a3 = (a4[6]<<16)+a4[7]; a3_ = rpU32be(a3); //d546
	d3 = Util.divu64(a3_-a2, 0x18); //d54c~50
	a4.push(d3); //d554
	smp = d3+d4; //d556~8
	d4 = d3; a2_ = rpU32be(a2); //d55c
	if(d4 > 0x80) return errorP('@d55e d4='+Hex(d4)+' > 80h');
	while(d4 > 0) { //d55e~60 & d57e
		a2_ -= rel; wpU32be(a2,a2_); //d562~4
		if(d5 <= a2_) d5 = a2_+2*rpU32be(a2+4);
		if(d2 > a2_) d2 = a2_; //d574~8
		a2 += 0x18; a2_ = rpU32be(a2);
	d4--}
	if(a2 > (a4[19]<<16)+a4[20]) { a4[19] = a2>>16; a4[20] = a2&0xFFFF } //d582~8
	d0 <<= 2; //d58e
 	a2 = rpU32be((a4[2]<<16)+a4[3]); a2_ = rpU32be(a2); //d592~6
	d3 = 0;
	do {
		if(a2_ != 0xFFFFFFFF && d3 < a2_-rel) d3 = a2_-rel; //d59c~a8
		a2 += 4; a2_ = rpU32be(a2); //d5aa
	d0--} while(a2 < X.Sz() && d0 > 0);
	a3 = (a4[8]<<16)+a4[9]; //d5b0
	while(a3 < X.Sz()) { a3 += 2; if(X.c("0C40",a3-2)) break } //d5b4~8
	d0 = rpU16be(a3+0x16); a4.push(d0); //d5ba~e
	if(d5 > d3) { //d5c8~a
		if(d5 > X.Sz()) return errorP('@d5ce error 1C'); //d5cc~e; return errorcode 1C
		a2 = d2; a1 = (a4[19]<<16)+a4[20];
		do { //from d5d8...
			if(rpU16be(a1) == d0) { a1 += 6; wpU32be(a1,rpU32be(a1)-rel) } //d5d8~e0; patching #3?...
			a1 += 2; // d5e2
		} while(a1 != a2 && a1 < X.Sz())
		a2 = d5;
	} else { //from d5ee
		if(d3 > X.Sz()) return errorP('@d5ee error 1C'); //d5ee~f0; return errorcode 1C
		a2 = d3; //d5f4; d4 and a3 = filesize
		while(a2 < X.Sz()) { //d5fc -> sub_d65c
			a2 += 2; if([0x94,0xFE,0xFF,0x1FE,0x1FF].indexOf(rpU16be(a2-2)) >= 0) break }
		a1 = d5; a1_ = rpU32be(a1); //d5f8
		do { // from d5fa...
			if(d0 == (a1_>>16)) {
				a1 += 6; a1_ = rpU32be(a1)-rel; wpU32be(a1,a1_);
				if(d3 < a1_) d3 = a1_;
			}
			a1 += 2; a1_ = rpU32be(a1); //d60a
		} while(a2 != a1); //d60c~e to d5fa
		if(a2 <= d3) { //d610~2
			a2 = d3;
			while(a2 < X.Sz()) {
				a2 += 2; if([0x94,0xFE,0xFF,0x1FE,0x1FF].indexOf(rpU16be(a2-2)) >= 0) break; }
		}
	}
	patchClear();
	sz = a2; //d618~a
	smpsz = d5-d2;
	songsz = a2-smpsz;
	return true
}
if(!bDetected && isMikeDavies()) {
	sName = "Mike Davies module (.MD)"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		if(X.isDeepScan()) sOption('smp:'+smp+' songsz:'+Hex(songsz)+' smpsz:'+Hex(smpsz)+' sz:'+outSz(sz))
	}
}


function isSilmarils() {
	//from UADE player RE
	a0 = 0; if(!X.c("0016",a0+4)) { a0 += 6; if(!X.c("0016",a0+4)) return }
	if(!X.c("0000 00000000 00000000 ....0020 ....0020",a0+6)) return;
	d1 = X.U32(a0+0xE,_BE); if(d1&1) return;
	if(!X.c("00000058",a0+d1)) return;
	a2 = a0+0x58; a3 = 0; if(X.c("0016",0xA)) a3 += 6;
	a3 += X.U32(a3+0xE,_BE); a3 += X.U32(a3,_BE);
	a2 = a3; x = smp = sz = d0 = d3 = 0;
	while(a3 < X.Sz()) {
		a3 = a2; a2 += 4;
		if(!X.U32(a3,_BE) || X.U8(a3)) { //→e684
			a3 = sz; sz += X.U32(a3+2,_BE); break;
		} else {
			a3 += X.I32(a3,_BE); if(a3 > sz) sz = a3; if(a3 > X.Sz()) return;
			if(X.c("FF02",a3+6)) x++;
			else {
				t = X.U32(a3+2,_BE); if(t > X.Sz()) return;
				smp++; d3 += t; if(d0 < t) d0 = t
			}
		}
	}
	if(a3 > X.Sz() || sz > X.Sz()) return;
	smpsz = d3;
	return true
}
if(!bDetected && isSilmarils()) {
	sName = "Michel Pernot's Silmarils module (.MOK)"; bDetected = 1;
	bad = "";
	if(x > 3) bad = bad.addIfNone("!subsongs>3");
	if(smp > 0x20) bad = bad.addIfNone("!smp>32");
	if(bad != "") sVersion = sVersion.appendS("malformed"+bad,'/');
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption("smp:"+smp+" smpsz:"+Hex(smpsz)+" sz:"+outSz(sz))
	}
}


function isDUX() {
	//from the UADE player's RE
	t = X.U32(0,_BE); if(t < 0x70 || (t&1) || !X.c("FFFF FFFFFFFF",t-6)) return; sz = t;
	for(smp=0,p=4; p < 0x64; p+=12) { //8 samples
		t = X.U32(p,_BE); if((t&1) || t && t < 0x70 || t > sz) return; if(t) smp++
	} if(!smp) return;
	for(; p < 0x70; p += 4) { t = X.U32(p,_BE); if(t < 0x70 || (t&1) || t > sz) return }
	if(!X.c("FFFF FFFFFFFF",p+t-6)) return;
	smpsz = X.U32(0x64,_BE); p = 0x74+smpsz; //p points to patterns? orderlist?
	// what does this do?..
	//for(q = 0; p < sz; p += 4) if((t = X.I16(p,_BE)) >= 0) q += t; else break;
	//q >>= 4; unpsz = Util.div64(q*14187, 44336);
	return true
}
if(!bDetected && isDUX()) {
	sName = "GT Game Systems module (.DUX)"; bDetected = 1;
	if(X.isVerbose()) {
		ord = 1+Util.div64(X.U32(0x68,_BE)-smpsz, 0x3C); smpsz -= 0x70;
		sOption('ord:'+ord+' smp:'+smp+' smpsz:'+Hex(smpsz)+' sz:'+outSz(sz))
	}
}


function isBuzzic2() {
	//from the app sources
	if(!X.c("'buz2'0200")) return;
	gvol = X.F32(8); if(!isWithin(gvol,0,2)) return;
	bpm = X.U32(0xC); if(!isWithin(bpm,10,200)) return;
	startpos = X.U32(0x10); ord = X.U32(0x14)+1; if(startpos >= ord) return;
	looping = X.U8(0x18); if(looping > 1) return;
	nV = X.U16(6); p = 0x9C; sz = -1; bad = "";
	maxptn = maxtrk = 64; maxtml /*max template melody length*/ = 128;
	ptn = X.U32(p); trk = X.U32(p+4); p += 8;
	if(nV >= 1) { maxptn = X.I32(p); maxtrk = X.I32(p+4); maxtml = X.I32(p+8); p += 12 }
	p += maxptn*16+maxtrk*maxtml;
	trks = [];
	for(i=0; i < 64; i++) { t = X.SA(p,0x40).trim(); if(t != "") trks.push(t); p += 0x40 }
	ptns = [];
	for(i=0; i < 64; i++) { t = X.SA(p,0x40).trim(); if(t != "") ptns.push(t); p += 0x40 }
	ins = X.U32(p); p += 4;
	if(p > X.Sz()) return;
	inss = []; totalops = 0;
	for(i=0; i < ins; i++) {
		t = X.SA(p,0x80).trim(); if(t != "") inss.push(t);
		var opcnt = X.U32(p+0x184); totalops += opcnt; p += 0x2410+opcnt*0x228;
	}
	sz = p; if(sz > X.Sz()) bad = bad.addIfNone('!short');
	return true;
}
if(!bDetected && isBuzzic2()) {
	sName = "Buzzic module (.buz2)"; bDetected = 1; sVersion = 'v2.'+nV.padStart(2,'0');
	if(X.isVerbose()) {
		//sOptionT(addEllipsis(trks.join(','),0xA0,0x80),'trks:"','"');
		//sOptionT(addEllipsis(ptns.join(','),0xA0,0x80),'ptns:"','"');
		//sOptionT(addEllipsis(inss.join(','),0xA0,0x80),'insts:"','"');
		sOption('bpm:'+bpm+' trk:'+trk+' ptn:'+ptn+' ins:'+ins+' g.vol:'+Math.round(gvol*100)+'% ops:'+totalops+' sz:'+outSz(sz))
	}
}


function isInfogramesRH2() {
	if(!X.c("000200")) return; //+04: speed? version? I saw 1 through 7
	if(!X.c("FF000F",X.U16(4,_BE)+1)) return;
	sz = X.U16(0x10,_BE)+2;
	for(i=10,oldp = X.U16(8,_BE); i < 0x20; i += 2) { if(i == 0x10) continue;
		p = X.U16(i,_BE); if(p <= oldp || p+1 > X.Sz()) return;  if(!X.c("FF",p+1)) return;
		oldp = p
	}
	return true;
}
if(!bDetected && isInfogramesRH2()) {
	sName = "Infogrames (RobHubbard2) module (.DUM&.INS)"; bDetected = 1;
	if(X.isVerbose()) sOption(outSz(sz),'sz:')
	//TODO get info
}


function isSpecialFX() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SpecialFX/Special%20FX_v2.asm
	if(!X.c("6000")) return;
	d2 = X.U16(2,_BE); if(d2 <= 0 || d2%2) return;  a1 = 2; a0 = 4;
	for(i = 0; i < 3; i++) { if(!X.c("6000",a0)) return;  t = X.U16(a0+2,_BE); a0 += 4; if(t <= 0 || t%2) return }
	a1 += d2;
	if(X.c("6000",a0)) {
		for(i = 0; i < 3; i++) { if(!X.c("6000",a0)) return;  t = X.U16(a0+2,_BE); a0 += 4; if(t <= 0 || t%2) return }
		if(X.c("6000",a0)) return;
	} else { //OldFor
		if(!X.c("6100",a1)) return; a1 += 4
	}
	if(!X.c("41F9",a1)) return; a1 += 6; if(!X.c("43F9",a1)) return;
	//TODO subsongs
	return true;
}
if(!bDetected && isSpecialFX()) {
	sName = "M.Cannon & J.Dunn's Special FX module (.JD)"; bDetected = 1
}


function isSpecialFXST() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SpecialFX_ST/src/Special%20FX%20ST_v3.asm
	if(X.Sz() < 2300) return;
	if(!X.c("00000000") && !X.c("0101") && !X.c("00000101") && !X.c("6000")) return;
	var a0 = 0, a1 = 140, a2 = X.Sz()-4;
	while(a0 < X.Sz()) { if(X.c("00090800",a0)) break; a0 += 2; if(a1 == a0) return }
	if(!X.c("01120900", a0+74) && !X.c("02240A00", a0+74*2) && !X.c("00090800", a0+74*3)
	  && !X.c("01120900", a0+74*4) && !X.c("02240A00", a0+74*5)) return;
	a0 = a1+1860;
	while(a0 < X.Sz()) { if(X.c("0EF80E10",a0)) break; a0 += 2; if(a0 >= a2) return }
	//init
	sz = -1; a1 = 0; var d1 = 10, d7 = 0, p1 = 0, p2 = 0;
	while(a1 < X.Sz()) { d0 -= 2; a1 += 2; if(X.c("E740",a1-2)) break } //Find1
	x = X.U16(a1-12,_BE);
	p1 = a1-4+X.U16(a1-4,_BE);
	while(a1 < X.Sz()) { //Find2
		if(X.c("101A234A",a1)) {
			a1 += d1 }
		else if(X.c("4880D040",a1)) break; //noSpec, break to OK2
		a1 += 2
	}
	p2 = a1-2+X.U16(a1-2,_BE); //useful
	while(a1 < X.Sz()) { if(X.c("08C70007",a1)) break; a1 += 2 } //Find3
	a2 = a1; if(a1 >= X.Sz()) return false;
	while(a2 > 0) { a2 -=2; if(X.c("41FA",a2)) break } //Find4
	while(a1 < X.Sz()) //Find5
		if(X.c("41F9",a1)) { a2 = X.U16(a1+2,_BE); break }
		else { t = X.c("41FA",a1); a1 += 2; if(t) { a2 = a1+X.U16(a1,_BE); break }
	}
	while(a1 < X.Sz()) { if(X.c("08870002",a1)) break; a1 += 2 } //Find6
	a2 = a1+6; //OK6
	if(X.c("41F9",a2-2)) { a2 = X.U16(a2,_BE); d7 = a2 }
	else a2 += X.U16(a2,_BE);
	while(a1 < X.Sz()) { if(X.c("08C70002",a1)) break; a1 += 2 } //Find7
	a1 += d1; a2 = a1;
	if(X.c("41F9",a2-2)) a2 = X.U16(a2,_BE); else a2 += X.U16(a2,_BE);
	while(a1 < X.Sz()) { t = X.c("41FA",a1); a1 += 2; if(t) break } //Find8
	a2 = a1+X.U16(a1,_BE);
	var skip = 0; bad = '';
	while(a1 < X.Sz()) { if(X.c("0EF80E10",a1)) { skip = 1; break } if(X.c("7000101A",a1)) break; a1 += 2 } //Find9
	if(!skip) {
		a2 = a1-2+X.U16(a1-2,_BE);
		while(a1 < X.Sz()) //FindA
			if(X.c("0EF80E10",a1)) { skip = 1; break }
			else { t = X.c("41FA",a1); a1 += 2; if(t) break }
		a2 = a1; a1 += X.U16(a1,_BE);
	}
	if(!skip) if(a1 > X.Sz()) { bad = bad.addIfNone('!short'); skip = 2 }
	if(!skip) { sz = a1; if(!d7) skip = 1 }
	if(!skip) while(a2 < X.Sz()) { //FindEnd
		if(X.c("41FA",a2)) sz = a1 = a2+2+X.U16(a2+2,_BE)+14;
		if(!X.c("110010",a2)) break; else a2 += 2;
	}
	//EndTable skipped -> Skip2
	if(skip != 2) {
		d0 = p2-p1;
		if(d0 > 0) d0 >>= 3;
		if(d0 > 0) x = d0
	}
	return true
}
if(!bDetected && isSpecialFXST()) {
	sName = "Special FX ST module (.DODA)"; bDetected = 1;
	if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		if(sz != -1) sOption(outSz(sz),'sz:')
	}
}


function isTronicDP() {
	a0 = d1 = 0x10+X.U16(2,_BE)+X.U16(6,_BE)+X.U16(10,_BE)+X.U16(14,_BE);
	if(a0 > X.Sz() || a0 % 2) return;
	a0 += X.U16(a0,_BE); if(a0 % 2) return;
	if(!X.c("005800B0",a0+4)) return;
	return true
}
if(!bDetected && isTronicDP()) {
	sName = "Tronic Delta Packer module (.DP)"; bDetected = 1; sOption('in:TronicTracker(?)')
}


function isDigitalSonixChrome() {
	//ref UADE player RE
	if(!X.U16(0)) return;  if(!(smp=X.U8(2))) return;  if((ord=X.U8(3)) < 2) return;
	d2 = smpsz = X.U32(4,_BE); if(!d2 || d2%2 || d2 > X.Sz() || d2 > 0x80000) return;
	d3 = X.U32(8,_BE); if(d3 > 0x20000) return;
	a0 = 0xC; x = 0;
	for(i=ord-1; i; i--) {
		d4 = X.I32(a0,_BE); if(d4 < 0 || d4 > 0x20000 || d4%2) return false; if(!X.U8(a0+4)) x++; a0 += 6
	}
	if(!X.c("00000000 0000",a0)) return;  a0 += 6; //@d2de~e4
	d3 <<= 2; a0 += d3; //d2e6~8
	a2 = a0+smp*0x12; //d2ea~f4
	s = 0;
	while(a0 < X.Sz() && a0 < a2) {
		d1 = X.I32(a0+2,_BE); if(!isWithin(d1, 0,d2)) return;
		d0 = X.U32(a0+0xC,_BE); if(d0 > d2) return;
		if(X.U8(a0+0x10) > 0x40 || X.U8(a0+0x11)) return; //this check's not in the player
		a0 += 0x12;
	}
	if(a0 > X.Sz() || d2 != d0+X.I32(a0-0x10,_BE)) return;
	sz = a0+smpsz;
	return true
}
if(!bDetected && isDigitalSonixChrome()) {
	sName = "Andrew Bailey & David Hanlon's Digital Sonix & Chrome module (.DSC)"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption('ord:'+ord+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isPaulShields() {
	//ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/PaulShields/src/Paul%20Shields_v3.asm
	if(!X.c("00000000 0000000 0000")) return;
	if((t = X.U16(0xA4)) === X.U16(0xA8) && t === X.U16(0xAC) && t === X.U16(0xB0)
	  && (t = X.I16(0xA0,_BE)) > 0 && !(t%2) && X.c("00B400B6",t)) { fmt = 1; p = 0xA6 }
	else if((t = X.U16(0x204)) === X.U16(0x208) && t === X.U16(0x20C) && t === X.U16(0x210)
	  && (t = X.I16(0x200,_BE)) > 0 && !(t%2) && X.c("02140216",t)) { fmt = -1; p = 0x206 }
	else if((t = X.U16(0x202)) === X.U16(0x206) && t === X.U16(0x20A) && t === X.U16(0x20E)
	  && (t = X.I16(0x204,_BE)) > 0 && !(t%2) && (X.c("FFEC",t-2) || X.c("FFE8",t-2))) { fmt = 0; p = 0x204 }
	else return;
	mp = 0; a3 = 0;
	for(i=0; i < 4; i++) { t = X.U16(p,_BE); if(mp < t) mp = t; p += 4 }
	a3 += mp; mp = X.U16(a3-2,_BE); while(a3 < X.Sz()) { t = X.U16(a3,_BE); a3 += 2; if(t == mp) break }
	smpp = a3; if(!isWithin(smpp,0x400,0x4000)) return;
	if(fmt == 1) a3 = X.I16(0xAA,_BE); else if(fmt == 0) a3 = X.I16(0x204,_BE); else a3 = X.I16(0x20A,_BE);
	ord = 0; while(a3 < X.Sz()) { t = X.U16(a3,_BE); a3 += 2; if(t == mp) break; ord++ }
	if(!isWithin(ord,1,0x80)) return;
	for(i=p=smp=smpsz=0; i < 0x10; i++) {
		p += 2; if(fmt != 1) p += 20; if(t = X.U16(p,_BE)) { smpsz += t; smp++ } p += 8; if(fmt != 1) p += 2;
	}
	smpsz <<= 1; if(!smp || !isWithin(smpsz,0x2000,0x20000)) return;
	sz = smpp+smpsz;
	return true;
}
if(!bDetected && isPaulShields()) {
	sName = "Paul Shields' module (.PS)"; sVersion = 'f.'+fmt; bDetected = 1;	
	if(X.isVerbose()) {
		sOption('ord:'+ord+' smp:'+smp+' smpsz:'+Hex(smpsz)+' sz:'+outSz(sz))
	}
}


function isROL() {
	// ref https://moddingwiki.shikadi.net/wiki/ROL_Format
	// the "signature" can contain filenames and (cut off) software names
	if(X.Sz() < 0xB6+(45*15+4+2) || !isWithin(X.U32(0), 0x30000,0x40000) || !X.c("'Tempo'00", 0xB6)) return;
	if(!isWithin(X.U16(0x2C), 1,0x30) || !isWithin(X.U16(0x2E), 1,0x10)) return;
	if(!isWithin(X.U16(0x30), 0x10,0x50) || !isWithin(X.U16(0x32), 0x20,0x50)) return;
	if(!isWithin(X.U8(0x34), 0,1) || (mode=X.U8(0x35)) > 1) return;
	bpm0 = X.F16(0xC5);
	q = true;
	ch = voices = X.U8(0x35)? 9: 11; ev = X.U16(0xC7);
	for(i=mclk=0,p=0x36; i < 45; i++,p+=2) {
		if(i < 11) { if(!X.U16(p)) ch--; mclk = Math.max(mclk, X.U16(p)) }
	}
	for(i=0x36; i < 0x4C && q; i += 2) if(X.U16(i) > 0x10FF) q = false;
	for(; i < 0x90 && q; i += 2) if(X.U16(i) > 0x1FF) q = false;
	if(!q) return;
	p = 0xCB+X.U16(0xC9)*6; //skip tempo events
	mtln = mdur = notev = insev = volev = pitev = 0;
	for(i=0; i < voices; i++) {
		p += 0xF; dur = 0;
		tln = X.U16(p); p += 2;
		if(tln) do { dur += X.U16(p+2); p += 4; notev++ } while (dur < tln && p < X.Sz()); //load note events
		if(tln > mtln) mtln = tln; if(dur > mdur) mdur = dur;
		p += 0xF;
		insev += (t=X.U16(p)); p += 2+14*t+0xF; //skip ins.events
		volev += (t=X.U16(p)); p += 2+6*t+0xF; //skip vol.events
		pitev += (t=X.U16(p)); p += 2+6*t; //skip pitch events
	}
	sz = p;
	return true;
}
if(!bDetected && isROL()) {
	sName = "Ad Lib's AdLib Visual Composer pianoroll (.ROL)"; bDetected = 1;
	if(X.isVerbose()) {
		c = X.SA(4,40); if(c != '\\roll\\default') sOption(c);
		sOption('ch:'+(ch!=voices?ch+'/':'')+voices+' rhythm:'+X.U16(0x2C)+'/'+X.U16(0x2E)
			+' bpm0:'+bpm0.toFixed(1)+' len:'+mdur+' notes:'+notev+' ins.ev:'+insev
			+' ins.ev:'+insev+' vol.ev:'+volev+' pitchev:'+pitev+' sz:'+outSz(sz))
	}
}


function isGYMX() {
	if(X.Sz() < 0x1AC || !X.c("'GYMX'")) return;
	for(i=4; i < 0x1A8; i++) if(isWithin(X.U8(i), 1,0xA) || isWithin(X.U8(i),0xE,0x1F)) return;
	unpsz = X.U32(0x1A8);
	if(unpsz <= 2) if(parseMDGYM(0x1AC, X.isDeepScan() ? BCParseToEoF : BCParseToReasonable) <= 0)
		return;
	return true
}
if(!bDetected && isGYMX()) {
	sName = "Sega Genesis/Mega Drive YM2612 chiptune (.GYM)"; bDetected = 1;
	if(unpsz <= 2) sVersion = sVersion.append('unpacked');
	if(X.isVerbose()) {
		sOptionT(X.SC(0x4,0x20,'CP1252'));
		sOptionT(X.SC(0x24,0x20,'CP1252'),'for: ');
		sOptionT(X.SC(0x44,0x20,'CP1252'),'at: ');
		sOptionT(X.SC(0x64,0x20,'CP1252'),'emu: ')
		sOptionT(X.SC(0x84,0x20,'CP1252'),'by: ');
		sOptionT(X.SC(0xA4,0x100,'CP1252'));
		if(unpsz > 2) sOptionT(X.U32(0x1A8),'unp.sz:')
	}
}


function isSoundMaster() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/SoundMaster/Sound%20Master_v1.asm
	if(!X.c("6000.... 6000.... 6000") || (p=base=a6=X.I16(2,_BE)+2) <= 0 || p%2
		|| (playp=X.I16(6,_BE)+6) <= 0 || playp%2) return;
	for(p1 = p+30; p < p1; p += 2) if(X.c("47FA",p-2)) break;  if(p >= p1) return;
	var lea1 = p; t = Math.min(X.Sz(),0x20000);
	for(; p < t; p += 2) if(X.c("4E75",p-2)) break;  if(p >= X.Sz() || p >= t) return;
	fmt = 'old'; if(X.c("177C0000",p-8)) { fmt = 'new'; p -= 6 }
	if(!X.c("00BFE001",p-6)) return;

	p = base; x = 1; d0 = 0;
	if(X.c("1740",p+6) || X.c("1740",p+4)) {
		for(; p < X.Sz(); p += 2) if(X.c("47FA",p-2)) break;  p += X.I16(p,_BE); a6 = p;
	} else skipold: do { //a one-time "loop" to have a way to break off
		if(X.c("3C00",p)) {
			p = lea1; a3 = a6 = p+X.I16(p,_BE);
			for(; p < X.Sz(); p += 2) if(X.c("7600",p-2)) break;  a3 += X.I16(p-4,_BE)+3; d0 = 7;
			for(; d0; a3+=3,x++,d0--) {
				if(!X.U16(a3,_BE) && X.U8(a3+2) == 1) break;
			}
			d0 = X.U8(a3-1);
			break skipold;
		} else
			if(X.c("4A00",p+0x28)) { x++; d0 = X.I16(p+0x34,_BE) }
		for(; p < X.Sz(); p += 2) if(X.c("47FA",p-2)) break;  p += X.I16(p,_BE); a6 = p;
	} while(0);
	ord = d0;

	for(p = 0xC; p < X.Sz(); p += 2) if(X.c("1743",p-2)) break; a3 = a6; pos = a6+X.I16(p,_BE);
	for(p = 0xC; p < X.Sz(); p += 2) if(X.c("5203",p-2)) break;
	sz = -1; patchable = X.c("177C", p+10);
	if(patchable) {
		a2 = base; a3 += X.I16(p+2,_BE);
		if(!ord) ord = X.U8(a3);
		if(fmt == 'new') {
			for(p = base+2; p < X.Sz(); p += 2) if(X.c("41EB",p-2)) break;
			a3 = a6; a6 += X.I16(p,_BE); a3 += X.I16(p+4,_BE); a6 += X.I32(a3,_BE); smpip = a6;
			songsz = a6+X.I16(a3-2,_BE);
			smp = smpsz = 0;
			for(;a6 < X.Sz();) {
				d3 = X.I32(a6,_BE); a6 += 4;
				if(d3 > 0 && (ssz = X.U16(a6,_BE)<<1)) {
					smp++; d3 += ssz;
					if(smpsz < d3) smpsz = d3;
				}
				a6 += 6; if(a6 >= songsz) break
			}
		} else { // old format
			for(p = base+2; p < X.Sz(); p += 2) if(X.c("3D70",p-2)) break;
			for(; p < X.Sz(); p += 2) if(X.c("D5F0",p-2)) break;
			a3 = a6+X.I16(p-4,_BE); a6 += X.I32(a3,_BE); t = a6; a6 += X.U16(p-0x12,_BE);
			smpip = a6; smp = smpsz = 0; a3 = a6+0x80;
			for(d1 = 32; d1; d1--) {
				if(X.U16(a3,_BE) > 1) {
					smp++; ssz = X.U16(a3,_BE)<<1; d3 = ssz+X.I32(a6,_BE); if(smpsz < d3) smpsz = d3;
				}
				a6 += 4; a3 += 2
			}
			songsz = t+X.U16(p-8,_BE);
		}
		sz = songsz+smpsz
	}
	return true
}
if(!bDetected && isSoundMaster()) {
	sName = "Sound Master module (.SM,.SMPRO,.SM3)"; sVersion = fmt; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		if(patchable) sOption('ord:'+ord+' sz:'+outSz(sz));
		//else sOption('unpatchable or precooked');
	}
}


function isTomyTracker() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/TomyTracker/src/Tomy%20Tracker_v2.asm
	if(X.Sz() < 0x6C0) return;
	if((sz=X.U32(0,_BE)) > 0x200000 || sz%2) return;
	if((d2=X.U32(4,_BE)) > sz || d2%2) return;
	d2 -= 0x2C0; if(d2 & 0x3FF) return;
	ptn = d2 >>= 10; d2--; p = 0x1BC; if(X.U8(p)) return;
	ord = d1 = X.I8(p+1); if(ord < 0) return;  p += 4; d2 <<= 10; d3 = 0;
	for(; d1; p+=2,d1--) { if((t=X.I16(p,_BE)) & 0x3FF) return;  if(d3 < t) d3 = t }
	if(d2 != d3) return;
	for(smp = 0, p = 14; p < 0x1C0; p += 0xE) if(X.U16(p,_BE)) smp++;
	return true
}
if(!bDetected && isTomyTracker()) {
	sName = "Tom Pakarinen's Tomy Tracker module (.SG)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isSoundcontrol() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Soundcontrol/src/Soundcontrol_v3.asm
	if(!X.c("0003",0x20))
		if(!X.c("0002",0x20) || X.U32(0x1C,_BE)) return;
	if(X.U16(0x10,_BE)) return;
	if((p = X.I16(0x12,_BE)) < 0 || p % 2) return;
	if(!X.c("FFFF0000 0400",p+0x3E)) return;
	title = X.readBytes(0,0x10); if(charStat(title,1).indexOf('allasc') < 0) return;
	title = decEncoding(title,"CP437");
	a2 = 0; a3 = sz = 0x40+X.U32(0x10,_BE);
	d2 = X.U32(0x14,_BE); sz += d2; a4 = sz;
	d1 = X.U32(0x18,_BE); sz += d1+X.U32(0x1C,_BE); d2 -= 0x400;
	if (X.Sz() < sz) return;
	ord = d1 = Util.divu64(d1,12); d1--;
	voc = 0;
	for(d3 = 6; d3; d3--,a4 += 2)  for(p = a4,d4 = ord; d4; d4--,p += 12)  if(X.U16(p,_BE)) { voc++; break }
	a3 += 0x43C; smp = d3 = 0;
	while(d2 > d3) { d4 = X.U32(a3,_BE); a3 += d4; d3 += d4; smp++ }
	x = 1; nv = 0; sv = '';
	if(X.U32(0x1C,_BE)) //crude fixes, go
		switch(sz) {
		case 95960: x = 2; //hndongame2; fallthrough
		case 54544: sv = 'v4.0'; break; //hndtitle
		case 81906: sv = 'v5.0'; break //hndintro
		}
	else
		switch(sz) {
		case 126446: x = 3; sv = 'v3.0'; break; //number9
		case 136612: x = 2; sv = 'v3.0'; break; //domination 1
		case 154704: x = 2; //dynatsong; fallthrough
		case 103808: sv = 'v3.2'; break; //eleven6
		}
	for(p = 0x40, ptn = 0; p < 0x240; p += 2) if(X.U16(p,_BE)) ptn++;
	return true
}
if(!bDetected && isSoundcontrol()) {
	sName = "Holger Gehrmann's Soundcontrol module (.SCT)"; sVersion = sv; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(title); if(x > 1) sOption(x,'×');
		sOption('ch:'+voc+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isSoundfactory() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Soundfactory/src/Soundfactory_v2.asm
	if((sz=X.U32(0,_BE)) > 0x200000 || sz > X.Sz()) return;
	x = 16; lastfound = false;
	for(p=0x13; p >= 4; p--) { if((t=X.U8(p)) > 0xF) return; if(!lastfound && t) {x = p-4; lastfound = true } }
	m = X.U32(0x14,_BE);
	for(p = 0x18; p < 0x114; p+=4) { if((t=X.U32(p,_BE)) > 0x200000 || t > sz) return false; if(m > t) m = t }
	if(m != 0x114) return;
	if(X.isDeepScan()) {
		p = 0x114; smp = smpsz = 0;
		for(;p < sz-8;) {
			//seek 84h at an even offset
			do { q = X.fSig(p,sz-8-p,"84"); if(q < 0) { p = sz; continue} else p = q+(q%2) } while(p < sz && !q%2);
//_log("found "+Hex(q))
			if(p < sz && (d1=X.U8(p+1)) <= 0x1F) {
				d1 >>= 2; smpp[d1] = p;
				d4 = X.U16(p+2,_BE)<<1; smpsz += d4-38; smp++; p += d4
			} else p += 2;
		}
		if(!smp || smp > 32) return;
	}
	return true
}
if(!bDetected && isSoundfactory()) {
	sName = "Soundfactory module (.PSF)"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption((X.isDeepScan()?'smp:'+smp+' smpsz:'+Hex(smpsz)+' ':'')+'sz:'+outSz(sz))
	}
}


function isBeniTracker() {
	//from https://modland.com/pub/software/trackers/DOS/Beni%20Tracker/Beni%20Tracker%20v1.8.rar / BT18.BAS -> SUB loadmod
	//ref BT18.DOC & https://modland.com/pub/software/trackers/DOS/Beni%20Tracker/Beni%20Tracker%20v1.3.rar / BeniTrk.doc
	ord = X.U8(0); ptn = X.U8(1); ins = X.U8(2);
	if(!ptn || ptn > 0xCC || ins > 0x1F) return;
	var ptnmap = [], insmap = [];
	p = 3; mptn = mins = 0;
	for(i=0; i < ptn; i++) {
		if((t = X.U8(p++)) > 0xCB) return;  if(mptn < t) mptn = t;
		if(ptnmap.indexOf(t) < 0) ptnmap.push(t) }
	if(ins) {
		for(i=0; i < ins; i++) {
			if(!isWithin(t = X.U8(p++),1,0x1F)) return;  if(mins < t) mins = t;
			if(insmap.indexOf(t) < 0) insmap.push(t) }
	}
	rptn = ptnmap.length; rins = insmap.length; mptn++;
	if(rptn != ptn || (ins && rins != ins)) return;
	for(o = 0; o < ord; o++)
		for(i=0; i < 9; i++)
			if(ptnmap.indexOf(X.U8(p++)) < 0) return;
	notes = 0;
	for(i=0; i < ptn*0x40; i++,p+=3) {
		var nt = X.U8(p) >> 4, ns = (X.U8(p) & 1) << 4 | X.U8(p+1) >> 4;
		if(nt > 12 || ns && insmap.indexOf(ns) < 0) return;
		if(nt != 12) notes++;
	}
	p += ins*0xB;
	if(X.c("'B.J.'",p)) { p += 4; sv = 'v1.8' } else sv = 'v1.3';
	if(sv == 'v1.3' && ptn > 100) return;
	sz = p; return true;
}
if(!bDetected && isBeniTracker()) {
	sName = "SPP's Beni Tracker (Adlib) module (.PIS)"; sVersion = sv; bDetected = 1;
	if(X.isVerbose()) {
		sOption('ord:'+ord+' ptn:'+ptn+(ptn!=mptn?'/'+mptn:'')+' ins:'+ins+(ins!=mins?'/'+mins:'')
			+' notes:'+notes+' sz:'+outSz(sz))
	}
}


function isSteveBarrett() {
	//ref reversing the eagleplayer and the module's player code
	for(p=0; p < 0x10; p += 4) if(!X.c("6000",p) || (t=X.U16(p+2,_BE)) > X.Sz() || t%2) return false;
	
	t = X.I16(6,_BE)+6; if(!X.c("49FA....1940....4E75 43FA.... 49FA.... 41FA.... 45FA",t)
		|| !X.c("'FORM'66",t+0x1C)) return false;
	t = X.I16(10,_BE)+10;
	if(!X.c("49FA....4CFA00FF",t) || !X.c("103A.... 660C 1940.... 6100... .6000",t+10)
		|| !X.c("2A4C DAD8 22CD 2A4C DAD8 22CD 2A4C DAD8 22CD",t+0x34)) return false;
	t = X.I16(0xE,_BE)+0xE;
	if(!X.c("70002A7C 00DFF0A8 3A803B40",t) || !X.c("1A801B40 00011B40 00021B40",t+0x1A)) return false; 
	initp = X.I16(2,_BE)+2; if(!X.c("43FA....49FA....41FA....45FA",initp) || !X.c("'FORM'66",initp+0x12)) return false;
	a0 = 0;
	for(p = initp; p < initp+0x10; p += 2) //find the sample ptr
		if(X.c("41FA",p-2)) { a0 = p+X.I16(p,_BE); break }
	if((p=6+X.fSig(initp,0x1000,"E7404281")) < 6) return false; t = p+X.I16(p,_BE); //possibly orderlist ptr
	for(; p < X.Sz(); p += 2) if(X.c("41FA",p-2)) break;
	for(; p < X.Sz(); p += 2) if(X.c("D08043FA",p)) break; p += 4; p += X.I16(p,_BE);
	x = (p-t)>>3;
	for(p = a0,smp=0; p < X.Sz(); smp++) {
		if(!X.c("'FORM'........'8SVXVHDR'",p)) { if(!X.U32(p)) p += 4; break }
		p += 8+X.U32(p+4,_BE);
	}
	sz = p; if(!smp) return false;
	return true;
}
if(!bDetected && isSteveBarrett()) {
	sName = "Steve Barrett's module (.SB)"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption('smp:'+smp+' sz:'+outSz(sz))
	}
}


function isQuartetPSG() {
	// ref the eagleplayer RE
	if(X.Sz() < 0x400 || !X.c("49FA",0x10)) return false;
	for(p=0; p < 0x10; p += 4)
		if(!X.c("6000",p) || (t=X.I16(p+2,_BE)) <= 0 || t%2) return false;
	if(!X.c("48E7FFFE 4DFA.... 51EE.... 41FA",p=2+X.I16(2,_BE))) return false; 
	if(!X.c("48E7FFFE 4DFA.... 4A2E.... 6700.... 70033F00 49FA",p=6+X.I16(6,_BE))) return false; 
	if(!X.c("48E7FFFE 4DFA.... 51EE.... 6100",p=10+X.I16(10,_BE))) return false; 

	for(p = 0x10; p < X.Sz(); p += 2) if(X.c("40C2",p)) break;
	for(; p < X.Sz(); p += 2) if(X.c("41FA",p)) break;
	p += 6; sz = p+X.I16(p,_BE); p += 2;
	for(; p < X.Sz(); p += 2) if(X.c("43E9",p-2)) break;
	sz += X.I16(p,_BE) << 1; a3 = sz; if(sz > X.Sz()) return false;
	for(a0 = 0; p < X.Sz(); p += 2) {
		if(X.c("206C0032",p)) { a0 += 8; p += 4 } if(X.c("08380007",p) || X.c("08390007",p)) break
	}
	for(; p < sz; p += 2) if(X.c("40C1",p)) break;
	for(p += 4; p < X.Sz(); p += 2) if(X.c("4CDF",p)) break;
	for(; p < sz; p += 2) if(X.I32(p,_BE) == 0x56) break;
	for(x = 0; p < a3; p += 2) if(X.I16(p,_BE) == 0x46) x++;
	x >>= 2;
	return true
}
if(!bDetected && isQuartetPSG()) {
	sName = "Illusions/Microdeal Quartet module (SQT.)";
	sVersion = "PSG synth"; bDetected = 1;
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption(outSz(sz),'sz:')
	}
}


function isSonicArranger() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/Sonic_Arranger/Sonic Arranger_v1.asm
	p = modp = smp = synsmp = ord = ptn = 0; x = 1; sv = bad = ''; owner = [];
	if(X.c("'SOARV1.0STBL'")) {
		x = X.I32(0xC,_BE); spd0 = X.U8(0x11); ptnlen0 = X.U8(0x13); pst0 = X.U16(0x14,_BE);
		ped0 = X.U16(0x16,_BE); lp0 = X.U16(0x18,_BE); irqps0 = X.U16(0x1A,_BE);
		if(!isWithin(spd0,2,16) || !isWithin(irqps0,16,120) || pst0 > ped0 || lp0 > ped0) return false;
		p = 0x10+x*12; if(!X.c("'OVTB'",p)) return false; //"OverTable"
		ord = X.I32(p+4,_BE); if(ped0 > ord) return false;
		p += 0x18+(ord << 4); if(!X.c("'NTBL'",p-0x10)) return false;
		ntbl = X.I32(p-0xC,_BE); p += ntbl << 2; if(!X.c("'INST'",p-8)) return false;
		ptn = Util.divu64(ntbl,0x10); ins = X.I32(p-4,_BE); inss = [];
		for(i=0; i < ins; i++,p+=0x98) {
			if(X.U16(p,_BE)) synsmp++; else smp++;
			t = X.readBytes(p+0x7A,0x1E,true);
			t = decEncoding(t,CPAmiga).trim(); if(t != '') inss.push(t)
		}
		var sc;
		if(!X.c("'SD8B'",p)) return false; smp = X.I32(p+4,_BE); sc = smp; p += 8+smp*0x26;
		pp = p; p += smp << 2; for(; sc-- && p < X.Sz(); pp += 4) p += X.U32(pp,_BE);
		if(!X.c("'SYWT'",p)) return false; synsmp = X.I32(p+4,_BE); p += 8+(synsmp << 7);
		if(!X.c("'SYAR'",p)) return false; t = X.I32(p+4,_BE); p += 8+(t << 7);
		if(!X.c("'SYAF'",p)) return false; t = X.I32(p+4,_BE); p += 8+(t << 7);
		if(!X.c("'EDAT'",p)) return false; sz = p+24; sv = 'song';
		} else {
		if(X.c("4EFA")) { //detect & skip replay
			if((t=X.I16(2,_BE)) <= 0 || t%2) return false;
			if(!X.c("48E7FFFE 41FA",t+2) || !X.c("201045F0 0800228A 43FA",t+0xE)
				|| !X.c("20280004 45F00800 228A 43FA",t+0x1A)) return false;
			if((p=X.I16(t+8,_BE)) <= 0 || p%2) return false;
			p += t+8; modp = p; sv = '+replayer';
		} else sv = 'pure';
		if(p+0x28 > X.Sz() || !X.c("00000028",p)) return false;
		spd0 = X.U16(p+0x28,_BE); irqps0 = X.U16(p+0x32,_BE); lp0 = X.U16(p+0x30,_BE);
		if(!isWithin(spd0,2,16) || !isWithin(irqps0,16,120)) return false;
		x = (X.I32(p+4,_BE)-0x28)/12; if(x == 1 || X.I16(p+0x3C,_BE) < 0) x = 1;
		var ptrs = [0];
		for(i=0; i < 8; i++) {
			t = X.I32(p,_BE); p += 4; if(t <= 0 || t%2 || t < ptrs[ptrs.length-1]) return false; ptrs.push(t)
		}
		var ordp = ptrs[2], ptnp = ptrs[3], insp = ptrs[4], a = ptrs[5];
		sc = X.I32(modp+t,_BE);
		//ord recs contain u16 references and a couple control bytes ST and NT
		ord = Util.div64(ptnp-ordp,0x10); ptn = Util.div64(insp-ptnp,0x40); ins = Util.div64(a-insp,0x98);
		p = modp+t; if(p > X.Sz()) return false;
		for(i=0; i < ins; i++) if(X.U16(modp+insp+i*0x98,_BE)) synsmp++; else smp++;
		if(smp != sc) bad = bad.addIfNone('!inconsistentsmpcnt'+sc); //be cool to understand how that happens...
		p += 4;
		if(smp) for(pp=p, p+=sc<<2; sc-- && p < X.Sz(); pp += 4) p += X.U32(pp,_BE);
		if(!X.c("'deadbeef'",p)) if(X.isHeuristicScan()) bad = bad.addIfNone('!badeof'); else return false;
		p += 12; sc = p; //skip 'deadbeef    '; sc is now for counting the string length
		// There's no real need to include the "programowner" info into calcsize but let's;
		// otherwise the eagleplayer thinks the file is "too short", although nobody really cares...
		for(lim = Math.min(p+0x400,X.Sz()); p < lim;) {
			c = X.U8(p++)^0xFF; if(c == 0xFF || isWithin(c,0,8) || isWithin(c,11,12) || isWithin(c,14,0x1F)) break;
			if(c == 0xA) { c = 0x20; if(owner[owner.length-1] == 0x20) continue }
			owner.push(c)
		}
		if(owner[owner.length-1] == 0x20) owner.pop();
		sz = p;
		if(c != 0xFF && p-sc != 0x50) bad = bad.addIfNone('!badinfo');
	}
	bpm0 = (15*irqps0/spd0).toFixed(1); owner = decEncoding(owner,CPAmiga).trim();
	return true
}
if(!bDetected && isSonicArranger()) {
	sName = "BrainTrace Design's Sonic Arranger module (.SA"+(sv == 'pure'?',.LION':'')+")"; bDetected = 1;
	sVersion = sv; if(bad != '') sVersion = sVersion.appendS('malformed:'+bad,'/');
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		if(owner != '') sOption(addEllipsis(owner,0xA0,0x80),'info:"','"');
		sOption('bpm0:'+bpm0+(ord?' ord:'+ord:'')+(lp0?' lp0:'+lp0:'')+(ptn?' ptn:'+ptn:'')+(ins?' ins:'+ins:'')
			+(smp?' wf.smp:'+smp:'')+(synsmp?' syn.smp:'+synsmp:'')+' sz:'+outSz(sz))
	}
}
if(!bDetected && X.c("'SASI'00000000000100")) {
	sName = "BrainTrace Design/MEDIA Verlags Sonic Arranger synth instrument"; bDetected = 1
}


function isJT() {
	if(X.Sz() < 1700) return;
	for(p = 0; p < 40; p += 2) if(X.c("02390001",p)) break; if(p == 40) return;
	p += 8; if(!X.c("66..4E75",p++)) return;  if((t = X.I8(p++)) <= 0) return;
	p += t; if(X.c("4A39",p))  for(j=4; j--; p += 0x12) if(!X.c("4A39",p)) return;
	if(!X.c("78001839",p)) return;
	for(j = p;;) { p = X.fSig(j,0x40000,"1400E302"); if(p < 0) return; else if(i % 2) { j = p+1; continue } else break }
	var org = X.U32(p+6,_BE);
	for(;;) { p = X.fSig(j,0x40000,"03580328"); if(p < 0) return; else if(i % 2) { j = p+1; continue } else break }
	org -= p;
	for(p=0; p < 0x40000; p += 2) if(X.c("B23C00FF",p) || X.c("0C0100FF",p)) break;  if(p >= 0x40000) return;
	for(; p < 0x40000; p += 2) if(X.c("267C",p-2)) break;  if(p >= 0x40000) return; p += 4; //?
	for(; p < 0x40000; p += 2) if(X.c("49F9",p-2)) break;  if(p >= 0x40000) return; smpip = X.U32(p,_BE)-org; p += 4;
	for(; p < 0x40000; p += 2) if(X.c("0026267C",p-4)) break;  if(p >= 0x40000) return; p += 4; //?
	for(; p < 0x40000; p += 2) if(X.c("23F4",p)) break;  if(p >= 0x40000) return;
	subsongp = X.U32(p-4,_BE)-org; p += 6; x = 0;
	for(p=subsongp; p < 0x40000; p += 0x12) {
		if(X.U8(p+16) != 12) break; t = X.U32(p,_BE);
		if(X.U32(p+4,_BE) != t || X.U32(p+8,_BE) != t || X.U32(p+12,_BE) != t) x++; else break
	}
	j = X.U32(smpip,_BE)-org; i = smpip+4; info = (j-i) >> 2;
	d0 = X.I32(j+4,_BE); d1 = X.I16(j+2,_BE)*2 + d0;
	for(smp = 1; i < j; i += 4) {
		t = X.U32(i,_BE)-org; d3 = X.U32(t+4,_BE); if(!d3) continue;
		d4 = X.I16(t+2,_BE)*2+d3; if(d3 < d0) d0 = d3; if(d4 > d1) d1 = d4; smp++
	}
	songsz = d0-org; sz = d1-org;
	for(i=0; i < 0x40000; i+=2) if(X.c("4E75",i-2)) break;
	specialmsg = ''; //I've no modules to test this on
	if((d1=X.U8(i-3)) != 2) specialmsg = X.SC(i,0x100,CPAmiga);
	return true;
}
if(!bDetected && isJT()) {
	sName = "Jeroen 'WAVE' Tel's module (.JT)"; bDetected = 1;
	if(X.isVerbose()) {
		if(specialmsg != '') sOption(specialmsg); if(x > 1) sOption(x,'×');
		sOption('smp:'+smp+' songsz:'+Hex(songsz)+' sz:'+outSz(sz))
	}
}


function isTCBTracker() {
	//ref ftp://ftp.scene.org/pub/resources/gotpapers/manuals/tcb_tracker_1.0_manual_1990.pdf
	if(X.Sz() <= 0x132 || !X.c("'AN COOL'") || (ptn = X.U32(8,_BE)) > 127 || (tmp0 = X.U8(0xC)) > 15
		|| X.U8(0xD) || (ord = X.I8(0x8E)) <= 0) return;
	if(X.SA(7,1) == '!') fmt = 0; else if(X.SA(7,1) == '.') fmt = 1; else return;
	if(!fmt) ptnp = 0x110; else ptnp = 0x132; smpp = ptnp+ptn*0x200; if(smpp+0xD4 > X.Sz()) return;
	if(!X.c("FFFFFFFF00000000",smpp+0xCC) || X.U32(smpp+0x44,_BE) != 0xD4) return;
	smp = 0; p = smpp+0x48;
	for(i=0; i < 16 && p < X.Sz(); i++) if(X.U32(p,_BE) != 1) smp++;
	sz = smpp+X.U32(smpp,_BE);
	return true
}
if(!bDetected && isTCBTracker()) {
		sName = "Anders 'AN Cool' Nilsson's TCB Tracker module (.TCB)"; sVersion = 'f.'+fmt; bDetected = 1;
		if(X.isVerbose())
			sOption('tempo:'+tmp0+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz));
	}


function is669() {
	//from https://modland.com/pub/documents/format_documentation/Composer%20669,%20Unis%20669%20(.669).txt
	if(!X.c("'if'") && !X.c("'JN'") || X.Sz() < 0x1F1+0x600) return; //not easy to make the signature more deficient than this one!
	if((smp=X.U8(0x6E)) > 0x40 || (ptn=X.U8(0x6F)) > 0x80 || (lp=X.U8(0x70)) >= 0x80) return;
	for(ic=0,i=2; i < 0x6D; i++) if(isWithin(X.U8(i),1,31) && ++ic > 40) return;
	for(i=ord=0; i < 0x80; i++) { //from 71h: order list; from F1h: ptn tempos; from 171h: ptn breaks
		if((o=X.U8(0x71+i)) >= ptn && o < 0xFE) return; if(o < 0x80 && !(t=X.U8(0xF1+i))) return;
		if(t > 15 || X.U8(0x171+i) >= 0x40) return; if(o < 0xFE) ord++;
	}
	sz = 0x1F1+smp*0x19+ptn*0x600;
	if(X.Sz() < sz) return;
	for(i = rsmp = 0; i < smp; i++) { //smp filename may have custom messages (the lunar forest), but too rarely
		ssz = X.U32(0x1FE+i*0x19); slps = X.U32(0x202+i*0x19); slpe = X.U32(0x206+i*0x19);
		if(ssz) rsmp++; else continue;
		if(ssz > 0x4000000) return; //a sanity check from openmpt
		if([0xFFFFF,0xF0FFFF,0xFFFFFFFF].indexOf(slps) < 0 && slps > ssz) return;
		if([0xFFFFF,0xF0FFFF,0xFFFFFFFF].indexOf(slpe) < 0 && (slpe > ssz || slpe < slps)) return;
		sz += ssz;
	}
	return true
}
if(!bDetected && is669()) {
	sName = ( X.c("'if'") ? "Renaissance's Composer 669"
		: "Jason 'JsNO BAR----' Nunn's UNIS 669 Composer" ) + " module (.669)"; bDetected = 1;
	if(X.isVerbose()) {
		t = X.SC(0x02,36,'CP850').trim(); //the seemingly most-used encoding for'em
		t = t.appendS(X.SC(0x26,36,'CP850').trim(),' '); t = t.appendS(X.SC(0x4A,36,'CP850').trim(),' ');
		sOption(t); sOption('ord:'+ord+(lp?' loop:'+lp:'')+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isBuzzic10() { // doesn't detect empty modules with no sound, as the format's already too sparse
	if(X.Sz() < 0xAEA8) return;
	susv = 0; // suspicious values like zero volume
	ins = X.U32(0x4A00); if(!ins || ins > 128) return;
	trk = X.U32(0x8E8C); if(!trk || trk > 64) return;
	//not that many tracks even fit on screen tho', and there's no horizontal scrolling, so it'd be much fewer
	//however, technically, it does have the format space even to fit 128 tracks. But only 64 names for them.
	ptn = X.U32(0x8E84); if(!ptn || ptn > 128) return;
	gvol = X.F32(0x8E94); if(gvol < 0 || gvol > 2) return; gvol = Math.round(gvol*100)+'%';
	bpm = X.U8(0x8E98); if(bpm < 10) susv++;
	start = X.U32(0x8E9C); ord = X.U32(0x8EA0);
	if(!ord) susv++; if(ord > 127 || start > ord) return; ord++;
	floop = X.U32(0x8EA4); if(floop > 1) return;
	for(i = 0; i < ins; i++) { //test instruments
		p = i*0x94; if(p+0x93 > Math.min(X.Sz(), 0x4A00)) return;
		var mute = X.U8(p+0x80); if(mute > 1) return;
		var note = X.I8(p+0x81); if(!note) susv++;
		if(note < 0 && -note > trk) return; //track link has to call a track
		var nend = X.I8(p+0x82); if(nend < 0 && -nend > trk) return;
		var len = X.U8(p+0x83); if(len > 127) return;
		var vol = X.I8(p+0x84); if(vol < 0 && -vol > trk) return;
		if(!len) susv++; if(!vol) susv++;
		var osc = X.U8(p+0x85); if(osc > 3) return;  if(osc < 3 && !note) susv++; //only noise doesn't need the note
		var dtn = X.I8(p+0x86); if(note > 0 && note+dtn <= 0) return;  if(dtn < -32 || dtn > 64) susv++;
		var atk = X.U8(p+0x87), dcy = X.U8(p+0x88), sus = X.U8(p+0x89);
		if(dcy < atk || sus < dcy || sus > 127 || atk > 127 || sus > 127) return;
		if(!atk && !dcy && !sus) susv++;
		var cut = X.I8(p+0x8A); if(cut < 0 && -cut > trk) return; //cutoff mod @ +0x8B
		var res = X.I8(p+0x8C); if(res < 0 && -res > trk) return;
		var dly = X.U8(p+0x8D), rep = X.U8(p+0x8E), damp = X.U8(p+0x8F);
		if(dly > 127 || rep > 127 || damp > 127) return;
		var lvwrap = X.I8(p+0x90);
		if(lvwrap < 0 && lvwrap > trk) return;
		var lvhard = X.I8(p+0x91);
		if(lvhard < 0 && lvhard > trk) return;
		var comprlo = X.U8(p+0x92), comprhi = X.U8(p+0x93);
		if((comprlo > 127 || comprhi > 127) || (!comprhi && comprlo)
			|| (comprhi && comprhi <= comprlo)) return; // they CAN both be 0...
	}
	if(susv > ins*3) { if(debug>0)_logIt("data too suspicious"); return }
	for(i = 0x4A04; i < 0x4E84; i++) if(X.U8(i) > 127) return; // testing patterns
	for(i = 0x4E84; i < 0x4E84+64*128; i++) //testing tracks... all 64 of'em
		if(X.U8(i) > ptn) { if(debug>0)_logIt("@"+Hex(i)+": bad ptn"); return }
	if(!isAllZeroes(0x4E84+64*128,64*128))
		return false; // the uneditable tracks would stay as 0, fair enough
	// there are absolutely no checks made on the text values so there's no meaning in checking those
	return true
}
if(!bDetected && X.isDeepScan() && isBuzzic10()) {
	sName = "Buzzic module (.BUZ)"; sVersion = 'v1.0'; bDetected = 1;
	sOption('trk:'+trk+' ord:'+ord+(start?' (from '+start+')':'')+' ptn:'+ptn+' ins:'+ins
		+' bpm:'+bpm+' gvol:'+gvol+' sz:44712')
}


function isBuzzic11() { //detection only slightly different from the above
	if(X.Sz() < 0xB0A8) return false;
	susv = 0;
	ins = X.U32(0x4C00); if(!ins || ins > 128) return;
	trk = X.U32(0x908C); if(!trk || trk > 64) return; // this editor has better limits on max tracks
	ptn = X.U32(0x9084); if(!ptn || ptn > 128) return;
	gvol = X.F32(0x9094); if(gvol < 0 | gvol > 1.91) return; gvol = Math.round(gvol*100)+'%';
	bpm = X.U8(0x9098); if(bpm < 10) susv++;
	start = X.U32(0x909C); ord = X.U32(0x90A0);
	if(!ord) susv++; if(ord > 127 || start > ord) return; ord++;
	floop = X.U32(0x90A4); if(floop > 1) return;
	for(i = 0; i < ins; i++) {
		p = i*0x98; if(p+0x97 > Math.min(X.Sz(), 0x4A00)) return;
		var mute = X.U8(p+0x80); if(mute > 1) return;
		var note = X.I8(p+0x81); if(!note) susv++;
		if(note < 0 && -note > trk) return;
		var nend = X.I8(p+0x82); if(nend < 0 && -nend > trk) return;
		var len = X.U8(p+0x83); if(len > 127) return;
		var vol = X.I8(p+0x84); if(vol < 0 && -vol > trk) return;
		if(!len) susv++; if(!vol) susv++;
		var osc = X.U8(p+0x85); if(osc > 3) return; if(osc < 3 && !note) susv++;
		var dtn = X.I8(p+0x86); if(note > 0 && note+dtn <= 0) return;  if(dtn < -32 || dtn > 64) susv++;
		var atk = X.U8(p+0x87), dcy = X.U8(p+0x88), sus = X.U8(p+0x89);
		if(dcy < atk || sus < dcy || sus > 127 || atk > 127 || sus > 127) return;
		if(!atk && !dcy && !sus) susv++;
		var cut = X.I8(p+0x8A); if(cut < 0 && -cut > trk) return;
		var res = X.I8(p+0x8C); if(res < 0 && -res > trk) return;
		var dly = X.U8(p+0x8D), rep = X.U8(p+0x8E), damp = X.U8(p+0x8F);
		if(dly > 127 || rep > 127 || damp > 127) return;
		var lvwrap = X.I8(p+0x90);
		if(lvwrap < 0 && lvwrap > trk) return;
		var lvhard = X.I8(p+0x91);
		if(lvhard < 0 && lvhard > trk) return;
		var comprlo = X.U8(p+0x92), comprhi = X.U8(p+0x93);
		if((comprlo > 127 || comprhi > 127) || (!comprhi && comprlo)
			|| (comprhi && comprhi <= comprlo)) return;
		var pan = X.I8(p+0x94); if(pan > 118) return; // funny—looks like an input filter typo, ah well
		var fltfreq = X.I8(p+0x95), fltres = X.I8(p+0x97); //frqmod @ +0x96
		if((fltfreq < 0 && -fltfreq > trk) || (fltres < 0 && -fltres > trk)) return;
	}
	if(susv > ins*3) { if(debug>0)_logIt("too suspicious"); return }
	for(i = 0x4C04; i < 0x5084; i++) if(X.U8(i) > 127) return; // testing patterns
	for(i = 0x5084; i < 0x7084; i++) //testing tracks... orderlists? all 64 of'em
		if(X.U8(i) > ptn) { if(debug>0)_logIt("@"+Hex(i)); return }
	if(!isAllZeroes(0x7084,0x2000)) return;
	return true
}
if(!bDetected && X.isDeepScan() && isBuzzic11()) {
	sName = "Buzzic module (.BUZ)"; sVersion = 'v1.1'; bDetected = 1;
	sOption('trk:'+trk+' ord:'+ord+(start?' (from '+start+')':'')+' ptn:'+ptn+' ins:'+ins
		+' bpm:'+bpm+' gvol:'+gvol+' sz:45224')
}


function isMXDRV() {
	// fmt https://www.vector.co.jp/download/file/dos/art/fh003454.html / DOC/MDXFORM.DOC
	// ref ditto / SRC/MDX2MUS.ASM
	// useful links: https://gorry.haun.org/mx/index_e.html
function re(p,t) { if(debug>-1)_l2r('mdx',p,t); return false }
//detection starts from here
	if(X.Sz() < 4+2+9*2+9*2) return false; //0d0a1a+00, vd ptr, chn ptrs, f100 f100....
	da1 = X.fSig(0,Math.min(0x400,X.Sz()),"0D0A1A"); //the longest title I saw was that long
	if(da1 < 0) return false;
	crypt = X.c("00'crypt'",da1-6);
	sus = crypt? -10: 0;
	for(i = 0; i < da1; i++) if(X.U8(i) < 0x20 && [0,9,0x1B,0xA,0x1A].indexOf(X.U8(i)) < 0) return false;
	title = X.SC(0,da1,'SJIS');
	p = X.fSig(da1+3,Math.min(15,X.Sz()-da1),"00"); if(p < 0) return false;
	if(da1+3 != p)
		pdxfn = X.SC(da1+3,p,'SJIS');
	else pdxfn = "";
	p++; ofs = p; bad = '';

	comp = false; ch = 9;
	if(X.SA(ofs+4,4) == "LZX "&& (lzxsz = X.U32(ofs+0x12,_BE))) {
		comp = true;
		sz = X.fSig(ofs+0x16,TOEOF,"'[ LZX.X ]'0D0A0000")+13;
		if(sz < 13) bad = bad.addIfNone('!short'); usedch = ch; bpm0 = notes = vdn = 0;
//re(ofs,"←ofs, lzxsz = "+lzxsz+" sz="+Hex(sz));
		return true; // stop right there because omg no
	}

	if(crypt) vd = -1;
	else {
		vd = X.U16(ofs,_BE)+ofs;
		if(vd > X.Sz()) { vd = -1; sus++ }
		//the bytes before voicedata (OPM voices, instruments) will be the F1 command (stop playback),
		//UNLESS, for example, you're Dig Dug2/dd2-10.mdx which is 84k long and the ins ptr just can't reach there
		//It still plays, so we have to accept this mockery, but we're holding a grudge...
		if(X.U8(vd-2) != 0xF1 && X.U8(vd-3) != 0xF1) { vd = -1; sus++ }
//re(vd,'vd')
		p += 2;
	}
	if(!X.c("0014",p) && !X.c("0022",p)) return false;
	m = Math.min(0xFFFFF,X.Sz()-2); //dd2-10.mdx is larger than it'd be allowed but still plays
	if(crypt) {
		sz = X.fSig(ofs+20,m,"'protected by cryptmdx v1.00 (c)1995 H.Yano'00")+0x2B;
		usedch = ch; bpm0 = 0; return true
	}
	var chn0 = chn = oldchn = X.U16(p,_BE)+ofs; //we begin with mml data 0 ptr, stored as offset from post-info point 
	if(!isWithin(chn,p,m)) return re(chn,'!chn'+Hex(p)+'-'+Hex(m)); // it shouldn't point at EoF-ish nor to 0 or 1
	ch = (chn-ofs-2)/2; //0x14 or 0x22, ie. either 9 or 16
	usedch = [0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0]; notes = vdn = mp = 0; vds = []; bpm0 = -1;
	var q = -1, lp = [], v = [0,1]; // v is for registering the presence of expected commands across the file; all must be 1
	if(X.isDeepScan()) { visited = []; for(i=0; i < m; i++) visited[i] = 0 } // to keep looping in check

	for(k=1; k <= ch; k++) { //check the rest of channels
		p += 2;
//re(p,'--= Parsing ch'+k+'/'+ch+' =--');
		if(p > mp) mp = p;
		if(k == ch) if(isWithin(vd, oldchn+2,X.Sz())) chn = vd; else chn = m;
		else {
			chn = X.U16(p,_BE)+ofs;
			if(!isWithin(chn,oldchn+2,m) || (X.U8(chn-2) != 0xF1 && X.U8(chn-3) != 0xF1)) {
//re(chn,'DEBUG2:'+Hex(X.U24(chn-3,_BE))+' ch'+ch);
				chn = oldchn; usedch[k-1] = false;
			}
			if(!isWithin(chn,oldchn+2,m)) { re(chn,'!p='+Hex(p)+',ch['+k+'] not between '+Hex(oldchn+2)+' and '+Hex(m)); sus += 2 }
			if(X.U8(chn-2) != 0xF1 && X.U8(chn-3) != 0xF1) {
				bad = bad.addIfNone('!badchnend@'+Hex(chn-2)+'='+Hex(X.U24(chn-3,_BE))); if(!X.isDeepScan()) sus++
			}
		}
		clk = 0; var cnotes = 0;

		if(X.isDeepScan()) for(q=oldchn,stop=false; !stop && q != chn && q < m; ) {

//_log(''+Hex(q)+' >> '+MDXCmdStr(k-1,q)); // !! the heavy logger of music data here. Much fun, much debug info

			visited[q] = 1; if(q > mp) mp = q;
			var c = X.U8(q++);
			if(c < 0x80) clk += c+1; //rest
			else if(c <= 0xDF) { cnotes++; notes++; usedch[k-1] = true; clk += X.U8(q++)+1 } //note or sample
			else switch(c) { //MMLscript
			case 0xFF: if(bpm0 < 0) bpm0 = X.U8(q); q++; break; //tempo0 (t)
			case 0xFE: a = X.U8(q); b = X.U8(q+1);//OPM reg set: reg and data
				if(!isYM2151Reg()) { sus++; bad = bad.addIfNone('!OPMreg@'+Hex(q-2)) }
				else if(a == 8 && (b&0xC8)) { cnotes++; notes++; usedch[b&7] = true }
				else if(isWithin(a, 0x60,0x7F)) v[0] = true;
				q += 2; break;
			case 0xFD: t = X.U8(q++); if(vds.indexOf(t) < 0) vds.push(t); break; //vd selection (@)
			case 0xFC: q++; break; //pan
			case 0xFB: t = X.U8(q++); if(isWithin(t,0x16,0x7F)) { bad = bad.addIfNone('!FB@'+Hex(q-2)+'='+Hex(t)); sus++ } v[0] = 1;
			break; //volume (v or @v)
			case 0xFA: case 0xF9: case 0xF7: case 0xEE: case 0xE8: break; //vmin, vmax, let ring, PCM8wide, syncwait, useful4Ach-head
			case 0xF8: t = X.U8(q++);
				if(!t/* || isWithin(t,9,0x7f)*/) {  bad = bad.addIfNone('!F8@'+Hex(q-1)); sus++ } break; //snd len (q or @q)
			case 0xF6: if(X.U8(q+1)) q++; else q += 2; break; //repeat start: num, 00 (apparently not always present)
			case 0xF5:
				if(X.U8(q+X.I16(q,_BE)-1) != 0xF6) { bad = bad.addIfNone('!F5→F6@'+Hex(q)); sus++ }
				q += 2; break; //repeat end: ofs to repstart+2
			case 0xF4:
				if(X.U8(q+X.I16(q,_BE)+1) != 0xF5) { bad = bad.addIfNone('!F4→F5@'+Hex(q)); sus++ }
				q += 2; break; //repeat stop: ofs to repend+1
			case 0xF3: q += 2; break; //detune (D)
			case 0xF2: q += 2; break; //portamento (_)
			case 0xF1: //endplay (optionally loopptr)
				//we'll stop here, ignoring possible unused music data that may follow past it,
				//because some files, like dd2-00.mdx, use the space BETWEEN channels to store unrelated data... 
				if(X.U8(q)) {
					lp[k] = q+2+X.I16(q,_BE);
					//normally, the loop is the channel's end but dd1-*.mdx are using F1 like jmp $+...
					//if(!isWithin(lp[k],oldchn,chn)) {
					if(!isWithin(lp[k],chn0,m)) { bad = bad.addIfNone('!loopOOB@'+Hex(q-1)); sus++ }
					if(visited[lp[k]]) { stop = true; q += 2 } else q = lp[k];
				} else q++;
				if(vd > 0 && vd < q) vd = q;
				 break;
			case 0xF0: q++; break; // key-on delay (k)
			case 0xEF: q++; break; //send sync to channel #
			case 0xED: q++; break; //ADPCM/noisewave#, H or P(f command)
			case 0xEC: case 0xEB: case 0xEA: t = X.U8(q++); //LFO ctl for 音程, 音量. OPMLFO ctl
				if(t != 0x80 && t != 0x81) q += 4; break;
			case 0xE9: q++; break; //LFO delay (MD)
			case 0xE7: if(X.U8(q) != 1) { bad = bad.addIfNone('!E7@'+Hex(q-1)); sus++ } q += 2; break //fadeout: 01, spd ($FO)
			default: stop = true; bad = bad.addIfNone('!unk'+Hex(c)); sus++ //unknown commands do stop-play
			}
			if(q > mp) mp = q;
		} // /if isDeepScan scan the channel
		if(cnotes) usedch[k-1] =  true;
//re(oldchn,'ch'+(k-1)+' stopped @'+Hex(q)+', has '+Hex(chn-oldchn)+' data ...'+Hex(X.U24(chn-3,_BE))+']')
//re(q,'ch'+(k-1)+' v:'+v.join('')+' clk:'+clk+' ... cmd:'+Hex(c))
		oldchn = chn;
		if(sus > 8) return re(mp,sus+' '+bad);
	} // /for k=1; k<=ch
	if(X.isDeepScan() && v[0] != '1') { bad = bad.addIfNone('!novol'); sus++ }
	if(sus > 8) return re(mp,sus+' '+bad);
	if(vd > 0 && vd < chn) { bad = bad.addIfNone('!ins@'+Hex(vd)+'<chn@'+Hex(chn)); sus++ }

	if(X.isDeepScan()) {
		vdn = vds.length;
		vds.sort(function(a,b){return a-b});
		var vdsavl = []; m = Math.min(X.Sz(), vd+0x1B00);
//re(vd+vdn*27,'vd used:'+outArray(vds,16))
		for(p=(vd > 0 && vd < chn)?chn:(vd > 0)?vd:p; vds.length && p < m; p+=0x1B) {
			if(!vds.length) break; //found all the instruments we used
			if(!(X.U8(p+1)&0xC0) && !(X.U8(p+2)&0xF0) //test for empty bytes at FL&CON and slot mask
			  && vdsavl.indexOf(t=X.U8(p)) < 0) //a new instrument found
				vdsavl.push(t);
			else break; //test for dupes
			vds = vds.filter(function(a,b,c){return a!=X.U8(p)}); //remove the matching element from the used vd list
			if(p > mp) mp = p;
		}
		vdsavl.sort(function(a,b){return a-b});
//re(p,'vdfound:'+outArray(vdsavl,16))
		if(vds.length) bad += '!missingInst'+outArray(vds,16);
		sz = mp+27;
	}
	sz = X.isDeepScan()? mp: -1; if(vd == X.Sz()) sz = vd;
	return true;
}
if(!bDetected && isMXDRV()) {
	sName = "Konami's X68k Music Data eXtended module (.MDX)"; bDetected = 1;
	if(pdxfn != "") sVersion = sVersion.appendS('+ '+pdxfn,' ');
	if(ch > 9) sVersion += "#EX-PCM";
	if(comp) sVersion = sVersion.appendS('compressed','/');
	if(crypt) sVersion = sVersion.appendS('cryptmdx','/');
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad+(sus?'/sus'+sus:''),'/');
	if(X.isVerbose()) {
		sOption(addEllipsis(title),'"','"');
		for(ch=0,i=0; i < 16; i++) if(usedch[i]) ch++;
		if(!crypt) sOption('ch:'+ch+' bpm0:'+(bpm0 < 0?'default':bpm0)
			+(notes? ' notes:'+notes: '')+(vdn? ' ins:'+vdn: '')+(sz > 0? ' sz:'+outSz(sz): ''));
		else sOption('sz:'+outSz(sz))
	}
}


function isFredF() {
	//ref https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/Players/Fred/FredWorker.cs
	var p = modp = ofsdiff = 0; bad = '';
	function _check0() {
		if(X.Sz() < 0xB0E) return false; if(!X.c("4EFA....4EFA....4EFA....4EFA")) return false;
		p = X.I16(2,_BE)+2; if(p <= 0x10 || p%2) return false;
		// The init routine just has 2 variants it seems, the second I only found in furball*.fred.
		// Maybe out in the wild there are more but:
		if(!X.c("123A.... B0016200 007E47FA 08761680 45FA0873 49FA086E D5C01892 E7887E03 7C0041FA 08D8",p)
		  && !X.c("42380001 123A.... B0016200 007E47FA 08B61680 45FA08B3 49FA08AE D5C01892 E7887E03 7C0041FA 0918",p))
			return false;
		// and this is as-is from NP. Not sure why this specific way of looking for it
		for(i=0; i < 4; i++) if(X.c("123A....B001",p+i*2)) { modp = p+i*2+1+X.I16(p+i*2+2,_BE); break }
		if(i == 4 || modp > X.Sz()) return false;
		for(; i < 60; i++) if(X.c("47FA....D7FA",p+i*2)) { ofsdiff = p+(i+1)*2+X.I16(p+i*2+2,_BE); return true }
		return false
	}
	if(!_check0()) return false;  p = modp+1; x = X.U8(p++)+1; if(x > 10) return false;  spd0 = X.U8(p++);
	spds = []; for(i=0; i < 10; i++) { t = X.U8(p++); if(spds.indexOf(t) < 0) spds.push(t) } p++;
	var insp = ofsdiff+X.U32(p,_BE), trkp = ofsdiff+X.U32(p+4,_BE), ptnsz = Math.abs(insp-trkp);
	// subsong start pos per voice init and read
	var stpt = [], ordt = [], trkt = [], trks = []; for(i=0,ord=[],p+=0x26C/*replay data*/; i < x; i++) { stpt[i] = [0,0,0,0]; ord[i] = 0 }
//_l2r('frf',p,'starts')
	for(i=0; i < x; i++) for(j=0; j < 4 && p < X.Sz(); j++,p+=2) stpt[i][j] = (X.U16(p,_BE) - x*8) >> 1;
//_l2r('frf',p,' -> '+outArray(stpt,16))
	if(p > X.Sz()) return false; ordp = p;
	for(otsz=(Math.min(insp,trkp)-p)>>1,i=0; i < otsz; i++,p+=2) ordt.push(X.I16(p,_BE));
	trksz = Math.abs(insp-trkp);
	for(i=tr=0; i < trksz; tr++) { // for checking ofs in the orderlist
		for(si=i; X.U8(p+(i++)) != 0x80 && i != trksz && p+i < X.Sz();){}
		if(i == trksz && X.U8(p+i-1) != 0x80) break;
		trkt[si] = tr
	}
	for(i=0; i < x && p < X.Sz(); i++) {
		for(j=0; j < 4 && p < X.Sz(); j++) {
			for(on=true,c=stpt[i][j]; c - stpt[i][j] < 0xFF && ordt[c] >= 0; c++)
				if(typeof trkt[ordt[c]] == 'undefined') return false;
		}
	} 
	for(syn=smp=0,msmpp=0x7fffffff,Msmpp=smpe=0,p=insp;;) {
		var smpp = X.U32(p,_BE), tsyn = X.I16(p+4,_BE), ssz = X.U16(p+6,_BE) << 1;
		var tins = X.U8(p+0x27); if(p+0x28 >= X.Sz() || p+0x3F >= msmpp) break;
		if(tins != 0xFF)
			if(smpp) {
				smpp += ofsdiff; if(smpp > X.Sz()) break;
				if(smpp < msmpp) msmpp = smpp;
				if(smpp > Msmpp && smpp < X.Sz()) { Msmpp = smpp; smpe = smpp+ssz } smp++
			} else {
				if(tsyn === -779) /* giants-1.fred fix*/ break;  if(tsyn != -1 && tins != 0) return false;  syn++
			}
		p += 0x40;
	}
	if(smp) sz = smpe; else sz = p;
	return true
}
if(!bDetected && isFredF()) {
	sName = "Fred & Julien Clermonte's Fred Editor module (.FRED,.FRD)"; sVersion = 'final'; bDetected = 1;
	if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption('tempo:'+spds.sort().join('-')+(smp?' smp:'+smp:'')+(syn?' syn:'+syn:'')+' sz:'+outSz(sz))
	}
}


function isDSMIAMF() {
	// ref https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_amf.cpp
	if(!X.c("'AMF'")) return false; var v = X.U8(3);
	if(v != 1 && !isWithin(v, 8, 0xE)) return false;
	if(v < 9) p = 4; else p = 0x24;
	smp = X.U8(p); ord = X.U8(p+1); trk = X.U16(p+2); ch = v >= 9? X.U8(p+4): 16;
	if(!smp || !ord || !trk) return false;  if(v >= 9) p += 5; else p += 4;
	if(v < 12 && !isWithin(ch,1,16)) return false;  if(!isWithin(ch,1,32)) return false;
	var rc = v >= 11? (v >= 12? 32: 16): v >= 9? 16: 0;
	p += rc;
	if(v >= 13) { tmp0 = X.U8(p++); if(tmp0 < 32) tmp0 = 125; spd0 = X.U8(p++) } else { tmp0 = 125; spd0 = 6 }
	var ptnsz = 0, psz = [], trkp = p; if(v >= 14) trkp += 2;
	for(i=0; i < ord; i++) { if(v >= 14) { psz[ord] = X.U16(p); ptnsz += X.U16(p); p += 2 } p += ch*2 }
	var truncshd = false;
	if(v == 10) {
		var s = p; for(i=0; i < smp; i++) {
			if(s+65 < X.Sz()) if(X.U8(s) > 1 || X.U32(s+46) > smp || (ssz=X.U32(s+50)) > 0x100000
			  || X.U8(s+56) > 0x40 || X.U32(s+57) > ssz || X.U32(s+61) > ssz)
				{ truncshd = true; break } else s += 65;
		}
	}
	smps = []; var smpsz = 0; rsmp = 0;
	for(i=0; i < smp; i++) {
		t = X.SC(p+1,0x20,'CP437').trim(); if(t.length) smps.push(t);
		if(v < 10) { smpsz += (t=X.U16(p+50)); if(t) rsmp++; p += 59 }
		else { smpsz += (t=X.U32(p+50)); if(t) rsmp++; p += (truncshd? 59: 65) }
	}
	trkc = 0; for(i=0; i < trk; i++) { t = X.U16(p); p += 2; if(t > trkc) trkc = t }
	for(i=0; i < trkc; i++) { t = X.U16(p); p += 3; if(t) p += t*3+ (v==1? 3: 0) }
	sz = p+smpsz;
	return true
}
if(!bDetected && isDSMIAMF()) {
	sName = "Digital Sound and Music Interface Advanced Music Format module (.AMF)";
	sVersion = "v"+X.U8(3); bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(X.SC(4,32,'CP437'));
		sOption(addEllipsis(smps.join(' '),0xA0),'smp/msg:"','"');
		sOption('ch:'+ch+' spd0:'+spd0+' tmp0:'+tmp0+' ord:'+ord+' trk:'+(trkc != trk?trkc+'/':'')+trk
			+' smp:'+(rsmp==smp?'':rsmp+'/')+smp+' sz:'+outSz(sz))
	}
}


function isSAdT() {
	//the signature's good enough but there also are sanity checks
	//ref https://github.com/adplug/adplug/blob/master/src/sa2.cpp
	if(!X.c("'SAdT'") || !isWithin(nV=X.U8(4),1,9)) return false;
	const hasArpList = 0x80, hasV7Ptn = 0x40, hasActCh = 0x20, hasTrkOrd = 0x10,
		hasArp = 8, hasOldBPM = 4, hasOldPtn = 2, hasUnk127 = 1; var notedis=0, fl;
	switch(nV) {
	case 1: notedis = 0x18; fl = hasUnk127 | hasOldPtn | hasOldBPM; break;
	case 2: notedis = 0x18; fl = hasOldPtn | hasOldBPM; break;
	case 3: notedis = 0xC; fl = hasOldPtn | hasOldBPM; break;
	case 4: notedis = 0xC; fl = hasArp | hasOldPtn | hasOldBPM; break;
	case 5: notedis = 0xC; //fallthru
	case 6: fl = hasArp | hasArpList | hasOldPtn | hasOldBPM; break;
	case 7: fl = hasArp | hasArpList | hasV7Ptn; break;
	case 8: fl = hasArp | hasArpList | hasTrkOrd; break;
	case 9: fl = hasArp | hasArpList | hasTrkOrd | hasActCh
	}
	p = 5 + 31*(fl & hasArp? 15: 11);
	for(i=0,inst=[]; i < 29; i++) { if((t=X.SC(p+1,X.U8(p),'CP437').trim()) != '') inst.push(t); p += 0x11 }
	p += 3; var orderlist = X.readBytes(p,128); p += 128;
	if(fl & hasUnk127) p += 0x7F;
	if(!isWithin(ptn=X.U16(p),1,64)) return false; p += 2;
	if(!isWithin(ord=X.U8(p++),1,0x80)) return false;
	for(i=rptn=0; i < ord; i++) if((orderlist[i]+1) > rptn) rptn = orderlist[i]+1;  delete orderlist;
	if(rptn > ptn || (lp=X.U8(p++)) >= ord) return false;
	bpm = X.U16(p); p += 2; if(fl & hasOldBPM) bpm = bpm*5/2;
	if(fl & hasArpList) p += 0x200; if(fl & hasTrkOrd) p += 9*0x40;
	if(fl & hasActCh) { actch = X.U16(p) << 16; p += 2 } else actch = -1;
	trk = 0;
	if(fl & hasOldPtn) while(trk < ptn && p < X.Sz()) { p += 64*9*5; trk++ }
	else if(fl & hasV7Ptn) while(trk < ptn && p < X.Sz()) { p += 64*9*3; trk++ }
	else while(trk < 64*9 && p < X.Sz()) { p += 64*3; trk++ }
	sz = p;
	return true
}
if(!bDetected && isSAdT()) {
	if(nV < 8) sName = "Surprise! AdLib Tracker module (.SAT)";
	else sName = "Surprise! AdLib Tracker 2 module (.SA2)";
	sVersion = "v"+nV; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(addEllipsis(inst.join(" "),0xA0),'ins/msg:"','"');
		sOption('bpm:'+bpm+(actch>=0?'ch:'+actch:'')
			+' ord:'+(lp?lp+'-':'')+ord+' ptn:'+(rptn!=ptn?rptn+'/':'')+ptn+(trk!=ptn?' trk:'+trk:'')+' sz:'+outSz(sz))
	}
}


/*function isTFMX() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/TFMX/src/TFMX_v4.asm
	if(!X.c("'TFMX'")) return false;
	if(X.U8(4) !== 0x20) {
		if(!X.c("'-SONG '",4)) return false;
		if(!X.c("'by'",10))
			if(!X.c("'(Empty) '",0x10) && X.U8(0x10) !== 0x20 && !X.c("'0='",0x10)) return false;
	}
	if(X.U32(0x1D0)) { _l2r('tfmx',0x1d0,'dw non-zero'); return false }
	if(X.c("0E60",14)) return false;
	if(X.c("0860",14) && !X.c("090C",0x1224)) return false;
	if(X.c("0920",14) && !X.c("9305",0xF24)) return false;
	if((a0=X.I32(0x600,_BE)) <= 0 || (a0&1)) return false;
	if((a1=X.I32(0x7FC,_BE)) <= 0 || (a1&1)) return false; if(a1 > X.Sz()) a1 = X.Sz();
	for(; a0 < a1; a0 += 4) if(X.U8(a0) > 0x24) return false;

	for(i=0, x=1, d5=0x1F; 0x148+i <= X.Sz();) {
		d2 = X.U16(0x142+i,_BE); d3 = X.U16(0x144+i,_BE); if(d2 == d3 && d3 == X.U16(0x146+i,_BE)) break;
		d5--; i += 2; x++; if(x == 0x20) break;
	}
	if(x != 0x20) for(;d5; i += 2,d5--) if(X.U16(0x142+i,_BE)-X.U16(0x102+i,_BE)) x++;
	sz = 0x7FC;
	while(!X.c("07000000",sz) && sz < X.Sz()) sz += 4;
	bad = ''; if(sz >= X.Sz()) bad = bad.addIfNone('!short'); sz += 4;
	return true
}
if(!bDetected && isTFMX()) {
	sName = "Chris Hülsbeck's The Final Musicsystem eXtended module (MDAT.+SMPL.)";
	// sVersion = 'v1.5';
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×')
		sOption('sz:'+outSz(sz))
	}
}

function isTFMX_7V() {
	//from reversing the eagleplayer
	if(!X.c("'TFMX-SONG '")) return false;
	if(!(d1=X.U32(0x1D0,_BE))) d1 = 0x800; var found = false;
	if(X.c("08B0",14)) if(X.c("01F4FF00",0x204)) found = true;
	if(!found) for(i=0,a1=0x100; !found && i < 0x20; i++) {
		t = X.U16(a1,_BE); a1 += 2; if(t == 0x1FF) continue;
		t <<= 4; t += d1; a2 = t; if(t > X.Sz()) return false;
		for(; !found && a2 < X.Sz(); ) {
			var effe = X.c("EFFE",a2); a2 += 2;
			if(effe) {
				var is3 = X.c("0003",a2); a2 += 2;
				if(is3)
					if(X.U16(a2,_BE))
						if(X.U8(a2) || !X.U8(a2+3)) { found = true; break }
				a2 += 12
			}
		}
	}
	if(!found) return false
	return true
}
if(!bDetected && isTFMX_7V()) {
	sName = "Chris Hülsbeck's The Final Musicsystem eXtended module (MDAT.,+SMPL.)";
	sVersion = '7V'
}

function isTFMX_ST() {
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/TFMX_ST/TFMX%20ST_v1.asm
	if(!X.c("'TFMX-SONG '")) return false;
	if(d1=X.U32(0x1D0,_BE)) if(X.U16(12,_BE)) return false;
	if(d2=X.U32(0x1D4,_BE)) d1 = X.U32(0x1D8,_BE);
	else {
		if((d1=X.I32(0x600,_BE)) <= 0 || (d1&1)) return false;
		if((d2=X.I32(0x7FC,_BE)) <= 0 || (d2&1)) return false;
	}
	d2 = Math.min(d2,X.Sz()); smp = st = 0;
	for(; d1 < d2; d1 += 4)
		if(X.U8(d1) == 0x48) smp++; else if(X.U8(d1) > 0x3F) st++;
	if(!st) return false;
sz=-5;
	// for(i=0, x=1, d5=0x1F; 0x148+i <= X.Sz();) {
	// 	d2 = X.U16(0x142+i,_BE); d3 = X.U16(0x144+i,_BE); if(d2 == d3 && d3 == X.U16(0x146+i,_BE)) break;
	// 	d5--; i += 2; x++; if(x == 0x20) break;
	// }
	// if(x != 0x20) for(;d5; i += 2,d5--) if(X.U16(0x142+i,_BE)-X.U16(0x102+i,_BE)) x++;

	bad = ''; if(sz >= X.Sz()) bad = bad.addIfNone('!short'); sz += 4;
	return true
}
if(!bDetected && isTFMX_ST()) {
	sName = "Chris Hülsbeck's The Final Musicsystem eXtended module ST module (MDST.+SMPL.)";
	if(X.isVerbose()) {
		sOption('smp:'+smp)
	}
}
*/

function isTFMX() {
	//from https://github.com/neumatho/NostalgicPlayer/blob/main/Source/Agents/Players/Tfmx/TfmxWorker.cs / TestModule, Load
	if(X.Sz() < 0x200) return false;
	var hdrsz = tp = mdatsz = smplsz = -1, p0 = 0, maxlen = 0x30000;
	title = album = by = ''; flag5 = -1; tfmxst = false;
	function isStFile(p0) {
		var stidx, edidx = X.U32(p0+0x1D4,_BE);
		if(!edidx) { stidx = X.U32(p0+0x600,_BE); edidx = X.U32(p0+0x7FC,_BE) }
		else { stidx = X.U32(p0+0x1D8,_BE); stidx = X.U32(p0+stidx,_BE) }
		var i, buf = X.readBytes(p0+stidx, edidx-stidx); for(i=0; i < buf.length; i+=4) if(isWithin(buf[i],0x40,0x7F)) return true;
		return false
	}
	if(X.c("'TFMX-MOD'")) { // a PC-originating module wrapper format???
		hdrsz = p0 = 0x14; sz = X.U32(12,_LE); smplsz = sz-X.U32(8,_LE); mdatsz = X.U32(8,_LE)-8;
		if(!mdatsz || !isWithin(sz, 0x212, X.Sz())) return false;
		for(; sz < X.Sz();) {
			t = X.U8(sz); var tagsz = X.U16(sz+1,_LE);
//_l2r('tfmx',sz,'MOD: tag#'+t+' sz:'+tagsz)
			sz += 3; if(!t && !tagsz) break;
			switch(t) {
			case 1: by = X.SC(sz,tagsz,"CP1252"); break;
			case 2: album = X.SC(sz,tagsz,"CP1252"); break;
			case 5: flag5 = X.U8(sz); break;
			case 6: title = X.SC(sz,tagsz,"CP1252"); break;
			}
			if(!t) { sz += 17; break } else sz += tagsz
		}
	}
	if(X.c("'TFHD'")) {
		hdrsz = X.U32(4,_BE); tp = X.U8(8); v = X.U8(9); mdatsz = X.U32(10,_BE); smplsz = X.U32(14,_BE);
		sz = hdrsz+mdatsz+smplsz; if(hdrsz < 18 || !mdatsz || !isWithin(sz, 0x212, X.Sz())) return false;
		if((tp&0x80) || !(tp&0x7F)) p0 = p = hdrsz; else
		switch(tp&0x7F) { case 1: tp = '1.5'; break; case 2: tp = 'pro'; break; case 3: tp = '7v'; break; default: return false }
	} else if(X.c("'TFMX '",p0) && !X.c("'SONG'",p0+5)) tp = '1.5';
		else if(X.c("'TFMX-SONG'",p0) || X.c("'TFMX_SONG'",p0) || X.c("'tfmxsong'",p0)) { //pro or 7v?
			//check the trackstep (info for sequencing and mastering)
			var tm = 0, gottms = false, stp = X.readBytes(p0+0x100,31), trksp = X.U32(p0+0x1D0,_BE); if(!trksp) trksp = 0x800;
			for(i=0; i < 31; i++) {
				var getNext = true, pos = stp[i]; if(pos == 0x1FF) break;
				while(getNext && p < X.Sz()) {
					p = p0+trksp+pos*16; t = X.U16(p,_BE); cmd = X.U16(p+2,_BE); p += 4;
					if(t != 0xEFFE) getNext = false;  else switch(cmd) {
					case 1: //loop a section
						if(!tm) { tm = -1; pos++ } else
							if(tm < 0) { pos = X.U16(p,_BE); tm = X.I16(p+2,_BE)-1; p += 4 }
							else { tm--; pos = X.U16(p,_BE); p += 2 }
						break;
					case 2: case 4: pos++; break; //set tempo + start master vol slide
					case 3: gottms = true; pos++; break; //start master vol slide too
					default: getNext = gottms = false
					}
				}
				if(gottms) break
			}
			if(isStFile()) return false;
			else { tfmxst = true; if(gottms) tp = '7v'; else tp = 'pro' }
		} else return false;
	for(i=0,p=p0+0x10,cmt=''; i < 6; i++,p += 40) cmt = cmt.appendS(decAnsi(p,40,CPAmiga).trim(),'  '); //F0 bytes cmt
	cmt = cmt.trim();
_l2r('tfmxcmt',p0+0x10,decAnsi(p,40*6,CPAmiga).trim())
	var sst = [], sed = [], tmp = [];
	for(i=0; i < 0x20; i++) { sst.push(X.I16(p,_BE)); p += 2 }
	for(i=0; i < 0x20; i++) { sed.push(X.I16(p,_BE)); p += 2 }
	for(i=0; i < 0x20; i++) { tmp.push(X.I16(p,_BE)); p += 2 }
	p += 0x10; // after the st/ed/tmp reads + 20 it's gonna be +60+80 = +E0 post-cmt
	var trkp = X.I32(p,_BE), ptnp = X.I32(p+4,_BE), insp = X.I32(p+8,_BE);
	if(!ptnp) ptnp = 0x200; else ptnp -= 0x200;
	if(!insp) insp = 0x400; else insp -= 0x200;
	if(!trkp) trkp = 0x600; else trkp -= 0x200;
	p += 0x30; if(p > X.Sz()) return false;  var datap = p, maxlen = Math.min(maxlen+datap,X.Sz());
	ptnp += datap; insp += datap; trkp += datap;
	if(hdrsz > 0) len = mdatsz; else len = Math.min(maxlen,X.Sz())-p;
	for(ins=mip=0,p=insp,ino=X.I32(p,_BE); ins < 0x100 && p+4 <= X.Sz(); ins++,p+=4) {
		t = X.I32(p,_BE)-0x200+datap;
		if((t & 3) || !isWithin(t,trkp,maxlen)
			|| (t & !X.c("F0000000",t-4) && !X.c("07000000",t-4)) || (ins && Math.abs(t-ino) > 0x2000)) break;
		// 07000000 is the end-of-data command,
		// F0000000 is the end pattern command (may happen because data may be mixed.
		// 2000h is an empirically appropriate max size of a record, should be good enough to deter FPs either way
		if(mip < t) mip = t;  if(ins) ino = t }
	ptn = Math.min((insp-ptnp)>>2, 128); var lg = X.U32(ptnp,_BE)-0x200+datap;
	pt = ptn; trkst = (lg - trkp) >> 4; if(trkst < 0) trkst = 0;
	if(hdrsz < 0)
		switch(Math.max(insp,ptnp,mip)) { //what's the file ending with? inst.ptr table, ptn.ptr table, instruments?
		case insp:  sz = insp+ins*4; break;
		case mip:
//_l2r('tfmx',mip,'tracing last instrument rec')
			for(p=mip; p < maxlen; p += 4) if(X.c("07000000",p)) break;  sz = p; if(sz < maxlen) sz += 4;
			break;
		case ptnp: //need to parse the pattern table to find out where it should end
_l2r('tfmx',datap,'p:'+Hex(p)+' ptnp:'+Hex(ptnp)+' insp:'+Hex(insp)+' trkp:'+Hex(trkp)+' trkst['+Hex(ptnp)+'='+Hex(lg)+']:'+Hex(trkst)+' len:'+Hex(len)+'/'+Hex(maxlen))
	 		for(p=ptnp+4,po=X.I32(ptnp,_BE),pt=1; pt < 0x100; p += 4,pt++) {
				t = X.I32(p,_BE)-0x200+datap;
//_l2r('tfmx',p,'ptn['+Hex(pt)+'] ptr:'+Hex(t)+'; '+((t&3)?'X':'O')+(!X.c("F0000000",t-4) && !X.c("07000000",t-4)? 'X':'O')+Hex(Math.abs(t-po))  )
 				if((t & 3) || !isWithin(t,trkp,maxlen)
 					|| (!X.c("F0000000",t-4) && !X.c("07000000",t-4)) || Math.abs(t-po) > 0x2000) break;
				po = t
 			}
			sz = p; break
	}
	x = -1; var max0s = 2; ord = [0];// there should be at least one, we all hope (empty files exist but who needs those)
	for(i=0; i < 32 && max0s > 0; i++) {
		x++; if(!sst[i]) max0s--; if(sst[i] == 0x1FF || sed[i] == 0x1FF) break;if(sst[i] <= trkst) ord[x] = sed[i]-sst[i]+1;
		if(sst[i] >= trkst) break; if(sst[i] == sed[i] && !sst[i] && !sst[i+1]) break;
	}
	if(!x) x = 1;
	return true
}
if(!bDetected && isTFMX()) {
	sName = "Chris Hülsbeck's The Final Musicsystem eXtended module (TFX.,.TFM,MDAT.+SMPL.,MDST.+SMPL.)";
	bDetected = 1;
	switch(tp) {
	case '1.5': sVersion = 'v1.5'; break;  case 'pro': sVersion = 'Professional'; break;  case '7v': sVersion = '7 voices'
	}
	if(tfmxst) sVersion = 'ST '+sVersion;
	if(pt < ptn) sVersion += '/malformed!badptn';
	if(X.isVerbose()) {
		sOptionT(title); if(x > 1) sOption(x,'×'); sOption(album,'in: '); sOptionT(by,'by: '); if(flag5 >= 0) sOption(flag5,'flag5:')
		if(cmt == '(Empty)') cmt = ''; sOption(addEllipsis(cmt,0xA0),'msg:"','"');
		sOption('ord:'+ord.join('+')+' ptn:'+ptn+(ptn!=pt? '/'+pt: '')+' ins:'+(ins>0x80? '128/': '')+ins+' sz:'+outSz(sz))
	}
}


function isThePlayer22to41() {
	//ref prowiz /r/TP22a.c & TP30a.c & TP40.c & TP41a.c
	if(!X.c("'P22A'") && !X.c("'P30A'") && !X.c("'P40A'") && !X.c("'P40B'") && !X.c("'P41A'")) return false;
	ptn = X.U8(4); smp = X.U8(6); volofs = (X.SA(1,3) == '41A')? 0x20: 0x22;
	if(ptn > 0x7F || !smp || smp > 0x1F) return false;
	for(i=0; i < smp; i++) {
		if(!isWithin(X.U16(volofs+i*16,_BE),1,0x40)) return false;
		if(volofs == 0x20 && X.U16(volofs+2+i*16,_BE) % 74) return false; //incorrect finetune in 4.1a
	}
	for(i=smpsz=0; i < smp; i++) {
		ssz = X.U16(24+i*16,_BE) << 1;
//_l2r('p2~4',24+i*16,'ssz['+i+'] = '+ssz);
		if(!ssz || ssz > 0xFFFE || (X.U16(30+i*16,_BE) << 1) > ssz+2) return false;
		smpsz += ssz
	}
	if(smpsz <= 4) return false;
	if(X.SA(1,1) < '4') ord = (X.U8(5)>>1)-1; else ord = X.U8(5);
	p = 0x10+smp*0x10;
	var trkp = X.U32(8,_BE), trktp = X.U32(0xC,_BE), smpp = X.U32(0x10,_BE), memofs = 0;
	if(p != trktp) { memofs = trktp-p; trkp -= memofs; trktp -= memofs; smpp -= memofs }
	if(!isWithin(trkp,p,X.Sz()) || !isWithin(trktp,p,X.Sz()) || !isWithin(smpp,p,X.Sz())) return false;
	for(i=p=0; i < smp; i++)
		if(volofs == 0x20 && X.U16(volofs+2+i*16,_BE) > 0x456) continue;
		else if((sp=X.U32(20+i*16,_BE)) > p) { p = sp-memofs; ssz = X.U16(24+i*16,_BE) }
	sz = 4+smpp+p+(ssz<<1);
	return true
}
if(!bDetected && isThePlayer22to41()) {
	sName = "Jarno 'Guru' Paananen's The Player module (."+X.SA(0,2)+'X,.'+X.SA(0,4)+')';
	sVersion = 'v'+X.SA(1,1)+'.'+X.SA(2,2); bDetected = 1;
	if(X.isVerbose()) {
		sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isThePlayer56X() {
	//from prowiz /r/TP50a.c & TP60a.c & TP61a.c
	if(X.Sz() < 7) return false;
	z = sig = X.c("'P50A'") || X.c("'P60A'") || X.c("'P61A'")? 4: 0;
	smpp = X.U16(z,_BE)+z; ptn = X.U8(z+2); if(!ptn || ptn > 0x7F) return false;
	smp = X.U8(z+3); if(smp & 0x20) return false;  pksmp = smp & 0x40; dtsmp = smp & 0x80; smp &= 0x3F;
	if(!smp || 7+smp*6 > X.Sz()) return false;
	if(pksmp) z += 4;
	if(smpp < z+4+smp*6+ptn*8 || smpp > X.Sz()) return false;
	smpsz = notes = 0; var unpsmpsz = vols = 0;
	for(i=0,p=z+4; i < smp; i++,p+=6) {
		if(isWithin(ssz=X.U16(p,_BE),0x8000,0xFFDF) || !ssz) return false;
		if(ssz > 0xFFDF && 0xFFFF-ssz > smp) return false;
		var spk = X.U8(p+2)&0x80, ft = X.U8(p+2)&0x7F;
		if(ft > 0xF || X.U8(p+3) > 0x40) return false; vols |= X.U8(p+3);
		if(isWithin(X.U16(p+4,_BE),ssz,0xFFFE)) return false; //lp
		if(ssz < 0xFF00) { smpsz += ssz << (spk? 0: 1); unpsmpsz += ssz << 1 }
	}
	if(!vols || (pksmp && X.U32(z,_BE) != unpsmpsz)) return false;
	for(i=0; i < ptn*4; i++) if(X.U16(z+4+smp*6,_BE)+4+z+smp*6+ptn*8 > smpp) return false;
	i = mptn = 0;
	function _5() {
		for(; (t=X.U8(z+4+smp*6+ptn*8+i)) != 0xFF && i < 0x80; i++) {
			if(t%2 || t > ptn*2) return false; if(t > mptn) mptn = t
		} mptn >>=1; return true
	}
	function _6() {
		for(; (t=X.U8(z+4+smp*6+ptn*8+i)) != 0xFF && i < 0x80; i++) {
			if(t > ptn-1) return false; if(t > mptn) mptn = t
		} return true
	}
	if(_6()) v = 6; else if(_5()) v = 5; else return false;
	if(/*z+4+smp*6+ptn*8+i > smpp ||*/ !i || i == 0x80) return false; ord = i; mptn++;
	function _is5060() {
		for(i=ord+z+5+smp*6+ptn*8; i < smpp; i++) {
			if((t=X.U8(i)) & 0x80) i += 3;
			else {
				if(t > 0x49 || (((t<<4)&0x10) | (X.U8(i+1)>>4)) > smp) return false;
				if(t >= 2) notes++; i += 2
			}
		}
		return (notes > 0)
	}
	function _is61() {
		for(i=ord+z+5+smp*6+ptn*8; i < smpp; i++) {
			if((t=X.U8(i)) == 0x7F) continue;
			else if(t == 0xFF)
				switch(X.U8(i+1) & 0xC0) {
				case 0: i++; continue;  case 0x40: i += 2; continue;
				case 0xC0: if(i < X.U16(i+2,_BE)-1) return false; i += 3; continue
				}
			switch(t & 0xF0) {
			case 0xF0: if((X.U8(i+1)&0x1F) > smp) return false;  i += 2; continue;
			case 0x70: if((X.U8(i+1)&0x1F) > smp) return false;  i += 1; continue;
			case 0xE0: i += 2; continue;  case 0x60: i += 1; continue
			}
			if((t & 0x80) == 0x80) { if((((t<<4)&0x10) | (X.U8(i+1)>>4)) > smp) return false;  i += 3; continue }
			if((((t<<4)&0x10) | (X.U8(i+1)>>4)) > smp) return false;
			i += 2
		}
		return true
	}
	if(v == 6) if(_is5060()) sv = '6.0'; else if(_is61()) sv = '6.1'; else return false;
	else if(_is5060()) sv = '5.0';
	return true
}
if(!bDetected && isThePlayer56X()) {
	sName = "Jarno 'Guru' Paananen's The Player module (.P"+sv[0]+'X,.P'+sv[0]+sv[2]+'A)';
	sVersion = 'v'+sv+'A'; bDetected = 1;
	if(dtsmp) sVersion = sVersion.appendS('deltasmp','/');
	if(pksmp) sVersion = sVersion.appendS('packedsmp','/');
	if(X.isVerbose()) {
		sOption('ord:'+ord+' ptn:'+(mptn!=ptn?mptn+'/':'')+ptn+' smp:'+smp
			+(notes>0?' notes:'+notes:'')+' sz:'+outSz(smpp+smpsz))
	}
}


function isThomasHermann() {
	//ref the eagleplayer RE
	if(X.Sz() < 0x1A90) return false;
	var ofs = X.I32(0x2E,_BE); if(!isWithin(ofs,2,0x4000000) || ofs % 2) return false;
	if(X.I32(0,_BE)-ofs != 0x40) return false; p = 4;
	for(i=0,d4=0x40; i < 4; i++,p+=4) { d4 += 0x400; if(X.I32(p,_BE)-ofs != d4) return false }
	for(i=0; i < 3; i++,p+=4) { d4 += 0x100; if(X.I32(p,_BE)-ofs != d4) return false }
	smp = X.U8(0x23); sz = smp-1; smpsz = -1;
	for(p = 0x44; p < 0x1040; p += 4) if((t=X.U32(p-4,_BE)-ofs) > sz) sz = t;
	sz += 0x40; if((sz-0x1A90)%3) return false;
	if(sz == 0x2E10) x = 5;  else if(sz == 0x2780) x = 3;  else x = 1;
	ptn = Util.divu64(Util.divu64(sz-0x1A90,3), X.U8(0x29)+1);
	bad = ''; if(ptn > 0x400) bad = bad.addIfNone('!badptn');
	if(smp > 0x1F) bad = bad.addIfNone('!badsmp');
	else for(i=0,p=0x14F0; i < smp; i++,p+=0x30) smpsz += X.U16(p,_BE);
	d1 = 0x100+X.U8(0x21)-X.U8(0x22)+1; d1 *= 2+X.U8(0x2C); d2 = d1;
	d1 *= X.U16(0x2A,_BE); d3 = Util.divu64(sz == 0x37EE ? 0xAEC80: 0xAD300,  X.U8(0x29)+1);
	d1 = Util.divu64(d1, d3); dur = secondsToTimeStr(d1)
	return true
}
if(!bDetected && isThomasHermann()) {
	sName = "Thomas Hermann's module (.THM+.SMP)"; bDetected = 1;
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		if(x > 1) sOption(x,'×');
		sOption('len.'+dur+' ptn:'+ptn+' smp:'+smp+' smpsz:'+smpsz+' sz:'+outSz(sz))
	}
}


function isJaytrax() {
	//ref https://github.com/pachuco/jaytrax/raw/refs/heads/master/lib_oldjaytrax/jxs.c etc.
//ch/ss = 16, ord/ss = 256, rows/ptn = 64, eff/inst = 4, wf/inst = 16, smp/wf = 256, arps/song = steps/arp = 16,
//se_ch = _FTsteps = 16, _FX = 18
	if(X.Sz() < 26243 || !isWithin(X.U32(0),0xD80,0xD81)) return false;
	if(!(ptn=X.U32(4)) || !(x=X.U32(8)) || !(ins=X.U32(0xC))) return false;
	if(!isAllZeroes(0x10,0x24)) return false; //reserved
	mbpm = 400; Mbpm = ch = smp = 0; ord = []; titles = [];
	for(s=0,p=0x34; s < x && p < X.Sz(); s++,p+=0x40B4) {
		// 0x40 bytes padding, 0x10 channel muting
		for(i=p+0x40; i < p+0x50; i++) if(X.U8(i) > 1) return false;
		if(!isWithin(bpm=X.U32(p+0x50),10,300)) return false;
		if(mbpm > bpm) mbpm = bpm; if(Mbpm < bpm) Mbpm = bpm;
		if(!isWithin(X.U8(p+0x54),0,3)) return false; //groove type
		if((startpos=X.U32(p+0x58)) > (endpos=X.U32(p+0x60))) return false;
		if((looppos=X.U32(p+0x68)) > endpos) return false;
//_l2r('jxs',X.U32(p+0x6C),' - loopstep, '+Hex(X.U16(p+0x70))+' - songloop')
		if(!isWithin(t=X.U16(p+0x92),1,16)) return false; if(ch < t) ch = t;
		if(!isWithin(delay=X.U16(p+0x94),2000,60000)) return false; // delay amts follow, until...
		if(!isWithin(amp=X.U16(p+0xA6),20,999)) return false;
		if(X.isDeepScan()) for(o=p+0xB4; o < p+0x40B4; o += 4) // not so necessary but we can do it so...
			if(X.U16(o) >= ptn || !X.U16(o+2) || (X.U16(o+2) & ~0x78)) return false; //ptnlen constraints
		t = X.SC(p+0x72,0x20,"CP1250"); if(t !== 'Empty' && t.trim() !== '') titles.push(t.trim());
		ord.push(endpos)
	}
	p += ptn*64*5; //patterns
	for(i=0; i < ptn && p < X.Sz(); i++) p += 4+X.U32(p); //pattern names
	for(i=0; i < ins && p < X.Sz(); i++,p+=0x2208) { //inst recs
		if([1234,1235].indexOf(X.U16(p)) < 0) return false; //mugi ver
		// sOption(X.SA(p+2,32)) //inst.name; nobody leaves any messages in them though
		if(X.U16(p+0x22) > 16 || !isWithin(X.U16(p+0x24),1,0x100)) return false; //wf, wlen. Should be 1~16 and 10~256, but faulty files still play!
		if(X.U16(p+0x26) > 0xFF || X.U16(p+0x28) > 16 || X.U16(p+0x2A) > 32) return false; //mastervol, am wave/spd
		if(X.U16(p+0x2E) > 15 || X.U16(p+0x30) > 16 || X.U16(p+0x32) > 64) return false; //ft, fm wave/spd; spd should be <= 32 but kingtut.jxs has 57!
		if(X.U32(p+0x200)) smp++; if(t=X.U32(p+0x204)) p += t; //smp len
	}
	if(p > X.Sz()) return false;
	p += 0x100; //arp table
	return true
}
if(!bDetected && isJaytrax()) {
	sName = "Reinier 'Rhino' van Vliet's Jaytrax/Syntrax module (.JXS)"; sVersion = 'v.'+X.U32(0); bDetected = 1;
	if(X.isVerbose()) {
		if(titles.length > 1) sOption(addEllipsis(titles.join('/'),0xC0),'×'+x+' subsongs:');
		else { if(titles.length) sOption(titles[0]); if(x > 1) sOption(x,'×') }
		if(x > 1) ord = ord.join('+');
		else ord = (startpos? startpos+'~': '')+(looppos > startpos? '('+looppos+'-)': '')+endpos;
		sOption('ch:'+ch+' bpm:'+mbpm+(mbpm!=Mbpm? '-'+Mbpm: '')
			+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' smp:'+smp+' sz:'+outSz(p));
	}
}


function isiXalanceUnp() {
//ref https://github.com/arnaud-neny/rePlayer/blob/646aeb86f4c0c2e57b38292e88f525680c207004/source/Replays/IXalance/webixs/Module.cpp#L481
	if(X.U8(0) != 0x21 || X.U8(9) != 0x80) return false;
	if(!(ord=X.U16(1)) || !(ins=X.U16(3)) || !(smp=X.U16(5)) || smp > ins || !(ptn=X.U16(7))) return false;
	if(!isWithin(mvol=X.U8(0xA),1,0x20) || !isWithin(spd=X.U8(0xB),1,0x20) || !isWithin(tmp=X.U8(0xC),0x20,0xA0)) return false;
	if(charStat(X.readBytes(0xD,0x1A),1).indexOf('allxsc') < 0) return false;
	for(p=0x27; p < 0x67; p++) if(X.U8(p) > 0x40) return false;
	for(p=0xA7; p < 0xA7+ord; p++) if(X.U8(p) != 0xFF && X.U8(p) >= ptn) return false;
	if(X.U8(p-1) != 0xFF) return false;
	var id; rins = 0; rsmp = 0; bad = '';
//_l2r('ixu',p,'insts')
	for(i=0; i < ins && p < X.Sz(); i++)
		if(['I','i'].indexOf(id=X.SA(p++,1)) < 0) return false // the small 'i' is the kb reset?
		else if(id === 'I') {
			if(X.U8(p+2) > 0x80) return false; // normally all volumes are up to 40h, but SOME files...
			p += X.I8(p+5) >= 0? 244: 6; //vol, kb setup
			for(j=3; j; j--) if(X.U8(p++)) {
				if(X.U8(p+1) > X.U8(p+2) || X.U8(p+3) > X.U8(p+4)) return false; //lp/sustainlp beginning/end tests
				p += 5 + X.U8(p)*3; //env node points
			} rins++
		}
//_l2r('ixu',p,'smps')
	for(i=smpsz=0; i < smp && p < X.Sz(); i++) {
		id = X.SA(p++,1);
		if(['S','s'].indexOf(id) < 0) return false; // the small 's' is the flags reset
		if(id == 'S') {
			if(X.U8(p) > 0x40 || X.U8(p+2) > 0x40) return false; //gvl, volume
			var fl = X.U8(p+1), ssz = X.I32(p+3), lpb = X.U32(p+7), lpe = X.U32(p+0xB),
				slpb = X.U32(p+0xE), slpe = X.U32(p+0x13), fn = X.readBytes(p+0x20,13);
			if(charStat(fn,1).indexOf('allxsc') < 0) return false; fn = decEncoding(fn,CP437);
//_l2r('ixu',p,'smp'+i+': ['+ssz+'] ('+lpb+'~'+lpe+') s('+slpb+'~'+slpe+')'+fn)
			switch(fn) { // broken(?) samples (I guess IT214 compression played a part)
			case '909OH.WAV': ssz = 3424; break;
			case '909SD.WAV': ssz = 3413; break;
			case 'CRASH.WAV': ssz = 16098
			}
			if(lpb > ssz || lpe > ssz || slpb > ssz || slpe > ssz || lpb > lpe || slpb > slpe) return false;
			smpsz += ssz; p += 0x2D; rsmp++
		}
	}
//_l2r('ixu',p,'ptns')
	for(i=0; i < ptn && p < X.Sz(); i++) {
		id = X.SA(p++,1);
		if(['P','p'].indexOf(id) < 0) return false; // the small 'p' is the flags reset
		if(id == 'P') {
			var psz = X.U16(p), rows = X.U16(p+2);
			if(!psz || !rows) return false;
			p += 4+psz
		}
	}
	j = X.U32(p); p += 4;
	// In principle, this marks the end of replayable part, but there's more info about SFXI to potentially account for.
	// In practice, maybe it can be copied from .IT files
//_l2r('ixu',p,'input for wfsmp x'+j)
	for(i=0; i < j && p < X.Sz(); i++,p+=0x10C) {
		if(charStat(X.readBytes(p,8),1).indexOf('allxsc') < 0) break
//_l2r('ixu',p,i+': '+X.SA(p+4,8))
	}
	j = X.U8(p++);
//_l2r('ixu',p,'input for synsmp x'+j)
	return true
}
if(!bDetected && isiXalanceUnp()) {
	sName = "Sahara Surfers' iXalance module (.IXS)"; sVersion = 'unpacked'; bDetected = 1;
	if(bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
	if(X.isVerbose()) {
		sOptionT(X.SA(0xD,0x1A,'CP1250'));
		sOption('ord:'+ord+' ptn:'+ptn+' ins:'+(rins!=ins?rins+'/':'')+ins
			+' smp:'+(rsmp!=smp?rsmp+'/':'')+smp+' smpsz:'+smpsz+'s sz:'+outSz(p))
	}
}


function isOPX() {
	var p = 0x7E;
	if(X.c("200D0A1A",0x7A)) {
		if(!X.c("0D0A",0x35) || !X.c("0D0A",0x6C)) return; //obligatory line breaks?
	} else if(!X.c("20202020",0x7A)) //wiped out with spaces!
		// 2 fringe cases:
		if(X.c("04C50964c504641A2609810F9919008C82100C830382100CC464C464C464C4641A"))
			p = 0; // no header
		else if(X.c("'msx2'00469E2A4E8A22626C2D'bl-demo.bas'00",0xA2F) && X.c("'OPXPLAY SYS'00",0xB2C))
			p = 0xC7E; //a bit too much of a header :o
		else return;
	if(X.U8(0) != 4) for(i=0; i < 0x35; i++) if(X.U8(i) < 0x20) return;
	if(X.U8(p+1) > 2 || X.U8(p+3) > 0x3F || X.U8(p+4) > 6 || X.U8(p+6) > 5 || X.U8(p+7) > 0x21 || X.U8(p+8) > 1
		|| X.U8(p+9) > 0x4F || X.U8(p+10) || X.U8(p+12) > 1 || X.U8(p+14) > 3 || X.U8(p+16) > 3 || X.U8(p+18) > 3) return;
	return true
}
if(!bDetected && isOPX()) {
	sName = "MSX Performer OPX chiptune (.OPX)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption(addEllipsis(X.SC(0,0x7B,'SJIS')))
	}
}


// new stable detections :go here ↑
// BELOW THIS POINT ARE THE DETECTIONS THAT ARE IFFIER THAN THE REST

// There are sanity-checked formats that nevertheless have some signature in a known place;
// those that have some signatures that aren't just "0000" in calculated places;
// those that are checked for pure mathematical dependencies and possible byte ranges;
// those that are very heavy to that, and those less so.
//
// Some are in dire need of amending, and they're set to go after the other detections,
// so you won't miss the good matches because of these and will hopefully spend less time waiting for detects


function isImagesMusicSystem() { //goes before Soundtracker .STK for speed
	//from https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/ImagesMusicSystem/src/Images Music System_v3.asm
	//is this a hack of Soundtracker? Vice versa?
	if(X.Sz() < 0x73C) return false;
	smpp = X.U32(0x438,_BE); if(smpp <= 0x43C) return false;
	d1h = (smpp-0x43C) % 0x300; if(d1h) return false;
	ptn = d2 = Util.div64(smpp-0x43C,0x300); ord = X.U8(0x3B6); if(ord > 127) return false;
	mptn = 0;
	for(i = 0; i <= ord; i++) { t = X.U8(0x3B8+i); if(t > 127) return false; if (mptn < t) mptn = t }
	if(ptn != mptn+1) return false;
	smp = smpsz = 0; smps = []; bad = ""; smpns = [];
	for(i = 0; i < 31; i++) {
		if(X.isVerbose()) smpns.push(X.SC(0x14+i*30,0x16,'CP437').trim());
		t = X.U16(0x14+i*30+0x16,_BE);
		if(t) { smp++; smpsz += t<<1 }
	}
	msmp = smpns[smpns.length-1];
	sz = smpp+smpsz;
	if(sz < X.Sz()) bad = bad.addIfNone("!short");

	a1 = 0x3B8; d1 = ord; x = a0 = notes = 0;
	if(X.isVerbose()) {
	  do { //NextPos
		a0 = 0x43C+X.U8(a1)*0x300; a3 = a0+0x300;
		a1++;
		do { //NextPatPos
			var z = X.readBytes(a0,2), nsmp = ((z[0] & 0xC0) >> 2) | (z[1] >> 4);
			if(z[0] & 0x3F) { notes++; if(debug && nsmp > msmp) bad = bad.addIfNone("!missingsmp#"+nsmp) }
			if(z[1] & 0x0F === 0x0B) { x++; break }
			else a0 += 3
		} while(a0 < a3 && a0 < X.Sz()); d1--
	  } while(d1);
	  if(!x) x = 1;
	} else x = 1;
	if(smpp === 28732 && smpsz === 12898 && X.c("'beast-busters1.st'") )
		x = 11;
	return true
}
if(!bDetected && isImagesMusicSystem()) {
	//https://www.exotica.org.uk/wiki/Images_(format)
	sName = "Neil Crossley's Images Music System module (.IMS)"; bDetected = 1;
	sVersion = "v1.0"; if(bad != "") sVersion = sVersion.appendS("malformed"+bad,"/");
	if(X.isVerbose()) {
		sOption(X.SC(0,20,'CP437')); if(x > 1) sOption(x,"×");
		sOption(addEllipsis(smpns.filter(funSampleName).join(","),0x100,0xA0),'smp/msg:"','"');
		sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(sz))
	}
}


function isSoundtrackerMOD() { //goes after IMS for speed
	//ref http://asle.free.fr/prowiz/prowiz.src.zip / r/SoundTracker.c
	// & https://github.com/OpenMPT/openmpt/blob/master/soundlib/Load_mod.cpp
	if(X.Sz() < 555) return false;
	function invalidChars(buf) {
		var c = 0; for(var i = 0; i < buf.length; i++) {
			if(buf[i] && (buf[i] < 0x20 || isWithin(0x80,0xFE)) && [0xA,0xD,0xE].indexOf(buf[i]) < 0) c++;
		} return c
	}
	function re(p,t) { if(debug>1)_l2r('stk',p,t); return false }
	function npTest(n) { const valid = [0, 856,808,762,720,678,640,604,570,538,508,480,453,
		  428,404,381,360,339,320,302,285,269,254,240,226,
		  214,202,190,180,170,160,151,143,135,127,120,113];
		return valid.indexOf(n) >= 0 || valid.indexOf(n-1) >= 0 || valid.indexOf(n+1) >= 0
	}
	const UST1_00=0,UST1_80=1,ST2_00_Exterminator=2,ST_III=3,ST_IX=4,MST1_00=5,ST2_00=6;
	var ic = 0, hasDiskNames = true, minV = UST1_00;
	ic = invalidChars(X.readBytes(0,20));
	bad = ""; allsmpsz = allvols = smp = minV = 0; snames = [];
	for(k=0; k < 15; k++) {
		var sn = X.readBytes(20+k*30,22,true), sname = decEncoding(sn,CPAmiga).trim();
		if(/ST-[0-9A-F]+:/i.test(sname)) ic -= 4; else snames.push(sname);
		ic += invalidChars(sn);
		re(20+k*30,"STKsmp["+k+'] "'+sname.trim()+'" invalid chars:'+ic+" ("+charStat(sn,1)+")")
		if(ic > 10) return re(20+k*30,"!title or sample names too broken");
		if(X.U8(20+k*30) && !/^st-[0-9a-f]\d:/i.test(sname))
			hasDiskNames = false;
		slen = X.U16(42+k*30,_BE)*2;
		if(slen > 0x12000) return re(42+k*30,"!smp #"+k+" too large:"+Hex(slen));
		if(X.U8(44+k*30) > 15) { bad = bad.addIfNone("!finetune"); ic+=16 } //finetune
		svol = X.U8(45+k*30); if(svol > 0x40) return false;
		sls = X.U16(46+k*30,_BE), sll = X.U16(48+k*30,_BE);
		if(slen > 9998 || sls > 4999) minV = Math.max(minV,MST1_00);
		if(slen) smp++;
		allsmpsz += slen; allvols += svol;
//_log("smp["+k+"] <"+X.SA(20+k*30,22)+"> ["+slen+"] @"+Hex(20+k*30)+" -> vol:"+svol+" loopstart:"+sls+" looplen:"+sll);
		if(sll > slen+2) {
			re(42+k*30,"!smp "+k+" LpLen "+sll+" > sSz "+slen); bad = bad.addIfNone("!sLpLen>sSz") }
		if(slen && sls >= slen) {
			re(46+k*30,"!smp "+k+" LpStart "+sls+" >= sSz "+slen); bad = bad.addIfNone("!sLpStart>=sSz") }
		if(sls && !sll) {
			re(42+k*30,"!smp "+k+" LpStart "+sls+" LpSz 0"); bad = bad.addIfNone("!sLpStart0LpSz") }
		if(sls && !slen) {
			re(46+k*30,"!smp "+k+" LpStart "+sls+" sSz 0"); bad = bad.addIfNone("!sLpStart0SSz") }
	}
//_log("5:allsmpsz="+allsmpsz+" allvols="+allvols);
	if(allsmpsz < 8 || !allvols) return re(20,"!smps too small or no smpvols");
	ord = X.U8(0x1D6); if(ord > 128) return false;
	restartp = X.U8(0x1D7); if(restartp > 220) return false;
	if(!restartp || /jjk55/.test(X.SA(0,6))) restartp = 0x78;
	bpm0 = 125;
	if(restartp != 0x78) {
		bpm0 = (709379*125 / (50*122*(240-restartp))).toFixed(2); //between ≈60 and ≈976
		if(minV > UST1_80) minV = Math.max(minV, hasDiskNames?ST_IX:MST1_00);
		else minV = Math.max(minV, hasDiskNames?UST1_80:ST2_00_Exterminator);
	}
	ptn = offptn = badptn = ord_ = 0; usedptns = []; usedsmps = [];
	for(o=0; o < 128; o++) {
		x = X.U8(0x1D8+o); if(x > 63) return re(0x1D8+o,"!impossible ptn #"+x);
		if(ptn <= x) {
			ptn = x+1;
			if(o < ord) { offptn = ptn; if(usedptns.indexOf(x) < 0) usedptns.push(x) }
		}
		if(x >= badptn) badptn = ptn+1;
		if(x) ord_++; //a heuristic to count out suspiciously many zeroes
	} ord_++;
//_log("ptn:"+ptn+" off.ptn:"+offptn+" badptn:"+badptn+" used ptns:"+usedptns)
	songszoffptn = 0x258+0x400*offptn;
	if(songszoffptn > X.Sz()) return re(songszoffptn,"!patterns cut off");
	ic = tnDxx = notes = 0;
	for(i=0; i < ptn; i++) {
		emptycmd = nDxx = badnote = ptnic = ptnotes = 0;
		for(row=0; row < 64; row++) for (chn=0; chn < 4; chn++) {
			var ofs = 0x258+(i<<10)+(row<<4)+(chn<<2);
			x = X.readBytes(ofs, 4);
			if(X.isDeepScan()) {
				if(!emptycmd && !x[0] && !x[1] && !x[2] && !x[3]) {
					emptycmd++; if(emptycmd > 32) minV = ST2_00
				} else emptycmd = 0 }
			var smpn = (x[0]&0xF0) | ((x[2]&0xF0) >> 4), np = ((x[0]&0xF) << 8) + x[1], fx = x[2]&0xF;
//if(debug>2)_log("@"+Hex(ofs)+" ptn "+i+": "+Hex(x[0])+" "+Hex(x[1])+" "+Hex(x[2])+" "+Hex(x[3])+": smp#"+smpn+" np:"+Hex(np)+" fx:"+Hex(fx));
			if(usedptns.indexOf(i) >= 0)
				if(smpn > 15) { ptnic++;
//if(debug>2)_log("   bad smp "+np+" @"+Hex(ofs)+" ptn"+i+" row"+row+" chn"+chn)
				}
				else if(usedsmps.indexOf(smpn) < 0) usedsmps.push(smpn);
			if((X.isDeepScan() || notes < 100) && !npTest(np)) { ptnic += 2; badnote++;
//if(debug>2)_log("   bad note "+np+" @"+Hex(ofs)+" ptn"+i+" row"+row+" chn"+chn)
			} else if(np) ptnotes++;
			if(X.isDeepScan()) switch(fx) {
			case 1: case 2:
				if(x[3] > 0x1F && minV == UST1_80) minV = hasDiskNames ? UST1_80 : UST1_00;
				else if(fx == 1 && x[3] > 0 && x[3] < 3) minV = Math.max(minV,ST2_00_Exterminator);
				else if(fx == 1 && (x[3] == 0x37 || x[3] == 0x47) && minV <= ST2_00_Exterminator)
					minV = hasDiskNames ? UST1_80 : UST1_00;
				break;
			case 0xB: minV = ST2_00; break;
			case 0xC: case 0xD: case 0xE: minV = Math.max(minV,ST2_00_Exterminator);
				if(fx == 0xD) { emptycmd = 1; if(!x[3] && !row) break; nDxx++ } break;
			case 0xF: if(minV < ST_III) minV = ST_III; break;
			}
		}
		if(ptn >= offptn && ptnic > 64) ptn = offptn;
		else { ic += ptnic; notes += ptnotes; if(badnote) bad = bad.addIfNone('!badnotes') }
		if(ic > Math.max(512,ptn*128)) return re('!badbytes:'+ic);
		if(nDxx && nDxx < 3) minV = ST2_00; tnDxx += nDxx;
	}
	if(tnDxx > ptn+32 && minV == ST2_00) minV = MST1_00;
	if(X.isDeepScan()) switch(minV) {
	case UST1_00: tracker = "Karsten Obarski's Ultimate ST 1.0~21"; break;
	case UST1_80: tracker = "Karsten Obarski's Ultimate ST 1.8~2.0"; break;
	case ST2_00_Exterminator: tracker = "The Exterminator's ST 2.0 / D.O.C.'s ST II"; break;
	case ST_III: tracker = "Il Scuro/Defjam's ST III / Alpha Flight ST IV / D.O.C.'s' ST IV / VI"; break;
	case ST_IX: tracker = "D.O.C.'s' ST IX"; break;
	case MST1_00: tracker = "Tip/The New Masters' Master ST 1.0"; break;
	case ST2_00: tracker = "D.O.C.'s ST 2.0~2"; break;
	default: tracker = "???"
	}
	sz = 0x258+0x400*ptn+allsmpsz;
	var sizediff = Math.abs(sz-X.Sz()), orddiff = Math.abs(ord-ord_);
	var nzord = ord?ord:0.0001, sus = 0;
	if(ic > 20) sus++; if(!isWithin(smp,3,15)) sus++;  if(sizediff > 2048) sus++;  if(sz > X.Sz()) sus++;
	if(!restartp) sus++;  if(!ord || !ord_ || badptn > ptn+2) sus++;  if(orddiff/nzord > 0.8) sus++;
	if(!ptn) sus++;  if(notes < 2) sus++;  if(allvols < smp) sus++;
	if(!isWithin(bpm0,20,300)) sus++;
//_log("ic="+ic+" smp="+smp+" sizediff="+sizediff+" ord||ptn="+(ord||ord_||ptn)+" maxptn="+(badptn>ptn+2)+" od%="+(orddiff/nzord).toFixed(1)+" notes:"+notes+" bpm0:"+bpm0+" how sus:"+sus)
	if(sus >= 4) // free strikes
		// If there are enough bad notes, the samples are kinda few or kinda many,
		//the size is more than two patterns' lengths different (especially smaller),
		//either no length or no "official" patterns are there, the orderlist is mostly zeroes,
		//it's just a couple notes or they're strange periods, the avg volume's too low, and the bpm0's weird...
		return re(sus,'!too suspicious');
	if(ic) bad = bad.addIfNone('!baddata='+ic);
	if(sz > X.Sz()) bad = bad.addIfNone('!short');
	if(sus) bad = bad.addIfNone('!sus+'+sus)
	return true;
}
if(!bDetected && isSoundtrackerMOD()) {
	sName = "Karsten Obarski's SoundTracker module (.STK,.MOD)"; bDetected = 1;
	if(bad != "") sVersion = 'malformed'+bad;
	if(X.isVerbose()) {
		sOptionT(X.SA(0,0x14));
		if(X.isDeepScan()) sOption(tracker,"in:");
		sOption(snames.filter(funSampleName).join(" "),'smps/msg:"','"');
		sOption('bpm0:'+bpm0+' ord:'+ord+(ord_!=ord? '/'+ord_: '')+' ptn:'+(offptn!=ptn? offptn+'/': '')+ptn
			+' smp:'+smp+(X.isDeepScan()? ' notes:'+notes: '')+' sz:'+outSz(sz))
	}
}


function isComposer670() {
	spd = X.U8(0); if(!isWithin(spd,1,15)) return false;
	ord = X.U8(1); if(!ord || ord >= 128) return false;
	ptn = X.U8(2); if(!ptn) return false; //while 0 is possible, there's no way we'll reliably detect the file then
	smp = X.U8(3); if(smp > 0x20) return false;
	opl = X.U8(4); lp = X.U8(5); if(lp > ord) return false;
	smpp = X.U32(6); if(smpp > X.Sz()) return false;
	p = 0xA; for(i=0; i < ord; i++) if(X.U8(p++) >= ptn) return false;
	ptnpt = p; p += ptn*4;
	for(i=smpsz=0; i < smp; i++,p+=16) {
		if(X.U32(p)) return false;
		var _l = X.U32(p+4), _ls = X.U32(p+8), _le = X.U32(p+12);
		if(!_l || _l > 0xFFFFF) return false; smpsz += _l;
		if(_le < 0xFFFFF && (_le > _l || _ls > _le)) return false
	}
	for(i=0; i < opl; i++,p+=11) {
		if(X.U8(p) & 0xF0) return false;
		if(X.U8(p+5) & 0xFC) return false;
		if(X.U8(p+10) & 0xFC) return false;
	}
	for(i=notes=0,ptnp=p,bad=false; i < ptn; i++) {
		p = ptnp+X.U32(ptnpt+i*4); if(p > smpp-3) return false;
		if(i >= ptn-1) ptnend = smpp; else ptnend = ptnp+X.U32(ptnpt+i*4+4);
		if(!isWithin(ptnend - p, 3,0x1000)) return false;
		for(r = 0; p < ptnend;) {
			var cmd = X.U8(p++);
			if(cmd <= 0xC) { p += 2; notes++ }
			else if(cmd >= 0x20 && cmd <= 0x2C) p++;
			else if(cmd == 0x40) r += X.U8(p++);
			else if(cmd == 0x60) break;
			else return false
		}
		if(r > 64) return false
	}
	sz = smpsz+smpp;
	return opl+smp > 0
}
if(!bDetected && isComposer670()) {
	sName = "CDFM/Composer 670 module (.670)"; sVersion = 'compact'; bDetected = 1;
	if(bad) sVersion = "malformed!badptn";
	if(X.isVerbose()) sOption('spd:'+spd+' ord:'+ord+(lp?' lp:'+lp:'')+' ptn:'+ptn+' smp:'+smp+' fm:'+opl+' notes:'+notes+' sz:'+outSz(sz))
}


function isLDS() {
	//ref https://github.com/adplug/adplug/blob/master/src/lds.cpp
	if(X.Sz() < 136) return false; if((mode = X.U8(0)) > 2) return false;
	if(X.U8(1) > 0x1F && X.U8(1) != 0xD0) return false; //speed, byte1
	if(X.U8(2) < 0x42 || X.U8(2) > 0x43) return false; //speed, byte2
	if((tempo = X.U8(3)) < 3 || tempo > 0x1F || ((ptnsz = X.U8(4)) & 0x87)) return false;
	for(i=5; i < 14; i++) if(X.U8(i) > 4) return false; if((regbd = X.U8(0xE)) > 2) return false;
	if(!(ins = X.U16(0xF)) || ins > 0x3F) return false;
	for(p = 0x11; p < 0x11+0x2E*ins; p += 0x2E) {
		if(X.U8(p+4) > 3 && X.U8(p+4) != 0xE1 || X.U8(p+9) > 4) return false;
		if(X.U8(p+0xA) > 0x7F || (X.U8(p+0xC) & 0xC0)) return false;
		if(!isWithin(X.I8(p+0x15), -0x30, 0x30) || !isWithin(X.I8(p+0x17), -0x30, 0x30)) return false;
		if(!isWithin(X.I8(p+0x1B), -0x30, 0x30) || !isWithin(X.I8(p+0x20), -0x30, 0x30)) return false;
		if((X.U8(p+0x24) > 0x30) || X.U8(p+0x25) > 1 || !isWithin(X.I8(p+0x27), -4, 0)) return false;
		if(isInside(X.U8(p+0x2B), 0x30, 0xE8) || X.U16(p+0x2C)) return false;
	}
	ord = X.U16(p); if(!ord || ord > 0x60) return false; p += 2; mp = -1; ptnp = p+ord*9*3+2;
	for(i=0; i < ord; i++) for(j=0; j < 9; j++) {
			pt = X.U16(p); if(pt%2 || pt+ptnp > X.Sz() || pt > 0x4000) return false; if(mp < pt) mp = pt; p += 3;
		}
	digisnd = X.U16(p); p += 2; sz = ptnp+digisnd; //digital sounds value seems to point just beyond the patterns!
	if(X.Sz() < sz) return false; ptn = Util.divu64(digisnd,2);
	return true
}
if(!bDetected && isLDS()) {
	sName = 'Loudness Sound System Ad Lib module (.LDS)'; bDetected = 1;
	if(X.isVerbose()) sOption('ch:9 mode:'+mode+' spd:'+X.U16(1)+' tempo:'+tempo
		+' ord:'+ord+' ptn:'+ptn+' ins:'+ins+' sz:'+outSz(sz))
}


function isKSM() {
	for(i=0; i < 4; i++) if(!isWithin(X.U8(i),0,0x57)) return false;
	for(; i < 0xB; i++) if(X.U8(i)) return false;  for(; i < 0x10; i++) if(X.U8(i) < 0xFB) return false;
	for(; i < 0x20; i++) if([0xF0,4,6,8,0xC].indexOf(X.U8(i)) < 0) return false;
	for(c=0; i < 0x25; i++) if(X.U8(i) > 5) return false; else if(!X.U8(i)) c++; if(c > 3) return false;
	for(; i < 0x2A; i++) if(X.U8(i)) return false;  for(; i < 0x30; i++) if(X.U8(i) > 1) return false;
	for(i=0x40; i < 0x50; i++) if(!isWithin(X.U8(i),0x20,0x3F)) return false;
	if(!X.c("32323232 323232",0x44)) return false;
	return true
}
if(!bDetected && isKSM()) {
	sName = "Ken Silverman's Adlib module (.KSM)"; bDetected = 1;
	if(X.isVerbose()) sOption('notes:'+(notes=X.U16(0x50))+' sz:'+outSz(0x52+notes*4))
}


function isTMC() {
	function rt(p,m) { if(debug>1)_l2r('tmc',p,m); return false }
	//ref http://atariki.krap.pl/index.php/TMC
	if(X.Sz() < 0x1D0 || X.U8(0x23) != 0x20) return false; //data starts from 1A0+instr.+ptns., obligatory space
	if((bin = parseAtariBinary())[0] < 0x1D6) return rt('!binsz'); // an Atari binary, of this size
	if(X.U8(bin[1][0][1]+5) != 0xFF) return rt(0,'!ptnend'+outArray(bin,16)); // last ptn ends with FF
	if(!isWithin(spd0=X.U8(0x24),1,0x10) || !isWithin(ticks=X.U8(0x25),1,4)) return rt(0x25,'!spd'+spd0+'/'+ticks);
	for(ins=t0=0,p0=0x10000,p=0x26; p < 0x66; p++) {
		if(!X.U8(p) && !X.U8(p+0x40)) continue; if([0,9].indexOf(X.U8(p)&0xF) < 0) return rt('!susins');
		t = (X.U8(p+0x40) << 8)+X.U8(p)+6-X.U16(2); if(t < 0 || t <= t0) return rt(t,'!-insptr');
		t0 = t; if(t > 0) { if(!isWithin(t,0x1A0,bin[1][0][1]+6)) return rt(t,'!insptr'); else ins++;  if(p0 > t) p0 = t }
	}
	if(!ins) return rt(p0,'!0inst');  if([0,9].indexOf(X.U8(0xA6) & 0xF) < 0) return rt(p0,'!0ptnptr'); //still depends on instrument record length
	for(ptn=t0=0,p=0xA6; p < 0x126; p++) {
		t = (X.U8(p+0x80) << 8)+X.U8(p)-X.U16(2)+6; if(p0 > t) p0 = t; if(t < 0 || t <= t0) return rt(t,'!-ptnptr');  t0 = t;
		if(t && !isWithin(t,0x1A0,bin[1][0][1]+6)) return rt(t,'!ptnptr');  if(t && X.U8(t) != 0xFF) ptn++
	}
	ord = (p0-0x1A6) >> 4;
	for(p=0x1A7,pt=-1,ic=0; p < p0; p += 2)
		if(!X.c("FF",p) && !X.c("7F",p))
			if(X.U8(p) > 0x7F) ic++; else if(X.U8(p) >= pt) pt = X.U8(p)+1;
	return true
}
if(!bDetected && isTMC()) {
	sName = "Marcin 'Jaskier' Lewandowski's Theta Music Composer module (.TMC,.TM4,.TM8)"; sVersion = 'v1.x'; bDetected = 1;
	if(ic) sVersion = sVersion.appendS('malformed!'+ic+'ptns','/');
	if(X.isVerbose()) {
		sOption(decAnsi(6,0x1E,CPATASCII,Chars0to1FATASCII_PL)); //Polish is prevalent, so...
		sOption('spd0:'+spd0+' ticks:'+ticks+' ord:'+ord+' ptn:'+(pt!=ptn?pt+'/':'')+ptn+' ins:'+ins+' sz:'+outSz(bin[0]))
	}
}


function isRMT() {
	function rt(p,m) { if(debug>1)_l2r('rmt',p,m); return false }
	//ref http://atariki.krap.pl/index.php/RMT_%28format_pliku%29 & http://atariki.krap.pl/index.php/Rmt
	if((bin = parseAtariBinary(0))[0] < 0x100) return rt('!binsz');
	base = X.U16(2);
	p = bin[1][0][0]; ch = X.U8(p+3)-0x30;
	if(!X.c("'RMT'",p) || ![4,8].includes(ch)) return;
	var trklen = X.U8(p+4); if(!trklen) trklen = 256;
	spd0 = X.U8(p+5);  if(!spd) return; ticks = X.U8(p+6); if(!ticks) return;  v = X.U8(p+7);
	var instp = p+X.U16(p+8)-base, trktlp = p+X.U16(p+0xA)-base, trkthp = p+X.U16(p+0xC)-base,
	trklstp = p+X.U16(p+0xE)-base;
//_l2r('rmt',p,'instp='+Hex(instp)+' trktlp='+Hex(trktlp)+' trkthp='+Hex(trkthp)+' trklstp='+Hex(trklstp));
	if(instp > X.Sz() || trktlp < instp || trkthp < trktlp || trklstp < trkthp
		|| trktlp > X.Sz() || trkthp > X.Sz() || trklstp > X.Sz()) return;
	//TODO extract more data
	return true
}
if(!bDetected && isRMT()) {
	sName = "Radik 'Raster' Štěrba's Raster Music Tracker module (.RMT)"; sVersion = 'v'+v; bDetected = 1;
	if(X.isVerbose()) {
		if(bin[1].length > 1) sOption('metadata present'); //TODO; don't have sample files
		sOption('ch:'+ch+' spd0:'+spd0+' ticks:'+ticks+' sz:'+outSz(bin[0]));
	}
}


function isPollyTracker() {
	//A trivial RLE compression with AE as the special command and a few glitches.
	//Underneath that, a trivial format that also messes up the lowercase letters for no reason.
	//Everything's space-padded, even the samples.
	if(!X.c("AE") || X.Sz() < 121) return false;
	p = 1; sz = unpsz = -1; var o = end = lc = 0; var u = Array(0x10000); var last = [-1,-2,-3,-4];
	function rB(q) { //this exists just to check for the unpacked sequences, we actually have better checks
		last[lc++] = X.U8(q); if(lc > 3) lc = 0;
		//PT packs sequences over 3 ch long so any we encounter in the file is cause enough to break off
		if(last[0] === last[1] === last[2] === last[3]) { end = 1; return -1 }
		else return X.U8(q)
	}
	function ret(s) { delete u; if(debug)_log(s); return false }
	while(!end && o < (X.isDeepScan() ? 65536 : 0x100) && p < Math.min(X.isDeepScan() ? 65535: 0x100,X.Sz())) {
		t = rB(p++);
		if(t == 0xAE) {
			c = rB(p++); if(c < 0) return ret("PTFault: bad count");
			if(!c) { end = true; break }
			else if(c === 1) { u[o++] = 0xAE; continue }
			b = rB(p++); if(b < 0) return ret("PTFault: bad byte");
			for(;c; c--) u[o++] = b
		}
		else u[o++] = t
	}
	if((tempo = u[0x1FC1]) < 0x10) return ret("PTFault: tempo < 10h");
	if(u[0x1F80] || u[0x1F90]) return ret('PTFault: nonzero smp#0');
	if(o%0x100) //fixing what seems like the packer's glitch. The lil bud always picks up some extra bytes
		while(o%0x100 && u[o-1] === 0x20) o--;
	if(o%0x100 || (X.isDeepScan() && o < 8192) || o > 65535 || p > 65535)
		return ret('PTFault: bad range! o='+Hex(o)+' p='+Hex(p));
	if((modsz = ((u[0x1FC3]+0x10) << 8)) != o)
		return ret('PTFault: allsmpsz mismatch: '+Hex(modsz)+' != '+Hex(o));
	var msmp = [4,12]; smp = 0;
	for(i=0x1F81; i < 0x1F90; i++) { // find max sample, count samples included
		if(u[i] >= 0x10) smp++; if(u[i] > msmp[0]) { msmp[0] = u[i]; msmp[1] = u[i+0x10] }
	}
	if((lastsmpend = ((msmp[0]+0x10)<<8) + (msmp[1]<<8)) != o)
		return ret('PTFault: last smp end '+Hex(lastsmpend)+' != '+Hex(o));
	notes = ic = 0;
	for(i=0; i < Math.min(0x1F00,o); i++) //test all the patterns, it's still fast
		//Notes aren't allowed to have smp#0 or note#0 but be a non-zero byte.
		//But PT v1.2 is glitchy, and earlier versions clearly allowed smp#0, so it does sometimes happen.
		if(u[i] && u[i] != 0xF0) { notes++; if((u[i]&0xF0) == u[i]) ic++ }
	if(X.isDeepScan()) for(i=0x2000; i < o; i++) //test all the samples
		if(u[i] > 0x3F) return ret('PTFault: bad sample @'+Hex(i));
	unpsz = o; sz = p; ord = ptn = 0;
	for(i = 0x1F00; i < 0x1F80; i++) { if(!u[i]) break; ord++; if((pt = u[i]-0xDF) > ptn) ptn = pt }
	if(ic > ptn<<2) return ret('PTFault: '+ic+' bad notes');
	// Let's adapt the text info too.
	for(i = 0x1FA0; i < 0x1FC0; i++) { if(u[i] && u[i] < 0x1A) u[i] += 0x60 }
	info = decEncoding(u.slice(0x1FA0,0x1FB0),CPAmiga);
	composer = decEncoding(u.slice(0x1FB0,0x1FC0),CPAmiga);
	delete u;

	return true;
}
if(!bDetected && isPollyTracker()) {
	sName = "Polly Tracker module (.MOD)"; bDetected = 1;
	if(X.isVerbose() && X.isDeepScan()) {
		sOptionT(info); sOptionT(composer,'by:');
		sOption('tempo:'+Hex(tempo)+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' notes:'+notes+' unpsz:'+unpsz+' sz:'+outSz(sz))
	}
}


function isSidMUS() {
	//ref NostalgicPlayer Source/Ports/LibSidPlayFp/SidTune/Mus.cs :: Detect, TryLoad
	// & https://github.com/MyDeveloperThoughts/ComputeSidPlayerC64Source/blob/main/notes/musFileFormat.md
	if(X.Sz() < 27) return;
	const HLT = 0x014F;
	var loadaddr = X.U16(0), len1 = X.U16(2), len2 = X.U16(4), len3 = X.U16(6);
	var v1p = 8+len1, v2p = v1p+len2, v3p = v2p+len3;
	if(v3p > X.Sz() || (v1p & 1) || (v2p & 1) || (v3p & 1)) return;
	if(!X.c("014F",v1p-2) || !X.c("014F",v2p-2) || !X.c("014F",v3p-2)) return; // voices must HLT at the end
	sz = v3p; t = "";
	if(X.Sz() > v3p && (p=X.fSig(v3p,0x1000,"00")-v3p+1) > 0) {
		t = decAnsi(v3p,p,CPFullCPETshifted,true).trim(); sz += p
	}
	return true
}
if(!bDetected && isSidMUS()) {
	sName = "COMPUTE!'s Enhanced SidPlayer tune (.MUS+.STR+.WDS)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption((t.length?'"'+addEllipsis(t,0x100,0xA0)+'"':'').append('sz:'+outSz(sz)));
	}
}


function isUltima6M() {
	//ref https://github.com/adplug/adplug/blob/master/src/u6m.cpp
	if(X.Sz() < 421 || !isWithin(unpsz=X.U16(0),0x30E,0xB21) || !X.c('00000007',2)) return false; //a rough filter
	// a finer filter: actually unpacking LZW and double-checking there
	var C, cW, o = 0, lim = Math.min(X.Sz(),unpsz), br = new BitReader(4), end = false,
		pW = 0, cwsz = 9, nextcw = 0x102, stk = [],
		dictsz = defdictsz = 0x1000, dict = [], contains = 0x102;
	for(i=0; i < dictsz-0x100; i++) dict.push({'rt':0, 'cw':0}) //new dictionary
	var dest = []; for(i=0; i < unpsz; i++) dest.push(0); //unpacked module
	function getstring(codeword) { //puts the string into a stack
		var c = codeword; while(c > 0xFF) { stk.push(dict[c-0x100]['rt']); c = dict[c-0x100]['cw'] } stk.push(c & 0xFF)
	}
	while(!end && br.offset <= lim && o <= unpsz) { //lzw decomp
		if(cwsz < 9 || cwsz > 12) return false; cW = br.read(cwsz);
		switch(cW) {
			case 0x100: cwsz = 9; nextcw = 0x102; dictsz = 0x200; contains = 0x102; //re-init the dictionary
				if(cwsz < 9 || cwsz > 12) return false; cW = br.read(cwsz); if(o >= unpsz) return false;
				dest[o++] = cW & 0xFF; break;
			case 0x101: end = true; break; //end of data
			default:
				getstring(cW < nextcw ? cW : pW); //codeword is already in the dictionary? get cW; else, pW
				C = stk[stk.length-1] & 0xFF;
				if(cW < nextcw)
					while(stk.length) { if(o >= unpsz) return false; dest[o++] = stk.pop() & 0xFF
					}
				else { //codeword not yet defined
					while(stk.length) { if(o >= unpsz) return false; dest[o++] = C; stk.pop() }
					if(cW != nextcw) return false;
				}
				if(contains < dictsz) { dict[contains-0x100] = { 'rt':C, 'cw':pW }; contains++ }
				nextcw++; if(nextcw >= dictsz) if(cwsz < 12) { cwsz++; dictsz <<= 1 }					
		}
		pW = cW
	}
	if(!end) return false;
	sz = br.offset;
	if(dest[0] != 0x83 || dest[1] || (dest[2]&8) || (dest[3]&0x20) || (dest[5]&0x80) || dest[6] > 1) return false;
//_logBase64(toBase64(dest)); //outputs the unpacked module for further saving
	return true
}
if(!bDetected && isUltima6M()) {
	sName = 'Ultima 6 Adlib module (.M)'; sOption('unpsz:'+unpsz+' sz:'+outSz(sz)); bDetected = 1
}


function isQuartetST() {
	if(!isWithin(X.U16(0,_BE),4,0x10)) return false;
	if(!isWithin(X.U16(2,_BE),8,0x20)) return false;
	if(!isWithin(X.U16(4,_BE),4,0x30)) return false;
	if(!isWithin(X.U8(6),1,4) || !X.c("0400000000",7)) return false;
	if(!X.c("'WT'",0xC) && X.U32(0xC,_BE)) return false;
	if(!isWithin(X.U8(0x17),3,0x77)) return false;
	if((t=X.U32(0x18,_BE)) > 0x4C || (t&3)) return false;
	sz = 0x10; var szlim = Math.min(X.Sz(),0xFFFF); x = 0;
	for(p=0x1C; p < Math.min(X.Sz()-1,0x400); p+=12) if(!isWithin(X.U16(p,_BE),0x46,0x6C)) return false;
	while(sz < szlim) {
		if(!X.c("0056",sz)) break; x++;
		for(i=0; i < 4; i++) for(sz += 2; sz < szlim; sz+=2) if(X.c("0046",sz)) break;
		sz += 0xC;
		break //TODO? Fugue.4v or Sweet Dreams.4v have more info after the 4 iterations, but it looks funny there
//_log(Hex(sz))
	}
	spd0 = X.U16(0xE,_BE);
	return !x || sz <= szlim
}
if(!bDetected && isQuartetST()) {
	sName = "Illusions/Microdeal Quartet module (QTS.+SMP., .4V+.SET)";
	sVersion = "samples"; bDetected = 1;
	if(X.isVerbose()) {
		//if(x > 1) sOption(x,'voices?'); //TODO for the same reason
		sOption((spd0?'spd0:'+spd0+' ':'')+'sz:'+outSz(sz))
	}
}


function isSQDigitalTracker() {
	//ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/digital/sqdigitaltracker.cpp
	if(X.Sz() < 0x4400) return false;
	if(X.U8(0x100) != 0x7C &&  X.U8(0x11F) != 0x7C) return false; //title surrounded by | |
	if(charStat(X.readBytes(0x100,0x20),1).indexOf('allasc') < 0) return false;
	if(X.U8(0x204) != 0xFF) return false;
	tempo = X.U8(0x210); if(!isWithin(tempo,2,10)) return false;
	ord = X.U8(0x212)+1; if(!isWithin(ord,1,0x65)) return false;
	loop = X.U8(0x211); if(loop >= ord) return false;
	if(charStat(X.readBytes(0x300,0x80),1).indexOf('allasc') < 0) return false;
	sz = 0x4000; //var regions = [];
	for(i=0; i < 8; i++) { // check layouts, calc size
		if(X.U8(0xC0+i*4)) return false; //address, lower byte
		if(!isWithin(X.U8(0xC0+i*4+1),0x80,0xC0)) return false; //address, higher byte
		if(!isWithin((bnk=X.U8(0xC0+i*4+2)),0x58, 0x5F)) return false; //bank
		if(!isWithin((sec=X.U8(0xC0+i*4+3)),1,0x80)) return false; //sectors
		var lst = X.U16(0xC0+i*4), lsz = sec << 8; bnk &= 7;
		//if(lst >= 0xC000 && lst+lsz <= 0x10000) regions[bnk] = [sz, lsz];
		sz += lsz
	}
	if(sz > X.Sz()) return false;
	sz += 0x400; // data at the end; tracker settings? nobody'll miss it, but...
//_l2r('sqd',0x4400,'regions:'+outArray(regions,16))
	title = X.SC(0x101,0x1E,"CP1251").trim();
	for(i=smp=0; i < 0x10; i++) { //sample info parser
		if(X.U8(0x120+i*8+4) > 1) return false;
// 			var rst = X.U16(0x120+i*8), rlp = X.U16(0x120+i*8+2);
// 			if(rst < 0x8000 || rst < rlp) continue;
// 			bnk = X.U8(0x120+i*8+5) & 7; var smpbase = rst < 0xC000? 0x8000: 0xC000;
// //_l2r('sqd',0x120+i*4,'used bank #'+bnk+' at '+Hex(rst)+'..'+Hex(rlp))
// 			if(typeof regions[bnk] != "undefined") {
// 				smp++;
// 				var ssz = Math.min(0x10000-rst,regions[bnk][1]), sp = regions[bnk][0] + rst - smpbase;
// 			}
	}
	for(i=ptn=0; i < 100; i++) if((t = X.U8(0x1A0+i)) > 0x1F) return false;  else if(ptn < t) ptn = t;
	ptn++;
	return true
}
if(isSQDigitalTracker()) {
	sName = "SQ Digital Tracker module (.SQD,.M)"; bDetected = 1;
	if(X.isVerbose()) {
		sOptionT(title); sOption('tempo:'+tempo+' ord:'+ord+(loop?' loop:'+loop:'')+' ptn:'+ptn+' sz:'+outSz(sz));
	}
}


function isSAS() {
	//from the eagleplayer RE
	if(X.U8(0) || !X.c("00000200",0xC)) return false;
	for(p=0x10,ptn=0; p < 0x1010; p += 2) { //orderlist?
		if(X.I32(p) == -1) break; if(X.U8(p)) return false; if(X.U8(p+1) > ptn) ptn = X.U8(p+1)
	}
	ptn++; ord = (p-0x10) >> 3; d2 = p; p = 0x1010 + ptn*0x30;
	while(p < Math.min(X.Sz(),0x30000)) { if(X.U32(p,_BE)) break; p += 4 }
	if(!X.c("'FORM'........'8SVXVHDR'",p+0x280)) return false;
	smptp = p; smp = 0; smps = '';
	for(i=0x20,sz=0; i--; p+=4) { //q for smpstart, p for smpsz?
		if(!X.U8(p)) {
			var sp = smptp+X.I32(p,_BE), ssz = X.I32(p+0x80,_BE);
			if(sp < 0x280 || !X.c("'FORM'........'8SVXVHDR'",sp)) return false;
			smp++; if(sp+ssz > sz) sz = sp+ssz;
			//if((t=X.fSig(sp,0x30,"'NAME'00")) > -1) smps = smps.appendS(X.SA(t+8,X.U32(t+4,_BE)),' ') //not much to show
		}
	}
	return true
}
if(!bDetected && isSAS()) {
	sName = "Michael Winterberg's Speedy A1 System module (.SAS)"; bDetected = 1;
	if(X.isVerbose()) {
		//sOption(smps,'smps:"','"');
		sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz))
	}
}


function isMFP() {
	// from the binary eagleplayer REing (it's actually different for some reason)
	// ref https://gitlab.com/uade-music-player/uade/-/raw/master/amigasrc/players/wanted_team/MagneticFieldsPacker/src/Magnetic Fields Packer_v3.asm
	if(X.Sz() < 0x17E || !isWithin(ord=X.U8(0xF8), 1, 0x7F) || X.U8(0xF9) != 0x7F) return false;
	var x17a = X.U16(0x17A,_BE); p = 0x179; allsmpsz = 0;
	if(x17a != X.U16(0x17C,_BE) || x17a != ord) return false;
	ord_ = -1; ptn = 0;
	for(; p > 0xF9; p--) { if((o=X.U8(p)) > 100) return false; if(o && ord_ < 0) ord_ = p-0xF9; if(o >= ptn) ptn = o+1 }
	if(ord_ < 0) ord_ = 1;
	for(p=smp=i=0; i < 31; i++, p += 8) if(ssz=X.U16(p,_BE)) { smp++; allsmpsz += ssz } allsmpsz <<= 1;
	for(p=0x17E,i=m=0; i < x17a*4; i++,p+=2) m = Math.max(m,X.U16(p,_BE));  p += m;
	//the source and player diverge from here, I mix them together
	if(ptn == 1) for(t=X.U16(p-2,_BE),p+=2; p < X.Sz(); p += 2) if(X.U16(p-2,_BE) == t) return true; //from src
	//from bin:
	for(q=p,m=0; q < p+4; q++) m = Math.max(m,X.U8(q)); //@e4b2, ofs 4ca+
	for(a3=p+m+4,m=0; q < a3; q++) m = Math.max(m,X.U8(q)); //@e4c4 ofs 4e2+
	for(a3=p+m+4,m=0; q < a3; q++) m = Math.max(m,X.U8(q)); //@e4d6 ofs 4e2+
	p += m*2+4; songsz = p;
	// back to src which continues where the bin left off:
	while(X.c("04040404 08080808",p) && p < 0xFFFF) p += 0x10;
	return true
}
if(!bDetected && isMFP()) {
	sName = "Shaun Southern's Magnetic Fields Packer module (.MFP+.SMP)"; bDetected = 1;
	//without the smp file, the smp.*.set will be used
	if(X.isVerbose()) {
		sOption('ord:'+ord+(ord != ord_? '/'+ord_: '')+' ptn:'+ptn+' smp:'+smp
			+' smpsz:'+allsmpsz+' songsz:'+songsz+' sz:'+outSz(p))
	}
}


function isADL() {
	//ref https://github.com/adplug/adplug/blob/master/src/adl.cpp -> CadlPlayer::load
	// & https://www.vgmpf.com/Wiki/index.php?title=ADL_(Westwood)
	if(X.Sz() < 720) return; //v1 min. size
	// Active Pointers, Zeroes and Invalid Chars are heuristics to filter out random sparse files in the obscurity that is ADL
	// There must be at least some active pointers, and too many zeroes at prog start is suspicious. IC is when a prog doesn't start on a well-expected byte
	p = ap = z = ic = 0;
	nV = 4;
	ofs = 500; //track entries
	for(; p < ofs; p+=2) { //500=1F4h is the trackentries buffer
		if(nV == 4 && isWithin(w = X.U16(p), 0x1F4,0xFFFE)) { //in v4, all entries are either within 500 or FFFF
if(debug>1)_logIt('@'+Hex(p)+': '+Hex(w))
			nV = 3 /*or less*/; ofs = X.c("6C776DFFFFFF6E6F",0x78) ? 250 : 120 // 78h, or FAh just for loresfx.adl
		}
	}
	const M = Math.min(0xFFFF+ofs,X.Sz());
	p = ofs;
// v1: EoB; v2: EoB2, Kyr1, Dune2; v3: LandsOfLore, Kyr2
// _trackEntries[]      _soundData[]   -- program/instrument offsets are ofs-relative
// | pt ids (ord?) | Program pt: sound/music tracks | Instrument pt: adlib ins | Trk data | Ins data |
// v1:   120 bytes          | 150 words         | 150 words     | @2D0h
// v2: 120 bytes          | 250 words         | 250 words     | @460h
// loresfx.adl: 250 bytes | 250 words     | 250 words    | @4E2h
// v3:   250 words          | 500 words         | 500 words     | @9C4h

//if(debug>0)_logIt('  v'+nV+' ofs:'+ofs+'/'+Hex(ofs))
	// test prog offsets: start with the first 150
	if(nV < 4) {
		nprog = 150; //for v1
		for(i=0; i < nprog; i++) {
			w = X.U16(p); p += 2;
			if(w && w != 0xFFFF) { ap++;
				if(w < 1000) { nV = 1; if(X.U16(0x78) != 0x258 /*in v1, the 0th prog always starts at 2D0*/) return }
				if(!isWithin(w, 600,M)) { if(debug>0)_logIt('!w='+w+'<600 or > sz'); return }
				w += ofs; y = X.U8(w);
				if(y != 0x8E && y > 9) { // progs always start with 1~9 or, seldom, 0 or 8E
//if(debug>1)_logIt('!v'+nV+'@'+Hex(p-2)+': ['+Hex(w)+'] = '+Hex(y))
					z++
				}
			}
		}
//if(debug>0)_logIt('  v'+nV+'@'+Hex(p))
		// check the rest of the program offsets:
		if(nV > 1) {
			if(X.Sz() < 1120) return; //v2/3 min. size
			nprog = 250; p = ofs+300;
			for(i=150; i < nprog; i++,p+=2) {
				w = X.U16(p);
				if(w && w != 0xFFFF) { ap++;
					if(!isWithin(w, 1000,M)) { if(debug>0)_logIt('!w='+w+'<1000 or > sz'); return }
					w += ofs; y = X.U8(w);
					if(!y) z++;
					if(y != 0x8E && y > 9) {
//if(debug>1)_logIt('!v'+nV+'@'+Hex(p)+': ['+Hex(w)+'] = '+Hex(y))
						ic++
					}
				}
			}
		}
//if(debug>0)_logIt('v'+nV+'@'+Hex(p)+' ')
	} else { //v4
		if(X.Sz() < 2500) return;
		nprog = 500; p = ofs;
		for(i=0; i < nprog; i++,p+=2) {
			w = X.U16(p);
			if(w && w != 0xFFFF) { ap++;
				if(!isWithin(w, 2000,M)) { if(debug>0)_logIt('!w='+w+'< 2000 or > sz'); return }
				w += ofs; y = X.U8(w);
				if(!y) z++;
				if(y != 0x8E && y > 9) {
//if(debug>1)_logIt('!v'+nV+'@'+Hex(p)+': ['+Hex(w)+'] = '+Hex(y))
					ic++;
				}
			}
		}
	}
	// also test ins offsets and find the max one+11 = filesize:
	for(mw=i=0,mo=(nprog<<1)+ofs; i < nprog; i++,p+=2) {
		w = X.U16(p);
		if(w && w != 0xFFFF) { ap++;
			w += ofs;
//if(debug>1)_logIt('@'+Hex(p)+': ['+Hex(w)+'] = '+Hex(X.U8(w)))
			if (!isWithin(w, mo,X.Sz())) { if(debug>0)_logIt(!'@'+Hex(p)); return; }
			mw = Math.max(mw,w)
		}
	}
	sz = mw+11; if(sz < 6900) return;
	ptn = [];
	if(nV == 4) { for(p=0; p < 500; p+=2) if(isWithin(y=X.U16(p),1,0xFFFE)) if(!ptn.includes(y)) ptn.push(y); }
	else for(p=ofs; p < 250; p+=2) if(isWithin(y=X.U16(p),1,0xFFFE)) if(!ptn.includes(y)) ptn.push(y);
	ptn = ptn.length;
if(debug>0)_log('@'+Hex(p)+' v:'+nV+' ic:'+ic+' zeros:'+z+' ap:'+ap+' ptn:'+ptn)
	return ic < 5 && z < 50 && ap > 1 // heuristics
}
if(!bDetected && isADL()) {
	sType = 'audio'; sName = "Westwood ADL module (.ADL)"; bDetected = 1;
	if(ofs == 250) sVersion = 'v.sfx'; else sVersion = 'v'+[,'1','2','2','3'][nV];
	
	if(X.isVerbose()) sOption('ptn:'+ptn+' sz:'+outSz(sz))
}


function isFLS() {
	//from https://ay.strangled.net/Ay_Emul30.src.7z/Players.pas -> FoundFLS
	if(X.Sz() < 0x34) return;
	var orda, ptna, smpa, p, cura, mp, maxd, dif, i, j;
	function re(m) { if(debug>0)_log('[isFLS]@'+Hex(p)+': '+m); return }
	function ValidSmpP() { return p >= 12 + orn*2 && !((p - orn*2) % 6) }
	function ValidSmpParams(o) {
		var lp = X.U8(o), lpsz = X.U8(o+1); if(lp > 0x20) return;
		if(!lp) { if(!isWithin(lpsz, 1,0x20)) return; } else if(!isWithin(lpsz, 1,0x21-lp)) return;
		return true
	}
	ordp = X.U16(0); ornp = X.U16(2); smpp = X.U16(4);
	orn = smpp-ornp; if(!isWithin(orn, 0,30) || orn % 2) return;
	orn >>= 1; orda = ordp; smp = ordp-smpp;
	if(smp <= 0 || smp > 16*4 || smp % 4) return;
	smp >>= 2; ptna = X.U16(6); ord = ptna-orda-1; if(!isWithin(ord, 1,256)) return;
	if(X.Sz() < 12+ord+1+36*smp+34*orn+3-1) return;
	p = 6; mp = 6+orn*2+smp*4;
	maxd = X.Sz()+1-mp; mp += 31*6;
	if(mp > X.Sz()+1-ord-1-3) { mp = X.Sz()+1-ord-1-3; if(mp % 2) --mp; }
	while(p < mp) {
		cura = X.U16(p); dif = cura-orda;
		if(!isWithin(dif, 1,maxd)) break;
		if(ValidSmpP() && p+6 < mp && ValidSmpParams(p)) {
			smpa = X.U16(p+2);
			if((!orn || smpa-X.I16(p-2) == 32) &&
				( smp == 1 && orda-smpa == 32*3 || 
				  smp > 1 && ValidSmpParams(p+4) && X.I16(p+6)-smpa == 32*3
				)
			) break;
		}
		if(cura < ptna) return re('!cura < ptna: '+Hex(cura)+' < '+Hex(ptna));
		p += 2;
	}
	if(!ValidSmpP()) return re('!post-cycle invalid smp ofs');
	mp = p+smp*4; if(mp > X.Sz()+1-ord-1-3) return;
	maxd = X.Sz()+1-mp;
	var ic = 0; //heuristic time
	for(i=0; i < smp; i++,p+=4) {
		if(!ValidSmpParams(p)) ic++; if(ic > 1) return re('!badsmpparams');
		cura = X.U16(p+2); dif = cura-orda; if(!isWithin(dif, 1, maxd)) return re('!bad cura-orda');
	}
	for(i=0; i < ord; i++,p++) if(!isWithin(X.U8(p), 1,31)) return re('!badpos');
	if(X.U8(p)) return re('!badordendmarker');
	j = ptna-p-1;
	if((ornp-j) % 2 || (smpp-j) % 2) return re('!odd orna or smpa');
	orda -= j; if(orda % 2) return re('!odd orda');
	sz = X.U16(orda-2)+0x60-j;
	if(sz <= orda) return re('!size<=orda');
	return true;
}
if(!bDetected && isFLS()) {
	sName = "Amadeus Voxon/Flash Inc.'s Flash Tracker module (.FLS)"; bDetected = 1;
	if(X.isVerbose()) {
		sOption('ord:'+ord+' ptn:'+ptn+' smp:'+smp+' orn:'+orn+' sz:'+outSz(sz))
	}
}



//the following signature detectors seem shaky to me [Kae] so they're heuristic and in parallel
//use _setResult(TYPE, NAME, VERSION, OPTIONS)

if(X.isHeuristicScan()) { //parallel block

	// Let's start with just judging by the extensions:
	if(extIs("imf") || extIs("wlf")) { //a detector is quite impossible to produce...
		if(extIs("imf"))
			freq = "560Hz (or 280Hz if Duke Nukem II)";
		else
			freq = "700Hz";
		_setResult("~audio","id/Apogee Music Format chiptune (.IMF)","","freq: "+freq);
	}
	else if(extIs("svar") && X.c("'PK'")) { //TODO detect in-zip
		_setResult("~audio","SVArTracker module (.SVAR)","","");
	}

	//these are compares at 0, so they can be non-parallel, to optimise it all
	if(X.c("8400")) {
		if(X.U8(2) == 0xF0) sversion = "adv."; else sversion = "";
		_setResult("~audio","Sierra Adlib chiptune (.SCI)",sversion,"")
	}
	else if(X.c("1C52")) {
		_setResult("~audio","Sound Interface System module (.LEM)","","")
	}
	else if(X.c("'NED'")) {
		_setResult("~audio","Nerd Tracker ][ module (.NED)","","")
	}
	else if(X.c("'MODU'"))
		_setResult("~audio","NovoTrade Packer module (.NTP)","",X.isVerbose()?X.SA(4,16):'');
	else if((X.c("'Ice!'") || X.c("'ICE!'"))) {
	//TODO find a sanity check to narrow it down, then move it to the other sanities
		dsize = X.U32(8,_BE);
		_setResult("~audio","Atari ST module (.SND,.SNDH)","compressed",X.isVerbose()? "orig.sz:"+dsize+" sz:"+outSz(X.U32(4,_BE)): '')
	}

	function isVortex1() {
		//ref https://ay.strangled.net/Ay_Emul30alpha11.src.7z / Formats.pas
		// & https://f.rdw.se/AY-3-8910-datasheet.pdf
		hdr = X.SA(0,2);
		if(['AY','YM','ay','ym'].indexOf(hdr) < 0 || X.U8(2) > 6) return false;
		hasyear = ['AY','YM'].indexOf(hdr) < 0; yr = 0;
		if(hasyear) {
			yr = X.U16(0xA,_LE);
			if(yr && (yr < 1980 || yr > 2050)) return false;
		}
		unpsz = X.U32(hasyear?0xC:0xA,_LE);
		if(unpsz < 2 || unpsz > 0xA00000) return false; // maxsize set a bit up from enlight '97 megamix.vtx
		chipfrq = X.U32(5,_LE); if(chipfrq < 800000 || chipfrq > 4000000) return false; //2M would be ok
		intfrq = X.U8(9);
		return true
	}
	if(isVortex1()) {
		if(!X.U8(2)) sversion = "1ch"; else sversion = "2ch";
		switch (hdr) {
			case 'AY': case 'ay': sversion += " AY-3-8910/12"; break;
			case 'YM': case 'ym': sversion += " YM2149"; break;
			default: sversion += " unk.chip" // never reached
		}
		if(X.isVerbose()) {
			p=hasyear?0x10:0x0E; t = X.SC(p,Math.min(256,X.Sz()-p),'CP1251'); sOptionT(t);
			p+=t.length+1; a = X.SC(p,Math.min(256,X.Sz()-p),'CP1251'); sOptionT(a,"by:");
			p+=a.length+1; if(hasyear) {
				if(yr) sOption(yr,"'");
				pr = X.SC(p,Math.min(256,X.Sz()-p),'CP1251'); p+=pr.length+1;
				sOptionT(pr,"for:");
				tn = X.SA(p,Math.min(256,X.Sz()-p)); sOptionT(tn,"in:"); p+=tn.length+1;
				c = X.SA(p,Math.min(256,X.Sz()-p)); sOptionT(c); //p+=c.length+1;
			}
			sOption((X.U8(2)&7).toString(2).padStart(3,'0'),"mode:");
			sOption(chipfrq,"chip freq:","Hz"); sOption(intfrq,"int.freq:","kHz")
			t = Util.div64(unpsz,intfrq*14); sOption("time:"+secondsToTimeStr(t));
			loop = X.U16(3,_LE); if(loop) sOption(loop,"loop:");
		}
		_setResult("~audio","Vortex Project chiptune (.VTX)",sversion,sOptions); sOptions = ""
	}


	function isMXDRVPDX() {
		// the format is very very very basic so FPs happen
		//and it's not possible to test more
		//the first bytes until the first sample starts are a table of addresses and sizes of the samples
		// (if the address is 0 just skip it),
		// then the samples go. That's all.
		// the table can be tons of bytes long, much longer than the max reasonable 800h
		if(X.Sz() < 0x300 || X.Sz() > 0x4000+0xFFFFFF) return false;
		sz = en = 0; var oldendp  = nonzeroaddr = -1, smpst = 0xFFFFFFFF, ptrs = []; sus = 0; bad = '';
		for(i=0; i*8 < (smpst == 0xFFFFFFFF? 0x300: Math.min(smpst,X.Sz())); i++) {
			var p = X.U32(i*8,_BE), s = X.U32(i*8+4,_BE);
			if(!p) continue;
//if(p < i*8) _l2r('pdx',p,i+'*8 is higher?!');
			if(p < i*8 || s > 0xFFFFF) return false;
			if(nonzeroaddr < 0) nonzeroaddr = i;
			if(smpst > p && p >= 0x300) smpst = p;
			oldendp = p+s; ptrs.push([p,s]);
			en++;
			if(p+s > sz) sz = p+s
		}
		if(!en || findGaps(ptrs,2).length > 4) return false;
		ptrs = ptrs.sort(function (a, b) { if(a[0] != b[0]) return a[0]-b[0]; else return a[1]-b[1] });
//if(ptrs[0][0] % 8 || !isWithin(ptrs[0][0],0x300,0x4000)) _l2r('pdx',i*8,'!smpst='+Hex(ptrs[0][0]));
		if(ptrs[0][0] % 8 || !isWithin(ptrs[0][0],0x300,0x4000)) return false;

//_l2r('pdx',sz,outArray(findGaps(ptrs,2),16))
		return true
	}
	if(isMXDRVPDX()) {
		sversion = ''; if(sz > X.Sz() && !X.isVerbose()) bad += '!short';
		if(bad.length) sversion = sversion.appendS('malformed'+bad+(sus?'sus'+sus:''),'/');
		_setResult("~audio","Konami's MXDRV PCM resource (.PDX)", sversion,
			X.isVerbose()? 'entries:'+en+' sz:'+outSz(sz): '')
	}


	function isKDM() {
		// ref http://advsys.net/ken/kdmsongs.zip/KDMSRC.ZIP/kdmwin/KDMENG.C
		if(X.Sz() < 12) return false;
		if(X.U32(0,_LE)) return false; //kdmversionum
		numnotes = X.U32(4,_LE); if(!numnotes || numnotes > 8192) return false;
		numtracks = X.U32(8,_LE); if(!numtracks || numtracks > 256) return false;
		sz = 12+numtracks*4+numnotes*11;
		if((sz != X.Sz()) && (sz != X.Sz()+numnotes)) return false;
		return true
	}
	if(isKDM()) {
		if(sz > X.Sz()) sversion = "no panning effects"; else sversion = "";
		_setResult("~audio","Ken Silverman's Digital Music module (.KDM)",sversion,X.isVerbose()? "trk:"+numtracks+" notes:"+numnotes: '');
	}


	function isDigitalStudio() {
		//ref https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/digital/digitalstudio.cpp
		if(X.Sz() < 111104) return false;
		lp = X.U8(0); if(lp > 63) return false;
		ptn = 0;
		for(i = 1; i < 100; i++) { pt = X.U8(i); if(pt > 0x1F) return false; if(pt > ptn) ptn = pt } ptn++;
		tmp = X.U8(0x64); ord = X.U8(0x65); if(!ord || ord > 100) return false; if(lp > ord) return false;
		title = X.readBytes(0x66,28); for(i=0; i < 28; i++) if(title[i] < 0x20 || title[i] > 0x7F) return false;
		title = decEncoding(title,CPSpeccy);
		compiled = !isAllZeroes(0xC8,0x38); allsmp = smp4bit = 0;
		smps = [];
		for(p=0x100; p < 0x200; p += 0x10) {
			var sst = X.U16(p), stlp = X.U16(p+2), spage = X.U8(p+4), sninbank = X.U8(p+5), ssz = X.U16(p+6);
			for(i=8; i < 16; i++) if(X.I8(p+i) < 0x20) return false;
			t = decAnsi(p+8,8,CPSpeccy,false).trim(); if(t != '') smps.push(t)
		}

		return true;
	}
	if(isDigitalStudio()) {
		sname = "Underground Systems Digital Studio module (.DST)";
		sversion = compiled?'compiled':'';
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(smps.filter(funSampleName).join(' '),'smp/msg:"','"');
			sOption('ord:'+ord+' ptn:'+ptn+(lp?' loop:'+lp:'')+' page0:'+X.U8(0x200)+' sz:'+outSz(compiled?0x1C200:0x1B200))
			soption = sOptions; sOptions = ''
		} else soption = '';
		_setResult("~audio",sname,sversion,soption)
	}


	function isExtremeTrackerZX() {
		//from https://bitbucket.org/zxtune/zxtune/src/develop/src/formats/chiptune/digital/extremetracker1.cpp
		if(X.Sz() < 112640) return false;
		if((lp = X.U8(0)) > 63) return false;
		if((tmp = X.U8(1)) < 3 || tmp > 0xF) return false;
		if((ord = X.U8(2)) > 64) return false;
		title = X.readBytes(3,30); for(i=0; i < 30; i++) if(title[i] < 0x20 || title[i] > 0x7F) return false;
		title = decEncoding(title,CPSpeccy);
		ptn = 0;
		for(p = 0x22; p < 0x86; p++) { if((pt = X.U8(p)) > 0x1F) return false; if(pt > ptn) ptn = pt } ptn++;
		for(; p < 0xA6; p++) { var ps = X.U8(p); if(ps < 4 || ps > 0x40) return false }
		var qstvw = [0x51,0x53,0x54,0x56,0x57];
		for(i=0; p < 0xBA; i++, p += 4) {
			if(X.U8(p) > 0x7C) return false; if(X.U8(p+1) != qstvw[i]) return false;
			if(X.U8(p+2) && X.U8(p+2) < 0x84) return false; if(X.U8(p+3) > 0x10) return false
		}
		var sus = 0; for(p=0xBC; p < 0xCB; p++) if(X.U8(p)) sus++; if(sus > 3) return false;
		var sig = X.readBytes(0xCB,0x35,true); if(charStat(sig,true).indexOf('allasc') <= 0) return false;
		if(X.U8(0xFF)) return false;
		smps = [];
		for(p = 0x100; p < 0x200; p+= 0x10) {
			if(qstvw.indexOf(X.U8(p+4)) < 0) return false;
			if(X.U8(p+5) > 0x10) return false; if(X.U8(p+6) > 0x7C) return false;
			t = X.readBytes(p+8,8); for(i=0; i < 8; i++) if(t[i] < 0x20 || t[i] > 0x7F) return false;
			t = decEncoding(title,CPSpeccy).trim(); if(t != '') smps.push(t)
		}
	}
	if(isExtremeTrackerZX()) {
		sname = "Red Limited's Extreme Tracker module (.ET1)";
		if(X.isVerbose()) {
			sOptionT(title); sOptionT(smps.filter(funSampleName).join(' '),'smp/msg:"','"');
			sOption('tmp0:'+tmp+' ord:'+ord+' ptn:'+ptn+(lp?' loop:'+lp:'')+' sz:'+outSz(112640))
			soption = sOptions; sOptions = ''
		} else soption = '';
		_setResult("~audio",sname,sversion,soption)
	}


	function isMON() {
		if(!X.c("4EFA....4EFA....4EFA")) return false;
		var t = X.U16(2,_BE); if (t > X.Sz() - 10) return false;
		return X.c("4BFA.... 08AD 0000",t+2)
	}
	if(isMON())
		_setResult("~audio","Jeroen 'WAVE' Tel & Charles Deenen's Maniacs of Noise module (.MON)","","")


	function isJHSTSMP() {
		if(X.Sz() < 0x80) return false;
		oldp = smp = 0;
		for(i = 0; i < 0x80; i += 8) {
			p = X.U16(i,_BE); if(p > X.Sz()) return false;
			if(p) { if(p < oldp) return false; oldp = p; smp++ }
			if(!X.c("0010 01000000",i+2) && !X.c("0000 00000000",i+2)) return false;
		}
		if(smp < 8) return false; // I only saw files with at least 10
		return true
	}
	if(isJHSTSMP()) _setResult("~audio","Jochen 'Mad Max' Hippel's Atari ST sample set (SMP.set)","",
			X.isVerbose()? "smp:"+smp+" sz:"+outSz(oldp): '')


	function isV2M() {
		//ref https://github.com/farbrausch/fr_public/blob/master/v2/v2mplayer.cpp ::InitBase
		//with kind commentary from Tammo "kb" Hinrichs
		notes = chs = 0;
		if(X.Sz() < 480) return false;
		timediv = X.U32(0,_LE); if(!timediv || [0x60,0x80,480].indexOf(timediv) < 0) return false; //empirical
		maxtime = X.U32(4); if(!maxtime) return false;
		gdnum = X.U32(8); if(!gdnum) return false;
		p = 12+10*gdnum; var pcs = pbs = ccs = 0;
		for(ch=0; ch < 16; ch++) {
			notenum = X.U32(p); p += 4; notes += notenum;
			if(notenum > 1000000) return false; // nobody'll write a million-note synth epic, will they @_@
			if(notenum) { chs++;
				p += 5*notenum; if(p > X.Sz()) return false;
				pcnum = X.U32(p); pcs += pcnum; p += 4+4*pcnum; //pgm change events
				pbnum = X.U32(p); pbs += pbnum; p += 4+5*pbnum; //pitch bends
				for(cn=0; cn < 7; cn++) {
					ccnum = X.U32(p); ccs += ccnum; p += 4+4*ccnum; //control changes
				}
			}
			if(p > X.Sz()) return false;
		}
		if(!notes || ccs > notes*50 || pbs > notes*3 || pcs > notes*3 || maxtime < notes) { //*50 & 3 are arbitrary
//_l2r('V2M',p,'notes:'+notes+' pcs:'+pcs+' pbs:'+pbs+' ccs:'+ccs)
			return false }
		size = X.U32(p); if(size > 0x4000) return false; //globals
		p += 4+size; if(p > X.Sz()) return false;
		size = X.U32(p); if(size > 0x100000) return false; //patchmap
		p += 4+size; if(p > X.Sz()) return false;
//_l2r('V2M',p,'speech -> '+Hex(p+4+X.U32(p)))
		spsize = X.U32(p); p += 4; if(spsize < 0x2000) {
			for(i=p+4,q=X.U32(p)*4,t=Math.min(X.Sz,p+4+q); i < t; i+=4) if(!isWithin(X.U32(i), q, p-4+spsize)) return false;
			p += spsize //speech size -- except tons of files are shorter than that, so we'll read the pointers!
		}
		sz = p; return true;
	}
	if(!bDetected && X.isDeepScan() && isV2M()) {
		sName = "farbrausch V2 Synthesizer module (.V2M)"; bDetected = 1;
		if(X.isVerbose())
			sOptions = 'ch:'+chs+' notes:'+notes+' timediv:'+timediv+' maxtime:'+maxtime
				+(spsize?' syn.speech':'')+' sz:'+outSz(sz);
	}


	function isTwinTeam() {
		if(!X.c("01000000", 0x06) || X.Sz() < 1500 || X.Sz() > 9000 || X.calculateEntropy(12,1200) < 7.8)
			return false; //a quick check because that's a lot of algo
		//ideally, get the checks from https://github.com/adplug/adplug/blob/master/src/dmo.cpp
		return true
	}
	if(isTwinTeam()) {
		_setResult("~audio","TwinTeam's Twin Trackplayer module (.DMO)","",X.isVerbose()?'unp.sz:'+X.U16(0xC):'')
	}


	function isVoices_8() { //this is a WIP until someone manages to test the tracker without it freezing up on I/O
		soption = ''; smp = ptn = smpsz = 0;
		for(i=0; i < 0x20; i++) {
			if(charStat(t=X.readBytes(i*0x20,0x10),1).indexOf('allxsc') < 0) return false;
			var c = t.indexOf(0); if(!c) continue; if(c < 0) return false;
			for(j=15; j > c && !t[j];) j--; if(j > c) return false;
			var ssz = X.U32(i*0x20+0x14,_BE); if(ssz) { smpsz += ssz; smp++ }
			}
		tmp0 = X.U8(0x480); ord = X.U8(0x481); if(!smpsz || !tmp0 || tmp0 > 0xF || !ord || ord > 0x80) return false;
		for(i=0; i < ord; i++) if((t=X.U8(0x482+i)+1) > ptn) ptn = t;  if(ptn > 32) return false;
		for(; i < 128; i++) if(X.U8(0x482+i)) return false; sz = 0x502+ptn*0x800+smpsz;
		if(X.Sz() < sz) return false;
		soption = 'tmp0:'+tmp0+' ord:'+ord+' ptn:'+ptn+' smp:'+smp+' sz:'+outSz(sz);
		return true
	}
	if(isVoices_8())
		_setResult("~audio","SHINING 8's Voices_8/8CHNL Soundtracker module",'',X.isVerbose()?soption:'')


	function isHSC() {
		//ref https://github.com/libxmp/libxmp/blob/master/src/bitrot/loaders/hsc_load.c
		// & https://github.com/libxmp/libxmp/raw/refs/heads/master/docs/formats/hsc.txt
		if(X.Sz() < 1587+1152 || X.Sz() > 59187+1) return;
		if(isAllZeroes(0,127*12)) return;
		p = t = ic = 0;
		//a heuristic run on lots of HSCs dictates these things:
		const
		  rangesb01 = [[0x0A,0x0D], [0x17,0x0E], [0x23,0x26], [0x29,0x2D], [0x3A,0x3F], [0x45,0x50],
			[0x5A,0x5E], [0x69,0x6B], [0x75,0x77], [0x7A,0x7D], [0x83,0x85], [0x89,0x8A], [0xB3,0xBF], [0xD3,0xDF], [0xFA,0xFE]],
		  rangesb2 = [[0x1B,0x1C], [0x21,0x2F], [0x34,0x3E], [0x41,0x47], [0x49,0x54], [0x5A,0x5E], [0x66,0x72],
			[0x75,0x7F], [0x81,0x87], [0x89,0xBF], [0xC9,0xCF], [0xD1,0xDF]],
		  rangesb3 = [[0x2B,0x2E],, [0x36,0x3E], [0x45,0x4C], [0x51,0x57], [0x59,0x67], [0x69,0x6C], [0x6E,0x71], [0x76,0x80],
			[0x88,0x8F], [0x9D,0xAF], [0xB1,0xBF], [0xC1,0xC9], [0xCB,0xCF]],
		  rangesb4 = [[1,5], [7,0x10], [0x15,0x1E], [0x27,0x2C], [0x39,0x3E], [0x45,0x4F], [0x57,0x5F], [0x69,0x6D], [0x8A,0x8E],
			[0x9A,0x9F], [0xAC,0xB0], [0xB9,0xBF], [0xC7,0xD1], [0xD7,0xDF], [0xE8,0xEF], [0xFA,0xFD]],
		  rangesb5 =[[1,0xF], [0x19,0x1E], [0x27,0x2E], [0x37,0x3F], [0x49,0x4F], [0x58,0x5F], [0x6A,0x6E], [0x78,0x7F], [0x89,0x8F],
			[0x9A,0x9F], [0xAC,0xAE], [0xBA,0xC6], [0xC9,0xD2], [0xD5,0xE3], [0xEA,0xEE], [0xFA,0xFC]],
		  rangesb6 = [[0xA,0xE], [0x1B,0x1E], [0x24,0x26], [0x37,0x3A], [0x3C,0x3F], [0x49,0x4E], [0x5A,0x60], [0x6B,0x6E],
			[0x7C,0x7E], [0x80,0x83], [0x8A,0x90], [0x9A,0xA1], [0xA7,0xAF], [0xB1,0xC6], [0xC8,0xCD], [0xCF,0xDC], [0xDE,0xE0],
			[0xE2,0xE6], [0xE8,0xED]],
		  rangesb7 = [[0xC,0xE], [0x19,0x1E], [0x27,0x2E], [0x39,0x41], [0x59,0x5E], [0x6A,0x6E], [0x79,0x7F], [0x8A,0x95],
			[0x9A,0xA5], [0xAB,0xC6], [0xCA,0xCD], [0xD1,0xDE], [0xE0,0xED]],
		  rangesb8 = [[0x12,0x15], [0x17,0x1F], [0x23,0x36], [0x38,0x3F], [0x41,0x4D], [0x4F,0x51], [0x5A,0x60], [0x62,0x68],
			[0x6A,0x6D], [0x6F,0x7E], [0x80,0x93], [0x95,0xF5]],
		  rangesb9 = [[0x10,0x17], [0x19,0x40], [0x42,0x60], [0x65,0x68], [0x6A,0x76], [0x7A,0x90], [0x92,0xB1]],
		  rangesbA = [[0x10,0x1C], [0x21,0x2F], [0x31,0x42], [0x49,0x54], [0x56,0x5D], [0x60,0x6D], [0x6F,0x72],
			[0x74,0x88], [0x78A,0x98]],
		  rangesbB = [[0xA,0xF], [0x12,0x1F], [0x21,0x2F], [0x31,0x36], [0x38,0x3F], [0x45,0x56], [0x58,0x5F], [0x61,0x66],
			[0x68,0x6F], [0x78,0x7F], [0x81,0x96], [0x9A,0xEF], [0xF1,0xFE]];

		for(i=0,m=X.isDeepScan()?127:16; i < m; i++,p+=12) {
			t = X.U8(p); if(isWithinRanges(t, rangesb01) || isWithin(t, 0xA5,0xB1)) ic++;
			t = X.U8(p+1); if(isWithinRanges(t, rangesb01) || isWithin(t, 0x92,0xA7)) ic++;
			t = X.U8(p+2); if(t >= 0xE1 || isWithinRanges(t, rangesb2)) ic++;
			t = X.U8(p+3); if(t >= 0xD1 || isWithinRanges(t, rangesb3)) ic++;
			t = X.U8(p+4); if(isWithinRanges(t, rangesb4)) ic++;
			t = X.U8(p+5); if(isWithinRanges(t, rangesb5)) ic++;
			t = X.U8(p+6); if(isWithinRanges(t, rangesb6)) ic++;
			t = X.U8(p+7); if(isWithinRanges(t, rangesb7)) ic++;
			t = X.U8(p+8); if(t >= 0xF7 || isWithinRanges(t, rangesb8)) ic++;
			t = X.U8(p+9); if(t >= 0xB3 || isWithinRanges(t, rangesb9)) ic++;
			t = X.U8(p+0xA); if(t >= 0x9A || isWithinRanges(t, rangesbA)) ic++;
			t = X.U8(p+0xB); if(isWithinRanges(t, rangesbB)) ic++;
			if(ic > 2) return
		}
		//test the orderlist:
		ptn = ord = x = 0;
//_logIt('@'+Hex(p)+' testing ords='+outArray(X.readBytes(0x600,0x33), 16))
		if(X.U8(0x600) > 0xB1) return;
		visited = []; for(i=0; i < 0x32; i++) visited[i] = false; // prep for the loops
		for(p=0x600; p < 0x633; p++) {
			if(visited[p-0x600]) break; visited[p-0x600] = true;
			if(isInside(t, 0x31,0x80)) t = 0xFF; //pattern out of range = end song
			if((t = X.U8(p)) > 0xB1) break; //rainyday.hsc doesn't have FF
			else if((t & 0x80) && t <= 0xB1) { //løøps
				t &= 0x3F; t += 0x600;
//_logIt('@'+Hex(p)+' -=loop=-')
				if(t > 0x632 || X.U8(t) > 0xB1 || t == p) { if(debug>0)_logIt('@'+Hex(p)+', t:'+Hex(t)+' :: '+Hex(X.U8(t))); return; }
				else p = 0x600+t-1;
			}
			else if(t & 0x80) ic++; else { if(ptn < t) ptn = t;  ord++ }
		}
		for(q=0x632; q > 0x600; q--) if(X.U8(q) == 0xFF) break;
//_logIt('ord:'+ord+' ptn:'+ptn+' last:'+Hex(X.U8(p)))
		if(!ord || !ptn && X.U8(p) != 0xFF) return; if(!x) x++;
		ptn++; if(ptn > 50) return; //test number of patterns
		p = 0x633;  sz = p + ptn*0x480;
		var safeptns = 0;
		for(i=0; i < ptn*0x240 && safeptns < 100; i++) { // just test a hundred patterns to be safe and sure it's a HSC
			n = X.U8(p++); m = X.U8(p++);
			if(n || m) {
				//the same heuristic run on lots of HSCs says these things too:
				if(n >= 0xCA || isWithinRanges(n, [[0x62,0x7E], [0x81,0x8F], [0x91,0xC8]])) return;
//_logIt('@'+Hex(p-2)+' n is within range')
				if(isWithinRanges(m, [[0x38,0x43], [0x45,0x51], [0x56,0x5F], [0x69,0x80], [0x82,0x88], [0x8A,0x9B],
				  [0x9D,0x9F], [0xAA,0xAE], [0xD7,0xDD], [0xDF,0xE6], [0xE8,0xEF], [0xF9,0xFE]])) return;
//_logIt('@'+Hex(p-1)+' m is within range')
				if(isWithin(m, 7,0xF)) if(n != 0x80 /*fmtrk2.hsc should be valid*/) {
					if(n != 0) /*return;*/ ic++; //2.hsc starts with a single broken n = 14h
					} //test effects 07..0F
//_logIt('@'+Hex(p-2)+' test1 passed')
				if(isWithin(m, 0x70,0x9F)) { //test effects 7x..9x
					if(m != 0x81 && m != 0x89) return; //rainyday.hsc should be valid
					ic++;
//_logIt('@'+Hex(p-2)+" test2 IC'ed -> "+ic)
				}
				if(ic > 20) return;
				safeptns++;
			}
		}
//		if(sz > X.Sz()) return;
		//if(sz%2) sz++; // all HSC files are word-aligned like it were Amiga, but it aint. Not sure whether to include
		if(ic) bad = '!ic'+ic;
		return true
	}
	if(isHSC()) {
			var soption = ''; if(X.isVerbose()) {
			if(x > 1) soption = '×'+x;
			soption = soption.appendS('ord:'+ord+' ptn:'+ptn+' sz:'+outSz(sz),', ')
		}
		_setResult("~audio","Hannes Seifert's HSC Adlib Composer/ECR HSC-Tracker module (.HSC)",(bad.length?'malformed'+bad:''),soption)
	}


	function isFMX() {
		if(X.Sz() < Math.max(X.U16(0x1E),0x30)) return false;
		ch = 0; var t;
		for(i=oldp=0; i < 0x10; i++) {
			if(!isWithin(t = X.U16(i*2), Math.max(0x30,oldp),X.Sz())) return false;
			if(i && X.U8(t-1) != 0x80) return false;
			if(X.U8(t) != 0x80) ch++;
			oldp = t
		}
		return true
	}
	if(isFMX()) _setResult("~audio","K.Ohshima's FMX chiptune (.FMX)",'',X.isVerbose()?'ch:'+ch:'');



// these are HEAVY as well as heuristic, so they must come last
	function isGYM() {
		if(X.Sz() < 0x160) return;
		_gyminfo = parseMDGYM(0, X.isDeepScan()? BCParseToEoF: BCParseToReasonable);
if(debug>0)_logIt('gym?'+outArray(_gyminfo,16))
		if(_gyminfo[0] < 0) return;
		return true
	}
	if(isGYM()) _setResult("~audio", "Sega Genesis/Mega Drive YM2612 chiptune (.GYM)", "headerless",
		X.isDeepScan() ? "notes:" + _gyminfo[0] + " sz:"+outSz(_gyminfo[1]) : "");

	function isOPMLog() { // the headerless one's nooooot easy to check
		if(X.Sz() < 0x160) return;
		var tmr;
if(debug>0){ tmr = new CheckpointTimer(); tmr.init(300); }
		_cyminfo = parseYM2151RegLog(0, X.isDeepScan()? BCParseToEoF: BCParseToReasonable);
if(debug>0)tmr.next('OPM (.cym) parsed');
if(debug>0)_logIt('cym?'+outArray(_cyminfo,16));
		if(_cyminfo[0] < 0) return;
		return true
	}
	if(!X.isOverlay() && isOPMLog()) _setResult("~audio","YM2151 OPM/Callus chiptune (.CYM)","headerless",
		X.isDeepScan() ? "notes:" + _cyminfo[0] + " sz:"+outSz(_cyminfo[1]) : "");

	function isAdlibLog() {
		if(X.Sz() < 0x160) return;
		var tmr;
if(debug>0){ tmr = new CheckpointTimer(); tmr.init(300); }
		_opl2info = parseYM3812RegLog(0, X.isDeepScan()? BCParseToEoF: BCParseToReasonable);
if(debug>0)tmr.next('OPM (.cym) parsed');
if(debug>0)_logIt('cym?'+outArray(_cyminfo,16));
		if(_opl2info[0] < 0) return;
		return true
	}
	if(!X.isOverlay() && isAdlibLog()) _setResult("~audio","YM3812/OPL2/Ad Lib chiptune","headerless",
		X.isDeepScan() ? "notes:" + _opl2info[0] + " sz:"+outSz(_opl2info[1]) : "")

} //isHeuristicScan parallel block

	return result();
}
/* beautify ignore:end */


================================================
FILE: db/Binary/audio_8svx.1.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("audio", "8SVX");

function detect() {
    if (Binary.compare("'FORM'")) {
        if (Binary.findString(0, Binary.getSize(), "BODY") != -1 && Binary.findString(0, Binary.getSize(), "FORM") != -1 && Binary.findString(0, Binary.getSize(), "ANNO") != -1) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/audio_ACM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens TG@kaens

meta("audio", "Interplay ACM waveform audio (.ACM)");

function detect() {
    //from https://github.com/dtiefling/snd2acm-portable/blob/master/src/general.h
    if (!File.compare("97280301") || File.getSize() < 0x10) return false;
    var smp = File.read_uint32(4),
        ch = File.read_uint16(8),
        r = File.read_uint16(0xA);

    if (!smp || !isWithin(ch, 1, 2) || !isWithin(r, 6000, 49716)) return false;
    bDetected = true;
    if (Binary.isVerbose()) {
        var sr = (r / 1000).toFixed(1);
        sOption('ch: ' + ch + ' s/r: ' + sr + 'kHz len: ' + secondsToTimeStr(Util.divu64(smp + (r >> 1), r * ch)));
    }

    return result();
}

================================================
FILE: db/Binary/audio_ADX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG@kaens)

meta("audio", "CRI Middleware's ADX 4-bit ADPCM stream (.ADX,.ADP)");

function detect() {
    //from https://wiki.multimedia.cx/index.php/CRI_ADX_file
    // & https://github.com/vgmstream/vgmstream/blob/master/src/meta/adx.c
    if (!X.c("8000")) return false;
    if (!isWithin(p=X.U16(2,_BE)+4, 0x14, X.Sz())) return false;
    if (!X.c("'(c)CRI'",p-6)) return false;
    fmt = X.U8(4);
    if ([2,3,4].indexOf(fmt) < 0) return false;
    if (X.U8(5)%0x12 || X.U8(6) != 4) return false; //frame size 12h (rarely a multiple thereof), 4 bit per sample only
    if ((ch=X.U8(7)) > 8) return false;
    nV = X.U8(0x12);
//    if ([3,4,5].indexOf(nV) < 0) return false;
    bDetected = 1;
    sVersion = "";
    switch(nV) {
        case 3: sVersion = "v3"; break;
        case 4: sVersion = "v4"; break;
        case 5: sVersion = "v4NL"
    }
    switch(fmt) {
        case 2: sVersion += " fixed-coefficient"; break;
        case 4: sVersion += " exponential-scale";
    }
    if(X.U8(0x13) > 0) sVersion += " encrypted";
    if(X.isVerbose()) {
        sOption(X.U8(7)+'ch '+(sr=X.U32(8,_BE))+'Hz len '
            +secondsToTimeStr(((smp=X.U32(0x0C,_BE))/sr/ch).toFixed(0)));
    }

    return result();
}

================================================
FILE: db/Binary/audio_AHX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG@kaens)

meta("audio", "CRI Middleware's AHX ADPCM stream (.AHX)");

function detect() {
    //from https://github.com/vgmstream/vgmstream/blob/master/src/meta/ahx.c
    if (!X.c("8000")) return false;
    if (!isWithin(p=X.U16(2,_BE)+4, 0x14, X.Sz())) return false;
    if (!X.c("'(c)CRI'",p-6)) return false;
    fmt = X.U8(4);
    if ([0x10,0x11].indexOf(fmt) < 0) return false;
    if (X.U8(5) || X.U8(6)) return false; //frames and bit per sample are 0 in AHX
    if (X.U8(7) != 1) return false; //1 ch only
    if (X.U8(0x12) != 6) return false;
    bDetected = 1;
    sVersion = "";
    switch(fmt) {
        case 0x10: sVersion += "+bigger frames";
    }
    if(X.U8(0x13) > 0) sVersion += " encrypted";
    if(X.isVerbose()) {
        sz = X.fSig(p,TOEOF,"'AHXE(c)CRI'"); if(sz > 0) sz += 10;
        sOption('1ch '+(sr=X.U32(8,_BE))+'Hz len '
            +secondsToTimeStr(((smp=X.U32(0x0C,_BE))/sr).toFixed(0))+' sz:'+outSz(sz))
    }

    return result();
}

================================================
FILE: db/Binary/audio_AIF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Audio_Interchange_File_Format
meta("audio", "AIF");

function detect() {
    if (Binary.compare("464f524d00......'AIFFCOMM'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/audio_AU.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens TG@kaens

meta("audio", "NeXT/Sun Au waveform audio (.AU,.SND)");

/* beautify ignore:start */
function detect() {
	//ref https://en.wikipedia.org/wiki/Au_file_format
	// & https://sox.sourceforge.net/AudioFormats-11.html#ss11.2
	// & http://soundfile.sapp.org/doc/NextFormat/soundstruct.h
	if (X.c("'.snd'")) { tp = 'BE'; en = _BE }
	// all these options, but only .snd is truly still found out there so I didn't test the rest
	else if (X.c("'dns.'")) { tp = 'LE'; en = _LE }
	else if (X.c("00'ds.'")) { tp = 'LE-ds.DEC'; en = _LE }
	else if (X.c("'.sd'00")) { tp = 'BE-ds.'; en = _BE }
	else return false;
	if (!isWithin(dataofs = X.U32(4, en), 0x18, X.Sz())) return false;
	bad = '';
	if (dataofs < 0x1C) bad = bad.addIfNone('!badofs'+Hex(dataofs));
	datasz = X.I32(8, en);
	ch = X.U32(0x14, en); if(!ch || ch > 0x100)  return false;
	sr = X.U32(0x10, en); if(!sr) return false;
	bDetected = true;
	sVersion = tp; fmt = X.U32(0xC, en);
	if (fmt > 0x1D) sVersion = sVersion.appendS('unknown format ('+Hex(fmt)+')', '/');
	else sVersion = sVersion.appendS(
		["unspecified format", "8-bit G.711 μ-law", "8-bit linear PCM", "16-bit linear PCM", "24-bit linear PCM",
		"32-bit linear PCM", "32-bit IEEE floating point", "64-bit IEEE floating point", "Fragmented sample data",
		"nested format", "DSP program", "DSP 8-bit fixed-point data", "DSP 16-bit fixed-point data",
		"DSP 24-bit fixed-point data", "DSP 32-bit fixed-point data", "unknown format (0Fh)",
		/*10*/"Sound Kit's visual data", "μ-law squelch", "16-bit linear w/emphasis", "16-bit linear compressed",
		"16-bit linear w/emphasis compressed", "Music Kit DSP commands", "Music Kit DSP commands: samples",
		"ITU-T G.721 4-bit ADPCM", "ITU-T G.722 4-bit SB-ADPCM", "ITU-T G.723 3-bit SB-ADPCM",
		"ITU-T G.723 5-bit SB-ADPCM", "8-bit G.711 A-law","AES",/*1D*/"8-bit Delta μ-law"][fmt], '/');
	if (bad.length) sVersion = sVersion.appendS('malformed'+bad,'/');
	if (X.isVerbose()) {
		info = []; t = 0x18;
		while(t < dataofs && t < X.Sz()) {
			if ((z = X.fSig(t, Math.min(X.Sz(),0x100,dataofs-t), "00")) < 0) z = dataofs;
			i = X.SC(t,z-t,'CP437').trim(); if(i.length) info.push(i); t = z+1
		}
		sOption(addEllipsis(info.join('; '), 0xC0), 'info:"', '"');
		sOption('ch:' + ch + ' s/r:' + (sr / 1000).toFixed(1) + 'kHz'+(datasz > 0? ' sz:'+outSz(dataofs+datasz): ''));
	}

	return result();
}
/* beautify ignore:end */


================================================
FILE: db/Binary/audio_BCSTM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

meta("audio", "Nintendo CTR Stream (.BCSTM)");

function detect() {
    // ref https://www.3dbrew.org/wiki/BCSTM
    if (!X.c("'CSTM'FF") && !X.c("'CSTM'FE") || X.U8(5) < 0xFE) return false;
    var e = X.U8(5) == 0xFE ? _LE : _BE;
    if (!X.c("'INFO'", ip = X.U32(0x18, e))) return false; ip += 0x20; // stream info ofs
    if (!X.c("'SEEK'", t = 0x40 + X.U32(0x44, e)) || t != X.U32(0x24, e)) return false;
    if (!X.c("'DATA'", t = t + X.U32(t + 4, e)) || t != X.U32(0x30, e)) return false;
    bDetected = true;
    sVersion = 'v' + X.U32(8, e).toString(16) + '_' + (e == 0xFE ? 'le' : 'be');
    if (X.isVerbose()) {
        var enc = X.U8(ip), senc = ['PCM8', 'PCM16', 'DSP ADPCM', 'IMA ADPCM'][enc],
            lp = X.U8(ip + 1), ch = X.U8(ip + 2), sr = X.U32(ip + 4, e);
        sOption(senc + ' ' + ch + 'ch ' + sr + 'Hz' + (lp ? ' looped' : '') + ' sz:' + outSz(X.U32(0xC, e)));
    }

    return result();
}


================================================
FILE: db/Binary/audio_BCWAV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

meta("audio", "Nintendo Binary CTR Wave (.BCWAV)");

function detect() {
    //ref https://www.3dbrew.org/wiki/BCWAV
    if (!X.c("'CWAV'FF") && !X.c("'CWAV'FE") || X.U8(5) < 0xFE) return false;
    var e = X.U8(5) == 0xFE? _LE: _BE;
    if(!X.c("'INFO'", ip=X.U32(0x18,e)) || !X.c("'DATA'", X.U32(0x24,e)) || ip+X.U32(ip+4,e) != X.U32(0x24,e)) return false;
    bDetected = true;
    sVersion = 'v'+X.U32(8,e).toString(16)+'_'+(e==0xFE?'le':'be');
    if(X.isVerbose()) {
        var enc = X.U8(ip+8), senc = ['PCM8', 'PCM16', 'DSP ADPCM', 'IMA ADPCM'][enc],
            lp = X.U8(ip+9), sr = X.U32(ip+0xC,e), ch = X.U8(ip+0x1C);
        var dsz = X.U32(X.U32(0x24,e)+4,e)-8, len = '';
        switch(enc) {
        case 0: len = (dsz/sr/ch).toFixed(1).toString(); break;
        case 1: len = (dsz/sr/2/ch).toFixed(1).toString(); break;
        case 3: len = (dsz*2/sr/ch).toFixed(1).toString();
        }
        sOption(senc+' '+ch+'ch '+sr+'Hz'+(lp?' looped':'')
            +(len.length?' len '+secondsToTimeStr(len):'')+' sz:'+outSz(X.U32(0xC,e)));
    }

    return result();
}


================================================
FILE: db/Binary/audio_CXT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG @kaens)

meta("audio", "Adobe Director Protected Cast file (.CXT)");

/* beautify ignore:start */
function detect() {

	const debug = 0;

	var
		p = 0xC, e = _BE,
		labl = [], txts = [],
		sz = -1,
		snds = 0, sndh = 0, snd = 0,
		hksz = 4,
		end = false, checklist = [false, false, false];
	if (X.Sz() < 0x10) return;
	if(X.c("'RIFX'") && ["MV93","FGDM", "MC95", "FGDC"].includes(X.SA(8,4))) e = _BE;
	else if(X.c("'XFIR'") && ["39VM","MDGF", "59CM", "CDGF"].includes(X.SA(8,4))) e = _LE;
	else return;
	if((sz = 8+X.U32(4, e)) < 12) return;
	if(debug) var chunks = "";
	while (p < X.Sz() && p < sz) {
		hkhd = X.SA(p, 4);
		hksz = X.U32(p + 4, e);
//_l2r('cxt',p,hkhd+' ['+Hex(hksz)+']')
		if(debug) chunks += " " + hkhd + " [" + Hex(hksz) + "] @" + Hex(p);
		p += 8;
		if(hkhd.slice(0,3) === "CAS") checklist[0] = 1;
		else if(hkhd === "KEY*") checklist[1] = 1;
		else if(hkhd.slice(0,3) === "snd") checklist[2] = 1;
		switch (hkhd) {
		case "sndH": sndh++; break;
		case "sndS": snds++; break;
		case "snd ": snd++; break;
		}
		hksz += hksz & 1; //align
		p += hksz
	} // end of chunks

	if(!checklist[0] || !checklist[1] || !checklist[2]) return;  bDetected = true;
	sVersion = e == _LE? "le": "be";

	if (debug) if (chunks != "") _l2r('rifx',0,'chunks: ['+chunks+']');

	if(X.isVerbose()) {
		sOption('snd:'+snd+' sndH:'+sndh+' sndS:'+snds+' sz:'+outSz(sz))
	}

	return result();
}
/* beautify ignore:end */

================================================
FILE: db/Binary/audio_DSS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG@kaens)

meta("audio","");

/* beautify ignore:start */
function detect() {
	//ref https://ffmpeg.org/doxygen/trunk/dss_8c_source.html - but the ds2 files are different with no code in sight
	if(X.c("02'dss'") || X.c("03'dss'"))
		sName = "Digital Speech Standard audio (.DSS)";
	else if(X.c("02'ds2'") || X.c("03'ds2'") || X.c("02'enc'") || X.c("03'enc'")) {
		sName = "Digital Speech Standard Pro audio (.DS2)";
	}
	else return false;
	nv = X.U8(0); v1 = X.c("'dss'",1);
	hdrsz = nv * 0x200; if(X.Sz() < hdrsz) return false;
	tm = X.SA(0x26,12);
	if(charStat(tm,1).indexOf('allnum') < 0 || !isWithin(tm.slice(2,4),'01','12') || !isWithin(tm.slice(4,6),'01','31')
	  || !isWithin(tm.slice(6,8),'00','23') || !isWithin(tm.slice(8,10),'00','59') || !isWithin(tm.slice(10,12),'00','59'))
		return false; // I'm not checking the year, what if this script (and indeed civilisation) survives until the 2100s!
	tm = '20'+tm.slice(0,2)+'-' + tm.slice(2,4)+'-' + tm.slice(4,6)
		+ ' ' + tm.slice(6,8)+':' + tm.slice(8,10)+':' + tm.slice(10,12);
	dur = X.SA(0x3E,6);
	if(charStat(dur,1).indexOf('allnum') < 0 || !isWithin(dur.slice(2,4),'00','59') || !isWithin(dur.slice(4,6),'00','59'))
		return false;
	dur = dur.slice(0,2)+'h'+dur.slice(2,4)+'m'+dur.slice(4,6)+'s';
	auth = X.readBytes(0xC,0x10);
	if(charStat(auth,1).indexOf('allxsc') < 0) return false;
	else auth = decEncoding(auth,CP437);
	if(v1) switch(cn = X.U8(0x2A4)) {
	case 0: co = 'DSS standard-play mode 11025Hz b/r '+(8*41*11025*512/(506*264)/1000).toFixed(3)+'k'; break;
	case 2: co = 'g723.1 long-play mode 8000Hz'; break;
	default: co = 'unknown ('+Hex(cn)+')'
	} else {
		cn = 0; co = 'DSS standard-play mode';
	}
	if(cn == 0) asz = hdrsz+3750*(dur.slice(0,2) * 3600 + dur.slice(3,5) * 60 + dur.slice(6,8)); else asz = -1
	cmt = "";
	if(v1) {
		cmt = X.readBytes(0x31E,0x40);
		if(charStat(cmt,1).indexOf('allxsc') < 0) return false;
		else cmt = decEncoding(cmt,CP437)
	} else for(i = 0x240; i < 0x3A6; i += 60) {
		if((t = X.SC(i, 30, 'CP437').trim() + ': ' + X.SC(i+30, 30, 'CP437').trim()) != ': ') cmt = cmt.appendS(t,', ')
	}
	// TODO traverse the blocks to check the filesize
	bDetected = 1; sVersion = 'v'+nv; if(X.c("'enc'",1)) sVersion += ' encrypted';
	if(X.isVerbose()) {
 		sOptionT(auth,'by: '); sOption(tm,'on: '); sOption(cmt); sOption(co,'codec: '); sOption(dur,'duration: ');
 		if(asz > 0) sOption('approx.filesize: '+(asz/0x100000).toFixed(2)+'M')
 	}

	return result()
}
/* beautify ignore:end */

================================================
FILE: db/Binary/audio_EXA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG@kaens)

meta("audio","Electronic Arts' EA-XA stream (.EXA)");

function detect() {
    // This one is built with sx.exe -sndstream %s.wav -=%s.exa
    //ref https://github.com/vgmstream/vgmstream/blob/master/src/meta/ea_schl.c
    if (X.Sz() < 0x20 || !X.c("'SC'")) return false;
    var cfg = X.U16(2,_BE) << 16,  sc = sr = ch = nv = pf = cd1 = cd2 = -1,  bps = 16,  blke = _LE,  e = X.U16(4)? _LE: _BE;
    var p = 0, hksz = 0, c = 0, eof = 0;
    for (; p < X.Sz() && !eof; ) {
        var hkhd = X.SA(p,4), hksz = X.U32(p+4, e);
        if(X.c("'SC'",p)) c++;
        switch (hkhd) {
        case 'SCHl':
            c++; q = p+8; pfid = X.SA(q,4);
            if (pfid !== 'GSTR' &&  pfid.slice(0,2) !== 'PT') { q += 4; pfid = X.SA(q,4) } //patching "nbapsstream"
            if(pfid === 'GSTR') { pf = 8/*generic*/; q += 4 }
            else if(pfid.slice(0,2) === 'PT') pf = X.U16(q+2,_LE);
            else return false;
            q += 4;
            function rd() { // bytecount being FF means custom data, > 4 we just skip here
                var r = 0, c = X.U8(q++); if (c == 0xFF) { q += 4+X.U32(q,_BE); return 0 } 
                if (c > 4) { q += c; return 0 }
                for(; c > 0; c--) r = Util.shlu64(r,8) + X.U8(q++);
                return r
            }
            hdend = 0;
            while(!hdend && q < p+hksz && q < X.Sz()) {
                var tp = X.U8(q++);
/* beautify ignore:start */
                switch (tp) {
                case 0: if(!hdend) rd(); break;
                case 3: case 4: case 5: case 6: case 7: case 8: case 9: case 0xA: case 0xB: case 0xC: case 0xD: case 0xE: case 0xF:
                case 0x10: case 0x11: case 0x12: case 0x13: case 0x14: case 0x15: case 0x19: case 0x1B: case 0x1C: case 0x1D:
                case 0x1E: case 0x1F: case 0x20: case 0x21: case 0x22: case 0x23: case 0x24: case 0x25: rd(); break;
                case 0xFC: case 0xFD: break;  case 0x83: cd1 = rd(); break;  case 0xA0: cd2 = rd(); break;
                case 0x80: nv = rd(); break;  case 0x81: bps = rd(); break;  case 0x82: ch = rd(); if (ch > 6) return false; break;
                case 0x84: sr = rd(); break;  case 0x85: sc = rd(); break;
                case 0x86: case 0x87: /*lpst, lped(add 1)*/
                case 0x88: case 0x89: case 0x94: case 0x95: case 0xA2: case 0xA3: /*ch ofs*/
                case 0x8F: case 0x90: case 0x91: case 0xAB: case 0xAC: case 0xAD: /*dsp/n64blk coefs */
                case 0x1A: case 0x26: case 0x27: case 0x28: case 0x29: case 0x2A: /* rel lp ofs */
                case 0x8C: /* play flags */ case 0x8A: case 0x8B: case 0x8D: case 0x8E: case 0x92: case 0x93: case 0x98:
                case 0x99: case 0x9C: case 0x9D: case 0x9E: case 0x9F: case 0xA6: case 0xA7: case 0xA1:
                    rd(); break;
                case 0xFF: case 0xFE:
                    hdend = 1; break;
                default: return false
                }
            }
            break;
        case 'SCCl': c++; break;
        case 'SCDl': c++; break;
        case 'SCEl': c++; /*→*/ case '': case '\xFF\xFF\xFF\xFF': eof = true; break;
        }
        p += hksz || 1; //avoids accidental ∞loops
    }
//_l2r('exa',c,' ')
    if (eof || c > 3) {
        bDetected = true;
        if ([2,3,4,6,8,9,0xE,0x10].indexOf(pf) >= 0) blke = _BE;
        if (ch <= 0) ch = 1;
        if (nv == -1)
            if (pf <= 4) nv = 0; else  if (pf <= 5) nv = 1; else  if (pf <= 8) nv = 2; else if (pf <= 0x14) nv = 3;
        sVersion = 'v'+nv; 
        if (cd1 < 0 && nv == 0) switch (pf) { // checks from Ctrl+F "codec1 defaults"
        case 0: case 3: case 4: cd1 = 0; break; // PC, MAC, SAT? PCM
        case 1: cd1 = 6; break; // PSX? VAG
        case 2: cd1 = 5; break; // N64? N64 :)
        default: bad = bad.addIfNone('!badcodec1');
        }
        if (cd1 >= 0 && cd2 < 0) switch (cd1) { //converts from Ctrl+F "codec1 to codec2"
        case 0:
            if(pf == 0) cd2 = bps == 8? 2: (blke == _BE? 1: 0);
            else cd2 = bps == 8? 9: (blke == _BE? 7: 8);
            break;
        case 5: cd2 = 6; break;  case 6: cd2 = 5; break;
        case 7: if(pf == 0 || pf == 3) cd2 = 3; else cd2 = 0xA; break;
        case 9: cd2 = 4; break;
        default: bad = bad.addIfNone('!badcodec1');
        }
        if(cd2 < 0) switch(pf) { //plaform-wise codec defaults
        case 0: case 3: case 8: case 9: case 0xA: case 0xE: cd2 = 0xA; break;
        case 1: case 5: cd2 = 5; break;  case 6: cd2 = 7; break;  case 7: cd2 = 8; break;
        case 0x10: case 0x14: cd2 = 0x12; break;
        default: bad = bad.addIfNone('!badcodec2');
        }
        if(sr < 0) switch(pf) {//platform-wise sample rate defaults
        case 0: case 1: case 2: case 3: case 4: case 5: case 0xA: sr = 22050; break;
        case 6: case 7: sr = 24000; break;
        case 0x10: case 0x14: sr = 32000; break;
        case 9: case 0xE: sr = 44100; break;
        case 8: sr = 48000; break;
        default: bad = bad.addIfNone('!badsmprate');
        }
/* beautify ignore:end */
        if(!isWithin(pf,0,0x14)) sVersion += '#unk.platform';
        else sVersion += '#'+['PC', 'Sony Playstation', 'Nintendo 64', 'MAC', 'Sega Saturn', 'Sony Playstation 2',
            'Nintendo Gamecube/Wii', 'Microsoft Xbox', 'Generic', 'Microsoft X360', 'Sony PSP',
            'pc-eaac', 'x360-eaac', 'psp-eaac', 'Sony Playstation 3', 'ps3-eaac', 'Nintendo Wii', 'wii-eaac', 'pc64-eaac',
            'mobile-eaac', 'Nintendo 3DS'][pf];
        // small letters mean unused, you don't expect to see those
        sVersion += blke == _LE? '/le': '/be'; if(blke != e) sVersion += '/file'+(e == _LE? '_le': '_be');
        var codecs2 = ['S16LE_INT','S16BE_INT','S8_INT','EA-XA_INT','MT10','VAG','N64','S16BE','S16LE','S8','EA-XA',
                'u8_int','cdxa','ima_int','layer1','Layer2','Layer3',,'GCADPCM','s24le_int','XboxADPCM','s24be_int','MT5',
                'EALayer3','xas0_int','ealayer3_int','ATRAC3','ATRAC3+'],
            senc = isWithin(cd2,0,0x1B)? codecs2[cd2]: cd2<0? '': 'SND10';
        if (X.isVerbose()) {
            sOption((senc.length?'codec:'+senc+' ':'')+ch+'ch '+sr+'Hz'+(bps>0?' '+bps+'bit':'')
                +' len '+secondsToTimeStr((sc/sr).toFixed(0))+' sz:'+outSz(p));
        }
    }

    return result();
}

================================================
FILE: db/Binary/audio_FLAC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens <TG@kaens>

meta("audio", "FLAC waveform audio (.FLAC)");

function detect() {
    //ref https://xiph.org/flac/format.html#format_overview
    if (!File.compare("'fLaC'")) return;
    end = 0; p = 4; hk = hks = malformed = "";
    ch = rate = bps = smp = smplen = sz = xa = xna = 0; seekt = -1;
    while (!end && p < File.getSize()) {
        t = File.read_uint8(p); if (p == 5 && (t & 0xFF)) return;
        last = t & 0x80; mdbt = t & 0x7F; mdsz = File.read_uint24(p + 1, _BE);
        p += 4;
        switch (mdbt) {
            case 0: hk = "STREAMINFO";
                minb = File.read_uint16(p, _BE), maxb = File.read_uint16(p + 2, _BE),
                    minf = File.read_uint24(p + 4, _BE), maxf = File.read_uint24(p + 7, _BE);
                if (minb < 16 || maxb > 65535 || minb > maxb) malformed += "!badblksz";
                br = new BitReader(p + 10, _BE);
                rate = br.read(20); ch = 1 + br.read(3); bps = 1 + br.read(5);
                smp = br.read(36); smplen = smp / rate;
                break;
            case 1: hk = "PADDING"; break;
            case 2: hk = "APP"; s = File.read_ansiString(p, 4);
                switch (s) { //from https://xiph.org/flac/id.html on 2024-02-20
                    case "ATCH": hk += ":Flacfile"; break;
                    case "BSOL": hk += ":beSolo"; break;
                    case "BUGS": hk += ":Bugs Player"; break;
                    case "Cues": hk += ":GoldWave"; break;
                    case "Fica": hk += ":CUE Splitter"; break;
                    case "Ftol": hk += ":flac-tools"; break;
                    case "MOTB": hk += ":MOTB MetaCzar"; break;
                    case "MPSE": hk += ":MP3 Stream Editor"; break;
                    case "MuML": hk += ":MusicML"; break;
                    case "RIFF": hk += ":Sound Devices RIFF c.s"; break;
                    case "SFFL": hk += ":Sound Font FLAC"; break;
                    case "SONY": hk += ":Sony Creative Software"; break;
                    case "SQEZ": hk += ":flacsqueeze"; break;
                    case "TtWv": hk += ":TwistedWave"; break;
                    case "UITS": hk += ":UITS Embedding tools"; break;
                    case "aiff": hk += ":FLAC AIFF c.s"; break;
                    case "imag": hk += ":flac-image file"; break;
                    case "peem": hk += ":Parseable Embedded Extensible Metadata"; break;
                    case "qfst": hk += ":QFLAC Studio"; break;
                    case "riff": hk += ":FLAC RIFF c.s (OpenMPT?)"; break;
                    case "tune": hk += ":TagTuner"; break;
                    case "w64 ": hk += ":FLAC Wave64 chunks"; break;
                    case "xbat": hk += ":XBAT"; break;
                    case "xbat": hk += ":xmcd"; break;
                    default: hk += ":<" + s + ">"
                }
                break;
            case 3: hk = "SEEKTABLE"; seekt = p; hk += "#" + Math.floor(mdsz, 18); break;
            case 4: hk = "VORBIS_COMMENT";
                break;
            case 5: hk = "CUESHEET";
                xa = xna = 0; trkn = File.read_uint8(p + 0x18B); u = p + 0x18C;
                for (i = 0; i < trkn; i++) {
                    u += 0x15; if (File.read_uint8(u++) & 0x80) xna++; else xa++;
                    u += 0x0D; u += 12 * File.read_uint8(u++);
                }
                break;
            case 6: hk = "PICTURE"; break;
            case 0x7F: end = 1; hk = "frames"; break;
            default: hk = "unknown" + Hex(mdbt)
        }
        if (hk != "frames") hks = hks.append("[" + hk + "]");
        p += mdsz; if (last) end = 1;
    }
    if (sz < p) sz = p;
    t = p + (smp * bps * ch >> 3); if (sz < t) sz = t; _log("t:" + t)
    if (seekt >= 0) for (i = 0; i < mdsz / 18; i++) {
        smpn = File.read_uint64(seekt + i * 18, _BE);
        seek = p + File.read_uint64(seekt + 8 + i * 18, _BE);
        st = seek + (File.read_uint16(seekt + 16 + i * 18, _BE) * bps * ch >> 3);
        if (sz < st) sz = st
    }
    end = 0;
    if (!smp && File.isDeepScan())
        while (!end && p < File.getSize()) {
            end = 1
            // TODO. Or not to do, this is the question >__> But prolly do; no other way to always find filesize
        }
    if (malformed) sVersion += malformed;
    bDetected = 1;
    if (Binary.isVerbose()) {
        sOption(Math.floor(smplen / 60) + ":" + (Math.floor(smplen) % 60).padStart(2, '0'));
        if (xa > 1 || xna) sOption("x" + xa + "+" + xna); //audio and non-audio tracks
        sOption(hks);
        sOption(rate + "Hz ch:" + ch + " bps:" + bps);//+" sz:"+sz);
        if (minb === maxb) sOption("fixed-size stream");
    }

    return result();
}


================================================
FILE: db/Binary/audio_FSB.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("audio", "FMOD Sample Bank (.FSB)");

function detect() {
    if (Binary.getSize() >= 0x24) {
        if (Binary.compare("'FSB'..")) {
            var nSamples, nExtVer, nMode;
            var sID = Binary.getString(0, 4);
            sVersion = sID;
            bDetected = true;
            switch (sID) {
                case "FSB1":
                    nSamples = Binary.read_int32(0x04);
                    break;

                case "FSB2":
                    nSamples = Binary.read_int32(0x04);
                    break;

                case "FSB3":
                    nSamples = Binary.read_int32(0x04);
                    nExtVer = Binary.read_int32(0x10);
                    nMode = Binary.read_int32(0x14);
                    break;

                case "FSB4":
                    nSamples = Binary.read_int32(0x04);
                    nExtVer = Binary.read_int32(0x10);
                    nMode = Binary.read_int32(0x14);
                    break;

                case "FSB5":
                    nSamples = Binary.read_int32(0x08);
                    nExtVer = Binary.read_int32(0x10);
                    nMode = Binary.read_int32(0x18);
                    switch (nMode) {
                        case 0x01:
                            sOption("PCM8");
                            break; // 8bit integer PCM data.
                        case 0x02:
                            sOption("PCM16");
                            break; // 16bit integer PCM data.
                        case 0x03:
                            sOption("PCM24");
                            break; // 24bit integer PCM data.
                        case 0x04:
                            sOption("PCM32");
                            break; // 32bit integer PCM data.
                        case 0x05:
                            sOption("PCMFLOAT");
                            break; // 32bit floating point PCM data.
                        case 0x06:
                            sOption("GCADPCM");
                            break; // Compressed Nintendo 3DS/Wii DSP data.
                        case 0x07:
                            sOption("IMA ADPCM");
                            break; // Compressed IMA ADPCM data.
                        case 0x08:
                            sOption("VAG");
                            break; // Compressed PlayStation Portable ADPCM data.
                        case 0x09:
                            sOption("HEVAG");
                            break; // Compressed PSVita ADPCM data.
                        case 0x0A:
                            sOption("XMA");
                            break; // Compressed Xbox360 XMA data.
                        case 0x0B:
                            sOption("MP3");
                            break; // Compressed MPEG layer 2 or 3 data.
                        case 0x0C:
                            sOption("CELT");
                            break; // Compressed CELT data.
                        case 0x0D:
                            sOption("AT9");
                            break; // Compressed PSVita ATRAC9 data.
                        case 0x0E:
                            sOption("XWMA");
                            break; // Compressed Xbox360 xWMA data.
                        case 0x0F:
                            sOption("VORBIS");
                            break; // Compressed Vorbis data.
                        case 0x10:
                            sOption("FADPCM");
                            break;
                        case 0x11:
                            sOption("OPUS");
                            break;
                        default:
                            bDetected = false;
                    }
                    break;

                default:
                    bDetected = false;
            }
            sOption("Samples:" + nSamples);
        }

    }

    return result();
}


================================================
FILE: db/Binary/audio_HMI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://moddingwiki.shikadi.net/wiki/Human_Machine_Interfaces_MIDI_Format
meta("audio", "Human Machine Interfaces");

function detect() {
    if (Binary.compare("'HMI-MIDISONG061595'0000000000000000000000000000000000000000ff00ffffffffff01")) {
        sVersion = "2.0";
        sOptions = "MIDI";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/audio_OGG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://file-recovery.com/ogg-signature-format.htm
meta("audio", "Vorbis");

function detect() {
    if (Binary.compare("'OggS'00020000000000000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/audio_PAF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Created with Audiacity

// https://www.filetypeadvisor.com/extension/paf
meta("audio", "Ensoniq PARIS (.PAF)");

function detect() {
    if (Binary.compare("20'paf'00000000000000000000AC44")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/audio_PVF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Created with Audiacity

// https://fileinfo.com/extension/pvf
meta("audio", "Portable Voice Format (.PVF)");

function detect() {
    if (Binary.compare("'PVF'")) {
        var freq = Binary.getString(7, 5).trim();

        if (/^[0-9]{5}/.test(freq)) {
            if (X.isVerbose()) sVersion = freq;
            bDetected = true;
        }

    }

    return result();
}

================================================
FILE: db/Binary/audio_RIFF-IMA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

// https://github.com/vgmstream/vgmstream/blob/master/src/meta/riff_ima.c
meta("audio", "Nintendo DS RIFF IMA-ADPCM stream (.STRM,.BIN,.LBIN)");

function detect() {
    if (X.c("'RIFF'") && X.c("'IMA '", 8) && X.U32(0xC) && X.U32(4) >= 0x2D) {
        bDetected = true;

        if (X.isVerbose()) {
            var ch = X.U32(0x24), len = Util.divu64((X.U32(4) - 0x2C) << 8, X.U16(0xC)) >> 8;

            sOption(
                'ch:' + ch + ' len ' + secondsToTimeStr(len) + ' s/r:' + X.U32(0xC) + 'Hz ' +
                ['not looped', 'looped'][+(X.U32(0x20) != 0)] + ' sz:' + outSz(X.U32(4))
            );
        }
    }

    return result();
}


================================================
FILE: db/Binary/audio_SOU.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php/SCUMM/Technical_Reference/Sound_resources#v5-v6_-_MONSTER.SOU
meta("audio", "SOU");

function detect() {
    if (Binary.compare("'SOU'2000000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/audio_STRM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

// https://github.com/Gota7/NitroStudio2/blob/master/docs/specs/stream.md
meta("audio", "Nintendo DS multi-channel stream (.STRM)");

function detect() {
    if ((!X.c("'STRM'FE") && !X.c("'STRM'FF")) || X.U8(4) == X.U8(5) || X.U8(5) < 0xFE || !X.c("'HEAD'", 0x10)) return;
    var e = X.U8(4) == 0xFF ? _LE : _BE, dp = 0x10 + X.U32(0x14, e);
    if (X.U8(0x19) > 1 || dp > X.Sz()) return;
    if (!X.c("'DATA'", dp) || X.U32(0x28, e) != dp + 8 || X.U32(8, e) != dp + X.U32(dp + 4, e)) return;

    bDetected = true;

    sVersion = ['PCM8s', 'PCM16', 'IMA-ADPCM'][X.U8(0x18)] + '/' + (e == _LE ? 'le' : 'be');
    if (X.isVerbose()) {
        var ch = X.U8(0x1A), len = (X.U32(0x24, e) / X.U16(0x1C, e)).toFixed(0);
        sOption(
            'ch:' + ch + ' len ' + secondsToTimeStr(len) +
            ' s/r:' + X.U16(0x1C, e) + 'Hz ' + ['not looped', 'looped'][X.U8(0x19)] + ' sz:' + outSz(X.U32(dp + 4, e) + dp)
        );
    }

    return result();
}


================================================
FILE: db/Binary/audio_STRM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

meta("audio", "José Ramón 'Gryzor87' García/Abylight's Nintendo 3DS stream (.STRM)");

function detect() {
  //ref https://github.com/Gota7/NitroStudio2/blob/master/docs/specs/stream.md
  if (!X.c("'STRM'E8030000") || !X.U32(0x10) || X.U32(0x18) < 0x1F || (sz=X.U32(0x10)) != X.U32(0x18)) return;
  bDetected = true;
  if (X.isVerbose()) {
    const m = Math.min(sz, X.Sz());
    var sr = X.U32(8), len = 0;
    if (X.isDeepScan()) for(p=0x1E; p < m; len++) { // parse AAC to count samples
       var fsy = (X.U16(p,_BE) >> 4) & 0xFFF,
         fsz = (X.U32(p+2,_BE) >> 5) & 0x1FFF;
       if(fsy != 0xFFF || fsz <= 8) break;
       p += fsz
    }
    if(p < m) sVersion = 'malformed!badAAC';
    len = (len * 1024 / sr).toFixed(0);
    sOption((len?'len '+secondsToTimeStr(len)+' ':'')+'s/r:'+sr+'Hz'+' sz:'+outSz(0x1E+sz))
  }

  return result();
}


================================================
FILE: db/Binary/audio_ShockwaveAudio.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://preservation.tylerthorsted.com/2023/08/04/shockwave-audio/
meta("audio", "Shockwave Audio");

function detect() {
    if (Binary.compare("000001..00000003")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/audio_TUN.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Lego Racers

// https://fileinfo.com/extension/tun
meta("audio", "TUN");

function detect() {
    if (Binary.compare("'ALP'")) {
        var soundOption = Binary.getString(8, 5).trim();

        if (/^[A-Z]{5}$/.test(soundOption)) {
            if (X.isVerbose()) sOptions = soundOption;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/audio_VOC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens TG@kaens

meta("audio", "Creative (Sound Blaster) Voice waveform (.VOC)");

/* beautify ignore:start */
function detect() {
	//from https://sourceforge.net/p/sox/code/ci/master/tree/src/voc.c
	bad = '';
	if (!X.c("'Creative Voice File'1A"))
		if (X.c("'Creative Voice File'..1A")) bad = bad.addIfNone('!bad1Asig');
		else return false;
	nV = X.U16(0x16); if ((((~nV) + 0x1234) & 0xFFFF) != X.U16(0x18)) return false; //version validation
	codec = '<default codec>';
	function getCodec(bCodec) {
		switch (bCodec) {
			case 0: codec = '8-bit uPCM'; break;
			case 1: codec = 'Creative 8 to 4-bit ADPCM'; break;
			case 2: codec = 'Creative 8 to 3-bit ADPCM'; break;
			case 3: codec = 'Creative 8 to 2-bit ADPCM'; break;
			case 4: codec = '16-bit sPCM'; break;
			case 5: codec = 'CCITT a-Law'; break;
			case 6: codec = 'CCITT u-Law'; break;
			case 0x2000: codec = 'Creative 16 to 4-bit ADPCM'; break;
			default: codec = "invalid codec " + Hex(bCodec)
		}
		return codec
	}
	sV = nV.toString(16).padStart(4, '0'); sVersion = 'v' + sV[1] + '.' + sV.slice(2, 4);
	bn = sz = -1; // block counter, expected filesize
	extended = z = false; // "extended info overrides" flag, 0 (terminator) flag 
	p = 0x1A; rate = Hz = bps = bCodec = 0; info = [];
	while (p < (X.isDeepScan() ? X.Sz() : 0xFFFF) && !z) { //scan blocks
		bst = p; bhd = X.U8(p++); bn++; // block start, header byte, number
		bsz = X.U24(p); p += 3;
		at = '';// '@'+Hex(bst)+'['+bn+']: ';
		switch (bhd) {
			case 0: info.push(at + 'EoF'); p -= 3; z = true; break;
			case 1: // sound data
				if (!extended) {
					rate = 1000000 / (256 - X.U8(p));
					Hz = rate < 100000 ? Math.round(rate) + "Hz" : (rate / 1000).toFixed(1) + 'kHz';
					bCodec = X.U8(p + 1);
				}
				info.push(at + 'audio data in ' + codec + ' at ' + Hz/*+' ->'+Hex(p+bsz)*/); //if extended, treat as case 2
				p += bsz;
				break;
			case 2: // sound data continues
				p += bsz;
				break;
			case 3: // silence
				len = X.U16(p) + 1; rate = 1000000 / (256 - X.U8(p + 2));
				Hz = rate < 100000 ? Math.round(rate) + "Hz" : (rate / 1000).toFixed(1) + 'kHz';
				info.push(at + 'silence (' + (len / rate).toFixed(2) + ' sec at ' + Hz + ')'); p += bsz; break;
			case 4: // marker
				info.push(at + 'marker #' + X.U16(p)); p += bsz; break;
			case 5: // asciiz string
				s = X.SA(p, bsz); p += bsz;
				info.push(at + '"' + s + '"'); break;
			case 6:
				n = X.U16(p); p += bsz;
				info.push(at + (n == 0xFFFF ? 'infinite' : n) + ' repeats { '); break;
			case 7: info.push(at + 'end repeat }'); break;
			case 8: //extended info
				if (!extended) {
					chn = X.U8(p + 3) + 1;
					rate = 256000000 / (chn * (65536 - X.U16(p)));
					Hz = rate < 100000 ? Math.round(rate) + "Hz" : (rate / 1000).toFixed(1) + 'kHz';
					bCodec = X.U8(p + 2);
				}
				extended = true; p += bsz;
				info.push(at + 'set to ' + getCodec(bCodec) + ' at ' + Hz + ', ' + chn + 'chn'); break;
			case 9: // new-format audio data
				if (nV < 0x112) bad = bad.addIfNone('!badver');
				rate = X.U32(p); if (!rate) bad = bad.addIfNone('!badrate@' + Hex(bst)); z = true; break;
				Hz = rate < 100000 ? rate + "Hz" : (rate / 1000).toFixed(1) + 'kHz';
				bps = X.U8(p + 4);
				chn = X.U8(p + 5); bCodec = X.U16(p + 6);
				info.push(at + 'audio in ' + bps + 'bps ' + getCodec(bCodec) + ' at ' + Hz + ', ' + chn + 'chn '/*+'->'+Hex(bsz)*/);
				p += bsz; break;
			default: bad = bad.addIfNone('!invalidblock@' + Hex(bst)); z = true;
		}
		if (p == X.Sz()) z = true;
		if (X.isDeepScan())
			if (p > X.Sz()) bad = bad.addIfNone('!short'); // for ripping, we should test this in each audiodata block
			else sz = p
	}
	bDetected = true;
	if (bad != '') sVersion = sVersion.appendS('malformed' + addEllipsis(bad, 0x80, 0x40), '/')
	if (X.isVerbose()) {
		sOption(addEllipsis(info.join('; '), 0x200, 0x100));
		sOption(outSz(sz), 'sz:')
	}
	return result();
}
/* beautify ignore:end */

================================================
FILE: db/Binary/audio_WAV.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: Levis <levintaeyeon@live.com>
//         Jason Hood <jadoxa@yahoo.com.au>
//         Kaens (TG @kaens)
// ref. official RIFF WAVE format doc; vgmstream > riff.c, msadpcm_decoder.c

meta("audio", "RIFF container/WAVE file (.WAV)");

/* beautify ignore:start */
function detect() {

	const debug = 0;

	var
		p = 0xC, e = _BE,
		labl = [], txts = [],
		dcsamples = cue = 0,
		nFormat = nRate = nChannels = nBPS = 0,
		dur = -1, sz = -1,
		lp = 0,
		fmtsz = 0, datasz = 0,
		hksz = 4,
		hkhd = "", title = "", dt = "", by = "", genre = "", cms = "", cmt = "", cop = "", sft = "",
		end = false, checklist = [false, false, false];
	if (X.Sz() < 36) return;
	if(X.c("'RIFF'........'WAVE'")) e = _LE;
	else if(X.c("'RIFX'........'WAVE'")) e = _BE;
	else return;
	if((sz = 8+X.U32(4, e)) < 12) return;
	function msadpcm_check_coefs(o) { //returns new offset or -1 for a failed check
		const coefs = [ [256,0], [512,-256], [0,0], [ 192,64], [240, 0], [460,-208], [392,-232] ];
		var c = X.U16(o, e); if(c != 7) return -1;  o += 2;
		for(var i=0; i < 7; i++,o+=4) {
			var c1 = X.I16(o, e), c2 = X.I16(o + 2, e);
			if (c1 != coefs[i][0] || c2 != coefs[i][1]) return -1;
		}
		return o
	}
	if(sz-8 >= X.Sz() && X.c("'NXBF'",0x24)) sz = X.Sz();
	if(debug) var chunks = "";
	while (p < X.Sz() && p < sz) {
		hkhd = X.SA(p, 4);
		hksz = X.U32(p + 4, e);
		if(debug) chunks += " " + hkhd + " [" + Hex(hksz) + "] @" + Hex(p);
		p += 8;
		switch (hkhd) {
			case "fmt ": checklist[0] = true; fmtsz = hksz;
				nFormat = X.U16(p, e);
				nChannels = X.U16(p + 2, e);
				nRate = X.U32(p + 4, e);
				nBlockSize = X.U16(p + 0xC, e);
				nBPS = X.U16(p + 0x0E, e);
				switch (nFormat) {
				case 0x0000: sVersion = "Yamaha AICA ADPCM (unofficial)";
					if(sz-4 == X.Sz()) sz -= 4; else if(sz-8 == X.Sz()) sz -= 8; else if(sz+2 == X.Sz()) sz -= 2;
					if(hksz == 0x12) hksz += 2;
					break;
				case 0x0001: if((nBPS & 7) || !isWithin(nBPS, 8,32)) return;  sVersion = "Microsoft PCM"
					+ (nBPS == 32? "32_le": nBPS == 24? "24_le": nBPS == 16? "16":"8U") +" (uncompressed)";
					break;
				case 0x0002:
					if(nBPS == 4) { if(msadpcm_check_coefs(p+0x14) < 0) { if(debug)_l2r('wav',2,'coefs are off'); return } }
					else if(nBPS == 16 && nBlockSize == 2*nChannels && sz >= 0x14-8) sVersion = "MS-IMA ADPCM";
					else sVersion = "Microsoft ADPCM";
					break;
				case 0x0003: if(nBPS != 32) return;  sVersion = "Microsoft IEEE float"; break;
				case 0x0004: sVersion = "Compaq VSELP"; break;
				case 0x0005: sVersion = "IBM CVSD"; break;
				case 0x0006: sVersion = "ITU G.711 a-law"; break;
				case 0x0007: sVersion = "ITU G.711 u-law"; break;
				case 0x0008: sVersion = "Microsoft DTS"; break;
				case 0x0009: sVersion = "DRM"; break;
				case 0x000A: sVersion = "WMA 9 Speech"; break;
				case 0x000B: sVersion = "Microsoft Windows Media RT Voice"; break;
				case 0x0010: sVersion = "OKI-ADPCM"; break;
				case 0x0011: if(nBPS == 4) sVersion = "MS-IMA ADPCM"; else sVersion = "Intel IMA/DVI-ADPCM";
					if((sz-8) >> 2 == X.U32(0x30, e)) sz = X.Sz();
					else if(X.Sz()-sz-0x10 <= 0x900 && X.c("'cont'",sz)) sz += 8+X.U32(sz+4, e);
					break;
				case 0x0012: sVersion = "Videologic Mediaspace ADPCM"; break;
				case 0x0013: sVersion = "Sierra ADPCM"; break;
				case 0x0014: sVersion = "Antex G.723 ADPCM"; break;
				case 0x0015: sVersion = "DSP Solutions DIGISTD"; break;
				case 0x0016: sVersion = "DSP Solutions DIGIFIX"; break;
				case 0x0017: sVersion = "Dialogic OKI ADPCM"; break;
				case 0x0018: sVersion = "Media Vision ADPCM"; break;
				case 0x0019: sVersion = "HP CU"; break;
				case 0x001A: sVersion = "HP Dynamic Voice"; break;
				case 0x0020: if(nBPS == 4) sVersion = "Yamaha AICA ADPCM"; else sVersion = "Yamaha ADPCM"; break;
				case 0x0021: sVersion = "SONARC Speech Compression"; break;
				case 0x0022: sVersion = "DSP Group True Speech"; break;
				case 0x0023: sVersion = "Echo Speech Corp."; break;
				case 0x0024: sVersion = "Virtual Music Audiofile AF36"; break;
				case 0x0025: sVersion = "Audio Processing Tech."; break;
				case 0x0026: sVersion = "Virtual Music Audiofile AF10"; break;
				case 0x0027: sVersion = "Aculab Prosody 1612"; break;
				case 0x0028: sVersion = "Merging Tech. LRC"; break;
				case 0x0030: sVersion = "Dolby AC2"; break;
				case 0x0031: sVersion = "Microsoft GSM610"; break;
				case 0x0032: sVersion = "MSN Audio"; break;
				case 0x0033: sVersion = "Antex ADPCM"; break;
				case 0x0034: sVersion = "Control Resources VQLPC"; break;
				case 0x0035: sVersion = "DSP Solutions DIGIREAL"; break;
				case 0x0036: sVersion = "DSP Solutions DIGIADPCM"; break;
				case 0x0037: sVersion = "Control Resources CR10"; break;
				case 0x0038: sVersion = "Natural MicroSystems VBX ADPCM"; break;
				case 0x0039: sVersion = "Crystal Semiconductors IMA ADPCM"; break;
				case 0x003A: sVersion = "Echo Speech ECHOSC3"; break;
				case 0x003B: sVersion = "Rockwell ADPCM"; break;
				case 0x003C: sVersion = "Rockwell DIGITALK"; break;
				case 0x003D: sVersion = "Xebec Multimedia"; break;
				case 0x0040: sVersion = "Antex G.721 ADPCM"; break;
				case 0x0041: sVersion = "Antex G.728 CELP"; break;
				case 0x0042: sVersion = "Microsoft MSG723"; break;
				case 0x0043: sVersion = "IBM AVC ADPCM"; break;
				case 0x0045: sVersion = "ITU-T G.726"; break;
				case 0x0050: sVersion = "Microsoft MPEG"; break;
				case 0x0051: sVersion = "RT23 or PAC"; break;
				case 0x0052: sVersion = "InSoft RT24"; break;
				case 0x0053: sVersion = "InSoft PAC"; break;
				case 0x0055: sVersion = "MP3"; break;
				case 0x0059: sVersion = "Cirrus"; break;
				case 0x0060: sVersion = "Cirrus Logic"; break;
				case 0x0061: sVersion = "ESS Tech. PCM"; break;
				case 0x0062: sVersion = "Voxware Inc."; break;
				case 0x0063: sVersion = "Canopus ATRAC"; break;
				case 0x0064: sVersion = "APICOM G.726 ADPCM"; break;
				case 0x0065: sVersion = "APICOM G.722 ADPCM"; break;
				case 0x0066: sVersion = "Microsoft DSAT"; break;
				case 0x0067: sVersion = "Microsoft DSAT-DISPLAY"; break;
				case 0x0069: if(nBPS == 4) sVersion = "XBOX IMA ADPCM"; else sVersion = "Voxware Byte Aligned";
					if(sz-8 == X.Sz()) sz -= 8; else if(sz-4 == X.Sz()) sz -= 4; else if(sz+8 == X.Sz()) sz += 8;
					break;
				case 0x0070: sVersion = "Voxware ACB"; break;
				case 0x0071: sVersion = "Voxware AC10"; break;
				case 0x0072: sVersion = "Voxware AC16"; break;
				case 0x0073: sVersion = "Voxware AC20"; break;
				case 0x0074: sVersion = "Voxware MetaVoice"; break;
				case 0x0075: sVersion = "Voxware MetaSound"; break;
				case 0x0076: sVersion = "Voxware RT29HW"; break;
				case 0x0077: sVersion = "Voxware VR12"; break;
				case 0x0078: sVersion = "Voxware VR18"; break;
				case 0x0079: sVersion = "Voxware TQ40"; break;
				case 0x007A:
					if(extIs('med')) {
						if(nBPS == 4) sVersion = "4-bit MS-IMA ADPCM";
						else if(nBPS == 3) sVersion = "3-bit MS-IMA ADPCM";
						else sVersion = "Voxware SC3/med"
					} else sVersion = "Voxware SC3"; break;
				case 0x007B: sVersion = "Voxware SC3"; break;
				case 0x0080: sVersion = "Soundsoft"; break;
				case 0x0081: sVersion = "Voxware TQ60"; break;
				case 0x0082: sVersion = "Microsoft MSRT24"; break;
				case 0x0083: sVersion = "AT&T G.729A"; break;
				case 0x0084: sVersion = "Motion Pixels MVI-MV12"; break;
				case 0x0085: sVersion = "DataFusion G.726"; break;
				case 0x0086: sVersion = "DataFusion GSM610"; break;
				case 0x0088: sVersion = "Iterated Systems Audio"; break;
				case 0x0089: sVersion = "Onlive"; break;
				case 0x008A: sVersion = "Multitude, Inc. FT SX20"; break;
				case 0x008B: sVersion = "Infocom IT’S A/S G.721 ADPCM"; break;
				case 0x008C: sVersion = "Convedia G729"; break;
				case 0x008D: sVersion = "Congruency, Inc. (not specified)"; break;
				case 0x0091: sVersion = "Siemens SBC24"; break;
				case 0x0092: sVersion = "Sonic Foundry Dolby AC3 APDIF"; break;
				case 0x0093: sVersion = "MediaSonic G.723"; break;
				case 0x0094: sVersion = "Aculab Prosody 8kbps"; break;
				case 0x0097: sVersion = "ZyXEL ADPCM"; break;
				case 0x0098: sVersion = "Philips LPCBB"; break;
				case 0x0099: sVersion = "Studer Professional Audio Packed"; break;
				case 0x00A0: sVersion = "Maiden PhonyTalk"; break;
				case 0x00A1: sVersion = "Racal Recorder GSM"; break;
				case 0x00A2: sVersion = "Racal Recorder G720.a"; break;
				case 0x00A3: sVersion = "Racal G723.1"; break;
				case 0x00A4: sVersion = "Racal Tetra ACELP"; break;
				case 0x00B0: sVersion = "NEC AAC NEC Corporation"; break;
				case 0x00FF: sVersion = "AAC"; break;
				case 0x0100: sVersion = "Rhetorex ADPCM"; break;
				case 0x0101: sVersion = "IBM u-Law"; break;
				case 0x0102: sVersion = "IBM a-Law"; break;
				case 0x0103: sVersion = "IBM ADPCM"; break;
				case 0x0111: sVersion = "Vivo G.723"; break;
				case 0x0112: sVersion = "Vivo Siren"; break;
				case 0x0120: sVersion = "Philips Speech Processing CELP"; break;
				case 0x0121: sVersion = "Philips Speech Processing GRUNDIG"; break;
				case 0x0123: sVersion = "Digital G.723"; break;
				case 0x0125: sVersion = "Sanyo LD ADPCM"; break;
				case 0x0130: sVersion = "Sipro Lab ACEPLNET"; break;
				case 0x0131: sVersion = "Sipro Lab ACELP4800"; break;
				case 0x0132: sVersion = "Sipro Lab ACELP8V3"; break;
				case 0x0133: sVersion = "Sipro Lab G.729"; break;
				case 0x0134: sVersion = "Sipro Lab G.729A"; break;
				case 0x0135: sVersion = "Sipro Lab Kelvin"; break;
				case 0x0136: sVersion = "VoiceAge AMR"; break;
				case 0x0140: sVersion = "Dictaphone G.726 ADPCM"; break;
				case 0x0150: sVersion = "Qualcomm PureVoice"; break;
				case 0x0151: sVersion = "Qualcomm HalfRate"; break;
				case 0x0155: sVersion = "Ring Zero Systems TUBGSM"; break;
				case 0x0160: sVersion = "Microsoft Audio1"; break;
				case 0x0161: sVersion = "Windows Media Audio V2 V7 V8 V9 / DivX audio (WMA) / Alex AC3 Audio"; break;
				case 0x0162: sVersion = "Windows Media Audio Professional V9"; break;
				case 0x0163: sVersion = "Windows Media Audio Lossless V9"; break;
				case 0x0164: sVersion = "WMA Pro over S/PDIF"; break;
				case 0x0170: sVersion = "UNISYS NAP ADPCM"; break;
				case 0x0171: sVersion = "UNISYS NAP ULAW"; break;
				case 0x0172: sVersion = "UNISYS NAP ALAW"; break;
				case 0x0173: sVersion = "UNISYS NAP 16K"; break;
				case 0x0174: sVersion = "MM SYCOM ACM SYC008 SyCom Technologies"; break;
				case 0x0175: sVersion = "MM SYCOM ACM SYC701 G726L SyCom Technologies"; break;
				case 0x0176: sVersion = "MM SYCOM ACM SYC701 CELP54 SyCom Technologies"; break;
				case 0x0177: sVersion = "MM SYCOM ACM SYC701 CELP68 SyCom Technologies"; break;
				case 0x0178: sVersion = "Knowledge Adventure ADPCM"; break;
				case 0x0180: sVersion = "Fraunhofer IIS MPEG2AAC"; break;
				case 0x0190: sVersion = "Digital Theater Systems DTS DS"; break;
				case 0x0200: sVersion = "Creative Labs ADPCM"; break;
				case 0x0202: sVersion = "Creative Labs FASTSPEECH8"; break;
				case 0x0203: sVersion = "Creative Labs FASTSPEECH10"; break;
				case 0x0210: sVersion = "UHER ADPCM"; break;
				case 0x0215: sVersion = "Ulead DV ACM"; break;
				case 0x0216: sVersion = "Ulead DV ACM"; break;
				case 0x0220: sVersion = "Quarterdeck Corp."; break;
				case 0x0230: sVersion = "I-Link VC"; break;
				case 0x0240: sVersion = "Aureal Semiconductor Raw Sport"; break;
				case 0x0241: sVersion = "ESST AC3"; break;
				case 0x0250: sVersion = "Interactive Products HSX"; break;
				case 0x0251: sVersion = "Interactive Products RPELP"; break;
				case 0x0260: sVersion = "Consistent CS2"; break;
				case 0x0270: sVersion = "ATRAC3/Sony SCX"; break;
				case 0x0271: sVersion = "Sony SCY"; break;
				case 0x0272: sVersion = "Sony ATRAC3"; break;
				case 0x0273: sVersion = "Sony SPC"; break;
				case 0x0280: sVersion = "TELUM Telum Inc."; break;
				case 0x0281: sVersion = "TELUMIA Telum Inc."; break;
				case 0x0285: sVersion = "Norcom Voice Systems ADPCM"; break;
				case 0x0300:
					if(sz-8 == X.Sz()) sz -= 8;
					if(nBPS == 4 && nBlockSize == 0x400*nChannels && sz == 0x14-8 && nChannels == 1) sVersion = "DVI IMA";
					else sVersion = "Fujitsu FM TOWNS SND";
					break;
				case 0x0301: sVersion = "Fujitsu (not specified)"; break;
				case 0x0302: sVersion = "Fujitsu (not specified)"; break;
				case 0x0303: sVersion = "Fujitsu (not specified)"; break;
				case 0x0304: sVersion = "Fujitsu (not specified)"; break;
				case 0x0305: sVersion = "Fujitsu (not specified)"; break;
				case 0x0306: sVersion = "Fujitsu (not specified)"; break;
				case 0x0307: sVersion = "Fujitsu (not specified)"; break;
				case 0x0308: sVersion = "Fujitsu (not specified)"; break;
				case 0x0350: sVersion = "Micronas Semiconductors, Inc. Development"; break;
				case 0x0351: sVersion = "Micronas Semiconductors, Inc. CELP833"; break;
				case 0x0400: sVersion = "Brooktree Digital"; break;
				case 0x0401: sVersion = "Intel Music Coder (IMC)"; break;
				case 0x0402: sVersion = "Ligos Indeo Audio"; break;
				case 0x0450: sVersion = "QDesign Music"; break;
				case 0x0500: sVersion = "On2 VP7 On2 Technologies"; break;
				case 0x0501: sVersion = "On2 VP6 On2 Technologies"; break;
				case 0x0555: sVersion = "Level-5 4-bit ADPCM"; //unofficial
					var fsz = sz+4*(X.U16(0x16, e)-1); if (fsz < X.Sz() && X.Sz() - fsz < 0x10) sz = fsz;
					break;
				case 0x0680: sVersion = "AT&T VME VMPCM"; break;
				case 0x0681: sVersion = "AT&T TCP"; break;
				case 0x0700: sVersion = "YMPEG Alpha (dummy for MPEG-2 compressor)"; break;
				case 0x08AE: sVersion = "ClearJump LiteWave (lossless)"; break;
				case 0x1000: sVersion = "Olivetti GSM"; break;
				case 0x1001: sVersion = "Olivetti ADPCM"; break;
				case 0x1002: sVersion = "Olivetti CELP"; break;
				case 0x1003: sVersion = "Olivetti SBC"; break;
				case 0x1004: sVersion = "Olivetti OPR"; break;
				case 0x1100: sVersion = "Lernout & Hauspie"; break;
				case 0x1101: sVersion = "Lernout & Hauspie CELP"; break;
				case 0x1102: sVersion = "Lernout & Hauspie SBC"; break;
				case 0x1103: sVersion = "Lernout & Hauspie SBC"; break;
				case 0x1104: sVersion = "Lernout & Hauspie SBC"; break;
				case 0x1400: sVersion = "Norris Comm. Inc."; break;
				case 0x1401: sVersion = "ISIAudio"; break;
				case 0x1500: sVersion = "AT&T Soundspace Music Compression"; break;
				case 0x181C: sVersion = "VoxWare RT24 speech"; break;
				case 0x181E: sVersion = "Lucent elemedia AX24000P Music"; break;
				case 0x1971: sVersion = "Sonic Foundry LOSSLESS"; break;
				case 0x1979: sVersion = "Innings Telecom Inc. ADPCM"; break;
				case 0x1C07: sVersion = "Lucent SX8300P speech"; break;
				case 0x1C0C: sVersion = "Lucent SX5363S G.723 compliant"; break;
				case 0x1F03: sVersion = "CUseeMe DigiTalk (ex-Rocwell)"; break;
				case 0x1FC4: sVersion = "NCT Soft ALF2CD ACM"; break;
				case 0x2000: sVersion = "FAST Multimedia DVM"; break;
				case 0x2001: sVersion = "Dolby DTS"; break;
				case 0x2002: sVersion = "RealAudio 1 / 2 14.4"; break;
				case 0x2003: sVersion = "RealAudio 1 / 2 28.8"; break;
				case 0x2004: sVersion = "RealAudio G2 / 8 Cook (low bitrate)"; break;
				case 0x2005: sVersion = "RealAudio 3 / 4 / 5 Music (DNET)"; break;
				case 0x2006: sVersion = "RealAudio 10 AAC (RAAC)"; break;
				case 0x2007: sVersion = "RealAudio 10 AAC+ (RACP)"; break;
				case 0x2500: sVersion = "Reserved range to 0x2600 Microsoft"; break;
				case 0x3313: sVersion = "makeAVIS (ffvfw fake AVI sound from AviSynth scripts)"; break;
				case 0x4143: sVersion = "Divio MPEG-4 AAC audio"; break;
				case 0x4201: sVersion = "Nokia adaptive multirate"; break;
				case 0x4243: sVersion = "Divio G726 Divio, Inc."; break;
				case 0x434C: sVersion = "LEAD Speech"; break;
				case 0x564C: sVersion = "LEAD Vorbis"; break;
				case 0x5756: sVersion = "WavPack Audio"; break;
				case 0x674F: sVersion = "Ogg Vorbis (mode 1)"; break;
				case 0x6750: sVersion = "Ogg Vorbis (mode 2)"; break;
				case 0x6751: sVersion = "Ogg Vorbis (mode 3)"; break;
				case 0x676F: sVersion = "Ogg Vorbis (mode 1+)"; break;
				case 0x6770: sVersion = "Ogg Vorbis (mode 2+)"; break;
				case 0x6771: sVersion = "Ogg Vorbis (mode 3+)"; break;
				case 0x7000: sVersion = "3COM NBX 3Com Corporation"; break;
				case 0x706D: sVersion = "FAAD AAC"; break;
				case 0x7A21: sVersion = "GSM-AMR (CBR, no SID)"; break;
				case 0x7A22: sVersion = "GSM-AMR (VBR, including SID)"; break;
				case 0xA100: sVersion = "Comverse Infosys Ltd. G723 1"; break;
				case 0xA101: sVersion = "Comverse Infosys Ltd. AVQSBC"; break;
				case 0xA102: sVersion = "Comverse Infosys Ltd. OLDSBC"; break;
				case 0xA103: sVersion = "Symbol Technologies G729A"; break;
				case 0xA104: sVersion = "VoiceAge AMR WB VoiceAge Corporation"; break;
				case 0xA105: sVersion = "Ingenient Technologies Inc. G726"; break;
				case 0xA106: sVersion = "ISO/MPEG-4 advanced audio Coding"; break;
				case 0xA107: sVersion = "Encore Software Ltd G726"; break;
				case 0xA109: sVersion = "Speex ACM Codec xiph.org"; break;
				case 0xDFAC: sVersion = "DebugMode SonicFoundry Vegas FrameServer ACM"; break;
				case 0xF1AC: sVersion = "Free Lossless Audio Codec FLAC"; break;
				case 0xFFFE: sVersion = "Extensible";
					var guid1 = X.U32(0x20, _LE), guid2 = (X.U16(0x24, _LE) << 16) | X.U16(0x26, _LE),
						guid3 = X.U32(0x28,_BE), guid4 = X.U32(0x2C,_BE);
					if(guid1 == 1 && guid2 == 0x10 && guid3 == 0x800000AA && guid4 == 0x00389B71)
						if(nBPS == 16) sVersion += ":PCM16";
					if(guid1 == 0xE923AABF && guid2 == 0xCB584471 && guid3 == 0xA119FFFA && guid4 == 0x01E4CE62)
						sVersion += ":ATRAC3+";
					if(guid1 == 0x47E142D2 && guid2 == 0x36BA4D8D && guid3 == 0x88FC6165 && guid4 == 0x4F8C836C)
						sVersion += ":ATRAC9";
					if(sz +0x18 == X.Sz()) sz += 0x18;
					else if(sz+0x38 == X.Sz()) sz += 0x38;
					else if(sz+0x40 == X.Sz()) sz -= 0x40;
					break;
				case 0xFFFF: sVersion = "Development"; break;
				default: sVersion = "Unknown:"+Hex(nFormat,4)
				}
				break;

			case "fact": dcsamples = X.U32(p, _LE); break; //the uncompressed (factual?) file size?

			case "data": checklist[1] = true; datasz = hksz;
				if (nBPS && nFormat == 1 && !(nBPS % 8)) {
					var nmSeconds = Math.round(X.U32(p - 4, e) / (nBPS >> 3) / nRate / nChannels * 10000) / 10;
					dur = new Date(nmSeconds).toISOString().substr(11, 8);
				}
				break;

			case "cue":
				var q = p + 4,
					hhd = "", hsz = 0;
				while (q < p + hksz && q < X.Sz()) {
					hhd = X.SA(q, 4);
					hsz = X.U32(q+4, _LE);
					q += 8;
					if(hhd == 'data') cue++;
					q += hsz + hsz & 1;
				}
				break;

			case "cmnt":
				cmt = cmt.appendS(X.SC(p+2,hksz-8,'SJIS'),'\n'); //gamerip stuff, so Japanese
				break;

			case "LIST": case "list": // lowercase non-standard but there are such files...
				if(["INFO","ADTL"].includes(X.SA(p,4).toUpperCase())) {
					var q = p + 4,
						hhd = "", hsz = 0;
					while (q < p + hksz && q < X.Sz()) {
						hhd = X.SA(q, 4);
						hsz = X.U32(q+4, _LE);
						q += 8;
						switch (hhd) {
							case "INAM": title = X.SC(q,hsz,'CP1252'); break;
							case "IART": by = X.SC(q,hsz,'CP1252'); break;
							case "ICMS": cms = X.SC(q,hsz,'CP1252'); break;
							case "ICOP": cop = X.SC(q,hsz,'CP1252'); break;
							case "ICRD": dt = X.SC(q,hsz,'CP1252'); break;
							case "ISFT": sft = X.SC(q,hsz,'CP1252'); break;
							case "IGNR": genre = X.SC(q,hsz,'CP1252'); break;
							case "ICMT": cmt = cmt.appendS(X.SC(q,hsz,'CP1252'),'\n'); break;
							case "labl": labl.push(X.SC(q+4,hsz-4,'CP1252').trim()); break;
							case "ltxt": txts.push(X.SC(q+0x14,hsz-0x14, X.SA(q+0x12,2)).trim()); break;
						}
						hsz += hsz & 1;
						q += hsz
					}
				}
				break;
			case "smpl": lp = X.U32(p+0x1C, e); break;
			case "wsmp": lp = X.U32(p+0x10, e); break;
			case "ctrl": lp = (X.I32(p, e) ? 1 : 0); break;
			case "NXBF": hksz = X.U32(p, e); p += 4; ch += '/'+X.U32(p+0xC, e); lp = X.I32(0x10, e) >= 0 ? 1 : 0; break;
			case "JUNK": checklist[2] = true; break
		}
		hksz += hksz & 1; //align
		p += hksz
	} // end of chunks

	if(!checklist[0] || !checklist[1]) return;  bDetected = true;
	sVersion += e == _LE? "/le": "/be";
	fact = Math.round(dcsamples / 0x100000);

	function is_ue4_msadpcm() {
		if(!extIs('adpcm')) return; //TODO tighten it enough that it can tell em apart
		function is_ue4_blocks() {
			var maxj = Math.min(10*nBlockSize, datasz);
			for(j=0; j < maxj; j += nBlockSize) {
				var coefs = X.U8(j), scale = X.U16(j+1, _LE);
				if(coefs > 7) return; 
				if(nBlockSize == 0x200) { if(scale == 0x00E6 && coefs != 0) return }
				else if(scale > 0x4000) return
			}
			return true
		}
		if(nChannels < 2 || fact > 0) return;
		if(fmtsz == 0x36 && nBlockSize != 0x200) return;
		if(fmtsz == 0x32 && ![0x200,0x9B,0x69].includes(nBlockSize)) return;
		return true
	}
	if(nFormat == 2 && nBPS == 4 && is_ue4_msadpcm()) sVersion = sVersion.appendS('UE4','/');

	if((nFormat & 0xFF00) == 0x6700 && sz+1 == X.Sz()) sz += 1;

	if (debug) if (chunks != "") _l2r('riff-wave',0,'chunks: ['+chunks+']');

	if(X.isVerbose()) {
		sOptionT(addEllipsis(title)); sOptionT(dt, 'created: '); sOptionT(addEllipsis(by),'by: ');
		sOptionT(genre, 'genre: '); sOptionT(addEllipsis(sft), 's/w: '); sOptionT(addEllipsis(cms), 'cms.by: ');
		sOptionT(cop, '©'); sOption(addEllipsis(cmt.trim()),'cmt: "', '"');
		if(labl.length) sOptionT(addEllipsis(labl.filter(function(x){return x.length>0}).join('; ')),'labels: "', '"');
		if(txts.length) sOptionT(addEllipsis(txts.filter(function(x){return x.length>0}).join('; ')),'captions: "', '"');
		sOption('ch:' + nChannels + (nBPS ? ' ' + nBPS + '-bit' : '') + ' s/r:' + nRate + 'Hz'
			+ (dcsamples ? ' fact:' + fact + 'M' : '') //for compressed things only
			+ (dur !== -1 ? ' len: '+dur : '')
			+ (lp > 0 ? ' looped'+(lp>1?'×'+lp:'') : '')
			+' sz:'+outSz(sz));
	}

	return result();
}
/* beautify ignore:end */


================================================
FILE: db/Binary/audio_WEM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG @kaens)
// ref. vgmstream > wwise.c , coding_utils.c

init("audio", "Audiokinetic Wwise RIFF (.WEM,.BNK)");
includeScript("vgmcodingutils");

/* beautify ignore:start */
function detect() {

    const debug = 0;

    var
        p = 0xC, e = _BE,
        fmtsz = fmtp = 0, xma2sz = xma2p = 0, datasz = datap = 0, vorbsz = vorbp = 0,
        wiihsz = wiihp = 0, seeksz = seekp = 0, smplsz = smplp = 0, metasz = metap = 0,
        hksz = 4,
        hkhd = "", title = "", dt = "", by = "", genre = "", cms = "", cmt = "", cop = "", sft = "";
    if (X.Sz() < 36) return;
    if(!X.c("'WAVE'",8) && !X.c("'XWMA'",8)) return;
    if(X.c("'RIFF'")) e = _LE;
    else if(X.c("'RIFX'")) e = _BE;
    else return;
if(debug) var chunks = "";
    while (p < X.Sz()) {
        hkhd = X.SA(p, 4);
        hksz = X.U32(p + 4, e);
        p += 8;
        if(debug) chunks += " " + hkhd + " [" + Hex(hksz) + "] @" + Hex(p);
        switch (hkhd) {
            case "fact": return; //shouldn't have any
            case "fmt ": fmtp = p; fmtsz = hksz; break;
            case "XMA2": xma2p = p; xma2sz = hksz; break;
            case "data": datap = p; datasz = hksz; break;
            case "vorb": vorbp = p; vorbsz = hksz; break;
            case "WiiH": wiihp = p; wiihsz = hksz; break;
            case "seek": seekp = p; seeksz = hksz; break;
            case "smpl": smplp = p; smplsz = hksz; break;
            case "meta": metap = p; metasz = hksz; break;
            default: if (p + hksz > X.Sz()) return
        }
        p += hksz
    } // end of chunks

    if(!datap) return;

    var nFormat = nRate = nChannels = nBPS = 0,
        dur = -1, sz = 8+X.U32(4, e),
        smp = xsz = chlo = chtp = 0;
        iswem = extIs('wem') || extIs('bnk'),
        info = [],
        lp = prefetch = false;
    if(xma2p) {
        nFormat = 0x165;
        info = xma2_pase_xma2_chunk(xma2p);
        nChannels = info[0]; nRate = info[1]; lp = info[2]; smp = info[3]
    }
    else {
        if(fmtsz < 0x10) return;
        nFormat = X.U16(fmtp, _LE);
        nChannels = X.U16(fmtp + 2, _LE);
        nRate = X.U32(fmtp + 4, _LE);
        nBlockSize = X.U16(fmtp + 0xC, _LE);
        nBPS = X.U16(fmtp + 0x0E, _LE);
        if (fmtsz > 0x10 && nFormat != 0x165 && nFormat != 0x166) xsz = X.U16(fmtp+0x14,_BE);
            if(xsz == 6)
                if((chlo=X.U32(p+0x14,_BE)) == nChannels) { chtp = (chlo >> 8) & 0xF; chlo >>= 12 }
    }
    if(nFormat == 0x166) {
        info = xma2_parse_fmt_chunk_extra(p, _BE);
        lp = info[0]; smp = info[1]
    }
    if(smplp && smplsz >= 34 && X.U32(p+0x1C) == 1 && X.U32(p+0x28) == 0) lp = true;

    switch(nFormat) {
    case 0x0001: sVersion = 'older Wwise, PCM'; prefetch = 1; break;
    case 0x0002: sVersion = 'newer Wwise IMA:platform ADPCM'; prefetch = 1;
        if(xsz == 0xC+nChannels*0x2E) sVersion += ':DSP+coefs';
        else if(xsz == 0xA && wiihp) sVersion += ':WiiH_DSP';
        else if(nBlockSize == 0x104*nChannels) sVersion += ':PTADPCM';
        break;
    case 0x0069: sVersion = 'older Wwise IMA'; prefetch = 1; break;
    case 0x0161: sVersion = 'Microsoft WMAv2'; prefetch = 1; break;
    case 0x0162: sVersion = 'Microsoft WMAPro'; prefetch = 1; break;
    case 0x0165: sVersion = 'Microsoft XMA2'; prefetch = 1; break;
    case 0x0166: sVersion = 'fmt-chunk Microsoft XMA2'; prefetch = 1; break;
    case 0x3039: sVersion = 'Opus NX'; prefetch = 1; break;
    case 0x3040: sVersion = 'Opus'; prefetch = 1; break;
    case 0x3041: sVersion = 'Wwise 2019.2.3 Opus_WEM/WW'; prefetch = 1; break;
    case 0x8311: sVersion = 'Wwise 2019.1 PTADPCM'; prefetch = 1; break;
    case 0xAAC0: sVersion = 'AAC'; break;
    case 0xFFF0: sVersion = 'DSP'; prefetch = 1; break;
    case 0xFFFB: sVersion = 'HEVAG'; break;
    case 0xFFFC: sVersion = 'ATRAC9'; prefetch = 1; break;
    case 0xFFFE: sVersion = 'PCM for Wwise Authoring'; prefetch = 1; break;
    case 0xFFFF: sVersion = 'Vorbis'; prefetch = 1; break;
    default:
        if(iswem) _setResult('audio', 'Wwise: unknown format ', Hex(nFormat, 4), ''); return
    }

    if(datap+datasz > X.Sz()) {
        if(datap+datasz < 0x5000 && X.Sz() > 0x10000) {
            _setResult('audio', 'Wwise: bad rip?', '' , 'datasz:'+Hex(datasz)); return;
        }
        if(prefetch) prefetch = 2; else return
    }

    if(nFormat == 0xFFFE && prefetch == 2 && X.c("'OggS'",datap)) sVersion = 'CP2077 Opus';

    bDetected = true;
    sVersion += e == _LE? "/le": "/be";

    if(smp) {
        var nmSeconds = Math.round(smp / nRate / nChannels * 10000) / 10;
        dur = new Date(nmSeconds).toISOString().substr(11, 8);
    }

    if(X.isVerbose()) {
        sOption('ch:' + nChannels + (nBPS ? ' ' + nBPS + '-bit' : '') + ' s/r:' + nRate + 'Hz'
            + (dur !== -1 ? ' len: '+dur : '')
            + (lp ? ' looped': '')
            +' sz:'+outSz(sz));
    }

    return result();
}
/* beautify ignore:end */

================================================
FILE: db/Binary/audio_mp3.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>
/*
   Ref: http://mpgedit.org/mpgedit/mpeg_format/mpeghdr.htm
        http://www.codeproject.com/Articles/8295/MPEG-Audio-Frame-Header
*/

meta("audio", "MP3 Audio File");

includeScript("duration");

var MP3 = {
    aVersion: ["2.5", "2", "1"],
    aLayer: ["III", "II", "I"],
    aRatev1: [32, 40, 48, 56, 64, 80, 96, 112, 128, 160, 192, 224, 256, 320, // Layer III
        32, 48, 56, 64, 80, 96, 112, 128, 160, 192, 224, 256, 320, 384, // Layer II
        32, 64, 96, 128, 160, 192, 224, 256, 288, 320, 352, 384, 416, 448
    ], // Layer I
    aRatev2: [8, 16, 24, 32, 40, 48, 56, 64, 80, 96, 112, 128, 144, 160, // Layers III & II
        32, 48, 56, 64, 80, 96, 112, 128, 144, 160, 176, 192, 224, 256
    ], // Layer I
    aFreq: [11025, 12000, 8000, // v2.5
        22050, 24000, 16000, // v2
        44100, 48000, 32000
    ], // v1
    aCh: ["Stereo", "Joint stereo", "Dual mono", "Mono"],

    header: function (nOffset) {
        // AAAAAAAA AAABBCCD EEEEFFGH IIJJKLMM
        var nHeader = X.U32(nOffset, _BE);
        if ((nHeader & 0xFFE00000) != ~~0xFFE00000) // AAAAAAAAAAA
        {
            return null;
        }
        var nVer = (nHeader >>> 19) & 3; // BB
        if (nVer == 1) // reserved
        {
            return null;
        }
        if (nVer > 1) {
            --nVer;
        }
        var nLayer = (nHeader >>> 17) & 3; // CC
        if (nLayer == 0) // reserved
        {
            return null;
        }
        --nLayer;
        var nBitrateIndex = (nHeader >>> 12) & 15; // EEEE
        if (nBitrateIndex == 0 || nBitrateIndex == 15) // free/bad
        {
            return null;
        }
        --nBitrateIndex;
        var nSamplingIndex = (nHeader >>> 10) & 3; // FF
        if (nSamplingIndex == 3) // reserved
        {
            return null;
        }
        var nPadding = (nHeader >>> 9) & 1; // G
        var nChannelMode = (nHeader >>> 6) & 3; // II

        var nBitrate = nVer == 2 ? this.aRatev1[nLayer * 14 + nBitrateIndex] :
            this.aRatev2[(nLayer == 2) * 14 + nBitrateIndex];
        var nFreq = this.aFreq[nVer * 3 + nSamplingIndex];
        var nTime;
        if (nLayer == 2) // Layer I
        {
            nTime = 384 / nFreq;
        } else if (nLayer == 1 || nVer == 2) // Layer II or v1,Layer III
        {
            nTime = 1152 / nFreq;
        } else // v2/2.5,Layer III
        {
            nTime = 576 / nFreq;
        }
        var bVBR = 1;
        var nVBR = Binary.findString(nOffset, 40, "Xing");
        if (nVBR == -1) {
            nVBR = Binary.findString(nOffset, 40, "Info");
            bVBR = 0;
        }
        if (nVBR != -1 && (X.U8(nVBR + 7) & 1)) {
            nTime *= X.U32(nVBR + 8, _BE);
            nOffset = bVBR ? -1 : -2;
        } else if (X.c("'VBRI'", nOffset + 32)) {
            nTime *= X.U32(nVBR + 46, _BE);
            nOffset = -1;
        } else {
            if (nLayer == 2) // Layer I
            {
                nOffset += Math.floor(12000 * nBitrate / nFreq + nPadding) * 4;
            } else {
                // 125 = 1000/8 = kilobits to bytes
                nOffset += Math.floor(125 * nBitrate * nTime + nPadding);
            }
        }
        return [this.aVersion[nVer],
        this.aLayer[nLayer],
            nBitrate,
            nFreq,
        this.aCh[nChannelMode],
            nTime,
            nOffset
        ];
    }
}

function detect() {
    if (X.Sz() >= 128) {
        if (X.c("'TAG'", X.Sz() - 128)) {
            sOptions = "ID3v1";
        }
        var nOffset = 0,
            bID3v2 = 0;
        if (X.c("'ID3'")) {
            nOffset = (X.U8(6) << 21) | (X.U8(7) << 14) | (X.U8(8) << 7) | (X.U8(9));
            nOffset += 10;
            if (sOptions == "") {
                sOptions = "ID3v2";
            } else {
                sOptions += "&2";
            }
            bID3v2 = 1;
        } else if (X.c("'WAVEfmt '........55", 8)) {
            nOffset = Binary.findString(50, 50, "data") + 8;
        }

        var aResult1, aResult = null;
        aResult1 = MP3.header(nOffset);

        if (aResult1 == null) {
            if (bID3v2) {
                // There may be some junk between the ID3 tag & the data (Win7
                // sample music files - C:\Users\Public\Music\Sample Music).
                // Since the ID3 tag is a fair indicator of an MP3, do a search
                // for v1,Layer III header.
                nOffset = Binary.findSignature(nOffset, 768, "FFFB");
                aResult1 = MP3.header(nOffset);
            }
            if (aResult1 == null) {
                return "";
            }
        }

        if (aResult1[6] > 0) {
            aResult = MP3.header(aResult1[6]);
            if (aResult == null) {
                return "";
            }
        }
        bDetected = true;
        // Assume version, layer & channels don't change.
        sVersion = aResult1[0] + ",Layer " + aResult1[1];

        if (File.isVerbose()) {
            var nFrames = 1,
                nRateSum = aResult1[2],
                nFreqSum = aResult1[3],
                nSeconds = aResult1[5];

            var bVBR = 0,
                bVF = 0;

            while (aResult != null) {
                nFrames++;
                nRateSum += aResult[2];
                nFreqSum += aResult[3];
                nSeconds += aResult[5];
                if (aResult[2] != aResult1[2]) {
                    bVBR = 1;
                }
                if (aResult[3] != aResult1[3]) {
                    bVF = 1;
                }
                aResult = MP3.header(aResult[6]);
            }
            sOptions = sOptions.append(Math.round(nRateSum / nFrames) + "kbps");
            if (bVBR) {
                sOptions += "(avg)";
            }
            sOptions = sOptions.append(Math.round(nFreqSum / nFrames) + "Hz");
            if (bVF) {
                sOptions += "(avg)";
            }
            sOptions = sOptions.append(aResult1[4], duration(nSeconds));
        }
    }

    return result();
}

================================================
FILE: db/Binary/backup_images.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("format", "");

function detect() {
    if (Binary.compare("7ca0932f")) {
        bDetected = true;
        sName = "R-Studio image";
        if (Binary.compare("78da", 0x38) != -1) {
            sOptions = "compressed (zlib)";
        }
    } else if (Binary.compare("'$CAN'")) {
        switch (Binary.readByte(4)) {
            case 0xe4:
                sOptions = "First or single file";
                break;
            case 0x60:
                sOptions = "next file";
                break;
        }
        bDetected = true;
        sName = "Norton Ghost image";
    }

    return result();
}

================================================
FILE: db/Binary/bin.Atari_ST.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("format", "Atari ST TOS executable");

function detect() {
    if (Binary.compare("601a0000....................0000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/bin.IDA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("format");

includeScript("zlib");

function detect() {
    if (Binary.getSize() >= 0x20) {
        if (Binary.compare("'IDA'..0000") && Binary.compare("DDCCBBAA", 0x1A)) {
            var nVer = Binary.read_uint16(0x1E);
            sVersion = nVer + ".0";
            switch (Binary.getString(0, 4)) {
                case "IDA0": bDetected = true; sName = "IDA Database (.IDB)"; break;
                case "IDA1": bDetected = true; sName = "IDA Database for 32-bit binary (.IDB)"; break;
                case "IDA2": bDetected = true; sName = "IDA Database for 64-bit binary (.I64)"; break;
            }

            if (bDetected) {
                switch (nVer) {
                    case 2: detect_zlib(Binary, Binary.read_uint32(0x06) + 0x05); break;
                    case 3: detect_zlib(Binary, Binary.read_uint32(0x06) + 0x05); break;
                    case 4: detect_zlib(Binary, Binary.read_uint32(0x06) + 0x05); break;
                    case 5: detect_zlib(Binary, Binary.read_uint32(0x06) + 0x09); break;
                    case 6: detect_zlib(Binary, Binary.read_uint32(0x06) + 0x09); break;
                }
            }
        } else if (Binary.compare("'IDASGN'")) {
            sName = "IDA FLIRT Signature Database (.SIG)";
            bDetected = true;

            const
                nVer = Binary.read_uint8(0x06),
                nModules = Binary.read_uint16(0x12),
                nFlags = Binary.read_uint8(0x10),
                nLibNameSz = Binary.read_uint8(0x22),
                nLibNameOf = 0x25;

            sVersion = nVer;

            if (!nModules) {
                nModules = Binary.read_uint32(0x25);
                nLibNameOf += 4;
                if (nVer >= 10) nLibNameOf += 4;
            }

            sOptions = "\"" + Binary.getString(nLibNameOf, nLibNameSz) + "\"";

            if (Binary.isVerbose()) {
                detect_zlib(Binary, nLibNameOf + nLibNameSz);
                sOption("modules:" + nModules); // count modules
                sOption("p:" + Binary.read_uint8(0x7)); // processor id
                sOption("a:" + Binary.read_uint16(0xE)); // application type
                sOption("o:" + Binary.read_uint16(0xC)); // os type
                sOption("f:" + Binary.read_uint32(0x8)); // file format type
            }
        } else if (Binary.compare("'IDATIL'")) {
            sName = "IDA Type Information List (.TIL)";
            sOptions = "\"" + Binary.getString(0xF, Binary.read_uint8(0xE)) + "\"";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/bin.ISO_9660.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "ISO 9660");

function detect() {
    if (Binary.getSize() > 0x8010) {
        if (Binary.compare("01'CD001'01", 0x8000) || Binary.compare("01'CD001'01", 0x9318) || Binary.compare("01'CD001'01", 0x9310)) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/bin.RPGMaker2Kdata.1.sg
================================================
// Detect It Easy: detection rule file
// Author:  Kaens TG@kaens

meta('game');

function detect() {
    /* beautify ignore:start */

    function isLCF() { //internal
        if (!X.isHeuristicScan() && (!X.c("'Lcf'", 1) || charStat(X.readBytes(1, X.U8(0)), 1).indexOf('allasc' < 0))) return false;
        return true
    }


    function isXYZ() {
        if (!X.c("'XYZ1'")) return false;
        w = X.U16(4); h = X.U16(6); var max = X.isHeuristicScan() ? 0x8000 : 0xA00;
        // 99.9999% images are within 800×800, but the official limit's 32000
        if (!isWithin(w, 1, max) || !isWithin(h, 1, max)) return false;
        return true
    }
    if (!bDetected && isXYZ()) {
        sName = 'RPGMaker 2000/2003 bitmap (.XYZ)'; bDetected = true; if (X.isVerbose()) sOption(w + '×' + h);
    }


    function isLSD() {
        //ref https://github.com/EasyRPG/liblcf/blob/master/src/generated/lcf/lsd/chunks.h etc.
        if (!isLCF()) return false; if (!X.c("0B") || !X.c("64", 12)) return false; bad = '';
        if (!X.c("'LcfSaveData'", 1))
            if (!X.isHeuristicScan()) return false;
            else bad = bad.addIfNone('!badsig'); // easyRPG won't quit just because the sig is wrong!
        if (!isWithin(dt = X.F64(0x10), 365 * 100, 365 * 200)) return false; // date test, days since 1900. I'll test 2000~2100, let's be real here
        var delphiEpoch = new Date(Date.UTC(1899, 11, 30));
        dt = new Date(delphiEpoch.getTime() + dt * 86400000); dt = dt.toISOString(); // Convert days to milliseconds, then to string
        ch0nm = ch1fs = ch2fs = ch3fs = ch4fs = ''; ch0lv = ch0hp = ch1fsi = ch2fsi = ch3fsi = ch4fsi = -1; info = '';
        for (idx = 0, p = 0x18; p < X.Sz();) {
            idx = readVarUInt(p); if (!isWithin(idx[0], 1, 3)) return false; p += idx[0]; idx = idx[1]; if (!idx) break;
            sz = readVarUInt(p); if (!isWithin(sz[0], 1, 5)) return false; p += sz[0]; sz = sz[1];
            switch (idx) {
                case 0x0B: heronm = X.SC(p, sz, 'SJIS'); break;
                case 0x0C: herolv = readVarUInt(p, sz)[1]; break;
                case 0x0D: herohp = readVarUInt(p, sz)[1]; break;
                case 0x15: ch1fs = X.SC(p, sz, 'SJIS'); break;
                case 0x16: ch1fsi = readVarUInt(p, sz)[1]; break;
                case 0x17: ch2fs = X.SC(p, sz, 'SJIS'); break;
                case 0x18: ch2fsi = readVarUInt(p, sz)[1]; break;
                case 0x19: ch3fs = X.SC(p, sz, 'SJIS'); break;
                case 0x1A: ch3fsi = readVarUInt(p, sz)[1]; break;
                case 0x1B: ch4fs = X.SC(p, sz, 'SJIS'); break;
                case 0x1C: ch4fsi = readVarUInt(p, sz)[1]; break;
            }
            p += sz
        }
        bad = ''; v = ''; sz = p;
        for (calcidx = 0x65; p < X.Sz(); calcidx = (calcidx < 0x72 ? calcidx + 1 : 0xC8)) {
            idx = readVarUInt(p); if (!isWithin(idx[0], 1, 3)) return false; p += idx[0]; idx = idx[1]; if (!idx) break;
            if (calcidx != idx) if (calcidx != 0xC8) { bad = bad.addIfNone('!brokenchunk'); break }
            sz = readVarUInt(p); if (!isWithin(sz[0], 1, 5) || !sz[1]) return false;
            p += sz[0]; sz = sz[1];
            switch (idx) {
                case 0xC8: tag = 'easyRPG_data';
                    if (readVarUInt(p)[1] == 1) { t = readVarUInt(p + 1)[1]; v = readVarUInt(p + 2)[1]; v = (((v >> 8) & 0xFF) | (v & 0xFF) << 8).toString(16) }
                    break;
                case 0x6C: tag = 'actors';
                    for (q = p + 2/*2D array idx? skip 2 bytes, test more*/; q < p + sz;) {
                        idx2 = readVarUInt(q); if (!isWithin(idx2[0], 1, 3)) { _l2r('lsd', q, 'idx2=' + Hex(idx2[0]) + ' is weird'); q = p + sz; continue }
                        q += idx2[0]; idx2 = idx2[1]; if (!idx2) break;
                        sz2 = readVarUInt(q); if (!isWithin(sz2[0], 1, 5)) return false;
                        q += sz2[0]; sz2 = sz2[1];
                        switch (idx2) {
                            case 1: t = X.SA(q, sz2); info = info.append('actor:' + (t == '\x01' ? '*' : X.SC(q, sz2, 'SJIS'))); break
                            case 2: t = X.SA(q, sz2); info = info.append('title:' + (t == '\x01' ? '*' : X.SC(q, sz2, 'SJIS'))); break
                            case 0x0B: t = X.SC(q, sz2, 'SJIS'); if (t.length) info = info.append('char:' + t); break
                            case 0x15: t = X.SC(q, sz2, 'SJIS'); if (t.length) info = info.append('sprite:' + t); break
                            case 0x1F: info = info.append('level:' + readVarUInt(q)[1]); break
                            case 0x21: t = readVarUInt(q)[1]; if (t) info = info.append('hpmod:' + t); break
                            case 0x22: t = readVarUInt(q)[1]; if (t) info = info.append('spmod:' + t); break
                            case 0x47: info = info.append('curhp:' + readVarUInt(q)[1]); break
                            case 0x48: info = info.append('cursp:' + readVarUInt(q)[1]); break
                        }
                        q += sz2
                    }
                    break;
                case 0x65: tag = 'system'; break; case 0x66: tag = 'screen'; break; case 0x67: tag = 'pictures'; break;
                case 0x68: tag = 'party_loc'; break; case 0x69: tag = 'boat_loc'; break; case 0x6A: tag = 'ship_loc'; break;
                case 0x6B: tag = 'airship_loc'; break; case 0x6D: tag = 'inventory'; break;
                case 0x6E: tag = 'teleport_targets'; break; case 0x6F: tag = 'map_info'; break; case 0x70: tag = 'panorama'; break;
                case 0x71: tag = 'fg_ev_execstate'; break; case 0x72: tag = 'common_events'; break;
                default: tag = 'ERROR!' + Hex(idx)
            }
            p += sz; if (idx == 0xC8) break
        }
        if (p > X.Sz()) return false; sz = p;
        if (idx == 0xC8) sVersion = 'easyRPG' + (v.length ? ' v' + v.slice(0, 4) : ''); else sVersion = 'RPG_RT';
        return true
    }
    if (!bDetected && isLSD()) {
        sName = "RPGMaker 2000/2003 save data (.LSD)"; bDetected = true;
        if (bad.length) sVersion = sVersion.appendS('malformed' + bad, '/')
        if (X.isVerbose()) {
            sOption('on: ' + dt.slice(0, 19)); sOption(heronm + ' lv.' + herolv + ' ' + herohp + 'HP', 'preview: ');
            if (ch1fsi >= 0) sOption(ch1fs); if (ch2fsi >= 0) sOption(ch2fs); if (ch3fsi >= 0) sOption(ch3fs); if (ch4fsi >= 0) sOption(ch4fs);
            sOption(info, 'info: ')
            sOption(outSz(sz), 'sz:')
        }
    }


    function isLMT() {
        //ref https://github.com/EasyRPG/liblcf/blob/master/src/generated/lcf/lmt/chunks.h etc.
        if (!isLCF()) return false; if (!X.c("0A")) return false; bad = '';
        if (!X.c("'LcfMapTree'", 1))
            // if(!X.isHeuristicScan())
            return false;
        // else
        // 	bad = bad.addIfNone('!badsig'); // easyRPG won't quit just because the sig is wrong! But we will, because there's not much more to detect it by
        i = readVarUInt(0xB); if (!isWithin(i[0], 1, 5)) return false; p = 0xB + i[0] + 1; len = i[1];
        title = ''; maps = [];
        for (idx = i = 0; p < X.Sz() && i < len;) {
            if (idx == 0x33) {
                p += readVarUInt(p)[0]; aid = readVarUInt(p); p += aid[0]; aid = aid[1]; //array idx
                if (aid < ++i) { bad = bad.addIfNone('!badidx'); break }
            }
            if (i >= len) break;
            idx = readVarUInt(p); if (!isWithin(idx[0], 1, 3)) return false; p += idx[0]; idx = idx[1];
            sz = readVarUInt(p); if (!isWithin(sz[0], 1, 5) || !sz[1]) return false; p += sz[0]; sz = sz[1];
            switch (idx) {
                case 1: t = X.SC(p, sz, 'SJIS');
                    if (!title.length) title = t; else maps.push(aid + '.' + t);
                    break;
            }
            p += sz;
        }
        //tree_order length is in aid
        for (i = 0; i < aid + 1; i++) p += readVarUInt(p)[0]; // tree_order + active_node
        //_l2r('lmt',p,'Start')
        for (i = 0; p < X.Sz();) {
            idx = readVarUInt(p); if (!isWithin(idx[0], 1, 3)) return false; p += idx[0]; idx = idx[1];
            if (!idx) break;
            sz = readVarUInt(p); if (!isWithin(sz[0], 1, 5) || !sz[1]) return false; p += sz[0]; sz = sz[1];
            p += sz
        }
        sz = p;
        if (sz > X.Sz()) return false;
        return true
    }
    if (!bDetected && isLMT()) {
        sName = "RPGMaker 2000/2003 map tree data (.LMT)"; bDetected = true;
        if (bad.length) sVersion = sVersion.appendS('malformed' + bad, '/')
        if (X.isVerbose()) {
            sOption('for: ' + title); sOption(addEllipsis(maps.join('\r'), 0xC000), len + ' maps:'); sOption(outSz(sz), 'sz:')
        }
    }


    function isLDB() {
        //ref https://github.com/EasyRPG/liblcf/blob/master/src/generated/lcf/ldb/chunks.h etc.
        if (!isLCF()) return false; if (!X.c("0B") || !X.c("0B", 0xC)) return false; bad = '';
        if (!X.c("'LcfDataBase'", 1))
            // if(!X.isHeuristicScan())
            return false;
        // else
        // 	bad = bad.addIfNone('!badsig'); // easyRPG won't quit just because the sig is wrong! But we will, because there's not much more to detect it by
        var debug = -1, char = []; chars = [];
        function ret(p, t) { if (debug >= 1) _l2r('ldb', p, t); return false }
        for (idx = i = 0, p = 0xC; p < X.Sz(); i++) { // go over all chunks found
            idx = readVarUInt(p); if (!isWithin(idx[0], 1, 3)) return ret(p, 'bad idx'); p += idx[0]; idx = idx[1];
            if (!isWithin(idx, 0xB, 0x1F)) if (i < 14) return ret(p, 'bad tag ' + idx);
            else { p--; break } //to tell the expected file length. idx = 00 is the last byte
            sz = readVarUInt(p); if (!isWithin(sz[0], 1, 6) || !sz[1]) return ret(p, 'bad size ' + sz[1]); p += sz[0]; sz = sz[1];
            if (idx == 0xB) { // an array; let's analyse the Characters one
                for (q = p; q < p + sz && q < X.Sz();) {
                    for (len = j = 0; q < p + sz && q < X.Sz(); j++) {
                        t = readVarUInt(q); if (!isWithin(t[0], 1, 3)) return false; q += t[0]; t = t[1];
                        if (!len) { len = t; j = 0 }
                        t = readVarUInt(q); if (!isWithin(t[0], 1, 3)) return false; q += t[0]; t = t[1];
                        for (; q < p + sz && q < X.Sz();) {
                            idx1 = readVarUInt(q); if (!isWithin(idx1[0], 1, 3)) return false; q += idx1[0]; idx1 = idx1[1];
                            if (!idx1) { q--; break }
                            sz1 = readVarUInt(q); if (!isWithin(sz1[0], 1, 5)) return ret(q, 'sz off at idx1=' + Hex(idx1)); q += sz1[0]; sz1 = sz1[1];
                            switch (idx1) {
                                case 1: char.push(X.SC(q, sz1, 'SJIS')); break; //name
                                case 2: char.push(X.SC(q, sz1, 'SJIS')); break; //title
                                default: if (char.length) chars.push(char.join(': '));
                                    char = []
                            }
                            q += sz1
                        }
                    }
                    i++
                }
            }
            p += sz
        }
        sz = p;
        return true
    }
    if (!bDetected && isLDB()) {
        sName = "RPGMaker 2000/2003 database (.LDB)"; bDetected = true;
        if (bad.length) sVersion = sVersion.appendS('malformed' + bad, '/')
        if (X.isVerbose()) {
            sOption(addEllipsis(chars.join(', ')), 'chars:')
            sOption(outSz(sz), 'sz:')
        }
    }


    function isLMU() {
        //ref https://github.com/EasyRPG/liblcf/blob/master/src/generated/lcf/ldb/chunks.h etc.
        if (!isLCF()) return false; if (!X.c("0A")) return false; bad = '';
        if (!X.c("'LcfMapUnit'", 1)) return false;
        id = -1; bg = ''; bgf = false;
        for (idx = i = 0, p = 0xB; p < X.Sz(); i++) { // go over all chunks found
            idx = readVarUInt(p); if (!isWithin(idx[0], 1, 3)) return false; p += idx[0]; idx = idx[1];
            if (!isWithin(idx, 1, 91)) if (i < 3) return false
            else break //to tell the expected file length. idx = 00 is the last byte
            sz = readVarUInt(p); if (!isWithin(sz[0], 1, 6) || !sz[1]) return false; p += sz[0]; sz = sz[1];
            switch (idx) {
                case 1: id = readVarUInt(p)[1]; break;
                case 31: bgf = true; break;
                case 32: bg = X.SC(p, sz, 'SJIS'); break
            }
            p += sz
        }
        sz = p;
        if (sz > X.Sz()) return false;
        return true
    }
    if (!bDetected && isLMU()) {
        sName = "RPGMaker 2000/2003 map unit (.LMU)"; bDetected = true;
        if (bad.length) sVersion = sVersion.appendS('malformed' + bad, '/')
        if (X.isVerbose()) {
            if (id >= 0) sOption(id, 'id:'); if (bgf) sOption(bg, 'bg:"', '"'); sOption(outSz(sz), 'sz:')
        }
    }


    return result()
    /* beautify ignore:end */
}

================================================
FILE: db/Binary/data_overlay_null_padding.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Detects zero-byte overlay padding added by linkers to align the output file
// to sector (0x200) or page (0x1000) boundaries.
// Example: TLINK32 pads PE files with null bytes up to the next 0x1000 boundary.

function detect() {
    if (!Binary.isOverlay()) {
        return result();
    }

    var nSize = Binary.getSize();

    if (Binary.isZeroFilled(0, nSize)) {
        _setResult("overlay", "null padding", "", "");
    }
}


================================================
FILE: db/Binary/data_overlays.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("data", "");

function detect() {
    if (Binary.isOverlay()) {
        if (Binary.compare("'aWAW'")) {
            sName = "CreateInstall data";
            bDetected = true;
        } else if (Binary.compare("';!@Install@!UTF-8!'")) {
            sName = "7-zip Installer data";
            bDetected = true;
        } else if (Binary.compare("00'TMSAMVOH'")) {
            sName = "ActiveMark protector data";
            bDetected = true;
        } else if (Binary.compare("....................'MSCF'00")) {
            sName = "Actual Installer data";
            bDetected = true;
        } else if (Binary.compare("'10JP'")) {
            sName = "Adveractive Installer data";
            bDetected = true;
        } else if (Binary.compare("'EWETAR DATA FILE!! VER 1.00 <<<>>>'")) {
            sName = "Aeco Systems installer data";
            bDetected = true;
        } else if (Binary.compare("c0ab........60ea")) {
            sName = "ARJSFX32 data";
            bDetected = true;
        } else if (Binary.compare("67570402")) {
            sName = "ARQ archive";
            bDetected = true;
        } else if (Binary.compare("0b0bafaf0b0ba4")) {
            sName = "AutoPlay Media Studio installer data";
            bDetected = true;
        } else if (Binary.compare("'wwgT)'") || Binary.compare("..120100....0000")) {
            sName = "ClickTeam installer data";
            bDetected = true;
        } else if (Binary.compare("'CK16'")) {
            sName = "CrypKey Installer archive";
            bDetected = true;
        } else if (Binary.compare("........'DIMDMSCF'")) {
            sName = "Dimd SFX data";
            sOptions = "CAB";
            bDetected = true;
        } else if (Binary.compare("'[metadata]'")) {
            sName = "distutils installer data";
            bDetected = true;
        } else if (Binary.compare("b297e169")) {
            sName = "Envoy Packager data";
            bDetected = true;
        } else if (Binary.compare("'EPSF'")) {
            sName = "Eschalon Installer archive";
            bDetected = true;
        } else if (Binary.compare("........'SPIS'1a'LH5'")) {
            sName = "GPInstall data";
            sOptions = "SPIS LH5";
            bDetected = true;
        } else if (Binary.compare("'zlb'1A") || Binary.compare("'idska32'1A")) {
            sName = "Inno Setup Installer data";
            bDetected = true;
        } else if (Binary.compare("'Inno Setup Messages'")) {
            sName = "Inno Setup uninstall data";
            bDetected = true;
        } else if (Binary.compare("'1CNT'")) {
            sName = "LucasArts Update Installer data";
            bDetected = true;
        } else if (Binary.compare("'MPU'0d")) {
            sName = "MP-ZipTool SFX32 data";
            bDetected = true;
        } else if (Binary.compare("'MPQ'1a20")) {
            sName = "MPQ archive";
            bDetected = true;
        } else if (Binary.compare("'PK??NOS_PO'") || Binary.compare("'NOS_PO'")) {
            sName = "NOS Installer data";
            bDetected = true;
        } else if (Binary.compare("970300000201")) {
            sName = "Pantaray QSetup data";
            sVersion = "10.X";
            bDetected = true;
        } else if (Binary.compare("370700000201")) {
            sName = "Pantaray QSetup data";
            sVersion = "11.X";
            bDetected = true;
        } else if (Binary.compare("04'PBG'")) {
            sName = "Paquet archive";
            bDetected = true;
        } else if (Binary.compare("'PB'................................'7z'")) {
            sName = "Paquet Builder";
            sOptions = "7zip";
            bDetected = true;
        } else if (Binary.compare("'qres'")) {
            sName = "QT installer data";
            bDetected = true;
        } else if (Binary.compare("4B2A9A") || Binary.compare("4B2A84")) {
            sName = "RTPatch archive";
            bDetected = true;
        } else if (Binary.compare("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7")) {
            sName = "Setup Factory installer data";
            sVersion = "8.X, 9.X";
            bDetected = true;
        } else if (Binary.compare("e0e1e2e3e4e5e6")) {
            sName = "Setup Factory installer data";
            sVersion = "4.X, 5.X";
            bDetected = true;
        } else if (Binary.compare("67155234ff4d3642")) {
            sName = "STATICSUP installer data";
            bDetected = true;
        } else if (Binary.compare("'ESIV'") || Binary.compare("'SIVM'", 0xf000)) {
            sName = "Vise Installer data";
            bDetected = true;
        } else if (Binary.compare("'RsDl'")) {
            sName = "WinImage SFX data";
            bDetected = true;
        } else if (Binary.compare("'IMP'0a")) {
            sName = "IMP archive";
            bDetected = true;
        } else if (Binary.compare("'@Daisy@Lucy@xyzzy@'................1f8b08")) {
            sName = "WinPatch Apply Program data";
            sOptions = "gzip";
            bDetected = true;
        } else if (Binary.compare("'@Daisy@Lucy@xyzzy@'1f8b08")) {
            sName = "WinPatch Apply Program data";
            sOptions = "gzip";
            bDetected = true;
        } else if (Binary.compare("'***messages***'")) {
            sName = "WinRAR Installer data";
            bDetected = true;
        } else if (Binary.compare("fffe2a002a002a006d0065007300730061006700650073002a002a002a00")) {
            sName = "WinRAR Installer data";
            sVersion = "5.X";
            bDetected = true;
        }
        /* else if(Binary.compare("'Rar!'"))
        {
            sName="RAR archive";
            bDetected=1;
        } */
        else if (Binary.compare("'MPV*'")) {
            sName = "ZipCentral SFX-32 data";
            bDetected = true;
        } else if (Binary.compare("'[20/20]'")) {
            sName = "PCInstall data";
            bDetected = true;
        } else if (Binary.compare("'ISSetupStream'")) {
            sName = "InstallShield data";
            sVersion = "18.X";
            bDetected = true;
        } else if (Binary.compare("'FWS'") || Binary.compare("'CWS'")) {
            sName = "Adobe Flash";
            bDetected = true;
        } else if (Binary.compare("'Smart Install Maker v'")) {
            sName = "Smart Install Maker data";
            sVersion = Binary.getString(Binary.getOverlayOffset() + 0x17);
            bDetected = true;
        } else if (Binary.compare("....0000dcedbd")) {
            sName = "PackageForTheWeb data";
            sOptions = "InstallShield";
            bDetected = true;
        } else if (Binary.compare("'00000000000000BD00000000000000010000000000000001'", 0x19a0)) {
            sName = "Autodesk Self-Extract data";
            bDetected = true;
        } else if (Binary.compare("c0dececb8d8d8d8d")) {
            sName = "Ghost Installer archive";
            sOptions = "xored MSCF, mask: 8D";
            bDetected = true;
        } else if (Binary.compare("02060a0405fd59")) {
            sName = "CreateInstall data";
            sVersion = "2003.3.5";
            bDetected = true;
        } else if (Binary.compare("'RWMV'")) {
            sName = "VMWare Installation Launcher data";
            bDetected = true;
        } else if (Binary.compare("........'GRCSETUPINFORMATION'")) {
            sName = "Codegear Installer data";
            bDetected = true;
        } else if (Binary.compare("'xvm'0003")) {
            sName = "Spoon Studio data";
            bDetected = true;
        } else if (Binary.compare("2f30ee1f5e4ee51e")) {
            sName = "Advanced Installer data";
            sOptions = "MS Compound-like format";
            bDetected = true;
        } else if (Binary.compare("'^OPT'")) {
            var ArcOffset = Binary.findString(Binary.getOverlayOffset(), 0x50, "^ARC");
            if (ArcOffset != -1) {
                if (Binary.compare("1f8b08", ArcOffset + 4)) {
                    sName = "Adobe SVG Installer";
                    sOptions = "gzip";
                    bDetected = true;
                }
            }
        } else if (Binary.compare("07d26cbf2159abaa0100000000")) {
            sName = "Chilkat ZIP Self-Extractor data";
            bDetected = true;
        } else if (Binary.compare("'IST'00")) {
            sName = "Dolphin Virtual Machine data";
            sVersion = "5.0";
            bDetected = true;
        } else if (Binary.compare("'@._P-DATA_.@'")) {
            sName = "CodeFusion Wizard data";
            bDetected = true;
        } else if (Binary.compare("'ASWsetupFPkgFil3'")) {
            sName = "avast! Antivirus installer data";
            bDetected = true;
        } else if (Binary.compare("5b3e")) {
            var ArcOffset = Binary.findSignature(Binary.getOverlayOffset(), 0x500, "'PK'0304");
            if (ArcOffset != -1) {
                sName = "InstallAnywhere data";
                sOptions = "zip";
                bDetected = true;
            }
        } else if (Binary.compare("........efbeadde'NullsoftInst'")) {
            sName = "NSIS data";
            bDetected = true;
        } else if (Binary.compare("................fec1cd666ebccf01fec1cd666ebccf0100..............78da")) {
            sName = "Internet Download Manager installer data";
            sOptions = "zlib";
            bDetected = true;
        } else if (Binary.compare("d513e4e801000000")) {
            sName = "Install4j installer data";
            bDetected = true;
        } else if (Binary.compare("efbbbf';!@Install@!UTF-8!'")) {
            sName = "7-zip Installer data";
            bDetected = true;
        } else if (Binary.compare("'UM'030a00")) {
            sName = "Sony Windows installer data";
            bDetected = true;
        } else if (Binary.compare("7b00320030003700320036003300370037002d00")) {
            sName = "ADS Self Extractor data";
            bDetected = true;
        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "7b00320030003700320036003300370037002d00") != -1) {
            sName = "ADS Self Extractor data";
            bDetected = true;
        } else if (Binary.compare("276327631226097513180178")) {
            sName = "Chaos Software installer data";
            bDetected = true;
        } else if (Binary.compare("'OWS9G1'", 0xb)) {
            sName = "Gentee installer data";
            bDetected = true;
        } else if (Binary.compare("'SQ5SFX'")) {
            sName = "Squeez SFX data";
            bDetected = true;
        } else if (Binary.compare("'Inno Setup Setup Data'")) {
            sName = "Inno Setup data";
            bDetected = true;
        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "'MSCF00000000'") != -1) {
            sName = "CAB archive";
            bDetected = true;
        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "'ISc('") != -1) {
            sName = "InstallShield archive";
            bDetected = true;
        } else if (Binary.compare("'ExcelsiorII1'")) {
            sName = "Excelsior installer data";
            bDetected = true;
        } else if (Binary.compare("'InstallShield'00")) {
            sName = "InstallShield data";
            sOptions = "2.X-3.X";
            bDetected = true;
        } else if (Binary.compare("'wwwwI'874712")) {
            sName = "Multimedia Fusion installer data";
            bDetected = true;
        } else if (Binary.compare("'PIMPFILE'00")) {
            sName = "PIMP installer data";
            bDetected = true;
        } else if (Binary.compare("'tiz1'........78da")) {
            sName = "Tarma installer data";
            sOptions = "zlib";
            bDetected = true;
        } else if (Binary.compare("'XXataDfOnigeB'")) {
            sName = "I-D Media installer data";
            bDetected = true;
        } else if (Binary.compare("'This is the end of the executable'")) {
            sName = "SwiftView installer data";
            bDetected = true;
        } else if (Binary.compare("1f8b08", 0x3000)) {
            sName = "BulletProofSoft installer data";
            sOptions = "gzip";
            bDetected = true;
        } else if (Binary.compare("'AddD'03")) {
            sName = "SecuROM data";
            var nOffset = Binary.getOverlayOffset();
            sVersion = Binary.getString(nOffset + 8);
            bDetected = true;
        } else if (Binary.compare("'NB02'")) {
            sName = "CodeView 3.14 debug information";
            bDetected = true;
        } else if (Binary.compare("'NB09'")) {
            sName = "CodeView 4.10 debug information";
            bDetected = true;
        } else if (Binary.compare("'NB11'")) {
            sName = "CodeView 5.0 debug information";
            bDetected = true;
        } else if (Binary.compare("'NB10'")) {
            sName = "PDB 2.0 file link";
            bDetected = true;
        } else if (Binary.compare("'RSDS'")) {
            sName = "PDB 7.0 file link";
            bDetected = true;
        } else if (Binary.compare("'[(*|*)]MZ'")) {
            sName = "Mioplanet installer executable+data"
            bDetected = true;
        } else if (Binary.compare("'MPV'")) {
            sName = "DelZip SFX data";
            bDetected = true;
        } else if (Binary.compare("'MPU'00")) {
            sName = "CoffeeCup SFX data";
            bDetected = true;
        } else if (Binary.compare("'<KRZIP FILE BEGINS HERE>'")) {
            sName = "KRZIP archive";
            bDetected = true;
        } else if (Binary.compare("..........87000001........5d0000800000")) {
            sName = "Smart Install Maker data";
            bDetected = true;
        } else if (Binary.compare("'RS'")) {
            sName = "AOLSetup data";
            bDetected = true;
        } else if (Binary.compare("'TGCF'")) {
            sName = "Setup-Specialist archive";
            bDetected = true;
        } else if (Binary.compare("a3484bbe986c4aa9")) {
            sName = "AutoIt compiled script";
            sVersion = "2.XX-3.XX";
            bDetected = true;
        } else if (Binary.compare("'MSCF'00000000")) {
            sName = "CAB archive";
            bDetected = true;
        } else if (Binary.compare("'PK'0304")) {
            sName = "ZIP archive";
            bDetected = true;
        } else if (Binary.compare("'$_BIM_CONFIG_START_$")) {
            sName = "Bytessence Install Maker data";
            bDetected = true;
        } else if (Binary.compare("........'.eh_frame'00")) {
            sName = "BitRock installer data";
            bDetected = true;
        } else if (Binary.compare("09050000")) {
            sName = "ThinApp data";
            bDetected = true;
        } else if (Binary.compare("BDA6EEE9F9EDEFEDE5ED")) {
            sName = "Hamrick Software XOR-ed ZIP";
            bDetected = true;
        } else if (Binary.compare("000000000000000038e8020000000000")) {
            sName = "Box Stub installer data";
            bDetected = true;
        } else if (Binary.compare("a7870800")) {
            sName = "Install Factory data";
            bDetected = true;
        } else if (Binary.compare("a7870800")) {
            sName = "Install Factory data";
            bDetected = true;
        } else if (Binary.compare("a6d6b210")) {
            sName = "Sax Software archive";
            bDetected = true;
        } else if (Binary.compare("'Win_Sfx_For_Windows_'")) {
            sName = "XZIP-SFX data";
            sOptions = "by Netzip";
            bDetected = true;
        } else if (X.SU16(2, 16) == "[GeneralOptions]") {
            sName = "Advanced Installer data";
            bDetected = true;
        } else if (Binary.compare("d90e0100889f")) {
            sName = "Winlicense xored EXE (0xC5 xor mask)";
            bDetected = true;
        }

        /* var ArcOffset=Binary.findSignature(Binary.getOverlayOffset(),0x400, "'|http:'");
        if(ArcOffset!=-1)
        {
            sName="Pantaray QSetup data";
            sVersion="6.X";
            bDetected=1;
        }
        var ArcOffset=Binary.findSignature(Binary.getOverlayOffset(),0x400, "'|www.'");
        if(ArcOffset!=-1)
        {
            sName="Pantaray QSetup data";
            sVersion="8.X";
            bDetected=1;
        } */
    }

    return result();
}

================================================
FILE: db/Binary/debug_data_debugData.1.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("debug data", "");

function detect() {
    var size = Binary.getSize();

    // Borland debug info
    if (Binary.readWord(0) === 0x52FB) {
        var minor = Binary.readByte(2),
            major = Binary.readByte(3),
            minorStr = ((minor >> 4) * 10 + (minor & 0x0F)).toString(),
            majorStr = ((major >> 4) * 10 + (major & 0x0F)).toString(),
            sVer = majorStr + "." + minorStr;

        _setResult(sType, "Borland", sVer, "TDS" + (Binary.readWord(0xE) ? " " + Binary.readWord(0xE) + " symbols" : ""));
        return true;
    } else if (Binary.compare("'FB09'")) {
        _setResult(sType, "Borland", "", "Delphi TDS");
        return true;
    } else if (Binary.compare("'FB0A'")) {
        _setResult(sType, "Borland", "", "C++ TDS");
        return true;
    }

    var debugSize = Binary.readDword(size - 4);

    // Watcom debug info
    if (size > 16 && Binary.readWord(size - 14) === 0x8386) {
        if (size - debugSize >= 0) {
            _setResult(sType, "Watcom", Binary.readByte(size - 12) + "." + Binary.readByte(size - 11), "0x" + debugSize.toString(16) + " bytes");
        }
        return true;
    }

    // CodeView debug info
    if (size > 16 && Binary.readWord(size - 8) === 0x424E) {
        if (/^NB0[5789]|NB1[01]$/.test(Binary.read_ansiString(size - 8, 4))) {
            if (size - debugSize >= 0) {
                _setResult(sType, "CodeView", "4.0", "0x" + debugSize.toString(16) + " bytes");
            }
            return true;
        }
    }

    // DWARF debug info
    if (size > 16 && Binary.readDword(size - 16) === 0x534954) {
        if (Binary.readDword(size - 12) === 0 && Binary.readDword(size - 8) === 0) {

            var debugOffset = size - debugSize;

            if (debugOffset >= 0) {
                var viStruct = get_DWRAF_vi(debugOffset, size - debugOffset);
                if (viStruct.bIsValid) {
                    _setResult(sType, "DWARF", viStruct.sVersion, "0x" + debugSize.toString(16) + " bytes, Watcom");
                }
                return true;
            }
        }
    }

    if (Binary.isDebugData()) {
        if (Binary.compare("'RSDS'")) {
            sName = "PDB file link";
            _setResult(sType, sName, "7.0", "");
            return true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/font.ADOBE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Info  : Adobe Type I Font (AFM, PFB, PFM)
// Status: WIP

meta("font");

function detect() {
    if (Binary.getSize() >= 0x0F) {
        if (Binary.compare("'StartFontMetrics '") && Binary.compare("'.'", 0x12)) {
            sName = "Adobe Font Metrics (.AFM)";
            sVersion = "v" + Binary.getString(0x11, 0x03);
            bDetected = true;
        } else if (Binary.read_uint16(0) == 384 && Binary.read_uint16(Binary.getSize() - 2) == 896) {
            sName = "Adobe Printer Font Binary (.PFB)";
            bDetected = true;
            if (Binary.isVerbose()) {
                var sFontText = Binary.getString(0x06, 0x0200);
                var aFontName = sFontText.match(/%!PS-AdobeFont-1.0: (.*?)[\r\n]/);
                if (aFontName) {
                    sOption(aFontName[1]);
                }
            }
        } else if (Binary.compare("0001") && Binary.getSize() == Binary.read_uint32(0x02)) {
            sName = "Adobe Printer Font Metrics (.PFM)";
            bDetected = true;
            if (Binary.isVerbose()) {
                sOptions = Binary.getString(0x06, 0x3C);
            }

        }
    }

    return result();
}

================================================
FILE: db/Binary/font_BMF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://www.angelcode.com/products/bmfont/doc/file_format.html

meta("font", "AngelCode Bitmap Font (.FNT)");

function detect() {
    if (Binary.getSize() >= 0x30) {
        if (Binary.compare("'BMF'")) {
            bDetected = true;
            switch (Binary.read_uint8(0x03)) {
                case 1:
                    sVersion = "v1";
                    sOptionT("Binary");
                    break;
                case 2:
                    sVersion = "v2";
                    sOptionT("Binary");
                    break;
                case 3:
                    sVersion = "v3";
                    sOptionT("Binary");
                    break;
                default:
                    bDetected = false;
            }
            if (bDetected && Binary.isVerbose()) {
                var nOffset = 0x04;

                while (nOffset < Binary.getSize()) {
                    var nBlockTypeIdentifier = Binary.read_uint8(nOffset);
                    nOffset += 1;
                    var nBlockSize = Binary.read_uint32(nOffset);
                    nOffset += 4;
                    switch (nBlockTypeIdentifier) {
                        case 1:
                            sOptionT('"' + Binary.getString(nOffset + 0xE) + '"');
                            sOptionT("Size:" + Binary.read_int16(nOffset)); // fontSize
                            break;
                        case 2:
                            sOptionT("pages:" + Binary.read_int16(nOffset + 4) + "x" + Binary.read_int16(nOffset + 6) + "x" + Binary.read_int16(nOffset + 8)); // scaleW, scaleH, pages
                            break;
                        case 3:
                            break;
                        case 4:
                            sOptionT("chars:" + nBlockSize / 20);
                            break;
                        case 5:
                            sOptionT("kerning_pairs:" + nBlockSize / 10);
                            break;
                    }
                    nOffset += nBlockSize;
                }
            }
        } else if (Binary.isPlainText() && Binary.find_utf8String(0, 200, "info face") >= 0 && Binary.find_utf8String(0, 200, "stretchH") >= 0) {
            bDetected = true;
            if (Binary.find_utf8String(0, 200, "<?xml") >= 0) { sOptionT("XML") } else
                (sOptionT("Text"))
        }
    }

    return result();
}

================================================
FILE: db/Binary/font_FFN.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://fifam.miraheze.org/wiki/FFN
meta("font", "FFN");

function detect() {
    if (Binary.compare("'FNTF'......00")) {
        sOptions = "Windows";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/font_TFM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://ctan.org/tex-archive/obsolete/graphics/metapost/base/texmf/fonts/tfm/
meta("font", "TFM");

function detect() {
    if (Binary.compare("....0012000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/font_VTF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("font", "VTF");

function detect() {
    bDetected = Binary.compare("'TNFV'");

    return result();
}


================================================
FILE: db/Binary/font_XTT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://file.org/extension/xtt#xbox360systemfontfile
meta("font", "Xbox 360 System Font (.XTT)");

function detect() {
    if (Binary.compare("78 74 74 66")) {
        var font = Binary.getString(1, 3).trim();

        if (/^[a-z]{3}$/.test(font)) {
            if (X.isVerbose()) sOptions = font;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_AS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("format", "AS");

function detect() {
    if (Binary.compare("'Act;'")) {
        var actor = Binary.getString(4, 5).trim();

        if (/^[a-zA-Z/]{5}/.test(actor)) {
            if (X.isVerbose()) sOptions = actor;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_AmigaIcon.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens TG@kaens

meta("format", "Amiga Icon Format (.INFO)");

function detect() {

    if (Binary.compare("E310 0001")) {
        //http://www.evillabs.net/index.php/Amiga_Icon_Formats
        bDetected = true;
        ic_Type = File.read_uint8(0x30);
        switch (ic_Type) {
            case 1: sVersion = "DISK"; break;
            case 2: sVersion = "DRAWER"; break;
            case 3: sVersion = "TOOL"; break;
            case 4: sVersion = "PROJECT"; break;
            case 5: sVersion = "GARBAGE"; break;
            case 6: sVersion = "malformed:DEVICE"; break;
            case 7: sVersion = "KICK"; break;
            case 8: sVersion = "malformed:APPICON"; break;
            default: sVersion = "malformed"
        }
        if (Binary.isVerbose()) {
            ic_DefaultTool = File.read_uint8(0x32) != 0;
            ic_ToolTypes = File.read_uint8(0x36) != 0;
            ic_CurrentX = File.read_int32(0x3A, _BE);
            ic_CurrentY = File.read_int32(0x3E, _BE);
            ic_DrawerData = File.read_uint8(0x42) != 0;
            ic_ToolWindow = File.read_uint8(0x46) != 0;
            p = 4; //struct Gadget
            ga_Width = File.read_int16(p + 0x08, _BE);
            ga_Height = File.read_int16(p + 0x0A, _BE);
            ga_SelectRender = File.read_uint8(p + 0x16) != 0;
            p = 0x4E;
            if (ic_DrawerData) { p += 0x38; sOption("Drawer data present") }
            //struct Image #1
            im_Width = File.read_int16(p + 4, _BE);
            if (im_Width % 2 == 1) im_Width++;
            im_Height = File.read_uint16(p + 6, _BE);
            im_Depth = File.read_uint16(p + 8, _BE);
            icoinfo = "icon: " + im_Width + "×" + im_Height + "@" + im_Depth + " at [" + Hex(p + 0x14) + "..";
            p += 0x14 + im_Width * im_Height * im_Depth / 8;
            icoinfo += Hex(p) + ")"; //round par intended!
            sOption(icoinfo);
            if (ga_SelectRender) { //struct Image #1
                im_Width = File.read_int16(p + 4, _BE);
                if (im_Width % 2 == 1) im1_Width++;
                im_Height = File.read_int16(p + 6, _BE);
                im_Depth = File.read_int16(p + 8, _BE);
                info = "sel.icon: " + im_Width + "×" + im_Height + "@" + im_Depth + " at [" + Hex(p + 0x14) + "..";
                p += 0x14 + im_Width * im_Height * im_Depth / 8;
                icoinfo += Hex(p) + ")"; //round par intended!
                sOption(icoinfo);
            }
            //_log("p="+Hex(p));
            if (File.getFileBaseName().toLowerCase() == "pn") {//POKEYNoise info
                p = File.findSignature(6, File.getSize() - 20, "'SONGS='") - 1; //TODO do it actually smart
                if (p > 0) {
                    tp = ""; x = ""; t = ""; c = ""; cp = ""; pn = false;
                    tagsz = File.getSize() - p; tagl = []; tagr = [];
                    while (p < File.getSize()) {
                        lr = File.read_ucsdString(p);
                        tagl.push(lr.split("=")[0]); tagr.push(lr.split("=")[1]);
                        p += lr.length + 5
                    }
                    for (i = 0; i < tagl.length; i++)
                        switch (tagl[i]) {
                            case "SONGS": x = tagr[i]; break;
                            case "TYPE": if (tagr[i] == "POKEY") pn = true; break;
                            case "NAME": t = tagr[i]; break;
                            case "CREATOR": c = tagr[i]; break;
                            case "COPYRIGHT": cp = tagr[i]; break;
                        }
                    if (pn) {
                        sOption("POKEYNoise info found");
                        sOption(t); if (x > "1") sOption(x, "x"); sOption(c, "by "); sOption(cp, "(c) ")
                    }
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_BCD1.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/BJNFNE/DEV7/blob/master/tools/BCD1Creator/BCD1Creator.cpp
// https://wiki.scummvm.org/index.php?title=Gob/DEV7_Information#BCD1_Format
meta("format", "BCD1");

function detect() {
    if (Binary.compare("'[ENVIINFO]'")) {
        var name = Binary.getString(11, 4).trim();

        if (/^[A-Za-z0]{4}$/.test(name)) {
            if (X.isVerbose()) sOptions = name;
            bDetected = true;
        }
    } else if (Binary.compare("'[AppliInfo]'")) {
        var name = Binary.getString(13, 4).trim();

        if (/^[A-Za-z]{4}$/.test(name)) {
            if (X.isVerbose()) sOptions = name;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_BOU.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Coktel Vision games

// https://github.com/scummvm/scummvm/blob/master/engines/gob/inter_adibou1.cpp
meta("format", "BOU");

function detect() {
    var appli = Binary.getString(0, 20).trim();

    if (/^[CLcl]\d{2}([Cc]alcul|[Ll]ecture) \d ans/.test(appli)) {
        if (X.isVerbose()) sOptions = appli;
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_BSP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://developer.valvesoftware.com/wiki/BSP_(Source)
meta("format", "BSP");

function detect() {
    if (Binary.compare("'VBSP'15000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_BTF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://docs.ebpf.io/concepts/btf/
meta("format", "BTF");

function detect() {
    bDetected = Binary.compare("9feb01001800000000000000");

    return result();
}


================================================
FILE: db/Binary/format_BackupMii.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Nintendo Wii - BackupMii/BootMii

// https://github.com/DarkMatterCore/xyzzy-mod/blob/a5139f246c4d2602c07abc0301e5917106fa4183/source/xyzzy.c#L275
// https://wiibrew.org/wiki/BackupMii
meta("format", "BackupMii");

function detect() {
    if (Binary.compare("'BackupMii v1'")) {
        var consoleId = Binary.getString(25, 8).trim();

        if (/^[a-z0-9]{8}$/.test(consoleId)) {
            if (X.isVerbose()) sOptions = "ConsoleID: " + consoleId;
            sVersion = "1.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_CCD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.elby.ch/
meta("format", "CloneCD Control");

function detect() {
    if (Binary.compare("'[CloneCD]'")) {
        var versionNumber = Binary.getString(19, 1).trim();

        if (/^[0-9]{1}/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }

    }

    return result();
}

================================================
FILE: db/Binary/format_CSO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/jamie/ciso
meta("format", "Compressed ISO file (.CISO)");

function detect() {
    if (Binary.compare("'CISO'0000000000......000000000008")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_CTRK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV7_Information#File_Formats
meta("format", "CTRK");

function detect() {
    if (Binary.compare("01000800000000000000")) {
        sOptions = File.cleanString(Binary.getString(0x0000001a));
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_CURE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV7_Information#File_Formats
meta("format", "Mesh configuration (.CURE)");

function detect() {
    if (Binary.compare("'[Global]'")) {
        var name = Binary.getString(10, 4).trim();

        if (/^[a-zA-Z]{4}/.test(name)) {
            if (X.isVerbose()) sOptions = name;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_CVM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

// https://amicitia.miraheze.org/wiki/CVM  ← found by BJNFNE
// https://github.com/JayFoxRox/cvm_tool/blob/master/cvm_parser.h
meta("format", "CRI Middleware's PS2 CVM/ROFS image (.CVM)");

function detect() {
    if (X.Sz() < 0x800 || !X.c("'CVMH'") || !isAllZeroes(0x0C, 0x10) || !X.c("'ROFS'", 0x34)) return;
    var versionNumber = X.SA(0x44, 4);
    if (!/^[0-9\.]{4}/.test(versionNumber)) return;
    var sz = X.U64(0x1C,_BE), sec = X.U32(0x80,_BE), p = 0, hkhd, hksz, end = false;
    if(sz < 0xC+X.U64(4,_BE)) return;
    if (!isWithin(sec, 1, (0xC+X.U64(4,_BE)-0x100)>>2)) return;
    while (p < sz && p < X.Sz()) {
        hkhd = X.SA(p, 4); hksz = X.U64(p+4,_BE); p += 0xC;
        if (!hksz || !charStat(hkhd, true).includes('allasc')) return;
        switch(hkhd) {
        case 'CVMH': break; //already got all info...
        case 'ZONE': break; //nothing to see here...
        default: end = true; break; //time to stop, we found unexpected characters
        }
        if(end) break; p += hksz
    }

    sVersion = 'v'+versionNumber;
    bDetected = true;

    if (X.isVerbose()) sOption(outSz(sz),'sz:');
    else if (sz < X.Sz()) sVersion += '/malformed!short';

    return result();
}

================================================
FILE: db/Binary/format_DESKTOP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Linux based dists for the desktop shortcuts

// Rewritten by DosX

meta("format", "Desktop Entry (.desktop)");

function detect() {
    if (Binary.isText() && (Binary.compare("'#'") || Binary.compare("'\n'") || Binary.compare("'['")) && Binary.isSignaturePresent(0, 512, "'[Desktop Entry]'")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_DSW.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.ibm.com/docs/en/informix-servers/15.0.0?topic=bladesmith-microsoft-visual-c-files
meta("format", "Microsoft Developer Studio Workspace");

function detect() {
    if (Binary.compare("'Microsoft Developer Studio Workspace File'")) {
        var versionNumber = Binary.getString(57, 5).trim();

        if (/^\d+\.\d{2}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_DTA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://zenhax.com/viewtopic.php@t=1382.html
meta("format", "DTA");

function detect() {
    if (Binary.compare("03000000....08")) {
        var model = Binary.getString(7, 8).trim();

        if (/^[a-z0-9]{8}/.test(model)) {
            if (X.isVerbose()) sOptions = model;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_Director.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// Director File Format Info:
// XFIR = 58464952 (Big endian)
// RIFX = 52494658 (Little endian)
// Platform type:
// BE = Mac based Director game
// LE = Windows based Director game

// https://github.com/rvanlaar/director-extrator/blob/master/extract.py
// https://github.com/einstein95/py_scripts/blob/main/shock.py
// https://wiki.scummvm.org/index.php?title=Director
meta("format", "Director (.DXR/.DIR/.DCR/.DRX/.CXT/.CST/.CCT)");

function detect() {
    if (Binary.compare("5249465800")) {
        sOptions = Binary.getString(0x00000008, 8);
        sVersion = "Win";
        bDetected = true;
    } else if (Binary.compare("58464952......00")) {
        sOptions = Binary.getString(0x00000008, 8);
        sVersion = "Mac";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_DunkleSchattenConfig.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://werbespiel.blogspot.com/2010/07/dunkle-schatten.html
meta("format", "Dunkle Schatten Config");

function detect() {
    if (Binary.compare("'DSchCFG'000001")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_DunkleSchattenSave.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://werbespiel.blogspot.com/2010/07/dunkle-schatten.html
meta("format", "Dunkle Schatten Save");

function detect() {
    if (Binary.compare("'DSchSAV'000001")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_Empty.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Empty file");

function detect() {
    if (Binary.getSize() == 0) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_FAS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/FAS-and-VLX-files.html
meta("format", "FAS");

function detect() {
    if (Binary.compare("0d0a20'FAS4-FILE'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_FLDB.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("format", "Becker file location databases");

function detect() {
    if (Binary.compare("'FLDB'", 0x00000014)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_FNX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Iron Willy

meta("format", "FNX");

function detect() {
    if (Binary.compare("'adgames'")) {
        var copyrightYear = Binary.getString(17, 4).trim();

        if (/^[12]\d{3}$/.test(copyrightYear)) {
            sVersion = copyrightYear;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_FST.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("format", "FST");

function detect() {
    if (Binary.compare("';Ligne de commentaires'0d0a")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_GAL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://graphicsgale.com/
meta("format", "Gale (.GAL)");

function detect() {
    if (Binary.compare("'Gale102'..00000001")) {
        var frame = Binary.getString(20, 6).trim();

        if (/^[A-Za-z0-9]{6}/.test(frame)) {
            sVersion = "1.0.2";
            sOptions = frame;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_GBI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.gburner.com/
meta("format", "gBurner Image (.GBI)");

function detect() {
    if (Binary.compare("'GBI'000000000000000000000000004C")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_GME.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/entropia/tip-toi-reveng/blob/master/GME-Format.md
meta("format", "GME");

function detect() {
    if (Binary.compare("'1CHOMPTECH DATA FORMAT CopyRight 2009'", 0x0020)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_GameMaps.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Author of original rule: Arjan Onwezen
// Info: https://moddingwiki.shikadi.net/wiki/GameMaps_Format

meta("format", "GameMaps (TED editor)");

function detect() {
    if (Binary.compare("'TED5v1.0'..ff")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_GamingRoot.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/answers/questions/4116358/gamingroot-and-xboxgames-keeps-generating-even-if
meta("format", "GamingRoot");

function detect() {
    if (Binary.compare("52 47 42 58 01 00 00 00 58 00 62 00 6F 00 78 00 47 00 61 00 6D 00 65 00 73 00 00 00")) {
        sVersion = "Xbox Games";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_HIV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-hives
meta("format", "Windows Registry Hive (.HIV)");

function detect() {
    if (Binary.compare("'regf'..0000000..00000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_HNM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Woody_Woodpecker:_Escape_from_Buzz_Buzzard_Park
meta("format", "HNM");

function detect() {
    if (Binary.compare("'HNM6'0000..108002")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_HSM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Woody Woodpecker: Escape from Buzz Buzzard Park

// https://en.wikipedia.org/wiki/Woody_Woodpecker:_Escape_from_Buzz_Buzzard_Park
meta("format", "HSM");

function detect() {
    if (Binary.compare("'1LMB'000000108002")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_ILK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/cpp/build/reference/ilk-name-incremental-database-file
meta("format", "Name incremental database file (.ILK)");

function detect() {
    if (Binary.compare("'Microsoft Linker Database'0a0a071a000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_IPCH.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Rewritten by DosX

// https://fileinfo.com/extension/ipch
meta("format", "Intellisense Precompiled Header File (.IPCH)");

function detect() {
    if (Binary.compare("'EDG C/C++ version '")) {
        var versionInfo = Binary.getString(18, 3).trim();

        if (versionInfo) {
            sVersion = versionInfo;
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/format_ITL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://home.vollink.com/gary/playlister/ituneslib.html
meta("format", "iTunes Library");

function detect() {
    if (Binary.compare("'hdfm'00000090")) {
        var versionNumber = Binary.getString(17, 8).trim();

        if (/^[0-9/.]{8}$/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_IVF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Duck_IVF
meta("format", "Duck IVF");

function detect() {
    if (Binary.compare("'DKIF'00002000")) {
        var codecInfo = Binary.getString(8, 4).trim();

        if (/^[A-Z0-9]{4}$/.test(codecInfo)) {
            if (X.isVerbose()) sOptions = "Codec: " + codecInfo;
            bDetected = true;
        }
    }
    return result();
}

================================================
FILE: db/Binary/format_Img.UDIF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Universal Disk Image Format");

function detect() {
    if (Binary.compare("7801730d62626060")) {
        sOptions = "read-only zlib-compressed";
        bDetected = true;
    } else if (Binary.compare("45520200") && Binary.compare("'disk image'", 0x410)) {
        sOptions = "read/write";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_InnoSetupUninstall.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://jrsoftware.org/isinfo.php
meta("format", "Inno Setup Uninstall Log");

function detect() {
    if (Binary.compare("'Inno Setup Uninstall Log (b) 64-bit'")) {
        sVersion = "64-bit";

        var uuid = Binary.getString(64, 39).trim();

        if (/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/.test(uuid)) {
            if (X.isVerbose()) sOptions = "UUID: " + uuid;
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/format_InterleafFile.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.legoisland.org/wiki/Interleaf_File
meta("format", "Interleaf File");

function detect() {
    if (Binary.compare("52494646........'OMNI'")) {
        var metadata = Binary.getString(12, 4).trim();

        if (/^[A-Za-z]{4}/.test(metadata)) {
            if (X.isVerbose()) sOptions = metadata;
            bDetected = true;
        }

    }

    return result();
}

================================================
FILE: db/Binary/format_LCA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// http://zenhax.com/viewtopic.php@t=17622.html
meta("format", "LCA");

function detect() {
    if (Binary.compare("4c45474f")) {
        var vcaFile = Binary.getString(85, 12).trim();

        if (/^[A-Z0-9/.]{12}$/.test(vcaFile)) {
            if (X.isVerbose()) sOptions = vcaFile;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_LGX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Lernwerkstatt 7

// http://www.binblind.de/software/Logox/index.html
meta("format", "Logox4 Speechengine");

function detect() {
    if (Binary.compare("'LGX'")) {
        var versionNumber = Binary.getString(7, 5).trim();

        if (/^[0-9]{5}/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/format_LIXS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Island_Xtreme_Stunts
meta("format", "LIXS");

function detect() {
    if (Binary.compare("'Island Xtreme Stunts - Silicon Dreams'")) {
        var copyrightYear = Binary.getString(40, 5).trim();

        if (/^[12]\d{3}$/.test(copyrightYear)) {
            sVersion = copyrightYear;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_LVL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.mobygames.com/game/138556/the-energy-thieves/ Used by Adiboo & The Energy Thieves (2004)
meta("format", "LVL");

function detect() {
    if (Binary.compare("1C070000....0000")) {
        var worldrender = Binary.getString(16, 13).trim();

        if (/^[A-Za-z]{13}/.test(worldrender)) {
            sOptions = worldrender;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MAT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/MATLAB
meta("format", "MatLab");

function detect() {
    if (Binary.compare("'MATLAB'")) {
        var versionNumber = Binary.getString(7, 3).trim();

        if (/^[0-9/.]{3}$/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MDL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://developer.valvesoftware.com/wiki/MDL
meta("format", "MDL");

function detect() {
    if (Binary.compare("'IDST'")) {
        var idstVersion = Binary.getString(4, 1).trim();

        if (/^[0-9]{1}/.test(idstVersion)) {
            if (X.isVerbose()) sVersion = idstVersion;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MDS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("format", "Alcohol 120% Media Descriptor Sidecar file (.MDS)");

function detect() {
    if (X.c("'MEDIA DESCRIPTOR'01")) { //always v1.xx, as per libMirage parser.c
        var cdt = '';
        switch (X.U16(0x12, _LE)) { //an additional test, too
            case 0: cdt = 'CD'; break;
            case 1: cdt = 'CD-R'; break;
            case 2: cdt = 'CD-RW'; break;
            case 0x10: cdt = 'DVD'; break;
            case 0x12: cdt = 'DVD-R'; break;
            default: return;
        }

        sVersion = 'v1-' + X.U8(0x11) + '/' + cdt; // not '.' until this is zero-padded
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_MS-DBG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

// https://github.com/libyal/libmdmp/blob/main/documentation/Minidump%20(MDMP)%20format.asciidoc
meta("format", "Windows Minidump (.DMP)");

function detect() {
    if (Binary.getSize() >= 9) {
        if (Binary.compare("'MDMP'93A7")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MS-PST.sg
================================================
// Detect It Easy: detection rule file
// Author: Arjan Onwezen
// Info: https://msopenspecs.azureedge.net/files/MS-PST/%5bMS-PST%5d.pdf

meta("format", "Microsoft Outlook Personal Storage Table (PST)");

function detect() {
    if (Binary.getSize() > 1024) {
        if (Binary.compare("21 42 44 4E") && Binary.compare("53 4D", 8)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MS-VHD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("format", "Microsoft Virtual Hard Disk (.VHD)");

function detect() {
    if (Binary.getSize() >= 0x200) {
        if (Binary.compare("'conectix'", Binary.getSize() - 0x200)) {
            bDetected = true;
            nOffset = Binary.getSize() - 0x200
            sVersion = "v" + Binary.read_uint16(nOffset + 0xC, _BE) + "." + Binary.read_uint16(nOffset + 0xE, _BE);
            switch (Binary.read_uint32(nOffset + 0x3C, _BE)) {
                // case  1: sOption("deprecate");    break;
                case 2:
                    sOption("Fixed");
                    break;
                case 3:
                    sOption("Dynamically");
                    break;
                case 4:
                    sOption("Differencings");
                    break;
                default: return;
            }

            sOption("OrginalSize:" + Binary.bytesCountToString(Binary.read_uint64(nOffset + 0x28, _BE)));
            sOption("CurrentSize:" + Binary.bytesCountToString(Binary.read_uint64(nOffset + 0x30, _BE)));
            if (Binary.isVerbose()) {
                sOption("CreaterApp:" + Binary.getString(nOffset + 0x1C, 4));
                sOption("v" + Binary.read_uint16(nOffset + 0x20, _BE) + "." + Binary.read_uint16(nOffset + 0x22, _BE));
                switch (Binary.read_uint32(nOffset + 0x24, _BE)) {
                    case 0x57693272:
                        sOption("WI2R");
                        break;
                    case 0x5769326B:
                        sOption("WINDOWS");
                        break;
                    case 0x57327275:
                        sOption("W2RU");
                        break;
                    case 0x57326B75:
                        sOption("W2KU");
                        break;
                    case 0x4D616320:
                        sOption("MACINTOSH");
                        break;
                    case 0x4D163258:
                        sOption("MACX");
                        break;
                    default: return;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MS-VHDX.sg
================================================
// Detect It Easy: detection rule file
// Author: Arjan Onwezen
// Info: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-vhdx/83e061f8-f6e2-4de1-91bd-5d518a43d477

meta("format", "Virtual Hard Disk v2 (VHDX)");

function detect() {
    if (Binary.getSize() > 0x100000) {
        if (Binary.compare("76 68 64 78 66 69 6C 65")) {
            bDetected = true;
            sOption("CreaterApp:" + Binary.read_unicodeString(8, 50));
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_MS-XNA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP

meta("format", "");

function detect() {
    if (Binary.getSize() >= 9) {

        if (Binary.compare("'XNB'")) {
            bDetected = true;
            sName = "Microsoft XNA Game Studio Binary Package (.XNB)"
            var nXNA_Ver = Binary.read_uint8(0x4);
            var fFlag = Binary.read_uint8(0x5);
            switch (nXNA_Ver) {
                case 3:
                    sVersion = "v3.0";
                    break;
                case 4:
                    sVersion = "v3.1";
                    break;
                case 5:
                    sVersion = "v4.0";
                    break;
                default:
                    bDetected = false;
            }


            /* XNA Studio platforms: 'w' = Windows, 'm' = Windows Phone 7, 'x' = X360
             * MonoGame extensions: 'i' = iOS, 'a' = Android, 'X' = MacOSX, 'P' = PS4, 'S' = Switch, etc */
            switch (Binary.read_uint8(0x3)) {
                case 0x77:
                    sOption("Windows");
                    break;
                case 0x78:
                    sOption("Xbox 360");
                    break;
                case 0x6D:
                    sOption("Windows Phone 7");
                    break;
                case 0x69:
                    sOption("iOS");
                    break;
                case 0x61:
                    sOption("Android");
                    break;
                case 0x58:
                    sOption("MacOSX");
                    break;
                case 0x50:
                    sOption("PS4");
                    break;
                case 0x53:
                    sOption("Switch");
                    break;
                default:
                    sOption("UNKNOWN");
                    //    bDetected=false;
            }

            if (Binary.isVerbose()) {
                if ((fFlag & 0x01) >> 0) { sOption("hiDef") };
                if ((fFlag & 0x80) >> 2) { sOption("compressed") };
                if (!Binary.getSize() == Binary.read_uint32(0x5)) { sOption("wrong size!") };
            }
        } else if (Binary.compare("'WBND'")) {
            bDetected = true;
            sName = "Microsoft XACT Wave Bank (.XWB)"
        } else if (Binary.compare("'SDBK'")) {
            bDetected = true;
            sName = "Microsoft XACT Sound Bank (.XSB)"
        } else if (Binary.compare("'XGSF'")) {
            bDetected = true;
            sName = "Microsoft XACT Global Settings File (.XGS)"
        }
    }

    return result();
}


================================================
FILE: db/Binary/format_OBC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Original location to look at is "'OBC Copyright MDO 1999"' since OBCEditor (https://github.com/BJNFNE/DEV7/blob/master/tools/OBCEditor/OBCEditor.py)
// updates the copyright year from the systemtime it wouldn't match with the old 1999 hardcoded variant.
// OBC is an compiled scripting language which get compiled to their OBC script.

// https://wiki.scummvm.org/index.php?title=Gob/DEV7_Information#STK21/OBC
meta("format", "Compiled DEV7 object (.OBC)");

function detect() {
    if (Binary.compare("'OBC Copyright MDO'20")) {
        var copyrightYear = Binary.getString(18, 5).trim();

        if (/^[12]\d{3}$/.test(copyrightYear)) {
            sVersion = copyrightYear;
            sOptions = File.cleanString(Binary.getString(0x0054, 14));
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_OpenSSH.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.openssh.com/
meta("format", "OpenSSH Private Key");

function detect() {
    if (Binary.compare("2d2d2d2d2d424547494e20'OPENSSH PRIVATE KEY'2d2d2d2d2d")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_P7X.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://stackoverflow.com/questions/38634052/what-is-the-structure-of-appxsignature-p7x
meta("format", "P7X");

function detect() {
    if (Binary.compare("'PKCX0'82")) {
        sOptions = "PKCX0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_PAT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.gimp.org/
meta("format", "Gimp Pattern");

function detect() {
    if (Binary.compare("000000..00000..10000")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_PDB.1.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev
// ---------------------------------
// Author of original rule: BJNFNE

// https://en.wikipedia.org/wiki/Program_database
meta("format", "Microsoft Program Database (.PDB)");

function detect() {
    if (Binary.compare("'BSJB'0100")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("'Microsoft C/C++ program database 2.00\r\n\'1A4A470000")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (Binary.compare("'Microsoft C/C++ MSF 7.00\r\n'1A4453000000")) {
        sVersion = "7.0";
        bDetected = true;
    }

    if (bDetected) {
        var refs = {
            "'$'11'@P:Microsoft.VisualBasic'00": "VB.NET",
            "%%%%%%%%%%'.cs'00": "C#",
            "'$'11'@P:FSharp.Core'00": "F#",
            "'std::'%%%%%%": "C++"
            // todo
        };

        for (var key in refs) {
            if (Binary.isSignaturePresent(0, 0x900000, key)) {
                sLang = refs[key];
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_PEM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail
meta("format", "Privacy-Enhanced Mail (.PEM)");

function detect() {
    if (Binary.compare("2d2d2d2d2d424547494e20'CERTIFICATE'2d2d2d2d2d")) {
        sVersion = "Certificate";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'PRIVATE KEY'2d2d2d2d2d")) {
        sVersion = "Private Key";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'RSA PRIVATE KEY'2d2d2d2d2d")) {
        sVersion = "RSA Private Key";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'ENCRYPTED PRIVATE KEY'2d2d2d2d2d")) {
        sVersion = "Encrypted Private Key";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'PUBLIC KEY'2d2d2d2d2d")) {
        sVersion = "Public Key";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'CERTIFICATE REQUEST'2d2d2d2d2d")) {
        sVersion = "Certificate Signing Request (CSR)";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'PKCS7'2d2d2d2d2d")) {
        sVersion = "PKCS7/CMS Message";
        bDetected = true;
    } else if (Binary.compare("2d2d2d2d2d424547494e20'X509 CRL'2d2d2d2d2d")) {
        sVersion = "Certificate Revocation List (CRL)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_PGP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.gnupg.org/
meta("format", "GPG");

function detect() {
    if (Binary.compare("2d2d2d2d2d424547494e20'PGP'205349474e41545552452d2d2d2d2d")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_POL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-file-format
meta("format", "Registry Policy File");

function detect() {
    if (Binary.compare("5052656701000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_PRI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/windows/win32/menurc/pri-indexing-reference
meta("format", "PRI");

function detect() {
    if (Binary.compare("'mrm_pri2'00000100")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_PS-X.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://problemkaputt.de/psxspx-cdrom-file-playstation-exe-and-system-cnf.htm
meta("format", "PlayStation executable (PS1)");

function detect() {
    if (Binary.compare("'PS-X EXE'")) {
        var regionString = Binary.getString(76, 48).trim();

        if (regionString) {
            if (X.isVerbose()) sOptions = "Region: " + regionString;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_PSM2CFG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Dunkle Schatten

// https://wiki.multimedia.cx/index.php/Engines/PSM
meta("format", "PSM2CFG");

function detect() {
    if (Binary.compare("'PSM2CFG'")) {
        var versionNumber = Binary.getString(17, 4).trim();

        if (/^[0-9\.]{4}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_RARREG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.win-rar.com/products-winrar.html
meta("format", "RAR registration data (.RARREG)");

function detect() {
    if (Binary.compare("'RAR registration data'0d0a")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_RCK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Woody_Woodpecker:_Escape_from_Buzz_Buzzard_Park
meta("format", "RCK");

function detect() {
    if (Binary.compare("'RKET'00000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_RCO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("format", "Resource Container (.RCO)");

function detect() {
    if (Binary.compare("0050524600010000")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_RGS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by InstallShield Professional

// https://file.org/extension/rgs
meta("format", "InstallShield");

function detect() {
    if (Binary.compare("'HKCR'0d0a7b0d0a09")) {
        sVersion = "Windows Registry Script";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_RedShirt.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Uplink_(video_game)
meta("format", "RedShirt");

function detect() {
    if (Binary.compare("'REDSHIRT'00")) {
        sVersion = "v1.0";
        bDetected = true;
    } else if (Binary.compare("'REDSHRT2'00")) {
        sVersion = "v2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_SDI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/System_Deployment_Image
meta("format", "System Deployment Image (.SDI)");

function detect() {
    if (Binary.compare("'$SDI0001'0000000000000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_SFK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.reddit.com/r/audioengineering/comments/4208al/does_anyone_know_the_actual_format_of_sony_sfk/
meta("format", "SFK");

function detect() {
    if (Binary.compare("'SFPK'0100000040")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_SHBIN.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.3dbrew.org/wiki/SHBIN
meta("format", "Shader Binary");

function detect() {
    if (Binary.compare("'DVLB'")) {
        var dvlp = Binary.getString(12, 4).trim();

        if (/^[A-Z]{4}/.test(dvlp)) {
            if (X.isVerbose()) sOptions = dvlp;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_SLN.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/cpp/build/reference/project-and-solution-files?view=msvc-170
meta("format", "Visual Studio solution file");

function detect() {
    if (Binary.compare("efbbbf0d0a'Microsoft Visual Studio Solution File'")) {
        var versionNumber = Binary.getString(59, 5).trim();

        if (/^\d+\.\d{2}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_SLNX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://devblogs.microsoft.com/dotnet/introducing-slnx-support-dotnet-cli/
meta("format", "SLNX");

function detect() {
    if (Binary.compare("'<Solution>'0d0a2020")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_SSHPublicKey.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Public-key_cryptography
meta("format", "SSH Public Key");

function detect() {
    if (Binary.compare("'ssh-ed25519'20")) {
        sOptions = "ed25519";
        bDetected = true;
    } else if (Binary.compare("'ssh-rsa'20")) {
        sOptions = "RSA";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_SystemErr.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV6_Information#Error_Messages (Used in Coktel Vision games)
meta("format", "System_Err");

function detect() {
    if (Binary.compare("'System_Err'")) {
        var errorLine = Binary.getString(11, 32).trim();

        if (/^[ A-Za-z0-9\-\:\\\.]{1,}$/.test(errorLine)) {
            if (X.isVerbose()) sOptions = errorLine;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_TLB.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// http://justsolve.archiveteam.org/wiki/Microsoft_Type_Library
meta("format", "Microsoft Type Library");

function detect() {
    if (Binary.compare("'MSFT'020001000000000009040000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_TOT.1.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev
// ---
// Samples by: BJNFNE <bjnfne@web.de>

// https://github.com/scummvm/scummvm-tools/blob/77daf9269a65c428a8445653c2b59196dfd52021/engines/gob/degob_script_v1.cpp
meta("format", "TOT");

function detect() {
    if (Binary.compare("?? ** 00'") && Binary.isSignaturePresent(0, 32, "00 00 '(c)'")) {
        bDetected = true;

        var versionInfo = Binary.findSignature(0, 64, "'Version ' %% 2E %%");

        if (versionInfo !== -1) {
            sVersion = Binary.getString(versionInfo + 8, 4);
        }

        var copyrightYear = Binary.findSignature(0, 64, "'19' %% %%");

        if (copyrightYear !== -1) {
            sVersion += (sVersion ? ", " : String()) + Binary.getString(copyrightYear, 4);
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_TPU.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Turbo_Pascal#Units
meta("format", "Turbo Pascal Unit (.TPU)");

function detect() {
    if (Binary.compare("'TPUQ'00000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_UCM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://tcrf.net/Crazy_Machines
meta("format", "UCM");

function detect() {
    if (Binary.compare("'UCM1'02000000")) {
        sVersion = "1.0";
        sOptions = Binary.getString(0x0008);
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_UPC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://abandonware-magazines.github.io/magazines/magazine.html?m=Wiz&n=057&pagenumbers=1,12 (Used in My Fearless Friend made by Makh Shevet)
meta("format", "UPC");

function detect() {
    if (Binary.compare("'UPC'")) {
        var frc = Binary.getString(13, 3).trim();

        if (/^[A-Z]{3}$/.test(frc)) {
            if (X.isVerbose()) sOptions = frc;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_UPF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://abandonware-magazines.github.io/magazines/magazine.html?m=Wiz&n=057&pagenumbers=1,12 (Used in My Fearless Friend made by Makh Shevet)
meta("format", "UPF");

function detect() {
    if (Binary.compare("'UPF'")) {
        var frf = Binary.getString(13, 3).trim();

        if (/^[A-Z]{3}$/.test(frf)) {
            if (X.isVerbose()) sOptions = frf;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_UPI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://abandonware-magazines.github.io/magazines/magazine.html?m=Wiz&n=057&pagenumbers=1,12 (Used in My Fearless Friend made by Makh Shevet)
meta("format", "UPI");

function detect() {
    if (Binary.compare("'UPI'")) {
        var fri = Binary.getString(13, 3).trim();

        if (/^[A-Z]{3}$/.test(fri)) {
            if (X.isVerbose()) sOptions = fri;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_VDI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Storage/VDICore.h

meta("format", "Virtual Disk Image (.VDI)");

function detect() {
    if (Binary.getSize() >= 0x200) {
        if (Binary.compare("7F10DABE", 0x40)) {
            sVersion = "v" + Binary.read_uint16(0x44) + "." + Binary.read_uint16(0x46);
            var sImgText = Binary.getString(0);
            var aImgName = sImgText.match(/<<< (.*?)\ >>>/);
            if (aImgName) {
                sOptions = "\"" + sOptions.append(aImgName[1]) + "\"";
                bDetected = true;
            }
            if (bDetected && Binary.isVerbose()) {
                switch (Binary.read_uint16(0x4C)) {
                    case 1: sOption("Normal dynamically"); break;
                    case 2: sOption("Preallocated fixed size"); break;
                    case 3: sOption("Dynamically growing for undo/commit changes"); break;
                    case 4: sOption("Dynamically growing for differencings"); break;
                }
                sOption("Size:" + Binary.bytesCountToString(Binary.read_uint64(0x0170)));
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_VM2.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.psdevwiki.com/ps3/PS2_Savedata
meta("format", "PS2 Memory Card");

function detect() {
    if (Binary.compare("'Sony PS2 Memory Card Format 1.2.0.0'000000000000020200100000")) {
        sVersion = "1.2.0.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_VTF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/Wanty5883/Titanfall2/blob/master/documentation/textures/valve-texture-format-vtf/README.md
meta("format", "Valve Texture");

function detect() {
    if (Binary.compare("'VTF'0007000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_VVD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://developer.valvesoftware.com/wiki/VVD
meta("format", "VVD");

function detect() {
    if (Binary.compare("'IDSV'04000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_W3D.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://director-online.dasdeck.com/buildArticle.php?id=1121
meta("format", "Shockwave 3D");

function detect() {
    if (Binary.compare("'IFX'000800000011000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_WASM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/WebAssembly
meta("format", "WebAssembly (.WASM)");

function detect() {
    if (Binary.compare("00'asm'010000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_WBFS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://file-extensions.com/docs/wbfs
meta("format", "Wii Backup File System");

function detect() {
    if (Binary.compare("'WBFS'00....000915000001000000")) {
        sOptions = File.cleanString(Binary.getString(0x00000200, 6));
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_XBE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://xboxdevwiki.net/Xbe
meta("format", "Xbox Executable (.XBE)");

function detect() {
    if (Binary.compare("'XBEH'000000000000000000000000")) {
        sOptions = "unsigned";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_XBF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/uwp/api/windows.ui.xaml.markup.xamlbinarywriter?view=winrt-26100
meta("format", "XBF");

function detect() {
    if (Binary.compare("'XBF'")) {
        var id = Binary.getString(68, 32).trim();

        if (/^[A-Z0-9]{32}/.test(id)) {
            if (X.isVerbose()) sOptions = id;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_XCG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Battlecry 3

// https://en.wikipedia.org/wiki/Warlords_Battlecry_III
meta("format", "XCG (Graphics)");

function detect() {
    if (Binary.compare("'xcg File'")) {
        var versionNumber = Binary.getString(9, 4).trim();

        if (/^[0-9/.]{4}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_XCI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Battlecry 3

// https://en.wikipedia.org/wiki/Warlords_Battlecry_III
meta("format", "XCI");

function detect() {
    if (Binary.compare("'xci File'")) {
        var versionNumber = Binary.getString(9, 4).trim();

        if (/^[0-9/.]{4}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_XCR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Used by Battlecry 3

// https://en.wikipedia.org/wiki/Warlords_Battlecry_III
meta("format", "XCR");

function detect() {
    if (Binary.compare("'xcr File'")) {
        var versionNumber = Binary.getString(9, 4).trim();

        if (/^[0-9/.]{4}$/.test(versionNumber)) {
            sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_XCS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Engines/XPAT#XCS
meta("format", "XPAT Compiled Script (.XCS)");

function detect() {
    if (Binary.compare("58 43 53")) {
        var platform = Binary.getString(4, 2).trim();

        if (/^[A-Z]{2}$/.test(platform)) {
            sVersion = platform;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_XDelta.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Xdelta
meta("format", "XDelta");

function detect() {
    if (Binary.compare("d6c3c4000502")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_XEX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://free60.org/System-Software/Formats/XEX/
meta("format", "Xbox Executable File (.XEX)");

function detect() {
    if (Binary.compare("'XEX2'000000..00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_ZZDATA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// http://www.cdinteractive.co.uk/forums/cdinteractive/viewtopic.php?t=2115
meta("format", "ZZDATA");

function detect() {
    if (Binary.compare("'DIRINFO'000000000000000000")) {
        sVersion = "CD-I";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_ZinsSAV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.mobygames.com/game/9264/captain-zins/
meta("format", "Captain Zins Save");

function detect() {
    if (Binary.compare("'ZinsSAV'000001")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_bin.AAALogo.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Tembo (http://tembolab.pl/products/executable-image-viewer.html)

meta("format", "AAA Logo");

function detect() {
    if (Binary.getSize() >= 90) {
        if (Binary.compare("2CA46774")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_bin.COL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

meta("format", "RenderWare collision data (.COL)"); // Criterion Software/Rockstar Games

function detect() {
    var hksz = 0, lst = [], c = 0, bad = '';
    for (p = 0; p < X.Sz(); c++, p += hksz) {
        if (!X.c("'COLL'", p) || X.U8(p - 1) || p + 8 > X.Sz())
            if (!X.c("'COLL'", --p)) break; else bad = bad.addIfNone('!badchunk'/*+'@'+Hex(p+1-hksz)*/);
        // In GTA:SA, peds.col has 3 chunks that are 1 byte shorter than declared!
        // They seem to be linked to the unusual entity name length.
        hksz = 8 + X.U32(p + 4, _LE);
        if (p + hksz > X.Sz()) return;
        var entity = X.SA(p + 8, 8); if (!entity.length) break;
        //_l2r('col',p,entity+':'+charStat(X.readBytes(p+8,8,true)));
        if (charStat(entity, 1).indexOf('allasc') < 0) return;
        lst.push(X.SA(p + 8, 8))
    }

    if (!c) return;
    if (bad.length) sVersion = sVersion.appendS('malformed' + bad, '/');
    if (X.isVerbose()) {
        sOption(addEllipsis(lst.join(',')));
        sOption(outSz(p), 'sz:');
    }

    bDetected = true;

    return result();
}


================================================
FILE: db/Binary/format_bin.GuitarPro.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// WIP
// Authors:
//    Tembo (http://tembolab.pl/products/executable-image-viewer.html)
//    Kaens TG@kaens

meta("format", "Arobas Music Guitar Pro");

/* beautify ignore:start */
function detect() {
	if (Binary.getSize() > 31) {
		if (Binary.compare("'BCFZ'") || Binary.compare("'BCFS'")) {
			sVersion = "6.X";
			sName += " Tablature";
			bDetected = true;
		} else if (Binary.compare("'GPAR'")) {
			sVersion = "6.X";
			sName += " Soundbank";
			bDetected = true;
		} else if ((X.c("18") || X.c("19")) && X.c("'FICHIER GUITAR PRO'20",1)) { //
			sV = /v(\d*)\.(\d*)/.exec(X.SA(X.U8(0)-4,6));
			if (sV[0]) {
				sName += " Tablature"; bDetected = true; sVersion = sV[0]; nV = Number(sV[1]+sV[2]);
				enc = 'CP1251'; tempo = ''; p = 0x1F;
				// ref https://github.com/CoderLine/alphaTab/blob/develop/src/importer/Gp3To5Importer.ts → readScore()
				title = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				subtitle = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				artist = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				album = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				words = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				if(nV >= 500) { music = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p) } else music = words;
				cr = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				tab = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				instructions = X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				var notice = '', noticeLines = X.U32(p); p += 4;
				for (i = 0; i < noticeLines && p < X.Sz(); i++) {
					if (i > 0) notice += '\r\n';
					notice += X.SC(p+5,X.U8(p+4),enc); p += 4+X.U32(p);
				}
				if(nV < 500) p++; //triplet feel before gp5
				if(nV >= 400) for(p+=4,i=0; i < 5 && p < X.Sz(); i++) p += 8+X.U32(p+4); // beat lyrics
				if(nV >= 510) p += 19; //rse master settings
				if(nV >= 500) {
					for(p+=30,i=0; i < 10 && p < X.Sz(); i++) p += 4+X.U32(p); //page setup and text field stencils
					tempo = X.SC(p+5,X.U8(p+4),enc).trim(); p += 4+X.U32(p)
				}
				if(t=X.U32(p)) tempo = tempo.appendS(t+'bpm',':');
				p += 4; if(nV >= 510) p++; //hide tempo?
				p += 4; if(nV >= 400) p++; //key & octave
				p += 64*12; //playback info
				if(nV >= 500) p += 2*19+4; //direction signs & ...4 bytes
				bars = X.U32(p); trk = X.U32(p+4); p += 8;
				for(i=0; i < bars && p < X.Sz(); i++) { //read master bars
					var f = X.U8(p++);
					if(f&1) p++; if(f&2) p++; if(f&8) p++; if((f&0x10) && nV < 500) p++;
					if(f&0x20) p += 8+X.U32(p); //annotated bar
					if(f&0x40) p += 2;
					if(nV >= 500) { p += 3; if(f&3) p += 4 }
				}
				for(i=0,trks=[]; i < trk && p < X.Sz(); i++) { //read track data
//_l2r('gpx',p,'track '+i+' data')
					var f = X.U8(p++); if((t=X.SC(p+1,X.U8(p),enc).trim()) != '') trks.push(t); p += 41;
					var strings = X.U32(p); p += 32; //strings & tunings
					var frets = X.U32(p+12), capo = X.U32(p+16);  p += 24; //port,index,fxch,frets,capo,colour
//_l2r('gpx',p,j+': strings:'+strings+' frets:'+frets+' capo|'+capo)
					if(nV >= 500) p += 45;
					if(nV >= 510) { p += 8+X.U32(p); p += 4+X.U32(p) }
				}
/*// This block has bugs to find (there's just a couple at most; add checkpoints to alphaTab, compare)
// AND it's gonna be rather sluggish even if all is right. TODO
				for(i=0; i < bars && p < X.Sz(); i++) for(j=0; j < trk && p < X.Sz(); j++) { //read bars → voices → beats
					if(nV >= 500) { p++; voc = 2 } else voc = 1;
					for(v=0; v < voc; v++) {
						var beatnum = X.U32(p); p += 4;
						for(k=0; k < beatnum && p < X.Sz(); k++) {
//_l2r('gpx',p,'bar:'+i+' voc:'+v+' beat:'+k)
							f = X.U8(p++); if(f&0x40) p++;  p++; if(f&0x20) p += 4;
							if(f&2) { //read chord info
								if(nV >= 500) { p += 17+22+4+4+28; p += 1+X.U8(p); p += 26 }
								else
									if(X.U8(p++))
										if(nV >= 400) { p += 16+22+4+4+28; p += 1+X.U8(p); p += 26 }
										else { p += 25+35+4+24+36 }
									else
										p += 4+X.U32(p)+4+4*(nV >= 406? 7: 6);
							}
							if(f&4) { text = X.SC(p+5,X.U8(p+4),enc); p += X.U32(p) } // could be more lyrics inside beat text
							if(f&8) { //read beat fx
								fs = X.U8(p++); f2 = 0; if(nV >= 400) f2 = X.U8(p++);
								if((fs&0x20)) { p++; if(nV < 400) p += 4 } //slapPop
								if(f2&4) { //read tremolo bar effect (beat)
									p += 5; var pts = X.U32(p); p += 4+pts*9
								}
								if(fs&0x40) p += 2; //stroke
								if(f2&2) p++; //pickstroke
							}
							if(f&0x10) { //read mix table change
								p++; if(nV >= 500) p += 16;
								var a = []; for(z=0; z < 6 && p < X.Sz(); z++) a.push(X.U8(p++));
								if(nV >= 500) p += 4+X.U32(p);
								a.push(X.U32(p)); p += 4;
								for(z=0; z < 6 && p < X.Sz(); z++) if(a[z]) p++; if(a[7]) { p++; if(nV >= 510) p++ }
								if(nV >= 400) p++; //mixtableflags
								if(nV >= 500) p++; //wahtype
								if(nV >= 510) { p += 4+X.U32(p); p += 4+X.U32(p)  }
							}
							f = X.U8(p++); //stringflags???
							for(l=6; l >= 0 && p < X.Sz(); l--) if((f&(1<<i)) && 6-i < bar_staff_tuning_length) {
								//readnote(track,bar,voice,newbeat,6-i);
								var f2 = X.U8(p++); if(nV < 500 && (f2&1)) p += 2; if(f2&0x10) p++;
								if(f2&0x20) p++; if(f2&0x80) p += 2; if(nV >= 500) { if(f2&1) p += 8; p++ }
								if(f2&8) {
									var xf = X.U8(p++), xf2 =  nV >= 400? X.U8(p++): 0;
									if(xf&1) { p += 5; pts = X.U32(p); p += 4+pts*9 } //read bend
									if(xf&0x10) p += 4+(nV >= 500? 1: 0); //read grace
									if(xf2&4) p++; if(xf2&8) p++;
									if(xf2&0x10) { t = X.U8(p++); if(nV >= 500) if(t == 2) p += 3; else if(t == 3) p++ } //read AH
									if(f&0x20) p += 2;
								} 
							}
							if(nV >= 500) {
								f = X.U16(p); p += 2; if(f&0x800) p++;
							}
						}
					}
				}
				sz = p;*/
//_l2r('gpx',p,outArray(trks))
				if(X.isVerbose()) {
					sOptionT(title,' title:"','"'); sOptionT(subtitle,'～','～');
					sOptionT(artist,'artist:"','"'); sOptionT(album,'album:"','"'); sOptionT(cr,'©'); sOptionT(tab,'tab:');
					sOptionT(instructions,'instructions:'); sOptionT(notice,'notice:');
					sOption(tempo,'tempo:'); sOption(trk,'tracks:'); sOption(bars,'bars:');
				}
			}
		}
	}

	return result()
}
/* beautify ignore:end */


================================================
FILE: db/Binary/format_bin.Hermes.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Hermes JavaScript bytecode");

function detect() {
    if (Binary.getSize() >= 0xC) {
        if (Binary.compare("C61FBC03C103191F", Binary.read_uint64(0, _BE))) {
            sVersion = Binary.read_uint32(8);
            bDetected = true;
        }
    }

    sLang = "JavaScript";

    return result();
}


================================================
FILE: db/Binary/format_bin.JMDL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Microstation Java (JMDL) Compiled Class");

function detect() {
    if (Binary.getSize() >= 8 && Binary.compare("CAFEBEEF")) {
        // var nMinor = X.U16(4,_BE);
        var nMajor = X.U16(6, _BE);
        if (nMajor) {
            sVersion = "JDK ";
            switch (nMajor) {
                case 0x2D:
                    sVersion += "1.1";
                    break;
                case 0x2E:
                    sVersion += "1.2";
                    break;
                case 0x2F:
                    sVersion += "1.3";
                    break;
                case 0x30:
                    sVersion += "1.4";
                    break;
            }

            bDetected = nMajor >= 0x2D && nMajor <= 0x42;
        }
    }


    sLang = "Java";

    return result();
}


================================================
FILE: db/Binary/format_bin.JSC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("format", "JavaScript Compiled/Bytenode (.JSC)");

var VersionHash = [
    ["11.8.172.17", "4aaade2a", "6e55fcb4"],
    ["11.3.244.8", "88b331c0", "bc2e4000"],
    ["10.8.168.25", "22162e5c", "866ceba8"],
    ["10.2.154.26", "353c3291", "82a06935"],
    ["9.6.180.15", "96a2e9d1", "77a0eea2"],
    ["9.6.180.14", "efecf234", "15e726e8"],
    ["9.5.172.25", "87f3c490", "7845cebc"],
    ["9.5.172.21", "22b0877a", "d54c6bc9"],
    ["9.4.146.26", "4f3466a4", "ee64ddac"],
    ["9.4.146.24", "34bdcb66", "251899cd"],
    ["9.4.146.19", "1c8f8b6a", "15375929"],
    ["8.6.395.17", "4e4909d8", "a8d671f0"],
    ["8.6.395.16", "2e933797", "42ff7bd2"],
    ["8.4.371.23", "422a9510", "305d5cb4"],
    ["8.4.371.19", "9ee57fe0", "8b279ced"],
    ["8.3.110.9", "98545131", "878c72a5"],
    ["8.1.307.31", "2cb9ba58", "8912ed09"],
    ["8.1.307.30", "22d2f67c", "f8e02587"],
    ["7.9.317.25", "e46e0ba2", "affe52ff"],
    ["7.9.317.23", "327e22f1", "a5ef90cb"],
    ["7.8.279.23", "f4ca7648", "2453843a"],
    ["7.8.279.17", "533dd511", "2e4f9afd"],
    ["7.7.299.13", "7ee98716", "8f1d647f"],
    ["7.7.299.11", "f4bd9236", "defcacc7"],
    ["7.6.303.29", "62a5311c", "905e664f"],
    ["7.4.288.27", "8d2f9651", "84fec91f"],
    ["7.5.288.22", "8176065f", "8b9ea960"],
    ["7.4.288.21", "4e79ebb1", "27f6dd21"],
    ["7.0.276.38", "5aa2a8c8", "261396d3"],
    ["7.0.276.32", "302bcaf2", "1c3c201f"],
    ["6.8.275.32", "4914c00b", "8af4d4f4"],
    ["6.8.275.30", "34fd59c5", "91d1cc59"],
    ["6.8.275.24", "70ff0c52", "74a2eeac"],
    ["6.7.288.49", "f5e4a619", "aa47d109"],
    ["6.7.288.46", "555f09bb", "6070752b"],
    ["6.7.288.45", "3f06ef23", "ca0b678f"],
    ["6.7.288.43", "bc67142f", "884dad18"],
    ["6.6.346.32", "9ac1441d", "600024b1"],
    ["6.6.346.27", "741c5f3b", "91b8852b"],
    ["6.6.346.24", "cbb74c67", "3e6b9b38"],
    ["6.2.414.78", "4d9d4c8d", "c2f91993"],
    ["6.2.414.77", "2e12ba35", "818125c8"],
    ["6.2.414.72", "90a269a0", "96890b15"],
    ["6.2.414.66", "a8f60b85", "36eba645"],
    ["6.2.414.54", "6ed53280", "82f11b7d"],
    ["6.2.414.50", "ae6544a8", "bd692ce0"],
    ["6.2.414.46", "4e617339", "81adf054"],
    ["6.2.414.44", "c60a7c87", "7e207921"],
    ["6.2.414.32", "42110b24", "84d039aa"],
    ["6.1.534.50", "a0f6f0f4", "9e10b69f"],
    ["6.1.534.48", "f14f22a0", "82467775"],
    ["6.1.534.47", "79276eb0", "221a8fc5"],
    ["6.1.534.46", "babe69a4", "64318412"],
    ["6.1.534.42", "166f25d9", "9892d1c2"],
    ["6.0.287.53", "a1bc32d4", "6fcdcd18"],
    ["6.0.286.52", "2cf4293d", "a030b731"],
    ["5.5.372.43", "b96063d0", "c10a0c40"],
    ["5.1.281.111", "bb23baab", "78f44bee"],
    ["4.6.85.32", "35a37732", "ca4b83fd"],
    ["4.5.103.53", "15953e0e", "b217e70b"],
    ["3.28.71.20", "26145e77", "fec9a40d"],
];

function detect() {
    if (Binary.getSize() >= 0x20) {
        if (Binary.compare("DEC0", 0x02)) {
            bDetected = true;
            for (i = 0; i < VersionHash.length; i++) {
                if (Binary.compare(VersionHash[i][1], 0x04)) {
                    sVersion = "v" + VersionHash[i][0] + " x86"
                } else if (Binary.compare(VersionHash[i][2], 0x04)) {
                    sVersion = "v" + VersionHash[i][0] + " x64"
                };
            }
        }
    }


    sLang = "JavaScript";

    return result();
}

================================================
FILE: db/Binary/format_bin.Java.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Levis <levintaeyeon@live.com>, LinXP
// doc-ref: https://docs.oracle.com/javase/specs/jvms/se18/html/jvms-4.html

meta("format", "Java Class File (.CLASS)");

function detect() {
    if (Binary.getSize() >= 8) {
        if (Binary.compare("CAFEBABE")) {
            bDetected = true;

            var nMinor = Binary.read_uint16(0x04, _BE),
                nMajor = Binary.read_uint16(0x06, _BE);

            switch (nMajor) { // https://en.wikipedia.org/wiki/Java_version_history
                case 45: sVersion = "JDK 1.1"; break; // February 1997
                case 46: sVersion = "JDK 1.2"; break; // December 1998
                case 47: sVersion = "JDK 1.3"; break; // May 2000
                case 48: sVersion = "JDK 1.4"; break; // February 2002
                case 49: sVersion = "Java SE 5.0"; break; // September 2004
                case 50: sVersion = "Java SE 6"; break; // December 2006
                case 51: sVersion = "Java SE 7"; break; // July 2011
                case 52: sVersion = "Java SE 8"; break; // March 2014
                case 53: sVersion = "Java SE 9"; break; // September 2017
                case 54: sVersion = "Java SE 10"; break; // March 2018
                case 55: sVersion = "Java SE 11"; break; // September 2018
                case 56: sVersion = "Java SE 12"; break; // March 2019
                case 57: sVersion = "Java SE 13"; break; // September 2019
                case 58: sVersion = "Java SE 14"; break; // March 2020
                case 59: sVersion = "Java SE 15"; break; // September 2020
                case 60: sVersion = "Java SE 16"; break; // March 2021
                case 61: sVersion = "Java SE 17"; break; // September 2021
                case 62: sVersion = "Java SE 18"; break; // March 2022
                case 63: sVersion = "Java SE 19"; break; // September 2022
                case 64: sVersion = "Java SE 20"; break; // March 2023
                case 65: sVersion = "Java SE 21"; break; // September 2023
                case 66: sVersion = "Java SE 22"; break; // March 2024
                case 67: sVersion = "Java SE 23"; break; // September 2024
                case 68: sVersion = "Java SE 24"; break; // March 2025
                case 69: sVersion = "Java SE 25"; break; // September 2025
            }

            if (sVersion && nMinor) {
                sVersion += "." + nMinor;
            }

            if (bDetected && Binary.isVerbose()) {
                var nOffset = 0x08;
                var constantPoolCount = Binary.read_uint16(nOffset, _BE);

                nOffset += 2;
                for (pool = 1; pool < constantPoolCount; pool++) {
                    switch (Binary.read_uint8(nOffset)) { // Tag
                        case 1: // CONSTANT_Utf8
                            nOffset += 1 + 2 + Binary.read_uint16(nOffset + 1, _BE);
                            break;
                        case 3: // CONSTANT_Integer
                        case 4: // CONSTANT_Float
                            nOffset += 1 + 4;
                            break;
                        case 5: // CONSTANT_Long
                        case 6: // CONSTANT_Double
                            nOffset += 1 + 4 + 4;
                            break;
                        case 7: // CONSTANT_Class
                        case 8: // CONSTANT_String
                        case 16: // CONSTANT_MethodType
                            nOffset += 1 + 2;
                            break;
                        case 9: // CONSTANT_Fieldref
                        case 10: // CONSTANT_Methodref
                        case 11: // CONSTANT_InterfaceMethodref
                        case 12: // CONSTANT_NameAndType
                        case 18: // CONSTANT_InvokeDynamic
                            nOffset += 1 + 2 + 2;
                            break;
                        case 15: // CONSTANT_MethodHandle_info
                            nOffset += 1 + 1 + 2;
                            break;
                        default:
                            sOption("err unk tag:" + nOffset);
                    }
                }
                var nAccessFlagss = Binary.read_uint16(nOffset, _BE);
                if (nAccessFlagss & 0x0001) { sOption("ACC_PUBLIC"); }
                if (nAccessFlagss & 0x0002) { sOption("ACC_PRIVATE"); }
                if (nAccessFlagss & 0x0004) { sOption("ACC_PROTECTED"); }
                if (nAccessFlagss & 0x0008) { sOption("ACC_STATIC"); }
                if (nAccessFlagss & 0x0010) { sOption("ACC_FINAL"); }
                if (nAccessFlagss & 0x0020) { sOption("ACC_SUPER"); }
                if (nAccessFlagss & 0x0040) { sOption("ACC_VOLATILE"); }
                if (nAccessFlagss & 0x0080) { sOption("ACC_TRANSIENT"); }
                if (nAccessFlagss & 0x0100) { sOption("ACC_NATIVE"); }
                if (nAccessFlagss & 0x0200) { sOption("ACC_INTERFACE"); }
                if (nAccessFlagss & 0x0400) { sOption("ACC_ABSTRACT"); }
                if (nAccessFlagss & 0x0800) { sOption("ACC_STRICT"); }
            }
        }
    }


    sLang = "Java";

    return result();
}

================================================
FILE: db/Binary/format_bin.KeePass.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Arjan Onwezen
// Info: https://gist.github.com/lgg/e6ccc6e212d18dd2ecd8a8c116fb1e45
// Rewritten by BJNFNE

meta("format", "KeePass");

function detect() {
    if (Binary.compare("03 D9 A2 9A")) {
        bDetected = true;
        if (Binary.compare("65 FB 4B B5", 4)) {
            sVersion = "1.X";
            sOptions = ".KBD";
            bDetected = true;
        }
        if (Binary.compare("66 FB 4B B5", 4)) {
            sVersion = "2.X, pre-release (alpha/beta)";
            sOptions = ".KBDX";
            bDetected = true;
        }
        if (Binary.compare("67 FB 4B B5", 4)) {
            sVersion = "2.X";
            sOptions = ".KBDX";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_bin.LUA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("format", "Lua Bytecode (.LUAC)");

function detect() {
    if (Binary.getSize() >= 8) {
        if (Binary.compare("1B'Lua'..00")) {
            bDetected = true;
            switch (Binary.read_uint8(0x04)) {
                case 0x50: sVersion = "v5.0"; break;
                case 0x51: sVersion = "v5.1"; break;
                case 0x52: sVersion = "v5.2"; break;
                case 0x53: sVersion = "v5.3"; break;
                case 0x54: sVersion = "v5.4"; break;
                default: return;
            }
            if (Binary.isVerbose()) {
                switch (Binary.read_uint8(0x06)) {
                    case 0: sOption("BigEndian"); break;
                    case 1: sOption("LittleEndian"); break;
                    default: return;
                }
            }
        }
    }

    sLang = "Lua";

    return result();
}

================================================
FILE: db/Binary/format_bin.NVA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Tembo (http://tembolab.pl/products/executable-image-viewer.html)

meta("format", "NVA");

function detect() {
    if (Binary.getSize() >= 8) {
        if (Binary.compare("'%NVA'")) {
            sVersion = Binary.getString(5, 3);
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_bin.Nintendo-certified-file.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kae <TG@kaens>

// from https://www.psdevwiki.com/ps3/Certified_File
// & https://www.psdevwiki.com/ps3/SELF_-_SPRX#ELF_Header
meta("format", "Unknown Certified File");

function detect() {
    if (X.c("'SCE'00")) {
        var tp, e;
        if (X.c('0000 0002', 4)) e = _BE; //PS3
        else if (X.c('0300 0000', 4)) e = _LE; //Vita
        else return;
        // PS3/Vita Certified File
        const attr = X.U16(8, e), tp = X.U16(0xA, e), exhdsz = X.U32(0xC, e), fofs = X.U64(0x10, e),
            fsz = X.U64(0x18, e), CFfsz = (e == _BE) ? 0 : X.U64(0x20, e), padding = (e == _BE) ? 0 : X.U64(0x28, e);
        var p = e == _BE? 0x20 : 0x30;
        switch (tp) {
        case 1:
            const eexhdsz = X.U64(p, e);
            if(!(e == _BE && eexhdsz == 3 || e == _LE && eexhdsz == 4)) return;
            const progidhdp = X.U64(p+8, e), ehdrp = X.U64(p+0x10, e),
                phdrp = X.U64(p+0x18, e), shdrp = X.U64(p+0x20, e);
                if (progidhdp+0x20 != ehdrp || ehdrp+0x40 != phdrp) return;
            if(X.c("7F 'ELF' .. .. 01", ehdrp)) sName = "Nintendō signed ELF/PRX (.SELF,.SPRX)";
            else sName = "Nintendō signed ELF/PRX, headerless (.SELF,.SPRX)";
            break;
        case 2: sName = "Nintendō signed revoke list (.SRVK)"; break;
        case 3: sName = "Nintendō signed package (.SPKG)"; break;
        case 4: sName = "Nintendō signed security policy profile (.SSPP)"; break;
        case 5: sName = "Nintendō signed diff (.SDIFF)"; break;
        case 6: sName = "Nintendō signed param.sfo"; break;
        default: if (X.isHeuristicScan()) { sType = '~'+sType; sName += ' type '+Hex(tp); } else return;
        }

        if (!isWithin(fofs, p,X.Sz()) || fsz < fofs) return;

        bDetected = true; sVersion = e == _BE ? 'PS3'  : 'PSVita';
        if(attr == 0x8000) sOption('fSELF');
        if(X.isVerbose()) sOption(outSz(fofs+fsz),'sz:')
    }

    return result();
}


================================================
FILE: db/Binary/format_bin.PEFF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://en.wikipedia.org/wiki/Preferred_Executable_Format
// Rewritten by BJNFNE

meta("format", "Preferred Executable Format");

function detect() {
    if (Binary.compare("'Joy!peff'00000001")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("'Joy!peffpwpc'00000001")) {
        sOptions = "PowerPC";
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_bin.PalmFile.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG @kaens)
// TODO parse PQA too, why not
/* beautify ignore:start */

meta("format", "Palm OS file ");

function detect() {
    //ref https://jichu4n.github.io/palm-pdb/assets/Palm%20File%20Format%20Specification.pdf
    // & https://github.com/jichu4n/palm-os-sdk/blob/master/sdk-3.1/include/Core/System/DataPrv.h
    if (/S98[0-3]/.test(X.SA(0, 4)) && X.U32(4) <= 0x20 && !X.U32(0xC)
        && (!X.U32(0x10) || isWithin(X.U32(0x10), 0x20, 0x800000))
        && X.U32(0x14) < 0x20000
        && (!X.U32(0x18) || isWithin(X.U32(0x18), X.U32(0x14), 0x800000))
        && X.U32(0x1C) <= 0x40) return //too many FPs with the S98 chiptunes
    var bad = '', sus = 0;

    function palmDateToStr(dt, desc) {
        // Palm OS date starts from Jan 1, 1904......
        if (typeof desc != 'string') desc = '';
        var msecs = new Date(1904, 0, 1).getTime() + dt * 1000;
        var date = new Date(msecs);
        if (!isWithin(date.getFullYear(), 1996, 2040) //...but not many file makers seem to have actually known that lol
            && date.getFullYear() != 1907) { // 1907 is courtesy Graffiti Sniper - Golgo 13 xmas cards. The game's from 2001
            msecs = new Date(0).getTime() + (dt * 1000); date = new Date(msecs)
        }
        if (!isWithin(date.getFullYear(), 1996, 2040) && date.getFullYear() != 1907)
            if (isWithin(dt, 1996, 2040))
                return 'y' + dt // some don't even realise it has a format and think it's just the year. (ZioGolf's zgrsc.pdb :D)
            else return ''; //thankfully even with the special snowflakes it's tight enough for detection
        var r = date.toISOString().slice(0, 19);
        return r.slice(0, 4) == '1907' ? '2001' + r.slice(4, 19) : r
    }

    const dmHdrAttrBackup = 1, dmHdrAttrLaunchableData = 2;
    var name = X.SA(0, 0x20), nc = charStat(name, true);
    if (nc.indexOf('asc') < 0) return;
    var attr = X.U16(0x20, _BE), v = X.U16(0x22, _BE), dtCre = X.U32(0x24, _BE), dtMod = X.U32(0x28, _BE),
        dtBak = X.U32(0x2C, _BE), modnum = X.U32(0x30, _BE), appinfo = X.U32(0x34, _BE),
        sortinfo = X.U32(0x38, _BE), tp = 'PDB', tp_ = X.SA(0x3C, 4), by = X.SA(0x40, 4);
    var idseed = X.U32(0x44, _BE), nextrec = X.U16(0x48, _BE), numrec = X.U16(0x4C, _BE),
        p = numrec ? 0x4E : 0x50;
    if (!numrec) sus += 3; //useless pdb, or, more realistically, a FP
    if (numrec > 0x7FFF) sus += 2; //haven't seen this many yet...
    if (modnum > 0xFFF) sus += 2; //can't be that many versions, right?
    if (nextrec) { sus++; bad = bad.addIfNone('!baddbdir') } //Palm specs say reject this db (artefacts of pre-v4 OSes)
    if (idseed > 0xFFFFFF) sus++;
    if (!/\w{3,}/.test(by)) return;
    switch (tp_) {
        case 'appl': tp = 'PRC'; break;
        case 'pqa ': if (by == 'clpr') tp = 'PQA'; else return;
        default:
            if (charStat(X.readBytes(p, 4), true).indexOf('allasc') >= 0) {
                tp = 'PRC'; bad = bad.addIfNone('!badtype' + X.SA(p, 4))
            }
    }
    var dt = palmDateToStr(dtMod, 'mod'), endp, reclen = 8, m = i = 0, mhk = '', uniq = [];
    if (dtMod && dt === '') { sus += 2; bad = bad.addIfNone('!nodate') }
    if (dtCre && palmDateToStr(dtCre, 'cre') === '') sus++;
    if (dtBak && palmDateToStr(dtBak, 'bak') === '') sus++;

    if (tp === 'PRC') for (reclen = 10, endp = p + reclen * numrec; p < endp; p += reclen) { // PRC RsrcEntryType
        if (p + 10 > X.Sz()) { /*debug('lookahead shorted out');*/ return }
        var hkhd = X.SA(p, 4), hkid = X.U16(p + 4, _BE), hkofs = X.U32(p + 6, _BE);
        if (!isWithin(hkofs, p, X.Sz()) || !/\w{3,}/.test(hkhd) || uniq.indexOf(hkofs) >= 0) return;
        uniq.push(hkofs); if (m < hkofs) { m = hkofs; mhk = hkhd }
        if (hkhd === 'tver') sVersion = 'v' + X.SA(m, 0x100).trim()
    }
    else if (tp === 'PDB') for (reclen = 8, endp = p + reclen * numrec; p < endp; p += reclen) { // PDB RecordEntryType
        if (p + 8 > X.Sz()) return;
        var hkofs = X.U32(p, _BE), hkattr = X.U8(p + 4), hkid = X.U24(p + 5, _BE); //the ID is unique. Not in reality though
        if (!isWithin(hkofs, p, X.Sz()) || uniq.indexOf(hkofs) >= 0) return;
        uniq.push(hkofs); if (m < hkofs) m = hkofs
    }
    //else TODO parse PQA reclist
    if (appinfo && !isWithin(appinfo, 0x4E + reclen * numrec, X.Sz())
        || sortinfo && !isWithin(sortinfo, 0x4C + reclen * numrec, X.Sz())
        || appinfo && sortinfo && sortinfo < appinfo) {
		/*debug('appinfo/sortinfo bad address');*/ return
    }

    if (sVersion != '') sVersion = tp_.appendS(sVersion, ' '); else sVersion = tp_;
    if (appinfo && Math.abs(appinfo - p) > 0x10) {
        //_l2r('Palm OS file',p,'appinfo should be '+Hex(appinfo));
        return
    }
    if (sus > 3) return;
    if (tp == 'PRC')
        if (['taic', 'tAIN', 'tver', 'tSTR'].indexOf(mhk) >= 0)
            sz = outSz(X.fSig(m, -1, '00') + 1); //text fields, most end with 0. Some do have 0 padding...
        else if (mhk == 'tSTL') {
            var ll = X.U8(m + 2, _BE), z; m += 4;
            for (i = 0; i < ll && m <= X.Sz(); i++) {
                z = X.fSig(m, TOEOF, "00");
                if (z < 0) { bad = bad.addIfNone('!short'); break }
                m = z + 1
            }
            sz = outSz(m)
        }
        else if (['pref'].indexOf(mhk) >= 0) sz = outSz(m + 10);
        else if (X.c("'RIFF'........'WAVE'", m)) sz = outSz(m + X.U32(m + 4) + 8);
        else {
            sz = Hex(Math.max(m, p, appinfo, sortinfo)) + '+' + mhk;
            if (mhk === 'code' && !X.c("4E75", X.Sz() - 2)) bad = bad.addIfNone("!noRTSatEoF")
        }
    else // PDB? PQA?
        sz = Math.max(m, p) + '+' + mhk;

    sName = "Palm OS file (." + tp + ")"; bDetected = true;
    if (sus) bad += '!sus×' + sus;
    if (bad != '') sVersion = sVersion.appendS('malformed' + bad, '/');
    if (X.isVerbose()) {
        sOption(name); sOption(by, 'by:'); sOption(dt, 'lastmod' + (modnum > 1 ? ' (×' + modnum + ')' : '') + ':');
        sOption(Hex(idseed), "idseed:")
        if (appinfo) sOption('appinfo'); if (sortinfo) sOption('sortinfo'); sOption(numrec, 'res:'); sOption(sz, 'sz:')
    }

    return result()
}
/* beautify ignore:end */


================================================
FILE: db/Binary/format_bin.Python.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Levis <levintaeyeon@live.com>
// History:
// Update sign to detect version of Python from 1.0 to 3.4
// Update sign to detect version of Python from 3.4 to 3.13a1 (by LinXP)
// Update sign to detect forks of Python and Some other versions (by northkatz)
// Full info: https://github.com/python/cpython/blob/main/Lib/importlib/_bootstrap_external.py#L463
// Version history: https://github.com/python/cpython/blob/main/Include/internal/pycore_magic_number.h

meta("format", "Python Compiled Module");

function detect() {
    if (Binary.getSize() >= 64) {
        if (Binary.read_uint16(0x02) == 0x0099) {
            bDetected = true;
            switch (Binary.read_uint32(0)) {
                case 0x00999902: sVersion = "1.0"; break;
                case 0x00999903: sVersion = "1.1-1.2"; break;
                default: return;
            }
        } else if (Binary.read_uint16(0x02) == 0x0A0D && Binary.isSignaturePresent(0x10, 0x100, "00 00 00 00")) {
            bDetected = true;
            var magicValue = Binary.read_uint16(0);
            switch (magicValue) {
                case 11913: sVersion = "1.3"; break;
                case 5892: sVersion = "1.4"; break;
                case 20121: sVersion = "1.5-1.5.2"; break;
                case 50428: sVersion = "1.6"; break;
                case 50823: sVersion = "2.0-2.0.1"; break;
                case 60202: sVersion = "2.1-2.1.2"; break;
                case 60717: sVersion = "2.2"; break;
                case 62011: sVersion = "2.3a0"; break;
                case 62021: sVersion = "2.3a0"; break;
                case 62041: sVersion = "2.4a0"; break;
                case 62051: sVersion = "2.4a3"; break;
                case 62061: sVersion = "2.4b1"; break;
                case 62071: sVersion = "2.5a0"; break;
                case 62081: sVersion = "2.5a0"; break;
                case 62091: sVersion = "2.5a0"; break;
                case 62092: sVersion = "2.5a0"; break;
                case 62101: sVersion = "2.5b3"; break;
                case 62111: sVersion = "2.5b3"; break;
                case 62121: sVersion = "2.5c1"; break;
                case 62131: sVersion = "2.5c2"; break;
                case 62135: sVersion = "2.5 (Dropbox)"; break;
                case 62151: sVersion = "2.6a0"; break;
                case 62161: sVersion = "2.6a1"; break;
                case 62171: sVersion = "2.7a0"; break;
                case 62181: sVersion = "2.7a0"; break;
                case 62191: sVersion = "2.7a0"; break;
                case 62201: sVersion = "2.7a0"; break;
                case 62211: sVersion = "2.7a0"; break;
                case 62218: sVersion = "2.7 (PyPy)"; break;
                case 22138: sVersion = "2.7 (Pyston)"; break;
                case 2657: sVersion = "2.7 (Pyston-0.6.1)"; break;
                case 3000: sVersion = "3.0"; break;
                case 3010: sVersion = "3.0"; break;
                case 3020: sVersion = "3.0"; break;
                case 3030: sVersion = "3.0"; break;
                case 3040: sVersion = "3.0"; break;
                case 3050: sVersion = "3.0"; break;
                case 3060: sVersion = "3.0"; break;
                case 3061: sVersion = "3.0"; break;
                case 3071: sVersion = "3.0"; break;
                case 3081: sVersion = "3.0"; break;
                case 3091: sVersion = "3.0"; break;
                case 3101: sVersion = "3.0"; break;
                case 3103: sVersion = "3.0"; break;
                case 3111: sVersion = "3.0a4"; break;
                case 3131: sVersion = "3.0b1"; break;
                case 3141: sVersion = "3.1a1"; break;
                case 3151: sVersion = "3.1a1"; break;
                case 3160: sVersion = "3.2a1"; break;
                case 3170: sVersion = "3.2a2"; break;
                case 3180: sVersion = "3.2a3"; break;
                case 48: sVersion = "3.2 or 3.2 (PyPy)"; break;
                case 3187: sVersion = "3.2 (PyPy)"; break;
                case 3190: sVersion = "3.3a1"; break;
                case 3200: sVersion = "3.3a1"; break;
                case 3210: sVersion = "3.3a1"; break;
                case 3220: sVersion = "3.3a2"; break;
                case 3230: sVersion = "3.3a4"; break;
                case 64: sVersion = "3.3 (PyPy)"; break;
                case 3250: sVersion = "3.4a1"; break;
                case 3260: sVersion = "3.4a1"; break;
                case 3270: sVersion = "3.4a1"; break;
                case 3280: sVersion = "3.4a1"; break;
                case 3290: sVersion = "3.4a4"; break;
                case 3300: sVersion = "3.4a4"; break;
                case 3310: sVersion = "3.4rc2"; break;
                case 3320: sVersion = "3.5a1"; break;
                case 3330: sVersion = "3.5b1"; break;
                case 3340: sVersion = "3.5b2"; break;
                case 3350: sVersion = "3.5b3"; break;
                case 3351: sVersion = "3.5.2"; break;
                case 112: sVersion = "3.5 (PyPy)"; break;
                case 3360: sVersion = "3.6a0"; break;
                case 3361: sVersion = "3.6a1"; break;
                case 3370: sVersion = "3.6a2"; break;
                case 3371: sVersion = "3.6a2"; break;
                case 3372: sVersion = "3.6a2"; break;
                case 3373: sVersion = "3.6b1"; break;
                case 3375: sVersion = "3.6b1"; break;
                case 3376: sVersion = "3.6b1"; break;
                case 3377: sVersion = "3.6b1"; break;
                case 3378: sVersion = "3.6b2"; break;
                case 3379: sVersion = "3.6rc1"; break;
                case 192: sVersion = "3.6 (PyPy)"; break;
                case 160: sVersion = "3.6.1 (PyPy)"; break;
                case 3390: sVersion = "3.7a1"; break;
                case 3391: sVersion = "3.7a2"; break;
                case 3392: sVersion = "3.7a4"; break;
                case 3393: sVersion = "3.7b1"; break;
                case 3394: sVersion = "3.7b5"; break;
                case 240: sVersion = "3.7 (PyPy)"; break;
                case 3400: sVersion = "3.8a1"; break;
                case 3401: sVersion = "3.8a1"; break;
                case 3410: sVersion = "3.8a1"; break;
                case 3411: sVersion = "3.8b2"; break;
                case 3412: sVersion = "3.8b2"; break;
                case 3413: sVersion = "3.8b4 or 3.8.10 (Graal) or 3.8.12-3.8.16 (PyPy)"; break;
                case 256: sVersion = "3.8 (PyPy)"; break;
                case 21150: sVersion = "3.8.5 (Graal)"; break;
                case 3420: sVersion = "3.9a0"; break;
                case 3421: sVersion = "3.9a0"; break;
                case 3422: sVersion = "3.9a0"; break;
                case 3423: sVersion = "3.9a2"; break;
                case 3424: sVersion = "3.9a2"; break;
                case 3425: sVersion = "3.9a2 or 3.9.10-3.9.16 (PyPy)"; break;
                case 336: sVersion = "3.9 (PyPy)"; break;
                case 3430: sVersion = "3.10a1"; break;
                case 3431: sVersion = "3.10a1"; break;
                case 3432: sVersion = "3.10a2"; break;
                case 3433: sVersion = "3.10a2"; break;
                case 3434: sVersion = "3.10a6"; break;
                case 3435: sVersion = "3.10a7"; break;
                case 3436: sVersion = "3.10b1"; break;
                case 3437: sVersion = "3.10b1"; break;
                case 3438: sVersion = "3.10b1"; break;
                case 3439: sVersion = "3.10b1"; break;
                case 384: sVersion = "3.10 (PyPy)"; break;
                case 21280: sVersion = "3.10 (Graal)"; break;
                case 3450: sVersion = "3.11a1"; break;
                case 3451: sVersion = "3.11a1"; break;
                case 3452: sVersion = "3.11a1"; break;
                case 3453: sVersion = "3.11a1"; break;
                case 3454: sVersion = "3.11a1"; break;
                case 3455: sVersion = "3.11a1"; break;
                case 3456: sVersion = "3.11a1"; break;
                case 3457: sVersion = "3.11a1"; break;
                case 3458: sVersion = "3.11a1"; break;
                case 3459: sVersion = "3.11a1"; break;
                case 3460: sVersion = "3.11a1"; break;
                case 3461: sVersion = "3.11a1"; break;
                case 3462: sVersion = "3.11a2"; break;
                case 3463: sVersion = "3.11a3"; break;
                case 3464: sVersion = "3.11a3"; break;
                case 3465: sVersion = "3.11a3"; break;
                case 3466: sVersion = "3.11a4"; break;
                case 3467: sVersion = "3.11a4"; break;
                case 3468: sVersion = "3.11a4"; break;
                case 3469: sVersion = "3.11a4"; break;
                case 3470: sVersion = "3.11a4"; break;
                case 3471: sVersion = "3.11a4"; break;
                case 3472: sVersion = "3.11a4"; break;
                case 3473: sVersion = "3.11a4"; break;
                case 3474: sVersion = "3.11a4"; break;
                case 3475: sVersion = "3.11a5"; break;
                case 3476: sVersion = "3.11a5"; break;
                case 3477: sVersion = "3.11a5"; break;
                case 3478: sVersion = "3.11a5"; break;
                case 3479: sVersion = "3.11a5"; break;
                case 3480: sVersion = "3.11a5"; break;
                case 3481: sVersion = "3.11a5"; break;
                case 3482: sVersion = "3.11a5"; break;
                case 3483: sVersion = "3.11a5"; break;
                case 3484: sVersion = "3.11a5"; break;
                case 3485: sVersion = "3.11a5"; break;
                case 3486: sVersion = "3.11a6"; break;
                case 3487: sVersion = "3.11a6"; break;
                case 3488: sVersion = "3.11a6"; break;
                case 3489: sVersion = "3.11a6"; break;
                case 3490: sVersion = "3.11a6"; break;
                case 3491: sVersion = "3.11a6"; break;
                case 3492: sVersion = "3.11a7"; break;
                case 3493: sVersion = "3.11a7"; break;
                case 3494: sVersion = "3.11a7"; break;
                case 3495: sVersion = "3.11a7"; break;
                case 416: sVersion = "3.11 (PyPy)"; break;
                case 21290: sVersion = "3.11 (Graal)"; break;
                case 3500: sVersion = "3.12a1"; break;
                case 3501: sVersion = "3.12a1"; break;
                case 3502: sVersion = "3.12a1"; break;
                case 3503: sVersion = "3.12a1"; break;
                case 3504: sVersion = "3.12a1"; break;
                case 3505: sVersion = "3.12a1"; break;
                case 3506: sVersion = "3.12a1"; break;
                case 3507: sVersion = "3.12a1"; break;
                case 3508: sVersion = "3.12a1"; break;
                case 3509: sVersion = "3.12a1"; break;
                case 3510: sVersion = "3.12a2"; break;
                case 3511: sVersion = "3.12a2"; break;
                case 3512: sVersion = "3.12a2"; break;
                case 3513: sVersion = "3.12a4"; break;
                case 3514: sVersion = "3.12a4"; break;
                case 3515: sVersion = "3.12a5"; break;
                case 3516: sVersion = "3.12a5"; break;
                case 3517: sVersion = "3.12a5"; break;
                case 3518: sVersion = "3.12a6"; break;
                case 3519: sVersion = "3.12a6"; break;
                case 3520: sVersion = "3.12a6"; break;
                case 3521: sVersion = "3.12a7"; break;
                case 3522: sVersion = "3.12a7"; break;
                case 3523: sVersion = "3.12a7"; break;
                case 3524: sVersion = "3.12a7"; break;
                case 3525: sVersion = "3.12b1"; break;
                case 3526: sVersion = "3.12b1"; break;
                case 3527: sVersion = "3.12b1"; break;
                case 3528: sVersion = "3.12b1"; break;
                case 3529: sVersion = "3.12b1"; break;
                case 3530: sVersion = "3.12b1"; break;
                case 3531: sVersion = "3.12b1"; break;
                case 12897: sVersion = "3.12 (Rust)"; break;
                case 3550: sVersion = "3.13a1"; break;
                case 3551: sVersion = "3.13a1"; break;
                case 3552: sVersion = "3.13a1"; break;
                case 3553: sVersion = "3.13a1"; break;
                case 3554: sVersion = "3.13a1"; break;
                case 3555: sVersion = "3.13a1"; break;
                case 3556: sVersion = "3.13a1"; break;
                case 3557: sVersion = "3.13a1"; break;
                case 3558: sVersion = "3.13a1"; break;
                case 3559: sVersion = "3.13a1"; break;
                case 3560: sVersion = "3.13a1"; break;
                case 3561: sVersion = "3.13a1"; break;
                case 3562: sVersion = "3.13a1"; break;
                case 3563: sVersion = "3.13a1"; break;
                case 3564: sVersion = "3.13a1"; break;
                case 3565: sVersion = "3.13a1"; break;
                case 3571: sVersion = "3.13"; break;
                case 12641: sVersion = "3.13.0 (Rust)"; break;
                case 3600: sVersion = "3.14"; break;
                case 3627: sVersion = "3.14rc3"; break;
                default: sVersion = "Unknown";
            }

            if (X.isVerbose()) sVersion = sVersion.append("magic: " + magicValue);
        }
    }

    sLang = "Python";

    return result();
}

================================================
FILE: db/Binary/format_bin.SWF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Small Web Format (.SWF)");

includeScript("zlib");

function detect() {
    if (Binary.getSize() >= 32 && Binary.compare("%% %% %% ?? ?? ?? ?? 00")) {
        switch (Binary.getString(0, 3)) {
            case "FWS":
                sOptions = "uncompressed";
                bDetected = true;
                break;
            case "CWS":
                if (detect_zlib(Binary, 0x08))
                    bDetected = true;
                break;
            case "ZWS":
                sOptions = "LZMA";
                bDetected = true;
        }

        if (bDetected) {
            sVersion = Binary.read_uint8(0x03);
        }
    }

    return result();
}


================================================
FILE: db/Binary/format_bin.VCF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens <TG@kaens>

// https://en.wikipedia.org/wiki/vCard
// https://www.rfc-editor.org/rfc/rfc6350, 6868, 9554, 9555
meta("format", "vCard/Virtual Contact File (.VCF,.vcard)");

function detect() {
    var ep, vp, sV;
    if ( !X.c("'BEGIN:VCARD'0d0a")
        || (ep=X.fSig(20,0x2000,"0d0a'END:VCARD'")) < 20
        || (vp=X.fSig(10,ep,"0d0a'VERSION:'")) < 10
        || !/\d(\.\d)?/.test(sV=X.SA(vp+10,3).trim())
    ) return;
    bDetected = true;
    var nV = 2.1;
    const sz = ep+13, st = 11;
    sVersion = 'v'+sV;
    if (X.isVerbose()) {
        if ( X.fSig(st, ep, "0d0a'GEO:geo:'") > st || X.fSig(st, ep, "0d0a'ANNIVERSARY'") > st
          || X.fSig(st, ep, "0d0a'CALADRURI'") > st || X.fSig(st, ep, "0d0a'CALURI'") > st
          || X.fSig(st, ep, "0d0a'CLIENTPIDMAP'") > st || X.fSig(st, ep, "0d0a'FBURL'") > st
          || X.fSig(st, ep, "0d0a'GENDER'") > st || X.fSig(st, ep, "0d0a'PRONOUNS'") > st
          || X.fSig(st, ep, "0d0a'KIND'") > st || X.fSig(st, ep, "0d0a'MEMBER'") > st
          || X.fSig(st, ep, "0d0a'RELATED'") > st || X.fSig(st, ep, "0d0a'XML'") > st)
            nV = 4.0;

        if ( X.fSig(st, ep, "0d0a'CATEGORIES:'") > st || X.fSig(st, ep, "0d0a'CLASS:'") > st
          || X.fSig(st, ep, "0d0a'IMPP'") > st || X.fSig(st, ep, "0d0a'NAME'") > st
          || X.fSig(st, ep, "0d0a'NICKNAME'") > st || X.fSig(st, ep, "0d0a'PRODID'") > st
          || X.fSig(st, ep, "0d0a'PROFILE'") > st || X.fSig(st, ep, "0d0a'SORT-STRING'") > st)
            nV = Math.max(nV, 3.0);

        if ( (+sV) < nV || (nV == 4.0 && sV == "4.0" && ( X.fSig(st, ep, "0d0a'LABEL'") > st
          || X.fSig(st, ep, "0d0a'SORT-STRING'") > st )) )
            sOption('version-incompatible fields');

        sOption(outSz(sz),'sz:')
    }
    return result();
}

================================================
FILE: db/Binary/format_bin.WindowsIconCacheDB.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Arjan Onwezen

meta("format", "Windows IconCacheDB");

function detect() {
    if (Binary.getSize() >= 20) {
        if (Binary.compare("..000000'Win4'")) {
            bDetected = true;
            switch (Binary.read_uint16(12)) {
                case 6000: sOption("Vista (Build 6000)"); break;
                case 6001: sOption("Vista (Build 6001)"); break;
                case 7600: sOption("Windows 7 (Build 7600)"); break;
                case 7601: sOption("Windows 7 (Build 6701)"); break;
                case 10586: sOption("Windows 10 (Build 10586)"); break;
                default: sOption("Unknown version");
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_database.SQLite.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://www.sqlite.org/fileformat.html

meta("format", "SQLite 3 database (.SQLITE)");

function detect() {
    if (Binary.compare("'SQLite format 3'00")) {
        bDetected = true;

        var nAppID = Binary.read_uint32(0x44, _BE),
            nSQLiteVersionNumber = Binary.read_uint32(0x60, _BE),
            nChangeCount = Binary.read_uint32(0x18, _BE);

        var nMajor = nSQLiteVersionNumber / 1000000 >> 0,
            nMinor = (nSQLiteVersionNumber - nMajor * 1000000) / 1000 >> 0,
            nRelease = nSQLiteVersionNumber - (nMajor * 1000000) - (nMinor * 1000) >> 0;

        sVersion = nMajor + "." + nMinor + "." + nRelease;

        switch (Binary.read_uint32(0x38, _BE)) {
            case 1: sOption("UTF-8"); break;
            case 2: sOption("UTF-16LE"); break;
            case 3: sOption("UTF-16BE"); break;
            default: return;
        }

        if (nAppID && Binary.isVerbose()) {
            sOption("AppID: " + nAppID);
        }

        if (nChangeCount && Binary.isVerbose()) {
            sOption("Changes: " + nChangeCount);
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_databases.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: hypn0 <hypn0@mail.ru>, Kaens (TG@kaens)

meta("format", "");

/* beautify ignore:start */
function detect() {
    if (Binary.compare("00010000'Standard Jet DB'00")) {
        sName = "Microsoft Access database (.MDB)";
        bDetected = true;
    }

    function isDBF() {
        // from https://independent-software.com/dbase-dbf-dbt-file-format.html
        // & https://www.clicketyclick.dk/databases/xbase/format/dbf.html
        // & https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
        nv = X.U8(0); v5 = false;
        switch (nv) {
            case 0x02: sv = 'FoxBase 1.0'; break;
            case 0x03: sv = 'FoxBase 2.x / dBASE III, no memo file'; break;
            case 0x04: sv = 'dBASE IV, no memo file'; break;
            case 0x05: sv = 'dBASE V, no memo file'; break;
            case 0x07: sv = "VISUAL OBJECTS v1.x for dBase III, no memo file"; break;
            case 0x30: sv = 'Visual FoxPro (possibly with DBC)'; break;
            case 0x31: sv = 'Visual FoxPro with auto increment'; break;
            case 0x32: sv = 'Visual FoxPro with varchar/varbinary'; break;
            case 0x43: sv = 'dBASE IV SQL Table, no memo file / Flagship .dbv memo var size'; break;
            case 0x64: sv = 'dBASE IV SQL System, no memo file'; break;
            case 0x83: sv = 'FoxBase 2.x / dBASE III+ with memo file'; break;
            case 0x87: sv = 'VisualObjects 1.x with memo file'; break;
            case 0x8B: sv = 'dBASE IV with memo file'; break;
            case 0x8C: sv = 'dBASE V with memo file'; break;
            case 0x8E: sv = 'dBASE IV with SQL table'; break;
            case 0xB3: sv = '.dbv with memo table'; break;
            case 0xCB: sv = 'dBASE IV SQL Table with memo file'; break;
            case 0xE5: sv = 'Clipper SIX with memo file'; break;
            case 0xF5: sv = 'FoxPro 2 with memo file'; break;
            case 0xFB: sv = 'FoxPro 2, no memo file'; break;
            default: return false;
        }
        if (nv == 2) {
            recc = X.U16(1); if (!recc) return false; recsz = X.U16(6); if (!recsz) return false;
            hdrsz = 0x209; rectp = 8; enc = 'IBM437';
        } else {
            y = X.U8(1); if (y < 80) y += 2000; else y += 1900; m = X.U8(2); d = X.U8(3);
            if (X.c('000000', 1)) { upd = 'never' } else {
                if (!isWithin(y, 1970, 2100) || !isWithin(m, 1, 12) || !isWithin(d, 1, 31)) return false;
                upd = y + '-' + m.padStart(2, '0') + d.padStart(2, '0')
            }
            recc = X.U32(4); if (!recc) return false;
            hdrsz = X.U16(8); recsz = X.U16(0xA); if (hdrsz < 0x20 || !recsz) return false;
            res0 = X.U24(0xC); res1 = X.readBytes(0xF, 13); res2 = X.U32(0x1C);
            if ([4, 0x8C].indexOf(nv) >= 0) {
                rectp = 0x44; enc = 'CP' + X.SA(0x22, 3); if (isWithin((t = X.SA(0x25, 1)), '0', '9')) enc += t;
                if (enc == 'CPKOI8') enc += X.SA(0x26, 1); v5 = true
            } else {
                rectp = 0x20;
                switch (X.U8(0x1D)) {
                    case 0x02: enc = 'CP850'; break; //DOS Multilingual
                    case 0x03: enc = 'CP1252'; break; //Windows ANSI
                    case 0x04: enc = 'CP10000'; break; //aka. 'macintosh', MAC Roman/W.European Mac
                    case 0x64: enc = 'CP852'; break; //Eastern-European MS-DOS
                    case 0x65: enc = 'CP865'; break; //Nordic MS-DOS
                    case 0x66: enc = 'CP866'; break; //Russian MS-DOS
                    case 0x67: enc = 'IBM861'; break; //Icelandic MS-DOS
                    //case 0x68: enc = 'Kamenicky (Czech) MS-DOS'; break;
                    //case 0x69: enc = 'Mazovia (Polish) MS-DOS'; break;
                    case 0x6A: enc = 'IBM737'; break; //Greek MS-DOS (aka. 437G)
                    case 0x6B: enc = 'IBM857'; break; //Turkish MS-DOS
                    case 0x96: enc = 'CP10007'; break; // aka. 'x-mac-cyrillic', Russian Mac
                    case 0x97: enc = 'CP10029'; break; // aka. 'x-mac-ce', MAC Latin 2/C.European Mac
                    case 0x98: enc = 'CP10006'; break; //aka. 'x-mac-greek', Greek Mac
                    case 0xC8: enc = 'CP1250'; break; //C.European Windows
                    case 0xC9: enc = 'CP1251'; break; //Russian Windows
                    case 0xCA: enc = 'CP1254'; break; //Turkish Windows
                    case 0xCB: enc = 'CP1253'; break; //Greek Windows
                    case 0x01: default: enc = 'IBM437' //OEM US
                }
            }
            //TODO check res* depending on version
        }
        validC = ['C', 'N', 'L', 'D', 'M', 'F', 'B', 'G', 'P', 'Y', 'T', 'I', 'V', 'X', '@', 'O', '+', '0'];
        fldc = 0; totalfldsz = 1 /* we begin with a deletion flag */; p = rectp; old = [0, 1];
        while (X.U8(p) != 0xD && p < hdrsz) {
            var name = X.readBytes(p, v5 ? 0x1F : 11); ns = charStat(name, 1);
            // _log('fld#'+fldc+' @'+Hex(p)+': '+decEncoding(name,CP866)+' (ns=['+ns+'])')
            if (!name[0] || (ns.indexOf('allxsc') < 0 && ns.indexOf('allforeign') < 0)) return false;
            tp = X.SA(v5 ? p + 0x20 : p + 0xB, 1); if (validC.indexOf(tp) < 0) return false;
            if (nv == 2) fldst = X.U16(p + 0xD); else if (v5) fldst = 0; else fldst = X.U32(p + 0xC);
            fldsz = X.U8(nv == 2 ? p + 0xC : v5 ? p + 0x21 : p + 0x10); if (!fldsz) return false;
            // _log('  sz:'+fldsz+', old: '+old+'; '+old[0]+'+'+Hex(old[1])+' = '+Hex(old[0]+old[1])+' ?? '+Hex(fldst))
            if (old[0] && fldst && old[0] + old[1] != fldst) return false; old = [fldsz, fldst];
            totalfldsz += fldsz;
            decn = X.U8(nv == 2 ? p + 0xF : p + 0x11);
            if (tp === 'N' && decn > fldsz) return false;
            fldc++; p += nv == 2 ? 0x10 : v5 ? 0x30 : 0x20;
            if (charStat(name.slice(0, name.indexOf(0)), 1).indexOf('foreign') >= 0
                && enc == "IBM437") enc = "CP1251"; // pesky Russians?
        }
        // _log('@'+Hex(p)+': '+fldc+' fields total size '+totalfldsz+' vs. '+recsz)
        if (totalfldsz - recsz != 0) return false;
        del = 0; if (X.isDeepScan()) {
            p = hdrsz; for (i = 0; i < recc; i++, p += recc) if (X.U8(p) == 0x2A) del++
        }
        sz = hdrsz + recc * recsz; if (X.U8(sz) == 0x1A) sz++;
        return sz <= X.Sz() || X.isHeuristicScan()
    }
    if (!bDetected && isDBF()) {
        sName = "dBase Database (.DBF)"; sVersion = sv; bDetected = true;
        if (X.isVerbose()) {
            sOption('fld:' + fldc + ' rec: ' + recc + (del ? '(* ' + del + ')' : '') + ' enc: ' + enc + ' sz: ' + outSz(sz))
        }
    }

    return result();
}
/* beautify ignore:end */


================================================
FILE: db/Binary/format_doc.CHM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Authors:
//    sendersu (sendersu on exelab.ru),
//    Kaens (TG @kaens)

meta("format", "Microsoft Compiled HTML Help");

function detect() {
    if (Binary.compare("'ITSF'..000000")) {
        bDetected = true;
        sVersion = Binary.read_int32(4, _LE);
        sOption(Binary.read_uint32(0x14, _LE), "LangID: ");
    }

    return result();
}


================================================
FILE: db/Binary/format_doc.DJVU.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens TG@kaens

meta("format", "DjVu document (.DJVU)");

function detect() {
    var sdjv = false;
    if (X.c("'AT&TFORM'"))
        if (X.c("'DJVM'........00", 12)) sVersion = 'multi-page';
        else if (X.c("'DJVU'........00", 12)) sVersion = 'single-page';
        else if (X.c("'DJVI'........00", 12)) sVersion = 'multi-file';
        else if (X.c("'THUMTH44'", 12)) sVersion = 'thumbnails';
        else return false;
    else if (X.c("'SDJVFORM'")) {
        sName = "Secure " + sName;
        sdjv = true
    } else return false;
    bad = "";
    sz = X.U32(8, _BE) + 12;
    if (X.Sz() < sz) bad = bad.addIfNone('!short');
    if (X.isDeepScan() && !sdjv) { //can't say I've ever seen an sdjv so nothing to test on
        var compfiles = minw = minh = mindpi = mingm = 0xFFFFFFFF,
            maxw = maxh = maxdpi = maxgm = 0;
        p = 0x10;
        while (p < sz) {
            hkhd = X.SA(p, 4);
            hksz = X.U32(p + 4, _BE);
            p += 8;
            //_log('@'+Hex(p-8)+':'+hkhd);
            switch (hkhd) {
                case 'INFO':
                    sVersion = sVersion.appendS('image', '/');
                    break;
                case 'NAVM':
                    if (X.isVerbose()) sOptions = sOptions.addIfNone(' bookmarks,');
                    break;
                case 'ANTa':
                case 'ANTz':
                    if (X.isVerbose()) sOptions = sOptions.addIfNone('annotated,');
                    break;
                case 'DIRM':
                    compfiles = X.U16(p + 1);
                    break;
                case 'FORM':
                    if (!X.c("'DJV'", p) && !X.c("'THUM'", p)) { _log('bad subchunk ' + X.SA(p, 8)); return false }
                    q = p + 4;
                    while (q < p + hksz) {
                        shd = X.SA(q, 4);
                        ssz = X.U32(q + 4, _BE);
                        q += 8;
                        if (q + ssz > p + hksz) { bad = bad.addIfNone('!short'); break }
                        switch (shd) {
                            case 'INFO':
                                var w = X.U16(q, _BE),
                                    h = X.U16(q + 2, _BE),
                                    dpi = X.U16(q + 6, _LE /*yes*/),
                                    gm = X.U8(q + 8);
                                if (w < minw) minw = w;
                                if (w > maxw) maxw = w;
                                if (h < minh) minh = h;
                                if (h > maxh) maxh = h;
                                if (dpi < mindpi) mindpi = dpi;
                                if (dpi > maxdpi) maxdpi = dpi;
                                if (gm < mingm) mingm = gm;
                                if (gm > maxgm) maxgm = gm;
                                break;
                            case 'INCL':
                                //if(X.isVerbose()) sOptionT(X.SA(q,ssz),'includes '); //included filenames, normally too many
                                break;
                            case 'TXTa':
                            case 'TXTz':
                                if (X.isVerbose()) sOptions = sOptions.addIfNone('text&layoutinfo,');
                                break;
                            case 'Djbz':
                            case 'Sjbz':
                            case 'FG44':
                            case 'BG44':
                            case 'TH44':
                            case 'WMRM':
                            case 'FGbz':
                            case 'BGjp':
                            case 'FGjp':
                            case 'Smmr':
                                break;
                        }
                        q += ssz;
                        if (q % 2) q++
                    }
                    break;
                default:
                    bad = bad.addIfNone('!badchunk<' + hkhd + '>@' + Hex(p - 8));
            }
            p += hksz;
            if (p % 2) p++
        }
    }
    if (sOptions.length && sOptions[sOptions.length - 1] == ',') sOptions = sOptions.slice(0, sOptions.length - 1);
    bDetected = true;
    if (bad != '') sVersion = sVersion.appendS('malformed' + addEllipsis(bad, 0x80, 0x40), '/')
    if (X.isVerbose()) {
        if (X.isDeepScan()) {
            sOption((minw != maxw ? '[' + minw + '～' + maxw + ']' : minw) + '×' +
                (minh != maxh ? '[' + minh + '～' + maxh + ']' : minh));
            sOption((mindpi != maxdpi ? '[' + mindpi + '～' + maxdpi : mindpi), '', 'dpi');
            sOption('gamma ' + (mingm != maxgm ? '[' + (mingm / 10).toFixed(1) + '～' + (maxgm / 10).toFixed(1) + ']' :
                (mingm / 10).toFixed(1)));
        }
        sOption(outSz(sz), 'sz:')
    }

    return result();
}

================================================
FILE: db/Binary/format_doc.HLP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "MS Help");

function detect() {
    if (Binary.compare("3f5f0300")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_doc.PDF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "PDF");

function detect() {
    if (/^\%PDF-\d+\.\d+/.test(File.read_ansiString(0, 10))) {
        sVersion = File.getString(5, 3);
        bDetected = true;

        var c = 0;
        for (i = 8; i < 15; i++)
            if (File.read_uint8(i) & 0x80) c++;

        if (c) sOptions = "binary data";
    }

    return result();
}


================================================
FILE: db/Binary/format_doc.RTF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "RTF");

function detect() {
    if (/^{\\rtf1?/.test(File.read_ansiString(0, 6))) {
        bDetected = true;
        for (var i = 4; i < Math.min(File.getSize(), 0x100); i++)
            if (File.read_uint8(i) & 0x80) { return; }
    }

    return result();
}


================================================
FILE: db/Binary/format_iCalender.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://icalendar.org/
meta("format", "iCalendar (.ICS)");

function detect() {
    if (Binary.compare("42 45 47 49 4E 3A 56 43 41 4C 45 4E 44 41 52")) {
        var utf = Binary.getString(33, 5).trim();

        if (/^[A-Z0-9/-]{5}$/.test(utf)) {
            if (X.isVerbose()) sOptions = utf;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_img.VM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru> & Arjan Onwezen

meta("format", "VMWare Virtual Disk (VMDK)");

function detect() {
    if (Binary.compare("'KDMV'01") || Binary.compare("'KDMV'02") || Binary.compare("'KDMV'03")) {
        sVersion = File.read_uint8(4);
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_text.RegistryFile.sg
================================================
// Detect It Easy: detection rule file
// Author: Arjan Onwezen

meta("format", "Registry file");

function detect() {
    if (Binary.compare("'REGEDIT4'0D 0A 0D 0A")) {
        bDetected = true;
        sVersion = "4.0";
    } else if (Binary.compare("'Windows Registry Editor Version 5.00'0D 0A 0D 0A")) {
        bDetected = true;
        sVersion = "5.0";
    } else if (Binary.compare("FF FE 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6F 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 20 00 35 00 2E 00 30 00 30 00 0D 00 0A 00 0D 00 0A 00")) {
        bDetected = true;
        sVersion = "5.0";
        sOption("UTF-16LE");
    }

    return result();
}

================================================
FILE: db/Binary/format_text.pdb.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG @kaens)

meta("format", "Protein Data Bank file");

function detect() {
    if (Binary.compare("'HEADER'") && (Binary.isHeuristicScan() || extIs("pdb"))) {
        //ref http://www.wwpdb.org/documentation/file-format-content/format33/sect1.html
        L = ['', '', '', '', ''];
        ttl = '';
        L[0] = Binary.read_ansiString(0, Binary.findSignature(0, 81, "0A"));
        if (/[\x20-\x7F]{65,}/.test(L[0])) {
            bDetected = true;
            if (Binary.isVerbose()) {
                p = L[0].length + 1;
                for (i = 1; i < L.length; i++) {
                    L[i] = Binary.read_ansiString(p, Binary.findSignature(p, 81, "0A") - p);
                    p += L[i].length + 1;
                }
                for (i = 0; i < L.length; i++) {
                    switch (L[i].substr(0, 6)) {
                        case "HEADER":
                            sOptionT(L[i].substr(10, 40), "Classification: ");
                            sOptionT(L[i].substr(62, 10), "ID: "); //4 is the format, but 10 for future-proofing
                            sOptionT(L[i].substr(50, 9), "dep. ");
                            break;
                        case "TITLE ":
                            ttl += ' ' + L[i].substr(10, 70).trim();
                            break;
                    }
                }
                sOptionT(ttl, "Title: ")
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_text.plaintext.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Plain text");

function detect() {
    if (Binary.isPlainText()) {
        var sText = Binary.getString(0, Math.min(Binary.getSize(), 3));
        // UTF-8 BOM.
        if (/^\xef\xbb\xbf/.test(sText)) {
            sName = "UTF-8 text";
        }

        var size = Binary.getSize() < 4096 ? Binary.getSize() : 4096,
            pos = Binary.findByte(0, size, 10);

        if (pos !== -1) {
            sOptions = (pos != 0 && Binary.readByte(pos - 1) == 13) || (pos + 1 < Binary.getSize() && Binary.readByte(pos + 1) == 13) ? "CRLF" : "LF";
        } else if (Binary.findByte(0, size, 13) != -1) {
            sOptions = "CR";
        }

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/format_video.BIK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Bink_Video
meta("format", "Bink Video");

function detect() {
    if (Binary.compare("'BIK'........00....0000....0000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_video.BK2.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.radgametools.com/bnkmain.htm
// https://filext.com/file-extension/BK2
meta("format", "BinkMovie");

function detect() {
    if (Binary.compare("'KB2'00")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_video.FLV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Tembo (http://tembolab.pl/products/executable-image-viewer.html)

meta("format", "Flash Video");

function detect() {
    if (Binary.getSize() > 37) {
        if (Binary.compare("'FLV'") && Binary.compare("'onMetaData'", 27)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_video.MOV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/QuickTime_File_Format
// https://developer.apple.com/documentation/quicktime-file-format/movie_data_atom
meta("format", "QuickTime Movie");

function detect() {
    if (Binary.compare("........'moov'")) {
        var codec = Binary.getString(11, 5).trim();

        if (/^[a-z]{5}$/.test(codec)) {
            sOptions = codec;
            bDetected = true;
        }

    } else if (Binary.compare("........6d646174")) {
        sOptions = "Movie data atom";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_video.MP4.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L - <asl@onet.eu> 2019

meta("format", "MP4 Video");

function detect() {
    if (Binary.getSize() > 100) {
        if (Binary.compare("000000..'ftyp'")) {
            sOptions = Binary.getString(16); // example : isomiso2avc1mp41 / isomavc1 / isom
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/format_video.Matroska.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Matroska
meta("format", "Matroska Video (.MKV)");

function detect() {
    if (Binary.compare("1a45dfa3a34286810142f7810142f2810442f38108428288'matroska'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_video.RobotAnimation.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Robot_Animation
meta("format", "Robot Animation");

function detect() {
    if (Binary.compare("1600534f4c00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_video.Smacker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Smacker
meta("format", "Smacker Video");

function detect() {
    if (Binary.compare("'SMK2'....0000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/format_video.VMD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/VMD
meta("format", "Video and Media Data (.VMD)");

function detect() {
    if (Binary.compare("2e03000001")) {
        sVersion = "Adi2/Adibou1/Playtoons/Woodruff";
        sOptions = "Video+Sound";
        bDetected = true;
    } else if (Binary.compare("2e0300000700a4030000000040018800011002003003000069763332")) { // 69763332 = iv32
        sOptions = "Indeo 3 (compressed)";
        sVersion = "3.24.01.01";
        bDetected = true;
    } else if (Binary.compare("2e0302000700........00004001f000000001003003000049563332")) { // 49563332 = IV32
        sOptions = "Indeo 3 (compressed)";
        sVersion = "3.24.15.03";
        bDetected = true;
    } else if (Binary.compare("2e030105000200000000008007e001")) {
        bDetected = true;
    } else if (Binary.compare("2e03..000100....000000008002")) {
        sOptions = "Video+Sound";
        sVersion = "Adi4/Adibou2";
        bDetected = true;
    } else if (Binary.compare("2e030200000015")) {
        sOptions = "Adibou2 (Sciences)";
        bDetected = true;
    } else if (Binary.compare("2e0302000000..000000000000000000001101004403")) {
        sOptions = "Sound only";
        sVersion = "Adiboud'chou";
        bDetected = true;
    } else if (Binary.compare("2e0302000d00")) {
        sOptions = "Video+Sound";
        sVersion = "Adibou2 (Sciences)/Adi4";
        bDetected = true;
    } else if (Binary.compare("3200..000000")) {
        sOptions = "Sound only";
        sVersion = "Adi5/Adibou3";
        bDetected = true;
    } else if (Binary.compare("2e0302001d00..00..00..00")) {
        sOptions = "Video+Sound";
        bDetected = true;
    } else if (Binary.compare("2e0302..........00000000000000000010..003003")) {
        sOptions = "Sound only";
        bDetected = true;
    } else if (Binary.compare("32000200..00..0000000000..00..00......0034")) {
        sOptions = "Animation only";
        sVersion = "Adibou3";
        bDetected = true;
    } else if (Binary.compare("2e0301000100........................02003003")) {
        sOptions = "Animation+Sound";
        sVersion = "Adibou2";
        bDetected = true;
    } else if (Binary.compare("2e0301000100......................1001003003")) {
        sOptions = "Sound only";
        sVersion = "Adibou2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/formats.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>, LinXP

meta("format");

includeScript("zlib");

function detect() {
    var TrueTypeTags = [];
    TrueTypeTags['BASE'] =
        TrueTypeTags['cmap'] =
        TrueTypeTags['DSIG'] =
        TrueTypeTags['EBDT'] =
        TrueTypeTags['Feat'] =
        TrueTypeTags['FFTM'] =
        TrueTypeTags['GDEF'] =
        TrueTypeTags['GPOS'] =
        TrueTypeTags['GSUB'] =
        TrueTypeTags['LTSH'] =
        TrueTypeTags['OS/2'] = 1;

    if (Binary.compare("950412de00000000") || Binary.compare("de12049500000000")) {
        sName = "GNU Gettext Machine Object (.MO)";
    } else if (TrueTypeTags[Binary.getString(0xC, 4)]) {
        sName = "TrueType font (.TTF)";
    } else if (Binary.compare("f702018392c01c3b")) {
        sName = "Device Independent Document (.DVI)";
    } else if (Binary.compare("31be000000ab0000") || Binary.compare("32be000000ab0000")) {
        sName = "Windows Write document (.WRI)";
    } else if (Binary.compare("'MICROSOFT PIFEX'0087010000", 0x171)) {
        sName = "Microsoft Program Information (.PIF)";
    } else if (Binary.compare("4c0000000114020000000000c000000000000046")) {
        sName = "Windows Shortcut (.LNK)";
    } else if (Binary.compare("'Zinc Data File Version'")) {
        sName = "Zinc Data (.DAT)";
    } else if (Binary.compare("00010000'Jet System DB  '00")) {
        sName = "Microsoft Access Workgroup Information (.MDW)";
    } else if (Binary.compare("dca5..00..................00000000") || Binary.compare("eca5c100..................00000000")) {
        sName = "Microsoft Word 2 document";
    } else if (Binary.compare("'OTTO'................'CFF '")) {
        sName = "OpenType - CFF compact font (.OTF)";
    } else if (Binary.compare("3cb86418caef9c95")) {
        sName = "Qt Message (.QM)";
    } else if (Binary.compare("'SIB file: TsiLang binary translation data'")) {
        sName = "TsiLang binary translation data (.SIB)";
    } else if (Binary.compare("......00..........000200") && Binary.compare("00'LP'", 0x21)) {
        sName = "Embedded OpenType font (.EOT)";
    } else if (Binary.compare("d4c3b2a1020004")) {
        sName = "TCPDUMP's style capture (.ACP/PCAP)";
    } else if (Binary.compare("'HSP'")) {
        sName = "OS/2 help file";
    } else if (Binary.compare("'LN'0200")) {
        sName = "Quick Help";
    } else if (Binary.compare("'MZIP'")) {
        sName = "MZIP archive";
    } else if (Binary.compare("'Kaydara FBX Binary  '00")) {
        sName = "Kaydara FBX Binary (.FBX)";
        sVersion = Binary.read_uint16(0x17);
    } else if (Binary.compare("89'FCP'0D0A1A0A")) {
        sName = "High-Logic FontCreator Project (.FCP)";
        sVersion = Binary.read_uint16(0x08) + "." + Binary.read_uint16(0x0A);
        detect_zlib(Binary, 0x14 + Binary.read_uint32(0x10) * 0x11 + 0x0C);
    } else if (Binary.compare("'XALZ'")) {
        sName = "Xamarin Compressed DLL";
        sOptions = sOptions.append("LZ4 compression", "Index:" + Binary.read_uint32(0x4), "Original size:" + Binary.read_uint32(0x8))
    }

    bDetected = bDetected || Boolean(sName);

    return result();
}

================================================
FILE: db/Binary/graphics.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: hypn0 <hypn0@mail.ru>, Kaens (TG@kaens)

meta("image");

function detect() {
    if (Binary.compare("d7cdc69a0000")) {
        sName = "Windows MetaFile (.WMF)";
    } else if (Binary.compare("ff4fff51002f0000")) {
        sName = "JPEG-2000 Code Stream (.JP2)";
    } else if (Binary.compare("0000000C6A50....................'ftypjp2'..........'jp2'20")) {
        sName = "LuraWave JPEG-2000 (.JP2)";
    } else if (Binary.compare("'P4'0a")) {
        sName = "Unix Portable BitMap (.PBM)";
    } else if (Binary.compare("'P5'0a") || Binary.compare("'P6'0a")) {
        sName = "Portable BitMap Package (.PPM)";
    } else if (Binary.compare("01da010100")) {
        sName = "Silicon Graphics bitmap (.SGI)";
    } else if (Binary.compare("010009000003............................................'WMFC'")) {
        sName = "Windows Metafile (old Win 3.x format) (.WMF)";
    } else if (Binary.compare("01000000640000000000000000000000") && Binary.compare("'EMF'000001", 0x29)) {
        sName = "Windows Enhanced Metafile (.EMF)";
    } else if (Binary.compare("'WGq'")) {
        sName = "Liar-soft Windows Computer Graphics image (.WCG)";
    }

    bDetected = bDetected || Boolean(sName);

    return result();
}


================================================
FILE: db/Binary/image.PNG.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: LinXP, Kae (TG@kaens)
// doc-ref: http://www.libpng.org/pub/png/spec/1.2/PNG-Contents.html

meta("image");

function detect() {
    if (File.compare("89'PNG'0D0A1A0A........'IHDR'")) {
        bDetected = true;
        sName = "Portable Network Graphics (.PNG)";
        ct = File.read_uint8(0x19);
        switch (ct) {
            case 0: sOption("grey"); break;
            case 2: sOption("RGB"); break;
            case 3: sOption("indexed"); break;
            case 4: sOption("grey+alpha"); break;
            case 6: sOption("RGBA"); break;
            default: sOption("unk.colour type");
        }
        if (File.read_uint8(0x1C)) sOption("interlaced");
        if (File.compare("00000008'acTL'", 0x21)) { }
        if (File.isVerbose()) {
            var p = 8,
                col = 0,
                end = simplea = musthaveplte = false,
                w = h = "?",
                af = icc = title = auth = desc = timestamp = sw = warn = cmt = sd = "";
            mainloop: while (!end && p < File.getSize()) {
                hksz = File.read_uint32(p, _BE);
                hkhd = File.read_ansiString(p + 4, 4);
                if (p + 12 + hksz > File.getSize()) { sVersion += "!short"; break }
                // the CRC algo in DiE seems to be different for this:
                // crc = File.calculateCRC32(p,8+hksz); ccrc = File.read_uint32(p+8+hksz,_BE);
                // if(crc != ccrc) sVersion += "!badchunk "//+hkhd+"@"+Hex(p);
                p += 8;
                switch (hkhd) {
                    case "IEND":
                        end = true;
                        break;
                    case "IHDR":
                        w = File.read_uint32(p, _BE);
                        h = File.read_uint32(p + 4, _BE);
                        col = 1 << File.read_uint8(p + 8);
                        musthaveplte = File.read_uint8(p + 9) == 3;
                        break;
                    case "PLTE":
                        musthaveplte = false;
                        break;
                    case "tRNS":
                        simplea = true;
                        break;
                    case "iCCP":
                        icc = File.read_codePageString(p, 79, "CP850");
                        break;
                    case "iTXt":
                    case "tEXt":
                        var i = p;
                        if (hkhd === "iTXt") {
                            t1 = File.read_codePageString(i, 79, "CP850").toLowerCase();
                            i += t1.length + 1;
                            if (!File.read_uint8(i += 2)) break; //not messing with compressed tags
                            t = File.read_codePageString(i, 0x100, "CP850");
                            i += t.length + 1; //language tag
                            t = File.read_codePageString(i, 0x100, "CP850");
                            i += t.length + 1; //translated keyword
                            t2 = File.read_utf8String(i, hksz - i);
                        } else {
                            t1 = File.read_codePageString(p, 79, "CP850").toLowerCase();
                            i += t1.length + 1;
                            t2 = File.read_codePageString(i, hksz - i, "CP850")
                        }
                        _log("t1:" + t1.slice(0, 4));
                        switch (t1) {
                            case "title":
                                title = t2;
                                break;
                            case "author":
                                auth = t2;
                                break;
                            case "description":
                                desc = t2;
                                break;
                            case "creation time":
                                timestamp = t2;
                                break;
                            case "software":
                                sw = t2;
                                break;
                            case "warning":
                                warn = t2;
                                break;
                            case "comment":
                                cmt = t2;
                                break;
                            default:
                                if (t1.slice(0, 4) == "xml:") desc = desc.append("XML info found")
                        }
                        break;
                    case "sBIT":
                        switch (ct) {
                            case 0:
                                sd = File.read_uint8(p);
                                break;
                            case 2:
                            case 3:
                                sd = "R" + File.read_uint8(p) + "G" + File.read_uint8(p + 1) +
                                    "B" + File.read_uint8(p + 2);
                                break;
                            case 4:
                                sd = "g" + File.read_uint8(p) + "a" + File.read_uint8(p + 1);
                                break;
                            case 6:
                                sd = "R" + File.read_uint8(p) + "G" + File.read_uint8(p + 1) +
                                    "B" + File.read_uint8(p + 2) + "a" + File.read_uint8(p + 3);
                                break;
                        }
                    case "tIME":
                        timestamp = "UTC" + File.read_uint16(p, _BE) + "-" +
                            File.read_uint8(p + 2) + "-" + File.read_uint8(p + 3) + "T" +
                            File.read_uint8(p + 4) + ":" + File.read_uint8(p + 5) + ":" + File.read_uint8(p + 6);
                        break;
                    case "acTL":
                        sName = "Animated Portable Network Graphics (.PNG)";
                        af = Binary.read_uint32(p, _BE);
                        break;
                    default:
                        for (i = 0; i < 4; i++) {
                            var c = hkhd[i];
                            if (c < 'A' || (c > 'Z' && c < 'a') || c > 'z') { sVersion += "!badchunkheader"; break }
                        }
                }
                p += 4 + hksz;
            }
            if (musthaveplte) sVersion += "!badpalette";
            if (!end) sVersion += "!noIEND";
            sOption(w + "x" + h);
            sOption(col, "colours:");
            sOption(af, "frames:");
            sOption(sd, "src.depth:");
            if (simplea) sOption("simple alpha");
            sOptionT(icc);
            sOption(title);
            sOption(auth, "by:");
            sOption(timestamp, "on:");
            sOption(sw, "in:");
            sOption(warn, "/!\\:");
            sOption(addEllipsis(desc, 70, 0x200));
            sOption(cmt);
            sOption(p, "sz:")
        }
    }

    return result();
}


================================================
FILE: db/Binary/image_ANI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("image", "Windows Animated Cursor");

function detect() {
    if (Binary.getSize() >= 48) {
        if (Binary.compare("'RIFF'........'ACON'")) {
            var nOffset = Binary.findString(12, Binary.getSize() - 12, "framicon");
            if (nOffset != -1) {
                sOptions = Binary.readByte(nOffset + 18) + "x" + Binary.readByte(nOffset + 19);
                // Read the BPP from the first icon, as the header is unreliable.
                nOffset += 12 + Binary.readDword(nOffset + 30);
                sOptions = sOptions.append(Binary.readWord(nOffset + 14) + "bpp");
            }
            nOffset = Binary.findSignature(12, Binary.getSize() - 12, "'anih'24000000");
            if (nOffset != -1) {
                var nCount = Binary.readDword(nOffset + 12);
                sOptions = sOptions.append(nCount + (nCount == 1 ? " icon" : " icons"));
            }
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_BMP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("image", "Windows Bitmap");

function detect() {
    if (Binary.getSize() >= 40) {
        if (Binary.compare("'BM'")) {
            if (Binary.getSize() >= Binary.readDword(2)) {
                switch (Binary.readDword(14)) {
                    case 40: sVersion = "3"; break;
                    case 108: sVersion = "4"; break;
                    case 124: sVersion = "5"; break;
                }
                if (sVersion) {
                    switch (Binary.readDword(0x1e)) {
                        case /*BI_RLE8*/ 1:
                        case /*BI_RLE4*/ 2:
                            sOptions = "RLE";
                            break;
                        case /*BI_JPEG*/ 4:
                            sOptions = "JPEG";
                            break;
                        case /*BI_PNG*/ 5:
                            sOptions = "PNG";
                            break;
                    }
                    nHeight = ~~Binary.readDword(0x16);
                    if (nHeight < 0) {
                        nHeight = -nHeight;
                        sOptions = sOptions.append("top-down");
                    }
                    sOptions = sOptions.append(Binary.readDword(0x12) + "x" + nHeight,
                        Binary.readWord(0x1c) + "bpp");
                }
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_CUR.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: Jason Hood <jadoxa@yahoo.com.au>, Kae <TG@kaens>

meta("image", "Windows Cursor");

includeScript("CurIcoBPP");

function detect() {
    if (X.Sz() >= 40) {
        if (X.c("00000200")) {
            // Find the biggest, assuming square.
            var nCount = X.U16(4);
            var nWidth = 0,
                nHeight = 0,
                nBPP = 0,
                sz = 6 + nCount * 16;
            if (sz === 6 || sz > X.Sz()) return false;
            var nHotX, nHotY;
            for (var i = 0; i < nCount; i++) {
                if (Binary.read_uint8(9 + i * 16)) return false;
                sz_ = Binary.read_uint32(14 + i * 16, _LE);
                if (!sz_ || sz_ > X.Sz() - 22)
                    return false;
                sz += sz_;
                var w = X.U8(6 + i * 16);
                if (w > nWidth) {
                    nWidth = w;
                    nHeight = X.U8(7 + i * 16);
                    nBPP = getCurIcoBPP(6 + i * 16);
                    nHotX = X.I16(10 + i * 16);
                    nHotY = X.I16(12 + i * 16);
                } else if (w == nWidth) {
                    var b = getCurIcoBPP(6 + i * 16);
                    if (b > nBPP) {
                        nBPP = b;
                        nHotX = X.I16(10 + i * 16);
                        nHotY = X.I16(12 + i * 16);
                    }
                }
            }
            sOptions = nWidth + "x" + nHeight;
            if (nBPP != 0) {
                sOptions = sOptions.append(nBPP + "bpp");
            }
            sOptions = sOptions.append("(" + nHotX + "," + nHotY + ")");
            if (nCount > 1) {
                sOptions = sOptions.append(nCount + " cursors");
            }
            sOptions = sOptions.append("sz:" + sz);
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/image_DDS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("image", "DirectDraw Surface (.DDS)");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("'DDS '7C000000")) {
            bDetected = true;
            if (Binary.isVerbose()) {
                sOption(Binary.read_uint32(0x0C) + "x" + Binary.read_uint32(0x10));
                var sFourCC = Binary.getString(0x54, 0x04);
                if (sFourCC) {
                    sOption("compressed: " + sFourCC);
                } else {
                    sOption("uncompressed");
                }
                if (Binary.read_uint32(0x1C)) {
                    sOption("MipMap");
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_EPS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("image", "Encapsulated PostScript (.EPS)");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("'%!PS-Adobe-'", 0x00) && Binary.compare("' EPSF-'", 0x0E)) {
            sVersion = sVersion.append(Binary.getString(0x0B, 0x03), Binary.getString(0x14, 0x03));
            var sText = Binary.getString(0x00, 0x0400)
            bDetected = true;
            if (Binary.isVerbose()) {
                var aCreator = sText.match(/%%Creator: (.*?)[\r\n]/);
                if (aCreator) {
                    sOptions = sOptions.append("Creator:" + aCreator[1]);
                }
                var aPages = sText.match(/%%Pages: (.*?)[\r\n]/);
                if (aPages) {
                    sOptions = sOptions.append("Pages:" + aPages[1]);
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_FSH.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.wiki.sc4devotion.com/index.php?title=FSH_Format
// https://rewiki.miraheze.org/wiki/EA_SSH_FSH_Image_(Type_1)
meta("image", "FSH");

function detect() {
    if (Binary.compare("'SHPI'......00..000000")) {
        sOptions = "PC";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/image_GIF.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: Kae (TG@kaens)

meta("image", "Graphics Interchange Format file (.GIF)");

function detect() {
    //ref https://www.w3.org/Graphics/GIF/spec-gif89a.txt
    if (!File.compare("'GIF87'") && !File.compare("'GIF89'") || File.getSize() < 11) return;
    sVersion = Binary.getString(4, 2);
    if (/\d[a-z]/.test(sVersion) < 0) return;
    sVersion = "v198" + sVersion;
    bDetected = true;
    if (!File.isDeepScan() && !File.compare("3B", File.getSize() - 1)) sVersion += "/malformed";
    if (!File.isVerbose()) return result();

    var fl = File.read_uint8(0x0A),
        ar = File.read_uint8(0x0C),
        malformed = "";
    sOption(File.read_uint16(6) + "x" + File.read_uint16(8));
    var col = 1 << ((fl & 7) + 1);
    sOption(col, "col:");
    var bgc = File.read_uint8(0x0B);
    if (bgc) sOption(bgc, "bgc:");
    if (ar) sOption((ar + 15) / 64, "a/r:");
    if (File.isDeepScan()) {
        p = 0x0D;
        imgs = 0;
        cmt = "";
        if (fl & 0x80) {
            p += 3 * col;
        }
        blocksp = p; //skip global palette
        mainloop: for (; ;) {
            var ch = File.read_uint8(p++);
            if (ch === 0x3B) break;
            else if (ch === 0x21) {
                var c = File.read_uint8(p++);
                switch (c) {
                    case 0xF9:
                        p += File.read_uint8(p++);
                        break; //graphics control extension
                    case 0xFE: //comments
                        c = File.read_uint8(p++);
                        if (c) {
                            cmt += File.read_ansiString(p, c);
                            p += c
                        }
                    case 0xFF: //application data extension
                        c = File.read_uint8(p++);
                        if (c === 11) {
                            t = File.read_ansiString(p, c);
                            sOption(t, "appdata:");
                            p += c;
                            c = File.read_uint8(p++);
                            while (c && p < File.getSize()) {
                                p += c;
                                c = File.read_uint8(p++)
                            }
                        } else { malformed += "!badappext"; break mainloop }
                        break;
                    default:
                        c = File.read_uint8(p++);
                        while (c) {
                            p += c;
                            c = File.read_uint8(p++)
                        }
                }
            }
            if (p >= File.getSize()) { malformed += "!short"; break }
            if (ch != 0x2C) continue;
            imgs++;
            if (!File.read_uint16(p + 4) || !File.read_uint16(p + 6)) { malformed += "!badimg"; break }
            p += 8 /*skip coords,w,h*/;
            fl = File.read_uint8(p++);
            p++ /*skip the min.lzw code size*/
            if (fl & 0x80) {
                col = 1 << ((fl & 7) + 1);
                p += 3 * col;
                _log("  local palettes skipped @" + Hex(p))
            }
            c = File.read_uint8(p++);
            while (c && p < File.getSize()) {
                p += c;
                c = File.read_uint8(p++)
            }
            if (p >= File.getSize()) { malformed += "!short"; break }
        }
        if (ch != 0x3B) malformed += "!badEoS";
        if (!imgs) { bDetected = false; return } else if (imgs > 1) sOption(imgs, "frames:");
        if (malformed) sVersion += "/malformed" + malformed;
        else sOption(p, "sz:");
    }
}


================================================
FILE: db/Binary/image_ICNS.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Apple_Icon_Image_format
meta("image", "Apple Icon Image");

function detect() {
    if (Binary.compare("'icns'00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/image_ICO.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: Jason Hood <jadoxa@yahoo.com.au>, Kae <TG@kaens>

meta("image", "Windows Icon");

includeScript("CurIcoBPP");

function detect() {
    if (X.c("00000100")) {
        // Find the biggest, assuming square.
        var nCount = X.U16(4, _LE),
            sz = 6 + nCount * 16;
        if (!nCount || sz > X.Sz()) return false;
        var nWMax = 0,
            nHMax = 0,
            nBPPM = 0,
            nWMin = 0xFFFFFFFFF,
            nHMin = 0xFFFFFFFFF,
            nBPPm = 0xFFFFFFFFF,
            w,
            h,
            b;
        for (var i = 0; i < nCount; i++) {
            if (X.U8(9 + i * 16) || X.U16(10 + i * 16, _LE) > 8 || !isWithin(X.U16(12 + i * 16, _LE), 1, 32)) return false;
            w = X.U8(6 + i * 16);
            b = getCurIcoBPP(6 + i * 16);
            sz_ = X.U32(14 + i * 16, _LE);
            if (!sz_ || sz_ > X.Sz() - 22) return false;
            sz += sz_;
            if (w === 0) {
                var nOffset = X.U32(18 + i * 16, _LE);
                if (X.c("89'PNG\r\n'1A0A........'IHDR'", nOffset)) {
                    w = X.I32(nOffset + 16, _BE);
                    h = X.I32(nOffset + 20, _BE);
                } else if (X.c("28000000", nOffset)) {
                    w = Math.abs(X.I32(nOffset + 4, _LE));
                    h = Math.abs(X.I32(nOffset + 8, _LE)); // abs for top-down and otherwise weird BMPs
                } else return false // unknown format after all
            } else {
                // _log("bmp, ht @ " + Hex(i * 16 + 7));
                h = X.U8(7 + i * 16);
            }
            nWMin = Math.min(w, nWMin);
            nHMin = Math.min(h, nHMin);
            nBPPm = Math.min(b, nBPPm);
            nWMax = Math.max(w, nWMax);
            nHMax = Math.max(h, nHMax);
            nBPPM = Math.max(b, nBPPM);
        }
        if (!nWMax || !nHMax) return false;
        sOption((nWMin != nWMax || nHMin != nHMax ? nWMin + 'x' + nHMin + ' ~ ' : '') + nWMax + "x" + nHMax);
        sOption((nBPPm != nBPPM ? nBPPm + '~' : '') + nBPPM + "bpp");
        if (nCount > 1) sOption(nCount + " icons");
        sOption("sz: " + sz)
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/image_IMG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV7_Information#Images
meta("image", "Image (DEV7)");

function detect() {
    if (Binary.compare("'IMG10'")) {
        var img10 = Binary.getString(3, 2).trim();

        if (/^[0-9]{2}$/.test(img10)) {
            if (X.isVerbose()) sVersion = img10;
            bDetected = true;
        }
    } else if (Binary.compare("'IMG1.0.1'")) {
        var img101 = Binary.getString(3, 5).trim();

        if (/^\d+\.\d+\.\d+$/.test(img101)) {
            if (X.isVerbose()) sVersion = img101;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_JNG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: http://www.libpng.org/pub/mng/spec/jng.html

meta("image", "JPEG Network Graphics (.JNG)");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("8B'JNG\r\n'1A0A........'JHDR'")) {
            bDetected = true;

            if (Binary.isVerbose()) {
                sOption(Binary.read_uint32(0x10, _BE) + "x" + Binary.read_uint32(0x14, _BE));
                switch (File.read_uint8(0x18)) {
                    case 8: sOption("Gray"); break;
                    case 10: sOption("Color"); break;
                    case 12: sOption("Gray Alpha"); break;
                    case 14: sOption("Color Alpha"); break;
                    default: return;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_JPEG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("image", "JPEG");

function detect() {
    if (X.Sz() >= 22) {
        if (X.c("FFD8FFE0....'JFIF'00")) {
            bDetected = true;
            sVersion = X.U8(11) + ".";
            if (X.U8(12) < 10) {
                sVersion = sVersion + "0";
            }

            sVersion = sVersion + X.U8(12);
            // Search for a Start Of Frame to get dimensions.
            var nOffset = 2;
            while (nOffset < X.Sz()) {
                var wTag = X.U16(nOffset, _BE);
                if (wTag >= 0xFFC0 && wTag <= 0xFFC3) {
                    sOptions = X.U16(nOffset + 7, _BE) + "x" +
                        X.U16(nOffset + 5, _BE);
                    switch (X.U8(nOffset + 9)) {
                        case 1:
                            sOptions = sOptions.append("grey");
                            break;
                        case 3:
                            sOptions = sOptions.append("YCbCr");
                            break;
                        case 4:
                            sOptions = sOptions.append("CMYK");
                            break;
                    }
                    break;
                }
                nOffset += 2 + X.U16(nOffset + 2, _BE);
            }
        } else if (X.c("FFD8FFE1....'Exif'00")) {
            bDetected = true;
            sVersion = X.U8(11) + ".";
            if (X.U8(12) < 10) sVersion = sVersion + "0";
            sVersion = sVersion + X.U8(12);
            sOptions = "EXIF";
        } else if (X.c("FFD8FFDB")) {
            bDetected = true;
            sOptions = "OLD";
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_JPEGXL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("image", "JPEG XL");

function detect() {
    if (Binary.getSize() >= 20) {
        if (Binary.compare("FF0A")) {
            sOptions = "codestream";
            bDetected = true;
        } else if (Binary.compare("0000000C4A584C200D0A870A")) {
            sOptions = "ISOBMFF-based container";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Binary/image_KTX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("image", "");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("AB'KTX 11'BB0D0A1A0A")) {
            bDetected = true;
            sName = "Khronos Texture (.KTX)";
            if (Binary.isVerbose()) {
                sOption(Binary.read_uint32(0x24) + "x" + Binary.read_uint32(0x28));
                //TODO derive size ref https://registry.khronos.org/KTX/specs/1.0/ktxspec.v1.html
            }
        } else if (Binary.compare("AB'KTX 20'BB0D0A1A0A")) {
            bDetected = true;
            sName = "Khronos Texture (.KTX2)";
            if (Binary.isVerbose()) {
                sOption(Binary.read_uint32(0x14) + "x" + Binary.read_uint32(0x18));
                //ref https://registry.khronos.org/KTX/specs/2.0/ktxspec.v2.html
                p = 0x50; sz = 0; //max ofs among the levels' ends
                for(i = 0; i < Math.max(1,Binary.read_uint32(0x28)); i++, p += 0x18)
                    if((t = Binary.read_uint64(p)) > sz) { sz = t + Binary.read_uint64(p+8) }
                sOption('sz:'+outSz(sz))
            }
        }

        // https://github.com/BinomialLLC/basis_universal/wiki/.basis-File-Format-and-ETC1S-Texture-Video-Specification
        else if (Binary.compare("734213004D00")) {
            bDetected = true;
            sName = "Basis Universal GPU Texture (.BASIS)";
            if (Binary.isVerbose()) {
                //sOption(Binary.read_uint32(0x14)+"x"+Binary.read_uint32(0x18));
            }
        }



    }

    return result();
}

================================================
FILE: db/Binary/image_LBM.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: Kaens TG@kaens

meta("image", "IFF InterLeaved BitMap (.IFF,.LBM)");

function detect() {
    if (File.compare("'FORM'") && (File.compare("'ILBM'", 8) || File.compare("'PBM '", 8))) {
        sz = File.read_uint32(4, _BE) + 8;
        if (File.getSize() < sz) sVersion = "malformed!short";
        p = 0x0C;
        end = Math.min(File.getSize(), sz);
        w = viewportMode = hsx = -1;
        while (p < end) {
            hkhd = File.read_ansiString(p, 4);
            hksz = File.read_uint32(p + 4, _BE);
            p += 8;
            switch (hkhd) {
                case "BMHD":
                    w = File.read_uint16(p, _BE);
                    h = File.read_uint16(p + 2, _BE);
                    x0 = File.read_int16(p + 4, _BE);
                    y0 = File.read_int16(p + 6, _BE);
                    numPlanes = File.read_uint8(p + 8);
                    mask = File.read_uint8(p + 9);
                    co = File.read_uint8(p + 0xA);
                    tcol = File.read_uint16(p + 0xC);
                    xa = File.read_uint8(p + 0xE);
                    ya = File.read_uint8(p + 0xF);
                    pw = File.read_int16(p + 0x10, _BE);
                    ph = File.read_int16(p + 0x12, _BE);
                    break;
                case "CAMG":
                    viewportMode = File.read_uint32(p, _BE);
                    break;
                case "GRAB":
                    hsx = File.read_int16(p, _BE);
                    hsy = File.read_int16(p + 2, _BE);
                    break;
            }
            p += hksz;
            if (hksz % 2) p++;
        }
        if (w < 0) return;
        if (File.isVerbose()) {
            sOption(w + "x" + h + " (" + x0 + "," + y0 + ") [" + pw + "x" + ph + "] AR" + xa + ":" + ya);
            sOption("planes:" + numPlanes);
            switch (co) {
                case 0:
                    sOption("uncompressed");
                    break;
                case 1:
                    sOption("RLE");
                    break;
                case 2:
                    sOption("vertical RLE");
                    break;
                default:
                    sOption("unk.compression")
            }
            if (mask >= 2) sOption("t.col:" + Hex(tcol));
            if (viewportMode >= 0) sOption(Hex(viewportMode), "view_port_mode:");
            if (hsx >= 0) sOption("hotspot: (" + hsx + "," + hsy + ")")
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/image_MNG.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: http://www.libpng.org/pub/mng/spec/

meta("image", "Multiple-image Network Graphics (.MNG)");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("8A'MNG\r\n'1A0A........'MHDR'")) {
            bDetected = true;
            if (Binary.isVerbose()) {
                sOption(Binary.read_uint32(0x10, _BE) + "x" + Binary.read_uint32(0x14, _BE));
                sOption("frames:" + Binary.read_uint32(0x18, _BE));
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_PCX.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: LinXP, Kae (TG@kaens)

meta("image", "ZSoft PiCture eXchange file (.PCX)");

function detect() {
    //ref https://www.fileformat.info/format/pcx/spec/a10e75307b3a4cc49c3bbe6db4c41fa2/view.htm
    if (X.Sz() >= 0x50) {
        if (X.U8(0) === 10) {
            switch (nv = X.U8(0x01)) {
                case 0:
                    sVersion = "v2.5 using a fixed EGA palette";
                    break;
                case 2:
                    sVersion = "v2.8 using a modifiable EGA palette";
                    break;
                case 3:
                    sVersion = "v2.8 using no palette";
                    break;
                case 4:
                    sVersion = "Windows";
                    break;
                case 5:
                    sVersion = "v3.0+ or 24-bit";
                    break;
                default:
                    return;
            }
            var sus = '', inv = 0; // strictly-speaking-invalid or highly unlikely parameter counter
            var rle = X.U8(0x02);
            if (rle > 1) return;
            if (!rle) { inv++; sus += '!uncompressed' }
            var w = X.U16(0x08) - X.U16(0x04) + 1,
                h = X.U16(0x0A) - X.U16(0x06) + 1;
            if (w <= 0 || h <= 0) return;
            var xdpi = X.U16(0xC),
                ydpi = X.U16(0xE);
            if(xdpi && !isWithin(xdpi,32,600)) { inv++; sus += '!susXdpi' };
            if(ydpi && !isWithin(ydpi,32,600)) { inv++; sus += '!susYdpi' };
            var bpplane = X.U8(0x03),
                nplanes = X.U8(0x41),
                bpx = bpplane * nplanes,
                pal = ext = false;
            if ([1, 2, 4, 8, 24].indexOf(bpplane) < 0) return;
            if (!nplanes || nplanes > 4) return;
            if (X.U8(0x40)) { inv += 2; sus += '!resnon0' }
            if (!isAllZeroes(0x4A, 0x36)) ext = true;
            if (pal && ([0, 3].indexOf(nv) < 0 || bpx > 4)) { inv++; sus += '!badpalette' }
            var bpline = X.U16(0x42); if (bpline % 2) return;
            if (bpline < w*bpx >> 3) { inv++; sus += '!bpline'+bpline+'<w'+(w*bpx/8) }
            if (inv > 3) return;
            if (inv && sus != "!uncompressed") sVersion = sVersion.appendS('sus'+sus,'/')
            if (X.isVerbose()) {
                sOption(w + "x" + h);
                if (rle) sOption("RLE");
                if (ext) sOption("extra_block");
                sOption(bpx, "bit/pixel:");
                sOption(bpplane, "bit/plane:");
                if(bpline < w*bpx >> 3) sOption(bpline, "scanline:");
                sOption(xdpi + "x" + ydpi, "res:", " dpi");
                if (X.U16(0x46) * X.U16(0x48)) sOption(X.U16(0x46) + "x" + X.U16(0x48), "screen:");
                if (!rle) sOption(0x80 + (w * h * bpx >> 3), "sz:")
            }
            bDetected = true
        }
    }

    return result()
}


================================================
FILE: db/Binary/image_PSD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/

meta("image", "Adobe Photoshop");

function detect() {
    if (Binary.getSize() >= 0x20) {
        if (Binary.compare("'8BPS'")) {
            bDetected = true;
            switch (File.read_uint16(0x04, _BE)) { // Version check
                case 1:
                    sName += " (.PSD)";
                    sVersion = "v1.0";
                    break;
                case 2:
                    sName += " BIG (.PSB)";
                    sVersion = "v2.0";
                    break;
                default:
                    bDetected = false;
            }

            const
                channelCount = Binary.read_uint16(0x0C, _BE),
                imageHeight = Binary.read_uint32(0x0E, _BE),
                imageWidth = Binary.read_uint32(0x12, _BE),
                bitsPerChannel = Binary.read_uint16(0x16, _BE),
                colorMode = Binary.read_uint16(0x18, _BE);

            sOption(imageWidth + "x" + imageHeight);
            switch (colorMode) {
                case 0: sOption("Bitmap"); break;
                case 1: sOption("Gray-scale"); break;
                case 2: sOption("Indexed"); break;
                case 3: sOption("RGB"); break;
                case 4: sOption("CMYK"); break;
                case 7: sOption("Multichannel"); break;
                case 8: sOption("Duotone"); break;
                case 9: sOption("Lab"); break;
                default:
                    bDetected = false;
            }
            sOption((channelCount * bitsPerChannel) + "-bit");
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_PVR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: http://powervr-graphics.github.io/WebGL_SDK/WebGL_SDK/Documentation/Specifications/PVR%20File%20Format.Specification.pdf
meta("image", "");

function detect() {
    var PixelFormat = ['PVRTC 2bpp RGB', 'PVRTC 2bpp RGBA', 'PVRTC 4bpp RGB', 'PVRTC 4bpp RGBA', 'PVRTC-II 2bpp', 'PVRTC-II 4bpp',
        'ETC1', 'BC1\\DXT1', 'DXT2', 'BC2\\DXT3', 'DXT4', 'BC3\\DXT5', 'BC4', 'BC5', 'BC6', 'BC7', 'UYVY', 'YUY2', 'BW1bpp', 'R9G9B9E5 Shared Exponent', 'RGBG8888', 'GRGB8888',
        'ETC2 RGB', 'ETC2 RGBA', 'ETC2 RGB A1', 'EAC R11', 'EAC RG11',
        'ASTC_4x4', 'ASTC_5x4', 'ASTC_5x5', 'ASTC_6x5', 'ASTC_6x6', 'ASTC_8x5', 'ASTC_8x6', 'ASTC_8x8', 'ASTC_10x5', 'ASTC_10x6', 'ASTC_10x8', 'ASTC_10x10',
        'ASTC_12x10', 'ASTC_12x12', 'ASTC_3x3x3', 'ASTC_4x3x3', 'ASTC_4x4x3', 'ASTC_4x4x4', 'ASTC_5x4x4', 'ASTC_5x5x4', 'ASTC_5x5x5', 'ASTC_6x5x5', 'ASTC_6x6x5', 'ASTC_6x6x6'
    ];

    if (Binary.getSize() >= 0x34) {
        if (Binary.compare("'PVR'03")) {
            bDetected = true;
            sName = "PowerVR PVR texture (.PVR)";
            if (Binary.isVerbose()) {
                sOption(Binary.read_uint32(0x18) + "x" + Binary.read_uint32(0x1c));
                sOption(PixelFormat[Binary.read_uint64(0x08)]);
                if (Binary.read_uint32(0x10)) { sOption("Linear RGB"); } else { sOption("Standard RGB"); }
            }
        }


    }

    return result();
}

================================================
FILE: db/Binary/image_QOI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: https://qoiformat.org/qoi-specification.pdf

meta("image", "Quite OK Image (.QOI)");

function detect() {
    if (Binary.getSize() >= 0x0E) {
        if (Binary.compare("'qoif'")) {
            bDetected = true;

            sOptions = sOptions.append(Binary.read_uint32(0x04, _BE) + "x" + Binary.read_uint32(0x08, _BE));
            switch (File.read_uint8(0x0C)) {
                case 3: sOption("RGB"); break;
                case 4: sOption("RGBA"); break;
                default: return;
            }
            switch (File.read_uint8(0x0D)) {
                case 0: sOption("sRGB with linear alpha"); break;
                case 1: sOption("all channels linear"); break;
                default: return;
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_SMDH.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.3dbrew.org/wiki/SMDH
meta("image", "SMDH");

function detect() {
    if (Binary.compare("'SMDH'00000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/image_TGA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG@kaens)

meta("image", "Truevision Advanced Raster Graphics Adapter bitmap (.TGA,.ICB,.VDA,.VST)");

function detect() {
    //ref https://github.com/ImageMagick/ImageMagick/blob/main/coders/tga.c
    // & https://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
    if (X.Sz() < 0x12) return false;
    var msg = bad = "", idlen = X.U8(0), cmt = X.U8(1), col = 0, depth = 0,
        it = X.U8(2), bpp = X.U8(0x10), strcls = "", co = "none";
    if ((bpp < 1 || bpp >= 17) && bpp != 24 && bpp != 32) return false;
    switch (it) {
        case 1: if (!cmt) return; strcls = "pseudo";
            if (X.isVerbose()) sOption("colormap"); break;
        case 2: if (X.isVerbose()) sOption("RGB"); col = "24bit"; break;
        case 3: if (X.isVerbose()) sOption("monochrome"); break;
        case 9: if (!cmt) return; co = "rle"; strcls = "pseudo";
            if (X.isVerbose()) sOption("RLE colormap"); break;
        case 10: co = "rle"; if (X.isVerbose()) sOption("RLE RGB"); col = "24bit"; break;
        case 11: co = "rle"; if (X.isVerbose()) sOption("RLE monochrome"); break;
        case 32: if (!cmt) return; co = "hdr"; strcls = "pseudo";
            if (X.isVerbose()) sOption("H/d/RLE colormap"); break;
        case 33: if (!cmt) return; co = "hdrq"; strcls = "pseudo";
            if (X.isVerbose()) sOption("H/d/RLE 4-pass colormap"); break;
        default: return;
    }
    var sus = 0, cmin = X.U16(3), cmlen = X.U16(5), cmsz = X.U8(7),
        x0 = X.U16(8), y0 = X.U16(0xA),
        w = X.U16(0xC), h = X.U16(0xE), attr = X.U8(0x11);
    if (!w || !h || w > 4096 || h > 2048 || x0 > 1600 || y0 > 1200 || cmsz > 32 || (attr & 0xC0)) return false;
    // suspiciousness is probably the only way to filter out all the FPs, so let's measure that
    if (x0) sus++; if (y0) sus++; if (w < 4) sus++; if (h < 4) sus++; if (w > 1600) sus++; if (h > 1200) sus++;
    if (attr & 0x10) sus++; // that's right-to-left
    if (!cmsz && cmlen) return false;
    if (cmt == 1 && (it == 2 || it == 10)) sus++; //shouldn't have colour maps with True-color
    if (cmsz < 15 || isWithin(cmsz, 17, 23) || isWithin(cmsz, 25, 31)) sus++; if (cmlen > 256) sus++; if (cmin) sus++;
    if (it == 2 || it == 10) { if (cmin) sus++; if (cmlen) sus++; if (cmsz) sus++ }
    if (it != 1 && it != 9 && it != 32 && it != 33) depth = bpp <= 8 ? 8 : (bpp <= 16 ? 5 : 8);
    else depth = cmsz <= 8 ? 8 : (cmsz <= 16 ? 5 : 8);
    var col = 1 << depth;
    if (strcls == "pseudo")
        if (cmt) col = cmin + cmlen;
        else { col = 1 << bpp; if (col > X.Sz()) return }
    p = 0x12;
    if (idlen) msg = X.SC(p, idlen, 'CP437'); p += idlen;
    //_log("colormap? @"+Hex(p)+"  type:"+cmt+" index:"+cmin+" len:"+cmlen+" size:"+cmsz);
    if (cmt) {
        if (col < cmin) col = cmin;
        switch (cmsz) {
            case 8: default: p += col; break;
            case 15: case 16: p += col * 2; break;
            case 24: p += col * 3; break;
            case 32: p += col * 4; break;
        }
    }
    if (cmlen > col) sus++;
    if (sus > 3) {
        //_log('TGAFault: '+sus+'-fold suspicious!');
        return;
    }

    //unpack!
    var pix = base = flag = skip = index = runlen = ofs = 0, ofsss = 1;
    if (((attr & 0xC0) >> 6) == 2) ofsss = 2;
    if (co != "hdr" && co != "hdrq")
        for (var y = 0; y < h && p < X.Sz(); y++) {
            for (var x = 0; x < w && p < X.Sz(); x++) {
                if (co == "rle")
                    if (runlen) { runlen--; skip = flag != 0 }
                    else {
                        runlen = X.U8(p++);
                        skip = 0; flag = runlen & 0x80; if (flag) runlen -= 0x80;
                    }
                if (!skip) switch (bpp) {
                    case 1: if (!(x & 7)) p++; break;
                    case 8: default: p++; break;
                    case 15: case 16: p += 2; break;
                    case 24: p += 3; break;
                    case 32: p += 4; break;
                }
            }
        }
    else p = 0; //giving up on reading huffman/delta etc. (not even Imagemagick can do that)
    ofs += ofsss; if (ofs > w) { base++; ofs = base }
    if (p > X.Sz())
        if (X.isHeuristicScan())
            bad = bad.addIfNone("!short");
        else return; //because the format is shaky and FPs are more than possible

    ea = 0;
    if (X.isHeuristicScan()) {
        function isNewTGA(ext) {
            if (ext <= p) return false;
            //let's see if it's not us accidentally catching the next resource.
            ea = X.U32(ext - 8); esz = X.U16(ea); var dd = X.U32(ext - 4);
            //_l2r('tga',p,'ext='+Hex(ext)+' dd='+Hex(dd)+' ea='+Hex(ea)+' ['+Hex(esz)+']'+' ext/esz check:'+(ea && ea+esz > ext));
            if (p > ext - 8 || (ea && p > ea) || (dd && p > dd) || ((dd || ea) && ea == dd) ||
                (ea && ea + esz > ext) ||
                (dd && ea && ea < dd && ea + esz > dd))
                return false; //false alarm
            if (ea) {
                if (esz == 495) sV = "v2.0"; else sV = "v2.X";
                auth = X.SC(ea + 2, 41, 'CP437');
                xmsg = X.SC(ea + 43, 324, 'CP437');
                timestamp = X.U16(ea + 371) + "-" + X.U16(ea + 369) + "-" +
                    X.U16(ea + 367) + " " +
                    X.U16(ea + 373) + ":" + X.U16(ea + 375) + ":" + X.U16(ea + 377);
                sw = X.SC(ea + 426, 41, 'CP437').trim() + " v" +
                    Math.floor(X.U16(ea + 467) / 100).toString() + '.' +
                    (X.U16(ea + 467) % 100).toString() + X.SC(ea + 469, 1, 'CP437'),
                    gamma = (X.U16(ea + 478) / X.U16(ea + 480)).toFixed(1);
            }
            else sV = "v2.X";
            if (dd) {
                var ddtn = X.U16(dd); var dsz = ddtn * 10 + 2;
                if (dd + dsz > ext || (ea && dd + dsz > ea)) return false;
                for (i = 0; i < ddtn; i++) {
                    var dtp = X.U32(dd + 4 + i * 10), dtsz = X.U32(dd + 8 + i * 10);
                    if (dtp + dtsz > ext || dtp + dtsz < p) return false;
                }
            }
            return true
        }
        sigsz = 15; found = false;
        //first, check for the strange signature sometime soon after the end of data
        ext = X.fSig(p, 0x1000, "'TRUEVISION-XX.'00"); if (isNewTGA(ext)) found = true;
        //then, check for the _proper_ signature sometime soon after the end of data
        if (!found) { sigsz = 18; ext = X.fSig(p, 0x1000, "'TRUEVISION-XFILE.'00"); if (isNewTGA(ext)) found = true }
        //if broken (hello H2_Hero_01a.tga with two broken v2-sigs), just give up and try our luck with the eof-sig:
        if (!found) { ext = X.fSig(X.Sz() - 20, 21, "'TRUEVISION-XFILE.'00"); if (isNewTGA(ext)) found = true }
        if (found) { sVersion = sV; p = ext + sigsz } else sVersion = "v1.X";
    }
    else sVersion = "v1.X";
    if (X.isVerbose()) {
        sOption(w + "x" + h + " (" + x0 + "," + y0 + ")");
        sOption(bpp, "bpp:");
        if (bpp < 24) sOption(col, "colours:");
        if (ea) {
            sOption(gamma, "gamma:");
            sOptionT(auth, "by:"); sOption(timestamp, "on:"); sOption(sw, "in:"); sOption(xmsg, 'msg:"', '"')
        }
        if (co != "rle" || X.isDeepScan()) sOption(outSz(p), "sz:")
    }
    if (bad) sVersion += "/malformed" + bad;
    bDetected = true;

    return result();
}


================================================
FILE: db/Binary/image_TIFF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// Status: WIP
// doc-ref:

meta("image", "Tagged Image File Format (.TIFF)");

function detect() {
    if (Binary.getSize() >= 0x0E) {
        bDetected = true;
        switch (Binary.read_uint32(0x00, _BE)) {
            case 0x4D4D002A: var bEndian = _BE; sOption("BE"); break;
            case 0x49492A00: var bEndian = _LE; sOption("LE"); break;
            default: return;
        }

        var nOffset = Binary.read_uint32(0x04, bEndian),
            nTagCount = Binary.read_uint16(nOffset, bEndian);

        nOffset += 2;

        var nWidth, nHeight, nBPS, nCol, nComp;

        while (nTagCount--) {
            var nTag = Binary.read_uint16(nOffset, bEndian),
                nType = Binary.read_uint16(nOffset + 2, bEndian),
                nCount = Binary.read_uint32(nOffset + 4, bEndian);

            switch (nTag) {
                case 0x100: nWidth = ReadTagValue(nType); break; // ImageWidth (256)
                case 0x101: nHeight = ReadTagValue(nType); break; // ImageLength (257)
                case 0x102: nBPS = nCount * ReadTagValue(nType); break; // BitsPerSample (258)
                case 0x103: nComp = ReadTagValue(nType); break; // Compression (259)
                case 0x106: nCol = ReadTagValue(nType); break; // PhotometricInterpretation (262)
                case 271: sOption("Make:" + ReadTagValue(nType)); break; // Make (271)
                case 50706: sName = "Digital Negative (.DNG)"; break; // DNGVersion (50706)
                default: break;
            }
            nOffset += 0x0C;
        }

        switch (nComp) {
            case 1: sOption("Uncompressed"); break;
            case 2: sOption("Huffman"); break;
            case 3: sOption("Group 3"); break;
            case 4: sOption("Group 4"); break;
            case 5: sOption("LZW"); break;
            case 6: sOption("embedded JPEG (602Photo software)"); break;
            case 7: sOption("JPEG"); break;
            case 32771: sOption("Alchemy software type 6 unknown compression"); break;
            case 32773: sOption("PackBits"); break;
            case 32946: sOption("Deflate"); break;
            case 34690: sOption("LDF bitonal"); break;
            case 65000: sOption("Kodak DCR"); sName = "Kodak DCS Pro SLR (.DCR)"; break;
        }
        if (nWidth != 0 && nHeight != 0) {
            sOption(nWidth + "x" + nHeight);
        }
        sOption(nBPS + "-bit ");
        switch (nCol) {
            case 0: sOption("W/B"); break;
            case 1: sOption("B/W"); break;
            case 2: sOption("RGB"); break;
            case 3: sOption("index"); break;
        }
    }

    function ReadTagValue(nType) {
        var nTempValue = 0,
            nTempOffset = 0;
        switch (nType) {
            case 1: break; // eBYTE
            case 2:
                nTempOffset = Binary.read_uint32(nOffset + 8, bEndian);
                nTempValue = Binary.getString(nTempOffset, nCount);
                return nTempValue; // eASCII
            case 3: // eSHORT
                if (nCount == 1) {
                    nTempValue = Binary.read_uint16(nOffset + 8, bEndian);
                    return nTempValue;
                } else {
                    nTempOffset = Binary.read_uint32(nOffset + 8, bEndian);
                    while (nCount--) {
                        nTempValue = Binary.read_uint16(nTempOffset, bEndian); nTempOffset += 2;
                    }
                    return nTempValue;
                }
            case 4: // eLONG
                if (nCount == 1) {
                    nTempValue = Binary.read_uint32(nOffset + 8, bEndian);
                    return nTempValue;
                } else {
                    nTempOffset = Binary.read_uint32(nOffset + 8, bEndian);
                    while (nCount--) {
                        nTempValue = Binary.read_uint32(nTempOffset, bEndian); nTempOffset += 4;
                    }
                    return nTempValue;
                }
            case 5: break; // eRATIONAL
            case 6: break; // eSBYTE
            case 7: break; // eUNDEF
            case 8: break; // eSSHORT
            case 9: break; // eSLONG
            case 10: break; // eSRATIONAL
            case 11: break; // eFLOAT
            case 12: break; // eDOUBLE
        }
    }

    return result();
}


================================================
FILE: db/Binary/image_XAR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP
// doc-ref: http://site.xara.com/support/docs/webformat/spec/XARFormatDocument.pdf
meta("image", "Xar Vector graphic file (.XAR)");

function detect() {
    if (Binary.getSize() >= 0x40) {
        if (Binary.compare("'XARA'A3A30D0A")) {
            bDetected = true;
            var sProducer = Binary.getString(0x1F),
                sProducerVersion = Binary.getString(0x1F + sProducer.length + 1),
                sProducerBuild = Binary.getString(0x1F + sProducer.length + 1 + sProducerVersion.length + 1);

            sName = sProducer + " Document (.XAR)";
            sVersion = sProducerVersion;

            if (Binary.isVerbose()) {
                sOption("build: " + sProducerBuild);

                switch (Binary.getString(0x10, 3)) {
                    case 'CXW': sOption("Web file"); break;
                    case 'CXN': sOption("Paper-publishable file"); break;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_XCF.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.gimp.org/
meta("image", "eXperimental Computing Facility (GIMP Image)");

function detect() {
    if (Binary.compare("67 69 6D 70 20 78 63 66")) {
        var versionNumber = Binary.getString(9, 4).trim();

        if (/^[a-z-0-9]{4}/.test(versionNumber)) {
            if (X.isVerbose()) sVersion = versionNumber;
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/image_bin.ZBMP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Kaens (TG @kaens)

meta("image", "Zlib-packed BMP file (.ZBM)");

function detect() {

    // found in ex. Snails for Palm OS, .zbm are simply zlib archives at offset 0x10 of uncompressed bitmap images
    if (X.c("'ZBMP'") && X.c("78DA", 0x10) && (w = X.U32(4)) && w < 0x10000 && (h = X.U32(8)) && h < 0x10000) {
        bDetected = true;
        sOptions = w + 'x' + h; //if(n=X.U32(0xC) sOption(n,'x'))
    }

    return result();
}


================================================
FILE: db/Binary/image_heuristic.image.HDR.1.sg
================================================
// Detect It Easy: detection rule file
// Authors: Kaens TG@kaens

meta("~image", "Greg Ward's RGBE / Radiance HDR (.hdr, .pic, .rgbe, .xyze)");

function detect() {
    if (X.isHeuristicScan()) {
        bDetected = (
            X.fSig(0, 0x80, "'#?RADIANCE'0A") >= 0 ||
            X.fSig(0, 0x80, "'#?RGBE'0A") >= 0
        ) && X.fSig(0x0A, 0x400, "0A'FORMAT='") >= 0;
    }

    return result();
}


================================================
FILE: db/Binary/protector_javascript-obfuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/javascript-obfuscator/javascript-obfuscator
meta("protector", "javascript-obfuscator");

function detect() {
    // Is JS file?
    if (isSignatureInBeginAndEndPresent("'function'") &&
        (
            isSignatureInBeginAndEndPresent("'var '") ||
            isSignatureInBeginAndEndPresent("'const '") ||
            isSignatureInBeginAndEndPresent("')();'")
        )) {

        if (isSignatureInBeginAndEndPresent("'_0x'")) {
            if (isSignatureInBeginAndEndPresent("'_0x' .. .. .. .. '('") ||
                isSignatureInBeginAndEndPresent("'_0x' .. .. .. .. .. '('") ||
                isSignatureInBeginAndEndPresent("'_0x' .. .. .. .. .. .. '('")) {
                bDetected = true;
            }
        }

        if (isSignatureInBeginAndEndPresent("'parseInt(' .. '('")) {
            sOptions = "mangled";
            bDetected = true;
        }

        if (isSignatureInBeginAndEndPresent("'=[\"'") && isSignatureInBeginAndEndPresent("'\",\"'") ||
            isSignatureInBeginAndEndPresent("'=[' 27") && isSignatureInBeginAndEndPresent("27 ',' 27")) {
            sOptions += (sOptions.length !== 0 ? " + " : String()) + "strings array";
        }
    }

    return result();
}

function isSignatureInBeginAndEndPresent(signature) {
    var chunkToAnalyze = 1024 * 10;

    if (chunkToAnalyze > Binary.getSize())
        chunkToAnalyze = Binary.getSize();

    if (Binary.isSignaturePresent(0, chunkToAnalyze, signature) || chunkToAnalyze != Binary.getSize()) {
        return Binary.isSignaturePresent(Binary.getSize() - chunkToAnalyze, chunkToAnalyze, signature);
    }
}

================================================
FILE: db/Binary/rom_32X.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://plutiedev.com/rom-header
meta("rom", "Mega Drive (Mega Everdrive extensions)");

function detect() {
    if (Binary.compare("'SEGA SSF '", 0x100)) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/script_text.Shell.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("script", "Shell");

includeScript("shell-script");

function detect() {
    if (isInterpreter("sh")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/shellcode.pe_to_shellcode.1.sg
================================================
// Detect It Easy: detection rule file
// Author: nicholasmckinney


// Detects hashezerade's reflective pe_to_shellcode generator
// https://github.com/hasherezade/pe_to_shellcode

meta("shellcode", "pe_to_shellcode");


function detect() {
    bDetected = false;

    // https://github.com/hasherezade/pe_to_shellcode/blob/master/pe2shc/stub2/stub32.bin
    var stub32 = "558BEC51518D45F85350E8AA0100005984C0750883C8FFE9A4000000" +
        "56578B7D08B84D5A00006639070F858C0000008B773C03F7813E50450000757F8D86A0" +
        "00000033DB391875046AFDEB71FF76345750E8FB00000083C40C84C075046AFCEB5C39" +
        "9E80000000742357FFB684000000FFB680000000FF75FCFF75F8E86F00000083C41484" +
        "C075046AFBEB318D86C0000000391874095750E82800000059598B4628B90020000003" +
        "C766854E167408536A0157FFD0EB07FFD0EB036AFE585F5E5BC9C204008B4424045657" +
        "8B7C24108B008B74380C85F674128B0E85C9740C6A006A0157FFD183C60475EE5FB001" +
        "5EC3538B5C241855568B7424185703F3EB3C03C350FF5424188BE885ED74408B7E1003" +
        "FBEB1F79050FB7C1EB058D430203C185C074295055FF54242085C0741F890783C7048B" +
        "0F85C975DB83C6148B460C85C075BD85F60F95C05F5E5D5BC332C0EBF78B4424045355" +
        "568B08034C241457EB478B410483F808723F8D68F8D1ED6A005B74320FB7545908668B" +
        "C266C1E80C6685C074216683F803752B8B44241881E2FF0F00002B44241C03D6035424" +
        "180102433BDD72CE0349048B3185F675B3B0015F5E5D5BC332C0EBF7565768029FE66A" +
        "E88B0100008BF05985F67431688DBDC13F56E87C0000008BF8595985FF741E68FF1F7C" +
        "C956E869000000595985C0740D8B4C240C894104B0018939EB0232C05F5EC353568B74" +
        "240C83CAFF8A1E84DB743B8A7C24105784FF750A8D43BF3C19770380C3206A085F8BCA" +
        "0FBEC3D1E933C28BD181F22083B8ED24010F44D1D0FB83EF0175E3468A1E84DB75CB5F" +
        "F7D25E8BC25BC351515355568B742418B84D5A00005766390675618B463C8B44307885" +
        "C074568B54301C33FF8B4C30188954241C8B5430208B443024894C241085C974388D1C" +
        "328D2C308B4C241C0FB745006A018D048103C6894424188B0303C650E84FFFFFFF5959" +
        "3B44242074164783C50283C3043B7C241072CE33C05F5E5D5B5959C38B4424148B0003" +
        "C6EBEF56578B7C240C83CAFF33F60FB7076685C0745B5355807C2418000FB7C8894C24" +
        "1475108D41BF6683F819770783C120894C2414668B5C24146A085D8BC233CAD1E88BD0" +
        "81F22083B8ED80E1010F44D066D1EB66895C241483ED0174068B4C2414EBD9460FB704" +
        "776685C075A95D5BF7D25F8BC25EC364A1300000005356578B780C83C7148B37EB288D" +
        "46F885C074258B581885DB741E8378300074126A00FF7030E85AFFFFFF59593B442410" +
        "740C8B363BF775D433C05F5E5BC38BC3EBF800000000000000";

    // https://github.com/hasherezade/pe_to_shellcode/blob/master/pe2shc/stub2/stub64.bin
    var stub64 = "56488BF44883E4F04883EC20E805000000488BE65EC348895C240857" +
        "4883EC30488BF9488D4C2420E83702000084C0750883C8FFE9BD000000B84D5A000066" +
        "39070F85AA00000048635F3C4803DF813B504500000F8597000000488D8BB000000083" +
        "3900750AB8FDFFFFFFE9860000004C8B4330488BD7E86201000084C07507B8FCFFFFFF" +
        "EB6F83BB9000000000742A0F28442420488D4C2420488B93900000004C8BC7660F7F44" +
        "2420E89300000084C07507B8FBFFFFFFEB3C488D8BD00000008339007408488BD7E833" +
        "0000008B4328B9002000004803C766854B16740E4533C0488BCF418D5001FFD0EB09FF" +
        "D0EB05B8FEFFFFFF488B5C24404883C4305FC348895C2408574883EC208B01488BFA48" +
        "8B5C10184885DB741B4C8B0B4D85C974134533C0488BCF418D500141FFD14883C30875" +
        "E5488B5C2430B0014883C4205FC3488BC4488958084889681048897018488978204156" +
        "4883EC208BDA498BF04903D84C8BF1EB4A8BC84803CE41FF16488BE84885C074628B7B" +
        "104803FEEB2679050FB7D1EB07488D56024803D14885D27447488BCD41FF56084885C0" +
        "743B4889074883C708488B0F4885C975D24883C3148B430C85C075AF4885DB0F95C048" +
        "8B5C2430488B6C2438488B742440488B7C24484883C420415EC332C0EBE148895C2408" +
        "48897C2410448B09498BD84C03CA4C8BDA33FF458B114585D27459418379040872F141" +
        "8B51044C8BC74883EA0848D1EA7435430FB74C41080FB7C166C1E80C6685C074236683" +
        "F80A752681E1FF0F0000498BC34103CA482BC34903CB49FFC04801014C3BC272CB418B" +
        "41044C03C8EBA332C0EB02B001488B5C2408488B7C2410C348895C2408488974241057" +
        "4883EC20488BD9B9029FE66AE8FD010000488BF84885C07432BA8DBDC13F488BC8E893" +
        "000000488BF04885C0741DBAFF1F7CC9488BCFE87E0000004885C0740B48894308B001" +
        "488933EB0232C0488B5C2430488B7424384883C4205FC3448A09448ADA4C8BD14183C8" +
        "FFEB414584DB750C418D41BF3C1977044180C120BA08000000418BC8410FBEC14133C0" +
        "D1E9448BC14181F02083B8ED2401440F44C141D0F94883EA0175DB49FFC2458A0A4584" +
        "C975BA41F7D0418BC0C3488BC448895808488968104889701848897820415441564157" +
        "B84D5A0000448BFA4C8BC16639010F85870000004863413C8B8C088800000085C97478" +
        "498D040833FF8B68184885ED746A448B4820448B50244D03C8448B601C4D03D0410FB7" +
        "02458B194D03D883CAFF498D3484EB2741BE080000008BCA0FBEC333C2D1E98BD181F2" +
        "2083B8ED24010F44D1D0FB4983EE0175E249FFC3418A1B84DB75D2F7D2413BD7742D48" +
        "FFC74983C2024983C104483BFD72A833C0488B5C2420488B6C2428488B742430488B7C" +
        "2438415F415E415CC3428B04064903C0EBDC48895C240848897C2410440FB7094183C8" +
        "FF33FF8ADA448BD74C8BD9EB4684DB750F418D41BF6683F8197705664183C120BA0800" +
        "0000418BC8410FB7C14133C0D1E9448BC14181F02083B8ED2401440F44C16641D1E948" +
        "83EA0175DA49FFC2470FB70C53664585C975B4488B5C240841F7D0488B7C2410418BC0" +
        "C348895C240848896C24104889742418574883EC2065488B0425600000008BE9488B78" +
        "184883C720488B1F483BDF7430488D43F04885C07427488B70304885F6741E488B4860" +
        "4885C9740B33D2E834FFFFFF3BC57405488B1BEBD0488BC6EB0233C0488B5C2430488B" +
        "6C2438488B7424404883C4205FC300000000000000000000000000";

    var redir32_64_Start = "4D5A4552E8000000005B4883EB09534881C3",
        redir32_Start = "4D5A4552E8000000005883E8095005",
        redir64_Start = "4D5A4552E800000000594883E909488BC14805";

    var signatures = [redir32_64_Start, redir32_Start, stub32, redir64_Start, stub64];

    var nSize = Binary.getSize();

    if (nSize > 0x4000) {
        nSize = 0x4000;
    }

    for (var i = 0; i < signatures.length; i++) {
        if (Binary.isSignaturePresent(0, nSize, signatures[i])) {
            bDetected = true;

            if (i <= 2) {
                sOptions = "x86";
            } else {
                sOptions = "AMD64";
            }
        }
    }

    return result();
}

================================================
FILE: db/Binary/shellcode_donut.1.sg
================================================
// Detect It Easy: detection rule file
// Author: nicholasmckinney

meta("shellcode", "Donut");


function detect() {
    bDetected = false;

    // https://github.com/TheWover/donut/blob/dafea1702ce2e71d5139c4d583627f7ee740f3ae/donut.c#L1235
    var bInstCall = Binary.readByte(0);
    if (bInstCall != 0xE8) {
        return result();
    }

    if (Binary.readWord(1) != Binary.readWord(5)) {
        return result();
    }

    var callDest = Binary.readDword(1)

    // https://github.com/TheWover/donut/blob/dafea1702ce2e71d5139c4d583627f7ee740f3ae/donut.c#L1239
    var popECXOffset = callDest + 5; // 1 byte for E8 (call opcode) and 4 bytes for destination offset

    if (Binary.readByte(popECXOffset) != 0x59) {
        return result();
    }

    bDetected = true;

    var archDetectionOffset = popECXOffset + 1;
    var archDetectBytes = Binary.readDword(archDetectionOffset) & 0x00ffffff;

    switch (archDetectBytes) {
        // https://github.com/TheWover/donut/blob/dafea1702ce2e71d5139c4d583627f7ee740f3ae/donut.c#L1242-L1248
        case 0x52515a:
            sOptions = "x86";
            break;

        // https://github.com/TheWover/donut/blob/dafea1702ce2e71d5139c4d583627f7ee740f3ae/donut.c#L1270-L1273
        case 0x48c031:
            sOptions = "x86 + AMD64";
            break;
        default:
            sOptions = "AMD64";
    }

    return result();
}

================================================
FILE: db/Binary/shellcode_srdi-monoxgas.1.sg
================================================
// Detect It Easy: detection rule file
// Author: nicholasmckinney

// https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py
meta("shellcode", "Monoxgas sRDI");

function detect() {
    if (Binary.isDeepScan()) {
        // 32-bit and 64-bit start out with the same first 5 bytes (relative jump)
        var jumpStartOffset = Binary.findSignature(0, Binary.getSize(), "E800000000");

        var currentOffset = jumpStartOffset + 5;

        // Possible 64-bit sRDI
        // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L76-L80
        if (Binary.readDword(currentOffset) == 0xC8894959) {
            sOptions = "AMD64";
            bDetected = true;
        } else if (Binary.readDword(currentOffset) == 0xE5895558) { // Possible 32-bit sRDI
            sOptions = "x86";
            bDetected = true;
        }
    }
    return result();
}


================================================
FILE: db/Binary/source_text.HTML.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("source", "HTML");

function detect() {
    var sText = Binary.getHeaderString();
    if (/^<\s*(!DOCTYPE\s+)?html\b[^>]*>/im.test(sText)) {
        bDetected = true;
    }

    sLang = "HTM";

    return result();
}


================================================
FILE: db/Binary/source_text.Pascal.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("source", "Pascal");

function detect() {
    var sText = Binary.getHeaderString();
    /* if(/^unit/im.test(sText)) {
        bDetected = true;
    } */
    if (/^\s*program\s.*\s*uses\s/im.test(sText)) {
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}


================================================
FILE: db/Binary/source_text.XML.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("source", "XML");

function detect() {
    var sText = Binary.getHeaderString();
    // Ignore the UTF-8 BOM.
    if (/^(?:\xef\xbb\xbf)?<\?xml/.test(sText)) {
        var aVersion = sText.match(/version="(.*?)"/);
        if (aVersion) {
            sVersion = aVersion[1];
        }

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/Binary/source_text.c.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("source", "C/C++");

function detect() {
    var sText = Binary.getHeaderString();
    if (/^#ifndef (\w+).*\s+^#define \1/m.test(sText) ||
        /#\s*pragma (?:once|hdrstop)/.test(sText)) {
        sOptions = "header";
        bDetected = true;
    }
    if (/^(?:class\b|virtual\b|public:|private:|template\b)/m.test(sText)) {
        if (!(/\sdef\s/.test(sText))) // to avoid false positives on python
        {
            sName = "C++";
            bDetected = true;
        }
    } else {
        var aInclude = sText.match(/^#include ["<].*?[>"]/mg);
        if (aInclude) {
            bDetected = true;
            for (var i = 0; i < aInclude.length; i++) {
                if (aInclude[i].indexOf(".") < 0) {
                    sName = "C++";
                    break;
                }
            }
        } else if (/^#define/m.test(sText)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/Binary/source_text.python.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("source", "Python");

function detect() {
    var sText = Binary.getHeaderString();

    if ((/import\s/.test(sText)) && (/class\s/.test(sText)) && (/self/.test(sText))) {
        if (/\sdef\s/.test(sText)) {
            bDetected = true;
        }
    }

    sLang = "Python";

    return result();
}


================================================
FILE: db/Binary/text.script.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("script");

includeScript("shell-script");

function detect() {
    if (sInterpreter) {
        // Capitalize the first letter, lowercase the rest.
        sName = sInterpreter.substr(0, 1).toUpperCase() + sInterpreter.substr(1).toLowerCase();
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/Binary/win_resources.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format");

function detect() {
    if (Binary.isResource()) {
        var mapNames = {
            "1": "Resource Cursor",
            "2": "Windows Bitmap",
            "3": "Resource Icon",
            "4": "Resource Menu",
            "5": "Resource Dialog",
            "6": "Resource String Table",
            "7": "Font Directory",
            "8": "Font",
            "9": "Accelerators",
            "10": "RC Data",
            "11": "Message Table",
            "12": "Windows Cursor",
            "14": "Windows Icon",
            "15": "Name Table",
            "16": "Resource Version Info",
            "17": "DlgInclude",
            "23": "HTML",
            "24": "Manifest"
        };

        var sResName = mapNames[Binary.getScanID()];

        if (sResName) {
            sName = sResName;
            sOptions = "Resources";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Borland
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Borland Delphi tests for Borland C++ first, so ensure we only do it once.

var bBorlandC;
if (typeof bBorlandC === "undefined") {
    bBorlandC = 0;
    if (PE.compare("'MZ'50000200000004000F00FFFF0000B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000020000BA10000E1FB409CD21B8014CCD219090'This program must be run under Win32\r\n$'370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'PE'0000")) {
        bBorlandC = 1;
    } else if (PE.compareEP("A1........C1E002A3")) {
        bBorlandC = 1;
    } else if (PE.compareEP("EB10'fb:C++HOOK'90")) {
        bBorlandC = 2;
    } else if (PE.section.length > 1) {
        var nOffset = PE.section[1].FileOffset;
        var nSize = Math.min(1024, PE.section[1].FileSize);
        if (PE.isSignaturePresent(nOffset, nSize, "'Borland C++ - Copyright'")) {
            bBorlandC = 1;
        }
    }
}

================================================
FILE: db/CFBF/Microsoft_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("Installer", "Microsoft Installer");

function detect() {
    if (CFBF.getFileFormatVersion() == 4.62) {
        sVersion = "1.X-5.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/CFBF/Microsoft_Office.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Microsoft Office");

function detect() {
    if (CFBF.getFileFormatVersion() == 3.62) {
        sVersion = "1997-2003";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/CFBF/_CFBF.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Compound File Binary Format");

function detect() {
    sName = CFBF.getFileFormatName();
    sVersion = CFBF.getFileFormatVersion();
    sOptions = CFBF.getFileFormatOptions();

    bDetected = true;

    return result();
}


================================================
FILE: db/CFBF/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = CFBF;
var X = CFBF;

================================================
FILE: db/COM/32-bit_crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "32-bit crypt");

function detect() {
    if (Binary.compare("6633c9678a81........34..2c..34..678881........6683c1..6681f9........75")) {
        sOptions = "by SWW //DiGiTAl FaCToRY";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/COM_Sccrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COM Sccrambler");

function detect() {
    if (Binary.compare("e9$$$$fcbe....8bfeb9....515657b4..04..ac90902ac432c4aae2..5f5e5903f183ee..a5a4b8....5083eb..33c9")) {
        sVersion = "0.1";
        sOptions = "1995 by Moshe";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Character_Intro_Engine.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "Character Intro Engine");

function detect() {
    if (Binary.compare("e9$$$$2e8b26....81c4....2ea1....2ea3....0e588ec08ed88bdc83c3..b1..d3eb43b4..cd21fc")) {
        sOptions = "by //UCF";
        bDetected = true;
    } else if (Binary.compare("e9$$$$2e8b26....81c4....0e588ec08ed88bdc83c3..b1..d3eb43b4..cd21fc")) {
        sOptions = "by //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Crypt_(CyPoxl).2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Crypt by CyPoxl");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$8bfc368b2d8bcd81ed....c3")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Crypt_(Dismember).2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Crypt by Dismember");

function detect() {
    if (Binary.compare("0E179C58F6C4..74..EB..90B4..BE....BF....B9....68....68....68....57F3A4C3")) {
        sVersion = "1.7";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....8bf7acad918ae157ac32c4f6d0d0c412e1aae2")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Deep_Crypter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Deep Crypter");

function detect() {
    if (Binary.compare("90e9$$$$e80000598be981ed....81e9....be....8dbe....668b056689048dbe....8bd78bdf83c3..8a043205f6d0")) {
        sVersion = "0.1b";
        sOptions = "by PLasMoiD";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Dn.COM_Cruncher.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Dn.COM Cruncher");

function detect() {
    if (Binary.compare("33dbb5..8bf98be9be....57f3a4bf....c3")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Inbuild_Encryption.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Inbuild Encryption");

function detect() {
    if (Binary.compare("b9....bb....2ed2072e281f43e2")) {
        sVersion = "1.0";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/LHarc_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LHarc SFX");

function detect() {
    if (Binary.compare("eb$$fcbc....bb....e8....8cc82e0306....8ed88ec005....2e3b06....76..bb....e9....bf....33d28bc2b9....d1e873..35....e2..abfec275..be....bf....b8....ba....2e3a24")) {
        sVersion = "1.13S, 1.13L";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcbc....bb....e8....8cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")) {
        sVersion = "1.14c";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcbc....e8....9090908cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")) {
        bDetected = true;
    }
    return result();
}

================================================
FILE: db/COM/Maveriks_C0der.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Mavericks C0der");

function detect() {
    if (Binary.compare("e9$$$$2e8b0e....49bb....fcbe....8a26....ac32c488074388c4e2..b9....ffe1")) {
        sVersion = "1.XX";
        bDetected = true;
    } else if (Binary.compare("e9$$$$2e8b3e....81c7....2e8b058ac82ea3....2e8a45..2ea2....be....462e8a0432c12e88048ac83bf775..e9")) {
        sVersion = "1.00a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Microsoft_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Microsoft C");

function detect() {
    if (Binary.compare("fab8....05....b1..d3e88ccb03c38ed88cd0a3....8bc4a3....8cd88ed0bb....8be3fb891e....b8....a3....0633c0")) {
        sVersion = "1.04";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Microsoft_RTL.3.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "Microsoft RTL");

function detect() {
    if (Binary.compare("b430cd213c..73..c38cdf8b36....2e893e....2bf781fe....72..be....b8....05....73..e8....33c050e8....b8ff4ccd218be0")) {
        sVersion = "1990";
        bDetected = true;
    } else if (Binary.compare("b430cd213c..73..c38cdf8b36....2e893e....2bf781fe....72..be....bb....81c3....73..e8....33c050e8....b8....cd21")) {
        sVersion = "1992";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/MrHDKiller_Protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Mr.HDKiLLeR PriotectioN");

function detect() {
    if (Binary.compare("e9$$$$4851442ea1....2d....8bd805....8bf0bf....b9....90f3a48bcb")) {
        sVersion = "1.1p";
        sOptions = "//eMX!";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/PC_FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "PC/FORTH");

function detect() {
    if (Binary.compare("90e9$$$$29c08ed8bb....8a072ea2....80c8..80e0..8807a1....2ea3....a1....2ea3....a1....2ea3....a1....2ea3....8cc88ed08ec08ed8a3....8b26")) {
        sOptions = "1983 by Laboratory Microsystems Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/RDT_ENC_3.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "RDT_ENC 3");

function detect() {
    if (COM.compare("e9$$$$be....8bfe8bce33c08ed8c706........c606......26acba....52fe0e....74..e8....d0c8fec83206....c3")) {
        sOptions = "by mr. Wicked";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/RTD_Compressor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "RTD_compressor");

function detect() {
    if (Binary.compare("bf....be....b5..57f3a5c3")) {
        sOptions = "by Mr.Wicked";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/RTD_Compressor2.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "RTD_Compressor 2");

function detect() {
    if (Binary.compare("fcbf....be....b5..57f3a5c3")) {
        sOptions = "1997 by mr. Wicked";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/SHOW_IT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "SHOW IT");

function detect() {
    if (Binary.compare("bf....32db2e8a150ad274..b4..cd214780fa..75..fec380fb..75..32db53b4..cd16b4..cd165b75")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/SPHINX_C--.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "SPHINX C--");

function detect() {
    if (Binary.compare("58bc....50b44abb....cd2173..b409ba....cd21c38cc88ec0bf....be....31d2bb....ac3c..74")) {
        sVersion = "1993";
        bDetected = true;
    } else if (Binary.compare("58bc....50b44abb....cd2173..c3")) {
        sVersion = "0.203 (1994)";
        bDetected = true;
    } else if (Binary.compare("58bc....50b44abb....cd2173..b409ba....cd21c3")) {
        bDetected = true;
    } else if (Binary.compare("eb$$31c08ec026c706........268c0e....e9$$$$c8......b8....e8")) {
        bDetected = true;
    } else if (Binary.compare("e9....'SPHINXC--'")) {
        bDetected = true;
    } else if (Binary.compare("0e07bf....be....31d2bb....ac3c..74..3c..74..3c..74..aaac")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Shade's_COM_Encryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "ShadE's COM encRYPTOR");

function detect() {
    if (Binary.compare("e9$$$$33c033db33c933d233edbf....be....b9....ac83c3..d3c38d9f....8dae....03dd")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Shadow_COM_encryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Shadow COM encryptor");

function detect() {
    if (Binary.compare("e9$$$$b9....bb....be....bf....ad33c3ab86dff7d3e2..68")) {
        sVersion = "1.0";
        sOptions = "by Tailgunner";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/TPC_Scramble.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "TPC Scramble");

function detect() {
    if (Binary.compare("e9$$$$b0..bb....5351b9....2e3007fec043e2..bb....c707....c647....33c033db59c3")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Text_Header.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "Text Header");

function detect() {
    if (Binary.compare("e9$$$$b9....be....bf....f3a468....c3")) {
        sVersion = "1.0";
        sOptions = "from EXE2COM 9.50 by B. Vorontsov";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/The_DRAW.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "The DRAW");

function detect() {
    if (Binary.compare("eb$$b40fcd10bb....3c..74..3c..74..c606......bb....3c..74..ba....b409cd21c3")) {
        sVersion = "4.6";
        bDetected = true;
    } else if (Binary.compare("eb$$b40fcd108ccb8edbbb....b4..3c..74..3c..73..bb....8a26....3c..73..8d16")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Tiny_Xor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Tiny Xor [tDCE]");

function detect() {
    if (Binary.compare("e9$$$$fcb8....bb....b9....be....300402c386c486df46e2..be....c704....c644....33c033db33c9ffe6")) {
        sVersion = "0.52b";
        sOptions = "by ThE DOCTOr //DiPG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/Unknown_cryptors.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Unknown cryptor");

function detect() {
    if (Binary.compare("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8")) {
        sVersion = "#01";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....b3..be....bf....acfec332c3aae2")) {
        sVersion = "#02";
        sOptions = "exe 0-relocs crypt";
        bDetected = true;
    } else if (Binary.compare("'GENERATED'00'FILE'bc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")) {
        sVersion = "#03";
        sOptions = "GENERATED FILE";
        bDetected = true;
    } else if (Binary.compare("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07")) {
        sVersion = "#04";
        bDetected = true;
    } else if (Binary.compare("e8$$$$fc8bec8b4e..2bc08bf9f2aebb....03d9875e..fec58bf1ac8ad0ad8bc88bfeac32c2aae2")) {
        sVersion = "#05";
        bDetected = true;
    } else if (Binary.compare("fc525756ba....b9....be....bf....52f3a52ec606......c3")) {
        sVersion = "#06";
        bDetected = true;
    } else if (Binary.compare("b4..be....bf....b9....68....68....68....57f3a4c3")) {
        sVersion = "#07";
        bDetected = true;
    } else if (Binary.compare("b8....05....50c3")) {
        var nOffset = Binary.readWord(1) + Binary.readWord(4) - 256;
        if (Binary.compare("90902ea1....8bc85005....9083e9..bf....2e8035..47495083f9..74..c3", nOffset)) {
            sVersion = "#08";
            sOptions = "xorer";
            bDetected = true;
        }
    } else if (Binary.compare("e9$$$$e8$$$$5e83ee..2e8984....06562e8c9c....0e070e1fb430cd213c..7d..bb....03dee8....b0..b44ccd21")) {
        sVersion = "#11";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....be....bf....bb....5357ad3d....74..c1c8..bb....03d933c3abe2")) {
        sVersion = "#15";
        sOptions = "xorer";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$5d83ed..0e1f0e07be....03f5bf....b9....f3a460be....0204463b")) {
        sVersion = "#16";
        sOptions = "1995 by A.V.Lemenkov";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....56b9....c704....c644....8134....4646cce2")) {
        sVersion = "#17";
        sOptions = "xorer";
        bDetected = true;
    } else if (Binary.compare("60bb....be....bf....8bcf03fb5781e9....f3a4c3")) {
        sName = "Com-crypt";
        sVersion = "#18";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8b1e....81eb....b8....5053b430cd215beb")) {
        sVersion = "#19";
        sOptions = "by WICKED!";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....8bf43bf776..8be7e8$$$$5f53518bdf43b9....2bcb300f43e2")) {
        sVersion = "#20";
        sOptions = "(xorer) 1988 by Executive Systems, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/VGA_font_loader.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "VGA font loader");

function detect() {
    if (Binary.compare("e9$$$$b8....8ed8fafcbf....8b36....8e1e....b9....f3a5b8....8ed8c706........8c0e....8cc88ed8")) {
        sOptions = "by Pete I. Kvitek";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/VSF&K_protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "VSF&K protection");

function detect() {
    if (Binary.compare("e9$$$$eb$$8cdb8cca8edafa8becbe....bc....bf....313c312446474c75")) {
        sOptions = "1992";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/WSP_self_update.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "WSP self update");

function detect() {
    if (Binary.compare("bb....b4..ba....cd212e891e....b4..bb....cd2173..ba....e9")) {
        sVersion = "1.50";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/WiZ_Cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "WiZ Cryptor");

function detect() {
    if (Binary.compare("e9$$$$fa60561e8ed8be....bf....b8....8706....ab8cc88706....ab1f68....9c5880cc..509dfc")) {
        sVersion = "1.00a";
        sOptions = "by SP0T //UCL";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/_COM.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "MS-DOS");

function detect() {
    if (COM.isVerbose()) {
        sName = COM.getOperationSystemName();
        sVersion = COM.getOperationSystemVersion();
        sOptions = COM.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/COM/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = COM;
var X = COM;

================================================
FILE: db/COM/compiler_8086_Forth_83.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "8086 Forth 83");

function detect() {
    if (Binary.compare("e9$$$$8cc88ed88ed08ec0a1....b0..a3....2d....a3....2d....8be8bb....031e....892f2d....a3....bb....031e....89078be0be....e9")) {
        sVersion = "2.1.0";
        sOptions = "1985";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_ASIC-Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "ASIC-Basic");

function detect() {
    if (Binary.compare("e9$$$$33dbb4..cd108916....cc90b0..ba....33c9b7..b4..cd1031d28916....b4..30ffcd1090")) {
        sVersion = "5.0";
        sOptions = "1994 by David Visti of 80/20 Software";
        bDetected = true;
    } else if (Binary.compare("e9$$$$33dbb4..cd108916....cc90b0..a2....ba....a0....3c..75..b4..b0..cd2172..a3")) {
        sOptions = "by David Visti of 80/20 Software";
        bDetected = true;
    } else if (Binary.compare("e9$$$$33dbb4..cd108916....cc90fcb9....be....bf....f3a490fcb9....be....bf....f3a4")) {
        sVersion = "3.0";
        sOptions = "by David Visti of 80/20 Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_BAT2EXEC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "BAT2EXEC");

function detect() {
    if (COM.compare("eb$$fcbd....8b....8b......8b......b44acd21a1....8986")) {
        sOptions = "by Douglas Boling";
        sVersion = "1.5";
        bDetected = true;
    } else if (COM.compare("fcbd....8b....8b......8b......b44acd21a1....8986")) {
        sOptions = "by Douglas Boling";
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_BatLite.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "BatLite");

function detect() {
    if (Binary.compare("eb$$e8....bb....8bf3031e....891e....81fb....73..bb....8bfb891e....031e....81c3....8be3b1..d3eb43")) {
        sOptions = "1991-95 by Pieter A. Hintjens";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Borland_C++.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Borland C++");

function detect() {
    if (Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8....a1....8ec033c08bd88bf8b9....fcf2aee3")) {
        sOptions = "1991";
        bDetected = true;
    } else if (Binary.compare("8cca2e8916....b430cd218b2e....1e2c..daa3....8c06....891e....892e....e8....a1....8ec033c08bd88bf8b9....fcf2aee3")) {
        sOptions = "1991";
        bDetected = true;
    }

    sLang = "C++";

    return result();
}

================================================
FILE: db/COM/compiler_Datalight_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Datalight/Northwest C");

function detect() {
    if (Binary.compare("eb$$fab8....b9....d3e88cc903c18ed88c06....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....81fb....77")) {
        sVersion = "3.10 S";
        sOptions = "by Walter Bright";
        bDetected = 1;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/COM/compiler_Easy!-C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Easy!-C");

function detect() {
    if (Binary.compare("9c55568ccd83c5..8db6....56be....56cb")) {
        sOptions = "1993 by Flight Technologys"; //spelling taken from file
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Fig-FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Fig-FORTH");

function detect() {
    if (Binary.compare("90e9$$$$be....8cc88ed88b26....8ed08ec0fc8b2e....e8$$$$b0..ba....b4..cd21c3")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_ForthCMP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "ForthCMP");

function detect() {
    if (Binary.compare("90e9$$$$8cc88ed08ec08ed8bc....b430cd2180f8..73..ba....b409cd2131c0cd218cc881c0....8b1e....81eb....39d8")) {
        sOptions = "1995 by Thomas Almy";
        bDetected = true;
    }
    if (Binary.compare("e9$$$$bc....c706........bd....892e....fce8....b8....cd21")) {
        sVersion = "2.1";
        sOptions = "by Thomas Almy";
        bDetected = true;
    }
    if (Binary.compare("e9$$$$bc....c706........bd....892e....b4..bb....cd21fce8")) {
        sVersion = "2.1";
        sOptions = "by Thomas Almy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_ForthCMP.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "ForthCMP");

function detect() {
    if (Binary.compare("90e9$$$$8cc88ed08ec08ed8bc....b430cd2180f8..73..ba....b409cd2131c0cd218cc881c0....8b1e....81eb....39d8")) {
        sOptions = "1995 by Thomas Almy";
        bDetected = true;
    }
    if (Binary.compare("e9$$$$bc....c706........bd....892e....fce8....b8....cd21")) {
        sVersion = "2.1";
        sOptions = "by Thomas Almy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_GP-FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "GP-FORTH");

function detect() {
    if (Binary.compare("e9$$$$8cc88ed8a1....a3....a1....a3....e8$$$$a1....3d....74..0306....72..a3....b1..d3e8408ccb8ec35003d8")) {
        sVersion = "93.9-94.7";
        sOptions = "1990-94 by Golden Porcupine Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Lattice_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Lattice C");

function detect() {
    if (Binary.compare("fab8....05....b1..d3e88ccb03c38ed88ed0")) {
        if (Binary.compare("a3....bc....fbfc8cd88cc92bc1b1..d3c0a3....8126", 19)) {
            sVersion = "3.0";
        } else if (Binary.compare("bc....fb8cd88cc92bc1b1..d3c0a3....8126", 19)) {
            sVersion = "3.0";
        } else if (Binary.compare("bc....fbb430cd210ac075", 19)) {
            sVersion = "2.1";
        } else if (Binary.compare("268b1e....2bd8f7c3....75..b1..d3e3eb..bb", 19)) {
            sVersion = "1.01";
        } else if (Binary.compare("bb....2bd8f7c3....75..b1..d3e3eb..bb", 19)) {
            sVersion = "1.0";
        }
        bDetected = true;
    } else if (Binary.compare("eb$$fab8....05....b1..d3e88ccb03c32ea3....8ed88ed0bc....fbb430cd21")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (Binary.compare("b8....05....b1..d3e88ccb03c38ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8....8cc88ec0eb$$fab8....05....b1..d3e88ccb03c38ed88ed0bc....fbb430cd21")) {
        sVersion = "2.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_MICRO-C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MICRO-C");

function detect() {
    if (Binary.compare("bb....b44acd21bc....be....bf....bb....b9....8a043c..74..3c..75..46eb")) {
        sOptions = "by Dave Dunfield";
        bDetected = true;
    } else if (Binary.compare("bb....b44acd2133c08be0bf....b9....2bcff3aabe....bf....bb....b9....8a043c..74..46")) {
        sOptions = "by Dave Dunfield";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_MINIFORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MINIFORTH");

function detect() {
    if (Binary.compare("e9$$$$fc33c08bd8a3....89c52d....a3....89c4b8....a3....891e....be....adffe0")) {
        sVersion = "1.0";
        sOptions = "1988 by Ted Beach";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_MoonRock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MoonRock");

function detect() {
    if (Binary.compare("bc....bb....b1..d3eb81c3....b4..cd2172..b8....cd212e891e....2e8c06....b8....ba....cd21")) {
        sVersion = "0.52.b01";
        sOptions = "1994-2000 by Rowan Crowe";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_OUTFORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "OUTFORTH");

function detect() {
    if (Binary.compare("90e9$$$$29c08ed8bb....8a0780c8..80e0..88078cc88ed08ec08ed8a3....ba....b4..b0..cd21ba....b4..b0..cd21be....8b26....8b2e....fce9")) {
        sOptions = "1989 by Norman L. Hills";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_PBFC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Personal Batch File Compiler");

function detect() {
    if (Binary.compare("eb$$90fcbd....8b....8b......8b......b44acd21a1....8986")) {
        sOptions = "1993, 2003 by Kinglion Software Workroom";
        sVersion = "1.6c";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_RMCOBOL.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "RM/COBOL");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$e8$$$$5a2e8c1e....b1..bb....81c3....f6c3..74..83c3..81e3....58fa8be3fb50d3eb52062e8e06....8bd3")) {
        sVersion = "2.2";
        sOptions = "1985 by Ryan-McFarland Corp.";
        bDetected = true;
    }

    sLang = "Cobol";

    return result();
}

================================================
FILE: db/COM/compiler_SP-FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "SP-FORTH");

function detect() {
    if (Binary.compare("8b26....8bec83ed..e9$$$$e8$$$$83ed..8976..5eadffe0")) {
        sVersion = "1.01";
        sOptions = "1992 by Stroyprogress Ltd.";
        bDetected = true;
    } else if (Binary.compare("8b26....8bec83ed..e9$$$$e8$$$$87ec5687ec5eadffe0")) {
        sVersion = "1.5";
        sOptions = "1993";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Surpas-86.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Surpas-86 (Pascal compiler)");

function detect() {
    if (Binary.compare("e9$$$$e9$$$$b8....05....25....b1..d3e88cca03d08eda2ea1....2bc2a3....33db2d....73..8b1e....b1..d3e333c0")) {
        sVersion = "1.0";
        sOptions = "1987 by Tixaku Pty Ltd";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_TCOM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Forth Target COMpiler");

function detect() {
    if (Binary.compare("8cc805....8ed88ed0b8....8be0a3....b8....8bf0a3....c704....2d....a3....bb....8bebe8")) {
        sOptions = "by Tom Zimmer";
        bDetected = true;
    } else if (Binary.compare("8cc805....8ed88ed08ec08b1e....81c3....8bf3891e....83c3..891e....c707....81c3....8be3891e....83c3..891e....c706")) {
        sOptions = "by Tom Zimmer";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Turbo_C++.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Turbo C++");

function detect() {
    if (Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8....c43e....8bc78bd8b9....fcf2ae")) {
        sVersion = "1990";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Turbo_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Turbo C");

function detect() {
    if (Binary.compare("8cca2e8916....8b2e....8b1e....8eda8c06....892e....e8....8cda2bea8b3e....81ff....73..bf....893e")) {
        sVersion = "1988";
        bDetected = true;
    } else if (Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c706")) {
        sVersion = Binary.compare("8e", 42) ? "1987" : "1988";
        bDetected = true;
    } else if (Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....8cda")) {
        sOptions = "1990";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8....c43e")) {
        sVersion = "1990";
        bDetected = true;
    } else if (Binary.compare("fb8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c706........e8")) {
        sVersion = "1987";
        bDetected = true;
    } else if (Binary.compare("8cca2e8916....e8....8cda2bea8b3e....81c7....72..b1..d3ef473bef72..833e......75..bf....3bef")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Turbo_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Turbo Pascal");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$e8$$$$b430e8$$$$80fc..74..80fc..74..80fc..74..80fc..74..55")) {
        sVersion = "3.0";
        sOptions = "1985";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$..8cc82e03....2e03....2e03....2e3b06....76")) {
        sVersion = "3.0";
        sOptions = "1985";
        bDetected = true;
    } else if (Binary.compare("e9$$$$eb$$e8....b8....b1..d3e88cca03d08eda2ea1....2bc2a3")) {
        sVersion = "3.0";
        sOptions = "1985";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e9$$$$b8....b1..d3e88cca03d08eda2ea1....2bc2a3")) {
        sVersion = "3.0";
        sOptions = "1985";
        bDetected = true;
    } else if (Binary.compare("e9$$$$c706............................8b0c39c174..4e4ef3a5")) {
        sVersion = "3.0";
        sOptions = "1985";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$1ee8$$$$5051b8....b1..d3e88cc903c18ed85958c3")) {
        sVersion = "3.0";
        sOptions = "1985";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_UNIFORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "UNIFORTH");

function detect() {
    if (Binary.compare("90e9$$$$8cc88ed88ed08ec0fc8b26....8b2e....8b3e....893e....ba....b8....cd21ba....b8....cd218b1e....8d4f..894d..8b0e....8bc1")) {
        sOptions = "1985 by Unified Software Systems";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Vienna-C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Vienna-C");

function detect() {
    if (Binary.compare("90e9$$$$8cc88ed8e8....803e......75..8a3e....883e....8b1e....891e....a3....8ec00306....8ed0a3....8b26....8b2e....be....c706")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Watcom_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Watcom C");

function detect() {
    if (Binary.compare("e9$$$$fb8cc98ec126bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8....01c383c3..80e3..8ed189dc26891e....89dad1")) {
        sName += "/C++16";
        sVersion = "1994";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fb8cc98ec1bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8....03d883c3..80e3..8ed18be326891e....8bd3d1ea")) {
        sName += "/C++16";
        sVersion = "1993";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fb8cc9bb....8ec1268c1e....26a1....3d....73..b8....03d88ed18be326891e....83c3")) {
        sName += "/C++16";
        sVersion = "1988";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fb8cc98ec1bb....83c3..83e3..26891e....268c1e....26a1....3d....73..b8....03d88ed18be326891e....83c3..83e3..8bd3d1ea")) {
        sVersion = "1991";
        bDetected = true;
    } else if (Binary.compare("e9$$$$0e0e1f07b4..ba....cd21ba....cd21e8....803e......74..b4..ba....cd21e9")) {
        sName += "/C++32";
        sVersion = "1995";
        bDetected = true;
    } else if (Binary.compare("eb$$fb8cc98ec1bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8........83c3..80e3..8ed1")) {
        sName = "Open Watcom C/C++16";
        sVersion = "2002 by Sybase, Inc.";
        sOptions = "type 1";
        bDetected = true;
    } else if (Binary.compare("eb$$fb8cc98ec1bb....83c3..80e3..891e....8c1e....a1....3d....73..b8....03d883c3..80e3..8ed1")) {
        sName = "Open Watcom C/C++16";
        sVersion = "2002 by Sybase, Inc.";
        sOptions = "type 2";
        bDetected = true;
    } else if (Binary.compare("eb$$fb8cc98ec126bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8........83c3..80e3..8ed1")) {
        sName = "Open Watcom C/C++16";
        sVersion = "2002 by Sybase, Inc.";
        sOptions = "type 3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Zbikowski_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Zbikowski C");

function detect() {
    if (Binary.compare("8975..8a0430e48946..408bf88a85....30e425....74..8b46..2d....eb..8b76..8a0430e42d....8346")) {
        sOptions = "1983 by Mark Zbikowski (Microsoft Corp.)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_Zortech_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Zortech C");

function detect() {
    if (Binary.compare("eb$$fab8....05....b9....d3e88cc903c18ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd881fb....72")) {
        sVersion = "2.10";
        sOptions = "1990 by Walter Bright";
        bDetected = true;
    } else if (Binary.compare("eb$$fcbe....b9....8b3e....5703f981c7....57f3a45f81c7....ffe7")) {
        sVersion = "2.00";
        sOptions = "1990 by Walter Bright";
        bDetected = true;
    } else if (Binary.compare("eb$$8cc883c0..50b8....50cbfc8e06....b0..b9....33fff2aeae75..4747be....e8")) {
        sVersion = "2.00";
        sOptions = "1990 by Walter Bright";
        bDetected = true;
    } else if (Binary.compare("eb$$fab8....05....b9....d3e88cc903c1dbe38ed88c06....8bd82b1e....891e....268b1e....2bd8")) {
        sVersion = "4.00";
        sOptions = "by Walter Bright";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/compiler_muSIMP-83.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "muSIMP-83");

function detect() {
    if (Binary.compare("e9$$$$8cc88ed88ed0bc....a3....ba....e8....c606......e8....803e......75..0e17bc....e8....e8....eb")) {
        sVersion = "4.12";
        sOptions = "1985 by The SOFT WAREHOUSE";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_A3E.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "A3E (text2com)");

function detect() {
    if (Binary.compare("1e33c050be....81c6....b8....8ec0bf....b9....f3a5cb")) {
        sOptions = "1992 by JHSoft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_AutoCracker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "AutoCracker");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$be....e8$$$$5133c9ac3c..74..32c8d1e1b4..8ad03c..74..cd21eb")) {
        sVersion = "1.X";
        sOptions = "1997 Dmitry Gorshkov";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_COM2TXT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "COM2TXT");

function detect() {
    if (Binary.compare("'XP5~~-~}P]XP-@?->@1Fq1Fx0F6,00F7,b(F8ZRu(XP2FzE,@r42fzWBxG!='")) {
        sOptions = "1997 by GyikSoft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_COMT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "COMT");

function detect() {
    if (Binary.compare("'ENC.COM.B&F='")) {
        sVersion = "0.1d";
        sOptions = "(com2text) by Alex Pruss";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_CRX2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "CRX2COM");

function detect() {
    if (Binary.compare("e9$$$$8b1e....c1....81c3....e8....b4..ba....cd21bb....e8....b4..ba....cd21b8....ba....cd2173")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_E2C.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "E2C (EXE2COM) by The DoP");

function detect() {
    if (Binary.compare("be....bf....b9....57f3a5c3")) {
        sVersion = "1.00-1.02";
        bDetected = true;
    } else if (Binary.compare("be....bf....b9....fc57f3a5c3")) {
        sVersion = "1.02a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_EXE2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "EXE2COM");

function detect() {
    if (Binary.compare("e9$$$$bf....be....a5a48cda83c2..50b9....ad970115e2")) {
        sVersion = "1.0";
        sOptions = "by D'B";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005b508cc005....8b0e....03c889....8b0e")) {
        sVersion = "1.0";
        sOptions = "by Microsoft";
        bDetected = true;
    } else if (Binary.compare("b3..b9....33d2be....8bfeac32c3aa434932e403d0e3..eb..3b16....75..be....8bc6b1..d3e88cdb03c30344..a3....8cc805")) {
        sOptions = "CRC check";
        bDetected = true;
    } else if (Binary.compare("e8$$$$bf....be....a5a48cda83c2..0116....81c2....8ed2bc....eb")) {
        sOptions = "by //ViP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....be....a5a48cda83c2..50b4..bb....cd21580116....81c2....8ed2")) {
        sOptions = "0-Relocs by dR.No //ViP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....be....a5a48cda83c2..0116....81c2....8ed2bc....eb..ea")) {
        sOptions = "0-Relocs by Sage //UCF";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005b81eb....8db7....bf....b9....f3a58db7....538ccf83c7..ad")) {
        sVersion = "2.0";
        sOptions = "by Paul Shpilsher";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8cca81c2....3b16....76..ba....b409cd21cd20")) {
        sOptions = "generic, type 1";
        bDetected = true;
    } else if (Binary.compare("be....8b043d....74..ba....b409cd21cd208bc6b1..d3e88cdb03c303....a3....8cc805....a3....8b44")) {
        sOptions = "by RaskY";
        bDetected = true;
    } else if (Binary.compare("bf....be....b9....fcf3a4068ccb83c3..011e....011e....b9....8b54..03d381c2....8ec28b3c")) {
        sVersion = "1.0";
        sOptions = "by Milkov";
        bDetected = true;
    } else if (Binary.compare("bf....be....b9....fcf3a48ccb011e....011e....eb00bf....be....b9....bb....bd....fa")) {
        sVersion = "1.0";
        sOptions = "by Milkov";
        bDetected = true;
    } else if (Binary.compare("eb$$be....8bc6b1..d3e88cdb03c30344..89048cc805....8be88b44..b1..d3e803c50344..bb....8b1f")) {
        sOptions = "by JauMing Tseng";
        bDetected = true;
    } else if (Binary.compare("e8$$$$bf....be....a5a48cda83c2..50b4..bb....cd21b9....ad970115e2")) {
        sVersion = "1.0d";
        sOptions = "1994 by D'B";
        bDetected = true;
    } else if (Binary.compare("e9$$$$92be....bf....fca5a48ccb83c3..b9....ad97011de2")) {
        sOptions = "1996 by EM-Phaser";
        bDetected = true;
    } else if (Binary.compare("b430cd213c..73..33c00650cb")) {
        sOptions = "by JVP";
        bDetected = true;
    } else if (Binary.compare("bf....be....b9....f3a48cd805....0344..8ccb9305....8be60364..8b4c..e3..5f5a")) {
        sName = "CC";
        sVersion = "2.61 beta";
        sOptions = "EXE2COM";
        bDetected = true;
    } else if (Binary.compare("e8$$$$bf....be....a5a48cda83c2..50b4..bb....cd21580116....81c2....8ed2bc....eb")) {
        sOptions = "by unknown";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e9$$$$8cca81c2....3b16....76..ba....b409cd21cd20")) {
        sOptions = "generic, type 2";
        bDetected = true;
    } else if (Binary.compare("be....8b043d4d5a74$$8bc6b1..d3e88cdb03c30344..a3....8cc8")) {
        sOptions = "by BuZZ Soft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_EXETools_EXE2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "EXETools EXE2COM");

function detect() {
    if (Binary.compare("e9$$$$e800005d8bcd83ed..bf....be....2bcff3a4b9....be....03f5e3..8cdb035e..ad8bf8011de2")) {
        sVersion = "2.0, 2.1";
        bDetected = true;
    } else if (Binary.compare("68....68....68....68....68....68....5fbe....b9....f3a4c3")) {
        sOptions = "com header from EXETools 2.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_FIXCRK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "FIXCRK");

function detect() {
    if (Binary.compare("'ROMANOID'32e4b0..cd104c5abf....c606......bd....e8....c606......bf....bd....e8....bd....c606......bf")) {
        sOptions = "by romanoid";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_FromBAT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "FromBAT");

function detect() {
    if (Binary.compare("e9$$$$be....bf....bb....c604..b9....fe04803c..77..c644....b80629cd21be....3c..74..8a04880743e2")) {
        sOptions = "1991 by Clockwork Software";
        bDetected = true;
    }
    if (Binary.compare("e9$$$$fcbe....bf....bb....c604..b9....fe04803c..77..c644....b80629cd21be....3c..74..8a04880743e2")) {
        sName = "BatchMaster";
        sOptions = "1993 by Clockwork Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_MAKEBOO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "MAKEBOO");

function detect() {
    if (Binary.compare("'XPHPD[0GG0G,0G51G31GB'27'(G+(G:u'27'0g?(G>(GE1G@arwIV_F*=US@<1|_,5wXNg-7muTu(4'")) {
        sOptions = "executable2text";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/COM/converter_NetCode.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "NetCode");

function detect() {
    if (Binary.compare("'T_OOWW3=XXWX5 2PY5w3P_-l.P-KD1Ep-OLPZ-pJP-pw40PQX5fsPu'")) {
        sVersion = "1.11";
        sOptions = "by JauMing Tseng //Nide";
        bDetected = true;
    } else if (Binary.compare("':?7%00%CCPY-@=PZ5+")) {
        sVersion = "1.40";
        sOptions = "by JauMing Tseng //Nide";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_NetRun.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "NetRun");

function detect() {
    if (Binary.compare("'XPPPYZIQD[L-f6-g41GDSXu'17'@,~P^P_O,!(GU(GZ(Gnu5'")) {
        sVersion = "3.10";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_TurboBAT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "TurboBAT");

function detect() {
    if (Binary.compare("ba....b4..909006b8....8ec0b9....268a26....80e4..26a0....24..3ac4")) {
        sVersion = "3.10";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcbd....8b6e..8b66..8b5e..b4..cd21a1....8946..b8....50c646....8b5e..ffe3")) {
        bDetected = true;
    } else if (Binary.compare("9090909090909006b8....8ec0b9....268a26....80e4..26a0....24..3ac474..26a0....24")) {
        sOptions = "unregistered";
        bDetected = true;
    } else if (Binary.compare("ba....b4..cd2106b8....8ec0b9....268a26....80e4..26a0....24..3ac474..26a0....24")) {
        sVersion = "3.16-9u";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_Vacsina.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "Vacsina EXE2COM");

function detect() {
    if (Binary.compare("e9$$$$e8....5b508cc005....8b0e....894f..8b0e....03c8894f..8b0e....894f..8b0e....03c8894f..8b3e....8b16")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/converter_XCK2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "XCK2COM");

function detect() {
    if (Binary.compare("e9$$$$be....e8....ad89c15156e8....be....e8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_Anti-Lamer_Cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Anti-Lamer Cryptor");

function detect() {
    if (Binary.compare("e9$$$$fa8cd3ba....8ed233d28ed38bdafb33c08ec026f716....eb")) {
        sVersion = "1.0";
        sOptions = "1999 by Ozzman //iHC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_CSCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "CSCRYPT");

function detect() {
    if (Binary.compare("e9$$$$e8000059eb$$cceb$$e4..bb....ba....eb$$81eb....0c..2bcb")) {
        sVersion = "3.30";
        sOptions = "by Christian Schwarz";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_EXINCT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "EXINCT");

function detect() {
    if (Binary.compare("e8$$$$ba....b8....cd218bd8b8....33c933d2cd2191b4..cd218bdc8b072d....89078bf05603f183ee..8904")) {
        sOptions = "by Razor 1911";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_J0B_cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "J0B cryptor");

function detect() {
    if (Binary.compare("e9$$$$fabe....8d0e....2bcee8$$$$5051ba....8bda301cac32c35183c4..b9")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....e8$$$$5052ac8a26....28e00ac0")) {
        sOptions = "1996";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_PU-Cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "PU-Cryptor");

function detect() {
    if (Binary.compare("e9$$$$fce8$$$$068cc8a3....b0..bf....b9....263005fec047e2")) {
        sOptions = "1994";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcb0..bf....b9....300547e2")) {
        sOptions = "1992";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcb0..bf....b9....263005fec047e2")) {
        sOptions = "1994";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcbc....e8$$$$068cc8a3....b0..bf....b9....263005fec047e2")) {
        sOptions = "1994";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bc....fce8$$$$068cc8a3....b0..bf....b9....263005fec047e2")) {
        sOptions = "1994";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_Phrozen_Crew_cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Phrozen Crew cryptor");

function detect() {
    if (Binary.compare("e9$$$$eb$$be....8b3c83ef..578bf781c6....83c6..bf....a5a55f83ef..5733f6bd....33c9300a414f8bf175..5f83ff..74")) {
        sOptions = "1998";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_SDW.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Shadow Com Cryptor (SDW)");

function detect() {
    if (Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....75..e8")) {
        sVersion = "1.7X";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    } else if (Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....74..50584c4c5b33c3")) {
        sVersion = "1.78";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ac2d....04..89c5e8....f514..f9362633f6")) {
        sVersion = "1.79";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e9$$$$e4..e8....e4..e9$$$$26fb78")) {
        sVersion = "1.7";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    } else if (Binary.compare("b8....bd....2e8a76..80f6..80ee..2e8876..83c5..4874..eb")) {
        sVersion = "1.80";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    } else if (Binary.compare("be....31d281c2....2e8034..83ee..83c2..74..31c005....50c3")) {
        sVersion = "1.80";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_Sydex.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Sydex cryptor");

function detect() {
    if (Binary.compare("eb$$ba....b8....bb....33ed8bf8434f505952494748542053..4445582c..414c4c")) {
        sOptions = "1987 by Sydex and C.P.Guzis";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....b8....bb....33ed8bf8434f505952494748542053..4445582c..414c4c")) {
        sOptions = "1987 by Sydex and C.P.Guzis";
        bDetected = true;
    } else if (Binary.compare("e9$$$$33c09e8bd88bc88bd08be88bf08bf88cc88ed88ec08ed08d26....8d36")) {
        sOptions = "1986,1987 by Sydex and C.P.Guzis";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_UComCry.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "UComCry");

function detect() {
    if (Binary.compare("e9$$$$6006fae4640c40e664b8....8ec026c706")) {
        sOptions = "by UniquE";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_USCC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Shitty COM Cryptor");

function detect() {
    if (Binary.compare("e9$$$$60bb....b9....300f43e2")) {
        sVersion = "1.4";
        sOptions = "by UniquE";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/cryptor_cryptors.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Cryptor");

function detect() {
    if (Binary.compare("e9$$$$60c704....c644....b9....bf....ac32018bd64a")) {
        sVersion = "0.04";
        sOptions = "by SkullC0DEr";
        bDetected = true;
    } else if (Binary.compare("e9$$$$60c704....c644....e8$$$$5f83c7..33dbb9....8a043201")) {
        sName = "crypt 95-97";
        sOptions = "type 2 by SkullC0DEr";
        bDetected = true;
    } else if (Binary.compare("e800005dbf....e8$$$$fa065733ff57078d76..b9....8004..46e2")) {
        sOptions = "by Synopsis";
        bDetected = true;
    } else if (Binary.compare("eb$$fdbf....ba....33c01e8ed8a3....1fb1..525e3bfa74..ac3205aae2..eb")) {
        sOptions = "by Min-Jei-Chen";
        bDetected = true;
    } else if (Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....eb$$ad2ea3....2e3136....8bc18bdef7e3eb$$2e3106....2e3116....2ea1....abe2")) {
        sOptions = "by PHOENiX";
        bDetected = true;
    } else if (Binary.compare("5053515756b8....508bf0b9....b0..8bfe0004f71404..46e2")) {
        sOptions = "by FalCoN'AleX";
        bDetected = true;
    } else if (Binary.compare("40429c58f6c4..74..eb....b4..be....bf....b9....68....68....68....57f3a4c3")) {
        sOptions = "by Terrible BloodSucker //FDs Group";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2")) {
        sName += ' N1';
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    } else if (Binary.compare("be....b9....ac03d8e2..81fb....74..cd19be....8bfeb9....8a26....ac32c1aae2")) {
        sOptions = "by Kai";
        bDetected = true;
    } else if (Binary.compare("eb$$c606......f873..e9$$$$be....bf....0633c08ec0bb....fa268b07268917a3")) {
        sName += ' N2';
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800002e9c589e72..fa9cfc505393584c4c3bc35b74..9de8....32e480c4")) {
        sOptions = "by Digital Information Pirates Group (DiPG)";
        bDetected = true;
    } else if (Binary.compare("'PHROZEN'fa'CREW'0d....fbfdbe....ac300481fe....77..94")) {
        sOptions = "by Phrozen Crew";
        bDetected = true;
    } else if (Binary.compare("0e1fb9....be....80....301c46e2..eb")) {
        sOptions = "by Dwolf //ROK";
        bDetected = true;
    } else if (Binary.compare("2e8036....28eb00c3")) {
        sName += " #2";
        sOptions = "by Misha";
        bDetected = true;
    } else if (Binary.compare("be....e8$$$$5d8bce8d72..bf....fd5747acaa86c4ac32c4aae2..8d75..fcf98d7e..c3")) {
        sOptions = "by TGT";
        bDetected = true;
    } else if (Binary.compare("e9$$$$33dbb9....d1e941b8....8b97....33c28987....924343e2..68....c3")) {
        sOptions = "by hijaq";
        bDetected = true;
    } else if (Binary.compare("e9$$$$0e179c58f6c4..75..b9....b8....2bc8bf....be....8a0551b9....8ae0862432c44ee2..88054759e2..e9")) {
        sOptions = "1996 by WildRover";
        bDetected = true;
    } else if (Binary.compare("668d3e....66b9........678137....6683c7..e2..e9")) {
        sOptions = "by PCY group";
        bDetected = true;
    } else if (Binary.compare("e9$$$$66b8........66a3....be....8bfeb9....fcad35....f7d0abe2..68....c3")) {
        sOptions = "by Evil Genius //rPG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$9cfafc1e06bb....b44acd21b448bb....cd218ec0be....b9....51bf....57f3a5061fb9....5e8bfe")) {
        sOptions = "by AliS S0fT //VCrT";
        bDetected = true;
    } else if (Binary.compare("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d")) {
        sVersion = "#2";
        sOptions = "by RAZOR 1911";
        bDetected = true;
    } else if (Binary.compare("'SNOWPANTHER'e9$$$$................8db7....bf....b9....f3a58db7....538ccf83c7..ad09c074..91ad")) {
        sName += " #1";
        sOptions = "by Snow Panther //DTG";
        bDetected = true;
    } else if (Binary.compare("fcbe....bf....b9....90ba....c606......90ac0fb61e....03da8a2732c4aafe06....803e......75..c606")) {
        sOptions = "by pASkuda";
        bDetected = true;
    } else if (Binary.compare("e9$$$$50538bdc8cd0bc....8ed49090909090909090909090909090909033e48ed4bc....909090909090909090909090909090908ed08be35b58c606")) {
        sOptions = "by Crack Soft";
        bDetected = true;
    } else if (Binary.compare("e9$$$$16179c58f6c4..74..faeb..e8$$$$58")) {
        sVersion = "1.0";
        sOptions = "1999 by Alex";
        bDetected = true;
    } else if (Binary.compare("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35")) {
        sOptions = "by DREAMMASTER";
        bDetected = true;
    } else if (Binary.compare("b8....ffe0")) {
        var nOffset = Binary.readWord(1) - 256;
        if (Binary.compare("be....8be88bd88bf883c5..908bd04a5287d687fe5981e9....52", nOffset)) {
            sOptions = "by BlackLight, MANtiCORE";
            bDetected = true;
        }
    } else if (Binary.compare("'FALCON//TULACREW'0d....e9$$$$be....b9....33c0f7d03004eb..04..32e046e2")) {
        sOptions = "by FALCON //UCL";
        bDetected = true;
    } else if (Binary.compare("bb....b9....be....301c02df86df46e2")) {
        sName += " #1";
        sOptions = "by dR.No";
        bDetected = true;
    } else if (Binary.compare("be....b9....b8....bb....33c34086c44b86fb93300446e2")) {
        sName += " #2";
        sOptions = "by dR.No";
        bDetected = true;
    } else if (Binary.compare("a3....eb$$5351525756b9....fa8bdc8cd2bc....03e1d1e94c4c5886e9d3c033c186e9f7d050e2")) {
        sOptions = "by venus soft.";
        bDetected = true;
    } else if (Binary.compare("e9$$$$3aac....3a29fc1aa8....80cd..1e0e0e1f0726fe06....ba....be....81f6....80f9")) {
        sName += " #1";
        sOptions = "by LiGHt DRUiD //SOS";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fd1e0e81de....89f63bf23aaf....03f423f61bf40a2d80f9..18dd0e071f03f433f081e6")) {
        sName += " #2";
        sOptions = "by LiGHt DRUiD //SOS";
        bDetected = true;
    } else if (Binary.compare("fcbe....8bfeac3206....8006......84c0aa75..be....e8")) {
        sOptions = "by Sludge Vohaul //DAT";
        bDetected = true;
    } else if (Binary.compare("'[HPA]'b5..8bf98be9be....57f3a4c3")) {
        sOptions = "by Hungarian Pirates Alliance [HPA]";
        bDetected = true;
    } else if (Binary.compare("bc....bb....b4..cd21bb....b9....8037..43e2..b409ba....cd21b8....cd21891e")) {
        sOptions = "by .EXEcutor //SOS";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005b8bcc8cd2fa33c08ec08ed0bc....588947..90588947..900e8bc305....508ed28be1fb")) {
        sOptions = "1998 by Demon Magister Protection";
        bDetected = true;
    } else if (Binary.compare("eb$$2ea3....8cc82e0306....502eff36....cb")) {
        sOptions = "1991 by YMI";
        bDetected = true;
    } else if (Binary.compare("53515256570633c08ec0fa26a1....268b16....fb075052b8....06508cca33c08ec058fa26a3....268916....fb07")) {
        sOptions = "1991 by Elisoft";
        bDetected = true;
    } else if (Binary.compare("b8....5650c3")) {
        var nOffset = Binary.readWord(1) - 256;
        if (Binary.compare("bf....8bdeb9....8b0533c689074747434346e2..c3", nOffset)) {
            sOptions = "by PC0R$AiR //UCL";
            bDetected = true;
        }
    } else if (Binary.compare("908cc8515a54e9$$$$36c0e0..eb$$eb$$6a..e8$$$$58eb$$e8$$$$58eb$$e8$$$$eb$$2eeb$$eb$$665eeb$$eb$$7c")) {
        sName = "Rowdy's Strong Protection {MtE}";
        bDetected = true;
    } else if (Binary.compare("0f011e....fbe9$$$$e90000c0c3..f8eb$$6a..c0e9..e800000f23dae8000059665e36e8")) {
        sName = "Rowdy's Strong Protection {MtE}";
        bDetected = true;
    } else if (Binary.compare("fa499033c0fbe9$$$$e800005eeb")) {
        sName = "Rowdy's Strong Protection";
        bDetected = true;
    } else if (Binary.compare("e9$$$$5060bf....c706........c605..e8....5e5681c6....b9....5756ffe7")) {
        sOptions = "1998 by StrangeLion";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5f87f757b9....ac34..aae2..c3")) {
        sName = "Wumpus soft lab cryptor";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5eb9....ac32c12e8844..e2..e9")) {
        sOptions = "by MXL //RIP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8d36....fd8d0e....81e9....d1e9add1c835....8944..e2..ff26")) {
        sOptions = "1989 by Sydex";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bb....b4..b0..8b0e....8a1728c230e28857..43fec0e2")) {
        sOptions = "1999 by SLine";
        bDetected = true;
    } else if (Binary.compare("'(C)1997'00'by'00'PSH'0d0a..005b..3139287a..2850..81c6....33db8bfeb9....ad35")) {
        sOptions = "1997 by PSH";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....be....b9....b0..2e8a1c32c132d82e881d4647e2..e9")) {
        sName = "SAGE-crypt";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcb0..bf....b9....263005fec047e2..b9....be....e8")) {
        sName = "PU-Disk encryption";
        sOptions = "1992";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bb....8a073c..74..e8$$$$50515234..3c..74..b4..8ad0cd21e9")) {
        sOptions = "1999 by Leon";
        bDetected = true;
    } else if (Binary.compare("fa'SNOW'fa'PANTHER'fabc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")) {
        sName += " #2";
        sOptions = "by Snow Panther //DTG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$c704....c644....b9....5683c6..8bfeb2..b6..ac32c202d6aae2..c3")) {
        sOptions = "1997 by Ment0R //UCL";
        bDetected = true;
    } else if (Binary.compare("eb$$bb....8b0f03d981c3....8be38cc88ed88ec08ed0b8....ba....cd21b3..ccb3..cc")) {
        sOptions = "1993 by The Shadow Lord";
        bDetected = true;
    } else if (Binary.compare("eb$$ccbe....bb....b2..bf....cc8b0d8bc103c7cc05....83c7..8be0cc")) {
        sOptions = "by The Shadow Lord";
        bDetected = true;
    } else if (Binary.compare("eb$$bb....001f4beb$$001f4beb")) {
        sName = "Crypt.Trivial.173";
        sOptions = "1998 by SMT";
        bDetected = true;
    } else if (Binary.compare("'SFINKS_SOFT___'fafcb430cd21fb33c0502ec606......0783e9..3be175..26c706........b9")) {
        sOptions = "by SFINKS SOFT";
        bDetected = true;
    } else if (Binary.compare("e8$$$$1e33c08ed8f716....eb$$f716....1f5ebf....57b9....ac34..aae2")) {
        sOptions = "by R!SC";
        bDetected = true;
    } else if (Binary.compare("e9$$$$6033edbe....b4..bd....bf....ac32c4aa80c4..fec43bf575..33c0b9....f3ab61bf....ffe7")) {
        sOptions = "by DarkGrey //DSA";
        bDetected = true;
    } else if (Binary.compare("'(C)1997'00'by'00'PSH'............................bc....6081c6....33db8bfeb9....ad35....c1c0..03d8abe2")) {
        sOptions = "1997 by PSH";
        bDetected = true;
    } else if (Binary.compare("eb$$bf....33dbba....fcbe....8bcfccad")) {
        sName += " #3";
        sOptions = "by Misha /ACE";
        bDetected = true;
    } else if (Binary.compare("e9$$$$061e33c08ed8be....8904be....89041e071fb8....bf....268905be....b9....8a04263205")) {
        sOptions = "by SafeSoft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/driver_DIGPAK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("driver", "DIGPAK");

function detect() {
    if (Binary.compare("e9$$$$8cc88ed88ec0e8$$$$1e56be....33c08ed8c5340bf674")) {
        sOptions = "1992 by The Audio Solutions";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8cc88ed88ec0c706........c706........c706........b8....50e8$$$$558bec061e5657fc")) {
        sOptions = "1991 by The Audio Solutions";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/driver_MIDPAK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("driver", "MIDPAK");

function detect() {
    if (Binary.compare("e9$$$$bb....d1ebd1ebd1ebd1eb43b8....cd21fa8cc88ed0bc....fb8ed88ec0c706")) {
        sOptions = "1992 by The Audio Solutions";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/immunizer_ARF_AV_Inject.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "ARF/AV Inject");

function detect() {
    if (Binary.compare("e9$$$$b8....50558bec83c4..061e90c746......c746......c646....c746......c746......8b5e..8dbf....b9")) {
        sVersion = "2.4";
        sOptions = "1995 by ARF Enterprises";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/immunizer_CPAV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Central Point Anti-Virus immunizer");

function detect() {
    if (Binary.compare("e9$$$$e9$$$$e8$$$$5b81eb....5051525657558beb2ec686......268e06....061fb9....bf....8bc7fcf2ae26803d..75")) {
        sVersion = "1993";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/immunizer_F-XLOCK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "F-XLOCK");

function detect() {
    if (Binary.compare("e8$$$$505351521e8e1e....33db8b07433d....74..75..43833f..75..4343")) {
        sVersion = "1.16";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/immunizer_IMMUN.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "IMMUN");

function detect() {
    if (Binary.compare("e9$$$$5053515256571e06e8....5e81ee....2e8936....8bfe81c7....2e8b1d2bfb83c7..81ef....8befb430cd21")) {
        sVersion = "1.2r";
        sOptions = "1993 by J.Bleuel";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/immunizer_TAV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Turbo Anti-Virus");

function detect() {
    if (Binary.compare("e9$$$$e9$$$$e800005b81eb....5051525657558beb2ec686......268e06....061f")) {
        sOptions = "by CARMEL Software Engineering";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/immunizer_VSS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Viren Schutz Schild");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$5b81eb....1e065051525354555657061e8bebb430cd2186e03d....73..e9")) {
        sVersion = "1993 by Ralph Roth";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/other_XLOADER.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "XLOADER");

function detect() {
    if (Binary.compare("fc8cdb33c08ec0b8....26a3....268c0e....5052faba....b0..ee42ec")) {
        sVersion = "2.00";
        sOptions = "by CyberMan + ST!LLS0N";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/other_integrity_checker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "integrity checker");

function detect() {
    if (Binary.compare("e9$$$$505351521ea1....8ed829db43833f..75..434389dab8....cd211fb9....ba....72..89c3b4..cd21")) {
        sOptions = "1990-92 by D.A. Martynoff";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_4kZIP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "4kZIP");

function detect() {
    if (Binary.compare("fcb1..e8$$$$8736....b8....d3e0482306....66d32e....280e....77..506633c0ac8a0e....80c1..66d3e0")) {
        sOptions = "by pascal //Digital Nightmare";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_AVPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "AVPACK");

function detect() {
    if (Binary.compare("eb$$8cda0316....3916....73..b409ba....cd21c3")) {
        sVersion = "1.22";
        sOptions = "Andrei Volkov";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_COMPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "COMPACK");

function detect() {
    if (Binary.compare("BE....E8....5D83C5..55505351520E070E1F8BCE8D72..BF....D1E9FD57F3A5")) {
        sVersion = "4.5";
        bDetected = true;
    } else if (Binary.compare("BE....E8....5D83C5..55505351520E070E1F8D72..bf....b9....90fd57f3a58d75..fcf98bfdc3")) {
        sVersion = "4.5?";
        bDetected = true;
    } else if (Binary.compare("BE....E8....5D83C5..555053510E070E1F8BCE8D72..BF....D1E9FD57F3A5")) {
        sVersion = "5.1";
        bDetected = true;
    } else if (Binary.compare("BE....E8....5D83C5..550e1f0e07505351528bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3")) {
        sVersion = "4.5";
        bDetected = true;
    } else if (Binary.compare("be....0e530e520e070e1fe800005d8bce8d72..bf....d1e9fd57f3a58d75..fcf98d7e..c3")) {
        sVersion = "4.4";
        sOptions = "1990";
        bDetected = true;
    } else if (Binary.compare("be....505351520e070e1fe800005d8bce8d72..bf....d1e9fd57f3a58d75..fcf98d7e..c3")) {
        sVersion = "4.4";
        sOptions = "1990";
        bDetected = true;
    } else if (Binary.compare("BE....E8....5D83C5..558bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3")) {
        sVersion = "4.5?";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/COM/packer_Cheat_packer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Cheat packer");

function detect() {
    if (Binary.compare("eb$$b9....ba....bf....bb....b8....be....83ec..8becfc8866..32e48976..8bf703c18bf83bfe76..fd574e4f")) {
        sOptions = "1993 by TWIN of TRSi";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_Compressor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Compressor");

function detect() {
    if (Binary.compare("eb$$8cc8488ec026813e........72..05....8ec0be....ba....33ffb9....b0..f3aa")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_CyberWare_Packer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "CyberWare Packer");

function detect() {
    if (Binary.compare("565056fd8bfc83ef..b9....be....fea447ffe7")) {
        sOptions = "1997";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_Diet.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Diet");

function detect() {
    if (Binary.compare("bf....3bfc72$$fdbe....b9....f3a5fc8bf7bf....adad8be8b2..e9")) {
        sVersion = "1.00";
        sOptions = "modified";
        bDetected = true;
    } else if (Binary.compare("bf....3bfc72$$be....b9....fdf3a5fc8bf7bf....adad8be8b2..e9")) {
        sVersion = "1.00, 1.00d";
        bDetected = true;
    } else if (Binary.compare("......bf....b9....3bfc72$$fdf3a5fc8bf7bf....adad8be8b2..e9")) {
        sVersion = "1.02b, 1.10a";
        bDetected = true;
    } else if (Binary.compare("......bf....b9....3bfc72$$31dbeb$$fdf3a5fc8bf7bf....adad8be8b2..e9")) {
        sVersion = "1.20";
        bDetected = true;
    } else if (Binary.compare("f99ceb$$55061e575652515350e8$$$$59b1..d3e98cc803c18ed88ec0")) {
        sVersion = "1.44/1.45";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_EXC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "EXC");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$5f81fc....72..8745..a3....8a45..a2....fc8db5....bd....8cca")) {
        sVersion = "1.0.0";
        sOptions = "by Kris Heidenstrom";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_ICE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "ICE");

function detect() {
    if (Binary.compare("eb$$be....8bfe8b0e....8b16....b8....50fcad33c2ab8bd0e2")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_LGLZ.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "LGLZ");

function detect() {
    if (Binary.compare("bf....3bfc72$$be....b9....fdf3a4fc8bf746bf....e8")) {
        sVersion = "1.03/04";
        sOptions = "1996";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_PKLITE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PKLITE");

function detect() {
    if (Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")) {
        sVersion = "1.12, 1.20";
        bDetected = true;
    } else if (Binary.compare("B8....BA....3bc473..8bc42d....9025....8bf8b9....90be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")) {
        sVersion = "1.15";
        bDetected = true;
    } else if (Binary.compare("50B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")) {
        sVersion = "1.50";
        bDetected = true;
    } else if (Binary.compare("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")) {
        sVersion = "1.00, 1.03";
        sOptions = "exe2com";
        bDetected = true;
    } else if (Binary.compare("ba....a1....2d....8ccb81c3....3bc377..05....3bc377..b4..ba....cd21cd20")) {
        sVersion = "1.00c";
        bDetected = true;
    } else if (Binary.compare("ba....b8....05....3b06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")) {
        sVersion = "1.1X";
        bDetected = true;
    } else if (Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1")) {
        sVersion = "1.12, 1.15, 1.20";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_PRO-PACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PRO-PACK");

function detect() {
    if (Binary.compare("83ec..8becbe....fce8....05....8bc8e8....8bd003c605....8bf8e8....ad88....32e489....8bf703c18bf83bfe76")) {
        sVersion = "2.08-2.19";
        bDetected = true;
    } else if (Binary.compare("83ec..8becbe....fce8....05....8bc8e8....8bd003c605....8bf8e8....8946..895e..ad8866..32e48976..8bf703c18bf83bfe76")) {
        sVersion = "2.08-2.19";
        sOptions = "-m1, locked";
        bDetected = true;
    } else if (Binary.compare("be....fce8....05....8bc8e8....8bd003c605....8bf883c6..ad32e48bee8bf703c18bf83bfe76")) {
        sVersion = "2.14";
        sOptions = "-m2";
        bDetected = true;
    } else if (Binary.compare("be....fce8....05....8bc8e8....8bd003c605....8bf8e8....5350ad32e48bee8bf703c18bf83bfe76")) {
        sVersion = "2.08-2.19";
        sOptions = "-m2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_SCRE2B.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "SCRE2B");

function detect() {
    if (Binary.compare("8cda0116....ff2e....00")) {
        sVersion = "1.02";
        sOptions = "by Graeme W. McRae";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_SCRNCH.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "SCRNCH");

function detect() {
    if (Binary.compare("eb$$bb....b44acd2181eb....73..ba....b9....e9")) {
        sVersion = "1.02";
        sOptions = "1988 by Graeme W. McRae";
        bDetected = true;
    } else if (Binary.compare("bb....b44acd2181eb....73..ba....b9....e9$$$$0e1fb440bb....cd21b8....cd21")) {
        sVersion = "1.00";
        sOptions = "1988 by Graeme W. McRae";
        bDetected = true;
    } else if (Binary.compare("bb....b44acd2181eb....73..ba....b9....e9$$$$b440bb....cd21b8....cd21")) {
        sVersion = "1.01";
        sOptions = "1988 by Graeme W. McRae";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_SHRINK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "SHRINK");

function detect() {
    if (Binary.compare("509cfcbe....bf....57b9....f3a48b0e....be....bf....f3a4c3")) {
        sVersion = "1.0";
        sOptions = "by Thomas G. Hanlin";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_Scramb.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Scramb");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$5b0e1f81eb....8bc305....508bc803d12bfac3")) {
        sVersion = "1.20";
        sOptions = "by B.U.G.";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8....5b0e1f81eb....8bc305....508bc803d12bfac3")) {
        sVersion = "1.20";
        sOptions = "by B.U.G.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_Six-2-Four.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Six-2-Four");

function detect() {
    if (Binary.compare("'[ESP]'b5..8bf98be9be....57f3a4c3")) {
        sVersion = "1.1";
        sOptions = "Boogie //ESP";
        bDetected = true;
    } else if (Binary.compare("'PULP'83c4..fcbf....be....b5..57f3a5c3")) {
        sVersion = "1.0";
        sOptions = "Kimmy //Pulp";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_TPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "TPACK");

function detect() {
    if (Binary.compare("03'TUSCON'030d0a005868....60e9")) {
        sVersion = "0.5c";
        sOptions = "1996 by Max //TUSCON";
        bDetected = true;
    } else if (Binary.compare("68....fd60be....bf....b9....f3a48bf7bf....fc46e9")) {
        sVersion = "0.55c";
        sOptions = "1996 by Max //TUSCON";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_Triplex.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Triplex");

function detect() {
    if (Binary.compare("bd....be....5553525a5b505351520e1f0e078bce8d72..bf....d1e9fd57f3a5")) {
        sOptions = "1994";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_UPX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "UPX");

function detect() {
    if (Binary.compare("b9....be....bf....fdf3a4fcf7e19387f783ee..19ed57")) {
        sVersion = "0.50";
        sOptions = "dos/com";
        bDetected = true;
    } else if (Binary.compare("81fc....77..cd20b9....be....bf....bb....fdf3a4fc87f783ee")) {
        sVersion = "0.81-1.20";
        sOptions = "dos/com";
        bDetected = true;
    } else if (Binary.compare("b9....be....bf....bd....fdf3a4fcf7e19387f783c6..57e9")) {
        sVersion = "0.30-0.40";
        sOptions = "dos/com";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_X-PACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "X-PACK");

function detect() {
    if (Binary.compare("bd....be....bf....b8....99fcfa33c9e9$$$$8bd9ffd5")) {
        sOptions = "by Jari Kytojoki";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_XE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "XE");

function detect() {
    if (Binary.compare("be....56bf....b9....fc56f3a55fe9")) {
        sVersion = "1.42";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_XPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "XPACK/LZCOM");

function detect() {
    if (Binary.compare("e9$$$$fa8bece8....06bf....57e8....06b8....50be....bf....cb")) {
        sVersion = "1.67";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fa8bece8....fb06bf....57e8....06b8....50be....bf....cb")) {
        sVersion = "1.67.1";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8cc805....8ec0bf....8bf7fcb9....f3a506b8....50cb")) {
        sVersion = "1.65";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8cc8a3....05....8ec0bf....8bf7fcb9....f3a506b8....50cb")) {
        sVersion = "1.4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_aPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "aPACK");

function detect() {
    if (Binary.compare("be....bf....8bcffc57f3a4c3")) {
        sVersion = "0.98-0.99 small";
        bDetected = true;
    } else if (Binary.compare("8cc880c4..8ec0fcb9....be....8bfe57f3a55fbe....0668....1e078ed8cb")) {
        sVersion = "0.82b-0.94b";
        bDetected = true;
    } else if (Binary.compare("8cc805....8ec0598ed051be....bf....5057fcb2..bd....50a4ffd5")) {
        sVersion = "0.61";
        bDetected = true;
    } else if (Binary.compare("8cc805....8ec0598ed051be....bf....5057fcb6..bd....ffd5")) {
        sVersion = "0.58-0.74";
        bDetected = true;
    } else if (Binary.compare("8cc880c4..8ec0fcb9....be....8bfe57f3a55fbe....06ba....521e078ed8cb")) {
        sVersion = "0.82-0.94";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_com_RLE_packer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "com RLE packer");

function detect() {
    if (Binary.compare("60be....bf....8b0e....f3a4be....bf....57b9....f3a4c3")) {
        sOptions = "by NOP/PC";
        bDetected = true;
    } else if (Binary.compare("fc8cc833ff05....8ec006be....b9....57f3a40e07cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/packer_envelope.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "envelope");

function detect() {
    if (Binary.compare("60ba....3bd472$$be....8bfeb9....bb....fcad33c343abe2")) {
        sOptions = "by ROWDY, St.Petersburg";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_ABK-Scrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ABK-Scrambler");

function detect() {
    if (Binary.compare("b430cd2186e03d....73..cd209c06b8....50cf")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_ACE_Scrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "A.C.E. Scrambler");

function detect() {
    if (Binary.compare("2c..fec024..34..fec824..34..bb....0c..eb$$24..0c..81eb....f6d8eb$$2c..fec0ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("24..0c..f6d8eb$$fec8bb....04..0c..f6d804..fec0f6d881eb....24..f6d8fec034..0c..04..2c..ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("34..fec834..0c..24..04..fec0bb....0c..2c..0c..81eb....eb$$fec0f6d82c..fec0f6d80c..ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("24..fec82c..bb....fec8f6d8eb$$04..81eb....0c..fec0fec80c..34..ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("24..eb$$04..bb....f6d834..fec8fec0eb$$0c..81eb....34..24..34..eb$$ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("34..fec804..24..0c..04..bb....0c..04..f6d881eb....0c..fec8f6d824..0c..ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("f6d834..2c..bb....0c..34..fec004..34..fec004..81eb....2c..34..24..eb$$04..2c..04..ffe3")) {
        sOptions = "1996";
        bDetected = true;
    } else if (Binary.compare("fec0eb$$24..34..bb....f6d834..fec024..fec0f6d834..81eb....f6d80c..eb$$04..ffe3")) {
        sOptions = "1996";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_AVAST-Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "AVAST-Protect");

function detect() {
    if (Binary.compare("eb$$8cc82e0306....502eff36....cb")) {
        sOptions = "1999 by P.Baudis";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_AdFlt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "AdFlt");

function detect() {
    if (Binary.compare("68....9c0fa00fa860fd6a..0fa1be....ad6664ff36....648b16....643106....6664ff36....648916....adff36")) {
        sVersion = "2.0";
        sOptions = "by EliCZ";
        bDetected = true;
    } else if (Binary.compare("9c0fa06660fd6a..0fa1be....ad6664ff36....648b16....668f06....643106....6664ff36....648916....668f06....adff36")) {
        sOptions = "by EliCZ";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Adys_COM-Scrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Ady`s COM-Scrambler");

function detect() {
    if (Binary.compare("33c08ed88ec0fcfabe....8bfead2ea3....ad2ea3....b8....ab8cc8ab")) {
        sOptions = "1993";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Anti-hack_encryption_system.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Anti-hack encryption system");

function detect() {
    if (Binary.compare("eb$$bd....33c08ec026c706........268c0e....8b46..26a3....268c0e....0e07")) {
        sOptions = "by Rezaul Kabir //Shuvro";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_BIN-Lock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "BIN-Lock");

function detect() {
    if (Binary.compare("eb$$31c08ec026c706........268c0e....26c706........268c0e....2ec706........2e8c0e....cccd01eb")) {
        sVersion = "1.00";
        sOptions = "by Hit-BBS Programmers crew";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Best_Protection_Kit-B.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Best Protection Kit-B");

function detect() {
    if (Binary.compare("eb$$fc8c06....e421a2....b0..e621fb33c08ed08be0be....8d3e....b9")) {
        sOptions = "1993 by Eric Zmiro";
        bDetected = true;
    } else if (Binary.compare("eb$$fc8c06....e421a2....b0..e621fbf433c08ed08be0be....8d3e....b9")) {
        sOptions = "1992 by Eric Zmiro";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_BinCOD.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "BinCOD");

function detect() {
    if (Binary.compare("e9$$$$60fa6a000726ff36....26ff36....26c706........26c706........fbb9....bf....03f9ac")) {
        sVersion = "1.1";
        sOptions = "by SierraMan";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Budokan.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Budokan");

function detect() {
    if (Binary.compare("bf....b9....8bc1fd3305abe2..e9")) {
        sOptions = "by Electronic Arts, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_C-crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "C-crypt");

function detect() {
    if (Binary.compare("e9$$$$e800005d83ed..55d9d09c5825....509d5057bf....b0..aa5f58665166b9........cc")) {
        sVersion = "1.02";
        sOptions = "by De'FeinD //uCT";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CC#3.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CC#3");

function detect() {
    if (Binary.compare("e9$$$$e800005d33db8bc3bf....893f81c3....532eff36....1f1e568d76..8bfbb9....f2a4c6")) {
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CC");

function detect() {
    if (Binary.compare("b8....ba....3be073..b409ba....cd21b8....cd218bdc81eb....83e3..fcbe....8bfbb9....f3a48bc3b1..d3e88cc903c15033c050cb")) {
        sVersion = "1.0";
        sOptions = "1991 by B.Vorontsov";
        bDetected = true;
    } else if (Binary.compare("ba....b430cd213c..73..33c00650cbb9....b8....eb$$05....fc80c4..eb")) {
        sVersion = "2.61 Beta";
        sOptions = "by UniHackers";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....be....8bfe5156b4..ac32c4c0c4..02e1aae2..bf....5e59f3a4be....56c3")) {
        sVersion = "1.01";
        sOptions = "by B.Vorontsov";
        bDetected = true;
    } else if (Binary.compare("bf....be....b9....fdf3a5fc8bf7bf....adad8be8b2..e9")) {
        sVersion = "1998";
        sOptions = "by B.Vorontsov";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CC286.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CC286x2");

function detect() {
    if (Binary.compare("e9$$$$eb$$e800005d81ed....eb$$bf....eb$$b0..eb$$e664eb$$b0..eb$$aaeb$$4f8d9e....eb$$538bdf")) {
        sVersion = "2.1";
        sOptions = "by Dark Stalker //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CCC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CCC");

function detect() {
    if (Binary.compare("e9$$$$e800005b8b4c..501736890e....8b47..1347..3347..2b47..36a3....83c6..b9....8b7f..037f..ac363006")) {
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005b8b4c..501736890e....8b47..3347..36a3....83c6..b9....8b7f..037f..ac363006")) {
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CHECKPRG.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CHECKPRG");

function detect() {
    if (Binary.compare("33c0be....8bd8b9....bf....ba....474a74..ac320503d8e2")) {
        sOptions = "1992 by Jordi Mas Hernandez";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CNT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CNT");

function detect() {
    if (Binary.compare("'CNT'58e8$$$$5e8b4c..bf....ac3306....3306")) {
        sOptions = "by C0NTRiVER";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_COM-Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COM-Protect");

function detect() {
    if (Binary.compare("e9$$$$8b1e....83eb..b8....5053b430cd215b9ceb")) {
        sOptions = "1995 by Mr.Wicked";
        bDetected = true;
    } else if (Binary.compare("e9$$$$565699521fe8....5d8d86....0e508f06....8f06....83c6..565f0e1fb9....b8....a3")) {
        sOptions = "1994 by SiAC";
        bDetected = true;
    } else if (Binary.compare("2e8006......eb00c3")) {
        sOptions = "1994 by Misha //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_COM-Protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COM-Protection");

function detect() {
    if (Binary.compare("e9$$$$eb$$86c08ec086dbeb$$05....87db8b2e....97eb$$aaaaeb$$aaaaeb$$bb....03ddb9....03cd87cbb8")) {
        sOptions = "by JAM //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_COMCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ComCrypt");

function detect() {
    if (Binary.compare("e9$$$$b9....be....89f70e1f0e07bb....fcad31d8abe2")) {
        sOptions = "1997 by HPA"
        bDetected = true;
    } else if (Binary.compare("e9$$$$eb$$5053575152061e572e8b36....81c6....8a5c..2e881e....8a5c")) {
        sVersion = "1.0b";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....be....89f7fcac04..aae2..b8....bf....abb0..aab8....5033c0c3")) {
        sOptions = "1997 by HPA"
        bDetected = true;
    } else if (Binary.compare("b8....ffe0")) {
        if (Binary.compare("bb....b9....33c02e802f..43e2", Binary.readWord(1) - 0x100)) {
            sOptions = "by Stone"
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/COM/protector_COMPROTECT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COMPROTECT (RCP)");

function detect() {
    if (Binary.compare("b8....15....72..8ac4bb....50515253555657061e50b8....58eb")) {
        sVersion = "2.10";
        sOptions = "1988-95 by Ralph Roth";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_COP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COP");

function detect() {
    if (Binary.compare("bf....be....b9....ac3206....aae2")) {
        sVersion = "1.0";
        sOptions = "by Jack A. Orman";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CodeLock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CodeLock");

function detect() {
    if (Binary.compare("e9$$$$bb....535856535981e9....31ff575a5dbe....e9")) {
        sVersion = "4.0";
        sOptions = "1993 by Dr. Detergent";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b430cd213c037d$$068e06....061f31c0505e565fae")) {
        sVersion = "3.0";
        sOptions = "1993 by Dr. Detergent";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Codesafe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Codesafe");

function detect() {
    if (Binary.compare("e9$$$$5033c08ec02ef606......74..26ff36....061e07e8....07268f06....fb2e8c1e....26ff36....268f06")) {
        sOptions = "by EliaShim Ltd";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_ComProt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ComProt");

function detect() {
    if (Binary.compare("e9$$$$e800005e8bee81ed....8db6....b9....f61446e2")) {
        sVersion = "1.0b";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_ComProtector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ComProtector");

function detect() {
    if (Binary.compare("e9$$$$b9....bb....bf....2e8a0734..fec8c0c0..2e88052e000d2e002d4743e2")) {
        sVersion = "1.0";
        sOptions = "1998 by Marco Ruhmann";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....e800005b83c3..90fa8bd48be133c02e030e....2ec007..0f23f82e2b0e....2e300f0f23d8")) {
        sVersion = "1.1";
        sOptions = "1998 by Marco Ruhmann";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Comlock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Comlock by Trouble Makers");

function detect() {
    if (Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bc82e300446ffc0e2")) {
        sVersion = "0.10";
        bDetected = true;
    } else if (Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bcb2e300446fec0e2")) {
        sVersion = "0.10";
        bDetected = true;
    } else if (Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....8bcbbe....2e3004fec046e2")) {
        sVersion = "0.1X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CrAcKeR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CrAcKeR");

function detect() {
    if (Binary.compare("eb$$be....8bfe5633c0be....ac02e081fe....72..5eac34..aa81fe....72")) {
        sVersion = "0.2a";
        sOptions = "by Deu$";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Crack2EXE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Crack2exe");

function detect() {
    if (Binary.compare("b9....bf....8035..47e2..be....8034..46803c..75..be....e8....be....e8....be....e8....bd")) {
        sName += "/486";
        sVersion = "0.02 Alfa";
        sOptions = "1996 by Professor Nimnul";
        bDetected = true;
    } else if (Binary.compare("b9....bf....8035..47e2..d7aa6de9")) {
        sVersion = "0.02";
        sOptions = "(crypted) 1996 by Professor Nimnul";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_CryptCom.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CryptCom");

function detect() {
    if (Binary.compare("e9$$$$be....56b9....c704....c644....8134....4646e2..31f631c9c3")) {
        sVersion = "2.0";
        sOptions = "by Nowhere Man";
        bDetected = true;
    } else if (Binary.compare("bf....57be....90b9....f3a4c3")) {
        sVersion = "1.1";
        sOptions = "by Frank Baumgartner";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Crypto-King.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Crypto-King");

function detect() {
    if (Binary.compare("bf....be....57b9....f3a4c3")) {
        sVersion = "1.08";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_DCFR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "DCFR");

function detect() {
    if (Binary.compare("b8....ba....3bc4eb$$72$$5250b9....bb....8b0733c140890743e2")) {
        sVersion = "0.0.4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_DS-CRP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "DS-CRP");

function detect() {
    if (Binary.compare("b8....50c3")) {
        var nOffset = Binary.readWord(1) - 256 + 8;
        if (Binary.compare("e800005d81ed....9c32e4509d9c5880e4..80fc..74..b4..509d9c5880e4..74..9deb", nOffset))
            sVersion = "1.30";
        sOptions = "by Dark Stalker //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Deeper.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Deeper");

function detect() {
    if (Binary.compare("90e9$$$$e8000059fa8bdc36c747......36837f....75..fb66fafb8be981ed....81e9....be....8dbe....668b05668904")) {
        sVersion = "1.0c";
        bDetected = true;
    }
    if (Binary.compare("90e9$$$$e80000fa8bdc36c747......36837f....75..fb598be981ed....81e9....be....8dbe....668b05668904")) {
        sVersion = "1.0a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_E2C-Scrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "E2C-Scrambler");

function detect() {
    if (Binary.compare("e9$$$$fabc....c1ea..8ccd03ea8ec5bf....be....b9....bb....fdac320702c1d2c002c5aa4381fb....75..bb....e2")) {
        sOptions = "1999 by Amokk //FTW";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_E2C1.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "E2C protection");

function detect() {
    if (Binary.compare("bc....33c050b8....50ba....b8....cd21b8....cd21bf....be....b9....9081ff....74..8a050204aa46e2..eb")) {
        sOptions = "1990 by Erik Labs";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_EPW.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EPW");

function detect() {
    if (Binary.compare("e9$$$$06571e565552515350bb....81c3....2e8b078ccb03c305....50b8....50cb")) {
        sVersion = "1.2";
        sOptions = "by Aland D. Jones";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_EXETools.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXETools by Dismember");

function detect() {
    if (Binary.compare("68....68....68....be....bf....57b9....f3a4c3")) {
        sVersion = "2.1 /E";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005d8bcd83ed..bf....be....2bcff3a4b9....be....03f5")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (Binary.compare("68....bf....8bf757b9....51b4..ac32c4c0c4..02e102f0aae2..33c0595e5f57eb")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (Binary.compare("68....68....68....be....bf....57b9....f3a4c3")) {
        sVersion = "2.1 /E";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Encriptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Encriptor");

function detect() {
    if (Binary.compare("eb$$b9....be....bf....acd0c8aae2..be....bf....acaa")) {
        sVersion = "1.00c";
        sOptions = "by Dark Stalker //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Entropy_Coder.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Entropy Coder");

function detect() {
    if (Binary.compare("be....bf....b9....fdf3a447fcffe7")) {
        sOptions = "by Sergey Lukashev";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_ExOM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ExOM");

function detect() {
    if (Binary.compare("'EXOM'fabd....ffe5")) {
        sVersion = "0.0X";
        sOptions = "by Abdelaziz BELBACHiR";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_FCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "FCRYPT");

function detect() {
    if (Binary.compare("e9$$$$505351be....bf....8befb9....fcacd0c032c1d0c032c1aae2..595b58ffe5")) {
        sVersion = "2.10b";
        sOptions = "1992-93 by Chip & Dale SoftGroup";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_GOAT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "GOAT");

function detect() {
    if (Binary.compare("5156505253813c....75$$424a81c3....8bdb595e585a5bb4..ba....cd21b8....cd21474f")) {
        sOptions = "1996 by Martin Overton";
        bDetected = true;
    } else if (Binary.compare("50565351b8....807c....74$$8bc0585e5b59b4..ba....cd21b8....cd21474f4154")) {
        sOptions = "1996 by Martin Overton";
        bDetected = true;
    } else if (Binary.compare("56515052807c....75$$81c2....8bc05e59585ab4..ba....cd21b8....cd21474f4154")) {
        sOptions = "1996 by Martin Overton";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Guardian_Angel.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Guardian Angel");

function detect() {
    if (Binary.compare("e9$$$$06fcbe....eb$$ba....eb$$eb$$eb$$8a04eb$$eb$$eb$$d0c8eb$$2ad0eb$$32c6eb$$d1c2eb$$8804eb$$eb$$eb$$4681fe....74")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$06fcbe....8be8e4210c..eb$$e6218bc5ba....8be8e4210c..eb$$e6218bc58a0ceb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$06fcbb....eb$$eb$$eb$$b9....8be8e42102..eb$$e6218bc58a17eb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$06fcbb....8be8e4210c..eb$$e6218bc5ba....eb$$eb$$eb$$8a0f")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$06fcbe....eb$$......eb$$8a..8be8e4210c..eb$$e6218bc5fe")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$06fcbf....8be8e4210c..eb$$e6218bc5bb....eb$$8a05eb$$eb$$eb$$fe")) {
        sVersion = "1.0";
        sOptions = "registered";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005d81ed....9c588bc825....509d9c5825....3d....75..eb")) {
        sVersion = "1.0b";
        bDetected = true;
    } else if (Binary.compare("e9$$$$06fcbb....eb$$ba....eb$$eb")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_HDKPROTC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "HDKPROTC");

function detect() {
    if (Binary.compare("e9$$$$4851442ea1....2d....8bd805....8bf0bf....b9....f3a48bcbd1e9b8....8bf08bf8066a..07268b2e")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_HackStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "HackStop");

function detect() {
    if (Binary.compare("fabe....ffe6")) {
        sVersion = "1.17cr";
        bDetected = true;
    } else if (Binary.compare("fabd....ffe5")) {
        sVersion = "1.13cs";
        bDetected = true;
    } else if (Binary.compare("fabb....ffe3")) {
        sVersion = "1.14s";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_IntroC0der.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "IntroC0der");

function detect() {
    if (Binary.compare("be....b9....8bfeac32c1d2c032c5aae2")) {
        sOptions = "1995 by SkullC0der";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Keygen_crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "KeyGen Crypt");

function detect() {
    if (Binary.compare("e9$$$$e800005d8d7e..575eb9....ad35....abe2")) {
        sVersion = "1.00";
        sOptions = "by Majestic";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Khrome_Crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Khrome Crypt");

function detect() {
    if (Binary.compare("b9....b8....eb$$05....fc80c4..eb$$eb$$f4")) {
        sVersion = "0.3";
        sOptions = "1997 by Teraphy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_LAME_GG.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "LAME GG (PROPHECY protection)");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$5eb9....314c..33c08ee003c605....faeb$$648b1e....899c....648b1e....899c....64a3....648c0e")) {
        sOptions = "1999";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_LAMPROT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "LAMPROT");

function detect() {
    if (Binary.compare("e9$$$$8b0e....be....bf....f3a4b9....bb....8a0734..880743e2..33c033c933db33d233ff33f668....c3")) {
        sOptions = "by gds //FH";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Lock-Master.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Lock-Master");

function detect() {
    if (Binary.compare("e9$$$$eb$$31c0061e502d....501f0726ff77..26ff77..8f87....8f87....ffb7....ffb7....585b29c353bb....5a1f07")) {
        sVersion = "9.0";
        sOptions = "by Andrew Kacy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_MASK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MASK");

function detect() {
    if (Binary.compare("e8$$$$5557cd03fc4d41534bfa8bec836e....8b6e..fb49e8....5b81eb....50d6515256")) {
        sVersion = "2.0";
        sOptions = "1995 by JosB M. L. Lopes.";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5557cd03fc4d41534bfa8bec8346....ff76..5d49e8....5b81eb....50d6515256")) {
        sVersion = "2.4";
        sOptions = "1995 by JosB M. L. Lopes.";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5557cd03fc4d41534bfd50fa8bc4f7dcbc....9449fbd651521f5256")) {
        sVersion = "2.5";
        sOptions = "1995 by JosB M. L. Lopes.";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5557cd03fc4d41534bfa8bec836e....ff76..5d49e800005b81eb")) {
        sVersion = "2.3";
        sOptions = "1995 by JosB M. L. Lopes.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_MCLock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MCLock");

function detect() {
    if (Binary.compare("e9$$$$909090fa29c08ec026c606......26c606......268c0e....26c606......26c606......268c0e....fbcd01")) {
        sVersion = "1.2, 1.3";
        bDetected = true;
    } else if (Binary.compare("e9$$$$eb00e9$$$$909090fa29c08ec026c606......26c606......268c0e....26c606......26c606......268c0e....fbcd01")) {
        sVersion = "1.2, 1.3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_MESS.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MESS");

function detect() {
    if (Binary.compare("....................b9....f326ace3..eb$$ba....b409cd21cd20")) {
        sVersion = "1.07";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_MSCC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MSCC");

function detect() {
    if (Binary.compare("e9$$$$0e07be....bf....b9....f3a4b9....be....accc9803d8e2")) {
        sVersion = "1.0a";
        sOptions = "1997 by Mad $cientist";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_MegaShield.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MegaShield");

function detect() {
    if (Binary.compare("90b8....e72133d252be....bd....b9....ad03d0d3c233c2d3ca2bd0e2")) {
        sVersion = "1.01a";
        sOptions = "by t-REX //PSA";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Microxor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MiCRoXoR");

function detect() {
    if (Binary.compare("e8$$$$bf....5e57b9....300ca4e2..c3")) {
        sOptions = "2000 by Jibz";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_NH.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "NH");

function detect() {
    if (Binary.compare("be....bf....57b9....f3a4c3")) {
        bDetected = true;
        sOptions = "by MANtiC0RE";
    }

    return result();
}

================================================
FILE: db/COM/protector_NoAV.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "NoAV");

function detect() {
    if (Binary.compare("e9$$$$68....60be....66b8........668706....b9....51c1e9..41be....5156bf....e8")) {
        sOptions = "by VAG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Nodebug.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Nodebug");

function detect() {
    if (Binary.compare("e8$$$$b430cd21b4..03f897d6405e50978b4d..ac32c1aae2")) {
        sVersion = "1.0 part 1";
        sOptions = "by JVP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_PCOM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PCOM");

function detect() {
    if (Binary.compare("be....b9....2e8a0434..2e880446e2")) {
        sVersion = "2.8b2, 2.8b3 -e -i";
        sOptions = "1999";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_PCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PCRYPT");

function detect() {
    if (Binary.compare("'PCRYPT'ff'v3.51'00e9")) {
        sVersion = "3.51";
        sOptions = "1997 by MERLiN //DTG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_PCVault-Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PCVault-Protect");

function detect() {
    if (Binary.compare("be....fcac3c..75..e9....ac3c..74..e9....eb")) {
        sOptions = "1993 by E. Johnson";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_PROTECT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PROTECT! COM");

function detect() {
    var nLimit = Math.min(65536, Binary.getSize());
    if (Binary.findSignature(0, nLimit, "0c02e9......e421e9......88e0..........eb....e621e9......88c4........e9......e621eb") != -1) {
        sVersion = "5.5";
        bDetected = true;
    } else if (Binary.findSignature(0, nLimit, "e42150e9......e621e9......58e621e9......b0ffeb") != -1) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....81f2")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bb....81c3....eb")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....81ee....bb....d1cb8b04")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....81ef....eb")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....81ee....bb....d1cb8b04")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....81f7")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....81c2....eb")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bd....81f5....eb")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bd....d1cd")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bb....81f3")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$1efd2efe")) {
        sVersion = "5.5";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005d81ed....33c08ed88bf0bf....b9....fcf3a5fd87fe8cc08ed833c08ec04f4f")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (Binary.compare("e9$$$$1eb430cd213c..73..cd20be....e8....e8....1f8cd88ec0")) {
        sVersion = "6.0";
        bDetected = true;
    } else if (Binary.compare("e8$$$$501e060e550e1f33c08ec0fafc26a1....5026a1....50")) {
        sVersion = "3.0/3.1";
        bDetected = true;
    } else if (Binary.compare("b8....50b8....50e9$$$$c606......eb$$8cc6060b01c3")) {
        sVersion = "2.0";
        sOptions = "1993";
        bDetected = true;
    } else if (Binary.compare("b8....50e9$$$$c606......eb$$8cc6060701c3eb")) {
        sVersion = "1.0";
        sOptions = "1993";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_PTP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PTP");

function detect() {
    if (Binary.compare("'PTP50'fafafcb430cd21fb585c582bc05257502ec606")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (Binary.compare("'PTP40'fafafcb430cd21fb585c582bc05257502ec606")) {
        sVersion = "4.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_PassCOM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PassCOM");

function detect() {
    if (Binary.compare("e9$$$$be....bf....b9....8ae1ac32c402e1aae2..68....c3")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Propellerhead_encryption.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Propellerhead encryption");

function detect() {
    if (Binary.compare("e9$$$$b430cd2180fc..72..90e9....90bb....81c3....53b0..04..51b9....e9")) {
        sOptions = "1997";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_ProtEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ProtEXE (com)");

function detect() {
    if (Binary.compare("e9$$$$9c5053515256571e0655fabe....8a64..8b54..8bda81c3....8c4f..908b0f894c..8a4f..884c..8bfe8bca83e9..fcac")) {
        sVersion = "3.0";
        sOptions = "1996";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_R-Crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "R-Crypt");

function detect() {
    if (Binary.compare("e9$$$$68....60bf....b9....b0..2e3005fec047e2..61c706........c606")) {
        sVersion = "0.91";
        bDetected = true;
    } else if (Binary.compare("e9$$$$68....60bf....b9....b0..2e300547fec0e2..61c706........c606")) {
        sVersion = "0.93";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....57b9....c705....c645....8135....4747e2..33ffc3")) {
        sVersion = "0.92";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_RCC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "RCC II");

function detect() {
    if (Binary.compare("fabc....ffe4")) {
        var nOffset = Binary.readWord(2) - 256;
        if (Binary.compare("83c4..bc....60e8$$$$e8$$$$50b8....58eb", nOffset)) {
            sVersion = "0.51/386";
            bDetected = true;
        }
    } else if (Binary.compare("90bd....ffe5")) {
        var nOffset = Binary.readWord(2) - 256;
        if (Binary.compare("faf7dc87ec83c4..81c4....f7dc83ec..87ecbc....50535251061eb9....b0..e6", nOffset)) {
            sVersion = "1.08h";
            bDetected = true;
        }
    } else if (Binary.compare("fcbe....bf....5657b9....f3a55e5f33db33d2")) {
        sVersion = "1.08h";
        bDetected = true;
    } else if (Binary.compare("e9$$$$9c505351525657551e06fcb8....cd21")) {
        sName = "RCC/286";
        sVersion = "1.10";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_RSCC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "RSCC");

function detect() {
    if (Binary.compare("b1..32ff82c7..b2..b5..b3..81c2....d0c203d133d1f7d232d13097")) {
        sVersion = "1.03";
        bDetected = true;
    } else if (Binary.compare("....82........81......32..80....2b..81")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("....80........81......30..80....30..80")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("32ed80c5..b2..b6..29ff81cf....32c980")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("29ff81f7....33d281f2....31c981c9....f81015a64975..fa53f889ea8944")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("2aed80cd..28c982c1..2ad282ca..bb....81c2....f7da03d102d128174383")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("28ed82cd..2aff82cf..32db80f3..b1..33c081c0....05....d0c033c1f7d002c1f83187")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("30c982f1..29d281ca....be....32ed82f5..81c2....d0c2f7da33d1")) {
        sVersion = "1.03";
        bDetected = true;
    } else if (Binary.compare("32ff82c7..b3..30ed80c5..b1..f88197........4343e2")) {
        sVersion = "1.03";
        bDetected = true;
    } else if (Binary.compare("f5bb....b8....bf....2e8037..81ff....4374..4875..90b5..1f9b")) {
        sVersion = "1.20";
        bDetected = true;
    } else if (Binary.compare("33d281f2....2bdb81f3....b9....3197....83c3..497f..2a142cca3aca")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (Binary.compare("2bc981c1....29d281f2....33db81c3....81c2....291783c3..497f..ab")) {
        sVersion = "1.03";
        bDetected = true;
    } else if (Binary.compare("b9....2bdb81cb....f880b7......434975..55fc532245..ef57f9")) {
        sVersion = "1.03";
        bDetected = true;
    } else if (Binary.compare("bf....8bf7b9....b4..8a0532c480c4..aae2")) {
        sVersion = "1.0X";
        sOptions = "mutated COM like RSCC";
        bDetected = true;
    } else if (Binary.compare("b9....be....8bfeadd1c034..86c42ae003c7abe2")) {
        sVersion = "1.0X";
        sOptions = "mutated COM like RSCC";
        bDetected = true;
    } else if (Binary.compare("fc50be....bf....57b9....f3a4c3")) {
        sVersion = "1.0X";
        sOptions = "mutated COM like RSCC";
        bDetected = true;
    } else if (Binary.compare("eb$$fcbe....bf....57b9....f3a4bf....be....b9....c3")) {
        sVersion = "1.0X";
        sOptions = "mutated COM like RSCC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_SCC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SCC");

function detect() {
    if (Binary.compare("fd53565b0fa1be....ad648b16....643106....648916....adff36....643306")) {
        sOptions = "by The Cleric //LZ0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_SCRAM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SCRAM!");

function detect() {
    if (Binary.compare("'SCRAM'b430cd213c..77..cd20bc....b9....8bfcb2..584cf6d82ac2d2c8feca32d181ff....73..eb")) {
        sVersion = "0.8a1";
        sOptions = "1997 by bushwoelie & ACP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Scrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Scrambler");

function detect() {
    if (Binary.compare("eb$$fafc31ff8ec726ff36....26ff36....8d36....b9....f3a4b9....cd00")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Scrypt!.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Scrypt!");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$e800005a5f578bf78bce33dbb7..acfec0f6d032c7aa86fb43c1c3..331e....331e....331e....331e")) {
        sVersion = "0.4";
        sOptions = "by DarkGrey //DTG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$5d81ed....b9....be....03f58bfeb4..ac32c4f6d4aae2")) {
        sVersion = "0.4";
        sOptions = "1998 by DarkGrey //DTG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Scrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SCRYPT");

function detect() {
    if (Binary.compare("e9$$$$e800005d8d5e..eb$$53eb$$66bd........e9$$$$b8....eb$$cc")) {
        sVersion = "1.0";
        sOptions = "1998 by hijaq //BAC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_SelfCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SelfCrypt");

function detect() {
    if (Binary.compare("8cc88ed833ffbe....bb....8a048a1132c288043c..74..4683ff..7d..47eb")) {
        sOptions = "1999 by MCS";
        bDetected = true;
    } else if (Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2")) {
        sVersion = "1994 by PHOENiX";
        bDetected = true;
    } else if (Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....ad2ea3....2e3136....8bc18bdef7e32e3106....2e3116....2ea1....abe2")) {
        sVersion = "1994 by PHOENiX";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_SelfProtect386.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SelfProtect386");

function detect() {
    if (Binary.compare("'=SYRIUS=DIRE=SERVICE='071a")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_SnoopStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SnoopStop");

function detect() {
    if (Binary.compare("90e9$$$$eb$$55e80000598be981ed....66608d9e....8d8e....2bcb2e8a0734..34..34..fec0f6d0")) {
        sVersion = "1.15";
        sOptions = "1998 by Trills and Technologies";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_SoftGuard.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Softguard");

function detect() {
    if (Binary.compare("e9$$$$8cc88ed88c06....8cc73bc774..8bfc368b052ea3....368b45..2ea3....a1....a3....a1....a3....a1....b1")) {
        sOptions = "1984-86";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Steplock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Steplock");

function detect() {
    if (Binary.compare("e9$$$$0e1fb9....030e....be....d204282c46e2")) {
        sVersion = "1.00A";
        sOptions = "by Morten Pedersens";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_TCEC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "TCEC");

function detect() {
    if (Binary.compare("1aff5fb9....f326ace3..eb")) {
        sVersion = "3.60";
        sOptions = "by ThE CLERiC! //LZ0, EVD";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_UnPackStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "UnPackStop");

function detect() {
    if (Binary.compare("68....c3")) {
        var nOffset = Binary.readWord(1) - 256;
        if (Binary.compare("8bc450be....bf....eb$$b8....501f58eb", nOffset)) {
            sVersion = "0.95";
            sOptions = "by Szaszi (Szabo Laszlo)";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/COM/protector_UniCrypt.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "UniCrypt");

function detect() {
    if (Binary.compare("8cc805....50b8....50cb")) {
        sVersion = "1.01";
        sOptions = "1998 by V.Slinchuk";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_Venus.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Venus crypt");

function detect() {
    if (Binary.compare("b9....fa8bdc8cd2bc....03e1d1e94c4c5886e9d3c033c186e9f7d050e2")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_XORCOPY.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XORCOPY");

function detect() {
    if (Binary.compare("e9$$$$b8....bb....ba....3107434039d375..c606......c606......c606......31c031db31d2e9")) {
        sVersion = "1.0";
        sOptions = "1995 by DeiMoS";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_XcomOR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XcomOR by madmax");

function detect() {
    if (Binary.compare("'MMX'e8$$$$83c5..8306......b8....5050ffe0")) {
        sVersion = "0.XX";
        bDetected = true;
    } else if (Binary.compare("'MMX'668136............eb$$668136............eb")) {
        sVersion = "0.99i, 0.99h";
        bDetected = true;
    } else if (Binary.compare("'MMX'b409ba....cd21e8$$$$1e6a..1f8136........8136........8b1e....a1....501f813f....75")) {
        bDetected = true;
    } else if (Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533edeb$$4f030de8")) {
        sName = "XcomOR/486 by madmax";
        bDetected = true;
    } else if (Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533ede8$$$$1e6a..1f")) {
        sVersion = "0.99f";
        bDetected = true;
    } else if (Binary.compare("e8$$$$8006......b4..5050c3bf....57bb....8b4d..81")) {
        sVersion = "0.99a";
        bDetected = true;
    } else if (Binary.compare("'MMX'eb$$4feb$$8b0dba....83c2..90eb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_XoReR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XoReR");

function detect() {
    if (Binary.compare("e9$$$$ba....b9....51b0..e660fab430cd213c..73..33c00650cbbf....8b36....59e2")) {
        sVersion = "2.l";
        sOptions = "by dR.No //ViP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....8bfeb9....33db80c3..ac32c3aae2")) {
        sVersion = "1.0";
        sOptions = "by dR.No //ViP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b8....e721b8....cd21b430cd218b2e....8b1e....bf....b9....b430cd2132..73..be....bf....b9....fcac300547e2")) {
        sVersion = "1.0 [2nd pass]";
        sOptions = "by dR.No //ViP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....b9....51b8....e721b430cd213c..73..33c00650cb")) {
        sVersion = "2.0";
        sOptions = "1998 by dR.No //ViP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_XorCom.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XorCom");

function detect() {
    if (Binary.compare("e9$$$$fcbe....bf....57b9....ac34..aae2..c3")) {
        sVersion = "1.0";
        sOptions = "by tFF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_aPatch.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "aPatch");

function detect() {
    if (Binary.compare("e8$$$$fde8$$$$ffc75e83ee..e8$$$$5d8176......c646....eb")) {
        sVersion = "0.05-0.33";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_acBBS_protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "acBBS protection p1");

function detect() {
    if (Binary.compare("e9$$$$bf....b9....870581f0....86e0faeb$$e8$$$$501e33c08ed8eb$$8706....eb$$8706....8706....1f58c3")) {
        sOptions = "1994 by p.q.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_com-crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "com-crypt");

function detect() {
    if (Binary.compare("b8....ffe0")) {
        sOffset = Binary.readWord(1);
        if (Binary.compare("5756bf....b8....abb8....abb0..aa89feb9....31dbad01c329cb89d8abe2", sOffset - 0x100)) {
            sOptions = "by BlackLight, MANtiCORE";
            bDetected = true;
        } else if (Binary.compare("be....562ec704....2ec744......2ec644....b9....8a0434..880446", sOffset - 0x100)) {
            sName = "com-crypt on BASIC";
            sOptions = "by BlackLight, MANtiCORE";
            bDetected = true;
        }
    } else if (Binary.compare("e8$$$$b7..538b4f..8a47..c0c8..880743e2")) {
        sOptions = "by Frenzy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_fds-cp.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "fds-cp");

function detect() {
    if (Binary.compare("8cca2e8916....b4..8b2e....8b1e....8edaa3....8c06....891e....892e....eb")) {
        sVersion = "0.04a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_mCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "mCrypt");

function detect() {
    if (Binary.compare("e9$$$$1e06be....bf....b9....0e1f0e07e8$$$$33c0fa5083c4..83ec..58fb0bc075..c3")) {
        sVersion = "0.1a";
        sOptions = "1998 by //UFO CREW";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "protection");

function detect() {
    if (Binary.compare("33db9090b9....fcad03d8e2..b9....be....8bfefcad33c3ab43e2")) {
        sOptions = "by ROWDY, St.Petersburg";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_spirit.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "$pirit");

function detect() {
    if (Binary.compare("e9$$$$b430cd21f6d12ea6e8....b462cd21e8....3636fb969034..c3")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (Binary.compare("e9$$$$aee8$$$$e4210c..fbe62190b8....fb5026509087c1")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (Binary.compare("e9$$$$369f9f1c..e9$$$$e8$$$$e421f80c..e6218d06....fc505089c1fb")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (Binary.compare("e9$$$$f8d72606b435cd2107e8$$$$1c..1c..33d226f6da12ddfcf905....f8f5f6ea")) {
        sVersion = "1.5";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_sticker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "sticker");

function detect() {
    if (Binary.compare("be....8bc6b1..d3e88cdb03c30344..a3....8cc805....a3....8b44..b1..d3e8")) {
        sOptions = "1994 by TigraSoft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/protector_x3.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "x3");

function detect() {
    if (Binary.compare("e8$$$$5ebf....57b9....ac34..aae2..c3")) {
        sVersion = "1.4";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    } else if (Binary.compare("ba....2e408b142633f6402681c6....2e1ad3")) {
        sVersion = "1.4";
        sOptions = "by MANtiC0RE";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_ACiDDRAW.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "ACiDDRAW");

function detect() {
    if (Binary.compare("e9$$$$b8....cd10b4..b9....cd10e8....ba....90e8....3d....75..e9....3d....75..e9....3d....75..e9....3d....75..eb")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (Binary.compare("eb$$b8....cd10b4..b9....cd10e8....ba....90e8....3d....75..e9....3d....75..e9....3d....75..e9....3d....75..eb")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_ANS2ALL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "ANS2ALL");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$b8....cd103c..75..80fb..73..58b8....cd21fcb8....8ec0be....bf....b9....f3a4fa")) {
        sVersion = "1.3";
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    }
    if (Binary.compare("e9$$$$2bc9b6..b2..b7..b4..cd212ad22af6b7..b4..cd10b6..32d2b7..b4..cd101e33c050")) {
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_ASC2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "ASC2COM");

function detect() {
    if (Binary.compare("e9$$$$e8$$$$33c0cd333d....75..c606......b8....cd338916....c3")) {
        sVersion = "2.02";
        sOptions = "1992 by MorganSoft";
        bDetected = true;
    } else if (Binary.compare("e8$$$$e8$$$$b401b7..b9....cd10c3f8bb....8b073d....75..c3")) {
        sVersion = "1.10B";
        sOptions = "1989 by MorganSoft";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$50535157bb....803f..74..33c98a0f438bfbb8....e3")) {
        sVersion = "2.01 Compressed";
        sOptions = "1992 by MorganSoft";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$e8$$$$b4..b7..b9....cd10c3")) {
        sOptions = "1989 by MorganSoft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_DOC2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "DOC2COM");

function detect() {
    if (Binary.compare("fc8b0e....498b36....8bfeac3204aae2")) {
        sOptions = "by Jerry DePyper";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_DOC2PAGE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "DOC2PAGE");

function detect() {
    if (Binary.compare("e9$$$$fc8a0e....32ede3..bf....b0..f3ae74..e8....ba....cd21ba....cd21e9")) {
        sOptions = "by Th. Edel";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_GTXT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "GTXT");

function detect() {
    if (Binary.compare("bb....b4..b1..8a070ac074..247f3c..75..438a070ac0")) {
        sVersion = "1.1";
        sOptions = "by EGans 05/08/86";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_HYPDOC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "HYPDOC");

function detect() {
    if (Binary.compare("e9$$$$e8....e8....e8....2ec606......2ec606......b9....2e8a26....b0..e8....2ec606......2ec606......2e8b3e....0e07")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_List.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "List");

function detect() {
    if (Binary.compare("bc....1e2bc0508926....b430cd213c")) {
        sOptions = "by Vernon D. Buerg";
        bDetected = true;
    } else if (Binary.compare("bc....1e2bc0508926....e8$$$$b430cd213c")) {
        sVersion = "6.00";
        sOptions = "1985 by Vernon D. Buerg";
        bDetected = true;
    } else if (Binary.compare("bc....1e2bc0508926....b430cd21a2")) {
        sVersion = "6.2a";
        sOptions = "1987 by Vernon D. Buerg";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_MakeRead.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "MakeRead");

function detect() {
    if (Binary.compare("e9$$$$c706........c606......c606......e8....bf....893e....bf....893e....b4..b0..0106....578bc78b3e....fcab")) {
        sVersion = "1.8";
        sOptions = "1987";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_ONLINE-HELP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "ONLINE-HELP");

function detect() {
    if (Binary.compare("e9$$$$8cc805....2ea3....be....ac3c..74..72..3c..72..3c..77..4e33c033dbba....8a1c80eb..80fb..77")) {
        sOptions = "1990 by Clockwork Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_PFL2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "PFL2COM");

function detect() {
    if (Binary.compare("eb$$be....bf....53bb....8a1780fa..74..80fa..75..c706")) {
        sOptions = "by C.P.White 1987-90";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_RELETTER.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "RELETTER");

function detect() {
    if (Binary.compare("e9$$$$bc....bf....bb....8a0784c075..e9....438a073c..74..3c..74..89da438a073c..74")) {
        sVersion = "1.0";
        sOptions = "1993 by Hans J. Baer";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_SHOWV20.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "SHOW");

function detect() {
    if (Binary.compare("e9$$$$b8....2b06....a3....e8$$$$bf....cd1125....3d....74..bf....893e....c3")) {
        sName += "V20";
        sOptions = "1992-93 by Simple Software Co.";
        bDetected = true;
    }
    if (Binary.compare("e9$$$$b8....2b06....a3....e8$$$$50a0....a2....58c3")) {
        sOptions = "1992-93 by Simple Software Co.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_TXT2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "TXT2COM");

function detect() {
    if (Binary.compare("e8$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7")) {
        sVersion = "1.1";
        sOptions = "1987 by Keith P. Graham";
        bDetected = true;
    } else if (Binary.compare("e9$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7")) {
        sVersion = "1.1";
        sOptions = "1987 by Keith P. Graham";
        bDetected = true;
    } else if (Binary.compare("8d26....e8$$$$b4..cd103c..74..c706........c706........3c..74..3c..74..8d16....b409cd21cd20c706")) {
        sVersion = "2.06";
        sOptions = "1989 by Keith P. Graham";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_TXTmaker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "TXTmaker");

function detect() {
    if (Binary.compare("eb$$b4..33dbcd1080fc..74..b0..eb$$b44ccd21")) {
        sVersion = "1.22";
        sOptions = "1991 by Jack A. Orman";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_Txt2Exe.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "Txt2Exe");

function detect() {
    if (Binary.compare("bf....033e....b9....2b0e....d1e9b8....f3abb4..cd1030e4a3....b8....cd10b8....8a1e....cd10")) {
        sVersion = "3.1b";
        sOptions = "2001 by BlackLight";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/self-displayer_readme.com.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "README.COM");

function detect() {
    if (Binary.compare("bb....b8....cd21be....fcbf....f6c2..74..f6c2..74..bf....ac3c..74..b4")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/sfx_LHA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LHA SFX");

function detect() {
    if (Binary.compare("eb$$fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")) {
        sVersion = "2.05L, 2.10-2.13, 2.55";
        bDetected = true;
    } else if (Binary.compare("eb$$00fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")) {
        sVersion = "2.13S";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/sfx_PKZip.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "PKZip mini-sfx");

function detect() {
    if (Binary.compare("b9....bf....2bcf32c0f3aab430cd21a3....8da5....8926....b8....e8")) {
        sVersion = "2.04g";
        bDetected = true;
    }
    if (Binary.compare("b9....bf....2bcf32c0f3aa8da5....83e4..8926....b430cd21a3....8cd8")) {
        sVersion = "2.50";
        sOptions = "1999 by PKWARE Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/simple_ansi_viewer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "simple ANSI viewer");

function detect() {
    if (Binary.compare("b8....bb....b9....0e1fba....cd21b8004ccd21")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/simple_self-displayer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "simple self-displayer");

function detect() {
    if (Binary.compare("b8....8ec0b4..b9....cd102bc92bffb8....51b9....f3ab59be....2bdb2bed2bd28bfdac")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/COM/virus.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("virus", "");

function detect() {
    if (Binary.compare("e9$$$$fa8bece800005b81eb....2ef687......74..8db7....bc....31343124464c75")) {
        sName = "Cascade.1701";
        bDetected = true;
    } else if (Binary.compare("e9$$$$89e5fae800005b81eb....2ef687......74..8db7....bc....31343124464c75")) {
        sName = "Cascade.1704";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/CurIcoBPP
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Read the bits per pixel of Windows cursors & icons from the image.

// nOffset: position of the header.
function getCurIcoBPP(nOffset) {
    var nBPP = 0;
    nOffset = Binary.readDword(nOffset + 12);
    if (Binary.readDword(nOffset) == 0x28) {
        nBPP = Binary.readWord(nOffset + 14);
    } else if (Binary.compare("89'PNG\r\n'1A0A", nOffset)) {
        // Just assume a PNG is going to be 8-bit RGBA.
        nBPP = 32;
    }
    return nBPP;
}

================================================
FILE: db/DEX/_DEX.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Android");

function detect() {
    if (DEX.isVerbose()) {
        sName = DEX.getOperationSystemName();
        sVersion = DEX.getOperationSystemVersion();
        sOptions = DEX.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/DEX/_DEX2.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "DEX");

function detect() {
    sName = DEX.getFileFormatName();
    sVersion = DEX.getFileFormatVersion();
    sOptions = DEX.getFileFormatOptions();

    bDetected = true;

    return result(); 
}


================================================
FILE: db/DEX/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = DEX;
var X = DEX;

================================================
FILE: db/DEX/compiler_dexlib2.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "dexlib2");

function detect() {
    if (DEX.getMapItemsHash() == 0x0e27e776) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/DEX/library_UnicomSDK.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "UnicomSDK");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/unicom/dcLoader/Utils;");

    return result();
}

================================================
FILE: db/DEX/obfuscator_ProGuard.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("obfuscator", "ProGuard");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/google/android/gms/common/ProGuardCanary;");

    return result();
}

================================================
FILE: db/DEX/protector_AESObfuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AESObfuscator");

function detect() {
    bDetected = DEX.isDexStringPresent("AESObfuscator.java");

    sLang = "Java";

    return result();
}

================================================
FILE: db/DEX/protector_APKProtect.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "APKProtect");

function detect() {
    bDetected = DEX.isDexStringPresent("APKProtect");

    return result();
}

================================================
FILE: db/DEX/protector_AlibabaProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AlibabaProtection");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/ali/mobisecenhance/StubApplication;");

    return result();
}

================================================
FILE: db/DEX/protector_AllatoriObfuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Allatori");

function detect() {
    bDetected = DEX.isDexStringPresent("ALLATORIxDEMO");

    sVersion = bDetected ? "Demo" : String();

    return result();
}

================================================
FILE: db/DEX/protector_ApkEncryptor.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "ApkEncryptor");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcn/beingyi/sub/utils/Native;");

    return result();
}

================================================
FILE: db/DEX/protector_AppSolid.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "AppSolid");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lweb/apache/sax/app;");

    return result();
}

================================================
FILE: db/DEX/protector_BaiduProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "BaiduProtection");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/baidu/protect/StubApplication;");

    return result();
}

================================================
FILE: db/DEX/protector_BangcleProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "BangcleProtection");

function detect() {
    bDetected = DEX.isDexStringPresent("apkFilePath");

    return result();
}

================================================
FILE: db/DEX/protector_EasyProtector.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "EasyProtector");

function detect() {
    bDetected = DEX.isDexStringPresent("com.easyprotector.android");

    return result();
}

================================================
FILE: db/DEX/protector_Jiagu.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Jiagu");

function detect() {
    bDetected = DEX.isDexStringPresent("/.jiagu");

    return result();
}

================================================
FILE: db/DEX/protector_Kiwi.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Allatori");

function detect() {
    bDetected = DEX.isDexStringPresent("Kiwi__Version__Obfuscator");

    return result();
}

================================================
FILE: db/DEX/protector_LIAPP.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "LIAPP");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/lockincomp/liapp/LiappClassLoader;");

    return result();
}

================================================
FILE: db/DEX/protector_MedusaH.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Medusah");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/seworks/medusah/MedusahDex;");

    return result();
}

================================================
FILE: db/DEX/protector_ModGuard.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "ModGuard");

function detect() {
    if (DEX.isDexStringPresent("ModGuard - Protect Your Piracy v1.2 by ill420smoker")) {
        sVersion = "v1.2";
    } else if (DEX.isDexStringPresent("ModGuard - Protect Your Piracy v1.3 by ill420smoker")) {
        sVersion = "v1.3";
    }

    return result();
}

================================================
FILE: db/DEX/protector_NQShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "NQShield");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/nqshield/Common;");

    return result();
}

================================================
FILE: db/DEX/protector_NagaPTProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "NagaPTProtection");

function detect() {
    bDetected = DEX.isDexStringPresent("LIBRARY_DDOG") || DEX.isDexStringPresent("LIBRARY_FDOG");

    return result();
}

================================================
FILE: db/DEX/protector_PangXie.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Jiagu");

function detect() {
    bDetected = DEX.isDexStringPresent("PangXie") || DEX.isDexStringPresent("nsecure");

    return result();
}

================================================
FILE: db/DEX/protector_QDBH.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "QDBH");

function detect() {
    bDetected = DEX.isDexStringPresent("/qdbh");

    return result();
}

================================================
FILE: db/DEX/protector_SecNeo.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "SecNeo");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/secneo/apkwrapper/ApplicationWrapper;");

    return result();
}

================================================
FILE: db/DEX/protector_TencentProtection.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "TencentProtection");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/tencent/StubShell/TxAppEntry;");

    return result();
}

================================================
FILE: db/DEX/protector_VDog.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Vdog");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/vdog/Common;");

    return result();
}

================================================
FILE: db/DEX/protector_Yidun.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Yidun");

function detect() {
    bDetected = DEX.isDexItemStringPresent("La/_;");

    return result();
}

================================================
FILE: db/DEX/tool_ApkToolPlus.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("tool", "ApkToolPlus");

function detect() {
    bDetected = DEX.isDexItemStringPresent("Lcom/linchaolong/apktoolplus/jiagu/utils/ApkToolPlus;");

    return result();
}

================================================
FILE: db/DOS16M/_DOS16M.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "DOS16M");

function detect() {
    if (DOS16M.isVerbose()) {
        sName = DOS16M.getOperationSystemName();
        sVersion = DOS16M.getOperationSystemVersion();
        sOptions = DOS16M.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/DOS16M/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = DOS16M;
var X = DOS16M;

================================================
FILE: db/DOS16M/compiler_Watcom.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Watcom C");

function detect() {
    bDetected = true; // Always true

    return result();
}


================================================
FILE: db/DOS4G/_DOS4G.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "DOS4G");

function detect() {
    if (DOS4G.isVerbose()) {
        sName = DOS4G.getOperationSystemName();
        sVersion = DOS4G.getOperationSystemVersion();
        sOptions = DOS4G.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/DOS4G/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = DOS4G;
var X = DOS4G;

================================================
FILE: db/DOS4G/compiler_Watcom.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Watcom C");

function detect() {
    bDetected = true; // Always true

    return result();
}


================================================
FILE: db/ELF/Borland_Kylix.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Borland Kylix");

function detect() {
    if (ELF.isSectionNamePresent("borland.ressym")) {
        bDetected = true;
    } else if (ELF.isSectionNamePresent("borland.reshash")) {
        bDetected = true;
    } else if (ELF.isSectionNamePresent("borland.resdata")) {
        bDetected = true;
    } else if (ELF.isSectionNamePresent("borland.resspare")) {
        bDetected = true;
    }

    sLang = "Pascal/C/C++";

    return result();
}


================================================
FILE: db/ELF/Free_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Levis <levintaeyeon@live.com>
// EP sigs by hypn0 <hypn0@mail.ru>
// Lazarus Free Pascal

meta("compiler", "Free Pascal");

function detect() {
    if (ELF.compareEP("5989e38d44....83e4..8915........a3........890d........891d........e8........8925........31ede8........c3")) {
        sVersion = "2.6.0";
        bDetected = true;
    } else if (ELF.compareEP("31ED5989E3")) {
        bDetected = true;
    } else if (ELF.isSectionNamePresent(".fpc.resources")) {
        bDetected = true;
    } else if (ELF.isSectionNamePresent(".fpcdata")) {
        bDetected = true;

        var nSection = ELF.getSectionNumber(".fpcdata"),
            nOffset = ELF.getSectionFileOffset(nSection),
            nSize = ELF.getSectionFileSize(nSection);

        if (nSize > 0) {
            var nStringOffset = ELF.findString(nOffset, 4, "FPC ");
            if (nStringOffset != -1) {
                sVersion = ELF.getString(nStringOffset + 4);
            }
        }
    } else if (ELF.isSectionNamePresent(".data")) {
        var nSection = ELF.getSectionNumber(".data"),
            nOffset = ELF.getSectionFileOffset(nSection),
            nSize = ELF.getSectionFileSize(nSection);

        if (nSize >= 0x100) {
            var nStringOffset = ELF.findString(nOffset + nSize - 0x100, 0x100, "FPC ");
            if (nStringOffset != -1) {
                sVersion = ELF.getString(nStringOffset + 4);
                bDetected = true;
            }
        }
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/ELF/HP_C++.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("compiler", "HP C++");

function detect() {
    if (ELF.isSectionNamePresent(".HP.init")) {
        bDetected = true;
    }

    sLang = "C++";

    return result();
}


================================================
FILE: db/ELF/IBM_AIX_kernel_loader.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("boot", "IBM AIX kernel loader");

function detect() {
    if (ELF.getNumberOfPrograms() >= 4) {
        if (ELF.getProgramFileSize(1) <= 0x100) {
            if (ELF.findString(ELF.getProgramFileOffset(1), Math.min(0x100, ELF.getProgramFileSize(1)), "IBM,RPA-Client-Config") != -1) {
                bDetected = true;
            }
        }
    }
    if (ELF.findString(ELF.getProgramFileOffset(0), Math.min(0x100, ELF.getProgramFileSize(0)), "PowerPC") != -1) {
        sVersion = "PowerPC";
    }

    return result();
}


================================================
FILE: db/ELF/Oracle_Solaris_Studio.4.sg
================================================
// Detect It Easy: detection rule file
// Author: anonymous

meta("compiler", "Oracle Solaris Studio");

function getOSSVersion() {
    var sResult = "";
    var nSection = ELF.getSectionNumber(".comment");

    if (nSection != -1) {
        var nSectionOffset = ELF.getSectionFileOffset(nSection);
        var nSectionSize = ELF.getSectionFileSize(nSection);
        var nOffset = ELF.findString(nSectionOffset, nSectionSize, "Sun WorkShop");
        if (nOffset != -1) {
            return ELF.getString(nOffset + 13, 100);
        }
        nOffset = ELF.findString(nSectionOffset, nSectionSize, "acomp: Sun C");
        if (nOffset != -1) {
            return ELF.getString(nOffset + 13, 100);
        }
        nOffset = ELF.findString(nSectionOffset, nSectionSize, "SUNWCC.h");
        if (nOffset != -1) {
            return "5.X";
        }
    }

    return sResult;
}

function detect() {
    if (ELF.compareEP("bc1020..e003....1300....e022....a203a0..1300....e222....1300....e222....a52c20..a404a0..a40440122700....e804....80a520"))
    // SPARC instruction set
    {
        if (ELF.isSectionNamePresent(".SUNW_version")) {
            bDetected = true;
        }
        var sOSSVersion = getOSSVersion();
        if (sOSSVersion) {
            bDetected = true;
            sVersion = sOSSVersion;
        }
    }

    sLang = "C/C++";

    return result();
}

================================================
FILE: db/ELF/_ELF.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Unix");

function detect() {
    if (ELF.isVerbose()) {
        sName = ELF.getOperationSystemName();
        sVersion = ELF.getOperationSystemVersion();
        sOptions = ELF.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/ELF/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = ELF;
var X = ELF;

================================================
FILE: db/ELF/compiler_DMD.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "DMD");

function getVersion() {
    var nSection = ELF.getSectionNumber(".comment");

    if (nSection != -1) {
        var nOffset = ELF.findString(
            ELF.getSectionFileOffset(nSection),
            ELF.getSectionFileSize(nSection),
            "DMD v");

        if (nOffset != -1) {
            return ELF.getString(nOffset + 5, 20);
        }
    }

    return String();
}

function detect() {
    var versionString = getVersion();
    if (versionString) {
        bDetected = true;
        sVersion = versionString;
    }

    sLang = "D";

    return result();
}


================================================
FILE: db/ELF/compiler_FASM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "FASM");

function detect() {
    if (ELF.getElfHeader_shstrndx() == 0 && ELF.getElfHeader_shnum() == 0 && ELF.getElfHeader_shentsize()) {
        sVersion = "1.X";
        bDetected = true;

        for (var i = 0; i < ELF.getNumberOfPrograms() - 1 && bDetected; i++) {
            if (ELF.getProgramFileOffset(i) == 0) {
                bDetected = false;
            }
        }
    }

    sLang = "ASMx" + (ELF.is64() ? "64" : "86");

    return result();
}


================================================
FILE: db/ELF/compiler_Go.4.sg
================================================
// Detect It Easy: detection rule file
// Author: fernandom - menteb.in

meta("compiler", "Go");

function detect() {

    if (ELF.isSectionNamePresent(".gosymtab") ||
        ELF.isSectionNamePresent(".gopclntab") ||
        ELF.isSectionNamePresent(".go.buildinfo") ||
        ELF.isSectionNamePresent(".note.go.buildid")) {
        bDetected = true;
    }

    //x86-64
    if (ELF.compareEP("488d742408488b3c24b810174200ffe0b870f94100ffe0000000000000000000")) {
        bDetected = true;
        sVersion = "1.2.2";
    } else if (ELF.compareEP("488d742408488b3c24b8907f4200ffe0b800564200ffe0000000000000000000")) {
        bDetected = true;
        sVersion = "1.3 or 1.3.1";
    } else if (ELF.compareEP("488d742408488b3c24b8c07f4200ffe0b830564200ffe0000000000000000000")) {
        bDetected = true;
        sVersion = "1.3.2";
    } else if (ELF.compareEP("488d742408488b3c24b8e07f4200ffe0b850564200ffe0000000000000000000")) {
        bDetected = true;
        sVersion = "1.3.3";
    } else if (ELF.compareEP("488d742408488b3c24488d0510000000ffe00000000000000000000000000000")) {
        bDetected = true;
        sVersion = "1.4.x or 1.5.X";
    } else if (ELF.compareEP("488d742408488b3c24488d0510000000ffe0cccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.6.X-1.9.X";
    } else if (ELF.compareEP("e92bc9ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")) {
        bDetected = true;
        sVersion = "1.10.X";
    } else if (ELF.compareEP("e9cbc6ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")) {
        bDetected = true;
        sVersion = "1.11.X";
    } else if (ELF.compareEP("e9dbc6ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")) {
        bDetected = true;
        sVersion = "1.12.X";
    } else if (ELF.compareEP("e92bc6ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")) {
        bDetected = true;
        sVersion = "1.13.X";
    } else if (ELF.compareEP("e92bc4ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")) {
        bDetected = true;
        sVersion = "1.14.X";
    } else if (ELF.compareEP("e91bcbffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.15.X";
    } else if (ELF.compareEP("e95bcaffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.16.X";
    } else if (ELF.compareEP("e93bc6ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.17.X";
    } else if (ELF.compareEP("e9fbc5ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.18.X";
    } else if (ELF.compareEP("e99bc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.22.X-1.23.X";
    } else if (ELF.compareEP("e95bc5ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.20.X";
    } else if (ELF.compareEP("e9bbc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.23.X";
    } else if (ELF.compareEP("e9dbc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.23.2";
    } else if (ELF.compareEP("e91bc7ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.23.5";
    } else if (ELF.compareEP("e95bc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.24.X";
    } else if (ELF.compareEP("e97bc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")) {
        bDetected = true;
        sVersion = "1.24.X";
    } else if (ELF.compareEP("4831ed4889e7488d35........4883e4..e8........8b37488d57..49c7c0")) {
        bDetected = true;
        sVersion = "1.24.0";
    } else if (ELF.compareEP("31ed4989d15e4889e24883e4..505449c7c0........48c7c1........48c7c7")) {
        bDetected = true;
        sVersion = "1.24.1";
    }

    //x86
    else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e87902ffffe804000000cd030000")) {
        bDetected = true;
        sVersion = "1.2.2";
    } else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e8f977feffe804000000cd030000")) {
        bDetected = true;
        sVersion = "1.3 or 1.3.1";
    } else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e8e977feffe804000000cd030000")) {
        bDetected = true;
        sVersion = "1.3.2";
    } else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e8c977feffe804000000cd030000")) {
        bDetected = true;
        sVersion = "1.3.3";
    } else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e89932ffffe804000000cd030000")) {
        bDetected = true;
        sVersion = "1.4.X";
    } else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e809000000cd0300000000000000")) {
        bDetected = true;
        sVersion = "1.5.X";
    } else if (ELF.compareEP("83ec088b4424088d5c240c890424895c2404e809000000cd03cccccccccccccc")) {
        bDetected = true;
        sVersion = "1.6.X-1.9.X";
    }
    else if (ELF.compareEP("e9....ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.10";
    } else if (ELF.compareEP("e9ebd8ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.10.X";
    } else if (ELF.compareEP("e96bdbffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.11.X";
    } else if (ELF.compareEP("e97b..ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.12.X";
    } else if (ELF.compareEP("e99bffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.13.X";
    } else if (ELF.compareEP("e99bd9ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.14.X";
    } else if (ELF.compareEP("e9abdcffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.15.X";
    } else if (ELF.compareEP("e9dbdcffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.16.X";
    } else if (ELF.compareEP("e92bdeffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.17.X";
    } else if (ELF.compareEP("e9..ddffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")) {
        bDetected = true;
        sVersion = "1.23.X-1.24.X";
    }
/*
    // generic rule for amd64 and 386
    else if (ELF.compareEP("e9....ffff..................................................cccc")) {
        bDetected = true;
        sVersion = "1.10.X-1.17.X";
    }
*/
    // arm
    else if (ELF.compareEP("00009de504108de204409fe500f084e2feffffea")) {
        bDetected = true;
    }

    sLang = "Go";

    return result();
}

================================================
FILE: db/ELF/compiler_MWCC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://decomp.wiki/compilers/MWCC
meta("compiler", "MW MIPS C");

function detect() {
    if (ELF.compareOverlay("4d57204d495053204320436f6d70696c65722028322e342e312e303129")) {
        sVersion = "2.4.1.01";
        sOptions = "PlayStation 2";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/ELF/compiler_Rust.4.sg
================================================
// Detect It Easy: detection rule file
// Author: fernandom - menteb.in

meta("compiler", "Rust");

function detect() {

    //x86
    if (ELF.compareEP("f30f1efb31ed5e89e183e4..505452e8........81c3")) {
        bDetected = true;
    } else if (ELF.compareEP("31ed5e89e183e4..505452e8........81c3")) {
        bDetected = true;
    } else if (ELF.compareEP("31ed89e083e4..5050e8........8104")) {
        bDetected = true;
    }

    //x86-64
    if (ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$488b37488d57..4531c94c8d05........488d0d........488d3d$$$$$$$$5541574156")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$5541574156")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$4156")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$5541574156")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$5541574156")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$41574156")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$53")) {
        bDetected = true;
    } else if (ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$554889e541574156")) {
        bDetected = true;
    } else if (ELF.compareEP("31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$41574156")) {
        bDetected = true;
    } else if (ELF.compareEP("31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$5541574156")) {
        bDetected = true;
    } else if (ELF.compareEP("31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$41574156")) {
        bDetected = true;
    } else if (ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$4881ec........8b074989f8ffc04898")) {
        bDetected = true;
    } else if (ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$4881ec........8b0783c0..4898")) {
        bDetected = true;
    } else if (ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$8b37488d57..488d3d$$$$$$$$41574156")) {
        bDetected = true;
    }

    //ARM64
    if (ELF.compareEP("1d0080d21e0080d2e0030091........210000911fec7c92")) {
        bDetected = true;
    } else if (ELF.compareEP("1f2003d51d0080d21e0080d2e50300aae10340f9e2230091e6030091")) {
        bDetected = true;
    } else if (ELF.compareEP("1d0080d21e0080d2e50300aae10340f9e2230091e6030091")) {
        bDetected = true;
    } else if (ELF.compareEP("1d0080d21e0080d2fd030091e50300aae10340f9e2230091e6030091")) {
        bDetected = true;
    }

    //ARM32
    if (ELF.compareEP("00b0a0e300e0a0e304109de40d20a0e104202de504002de5")) {
        bDetected = true;
    } else if (ELF.compareEP("00b0a0e300e0a0e310109fe501108fe00d00a0e10fc0c0e3")) {
        bDetected = true;
    }

    //ARMv7
    if (ELF.compareEP("f0000b4ff0000e03497944684620f00f0ce54600f002f8..")) {
        bDetected = true;
    } else if (ELF.compareEP("f0000b4ff0000e02bc6a4604b401b4dff824a008a39a44df")) {
        bDetected = true;
    } else if (ELF.compareEP("f0000b4ff0000e5df8041b6a464df8042d4df8040ddff828")) {
        bDetected = true;
    }

    if (ELF.isStringInTablePresent(".strtab", "rust_panic")) {
        bDetected = true;

        var nSection = ELF.getSectionNumber(".debug_str"),
            nOffset = ELF.getSectionFileOffset(nSection),
            nSize = ELF.getSectionFileSize(nSection);

        if (nSize > 0) {
            var nStringOffset = ELF.findString(nOffset, 6, "rustc ");
            if (nStringOffset != -1) {
                sVersion = ELF.getString(nStringOffset);
            }
        }
    }

    sLang = "Rust";

    return result();
}

================================================
FILE: db/ELF/compiler_VBCC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "VBCC");

function detect() {
    if (ELF.getElfHeader_entry() == 0) { // EP == 0
        if (ELF.compare("6000000048......................7c08....9001....9421....bdc1....3d......902b....3d......39ad....3960....800b....3d......90", ELF.getSectionFileOffset(1))) { // PPC instruction set
            sVersion = "0.7";
            bDetected = true;
        }
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/ELF/compiler_Watcom.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("compiler", "Watcom");

function detect() {
    var nData = ELF.getSectionNumber(".data");

    var nOffset = ELF.getSectionFileOffset(nData);
    var nSize = ELF.getSectionFileSize(nData);
    if (ELF.findString(nOffset, nSize, "WATCOM") != -1) {
        bDetected = true;
    } else if (ELF.compareEP("33ed8925........598bf48d44....505651e8")) {
        sName = "Open Watcom C/C++32";
        sOptions = "2002";
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/ELF/compiler_Zig.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Zig");

function detect() {
    if ((ELF.isSectionNamePresent(".rodata")) && (ELF.isDeepScan())) {
        var nIndex = ELF.getSectionNumber(".rodata");

        var nOffset = ELF.getSectionFileOffset(nIndex);
        var nSize = ELF.getSectionFileSize(nIndex);

        var nVersionOffset = ELF.findSignature(nOffset, nSize, "5a49475f44454255475f434f4c4f52"); // ANSI ZIG_DEBUG_COLOR

        if (nVersionOffset != -1) {
            bDetected = true;
        }
    }

    sLang = "Zig";

    return result();
}


================================================
FILE: db/ELF/compiler_gcc.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "GCC");

function getVersion(nOffset, nSize) {
    var versionString = ELF.findString(nOffset, nSize, "GCC:");
    if (versionString != -1) {
        return ELF.getString(versionString + 5, 100);
    }

    return String();
}

function detect() {
    if (ELF.compareEP("31ed5e89e183e4..50545268........68........515668........e8")) {
        if (ELF.compareEP("$$$$$$$$57565383ec..8b7424..8b7c24..8b5c24..b8........85c00f84........8b0d........85c90f94c025........a3........8b5424..8b4c24..8d44....a3........8b5424..8915........90", 29)) {
            sVersion = "4.7.2, exe";
            bDetected = true;
        } else if (ELF.compareEP("$$$$$$$$55b8........57565383ec..85c08b7c24..8bb424........8b9c24........0f84........8b15........31c085d20f94c08b5424..8b4c24..a3........8d44....8b9424........a3........8915........6690", 29)) {
            sVersion = "4.6.1, exe";
            bDetected = true;
        } else if (ELF.compareEP("$$$$$$$$5589e557565383ec..8b7d..8b75..8b5d..b8........85c00f84........a1........85c00f94c025........a3", 29)) {
            sVersion = "4.5.3, exe";
            bDetected = true;
        } else if (ELF.compareEP("$$$$$$$$55b8........89e557565383ec..85c08b7d..8b75..8b5d..74..31c0833d..........0f94c0", 29)) {
            sVersion = "4.4.6, exe";
            bDetected = true;
        } else if (ELF.compareEP("$$$$$$$$55b8........89e557565383ec..85c08b7d..8b5d..74..31c08b15........85d20f94c0", 29)) {
            sVersion = "4.4.5, exe";
            bDetected = true;
        } else if (ELF.compareEP("$$$$$$$$55b8........89e557565383ec..85c08b....8b5d..74..31c0833d..........0f94c0", 29)) {
            sVersion = "4.3.3, exe";
            bDetected = true;
        } else if (ELF.compareEP("$$$$$$$$55ba........89e557565381ec........85d20f85........8b45..8b4d..8915........8d54", 29)) {
            sVersion = "4.1.2, exe";
            bDetected = true;
        }
    } else if (ELF.compareEP("31ed5589e583e4..8d45..83ec..50ff75..52e8$$$$$$$$5589e557565383ec..8b5d..8b7d..8d74....8935........85db7e..8b0785c074..a3........0fb610")) {
        sVersion = "4.4.7, exe"; // BSD
        bDetected = true;
    } else if (ELF.compareEP("5589e5565383ec..83e4..8b5d..89d18d74....85db8935........7e..8b45..85c074..a3........0fb610")) {
        sVersion = "4.2.1, exe"; // BSD
        bDetected = true;
    } else if (ELF.compareEP("55575653e8........81c3........83ec..8b93........8b8b........8b83........8b2a8b93........890c24895424..8b93........895424..eb")) {
        sVersion = "4.7.2, so";
        bDetected = true;
    } else if (ELF.compareEP("5589e557565383ec..83e4..8b5d..89d78d74....85db8935........7e..8b45..85c074..a3........89c10fb601")) {
        sVersion = "3.4.6, exe"; // BSD
        bDetected = true;
    } else if (ELF.compareEP("5589e557565383ec..89d18d7d..8b5f..8d74....8935........85db7e..837d....74..8b45..a3........89c28038..74..8db6........8dbf........803a..75..8d42..a3")) {
        sVersion = "3.2.1, exe"; // BSD
        bDetected = true;
    } else if (ELF.compareEP("5557565383ec..8b7424..8b6c24..8b3ec745..........c74424..........c74424..........8b078904248d4424..894424..ff57")) {
        sVersion = "3.2, so"; // BSD
        bDetected = true;
    } else if (ELF.compareEP("7c290b785421....38......9421ff..7c0803a690......3d......85......48")) { // PowerPC instruction set
        sVersion = "3.2.X";
        bDetected = true;
    } else if (ELF.compareEP("6a..6a..8bec52b8........85c074")) {
        sVersion = "2.95.2";
        bDetected = true;
    } else if (ELF.isStringInTablePresent(".strtab", "gcc2_compiled.")) {
        sVersion = "2.X";
        bDetected = true;
    } else if (ELF.isStringInTablePresent(".dynstr", "GCC_3.0")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (ELF.isSectionNamePresent(".gcc_except_table")) {
        bDetected = true;
    }
    var nSection = ELF.getSectionNumber(".comment");
    if (nSection != -1 && !sVersion) {
        var versionString = getVersion(ELF.getSectionFileOffset(nSection), ELF.getSectionFileSize(nSection));
        if (versionString) {
            sVersion = versionString;
            bDetected = true;
        }
    }

    if (!sVersion) {
        if (ELF.isOverlayPresent()) { // TODO Check!!!
            var versionString = getVersion(ELF.getOverlayOffset(), Math.min(8192, ELF.getOverlaySize()));
            if (versionString) {
                sVersion = versionString; // Version mb corrupted!
                bDetected = true;
            }
        }
    }

    sLang = "C";

    return result();
}


================================================
FILE: db/ELF/compiler_gdc.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "gdc");

function detect() {
    if (ELF.isLibraryPresent("libgphobos.so.2")) {
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/ELF/compiler_ldc.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "ldc");

function getLDCVersion() {
    var sResult = "";
    var nSection = ELF.getSectionNumber(".comment");
    if (nSection != -1) {
        var nSectionOffset = ELF.getSectionFileOffset(nSection);
        var nSectionSize = ELF.getSectionFileSize(nSection);
        var nOffset = ELF.findString(nSectionOffset, nSectionSize, "ldc version ");
        if (nOffset != -1) {
            sResult = ELF.getString(nOffset + 12, 20);
        }
    }

    return sResult;
}

function detect() {
    if (ELF.isLibraryPresent("libphobos2-ldc-shared.so.98") || ELF.isLibraryPresent("libdruntime-ldc-shared.so.98")) {
        bDetected = true;
    }

    var sLDCVersion = getLDCVersion();
    if (sLDCVersion) {
        bDetected = true;
        sVersion = sLDCVersion;
    }

    sLang = "D";

    return result();
}


================================================
FILE: db/ELF/compiler_movfuscator.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("compiler", "movfuscator");

function detect() {
    if (ELF.compareEP("A1........8B98........8B03BA........668B9400........8913A1........8B98........")) {
        bDetected = true;
        sVersion = "v2";

        _setResult("protection", "M/o/Vfuscator", "", "");
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/ELF/library_Curl.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://curl.se/libcurl/
meta("library", "Curl");

function detect() {
    if (ELF.isLibraryPresent("libcurl.so.4")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_FFmpeg.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://ffmpeg.com/
meta("library", "FFmpeg");

function detect() {
    if (ELF.isLibraryPresent("libffmpeg.so")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_FLAC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/xiph/flac
meta("library", "FLAC");

function detect() {
    if (ELF.isLibraryPresent("libFLAC.so.14")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_Flexlm.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "");

function detect() {
    var nOffset = ELF.findSignature(0, ELF.getSize(), "'@(#) F'");
    if (nOffset != -1) {
        sName = ELF.getString(nOffset, 200).match(/\w\S*/i);
        sVersion = ELF.getString(nOffset, 200).match(/\d\S*/i);
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_FluidSynth.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.fluidsynth.org/
meta("library", "FluidSynth");

function detect() {
    if (ELF.isLibraryPresent("libfluidsynth.so.3")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_FreeType.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://freetype.org/
meta("library", "FreeType");

function detect() {
    if (ELF.isLibraryPresent("libfreetype.so.6")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_GLEW.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://glew.sourceforge.net/
meta("library", "GLEW");

function detect() {
    if (ELF.isLibraryPresent("libGLEW.so.2.2")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_GLIBC.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "GLIBC");

function getMaxVersion(sValue1, sValue2) {
    var aString1 = sValue1.toString().split('.');
    var aString2 = sValue2.toString().split('.');

    for (var i = 0; i < 3; i++) {
        if (aString1[i] > aString2[i]) {
            return sValue1;
        } else if (aString1[i] < aString2[i]) {
            return sValue2;
        }
    }

    return sValue2;
}

function detect() {
    if (ELF.isSectionNamePresent(".dynstr")) {
        var nSection = ELF.getSectionNumber(".dynstr");

        var nOffset = ELF.getSectionFileOffset(nSection);
        var nSize = ELF.getSectionFileSize(nSection);

        var nCurrentOffset = nOffset;
        var nCurrentSize = nSize;
        var sLIBCVersion;
        while (nCurrentSize > 0) {
            nCurrentOffset = ELF.findString(nCurrentOffset, nSize, "GLIBC_");
            if (nCurrentOffset == -1) {
                break;
            }
            bDetected = true;
            sLIBCVersion = ELF.getString(nCurrentOffset + 6);

            sVersion = getMaxVersion(sVersion, sLIBCVersion);

            nCurrentSize = nSize - (nCurrentOffset - nOffset + 1);
            nCurrentOffset++;
        }

        sOptions = ELF.getGeneralOptions();

    }

    return result();
}


================================================
FILE: db/ELF/library_LZMA.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://tukaani.org/xz/liblzma-api/
meta("library", "LZMA");

function detect() {
    if (ELF.isLibraryPresent("liblzma.so.5")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_Lego1.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/isledecomp/isle-portable
meta("library", "Lego1");

function detect() {
    if (ELF.isLibraryPresent("liblego1.so")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_MPEG2.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://libmpeg2.sourceforge.io/
meta("library", "MPEG2");

function detect() {
    if (ELF.isLibraryPresent("libmpeg2.so.0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_Mikmod.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://sourceforge.net/projects/mikmod/
meta("library", "Mikmod");

function detect() {
    if (ELF.isLibraryPresent("libmikmod.so.3")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_OGG.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.xiph.org/ogg/
meta("library", "OGG");

function detect() {
    if (ELF.isLibraryPresent("libogg.so.0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_OpenAL.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.openal.org/
meta("library", "OpenAL");

function detect() {
    if (ELF.isLibraryPresent("libopenal.so.1")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_PulseAudio.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.freedesktop.org/wiki/Software/PulseAudio/
meta("library", "PulseAudio");

function detect() {
    if (ELF.isLibraryPresent("libpulse.so.0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/library_QT.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Qt");

function getQTVersion() {
    var sResult = "";
    var nSize = ELF.getSize();
    var nOffset = ELF.findString(0, nSize, "/usr/local/Trolltech/Qt-");
    if (nOffset != -1) {
        sResult = ELF.getString(nOffset + 24);
        var aVersion = sResult.match(/(.*)\//);
        if (aVersion) {
            sResult = aVersion[1];
        }
    }

    return sResult;
}

function detect() {

    if (ELF.isStringInTablePresent(".dynstr", "libQtCore.so.4")) {
        sVersion = "4.X";
        bDetected = true;
    } else if (ELF.isStringInTablePresent(".dynstr", "libQt5Core.so.5")) {
        sVersion = "5.X";
        bDetected = true;
    } else if (ELF.isStringInTablePresent(".dynstr", "libQt6Core_x86.so")) {
        sVersion = "6.X";
        bDetected = true;
    } else if (ELF.isStringInTablePresent(".dynstr", "libQt6Core.so.6")) {
        sVersion = "6.X";
        bDetected = true;
    }

    if (bDetected) {
        var sQTVersion = getQTVersion();
        if (sQTVersion) {
            sVersion = sQTVersion;
        }
    }

    return result();
}


================================================
FILE: db/ELF/library_SDL.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "SDL");

function getSDLVersion() {
    var sResult = "";
    var nSection = ELF.getSectionNumber(".dynstr");
    if (nSection != -1) {
        var nOffset = ELF.getSectionFileOffset(nSection);
        var nSize = ELF.getSectionFileSize(nSection);

        var nVersionOffset = ELF.findString(nOffset, nSize, "libSDL-");
        if (nVersionOffset != -1) {
            var sSDLVersion = ELF.getString(nVersionOffset);
            var aVersion = sSDLVersion.match(/libSDL-(.*).so/);
            if (aVersion) {
                sResult = aVersion[1];
            }
        }
    }

    return sResult;
}

function detect() {
    if (ELF.isStringInTablePresent(".dynstr", "SDL_Init")) {
        bDetected = true;
    }

    if (bDetected) {
        sVersion = getSDLVersion();
    }

    return result();
}


================================================
FILE: db/ELF/packer_Ezuri.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Rewritten from yara (YARA-Rule by f0wl) by KDSS-Research
// Optimized and rewritten (again) by DosX

meta("packer", "Ezuri");

function detect() {
    if (ELF.isSectionNamePresent(".strtab") && ELF.isSectionNamePresent(".gopclntab") && ELF.isSectionNamePresent(".noptrdata") && ELF.isSectionNamePresent(".rodata")) {
        var strtab = ELF.getSectionNumber(".strtab"),
            gopclntab = ELF.getSectionNumber(".gopclntab"),
            noptrdata = ELF.getSectionNumber(".noptrdata"),
            rodata = ELF.getSectionNumber(".rodata");


        var nOffset = ELF.findString(ELF.getSectionFileOffset(strtab), ELF.getSectionFileSize(strtab), "main.runFromMemory");


        if (nOffset != -1 &&
            ELF.findString(ELF.getSectionFileOffset(strtab), ELF.getSectionFileSize(strtab), "main.aesDec") != -1 &&
            ELF.findString(ELF.getSectionFileOffset(gopclntab), ELF.getSectionFileSize(gopclntab), "crypto/cipher.NewCFBDecrypter") != -1 &&
            ELF.findString(ELF.getSectionFileOffset(rodata), ELF.getSectionFileSize(rodata), "/proc/self/fd/%d") != -1 &&
            ELF.findString(ELF.getSectionFileOffset(rodata), ELF.getSectionFileSize(rodata), "/dev/null") != -1 &&
            ELF.findSignature(ELF.getSectionFileOffset(noptrdata), ELF.getSectionFileSize(noptrdata), "A5 63 63 C6 84 7C 7C F8") != -1 &&
            ELF.findSignature(ELF.getSectionFileOffset(noptrdata), ELF.getSectionFileSize(noptrdata), "63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76") != -1) {
            bDetected = true;
        }

    }

    return result();
}


================================================
FILE: db/ELF/packer_PyInstaller.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("packer", "PyInstaller"); // python = 💩

function detect() {

    // they insert pkgs into the section named "pydata"
    const pydata = ELF.getSectionNumber("pydata")

    // we can find the magic number in the section
    if (pydata != -1 && ELF.findSignature(
            ELF.getSectionFileOffset(pydata),
            ELF.getSectionFileSize(pydata),
            "4d45490c0b0a0b0e"
        ) != -1)
        bDetected = true;

    sLang = "Python";

    return result();
}

================================================
FILE: db/ELF/packer_UPX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "UPX");

function getUPXOptions(nOffset) {
    var nMethod = ELF.readByte(nOffset + 2);
    var nLevel = ELF.readByte(nOffset + 3);
    var sCompression = "";
    switch (nMethod) // From http://sourceforge.net/p/upx/code/ci/default/tree/src/conf.h
    {
        case 2:
        case 3:
        case 4:
        case 5:
        case 6:
        case 7:
        case 8:
        case 9:
        case 10:
            sCompression = "NRV";
            break;
        case 14:
            sCompression = "LZMA";
            break;
        case 15:
            sCompression = "zlib";
            break;
    }

    if (sCompression) {
        sOptions = sOptions.append(sCompression);
        if (nLevel == 8) {
            sOptions = sOptions.append("best");
        } else {
            sOptions = sOptions.append("brute");
        }
    }
}

function detect() {
    var nSize = ELF.getSize();
    if (ELF.compare("'UPX!'", nSize - 0x24)) {
        getUPXOptions(nSize - 0x20);
        bDetected = true;
    } else if (ELF.compareEP("E8........EB0E5A585997608A542420E9........60")) {
        sVersion = "3.X";
        bDetected = true;
    }

    var nOffset = ELF.findString(0, nSize, "$Id: UPX");
    if (nOffset != -1) {
        sVersion = ELF.getString(nOffset + 9, 4);
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/ELF/packer_Virbox.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Vito <@ScalletaZ>

meta("packer", "Virbox");

function detect() {
    for (var i = 0; i < ELF.getNumberOfPrograms(); i++) {
        var nOffset = ELF.getProgramFileOffset(i);
        if (ELF.findString(nOffset, 32, "Virbox Protector") != -1) {
            sVersion = "Virbox Protector";
            bDetected = true;
            break;
        }
    }

    return result();
}

================================================
FILE: db/ELF/packer_exepak.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "exepak");

function detect() {
    if (ELF.compareEP("b9........81e9........89cb83e9..be........89f7033d........f3a48b15........b8")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ELF/protector_Burneye.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Burneye");

function detect() {
    if (ELF.compareEP("FF35........9C608B0D........E9")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/ELF/protector_HASP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Hand Mill
/*
If errors pls contact HandMill on exelab.ru
*/

meta("protector", "HASP");

function detect() {
    if (ELF.getNumberOfSections() == 2) {
        if (ELF.isSectionNamePresent("protect") && (ELF.getSectionFileSize(0) == 0)) {
            var nOffset = ELF.getProgramFileOffset(3);
            var nSize = ELF.getProgramFileSize(3);
            if (ELF.findString(nOffset, nSize, "hasp") != -1) {
                bDetected = true;
            } else {
                var nOffset = ELF.getProgramFileOffset(1);
                var nSize = ELF.getProgramFileSize(1);
                if (ELF.findString(nOffset, nSize, "hasp") != -1) {
                    bDetected = true;
                }
            }

        }
    }

    return result();
}

================================================
FILE: db/FASM
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// FASM's PE DOS stub is tested twice - once to detect FASM as a compiler and
// again to prevent being detected as a linker (FASM has no linker).  Detect it
// once here.

var bFASM;

if (!bFASM && PE) {
    bFASM = PE.compare("'MZ'80000100000004001000FFFF00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\n$'0000000000000000'PE'0000");
}

================================================
FILE: db/FPC
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Free Pascal
// Author: Rinat Aminow <rinat84.a@gmail.com>

var bFPC;
if (typeof bFPC === "undefined" && typeof PE !== "undefined") {
    if (PE.section[".data"]) {
        var nOffset = PE.section[".data"].FileOffset + PE.section[".data"].FileSize - 0x1024;

        bFPC = PE.findString(nOffset, 0x1024, "FPC ") != -1;
    }
}

================================================
FILE: db/IPA/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = IPA;
var X = IPA;

================================================
FILE: db/ISO9660/_ISO9660.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "ISO9660");

function detect() {
    if (ISO9660.isVerbose()) {
        sName = ISO9660.getFileFormatName();
        sVersion = ISO9660.getFileFormatVersion();
        sOptions = ISO9660.getFileFormatOptions();

        if (sName) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = ISO9660;
var X = ISO9660;

================================================
FILE: db/ISO9660/bootloader_Grub.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/GNU_GRUB
meta("bootloader", "Grub");

function detect() {
    if (ISO9660.compare("'GRUB'", 0x00000180)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/filesystem_AppleHFS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Hierarchical_File_System_(Apple)
meta("filesystem", "Apple HFS");

function detect() {
    if (ISO9660.compare("'Apple_HFS'", 0x430) || ISO9660.compare("'Apple_map_partiton'", 0x230)) {
        sOptions = "ISO";
        bDetected = true;
    } else if (ISO9660.compare("'Apple_HFS'", 0x440) || ISO9660.compare("'Apple_map_partiton'", 0x240)) {
        sOptions = "BIN";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/iso_Rimage.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://rimage.incom.de/en/
meta("iso", "Rimage Image Server");

function detect() {
    if (Binary.compare("'Rimage Image Server Version: 8.6.604.1'", 0x00008373)) {
        sVersion = "8.6.604.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/library_IMAPI.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://learn.microsoft.com/en-us/windows/win32/imapi/imapi-interfaces
meta("library", "IMAPI");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier();

    if (sDataPreparer.indexOf("IMAPI ISO-9660 Formatter") !== -1) {
        sVersion = "1.0";
        bDetected = true;

        // Check if it's Microsoft & Roxio version
        if (sDataPreparer.indexOf("Microsoft & Roxio") !== -1) {
            sOptions = "Microsoft & Roxio";
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/library_IMAPI2.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://learn.microsoft.com/en-us/windows/win32/imapi/imapi-interfaces
meta("library", "IMAPI2");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier();

    if (sDataPreparer.indexOf("IMAPI2") !== -1) {
        bDetected = true;

        // Try to extract version if present
        // Format: "IMAPI2 (1.0) ISO9660 FORMATTER COPYRIGHT (C) 2004-2007 MICROSOFT"
        var nVerPos = sDataPreparer.indexOf("IMAPI2");
        if (nVerPos !== -1) {
            var sVersionPart = sDataPreparer.substring(nVerPos + 6).trim();
            if (sVersionPart.charAt(0) === '(') {
                var nClosePos = sVersionPart.indexOf(")");

                if (nClosePos !== -1) {
                    sVersion = sVersionPart.substring(1, nClosePos);
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/library_libburn.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://dev.lovelyhq.com/libburnia/libburn
meta("library", "libburn");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier();

    if (sDataPreparer.indexOf("LIBBURN") !== -1) {
        bDetected = true;

        // Try to extract version if present
        // Format: "XORRISO-1.5.4 2021.01.30.150001, LIBISOBURN-1.5.4, LIBISOFS-1.5.4, LIBBURN-1.5.4"
        var nVerPos = sDataPreparer.indexOf("LIBBURN-");
        if (nVerPos !== -1) {
            var sVersionPart = sDataPreparer.substring(nVerPos + 8),
                nCommaPos = sVersionPart.indexOf(",");

            if (nCommaPos !== -1) {
                sVersion = sVersionPart.substring(0, nCommaPos);
            } else {
                // No comma, might be at end of string
                sVersion = sVersionPart.trim();
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/library_libisoburn.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://dev.lovelyhq.com/libburnia/libisoburn
meta("library", "libisoburn");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier();

    if (sDataPreparer.indexOf("LIBISOBURN") !== -1) {
        bDetected = true;

        // Try to extract version if present
        // Format: "XORRISO-1.5.4 2021.01.30.150001, LIBISOBURN-1.5.4, LIBISOFS-1.5.4, LIBBURN-1.5.4"
        var nVerPos = sDataPreparer.indexOf("LIBISOBURN-");
        if (nVerPos !== -1) {
            var sVersionPart = sDataPreparer.substring(nVerPos + 11),
                nCommaPos = sVersionPart.indexOf(",");

            if (nCommaPos !== -1) {
                sVersion = sVersionPart.substring(0, nCommaPos);
            } else {
                var nSpacePos = sVersionPart.indexOf(" ");
                if (nSpacePos !== -1) {
                    sVersion = sVersionPart.substring(0, nSpacePos);
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/library_libisofs.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://dev.lovelyhq.com/libburnia/libisofs
meta("library", "libisofs");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier();

    if (sDataPreparer.indexOf("LIBISOFS") !== -1) {
        bDetected = true;

        // Try to extract version if present
        // Format: "XORRISO-1.5.4 2021.01.30.150001, LIBISOBURN-1.5.4, LIBISOFS-1.5.4, LIBBURN-1.5.4"
        var nVerPos = sDataPreparer.indexOf("LIBISOFS-");
        if (nVerPos !== -1) {
            var sVersionPart = sDataPreparer.substring(nVerPos + 9),
                nCommaPos = sVersionPart.indexOf(",");

            if (nCommaPos !== -1) {
                sVersion = sVersionPart.substring(0, nCommaPos);
            } else {
                var nSpacePos = sVersionPart.indexOf(" ");
                if (nSpacePos !== -1) {
                    sVersion = sVersionPart.substring(0, nSpacePos);
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/partition_EFI_PART.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/EFI_system_partition
meta("partition", "EFI PART");

function detect() {
    if (ISO9660.compare("'EFI PART'", 0x00000200)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_CDBurnerXP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://cdburnerxp.se/
meta("tool", "CDBurnerXP");

function detect() {
    if (ISO9660.compare("'CDBURNERXP PRO 3'", 0x0000823e)) {
        sVersion = "Pro 3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_CDIMAGE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/oscdimg-command-line-options
meta("tool", "CDIMAGE");

function detect() {
    var sAppId = ISO9660.getApplicationIdentifier();

    if (sAppId.indexOf("CDIMAGE") !== -1) {
        bDetected = true;

        // Try to extract version if present
        // Format: "CDIMAGE 2.54 (01/01/2005 TM)"
        var nVerPos = sAppId.indexOf("CDIMAGE");
        if (nVerPos !== -1) {
            var sVersionPart = sAppId.substring(nVerPos + 8).trim(),
                nSpacePos = sVersionPart.indexOf(" ");

            if (nSpacePos !== -1) {
                sVersion = sVersionPart.substring(0, nSpacePos);
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/tool_CeQuadrat.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "CeQuadrat");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier().toUpperCase();

    if (sDataPreparer.indexOf("CEQUADRAT") !== -1 && sDataPreparer.indexOf("ISO-9660 FORMATTER") !== -1) {
        bDetected = true;

        // Try to extract year/version from copyright notice
        // Format: "COPYRIGHT (C) 1995" or "COPYRIGHT (C) 1995-1998"
        var nIndex = sDataPreparer.indexOf("COPYRIGHT (C)");
        if (nIndex !== -1) {
            var sYearPart = sDataPreparer.substring(nIndex + 14, nIndex + 30).trim(),
                nYearEnd = sYearPart.indexOf(" ");

            if (nYearEnd !== -1) {
                sVersion = sYearPart.substring(0, nYearEnd).trim();
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/tool_ImgBurn.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.imgburn.com/
meta("tool", "ImgBurn");

function detect() {
    if (ISO9660.compare("'ImgBurn'", 0x00008373)) {
        sVersion = ISO9660.getString(0x0000837C, 7);
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_MKARCHISO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/archlinux/archiso/blob/master/archiso/mkarchiso
meta("tool", "MKARCHISO");

function detect() {
    if (ISO9660.compare("'REPARED BY MKARCHISO'", 0x000081bf)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_NeroBurningROM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.nero.com/
meta("tool", "Nero Burning ROM");

function detect() {
    var sAppId = ISO9660.getApplicationIdentifier();

    if (sAppId.indexOf("NERO___BURNING_ROM") !== -1) {
        bDetected = true;
    } else if (sAppId.indexOf("NERO BURNING ROM") !== -1) {
        bDetected = true;

        // Try to extract version if present
        var nVerPos = sAppId.indexOf("VER ");
        if (nVerPos !== -1) {
            var sVersionRaw = sAppId.substring(nVerPos + 4, nVerPos + 13).trim();
            // Convert version "12,0,20,0" -> "12.0.20000"
            var versionParts = sVersionRaw.split(",");
            if (versionParts.length >= 3) {
                var major = versionParts[0],
                    minor = versionParts[1],
                    build = parseInt(versionParts[2], 10) * 1000;

                sVersion = major + "." + minor + "." + build.toString();
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/tool_PersonalRomMaker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("tool", "The Personal RomMaker");

function detect() {
    if (ISO9660.compare("'The Personal RomMaker (32-bit Windows 95 V4.10)'", 0x00000800)) {
        sVersion = "4.10";
        sOptions = "Windows 95 32-bit";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_QuickToPix.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://phantom.sannata.org/viewtopic.php?t=40730
meta("tool", "QuickToPix");

function detect() {
    if (ISO9660.compare("'MI_QUICKTOPIX'", 0x000081bf)) {
        bDetected = true;
    } else if (ISO9660.compare("'MI QUICKTOPIX 2.00 BUILD 209_PHB_MPO'", 0x000081bf)) {
        sVersion = "2.00";
        sOptions = "Build: 209_PHB_MPO";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_RoxioToast.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Roxio_Toast
meta("tool", "Roxio Toast");

function detect() {
    if (ISO9660.compare("'TOAST 2.5 Partition'", 0x00000410)) {
        sVersion = "2.5";
        bDetected = true;
    } else if (ISO9660.compare("..'Toast 3.0 PPC HFS Optimizer'", 0x0000040f)) {
        sVersion = "3.0";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.0.2 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "3.0.2";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.0.5 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "3.0.5";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("....'Toast 3.5 PPC HFS Optimizer'", 0x0000040e)) {
        sVersion = "3.5";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.5.3 PPC Partition'", 0x00000410)) {
        sVersion = "3.5.3";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.5.4 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "3.5.4";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.5.5 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "3.5.5";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("....'Toast 3.5.6 PPC Partition'", 0x0000040e)) {
        sVersion = "3.5.6";
        sOptions = "PowerPC";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.5.6 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "3.5.6";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.5.7 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "3.5.7";
        sOptions = "PowerPC HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 3.5.7 PPC Partition'", 0x00000410)) {
        sVersion = "3.5.7";
        sOptions = "PowerPC";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 4.0 PPC HFS Optimizer'", 0x00000410)) {
        sVersion = "4.0";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("....'Toast 4.1 Partition'", 0x0000040e)) {
        sVersion = "4.1";
        bDetected = true;
    } else if (ISO9660.compare("....'Toast 4.1.3 Partition'", 0x0000040e)) {
        sVersion = "4.1.3";
        bDetected = true;
    } else if (ISO9660.compare("'Toast F-4.1.3 Partition'", 0x00000410)) {
        sVersion = "F-4.1.3";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 5.0 HFS Optimizer'", 0x00000410)) {
        sVersion = "5.0";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 5.0.2 HFS/Joliet Builder'", 0x00000410)) {
        sVersion = "5.0.2";
        sOptions = "HFS/Joliet Builder";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 5.0.2 HFS Optimizer'", 0x00000410)) {
        sVersion = "5.0.2";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 5.1.1 HFS Optimizer'", 0x00000410)) {
        sVersion = "5.1.1";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 5.2.3 HFS Optimizer'", 0x00000410)) {
        sVersion = "5.2.3";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 6.0 HFS Optimizer'", 0x00000410)) {
        sVersion = "6.0";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("..'Toast 6.0.7 HFS Optimizer'", 0x0000040f)) {
        sVersion = "6.0.7";
        sOptions = "HFS Optimizer";
        bDetected = true;
    } else if (ISO9660.compare("'Toast 9.0.2 HFS Optimizer'", 0x00000410)) {
        sVersion = "9.0.2";
        sOptions = "HFS Optimizer";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_UltraISO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.ultraiso.com/
meta("tool", "UltraISO");

function detect() {
    if (ISO9660.getString(0x8373) == "ULTRAISO") {
        sVersion = ISO9660.getString(0x837c);
        bDetected = true;
    }

    if (!bDetected) {
        var sAppId = ISO9660.getApplicationIdentifier();

        if (sAppId.indexOf("UltraISO") !== -1) {
            bDetected = true;

            // Try to extract version if present
            // Format: "UltraISO V7.2 CD & DVD Image Creator, Copyright (c)2002-2004 EZB Systems, Inc."
            var nVerPos = sAppId.indexOf("UltraISO");
            if (nVerPos !== -1) {
                var sVersionPart = sAppId.substring(nVerPos + 9).trim();
                if (sVersionPart.charAt(0) === 'V') {
                    var nSpacePos = sVersionPart.indexOf(" ");
                    if (nSpacePos !== -1) {
                        sVersion = sVersionPart.substring(1, nSpacePos);
                    }
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_WinISO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://winiso.com/
meta("tool", "WinISO");

function detect() {
    if (ISO9660.compare("'WinISO software'", 0x0000813e)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/ISO9660/tool_genisoimage.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// Part of cdrkit project
meta("tool", "genisoimage");

function detect() {
    var sAppId = ISO9660.getApplicationIdentifier().toUpperCase();

    if (sAppId.indexOf("GENISOIMAGE") !== -1) {
        bDetected = true;

        // Try to extract version from copyright years
        // Format: "GENISOIMAGE ISO 9660/HFS FILESYSTEM CREATOR (C) 1993 E.YOUNGDALE (C) 1997-2006 J.PEARSON/J.SCHILLING (C) 2006-2007 CDRKIT TEAM"
        var nCdrkitPos = sAppId.indexOf("CDRKIT TEAM");
        if (nCdrkitPos !== -1) {
            // Look for the year range before "CDRKIT TEAM"
            var sPart = sAppId.substring(0, nCdrkitPos),
                nLastCPos = sPart.lastIndexOf("(C)");

            if (nLastCPos !== -1) {
                var sYearPart = sPart.substring(nLastCPos + 4).trim(),
                    nSpacePos = sYearPart.indexOf(" ");

                if (nSpacePos !== -1) {
                    sVersion = sYearPart.substring(0, nSpacePos).trim();
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/ISO9660/tool_xorriso.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.gnu.org/software/xorriso/
meta("tool", "xorriso");

function detect() {
    var sDataPreparer = ISO9660.getDataPreparerIdentifier();

    if (sDataPreparer.indexOf("XORRISO") !== -1) {
        bDetected = true;

        // Try to extract version if present
        // Format: "XORRISO-1.5.4 2021.01.30.150001, LIBISOBURN-1.5.4, LIBISOFS-1.5.4, LIBBURN-1.5.4"
        var nVerPos = sDataPreparer.indexOf("XORRISO-");
        if (nVerPos !== -1) {
            var sVersionPart = sDataPreparer.substring(nVerPos + 8),
                nSpacePos = sVersionPart.indexOf(" ");

            if (nSpacePos !== -1) {
                sVersion = sVersionPart.substring(0, nSpacePos);
            }
        }
    }

    return result();
}


================================================
FILE: db/Image/_Image.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Image");

function detect() {
    if (Image.isVerbose()) {
        sName = Image.getFileFormatName();
        sVersion = Image.getFileFormatVersion();
        sOptions = Image.getFileFormatOptions();
        
        if (sName) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/Image/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = Image;
var X = Image;

================================================
FILE: db/JAR/_JAR.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("virtual machine", "JVM");

function detect() {
    if (JAR.isVerbose()) {
        sName = JAR.getOperationSystemName();
        sVersion = JAR.getOperationSystemVersion();
        sOptions = JAR.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/JAR/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = JAR;
var X = JAR;

================================================
FILE: db/JAR/tool_SingleJar.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "SingleJar");

function detect() {
    if (JAR.getManifestRecord("Created-By") == "singlejar") {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/JPEG/_Jpeg.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "JPEG");

function detect() {
    sName = Jpeg.getFileFormatName();
    sVersion = Jpeg.getFileFormatVersion();
    sOptions = Jpeg.getFileFormatOptions();
    
    if (sName) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/JPEG/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = Jpeg;
var X = Jpeg;

================================================
FILE: db/JPEG/camera_camera.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("camera", "");

function detect() {
    sName = Jpeg.getExifCameraName().replace(/\s{2,}/g, " ").trim();

    if (sName) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/JPEG/image_DQT.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("image", "DQT");

function detect() {
    bDetected = true;
    sOptions = Jpeg.getDqtMD5();

    return result();
}

================================================
FILE: db/JPEG/image_comment.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("image", "comment");

function detect() {
    sOptions = Jpeg.getComment();

    if (sOptions) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/JPEG/tool_Tools.3.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("tool", "");

function detect() {
    if (Jpeg.isChunkPresent(0xE2)) {
        _setResult("tool", "FlashPix/ICC", "", "");
    }
    if (Jpeg.isChunkPresent(0xE3)) {
        _setResult("tool", "Kodak", "", "");
    }
    if (Jpeg.isChunkPresent(0xE4)) {
        _setResult("tool", "FlashPix", "", "");
    }
    if (Jpeg.isChunkPresent(0xE5)) {
        _setResult("tool", "Ricoh", "", "");
    }
    if (Jpeg.isChunkPresent(0xE6)) {
        _setResult("tool", "GoPro", "", "");
    }
    if (Jpeg.isChunkPresent(0xE7)) {
        _setResult("tool", "Pentax/Qualcomm", "", "");
    }
    if (Jpeg.isChunkPresent(0xE8)) {
        _setResult("tool", "Spiff", "", "");
    }
    if (Jpeg.isChunkPresent(0xE9)) {
        _setResult("tool", "MediaJukebox", "", "");
    }
    if (Jpeg.isChunkPresent(0xEA)) {
        _setResult("tool", "PhotoStudio", "", "");
    }
    if (Jpeg.isChunkPresent(0xEB)) {
        _setResult("tool", "HDR", "", "");
    }
    if (Jpeg.isChunkPresent(0xEC)) {
        _setResult("tool", "Photoshop", "", "Web");
    }
    if (Jpeg.isChunkPresent(0xED)) {
        _setResult("tool", "Photoshop", "", "");
    }
    if (Jpeg.isChunkPresent(0xEE)) {
        _setResult("tool", "Adobe", "", "");
    }
    if (Jpeg.isChunkPresent(0xEF)) {
        _setResult("tool", "GraphicConverter", "", "");
    }

    return result();
}

================================================
FILE: db/JavaClass/_JavaClass.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "JavaClass");

function detect() {
    sName = JavaClass.getFileFormatName();
    sVersion = JavaClass.getFileFormatVersion();
    sOptions = JavaClass.getFileFormatOptions();

    bDetected = true;

    return result();
}


================================================
FILE: db/JavaClass/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = JavaClass;
var X = JavaClass;

================================================
FILE: db/LE/_LE.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Windows");

function detect() {
    if (LE.isVerbose()) {
        sName = LE.getOperationSystemName();
        sVersion = LE.getOperationSystemVersion();
        sOptions = LE.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/LE/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = LE;
var X = LE;

================================================
FILE: db/LE/compiler_Watcom_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Watcom C");

function detect() {
    if (LE.compareEP("eb$$fb83e4..8bdc891d........891d........66b8....66a3........bb........2bc0b430cd21a2")) {
        sName = "Watcom C/C++";
        sOptions = "1988-93";
        bDetected = true;
    } else if (LE.compareEP("eb$$fb83e4..89e3891d........891d........66b8....66a3........bb........29c0b430cd21a2")) {
        sName = "Open Watcom C/C++";
        sOptions = "1988-2002";
        bDetected = true;
    } else if (LE.compareEP("eb$$fb83e4..89e3891d........891d........55575666b8....cd21668cc00f00e875..0f00eb75")) {
        sName = "Open Watcom C/C++";
        sOptions = "1988-1995";
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/LE/packer_UPX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "UPX");

function getUPXOptions(nOffset) {
    var nMethod = LE.readByte(nOffset + 2);
    var nLevel = LE.readByte(nOffset + 3);

    var sCompression = "";
    switch (nMethod) // From http://sourceforge.net/p/upx/code/ci/default/tree/src/conf.h
    {
        case 2:
            sCompression = "NRV2B_LE32";
            break;
        case 3:
            sCompression = "NRV2B_8";
            break;
        case 4:
            sCompression = "NRV2B_LE16";
            break;
        case 5:
            sCompression = "NRV2D_LE32";
            break;
        case 6:
            sCompression = "NRV2D_8";
            break;
        case 7:
            sCompression = "NRV2D_LE16";
            break;
        case 8:
            sCompression = "NRV2E_LE32";
            break;
        case 9:
            sCompression = "NRV2E_8";
            break;
        case 10:
            sCompression = "NRV";
            break;
        case 14:
            sCompression = "LZMA";
            break;
        case 15:
            sCompression = "zlib";
            break;
    }

    if (sCompression) {
        sOptions = sOptions.append(sCompression);
        if (nLevel == 8) {
            sOptions = sOptions.append("best");
        } else {
            sOptions = sOptions.append("brute");
        }
    }
}

function getUPXVersion() {
    var nEP = LE.getEntryPointOffset();
    var nOffset1 = LE.findString(nEP - 1024, 1024, "$Id: UPX ");
    var nOffset2 = LE.findString(nEP, 1024, "UPX!");
    if (nOffset2 != -1) {
        getUPXOptions(nOffset2 + 4);
    }

    if (nOffset1 != -1) {
        sVersion = LE.getString(nOffset1 + 9, 4);
    }
    if ((sVersion == "") && (nOffset2 != -1)) {
        sVersion = LE.getString(nOffset2 - 5, 4);
    }
}

function detect() {
    if (LE.compareEP("bf........6957..........061e07578db7........8dbf........b9........fdf3a5fc8d77..5f83cd..57e9")) {
        sOptions = "for Watcom C";
        bDetected = true;
    } else if (LE.compareEP("bf........be........6957..........57fc31db83cd..909001db75")) {
        sOptions = "for Watcom C";
        bDetected = true;
    }
    getUPXVersion();

    return result();
}

================================================
FILE: db/LX/_LX.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "OS/2");

function detect() {
    if (LX.isVerbose()) {
        sName = LX.getOperationSystemName();
        sVersion = LX.getOperationSystemVersion();
        sOptions = LX.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/LX/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = LX;
var X = LX;

================================================
FILE: db/LX/compiler_Borland_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Borland C++");

function detect() {
    if (LX.compareEP("8b4424..a3........5868........50e8........e9$$$$$$$$558bec83ec..535756e8........68")) {
        sVersion = "1992";
    } else if (LX.compareEP("8b4424..a3........5868........50e9$$$$$$$$558bec83ec..53575668........ff35")) {
        sVersion = "1992";
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    sLang = "C/C++";

    return result();
}

================================================
FILE: db/LX/compiler_Watcom_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Watcom C/C++");

function detect() {
    if (LX.compareEP("e9$$$$$$$$535152565783ec..e8........8b5c24..a3........894424..eb")) {
        sOptions = "1988-95";
    } else if (LX.compareEP("e9$$$$$$$$535152565783ec..8b7424..83c724....74..e8")) {
        sOptions = "1988-95";
    } else if (LX.compareEP("e9$$$$$$$$53515283ec..b8........8b4c24..8b5c24..8b5424..e8........89e0")) {
        sOptions = "1988-95";
    } else if (LX.compareEP("e9$$$$$$$$535152565783ec..8b7424..837c24....74..e8")) {
        sOptions = "1988-95";
    } else if (LX.compareEP("e9$$$$$$$$535152565781ec........8bb424........83bc24..........74..e8")) {
        sOptions = "1988-95";
    } else if (LX.compareEP("e9$$$$$$$$5351525657558b5c24..8b7424..85f674..5653e8........8b15")) {
        sOptions = "1988-94";
    } else if (LX.compareEP("e9$$$$$$$$53515283ec..837c24....74..e8........ba........89c3")) {
        sOptions = "1988-94";
    } else if (LX.compareEP("e9$$$$$$$$53575581ec........8b9c24........8b9424........85d274..5253")) {
        sOptions = "1988-94";
    } else if (LX.compareEP("e9$$$$$$$$535657558b5c24..8b7424..85f674..5653e8........8b15")) {
        sOptions = "1988-94";
    } else if (LX.compareEP("e9$$$$$$$$535152575581ec........8b9c24........8b9424........85d274..5253")) {
        sOptions = "1988-94";
    } else if (LX.compareEP("e9$$$$$$$$5351525657558b5c24..8b7424..85f674..8b15........83fa..7e..8d5a..31c0891d")) {
        sOptions = "1988-2002";
    } else if (LX.compareEP("eb$$e9$$$$$$$$51525589e550508b45..eb..89d08d50..8038..75..8b45..a3........8915")) {
        sName = "Watcom C 386";
        sOptions = "1989, 1992";
    } else if (LX.compareEP("eb$$e9$$$$$$$$51525589e5837d....74..e8........89c2e8........89d0")) {
        sName = "Watcom C 386";
        sOptions = "1989, 1992";
    } else if (LX.compareEP("e9$$$$$$$$535657558b5c24..8b7424..85f674..8b15........83fa..7e..8d5a..31c0")) {
        sName = "Open Watcom C/C++";
        sOptions = "1988-2002";
    } else if (LX.compareEP("e9$$$$$$$$535152565589e583ec..b8........e8........a1........83c0..24..31d2")) {
        sName = "Open Watcom C/C++";
        sOptions = "1988-2002";
    } else if (LX.compareEP("e9$$$$$$$$53515257c8......8b5d..837d....0f84........833d..........7e..ff")) {
        sName = "Open Watcom C/C++";
        sOptions = "1988-2002";
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    sLang = "C/C++";

    return result();
}

================================================
FILE: db/MACH/_MACH.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "macOS");

function detect() {
    if (MACH.isVerbose()) {
        sName = MACH.getOperationSystemName();
        sVersion = MACH.getOperationSystemVersion();
        sOptions = MACH.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MACH/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = MACH;
var X = MACH;

================================================
FILE: db/MACH/compiler_Delphi.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Delphi");

function detect() {
    var nSection = MACH.getSectionNumber("__rodata");
    if (nSection != -1) {
        var nOffset = MACH.findSignature(ACH.getSectionFileOffset(nSection), MACH.getSectionFileSize(nSection), "'TObject'");
        if (nOffset != -1) {
            sName = "Embarcadero Delphi";
            sVersion = "XE2-XE6"
            bDetected = true;
        }
    }

    sLang = "Delphi";

    return result();
}


================================================
FILE: db/MACH/compiler_Rust.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Rust");

function detect() {

    //x86-64
    if (MACH.compareEP("554889e5415741564154534883ec..31ffbe........31c0e8........83f8")) {
        bDetected = true;
    } else if (MACH.compareEP("554889e54883ec..4889f14863d7488d05........488945..488d35........488d7df84531c0")) {
        bDetected = true;
    } else if (MACH.compareEP("554889e5415741564154534881ec........31ffbe........31c0e8........83f8")) {
        bDetected = true;
    } else if (MACH.compareEP("554889e541574156534881ec........31ffbe........31c0e8........83f8")) {
        bDetected = true;
    } else if (MACH.compareEP("554889e541574156534883ec..31ffbe........31c0e8........83f8")) {
        bDetected = true;
    }

    //ARM64
    if (MACH.compareEP("ff8300d1fd7b01a9fd430091e30301aa027c4093")) {
        bDetected = true;
    } else if (MACH.compareEP("ff....d1fc6f..a9fa67..a9f85f..a9f657..a9f44f..a9")) {
        bDetected = true;
    } else if (MACH.compareEP("ffc303d1fa670aa9f85f0ba9f6570ca9f44f0da9fd7b0ea9")) {
        bDetected = true;
    } else if (MACH.compareEP("ff8302d1f85f06a9f65707a9f44f08a9fd7b09a9fd430291")) {
        bDetected = true;
    }

    sLang = "Rust";

    return result();
}

================================================
FILE: db/MACH/compiler_Zig.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Zig");

function detect() {
    if ((MACH.isSectionNamePresent("__cstring")) && (MACH.isDeepScan())) {
        var nIndex = MACH.getSectionNumber("__cstring");

        bDetected = MACH.findSignature(
            MACH.getSectionFileOffset(nIndex),
            MACH.getSectionFileSize(nIndex),
            "5a49475f44454255475f434f4c4f52"); // ANSI ZIG_DEBUG_COLOR
    }

    sLang = "Zig";

    return result();
}


================================================
FILE: db/MACH/compiler_gcc.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "gcc");

function detect() {
    /* if(MACH.isLibraryPresent("libstdc++.6.dylib"))
    {
        sOptions="libstdc++";
        bDetected=1;
    }
    else if(MACH.isLibraryPresent("libc++.1.dylib"))
    {
        sOptions="C++";
        bDetected=1;
    }
    else if(MACH.isLibraryPresent("libgcc_s.1.dylib"))
    {
        sOptions="C/C++";
        bDetected=1;
    }
    else if(MACH.isLibraryPresent("libobjc.A.dylib"))
    {
        sOptions="Objective-C";
        bDetected=1;
    } */

    if (MACH.isLibraryPresent("libgcc_s.1.dylib")) {
        sOptions = "C/C++";
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/MACH/library_Carbon.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Carbon");

function detect() {
    if (MACH.isLibraryPresent("Carbon")) {
        bDetected = true;
    } else if (MACH.isLibraryPresent("CarbonCore")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MACH/library_Cocoa.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Cocoa");

function detect() {
    if (MACH.isLibraryPresent("Cocoa")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MACH/library_QT.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "QT");

function getVersion() {
    var current = MACH.getLibraryCurrentVersion("QtCore");

    return ((current >> 16) & 0xFF) + "." + ((current >> 8) & 0xFF) + "." + (current & 0xFF);
}

function detect() {
    if (MACH.isLibraryPresent("QtCore")) {
        sVersion = getVersion();
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MACH/library_WebKit.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "WebKit");

function detect() {
    if (MACH.isLibraryPresent("WebKit")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MACH/library_java.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Java Runtime");

function detect() {
    if (MACH.isLibraryPresent("libjava.dylib")) {
        bDetected = true;
    } else if (MACH.isLibraryPresent("libjvm.dylib")) {
        bDetected = true;
    }

    sLang = "Java";

    return result();
}


================================================
FILE: db/MACH/packer_UPX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "UPX");

function detect() {
    if (MACH.getNumberOfSections() == 2) {
        var nOffset = MACH.findString(0, MACH.getSize(), "$Id: UPX");
        if (nOffset != -1) {
            sVersion = MACH.getString(nOffset + 9, 4);
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/MACH/packer_Virbox.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Vito <@ScalletaZ>

meta("packer", "Virbox");

function detect() {
    if (MACH.getSectionNumber("__vdata") != -1) {
        sVersion = "Virbox Protector";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MACHOFAT/_MACHOFAT.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "macOS");

function detect() {
    if (MACHOFAT.isVerbose()) {
        sName = MACHOFAT.getOperationSystemName();
        sVersion = MACHOFAT.getOperationSystemVersion();
        sOptions = MACHOFAT.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MACHOFAT/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = MACHOFAT;
var X = MACHOFAT;

================================================
FILE: db/MACHOFAT/converter_lipo.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("converter", "lipo");

function detect() {
    bDetected = true; // Always true

    return result();
}


================================================
FILE: db/MFC
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// MFC is tested twice - as a library and as a compiler (to distinguish C from
// C++).  Detect it once here.

var aMFC;

if (!aMFC && PE) {
    aMFC = PE.isLibraryPresentExp(/^MFC(\d+?)(u?)(d?)\.dll/i);
    if (!aMFC) {
        if (PE.section[".data"] &&
            PE.isSignatureInSectionPresent(PE.section[".data"].Number, "'CMFCComObject'")) {
            aMFC = 1;
        }
    }
}

================================================
FILE: db/MSDOS/ACE.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("ACE");

function detect() {
    detect_ACE(0);

    return result();
}

================================================
FILE: db/MSDOS/Adys_COM2EXE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("converter", "Ady`s COM2EXE");

function detect() {
    if (MSDOS.compare("'Ady'27", 28)) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/Adys_Glue.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Ady`s Glue");

function detect() {
    if (MSDOS.compareEP("2E........0E1FBF....33DB33C0AC")) {
        sVersion = "1.10";
        bDetected = true;
    } else if (MSDOS.compareEP("2E8C06....0E0733C08ED8BE....BF....FCB9....56F3A51E075F")) {
        sVersion = "0.10";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/Anti-hack_encryption_system.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Anti-hack encryption system");

function detect() {
    if (MSDOS.compareEP("eb$$bd....33c08ec026c706........268c0e....8b46..26a3....268c0e....0e07")) {
        sOptions = "by Rezaul Kabir //Shuvro";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Aztec_C-86.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Aztec C-86");

function detect() {
    if (MSDOS.compareEP("bd....85ed75..8cdd2e8c1e....8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5")) {
        sVersion = "3.40";
        sOptions = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....85ed75..b8....e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc2")) {
        sVersion = "3.40b";
        sOptions = "1986";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....85ed75..8cdd8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5268c1e....b1..d3e3")) {
        sVersion = "5.2a";
        sOptions = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....85ed75..b8....50e8....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")) {
        sVersion = "5.2a";
        sOptions = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....85ed75..b8....509a........8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")) {
        sVersion = "5.2a";
        sOptions = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....85ed75..b0..e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")) {
        sVersion = "5.2a";
        sOptions = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed82e80........ba....75..e8....3d....75..e9$$$$8cc38edb2e891e....be....8a0c80f9..74..80f9..7e")) {
        sVersion = "3.20X";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$3d....74..eb$$2ec606......502e891e....2e890e....2e8916....8cd82ea3....8cc02ea3....2e8936")) {
        sVersion = "3.20X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/BlackWolf_Protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "BlackWolf Protection");

function detect() {
    if (MSDOS.compareEP("061e0e0e071fbe....b9....871481c2....53e8")) {
        sOptions = "1996 by p.q.";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/Black_fist.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "BlacK FiST");

function detect() {
    if (MSDOS.compareEP("eb$$061ee8....1f072ea1....2e8b1e....8cd12e2b0e....fa8ed1fb5053cb")) {
        sOptions = "1993";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Borland_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("compiler", "Borland C/C++");

function detect() {
    var nOffset = 0;
    if (MSDOS.compareEP("FB")) {
        nOffset = 1;
    }
    if (MSDOS.compareEP("BA....2E8916....B430CD218B2E02008B1E2C008EDA", nOffset)) {
        var nDataSeg = MSDOS.readWord(MSDOS.getEntryPointOffset(nOffset + 1));
        nOffset = MSDOS.addressToOffset(nDataSeg);
        bDetected = true;
    } else if (MSDOS.compareEP("8CCA2E8916....B430CD218B2E02008B1E2C008EDAA3")) {
        var nDataOfs = MSDOS.readWord(MSDOS.getEntryPointOffset(22));
        nOffset = MSDOS.addressToOffset(0, nDataOfs - 120);
        bDetected = true;
    }
    nOffset = MSDOS.findString(nOffset, 64, " - Copyright ");
    if (nOffset != -1) {
        sVersion = MSDOS.getString(nOffset + 13, 4);
        if (MSDOS.compare("43", nOffset - 1)) {
            sName = "Turbo C";
            if (sVersion == "(c) ") {
                sVersion = MSDOS.getString(nOffset + 17, 4);
            }
        } else if (MSDOS.compare("'Turbo'", nOffset - 9)) {
            sName = "Turbo C/C++";
        } else if (sVersion == "1991") {
            sVersion = "3.1";
        } else if (sVersion == "1994") {
            sVersion = "4.X";
        }
        bDetected = true;
    }
    if (MSDOS.compareEP("b4..cd103c..74..b8....cd10ba....2e8916....8b2e....8b1e....8eda8c06....891e....892e....a1")) {
        sVersion = "1991";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8")) {
        sVersion = "1991";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c43e....8bc78bd8")) {
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......C7..........E8....C4......8bc78bd8b9....26........75")) {
        sName = "Turbo C";
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......8cd22bea8b3e....81ff....73..bf....893e....b1")) {
        sName = "Turbo C";
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......53E8....0733FF2BDB8BC3B9....FCF2AEE3..4326......75..80")) {
        sName = "Turbo C";
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("FBBA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681")) {
        sName = "Turbo C";
        sVersion = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("FB8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681")) {
        sName = "Turbo C";
        sVersion = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("BA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........8ec333c0b9....8bf88bd82681......75")) {
        sName = "Turbo C";
        sVersion = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706")) {
        sName = "Turbo C";
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......E8")) {
        sName = "Turbo C";
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd8bb....8edb8cd38bccfa8e16....bc....fbe8....fa8ed38be1fbea")) {
        sName = "Turbo C";
        sVersion = "1988";
        bDetected = true;
    }

    sLang = sName.indexOf("C++") !== -1 ? "C" : "C++";

    return result();
}

================================================
FILE: db/MSDOS/Borland_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Borland Pascal");

function detect() {
    if (MSDOS.compareEP("9AFFFF00009AFFFF00005589E531C09AFFFF0000")) {
        sVersion = "7.0*";
        bDetected = true;
    } else if (MSDOS.compareEP("B8....BB....8ED08BE38CD88EC00E1FA1....25....A3....E8....833E......75")) {
        sVersion = "7.0*";
        sOptions = "Protected Mode";
        bDetected = true;
    } else if (MSDOS.compareEP("B8....8ED88C......8CD38CC02BD88BC405....C1....03D8B4..CD210E")) {
        sVersion = "7.0*";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########ba....8eda8c06....33ed8bc405....b1..d3e88cd203c2a3....a3")) {
        sVersion = "7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########ba....8eda8c06....33ede8....e8....8bc405....b1..d3e88cd203c2a3....a3....0306....a3....a3....a3....a3....8e06....26a1....a3....c706")) {
        sVersion = "6.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########06ba....8eda268b3e....8ec25b8bef83ed..1eb8....8ed8b9....2bc8d1e1")) {
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########ba....8eda8c06....8bc405....a3....8c16....05....b1..d3e88cd203c2a3....a3")) {
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########ba....8edae8....8c06....33ed8bc405....b1..d3e88cd203c2c706")) {
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########5589e50ee8$$$$5589e583ec..31c0")) {
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########ba....8eda8c06....8bc405....b1..d3e88cd203c2a3....a3....26a1....2d....a3....c706")) {
        sVersion = "4.0-6.0";
        sOptions = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########54583bc475..9c585080cc..509d9c589d80e4..75..bb....e8....b8....cd21ba....8eda")) {
        sVersion = "6.0-7.0";
        sOptions = "1992 by Borland & Eagle Performance Software";
        bDetected = true;
    } else if (MSDOS.compareEP("9a........5589e5bf....0e57e8$$$$f9")) {
        sName = "Turbo Pascal";
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########b8....8ed88c06....cb")) {
        sName = "Turbo Pascal";
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########ba....8eda8c06....b430cd2186c43d....73..0e1f")) {
        sName = "Turbo Pascal";
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("31ed9a########2e8e1e....b451cd21891e....803e......74..f706........74..e8")) {
        sName = "Turbo Pascal";
        sVersion = "6.0-7.0";
        bDetected = true;
    }
    if (MSDOS.compareEP("9a########f860f972..8bdc36c51f83c3..807f....74..807f")) {
        sName = "Turbo Pascal";
        sVersion = "6.0-7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9A0000")) {
        var nDataSeg = MSDOS.readWord(MSDOS.getEntryPointOffset(3));
        var nOffset = MSDOS.addressToOffset(nDataSeg);
        nOffset = MSDOS.findSignature(nOffset, Math.min(1024, MSDOS.getSize() - nOffset),
            "'Portions Copyr    ight (c) 1983,9'..' Borland'");
        if (nOffset != -1) {
            switch (MSDOS.getString(nOffset + 29, 1)) {
                case "0":
                    sVersion = "5.0";
                    sName = "Turbo Pascal";
                    break; // guess
                case "1":
                    sVersion = "6.0";
                    sName = "Turbo Pascal";
                    break; // guess
                case "2":
                    sVersion = "7.0";
                    break;
            }
            bDetected = true;
        }
    }

    sLang = "Pascal";

    return result();
}


================================================
FILE: db/MSDOS/Borland_RTM.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Borland RTM DPMI loader");

function getBLVersion() {
    var sResult = "";

    var nOffset = MSDOS.findString(0, MSDOS.getSize(), "RTM loader version")

    if (nOffset != -1) {
        sResult = MSDOS.getString(nOffset + 19);
        sResult = sResult.substr(0, sResult.indexOf(' '));
    }

    return sResult;
}

function detect() {
    if (MSDOS.compareEP("b8....8ed8b8....bb....8ed08be38926....0626......8ec0263b......74..e9")) {
        sVersion = "1.0-1.5";
        bDetected = true;
    }

    if (bDetected) {
        var sBL = getBLVersion();
        if (sBL) {
            sVersion = sBL;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/Borland_TDS.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("debug", "Borland TLINK Symbol Table Present");

function detect() {
    if (MSDOS.compareOverlay("FB52")) {
        var offset = MSDOS.getOverlayOffset();
        var minor = MSDOS.readByte(offset + 0x2);
        var major = MSDOS.readByte(offset + 0x3);
        var minorStr = ((minor >> 4) * 10 + (minor & 0x0F)).toString();
        var majorStr = ((major >> 4) * 10 + (major & 0x0F)).toString();
        sVersion = majorStr + "." + minorStr;

        sOptions = "TDS";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/Borland_TLINK.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("linker", "Borland TLINK");

function detect() {
    var nVer = MSDOS.readWord(0x1E);
    if ((nVer & 0xFF) == 0xFB) {
        sVersion = ((nVer >> 8) / 16).toFixed(1);
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/CSCRYPT_Pro.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CSCRYPT Pro");

function detect() {
    if (MSDOS.compareEP("8d36....565f81ef....b8....81ef....81c0....81f7....2e2935474781c6....e9")) {
        sVersion = "3.30/386";
        sOptions = "1995-97 by Christian Schwarz";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Concurrent_Small_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Concurrent Small C");

function detect() {
    if (MSDOS.compareEP("b8....8ed826a1....2d....80fc..72..9090b8....b1..d3e0fa8cdb8ed38be050fbb8....2d....d3e08bd8fec7fec73b..72..9090")) {
        sVersion = "1.0";
        sOptions = "1996 by Andy Yuen";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/CopyQM_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "CopyQM SFX");

function detect() {
    if (MSDOS.compareEP("e9$$$$b8....8ec0a1....26a3....268c1e")) {
        if (MSDOS.compareOverlay("'TX'")) {
            sVersion = "3.24";
            sOptions = "1996 by Sydex";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/Crypt_(Dismember).2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Cryptor by Dismember");

function detect() {
    if (MSDOS.compareEP("1E8CDA83....8EDA8EC2BB....BA....85D274..B4..33FF33F6B9....AC32C4C0....02..2E........AAE2")) {
        sVersion = "1.3";
        bDetected = true;
    } else if (MSDOS.compareEP("0E179C58F6....74..E9....1EB0..E6..8CDA83....8EDA8EC2BB....BA....85D274..B4..33FF33F6B9")) {
        sVersion = "1.7";
        bDetected = true;
    } else if (MSDOS.compareEP("0E179C58F6....74..EB$$b0..e6..33c9e2..b430cd213c..73..33c00650cb")) {
        sVersion = "1.7";
        bDetected = true;
    } else if (MSDOS.compareEP("fa061e8cdd83c5..2e012e....2e012e....e8....e8....1f072e8e16....2e8b26....fb2eff2e")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$bf....8bf7acad918ae157ac32c4f6d0d0c412e1aae2")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Crypt_(LightShow).2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Crypt by LightShow //ECLIPSE");

function detect() {
    if (MSDOS.compareEP("e9$$$$eb$$8cc8fa8ed0bc....fb8cc0bb....83e8..8ed833f64b8ccd8cc02ea3....33c08ec026a1....2ea3....26a1")) {
        sVersion = "1.21";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8cc883e8..8ed833f68ccb8cc02ea3....2bc08ec08bf8b9....26ff36....26ff36....26894d..26895d..b9")) {
        sVersion = "1.15";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$eb$$8cc8fa8ed0bc....8cc0bb....83e8..8ed833f64b8ccd8cc02ea3....5333c08ec0268c0e....26c706........1f")) {
        sVersion = "1.20";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8cc8fa8ed0bc....fb8cc0bb....83e8..8ed833f64b8ccd8cc02ea3....33c08ec026a1....2ea3....26a1")) {
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$2e8b36....2e8974..8ccb8cc02e8944..2bc08ec08ed88bf82e8b4c..81c1....6a..ff36....ff36....894d..895d")) {
        sVersion = "1.11";
        sOptions = "1994";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/DAEMON_Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DAEMON Protect");

function detect() {
    if (MSDOS.compareEP("60609C8CC932C9E30C520F014C24FE5A83C20C8B1A9D61")) {
        sVersion = "0.6.7";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/DOS32_loader.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("loader", "DOS32 loader");

function detect() {
    if (MSDOS.compareEP("8cd88ccb2bd88bc4b1..d3e803d843b4..cd218e06....8cd80e1fa3....a3....a3....fc33c033ffeb")) {
        sVersion = "3.3";
        sOptions = "1995 by Adam Seychell";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/DOS_16M.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "DOS/16M DOS Extender");

function detect() {
    if (MSDOS.compareEP("bf....8ed781c4....be....2bf73689......8bc6b1..d3e04836a3....be....468936....8cc32bdef7dbb44acd21368c......1607fcbf....b9....2bcf33c0")) {
        sOptions = "1991 by Rational Systems, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8ec78ed7bc....368c......ff36....268f......be....ac8ad8b7..88388b3e....4f8ec726a1....36f726....4836a3....8e06....33c08bc8f7d18bf8f2ae26")) {
        sOptions = "1994 by Tenberry Software Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8ec78ed7bc....368c1e....ff36....368f06....be....ac8ad8b7..88388b3e....4f8ec726a1....36f726....4836a3....8e06....33c08bc8f7d18bf8f2ae26")) {
        sOptions = "1995 by Tenberry Software";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8ec78ed7bc....368c1e....ff36....368f06....be....ac8ad8b7..883816078b3e....4f8ec726a1....36f726....4836a3....8e06....33c08bc8f7d18bf8f2ae26")) {
        sOptions = "1994 by Rational Systems, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8ec78ed7bc....368c1e....1607be....ac98508b3e....4f8ec726a1....c1e0..4836a3....8e06....33c08bc8f7d18bf8f2ae26")) {
        sOptions = "1993 by Rational Systems, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8ed781c4....be....2bf7368926....368926....8bc6b1..d3e04836a3....be....468936....8cc32bdef7dbb4..cd21")) {
        sOptions = "1989 by Rational Systems, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("BF....8ED781C4....BE....2BF78BC6B1..D3E04836A3....368926....BE....468936....8CC32BDEF7DBB4..CD21368C")) {
        sOptions = "1987-1992 by Rational Systems, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/DOS_32A.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "DOS/32A DOS Extender");

function detect() {
    if (MSDOS.compareEP("fb0e1f8c1e....8c06....8c16....26a1....a3....fce8....e8....e8....8cd0268b36....05")) {
        sVersion = "R9-07.0101.2011";
        sOptions = "1996-98, 2002 by Narech Koumar (Supernar Systems, Ltd.)";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f8cc08cd3a3....2bd88bc4d1e8d1e8")) {
        sVersion = "R8-07.0101.0076";
        sOptions = "1996-98, 2002 by Narech Koumar (Supernar Systems, Ltd.)";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f8c1e....8c06....8c16....26a1....a3....fbfce8")) {
        sVersion = "04-20-06";
        sOptions = "1996-2006 by Narech Koumar (Supernar Systems, Ltd.)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Digital_Research_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Digital Research C");

function detect() {
    if (MSDOS.compareEP("eb$$0e17bc....a1....8cdb0e1f891e....a3....8cc80306....a3....b9....2bdb8bf3bf....8cc803050306")) {
        sVersion = "1.1";
        sOptions = "1983";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/Disk_eXPress.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "Disk eXPress");

function detect() {
    if (MSDOS.compareOverlay("be9b8710415302")) {
        if (MSDOS.compareEP("fca3....891e....49890e....bb....8c1f83e4..8967..b8....50")) {
            sOptions = "1991-93 by Albert J. Shan";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/MSDOS/EMMXXXX0_check.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "EMMXXXX0 check by Symantec");

function detect() {
    if (MSDOS.compareEP("b8....cd213c..73..0e1fba....b409cd210633c050cb8cd88ccbfabc....8ed3fbfc8ec3bf....be....b9....fc")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/EXETools_COM2EXE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "EXETools COM2EXE");

function detect() {
    if (MSDOS.compareEP("e800005d83ed..8cda2e8996....83c2..8eda8ec22e0196....60bb....ba....85d274..b4..33ff33f6b9....ac")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/EXE_Manager.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXE Manager");

function detect() {
    if (MSDOS.compareEP("b4301e06cd212ea3....bf....b9....33c02e....47e2..2e3b06....74..b8....cd1033c050cb")) {
        sVersion = "3.0";
        sOptions = "1994 by Solar Designer";
        bDetected = true;
    } else if (MSDOS.compareEP("1e54583bc475..b43006cd212ea3....bf....8befb9....33c02e030547e2")) {
        sVersion = "4.0";
        sOptions = "1996 by Solar Designer";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/EXE_Packer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "EXE Packer");

function detect() {
    if (MSDOS.compareEP("1E068CC383....2E........B9....8CC88ED88BF14E8BFE")) {
        sVersion = "7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("EB$$1E068CC383....0E1F011E....011E....BE....B9....FCAD3BC174")) {
        sVersion = "7.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/EXE_encryption.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXE encryption");

function detect() {
    if (MSDOS.compareEP("501e068cc88ed88ec0e8....5b81eb....2ae4be....03f3882446fec40ae475..8b87....ba....f7e28987")) {
        sOptions = "1992 by E.Akulow";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Eliashim's_CodeTrack.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Eliashim's CodeTrack");

function detect() {
    if (MSDOS.compareEP("e9$$$$502e8c06....33c08ec02ef606......74..26ff36")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/File_Shield.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "File Shield");

function detect() {
    if (MSDOS.compareEP("50b430cd213c..7d..e9....e8$$$$b8....bb....b9....ba....cd212ec706........81fb....75..2ec706........2e8916")) {
        sVersion = "1.2";
        sOptions = "by McAfee";
        bDetected = true;
    }
    else if (MSDOS.compareEP("501eeb$$2ea1....2e8b1e....2e8b0e....ba....2e8916....e8$$$$535051cd12")) {
        sVersion = "1.5";
        sOptions = "by McAfee";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Fitted_Modula-2.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Fitted Modula-2");

function detect() {
    if (MSDOS.compareEP("9a########558bec2e8e1e....a1....d1c873..8be55dca0000")) {
        sVersion = "2.0a";
        sOptions = "1988";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/GFX_to_EXE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "GFX to EXE");

function detect() {
    if (MSDOS.compareEP("eb$$2ea1....3c..74..be....bd....8ccabf....83e7..bb....c1eb..03d32e8b1e....2e8b0e....8eda3c..75..30253c")) {
        sVersion = "2.0";
        sOptions = "by t-Rex";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/GamBit_Pro_Library.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "GamBit Pro Library");

function detect() {
    if (MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06") &&
        MSDOS.compareOverlay("'RS'000102")) {
            sOptions = "1994 by Nikita Ltd.";
            bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/GameWizard_DOS_Extender.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "GameWizard DOS Extender");

function detect() {
    if (MSDOS.compareEP("b430cd2186c43d....73..ba....e8....ba....b1..d3ea8cc803d08edafa8ed2bc....fb2e8916....2e8c06....368c0e....2e8c16....e8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Graphic_WorkShop.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "Graphic WorkShop");

function detect() {
    if (MSDOS.compareEP("e9$$$$2ec706........b8....a9....74..25....bb....2bd8432e011e....e8")) {
        sVersion = "6.0-7.1";
        sOptions = "by Alchemy Mindworks Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Guardian_Angel.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Guardian Angel");

function detect() {
    if (MSDOS.compareEP("068cc88ed88ec0fc......8be8e4210c..eb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("068CC88ED88EC0FCBF....EB")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("068CC88ED88EC0FCBB....EB")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("068CC88ED88EC0FCBE....EB")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/H+BEDV_SelfCheck.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "H+BEDV SelfCheck");

function detect() {
    if (MSDOS.compareEP("1e0e1ffcbe....33d233dbb9....ac3287....3084....0294....80d6..fec3e2..3b16....75..b8....cd213d....8bc374..b430cd21ba")) {
        sVersion = "1.74-2.41";
        sOptions = "1993-94 by H+BEDV Datentechnik GmbH";
        bDetected = true;
    } else if (MSDOS.compareEP("1e0e1fb8....cd213d....8bc374..b430cd21ba....3c..b8....72..fcbe....33d233dbb9....ac3287....3084....0294....80d6..fec3e2")) {
        sVersion = "1.10";
        sOptions = "1993 by H+BEDV Datentechnik GmbH";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Header_Changer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "Header Changer");

function detect() {
    if (MSDOS.compareEP("8cdb81c3....53bb....53501e068cdb81c3....53bb")) {
        sOptions = "by Shay Lev Ary";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Hi-Tech_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Hi-Tech C");

function detect() {
    if (MSDOS.compareEP("fcba....b1..d3ea8cc803c28ed88ed0268b1e....4b2bd8b8....f7c3....75..d3e38bc38be0be....b9....2bce32c0")) {
        sVersion = "3.06";
        sOptions = "1984-87 by HI-TECH Software";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/HyperLOCK_386.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "HyperLOCK 386");

function detect() {
    if (MSDOS.compareEP("e9$$$$fabf....b0..b9....2e8a2581ff....72..2e3005472ac4")) {
        sVersion = "1.00";
        sOptions = "1993 by Jayeson Lee-Steere";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/IBM_PC_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// http://www.edm2.com/index.php/IBM_PC_Pascal_Compiler
meta("compiler", "IBM PC Pascal");

function detect() {
    if (MSDOS.compareEP("b8....8ed88c06....fa8ed0268b1e....2bd881fb....7e..bb....d1e3")) {
        sVersion = "2.00";
        sOptions = "1984";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed88bd08c06....268b1e....891e....2bd8f7c3....75..b1..d3e3")) {
        sVersion = "2.05";
        sOptions = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....b4..b0..8cc98ed9cd21")) {
        sVersion = "2.00";
        sOptions = "1984";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed88c06....ba....d1eab9....2bcad1ea")) {
        sVersion = "1.00";
        sOptions = "1981";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8e1e....8cd08cdb2bc3d1e0")) {
        sVersion = "2.02";
        sOptions = "1987";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/MSDOS/John_Socha_Library.3.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "John Socha Library");

function detect() {
    if (MSDOS.compareEP("bb....8edb2e891e....8d06....25....fa8ed38be0fb26a1....a3....b430cd21a2....8826....3c..73..8d16....b409cd2133c05006cb")) {
        sVersion = "1986 Peter Norton Computing, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Khrome_Crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Khrome Crypt");

function detect() {
    if (MSDOS.compareEP("B9....B8....EB..80....EB..EB..EB..66..........66")) {
        sVersion = "0.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/LSI_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "LSI C-86");

function detect() {
    if (MSDOS.compareEP("b8....8ed0bc....368c......b430cd2136......8a......32ff438e......161f33ffb9....32c0fceb")) {
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ec00617bc....268c......b430cd2126a3....fcbe....8a0e....32edbf....f3a426......47")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/L_O_V_E__FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "L.O.V.E. FORTH");

function detect() {
    if (MSDOS.compareEP("e9$$$$fc2e8c1e....8cc88ec08ed8bb....e8....bb....e8....bb....e8....bb....e8....8bec2b2e")) {
        sVersion = "1.29";
        sOptions = "1988-92 by Homer Seywerd, Wolodymyr R. Elehew and Peter Cav";
        bDetected = true;
    } else if (MSDOS.compareEP("fcbb....e8$$$$8b8f....09c974..8cd88cda0387....0397....1e068ed88ec28bf98bf14f4efdf3a4")) {
        sVersion = "1.20";
        sOptions = "1988-92 by Homer Seywerd, Wolodymyr R. Elehew and Peter Cav";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Lahey_Fortran.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Lahey Fortran");

function detect() {
    if (MSDOS.compareEP("EA########dbe3fcb8....8ed88c06....54583bc474..c606......d92e....eb")) {
        sOptions = "1984-91 by Lahey Computer Systems Inc.";
        bDetected = true;
    }

    sLang = "Fortran";

    return result();
}

================================================
FILE: db/MSDOS/Lattice_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Lattice C");

function detect() {
    if (MSDOS.compareEP("fab8....8ed8b8....8ed0bc....90fb")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed02e8b26....fbb8....a3....8c06....26a1....a3....be")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be02e8c06....fbbb....b4..cd2173..e9")) {
        sVersion = "3.00";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8cd88cc92bc1b1..d3c0a3....8126........25....a3....33c0")) {
        sVersion = "3.00";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb8....a3....8c06....26a1....a3")) {
        sVersion = "2.00";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be0fbbb....b4..cd21ba....72")) {
        sVersion = "2.00";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb430cd210ac075..b8....a3....8c06")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (MSDOS.compareEP("fa8cc78cd68bccba....8ec2268e16....bc....fb8ec75651501e06")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (MSDOS.compareEP("fcb8....8ed88926....8306......06fa8ed081c4....fbc706........c606......33c0a2....a2....b8....2d....a3....03c4")) {
        sVersion = "6.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fcb8....8ed88926....8306......fa8ed081c4....fbc706........b8....a3....a3....bb....2bd8")) {
        sVersion = "6.0";
        if (MSDOS.compareEP("891e....03dc", 43)) {
            sOptions = "overlay";
        }
        bDetected = true;
    } else if (MSDOS.compareEP("8cc88ed8ba....b409cd21b8....8ed8ba....b409cd21bb....8b178b4f..8ed9b409cd21b8....cd21cb")) {
        sVersion = "3.30";
        sOptions = "driver";
        bDetected = true;
    } else if (MSDOS.compareEP("fa8cdeb9....8ed98926....8c16....8936....8bec8b46..a3....8b46..a3....fbfca1....0bc075..40a3....8cd8")) {
        sVersion = "3.00";
        sOptions = "overlay";
        bDetected = true;
    } else if (MSDOS.compareEP("8bec8b5e..8b46..2ea3....2e891e....c746......8b46..8b5e..8cc78cd68bccba....8ec2268e16....bc....8bd0")) {
        sVersion = "3.00";
        sOptions = "overlay";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3891e....b8....a3....0633c0508bec")) {
        sVersion = "1.00";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed88ed08c06....268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec")) {
        sVersion = "1.02";
        bDetected = true;
    } else if (MSDOS.compareEP("fc508cc00bc05874..b8....8ed88cc0a3....2906....8b1e....b4..cd2126a1....a3....8cc0a3....c706........268a1e")) {
        sVersion = "3.30";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$fafcb8....8ed88cc0a3....2906....a3....c706........8b1e....b4..cd2126a1....a3....268a1e....26c606")) {
        sVersion = "3.30";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$fc268b36....bf....2e8c06....8ec732c0b430cd21fc8cd93c..73..b0..26a2....33ed33db8edb8b07d1e8")) {
        sVersion = "2.00";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$8cc78cd68bcc83c1..2e8c06....ba....8ec2268e16....bc....5651501e57b8....8ed833ff26f685......75")) {
        sVersion = "2.00";
        bDetected = true;
    } else if (MSDOS.compareEP("fabe....8b14b8....8ed8b8....8ed0bc....8916....fbb430cd210ac075..b8....a3....8c06....803e......7c")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed88f06....8f06....8becc446..a3....8c06....8b46..2b46..a3....8b46..a3....8e46..8b5e..b8....8ed0")) {
        sVersion = "2.1";
        sOptions = "overlay";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be0fbbb....b44acd21ba....73..e9")) {
        sVersion = "2.1-3.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8c06....268e06....8c06....c706........b8....a3")) {
        sVersion = "2.1-3.0";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/Logitech_Modula-2.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Logitech Modula-2");

function detect() {
    if (MSDOS.compareEP("8cdb83c3..8cc88ec0bf....33c0268a05473c..74..3c..74..03f08b0c03cb890ceb..26c5358cd903cb8ed983c7..eb..b8....03c350b8....5033c0")) {
        sVersion = "3.00";
        sOptions = "Aug 1987";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Meridian_Ada.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Meridian Adavantage ADA");

function detect() {
    if (MSDOS.compareEP("b8....8ed89a........558bec5583ec..168d46..509a........894e..895e..83fb..75..83f9..75")) {
        if (MSDOS.compareEP("9a", 43)) {
            sVersion = "1993";
        } else if (MSDOS.compareEP("33c050ba....521ebe....569a", 43)) {
            sVersion = "1991";
        }
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed89a########04..2bc0f3508a46..83e0")) {
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed89a########515006b8....8ec0b9....b8....8bf8fcf3ab075859cb")) {
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed89a########e8$$$$c8......57561eb8....8ed868....9a")) {
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed89a########8c06....8c16....8926....a1....a3....8b16....8916....8c06....9a")) {
        sVersion = "1988";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Meridian_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Meridian Pascal");

function detect() {
    if (MSDOS.compareEP("b8....501f9a########8926....8926....8c16....8c16....8c06....8c06....9a........c706")) {
        sOptions = "1985-1988 by Meridian Software Systems, Inc.";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....8ed89a########8c06....8c16....8926....a1....a3....a1....a3....a1....a3")) {
        sOptions = "1985-1988 by Meridian Software Systems, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed89a########558bec5583ec..8c06....8c16....8926....cd..8946..f646")) {
        sOptions = "1985 by Meridian Software Systems, Inc.";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/MSDOS/MetaWare_High_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MetaWare High C");

function detect() {
    if (MSDOS.compareEP("b8....50b8....50cbeb$$bd....2e8e1e....26a1....a3....8cd805....268b1e....3bc376..2bd8b1..d3e3eb..26a3....938cc02bd8b44acd212bdb8cd8fa8ed08be3fbc706........c706")) {
        sVersion = "1983-1986";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....26a1....2d....bb....fa8ed08be3fbc706........c706........bb....3bc373..2bd8b1..d3e3011e....011e....2e8e1e....9c0654582bc4d1f8")) {
        sVersion = "1983-1988";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$fa6633e42e8e16....bc....6633f66633ff6633c92e8e1e....be....2e8e06....bf....b9....e8")) {
        sVersion = "1983-1990";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....26a1....2d....bb....fa8ed08be3fbc706........c706........bb")) {
        sVersion = "1983-1986";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....268b......b1..4b891e....b8....05....3bc376..8bc3ba....2bc2d3e0")) {
        sVersion = "1983-1986";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$bd....2e8e1e....268b1e....b1..4b891e....b8....05....3bc376..8bc350a3....a3....2bd8b1..d3c38cc12bc1")) {
        sVersion = "1983-1985";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/MetaWare_Professional_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MetaWare Professional Pascal");

function detect() {
    if (MSDOS.compareEP("b8000050b8....50cbeb..e8....2bc050e8....c3....bd....2e8e")) {
        sVersion = "1983-1986";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....26a1....2d....bb....fa8ed08be3fb")) {
        sVersion = "1983-1986";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$bd....2e8e1e....26a1....2d....bb....fa8ed08be3fb")) {
        sVersion = "1983-1986";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8cd805....268b1e....3bc376..2bd8b1..d3e3eb")) {
        sVersion = "1983-1988";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/MSDOS/Micro_Focus_Cobol.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Micro Focus Cobol");

function detect() {
    if (MSDOS.compareEP("e9$$$$e9$$$$e8....8edac606......b8....0306....8ed28be08c0e....4a8bc28706....2bd0e8")) {
        sVersion = "1981, 1985 by Micro Focus Ltd";
        bDetected = true;
    }
    if (MSDOS.compareEP("e8....51e8$$$$8bf0e8$$$$061e5657558bece8....72..a1....8be55d5f5e1f07c3")) {
        sVersion = "4.5";
        bDetected = true;
    }

    sLang = "Cobol";

    return result();
}

================================================
FILE: db/MSDOS/Micro_Focus_DOS_extender.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Micro Focus DOS Extender");

function detect() {
    if (MSDOS.compareEP("eb$$b8....8ed854583bc475..0f01e0a8..74..e8....75..2e800e......eb..c8......0f014e..80")) {
        sVersion = "1993 by Micro Focus Ltd";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Microsoft Basic");

function detect() {
    if (MSDOS.compareEP("eb$$0e1fb8....e8....8eda938a170ad274..b4..cd2143eb..b8....cd21")) {
        sVersion = "7.10";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########591fa1....1e510e1ffc3d....74..e9....b430cd213c..73..e9$$$$ba....0e1fb409cd21b8....cd21")) {
        sVersion = "5.60";
        sOptions = "1986";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$8cc88ed8e8....8a170ad274..b4..cd2143eb..b2..b4..cd21")) {
        sVersion = "5.60";
        sOptions = "1986";
        bDetected = true;
    }

    sLang = "Basic";

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("compiler", "Microsoft");

function detect() {
    if (MSDOS.compareEP("b430cd213c..73..33c00650cbbf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f")) {
        sName += " Quick C";
        sVersion = "2.5X";
        sOptions = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("fc8cc02ea3....8ed8a1....2ea3....2ea3....be....ac32e403f0c6....b8....8ec02680........75")) {
        sName += " Quick C";
        sVersion = "2.51a";
        sOptions = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..b8....50e8....92b409cd21cd20bf")) {
        sName += " C/C++";
        sVersion = "1986";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..b8....50900ee8....92b409cd21cd20bf")) {
        sName += " C/C++";
        sVersion = "1986";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..b8....509a........92b409cd21cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..33c050")) {
        sName += " C/C++";
        sVersion = "1986";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf072..8bf0fa8ed781c4....fb73")) {
        sName += " Quick C";
        sVersion = "1987-89";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..e9....81e4....3689......3689......8bc6b1")) {
        sName += " C/C++";
        sVersion = "1985";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec")) {
        sName += " C/C++";
        sVersion = "1.04";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73")) {
        sName += " Quick C";
        if (MSDOS.compareEP("81", 54)) {
            sVersion = "1.0";
            sOptions = "1987";
        } else if (MSDOS.compareEP("83", 54)) {
            sVersion = "2.00";
            sOptions = "1989";
        } else if (MSDOS.compareEP("8b", 54)) {
            sVersion = "2.X";
            sOptions = "1989";
        }
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_C_Library.3.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "Microsoft C Library");

function detect() {
    if (MSDOS.compareEP("fa8cc78cd68bccba....8ec2268e16....bc....fb8ec75651501e062e8c06....b8....8ed8e8....b8....8ec08cc8262b06....26a3....803e")) {
        sVersion = "1986";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f0ee8....33c0500ee8....b8....cd21")) {
        sVersion = "1985";
        bDetected = true;
    } else if (MSDOS.compareEP("061e33c08ed88b1e....a1....8ec0268b47..3d....75..ba....1f07e9....1f07be....ac0ac074..e8....72")) {
        sName += " (possibly)";
        sVersion = "1986";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_Fortran.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Microsoft Fortran");

function detect() {
    if (MSDOS.compareEP("b430cd213c..73..9a########558becb8....501eb8....50b8....509a")) {
        sVersion = "1987";
        bDetected = true;
    }

    sLang = "Fortran";

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_Quick_Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Microsoft Quick Basic");

function detect() {
    if (MSDOS.compareEP("1e071e2e8e1e....b430cd2150812e........8b36....ad91ade3..3d....72..3d....73..ba....eb..0bc075..c706........c706........33c99a")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$8cda83c2..8edaa1....0e1ffc3d....74..e9....b430cd213c..73..e9$$$$ba....0e1fb409cd21b8....cd21")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########591fa1....1e510e1ffc")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$0e1fb8....509a........8eda938a170ad274..b4..cd2143eb")) {
        sVersion = "4.5";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########591fa0....1e51063c..74")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....a1....2ea3....2bc73d....72..b8....fa8ed781c4....fb969f2e8826....9683e4")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("9a########06ba....8eda268b3e....8ec257b9....be....bf....0e1ffcf3a4b1")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed88c06....fa8ed0bc....fbb430cd21a3....3c..75..06b4..cd218c06....b9")) {
        sVersion = "4.X";
        bDetected = true;
    }

    sLang = "Basic";

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_Quick_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Microsoft QuickPascal");

function detect() {
    if (MSDOS.compareEP("b0..9a########50b430cd213c..73..cd20b8....8ed88c06....c706........8c0e....58545b3bdc74..0ac074..be....e8....32c0e9")) {
        sVersion = "1.0-1.08";
        sOptions = "1989";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_RTL.3.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "Microsoft RTL");

function detect() {
    if (MSDOS.compareEP("b430cd213c..73..cd208cc18cd32bd981c3....b4..cd2172..8cd6bf....2bf7b1..d3e6fa8ed703e6fb")) {
        bDetected = true;
    } else if (MSDOS.compareEP("1e068cc88ed88cc0a3....83c0..a3....b430cd213c..73..b8....8ed8b8....ea........e8....e8....e8....8e")) {
        sVersion = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..cd20bf....b8....03c405....b1..d3e88bf0fa8ed781c4....fb73..161f9a........33c0509a")) {
        sVersion = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c06....2e8c1e....bb....8edb1ee8....1f8b1e....0bdb74..8cd18bd4fa8ed3bc....fb5351521ee8....1f5a")) {
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c1e....bb....8edb1ee8....1f8b1e....0bdb74..8cd18bd4fa8ed3bc....fb5351521ee8....1f5a")) {
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("1eb8....8ed8b430cd213c..73..ba....e8....0633c050cb")) {
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("1e069a########502e8c06....2ea1....2e0b06....75..26a1....2ea3....26a1....2ea3....58cb")) {
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....cd212e8816....b2..b8....cd21b4..cd218edbb8....83e8..8ec033f633ffb9....fcf3a5bb")) {
        sVersion = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("b4..cd218edbb8....83e8..8ec033f633ffb9....fcf3a5bb")) {
        sVersion = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd03d....75..8cd83d....75..8ccab8....e8....e9....8cdb8ccab8....e8....eb..908cd83d")) {
        sVersion = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f")) {
        sVersion = "1988";
        bDetected = true;
    } else if (MSDOS.compareEP("b4..cd213c..73..33c00650cb86e03d....b0..72..bf....8b36....2bf781fe....72..be")) {
        sVersion = "1992";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8edffa8ed781c4....fb33dbb8....cd210bdb74..881e....883e....8816....8836....b8")) {
        sVersion = "1992";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Microsoft_RTL_(Clipper).3.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "Microsoft RTL (CLIPPER 5.01)");

function detect() {
    if (MSDOS.compareEP("e8$$$$1e06fc8cc88ed88c06....b430cd2186e0a3....e8....891e....890e....b8....bb....e8....071fc3")) {
        sVersion = "1988";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/MultiLoop_Protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MultiLoop Protection");

function detect() {
    if (MSDOS.compareEP("1e06b8....8ec0b0..b9....be....2e300404..46e2")) {
        sOptions = "1992 by J&A";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Netware_loader.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("loader", "Netware loader");

function detect() {
    if (MSDOS.compareEP("e9$$$$b8....cd213c..72..a1....3d....75..a1....3d....75..e9$$$$1e8cc88ed833c08ec0268b1e....891e")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/PDC_Prolog.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "PDC Prolog");

function detect() {
    if (MSDOS.compareEP("b8....8ed88cc6bb....8ec3bb....268b178ec6b9....8bdad3eb8cd003d88cc02bd843b44acd2173..b0..b44ccd21")) {
        sOptions = "1992 by Prolog Development Center";
        bDetected = true;
    }

    sLang = "Visual Prolog";

    return result();
}

================================================
FILE: db/MSDOS/PK_sig.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "PK signature");

function detect() {
    if (MSDOS.compareEP("c706....'PK'8cd805....50b8....50cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/PROPACK_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("sfx", "PROPACK SFX");

function detect() {
    if (MSDOS.compareEP("558bec83ec..8c5e..e8....be....e8....b80030cd21ba....0e3c..72..a1....8ec033ff33c0b9....f2aeae75..fec0af75..5a8bd7061f")) {
        sVersion = "2.18";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Pacific_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Pacific C");

function detect() {
    if (MSDOS.compareEP("fcb8....8ed826a1....488bd881eb....ba....3bd372..8bda2bc3b9....d3e048488ed38be0")) {
        sVersion = "7.51";
        sOptions = "1984-91 by HI-TECH Software";
        bDetected = true;
    } else if (MSDOS.compareEP("fcc516....b8....8ed88ed0268b1e....4b2bd8b8....f7c3")) {
        sVersion = "7.51";
        sOptions = "1984-91 by HI-TECH Software";
        bDetected = true;
    } else if (MSDOS.compareEP("fc8d16....b8....8ed826a1....488bd881eb....ba....3bd372..8bda2bc3b9....d3e048488ed38be0")) {
        sVersion = "7.51";
        sOptions = "1984-91 by HI-TECH Software";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/Panda_immunizer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Artemis Professional");

function detect() {
    if (MSDOS.compareEP("e8$$$$5d81ed....2e8c8e....2e8c86....fc268e06....33ff32c0b9....f2ae26803d..75..83c7..2e89be")) {
        sOptions = "by Panda Software";
        sVersion = "2.10s";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Pascal_MT+86.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Pascal/MT+86");

function detect() {
    if (MSDOS.compareEP("e8$$$$8cc82e0306....2e0306....2e0306....2e0306....3b06....76..2ea1....2d....2ea3....3d....7f..1ee8")) {
        sVersion = "3.1";
        sOptions = "1982 by Digital Research, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$8cc82e0306....2e0306....2e0306....2e0306....3b06....76..1ee8")) {
        sVersion = "3.01";
        sOptions = "1982 by Digital Research, Inc.";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/MSDOS/Phar_Lap.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Phar Lap DOS Extender");

function detect() {
    if (MSDOS.compareEP("eb$$8cd88ec0b8....8ed8c706........b8....2d....3bc476..c706........8f06....8f06....58a3....a3....a3....8cd88d1e....8ed0")) {
        sVersion = "1986-93 (C5S2S2P6)";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8cd88ec0b8....8ed8bb....8cc02bd881c3....b44acd2173..e9....8d06....05....8cdb8ed38be0fcb8....8ec033c033db33c9")) {
        sVersion = "1986-91 (C5S2S2PJ)";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....50b8....50cb")) {
        sVersion = "1986-91 (C3S2S2P8)";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....268b1e....b1..8cdab8....05....3bc376..8bc32bc23d....76..b8....d3e0bb....891e....c706")) {
        sVersion = "1986-89 (C5S2S2P6)";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8d06....a3....9d06....a3....8d06....a3....8cd88d1e....8ed08be3bb....26891e....8cc02bd8")) {
        sVersion = "1986-89 (C5S2S2P6)";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....268b1e....b1..4b891e....b8....05....3bc376..8bc3ba....2bc2d3e0c706........c706")) {
        sVersion = "1986-89 (C5S2S2P7)";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed8b8....cd21a3....3c..7d..b4..ba....8edaba....cd2106b8....50cb")) {
        sVersion = "1986-89 (C5S2S2PN)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/RAR.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("rar-file");

function detect() {
    detect_RAR(0);
}


================================================
FILE: db/MSDOS/REC_small.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "REC.small");

function detect() {
    if (MSDOS.compareEP("8cd81ee8$$$$83c0..5fb9....81ef....87ef408ed82bdbb2..0017424383fb..75..e2")) {
        sVersion = "1.2";
        sOptions = "by Ralf Roth";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd81ee8$$$$5d83c0..81ed....b9....408ed82bdbb2..0017fec24383fb..75..e2")) {
        sVersion = "1.01";
        sOptions = "by Ralf Roth";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd81ee8000083c0..5db9....81ed....408ed82bdbb2..0017fec24383fb..75..e2")) {
        sVersion = "1.02";
        sOptions = "by Ralf Roth";
        bDetected = true;
    } else if (MSDOS.compareEP("b9....8cd883c0..fa8bdc8cd7bc....44408ed02be4b2..8bec0056..424483fc..75..e2")) {
        sVersion = "1.05";
        sOptions = "by Ralf Roth";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/REC_small_AV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "REC.small");

function detect() {
    if (MSDOS.compareEP("eb$$8cd81ee8$$$$83c0..5fb9....81ef....87ef408ed82bdbb2..0017424383fb..75..e2")) {
        sVersion = "1.03";
        sOptions = "by Ralf Roth";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8cd81ee8$$$$83c0..5fb9....81ef....87ef408ed82bdbb2..001702d34383fb..75..e2")) {
        sVersion = "4.01";
        sOptions = "by Ralf Roth";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/RLE_com-packer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "RLE com-packer");

function detect() {
    if (MSDOS.compareEP("60be....bf....8b0e....f3a4be....bf....57b9....f3a4c3")) {
        sOptions = "by NOP/PC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/RM_FORTRAN.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "RM/FORTRAN");

function detect() {
    if (MSDOS.compareEP("fc1eb8....8ed89a........81ec....8becc706........c706........33ffbe....b8....8ec0b9....f3a5897e..b8....ab8cdb8ec3bb")) {
        bDetected = true;
    }

    sLang = "Fortran";

    return result();
}

================================================
FILE: db/MSDOS/RTLink_VM_Manager.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", ".RTLink VM Manager");

function detect() {
    if (MSDOS.compareEP("9a########1e069a........2e8c06....8cc88ed852ba....b0..9a........5afcb8....2b06....d1e0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/RTPatch_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "RTPatch SFX");

function detect() {
    if (MSDOS.compareEP("e8$$$$8ccb8edb8c06....a3....8cc00106....0106....fd26a1....bb....b1..d3eb2bc38ec0bf....83e7..8bf7b9....d1e9f3a5fc")) {
        sVersion = "3.20";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Realia_Cobol.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Realia Cobol");

function detect() {
    if (MSDOS.compareEP("9a########9a########3c..75..8ed38be22bdb2bd2cb")) {
        sVersion = "4.X";
        sOptions = "1984-92 by Realia, Inc.";
        bDetected = true;
    }

    sLang = "Cobol";

    return result();
}

================================================
FILE: db/MSDOS/Realia_SPITBOL.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Realia SPITBOL");

function detect() {
    if (MSDOS.compareEP("2e8c1e....fc8ccaa1....0e1ffe06....a3....0116....b9....be....ad0bc074..03c28944..e2..8e06....bf....b1..b0..f3ae")) {
        sVersion = "3.6";
        sOptions = "1983-84 by Realia, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/SHOW_IT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "SHOW IT");

function detect() {
    if (MSDOS.compareEP("bf....32db2e8a150ad274..b4..cd214780fa..75..fec380fb..75..32db53b4..cd16b4..cd165b75")) {
        sVersion = "1.2";
        sOptions = "converted to exe";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Self_UnStuffer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Self UnStuffer");

function detect() {
    if (MSDOS.compareEP("86e303e9ace3$$1000e3$$00e40ec400e3")) {
        if (MSDOS.compareOverlay("0101'Aladdin'")) {
            sVersion = "1.1";
            sOptions = "by Aladdin Systems, Inc.";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/Small_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Small C");

function detect() {
    if (MSDOS.compareEP("b8....8ed826a1....2d....80fc..72..b8....b1..d3e0fa8cdb8ed38be050fbb8....2d....d3e08bd8fec73bdc72..b8....50e8")) {
        sVersion = "2.2";
        sOptions = "1982-88 by J. E. Hendrix";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed826a1....2d....3d....72..b8....b1..d3e0fa8cdb8ed38be050fbb8....2d....d3e08bd881c3....3bdc72..b8....cd21")) {
        sVersion = "2.1";
        sOptions = "1982-88 by J. E. Hendrix";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/StonyBrook_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "StonyBrook Pascal+");

function detect() {
    if (MSDOS.compareEP("31ED9A........5589E581EC....B8....0E509A........BE....1E0EBF....1E071FFC")) {
        sVersion = "7.0";
        bDetected = true;
    } else if (MSDOS.compareEP("31ed9a........5589e5b8....50ff1e")) {
        sVersion = "6.13";
        bDetected = true;
    } else if (MSDOS.compareEP("31ed9a........5589e581ec....16078dbe....b9....31c0fcf3ab1e07")) {
        sVersion = "6.12";
        bDetected = true;
    } else if (MSDOS.compareEP("31ed9a........5589e59a........c706........c706........e8")) {
        sVersion = "6.1G";
        bDetected = true;
    } else if (MSDOS.compareEP("31ed9a........5589e583ec..9a........9a")) {
        sVersion = "6.14";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}


================================================
FILE: db/MSDOS/Sydex_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Sydex SFX");

function detect() {
    if (MSDOS.compareEP("b8....8ec0b430cd2186e0ba....3d....72..a1....26a3....bf....8a1d32ff47883926893e....268c1e....8cd88cc3")) {
        sOptions = "1994 by Sydex, Inc.";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....8ec0e8....ba....3d....b8....72..e8....26a3....26890e....268916....8cd88cc381c3....2bd88ec0b4..cd21")) {
        if (MSDOS.compareOverlay("'SXD'00")) {
            sOptions = "1997 by Sydex, Inc.";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/Topspeed_Modula.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Topspeed Modula");

function detect() {
    if (MSDOS.compareEP("e90000fc2bedbc....b8....8ed88c06....26a1....a3....54583bc4b8....75..b430cd213c..74..3c..77..b8....8cdbe8....86c4a3....8e06")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("1eba....8eda8b0e....8b36....ff36....5053a1....48ba....8eda890e....8936....a3....c706........2ea1....a3")) {
        sName += ' RTL';
        sOptions = "1989 by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....58c706........c706")) {
        sName += ' RTL';
        sOptions = "1989 by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....c706........58c706")) {
        sName += ' RTL';
        sOptions = "1989 by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("fc1eba....8eda8b0e....8b36....ff36....50a1....ba....8eda890e....8936....a3....58c706........c706")) {
        sName += ' RTL';
        sOptions = "1989 by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("ea########2e8c1e....fc2ef706........74..e8....eb..b8....ba....0e1fcd212bc02ef706........74")) {
        sVersion = "2.0";
        sOptions = "by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("ea########2e8c1e....fc2bc08cd3ba....8ec2bf....b9....f3ab423bd372..508becffe0")) {
        sVersion = "1.17";
        sOptions = "by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("ea########8cdb2e8e1e....891e....fc2ef706........74..2bc02e8e1e....ff36....8cd3ba....8ec2bf....b9....f3ab423b..72")) {
        sOptions = "by JPI";
        bDetected = true;
    }

    sLang = "Modula";

    return result();
}

================================================
FILE: db/MSDOS/UR_FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "UR/FORTH");

function detect() {
    if (MSDOS.compareEP("fc2e8c06....2e8e1e....e8$$$$b430cd213c..73..e8")) {
        sVersion = "1.03";
        sOptions = "1986-88 by Laboratory Microsystems, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Unknown_cryptors.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Unknown cryptor");

function detect() {
    if (MSDOS.compareEP("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8")) {
        sVersion = "#01";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$b9....b3..be....bf....acfec332c3aae2")) {
        sVersion = "#02";
        sOptions = "exe 0-relocs crypt";
        bDetected = true;
    } else if (MSDOS.compareEP("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07")) {
        sVersion = "#03";
        bDetected = true;
    } else if (MSDOS.compareEP("9090e9$$$$8cd88be8b8....8be08ccb8edb8ec3bf....892de8....8cc88ed88ec01e33db8edbbb....81eb....8b071f1ebb")) {
        sVersion = "#04";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$be....bf....2e89352eff26")) {
        sOptions = "protector";
        sVersion = "#05";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....b8....fa8ed08be7fb1e1eb8....0e500e501efc8cd08ec0be....8cc806b9....578ed8f3a5cb")) {
        sOptions = "Russ";
        sVersion = "#06";
        bDetected = true;
    } else if (MSDOS.compareEP("........0e1f8b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb")) {
        sOptions = "Aidstest";
        sVersion = "#07";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e8$$$$bb....e8$$$$29c9e8$$$$e8$$$$e9$$$$8ed9e9$$$$870feb$$e8$$$$eb$$51eb$$eb$$29dbe8$$$$bf....e9$$$$e8$$$$871de8$$$$53eb$$b3..b7..bf....2e8a05")) {
        sOptions = "by Matrix Technologies";
        sVersion = "#08";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....50060ee8$$$$065733ff570e1f07be....b9....8004..46e2..b1..ac268a1d04..aa80eb..885c..e2")) {
        sOptions = "SYN!";
        sVersion = "#09";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$eb$$bf....e9$$$$26f6e8$$$$e9$$$$8edee8$$$$8735e8$$$$56e9")) {
        sOptions = "by Matrix Technologies";
        sVersion = "#10";
        bDetected = true;
    } else if (MSDOS.compareEP("b3..060e1f8b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb")) {
        sOptions = "Aidstest";
        sVersion = "#11";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2")) {
        sVersion = "#12";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Upper_Deck_Forth.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Upper Deck Forth");

function detect() {
    if (MSDOS.compareEP("fc2e8c06....b8....cd213c..73..b4..2e8e1e....ba....cd212eff36....33c050cb")) {
        sVersion = "2.00";
        sOptions = "1990, 1991 by Upper Deck Systems";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Visual_Cobol.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Visual COBOL (XO)");

function detect() {
    if (MSDOS.compareEP("9a########061fbe....b9....ac3cff75..e2..ad8ed88b0e....8ed08be1eb")) {
        sVersion = "3.3";
        sOptions = "1993 by mbp Software & Systems";
        bDetected = true;
    }

    sLang = "Cobol";

    return result();
}

================================================
FILE: db/MSDOS/WWPACK_mutator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "WWPACK mutation engine");

function detect() {
    if (MSDOS.compareEP("8cc981c1....51b9....510606b1..51b1..8cd383eb..5351fc8cd5b8....8cca03d0be....33ff4d8ec58edab1..f3a54a4879")) {
        sVersion = "1.0";
        sOptions = "by Barthazi Andras";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc981c1....51b9....5106068ccab8....03d0b1..518cd383eb..53b1..51fc8cd5be....33ff4d8ec58eda4ab9....50")) {
        sOptions = "by MR WiCKED";
        bDetected = true;
    } else if (MSDOS.compareEP("81ce....1bf78a....80fa..2a95....fc03f633f281e6....1e10ea0e1f00d20e0732b4....21da2efe06")) {
        sOptions = "1996 by van Hauser";
        bDetected = true;
    } else if (MSDOS.compareEP("8ccab8....03d08cc981c1....51b9....510606b1..518cd383eb..53b1..51fc8cd5be....33ff4d8ec58eda4ab9....50")) {
        sVersion = "3.04a";
        sOptions = "by Boogie";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd383eb..8cc981c1....51b9....510606b1..51fc8cd5b1..5351b8....8cca")) {
        sVersion = "3.04a";
        sOptions = "by Boogie";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc981c1....51b9....51b1..068cd30651b1..b8....8cca03d0fc")) {
        sVersion = "3.04a";
        sOptions = "by Boogie";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc981c1....51b9....510606fc8cd5b1..51b1..8cd383eb..5351")) {
        sVersion = "3.04a";
        sOptions = "by Boogie";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc981c1....51b9....fc8cd5510606b1..51b1..8cd383eb..5351")) {
        sVersion = "3.04a";
        sOptions = "by Boogie";
        bDetected = true;
    } else if (MSDOS.compareEP("f9be....81ee....2e80b4......eb")) {
        sVersion = "1.1c";
        bDetected = true;
    } else if (MSDOS.compareEP("061e0e0e071fb430cd2186e03d....73..cd20eb$$eb$$5055528cd2fa50b8....58eb")) {
        sOptions = "REC by R0SE";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc98cd383eb..81c1....51b9....510606b1..518ccafc8cd5b1..5351b8")) {
        sVersion = "1.0";
        sOptions = "by Barthazi Andras";
        bDetected = true;
    } else if (MSDOS.compareEP("......81......2e80..")) {
        sOptions = "by unknown";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Whitesmiths_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Whitesmiths C (dos86)");

function detect() {
    if (MSDOS.compareEP("be....8cd18cd83bc175..a3....e9....8bde8a0f81e1....03d9d1e941ff3783eb..e2..8bf48cd936890e....8cd18ed98c06....8c06")) {
        sVersion = "3.3";
        sOptions = "1988 by Whitesmiths, Ltd. and Cosmic, Sarl";
        bDetected = true;
    } else if (MSDOS.compareEP("be....8cdb8cd03bc374..8a0c81e1....03f1d1e941ff3483ee..e2..8bf4b9....8ed9")) {
        sVersion = "3.2";
        sOptions = "1987 by Whitesmiths, Ltd";
        bDetected = true;
    }


    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/Window_book.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "Window book");

function detect() {
    if (MSDOS.compareEP("e9$$$$e8$$$$fc5e8cda8b1e....bd....8edd8ec5b9....bf....2bcf33c02ea3....41d1e9f3ab891e....8916....8ec2bb....03dd")) {
        if (MSDOS.findSignature(MSDOS.getOverlayOffset(), 2000, "1a1a7bf7") != -1) {
            sVersion = "4.20";
            bDetected = true;
        }
    } else if (MSDOS.compareEP("e9$$$$e8$$$$fc5e8cdaa1....bd....8edd8ec5a3....b9....bf....2bcf33c02ea3....d1e9f3ab8916....8ec2bb....a1....03c7")) {
        if (MSDOS.findSignature(MSDOS.getOverlayOffset(), 2000, "1a1a7bf7") != -1) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/Wizardy_protection.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Wizardy protection");

function detect() {
    if (MSDOS.compareEP("2eff16....e9")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/WordPerfect_EXEPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "WordPerfect EXEPack");

function detect() {
    if (MSDOS.compareEP("958cc005....0e1fa3....0306....8ec08b0e....8bf94f8bf7fdf3a48b16....50b8....50cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/XOPEN+_Protection.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XOPEN+ Protection");

function detect() {
    if (MSDOS.compareEP("8cca8cdd8eda81ea....8916....ba....8eddea")) {
        sOptions = "1994";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/Zbikowski_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Zbikowski C");

function detect() {
    if (MSDOS.compareEP("ba....8cd32bdab1..d3e3fa8ed203e3fbfc8b1e....8bc32bc2a9....74..8bda80c7..33c0eb..b1..d3e02d....36a3")) {
        sOptions = "1983 by Mark Zbikowski (Microsoft Corp.)";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....8cd32bdab1..d3e3fa8ed203e3fbbe....8b1e....36891e....33ff8bc70bdb74..b9....8ec3f2ae")) {
        sOptions = "1983 by Mark Zbikowski (Microsoft Corp.)";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/Zip.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("zip-file");

function detect() {
    detect_Zip(0);
}

================================================
FILE: db/MSDOS/Zortech(Symantec)_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Zortech/Symantec C");

function detect() {
    if (MSDOS.compareEP("fafcb8....8ed88c......268b......891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....80ff..73..ba....e9....fbb430cd21a3")) {
        sVersion = "2.10 - 3.0r1*, 4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed88ed08ec0bc....33c050e8....eb")) {
        sVersion = "2.10 - 3.0r1, 4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed0bc....b8....8ed88c06....660fb7c066c1e0..ba")) {
        sVersion = "3.0";
        sOptions = "1991";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed88ed0bc....2e8c06....33d21e2e8e1e....be....8a0e....32ede3")) {
        sVersion = "3.0";
        sOptions = "1991";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed8bb....81c3....8ed08be3fb8becbe....268a0c4632ed8bd9")) {
        sVersion = "3.0";
        sOptions = "1991";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed88ed0bc....b4..cd214b891e....8cc0a3....b8....cd21")) {
        sVersion = "2.10 - 3.0r1, 4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed833c08ed88bf8bb....b9....b8....8905")) {
        sVersion = "2.10 - 3.0r1, 4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed8a3....8c06....268b......891e....8bd82b1e....891e....268b......891e....2bd881fb....72..bb....8bd003d34289")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....8ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd0")) {
        sVersion = "2.00";
        sOptions = "1989 by Walter Bright";
        bDetected = true;
    } else if (MSDOS.compareEP("fab8....dbe38ed88c06....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....81fb....77")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$fab8....05....b9....d3e88cc903c18ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd8")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$fc06b8....cd21bf....8cc98ed9be....b9....f3")) {
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed8bb....81c3....8ed08be38becfb8cc0a3....be....268b04a3....8b36")) {
        bDetected = true;
    } else if (MSDOS.compareEP("fafcb8....8ed88c06....8ed0bc....fbba....e8....b8....cd2186c4")) {
        bDetected = true;
    }


    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/Zurenava_DOS_Extender.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Zurenava DOS Extender");

function detect() {
    if (MSDOS.compareEP("be....bf....b9....56fcf3a55fe9")) {
        sVersion = "0.45";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/_LE.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("type", "LE");

function detect() {
    if (MSDOS.isLE()) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/_LX.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("type", "LX");

function detect() {
    if (MSDOS.isLX()) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/_MSDOS.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "MS-DOS");

function detect() {
    if (MSDOS.isVerbose()) {
        sName = MSDOS.getOperationSystemName();
        sVersion = MSDOS.getOperationSystemVersion();
        sOptions = MSDOS.getOperationSystemOptions();

        if (sName === "Unknown") {
            sName = "DOS-like";
        }

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/_NE.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("type", "NE");

function detect() {
    if (MSDOS.isNE()) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = MSDOS;
var X = MSDOS;

/**
 * Get the “base” offset, after the header.
 * @param {Int} [nOffset=0] - The offset from the base offset.
 * @returns {Int}
 */
MSDOS.getBaseOffset = function (nOffset) {
    if (arguments.length == 0) {
        nOffset = 0;
    }
    return (MSDOS.readWord(8) << 4) + nOffset;
}

/**
 * Translate segment/offset address pair to file offset.
 * @param {UShort} nSegment - Segment address.
 * @param {UShort} [nOffset=0] - Offset address.
 * @returns {Int}
 */
MSDOS.addressToOffset = function (nSegment, nOffset) {
    if (arguments.length == 1) {
        nOffset = 0;
    }
    nOffset += nSegment << 4;
    return MSDOS.getBaseOffset(nOffset & 0xFFFFF);
}

// Backward compatibility alias
MSDOS.AddressToOffset = function () { MSDOS.addressToOffset.apply(this, arguments); }

/**
 * Get the entry point file offset.
 * @param {Int} [nOffset=0] - The offset from the entry point.
 * @returns {Int}
 */
MSDOS.getEntryPointOffset = function (nOffset) {
    if (arguments.length == 0) {
        nOffset = 0;
    }
    return MSDOS.addressToOffset(MSDOS.readWord(0x16), MSDOS.readWord(0x14)) + nOffset;
}

/**
 * Get the NewExe (or LE/LX) file offset (assuming it's valid).
 * @param {Int} [nOffset=0] - The offset from the NewExe offset.
 * @returns {Int}
 */
MSDOS.getNEOffset = function (nOffset) {
    if (arguments.length == 0) {
        nOffset = 0;
    }
    return MSDOS.readDword(0x3C) + nOffset;
}

================================================
FILE: db/MSDOS/anti-tracing_add-on.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "anti-tracing add-on");

function detect() {
    if (MSDOS.compareEP("fc33d28ec2bf....abab8ccb33ff81eb....53bb....531e0733dbcb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_ASIC-Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "ASIC-Basic");

function detect() {
    if (MSDOS.compareEP("b8....8ed88ec033dbb4..cd108916....cc901ebf....8cc82d....8ed833c98a0e....83f9..72..b9....26be....fc")) {
        sVersion = "5.0";
        sOptions = "1994 by David Visti of 80_20 Software";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed88ec033dbb4..cd108916....1ebf....8cc82d....8ed833c98a0e....83f9..72..b9....26be....fc")) {
        sVersion = "5.0";
        sOptions = "1994 by David Visti of 80_20 Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_Ada89.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Ada89");

function detect() {
    if (MSDOS.compareEP("e9$$$$8cda8cc939d173$$1e0e1fb4..b0..ba....cd21b4..b0..ba....cd211f8cd9b8....8b1e....8ed88ec0")) {
        sOptions = "1989 by RR Software, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_ApBasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "ApBasic");

function detect() {
    if (MSDOS.compareEP("eb$$8cc02ea3....268b36....8cc88ed88ec08cc82e0106....2e0106....2ea1....2e8b16....33db2e")) {
        sVersion = "1.2";
        sOptions = "1987-89 by Comptech Software, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8cc02ea3....268b36....8cc88ed88ec08cc82e0106....2e0106....e8....2ea1....2e8b16....33db2e")) {
        sOptions = "1991 by Comptech Software, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_BAT2EXEC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "BAT2EXEC");

function detect() {
    if (MSDOS.compareEP("eb$$fcbd....8b....8b......8b......b44acd21a1....8986....8b9e....ffe3")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("fcbd....8b....8b......8b......b44acd21a1....8986....8b9e....ffe3")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_BSTAR_FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "BSTAR_FORTH(16)");

function detect() {
    if (MSDOS.compareEP("e9$$$$8c0e....8c0e....a1....a3....e8....a3....a1....a3....e8....a3....a1....a3....e8....e8....8b0e....e3..1e8e06....a1")) {
        sVersion = "0.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_BatLite.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "BatLite");

function detect() {
    if (MSDOS.compareEP("eb$$e8....bb....8bf3031e....891e....81fb....73..bb....8bfb891e....031e....81c3....8be3b1..d3eb43")) {
        sOptions = "1991-95 by Pieter A. Hintjens (COM2EXE converted)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_BetterBASIC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "BetterBASIC");

function detect() {
    if (MSDOS.compareEP("e9$$$$fa2ec706........2e8c1e....b8....05....b1..d3e805....bb....83c3..d3eb8cc98ed1bc....2ec706........03c88ed903cb8ec1")) {
        sOptions = "1984-86 by Summit Software Technology Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_CII-C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "CII-C");

function detect() {
    if (MSDOS.compareEP("eb$$dbe3fcb8....8ed88c06....26a1....3b06....76..2b06....8cdf81c7....3bf873..8bc7be....3bf0")) {
        bDetected = true;
    } else if (MSDOS.compareEP("dbe3fcb8....8ed88c06....26a1....3b06....76..2b06....be....3bf073..2bc63b06....72..3b06")) {
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$dbe3fcb8....8ed88c06....26a1....3b06....76..2b06....be....3bf073..2bc63b06....72..3b06")) {
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$dbe3fcb8....8ed88c06....9c58a9....75..26a1....3b06....76..2b06....8cdf81c7....3bf8")) {
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/compiler_Easy!-C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Easy!-C");

function detect() {
    if (MSDOS.compareEP("9c55568ccd83c5..8db6....56be....56cb")) {
        sOptions = "1993 by Flight Technologys"; //spelling taken from file
        bDetected = true;
    }

    sLang = "C";

    return result();
}


================================================
FILE: db/MSDOS/compiler_GRASP.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// Note: GRaphic Animation System for Professionals

meta("compiler", "GRASP Interpreter");

function detect() {
    if (MSDOS.compareEP("8cd88ec0b8....8ed88c06....8c16....8926....26a1....3b06....77..e9....2b06....8cdf81c7....3bf873..8bc7")) {
        sVersion = "4.00e - 5.0";
        sOptions = "1993 by John Bridges";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd88ec0b8....8ed88c06....26a1....3b06....77..e9....2b06....8cdf81c7....3bf873..8bc7")) {
        sVersion = "4.0b";
        sOptions = "1991 by John Bridges";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_MegaBasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MegaBasic");

function detect() {
    if (MSDOS.compareEP("e9$$$$1eff36....ff36....8cc88ed88ec02e8f06....2e8f06....2e8f06....2e8c0e....b430cd213c..ba....73..e8....2eff36....33c050cb")) {
        sVersion = "4.00";
        sOptions = "1991-94 by Kristofer Sweger";
        bDetected = true;
    }

    sLang = "Basic";

    return result();
}

================================================
FILE: db/MSDOS/compiler_MegaBasic1.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "MegaBasic");

function detect() {
    if (MSDOS.compareEP("e9$$$$b9....33f633ff1607fcf3a5368c1e....a1....161fa3....e8....bc....b430cd21a2....0ac074..86e0")) {
        sVersion = "5.40";
        sOptions = "1985-87 by Christopher Cochran";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$b8....cd21360806....84c074..8bf886e08bd0d40a86c4360906....86c48ac48ae6d50a")) {
        sVersion = "5.812";
        sOptions = "1994 by Christopher Cochran";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$b430cd21360806....0ac074..86e08bd0d40a86c4360906....86c48ac48ae6d50a")) {
        sVersion = "5.73";
        sOptions = "1992 by Christopher Cochran";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$b9....33f633ff1607fcf3a5368c1e....161fe8....bc....b430cd21a2....0ac074..86e0")) {
        sOptions = "1985 by Christopher Cochran";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$b9....33f633ff1607fcf3a5268c1e....161fe8....bc....0e1fba....b8....cd21ba....b8")) {
        sOptions = "1985 by Christopher Cochran";
        bDetected = true;
    }

    sLang = "Basic";

    return result();
}

================================================
FILE: db/MSDOS/compiler_PCC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "PCC (DeSmet C)");

function detect() {
    if (MSDOS.compareEP("e9$$$$368c1e....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....368b1e....36031e....83c3..3be375..8be0368926....b430cd213c..72..36c606......c606")) {
        sVersion = "1.2";
        sOptions = "by Mark DeSmet (C Ware Corporation)";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$368c1e....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....368b1e....36031e....83c3..3be375..8be0368926....b430cd213c..72..36c606......36a2....c606")) {
        sVersion = "3.X";
        sOptions = "1984-86 by Mark DeSmet (C Ware Corporation)";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$368c1e....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....8be0c606......c606......b9....be....468a84....3c..74..3c..75..b8....50")) {
        sVersion = "2.X";
        sOptions = "1984-86 by Mark DeSmet (C Ware Corporation)";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$368c1e....a1....36a3....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....368b1e....36031e....83c3..3be375..8be0368926")) {
        sVersion = "3.1";
        sOptions = "1984-86 by Mark DeSmet (C Ware Corporation)";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/compiler_Power_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Power C");

function detect() {
    if (MSDOS.compareEP("b8....05....b1..d3e88cca03c28b0e....8cdb8ed8891e....890e....8ec0ba....1e8cc88ed8b8....cd21588ed8bf....33c0")) {
        sVersion = "2.0.X";
        sOptions = "1989-91 by Mix Software";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/compiler_SP-FORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "SP-FORTH");

function detect() {
    if (MSDOS.compareEP("b8....8ed88bec81c5....c746......e8$$$$8b46..25....0d....cd218b46..83ed..8946..c3")) {
        sVersion = "2.5.13";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....8ed88bec81c5....c746......e8$$$$e8$$$$8bc583ed..8946..c3")) {
        sVersion = "2.5.X";
        sOptions = "1994";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_Symantec_BASIC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Symantec BASIC");

function detect() {
    if (MSDOS.compareEP("e8$$$$1e060e1f9a........8c06....33c08ec026a1....a3....26a1....a3....ba....b0..9a........fa26c706........268c0e....fb071fc3")) {
        sVersion = "1.1a";
        sOptions = "1993";
        bDetected = true;
    }

    sLang = "Basic";

    return result();
}

================================================
FILE: db/MSDOS/compiler_Topspeed_C.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Topspeed C");

function detect() {
    if (MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....ba....8eda890e....8936....a3....58")) {
        sVersion = "2.0";
        sOptions = "1989 by JPI";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....c706........58")) {
        sVersion = "2.0";
        sOptions = "1989 by JPI";
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/MSDOS/compiler_Turbo_Basic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Turbo Basic");

function detect() {
    if (MSDOS.compareEP("2E8C......2EC706........E8....E8")) {
        sVersion = "1.0";
        sOptions = "1987";
        bDetected = true;
    } else if (MSDOS.compareEP("faba....8ec28ed2bc....fb8bfc32edbe....8a0e....8bc12bf94f81e7....268c1e....8be78ec2fcf3a48eda8bf7bb....9150")) {
        sVersion = "1.0";
        sOptions = "1987";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_Turbo_Prolog.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Turbo Prolog");

function detect() {
    if (MSDOS.compareEP("fab8....8ed8b8....a3....8ed0bc....fb8c06....268e06....8c06....b8....a3....9a")) {
        sVersion = "2.0";
        sOptions = "1986-88";
        bDetected = true;
    }

    sLang = "Prolog";

    return result();
}

================================================
FILE: db/MSDOS/compiler_WATCOM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("compiler", "WATCOM C");

function detect() {
    if (MSDOS.compareEP("E9....'WATCOM C'")) {
        bDetected = true;
    } else if (MSDOS.isSignaturePresent(0, Math.min(2048, MSDOS.getSize()), "'WATCOM C'")) {
        bDetected = true;
    } else if (MSDOS.isLE()) {
        var nLE = MSDOS.getNEOffset();
        var nDataPage = MSDOS.readDword(nLE + 0x80);
        var nOffset = MSDOS.readDword(nLE + 0x1C);
        if (MSDOS.compare("EB..'WATCOM C'", nDataPage + nOffset)) {
            bDetected = true;
        }
    } else if (MSDOS.compareEP("e9$$$$fbb9....8ec126bb....83c3..80e3..26891e....268c1e....01e383c3..80e3..8ed189dc26891e....89dad1ea")) {
        sName = "Open Watcom C/C++16";
        sVersion = "2002 by Sybase, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$fbb9....8ec1bb....83c3..80e3..26891e....268c1e")) {
        sName = "Open Watcom C/C++16";
        sVersion = "1988-2002 by Sybase, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd8bb....8edb8b1e....0bdb74..8cd18bd4fa8ed3bc....fb50535152a3....e8....5a595b580bdb74..fa8ed18be2fb")) {
        sName += "/C++";
        sVersion = "1990 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....fa8cc88ed0bc....fb2ec706........b8....cd213c..72..2e830e......e8....8bd8")) {
        sName += "/C++";
        sVersion = "1991 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea1....2e0306....fa8ed0bc....fbb8....b1..d3e874..33c054593bcc75..9cb9")) {
        sVersion = "1992 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8d06....a3....8d06....a3....8d06....a3....8cd88d1e....8ed08be3bb....26891e")) {
        sName += " 386";
        sVersion = "1990 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....fa8cc88ed0bc....fbe8....8bd8e8....2ea2....fa")) {
        sVersion = "1990 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("faba....8eda8916....8c06....8c0e....b8....a3....b8....a3....8ed28be0fb0633c9518becbe....268b04a3....8ec28e1e")) {
        sVersion = "1988 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....2e8c1e....fa8cc88ed0bc....fbe8....8bd8fa2e8e16")) {
        sVersion = "1992 by WATCOM Systems Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("EB....00'*** NULL assignment detected'00'")) {
        sName = "Open Watcom C/C++16";
        sVersion = "2.0";
        bDetected = true;
    }

    sLang = sName.indexOf("C++") !== -1 ? "C" : "C++";

    return result();
}

================================================
FILE: db/MSDOS/compiler_WPFORTH.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "WPFORTH");

function detect() {
    if (MSDOS.compareEP("bd....bc....b8....0e5b81c3....8ed3ffe0")) {
        sVersion = "1.0";
        sOptions = "1993 by Albert Chan";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_djgpp.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("compiler", "djgpp");

function detect() {
    if (MSDOS.compare("'go32stub'", 512)) {
        sVersion = "2";
        bDetected = true;
    } else if (MSDOS.isSignaturePresent(0, Math.min(8192, MSDOS.getSize()), "'StubInfoMagic!!'")) {
        sVersion = "1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/compiler_muLISP-87.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "muLISP");

function detect() {
    if (MSDOS.compareEP("e9$$$$eb$$8cc88ed88ed0bc....a3....b8....cd21891e....8c06....a0....5084c075..b8....8ec026803e......75..26c416....8cc1")) {
        sName += "-87";
        sOptions = "1983-1989 by Soft Warehouse, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$eb$$8cc88ed88ed0bc....a3....b8....cd21891e....8c06....b8....cd21891e....8c06....ba....b8....cd21a0....5084c0")) {
        sName += "-90";
        sOptions = "1983-1990 by Soft Warehouse, Inc.";
        bDetected = true;
    }

    sLang = "LISP";

    return result();
}

================================================
FILE: db/MSDOS/converter_EXE2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "EXE2COM");

function detect() {
    if (MSDOS.compareEP("b3..b9....33d2be....8bfeac32c3aa494332e403d0e3..eb")) {
        sVersion = "9.50a";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$92be....bf....fca5a48ccb83c3..b9....ad97011de2")) {
        sOptions = "1996 by EM-Phaser";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e9$$$$8cca81c2....3b16....76..ba....b409cd21cd20")) {
        sOptions = "generic, type 2";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$bf....be....a5a48cda83c2..50b4..bb....cd21580116....81c2....8ed2")) {
        sOptions = "0-Relocs by dR.No //ViP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/converter_FromBAT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "FromBAT");

function detect() {
    if (MSDOS.compareEP("e9$$$$be....bf....bb....c604..b9....fe04803c..77..c644....b80629cd21be....3c..74..8a04880743e2")) {
        sOptions = "1991 by Clockwork Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/converter_GRABBER.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "GRABBER");

function detect() {
    if (MSDOS.compareEP("e9$$$$fc8cdb8cc88ed8a3....8ec3891e....8b1e....b1..d3e383c3..b44acd2173..eb")) {
        sVersion = "6.30-6.31";
        sOptions = "1991 by G. A. Monroe";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$fc8cdbb8....8ed8a3....8ec3891e....8b1e....b1..d3e383c3..b44acd2172..b8")) {
        sVersion = "6.32";
        sOptions = "1991 by G. A. Monroe";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$fc8cdb8cc88ed88ec0891e....e8")) {
        sVersion = "3.70-3.87";
        sOptions = "1991 by G. A. Monroe";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$fc8cdbb8....8ed88ec3891e....a3....8b1e....b1..d3e383c3..b44acd2173..b4")) {
        sVersion = "3.91-3.94";
        sOptions = "1991-92 by G. A. Monroe";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/converter_com2exe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("converter", "com2exe");

function detect() {
    if (MSDOS.compareEP("b8....50c3")) {
        sVersion = "9.50";
        bDetected = true;
    } else if (MSDOS.compareEP("16179c58f6c4..74..faeb")) {
        sName = "COM -> EXE";
        sOptions = "1993 by R.Roth";
        bDetected = true;
    } else if (MSDOS.compareEP("fcbe....bf....b9....f3a568....c3")) {
        sVersion = "2.1";
        sOptions = "1997 by X-HACKS Group";
        bDetected = true;
    } else if (MSDOS.compare("02000000fffff0fffeff....0001f0ff1c00000000000000", 0x8)) {
        sOptions = "by Stefan Esser";
        bDetected = true;
    } else if (MSDOS.compare("040000100010f0fffeff00000001f0ff..000000", 0x8)) {
        sOptions = "by MasterBall Systems";
        bDetected = true;
    } else if (MSDOS.compare("02000000fffff0fffeff00000001f0ff1c0000000000924b", 0x8)) {
        sOptions = "by Tnarchistic KA0T";
        bDetected = true;
    } else if (MSDOS.compare("0200....fffff0fffeff00000001f0ff1c00000000000000", 0x8)) {
        sOptions = "by Fabrice Bellard";
        bDetected = true;
    } else if (MSDOS.compare("02000000fffff0fffeff00000001f0ff1c00000020202020", 0x8)) {
        sOptions = "by cINOgEN";
        bDetected = true;
    } else if (MSDOS.compare("0500aaaafffff0fffeff00000001f0ff1c00000000000000", 0x8)) {
        sOptions = "by COMSEC";
        bDetected = true;
    } else if (MSDOS.compare("0400aaaaffff0000feff00000001f0ff4000000053545542", 0x8)) {
        sOptions = "by DblStar Software";
        bDetected = true;
    } else if (MSDOS.compare("0200aaaafffff0fffeff00000001f0ff0000454c49544500", 0x8)) {
        sOptions = "by Elite x";
        bDetected = true;
    } else if (MSDOS.compare("02000010fffff0fffeff00000001f0ff1c00000000000000", 0x8)) {
        sOptions = "by HENDRX";
        bDetected = true;
    } else if (MSDOS.compare("02000000fffff0fffeff00000001f0ff1c0000004d455353", 0x8)) {
        sOptions = "MESS /E";
        bDetected = true;
    } else if (MSDOS.compare("0200aaaafffff0ff000000000001f0ff1c00000050484158", 0x8)) {
        sOptions = "by PHaX";
        bDetected = true;
    } else if (MSDOS.compare("2000aa00ffffaaaa00aa00000001f0ff0000000000000000", 0x8)) {
        sOptions = "SCRb2e";
        bDetected = true;
    } else if (MSDOS.compare("02008f0daaaaf0fffeff00000001f0ff1c0000000000524f", 0x8)) {
        sOptions = "by Rose";
        bDetected = true;
    } else if (MSDOS.compare("0200d70dfffff0fffeff00000001f0ff1c00005472696c6c", 0x8)) {
        sOptions = "by Trills nT";
        bDetected = true;
    } else if (MSDOS.compare("02000000fffff0ff000000000001f0ff1c00000000000000", 0x8)) {
        sOptions = "UNP x";
        bDetected = true;
    } else if (MSDOS.compare("04000100fffff0fffeffaaaaaa0200001c000000aa020000", 0x8)) {
        sVersion = "1.0";
        sOptions = "Comvert";
        bDetected = true;
    } else if (MSDOS.compare("18000000fffff0fffeff00000001f0ff1c00000020202020", 0x8)) {
        sOptions = "WWPACK";
        bDetected = true;
    } else if (MSDOS.compare("0200....fffff0ff648400000001f0ff1c00000000000000", 0x8)) {
        sOptions = "by unknown";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/cryptor_EXE-Cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "EXE-Cryptor");

function detect() {
    if (MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1fe8$$$$8cc9bb....83c5..5e2ead1e2e81")) {
        sOptions = "1993-1995 by Rolle&Schild"
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1ffa8bec8c4e..c746......fe0e")) {
        sOptions = "1993 by Rolle&Schild"
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1ffa8bec8c4e..c746......fe0e....f972..ba....0e1fbb....8b0e")) {
        sOptions = "1992 by RKT-LANDMARK"
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1f8926....8306......fa8c0e....fe0e....f972..ba....0e1fbb")) {
        sOptions = "by RKT-LANDMARK"
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/cryptor_TUCCRYP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "TUCCRYP");

function detect() {
    if (MSDOS.compareEP("eb$$2e8c06....8cca8ec28edab4..ba....cd218cda2ea1....2bd08edabb....2e8b0e....b2..51b9....8a0732c28807fec280")) {
        sVersion = "2+";
        sOptions = "George Stark";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$2e8c06....8cca8ec28edab4..ba....cd218cda2ea1....2bd08edabb....2ea1....ba....f7e28bc8")) {
        sName = "TUC cryPack";
        sVersion = "1.0";
        sOptions = "George Stark";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/cryptor_deep-CRyPTer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "deep-CRyPTer");

function detect() {
    if (MSDOS.compareEP("..E9....E8....598BE981......81......BE....8D......66....66....8D......8BD78BDF")) {
        sVersion = "0.1c";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/dos_extender.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "dos extender by Doug Huffman");

function detect() {
    if (MSDOS.compareEP("0e1f8cc6b4..50bb....cd2173..58cd2172..03de8bebb8....cd21065356b8....cd2f0bc075")) {
        sVersion = "1991";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f06b4..50bb....cd2173..58cd2172..8cc003d88bebb8....cd210653b8....cd2f0bc075")) {
        sVersion = "1992";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/dos_extender1.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "DOS protected mode extender");

function detect() {
    if (MSDOS.compareEP("fafc0e1fe8....8cc0660fb7c066c1e0..6667a3........66b8........66c1e0..6667a3........66670905........66670905")) {
        sVersion = "1994 by TRAN (Thomas Pytel)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/dos_extender2.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "DOS extender");

function detect() {
    if (MSDOS.compareEP("bc....bb....438cc02bd8b4..cd2173..9a........0e1feb")) {
        sVersion = "1986-90 by Ergo Computing, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed0bc....bb....8cc02bd843b4..cd21b8....8ed8c606......b8....8ed88cc0a3")) {
        sVersion = "1986-91 by Ergo Computing, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_Blinker.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("extender", "Blinker");

function detect() {
    if (MSDOS.isNE()) {
        if (MSDOS.compare("'BLINKER'", MSDOS.getBaseOffset(0x18))) {
            bDetected = true;
            nOffset = MSDOS.getNEOffset(-0x1200);
            if (nOffset > 0) {
                nOffset = MSDOS.findString(nOffset, 0x1200, "Blinker ");
                if (nOffset != -1) {
                    sVersion = MSDOS.getString(nOffset + 8, 4);
                }
            }
        }
    } else if (MSDOS.compareEP("e8$$$$558bec5053515256571e06fc8cc88ed8e8....bf....8845..8c")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$1e06fc8cc88ed8e8....bf....8845..8c1e....c41e....891d")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_CWSDPMI.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "CWSDPMI");

function detect() {
    if (MSDOS.compareEP("8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7")) {
        sVersion = "0.90+ (r4)";
        sOptions = "1997 by Charles W. Sandmann";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7")) {
        sVersion = "0.90+ (6b)";
        sOptions = "2001 by Charles W. Sandmann";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....8eda8cd32bdac1e3..8ed203e38c06....fcb430cd213c0373..b0..ba....e9")) {
        sName += " (ELFstub)";
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_CauseWay_DOS_Extender.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "CauseWay DOS Extender");

function detect() {
    if (MSDOS.compareEP("fa161f26a1....83e8..8ed0fb061607be....8bfeb9....f3a407368c......8bd88cca3603......368b......fd8bc53d....76")) {
        sVersion = "3.1X-3.4X";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8be88cc60e1f8cc005....0106....b8....cd213c..73..b8....cd21803e......74..8cc005....0306....268b16....3bc273..8ec0a1....33ff")) {
        sVersion = "2.64, 3.25";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_DOS32.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "DOS32");

function detect() {
    if (MSDOS.compareEP("0e1ffc9c5b8bc380f4..509d9c583ae775..ba....b409cd21b44ccd218c06....26a1....a3")) {
        sVersion = "3.3";
        sOptions = "1995 by Adam Seychell";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f068c06....26a1....a3....8ec06633ff6633c96649fc32c0f2ae26380575..83c7")) {
        sVersion = "3.0";
        sOptions = "by Adam Seychell";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1ffc9c5b8bc380f4..509d9c5838fc75..ba....b409cd21b44ccd21")) {
        sVersion = "3.5c rev6";
        sOptions = "1995 by Adam Seychell";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_DOS4G.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("extender", "DOS/4G");

function detect() {
    if (MSDOS.isSignaturePresent(0, Math.min(1024, MSDOS.getSize()), "'DOS/4G'")) {
        bDetected = true;
    } else if (MSDOS.isSignaturePresent(0, Math.min(1024, MSDOS.getSize()), "'DOS4GW'") ||
        MSDOS.isSignaturePresent(MSDOS.getNEOffset() - 1024, 1024, "'dos4gw'")) {
        sName += 'W';
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_DOSX16.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "DOSX16");

function detect() {
    if (MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6")) {
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....81eb....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6")) {
        sVersion = "type 1";
        sOptions = "CodeView";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$b430cd213c0372..e8$$$$56571e060e1fb8....cd213c0372..77..80fc..72..b452cd2126a1....3d")) {
        sVersion = "type 2";
        sOptions = "CodeView";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8cc8fa8ed0bc....fb0e1f8c06....c406....a3....8c06....e8....b8....b1..d3e805....a3....e8")) {
        sVersion = "type 3";
        sOptions = "CodeView";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$b8....8ed88c06....8ed0bc....50bb....b44acd21588ec0")) {
        sVersion = "type 4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_EMX.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "EMX DOS Extender");

function detect() {
    if (MSDOS.compareEP("b8....8ed88c06....e8....e8....e8....e8")) {
        sVersion = "0.8f-0.9d";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8ed88cd88ed0bc....e8....3c..72..26a1")) {
        sVersion = "0.8f";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_Go32Stub.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Go32Stub DOS-Extender");

function detect() {
    if (MSDOS.compareEP("0e1f8c1e....8c06....fcb430cd21")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("68....1fbd....9081ed....8c06....fcb430cd21")) {
        sVersion = "2.02T";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....8eda8cd32bdac1e3..8ed203e3bd....81ed....8c06....fcb430cd21")) {
        sVersion = "2.02T";
        bDetected = true;
    } else if (MSDOS.compareEP("fc0e1fb4..bb....b9....ba....cd21061e07bf....b9....30c0f3aa07e9")) {
        sVersion = "2.02T";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_PMODE.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("extender", "PMODE/W");

function detect() {
    if (MSDOS.compare("'PMODE/W v'", 0x55)) {
        sVersion = MSDOS.getString(0x5e, 4);
        bDetected = true;
    } else if (MSDOS.compareEP("fc1607bf....8bf757b9....f3a5061e071f5fbe....060ea4ad8be8b2..1eb8....50cb")) {
        sVersion = "1.12-1.33";
        sOptions = "1994-1997 by Daredevil and Tran.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_PRO32.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "PRO32 Protected Mode DOS Extender");

function detect() {
    if (MSDOS.compareEP("e8$$$$8cc82ea3....fa6633f68eeeb8....8ed8b9....66658b0466890483c6..e2..6633c0bb")) {
        sVersion = "1.7";
        sOptions = "1996-99 by Dieter Pawelczak";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_RSX.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "RSX DPMI DOS Extender");

function detect() {
    if (MSDOS.compareEP("8cc2b8....8ed88ec08ed0bc....8916....e8....b44ccd21")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_Stub-386.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Stub-386 DPMI DOS Extender");

function detect() {
    if (MSDOS.compareEP("0e1f8c06....b430cd213c..73..b8....eb..c606......c606......c606......c606......9a")) {
        sOptions = "1997 by LADsoft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_TMTSTUB.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "TMTSTUB DOS Extender");

function detect() {
    if (MSDOS.compareEP("b462cd218bc38ccb538edb8c0e....8c0e....8c0e....2bd8bd....03ddc1e5..b44acd2173..ba....e9")) {
        sVersion = "0.31";
        sOptions = "32bit WDOSX-based DOS-extender and loader by Rustam Gadeyev";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_WDOSX.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("extender", "WDos/X");

function detect() {
    if (MSDOS.compare("'WDOSX'", 52)) {
        sVersion = MSDOS.getString(58, 4);
        sOptions = "1996-1999 by Michael Tippach";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_WDOSX32.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "WDOSX32");

function detect() {
    if (MSDOS.compareEP("bc....fcbf....ba....e8....b8....abe8....ba....e8....b0..aabe....bf....89faac3c..75..e8....57444f53584c45")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_XMLOD.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "XMLOD DOS-Extender");

function detect() {
    if (MSDOS.compareEP("8cd805....8ed88ed0bc....90908d06....ffd0")) {
        sOptions = "1991 by IGC, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("fa8cd805....8ed88ed0bc....90908d1e....c1eb..03c333f6268b5c")) {
        sVersion = "1992";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/extender_Xtender.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("extender", "Xtender DOS Extender");

function detect() {
    if (MSDOS.compareEP("0e1fe8$$$$e8$$$$b8....9c5b80e7..539d9c5980e5..80fd..74..4080cf..539d9c5980e5..74..40668bdc66")) {
        sVersion = "1.04.36037";
        sOptions = "by vyc/sophtXS";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/immunizer_CPAV.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Central Point Anti-Virus");

function detect() {
    if (MSDOS.compareEP("e8$$$$5b81eb....50515256578beb1e2ec6........268e......061fb9....bf....8bc7eb")) {
        sVersion = "1992-1993";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/immunizer_F-XLOCK.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "F-XLOCK");

function detect() {
    if (MSDOS.compareEP("505050535152561e8bdc8cd805....368947..36c747......8e1e....33db8b07433d....74..75..43833f..75..4343")) {
        sVersion = "1.16";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/immunizer_Oyster.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Oyster");

function detect() {
    if (MSDOS.compareEP("061e55565752515350e8$$$$508cc805....8ed858c3")) {
        sVersion = "3.01 1991-95 by BEST";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/immunizer_PGPROT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "PGPROT Antivirus Vaccine");

function detect() {
    if (MSDOS.compareEP("e9$$$$2ea3....2e8c1e....2e8c06....0e1f8cc00106....0106....26ff36....0732c033ffb9....f2ae26803d..75..47")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/immunizer_Palladix.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "Palladix Virus Protector");

function detect() {
    if (MSDOS.compareEP("2e8c1e....b8....cd2172..3c..72..b8....cd218cc08ed88bd3b8....cd218cc88ed8b8....ba....cc8cc88ed88ec0be....8bfe")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/immunizer_TTW.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "TTW");

function detect() {
    if (MSDOS.compareEP("ab33c08bd88bc889c28bf889c6db52..e9")) {
        sOptions = "1994-95 by TTW Inc.";
        bDetected = true;
    }
    if (MSDOS.compareEP("d88b....c2....89c6071fcb")) {
        sOptions = "1994-95 by TTW Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/joiner_TurboChainer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("joiner", "TurboChainer");

function detect() {
    if (MSDOS.compareEP("ba....8eda8cd32bdad1e3d1e3d1e3d1e3fa8ed203e3fbb8....8ed81efc8d06....83c0..501ebe....8cc08ed8075f8b0c32ed5146f3a4591f")) {
        sVersion = "1.03";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/joiner_V-Load.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("joiner", "V-Load");

function detect() {
    if (MSDOS.compareEP("33f62ef606......74..0e588bd881e3....75..b1..d3e02bf0d3ee065b0e582bc3b1..bb....8bd3d3eb81e2")) {
        sVersion = "0.9c1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/library_ParsecCollection.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("library", "Parsec Collection");

function detect() {
    if (MSDOS.compareOverlay("0D0A41205041525345432050726F64756374696F6E")) {
        sOptions = "EOF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/loader_32stub.0a.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("loader", "32stub for PE files");

function detect() {
    if (MSDOS.compareEP("8cc88ed88c1e....8c06....8c06....8c06....8bdc83c3..d1ebd1ebd1ebd1eb8cd003d82b1e....b8....cd21")) {
        sOptions = "by Borland";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/mbp_SHRINK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "mbp SHRINK");

function detect() {
    if (MSDOS.compareEP("061e508cc005....2e0106....2e0106....8bd02e0306....2ea3....2e8b3e....8ed80355..8955..8b3d0bff74")) {
        sOptions = "by mbp Software & Systems";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/other_AutoHack.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "AutoHack addition");

function detect() {
    if (MSDOS.compareEP("0e1fb409ba....cd21fa8e06....be....8b0e....83f9..74..fdd1e1")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/other_Coderunner.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// CodeRunneR is an effective tool for creating new TSRs and porting existing applications to a TSR environment.
// http://www.drdobbs.com/msis-coderunner-makes-your-tsrs-run/184402267?pgno=5

meta("other", "CodeRunneR");

function detect() {
    if (MSDOS.compareEP("e9$$$$e8$$$$fc5e8cdaa1....bd....8edd8ec5a3....b9....bf....2bcf33c02ea3....41d1e9f3ab8916")) {
        sOptions = "1989 by Micro Systems Software, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e8$$$$fc5e8cda8b1e....bd....8edd8ec5b9....bf....2bcf33c02ea3....41d1e9f3ab891e")) {
        sOptions = "1989 by Micro Systems Software, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e8$$$$fc5e8cdaa1....bd....8edd8ec5a3....b9....bf....2bcf33c02ea3....d1e9f3ab8916")) {
        sOptions = "1992 by OP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/other_DemoMaker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "DemoMaker");

function detect() {
    if (MSDOS.compareEP("be....ad8ed833f6b8....8ec0bf....b9....ac3c..75..3a0474..e2..b8....8ed8b409ba....cd21b8....cd21")) {
        sVersion = "1.55";
        sOptions = "1993-94 by R.Janorkar";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/overlay_overlays.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("overlay", "");

function detect() {
    if (MSDOS.compareOverlay("....'-lh'..2d") || MSDOS.compareOverlay("....'-lz'..2d")) {
        sName = "LHA archive";
        switch (MSDOS.readByte(MSDOS.getOverlayOffset() + 0x5)) {
            case 0x30: bDetected = true; break;
            case 0x31: bDetected = true; break;
            case 0x32: bDetected = true; break;
            case 0x33: bDetected = true; break;
            case 0x34: bDetected = true; break;
            case 0x35: bDetected = true; break;
            case 0x36: bDetected = true; break;
            case 0x64: bDetected = true; break;
            case 0x73: bDetected = true; break;
        }
    } else if (MSDOS.compareOverlay("60ea")) {
        sName = "ARJ archive";
        bDetected = true;
    } else if (MSDOS.compareOverlay("'ZOO'............'Archive'")) {
        bDetected = true;
        sName = "ZOO archive";
    } else if (MSDOS.compareOverlay("4c0103")) {
        bDetected = true;
        sName = "COFF executable";
    } else if (MSDOS.compareOverlay("0101'Aladdin'")) {
        sName = "Self UnStuffit data";
        sVersion = "1.1";
        sOptions = "by Aladdin Systems, Inc.";
        bDetected = true;
    } else if (MSDOS.compareOverlay("7f'ELF'010101")) {
        sName = "ELF executable";
        bDetected = true;
    } else if (MSDOS.compareOverlay("................'BSA'")) {
        sName = "BSN archive";
        bDetected = true;
    } else if (MSDOS.compareOverlay("'W4'")) {
        sName = "W4 executable";
        bDetected = true;
    } else if (MSDOS.compareOverlay("fef2fc")) {
        sName = "FOXPRO archive";
        bDetected = true;
    } else if (MSDOS.compareOverlay("'SXD'00")) {
        sName = "Sydex archive";
        bDetected = true;
    } else if (MSDOS.compareOverlay("'RS'000102")) {
        sName = "GamBit Pro Library archive";
        bDetected = true;
    } else if (MSDOS.compareOverlay("'PK'0304")) {
        sName = "ZIP archive";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_32LiTe.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.softpedia.com/get/Compression-tools/32LiTE.shtml
meta("packer", "32LiTe");

function detect() {
    if (MSDOS.compareEP("1E060E1F0E07BE....BF....8BCFFC57F3A48CC80106....C333FF")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_AINEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "AINEXE");

function detect() {
    if (MSDOS.compareEP("a1....2d....8ed0bc....8cd836a3....05....36a3....2ea1....8ad4b1..d2eafec9d3e08cd336")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (MSDOS.compareEP("0e07b9....be....33fffcf3a4a1....2d....8ed0bc....8cd836......05....36......2e")) {
        sVersion = "2.3";
        bDetected = true;
    } else if (MSDOS.compareEP("a1....2d....8ed0bc....8cd836a3....05....36a3....2ea1....8ad4b1..d2ead3e08cd3368b2e....2e032e....fdfeca")) {
        sVersion = "2.22";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_AVPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "AVPACK");

function detect() {
    if (MSDOS.compareEP("501E0E1F160733F68BFEB9....FCF3A506BB....53CB")) {
        sVersion = "1.20";
        bDetected = true;
    } else if (MSDOS.compareEP("EB$$501E0E1F160733F68BFEB9....FCF3A506BB....53CB")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$8cda0316....8bda0316....3b16....76..ba....b409cd21cd208cd28bccfa8ed3bc....fb5251501e53b8")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_Amisetup.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Amisetup loader");

function detect() {
    if (MSDOS.compareEP("b8....50b8....501e8cc88ed8e8$$$$9c5b81e3....539d9c5b81e3....81fb....74..c3")) {
        sOptions = "by Robert Muchsel";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_COMPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "COMPACK");

function detect() {
    if (MSDOS.compareEP("BE....E8....5D83....55505351520E070E1F8BCE")) {
        sVersion = "4.5";
        bDetected = true;
    } else if (MSDOS.compareEP("BD....50068CCB03DD8CD24B8EDBBE....BF....8EC2B9....F3A54A4D75")) {
        sVersion = "5.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_CRYPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "CRYPACK");

function detect() {
    if (MSDOS.compareEP("EB..061E8CD805....8ED833DB0E0733FFBE....8A0726....32C48807473BFE")) {
        sVersion = "3.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_Compress-EXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Compress-EXE");

function detect() {
    if (MSDOS.compareEP("9c508cdb53530e1f83c3..33ff8ec38bd3015d..015d..b9....be....fc32e4ac3c..77")) {
        sVersion = "1.0";
        sOptions = "1990 by W.ZhongHua";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_DIET.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "DIET");

function detect() {
    if (MSDOS.compareEP("BF....3BFC72..B44CCD21BE....B9....FDF3A5FC")) {
        sVersion = "1.00/1.00d";
        bDetected = true;
    } else if (MSDOS.compareEP("FC061E0E8CC801......BA....03............................00000000")) {
        sVersion = "1.00d";
        bDetected = true;
    } else if (MSDOS.compareEP("fc061e0e8cc80106....ba....03c28bd805....8edb8ec033f633ffb9....f3a54b484a79..8ec38ed8be....ad8be8b2..ea")) {
        sVersion = MSDOS.compareEP("64", 55) ? "1.10a/1.20" : "1.00";
        bDetected = true;
    } else if (MSDOS.compareEP("BE....BF....B9....3BFC72..B44CCD21FDF3A5FC")) {
        sVersion = "1.02b/1.10a/1.20";
        bDetected = true;
    } else if (MSDOS.compareEP("F89C061E5756525153500EFC8CC8BA....03D052")) {
        sVersion = "1.44/1.45f";
        bDetected = true;
    } else if (MSDOS.compareEP("F99CEB$$061e5756525153500efc8cc82e0106....ba....03c28bd805....8edb8ec033f633ff")) {
        sVersion = "1.43/1.44";
        bDetected = true;
    } else if (MSDOS.compareEP("F99CEB$$061e5756525153500efc8cc8ba....03d052ba....52ba....03c28bd805....8edb")) {
        sVersion = "1.45f";
        bDetected = true;
    } else if (MSDOS.compareEP("061e0efc8cc80106....ba....03c28bd805....8edb8ec033f633ffb9....f3a54b484a79")) {
        sVersion = "1.44b";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....1e068ccb03dd8cd24b8edbbe....bf....8ec2b9....f3a54a4d")) {
        sVersion = "1.45d";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_DSHIELD.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "DSHIELD");

function detect() {
    if (MSDOS.compareEP("06E8....5E83EE..16179C58B9....25....2E")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_DexEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "DexEXE");

function detect() {
    if (MSDOS.compareEP("8b2e....2e8c0e....2e8c0e....83ed..8ed5bc....501eba....f91bea8ec58cc805....8ed80e06fc33f68bfe8adeb1..d3e2d2ebb8....74..b9....f3a5")) {
        sVersion = "2.1";
        sOptions = "by Kaljevic Dejan";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_EXECUTRIX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "EXECUTRIX-COMPRESSOR");

function detect() {
    if (MSDOS.compareEP("e9$$$$0e1fa3....8c1e....8c1e....268b......89......8ccbb8....05....05....2bc3a3....8cd01e5b2bc3a3....b430cd21")) {
        sOptions = "by Knowledge Dynamics Corp";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_EXEPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "EXEPACK");

function detect() {
    if (MSDOS.compareEP("8cc005....0e1fa3....0306....8ec08b0e....8bf94f8bf7fdf3a4")) {
        switch ((MSDOS.readByte(18) << 8) | MSDOS.readByte(20)) {
            case 0x0010:
                sVersion = "3.65";
                break;
            case 0x9910:
                sVersion = "4.00";
                break;
            case 0x1510:
                sVersion = "4.03";
                break;
            case 0x0012:
            case 0x0112:
                sVersion = "4.06";
                break;
            case 0x0014:
            case 0x2d10:
            case 0x7c10:
                sVersion = "4.00 - 4.06";
                break;
            case 0x8410:
                sVersion = "4.0x (possibly)";
                break;
        }
        bDetected = true;
    } else if (MSDOS.compareEP("428cc005....0e1fa3....0306....8ec08b0e....8bf94f8bf7fdf3a4")) {
        if (MSDOS.readByte(18) == 0x00 && MSDOS.readByte(20) == 0x10) {
            sVersion = "3.65";
        }
        bDetected = true;
    } else if (MSDOS.compareEP("..52428be88cc005....0e1fa3....0306....8ec0..0e....8bf94f8bf7fdf3a4")) {
        if (MSDOS.readByte(18) == 0x00 && MSDOS.readByte(20) == 0x10) {
            sVersion = "3.65";
        }
        bDetected = true;
    } else if (MSDOS.compareEP("8be88cc0......0e1fa3....0306....8ec08b0e........4f8bf7fdf3a4")) {
        if (MSDOS.readByte(20) == 0x10) {
            sVersion = "3.69";
        } else if (MSDOS.readByte(18) == 0x00 && MSDOS.readByte(20) == 0x12) {
            sVersion = "5.31.009";
        }
        bDetected = true;
    } else if (MSDOS.compareEP("8be88cc0......0e1fa3....0306....06b8....06008b....8bf7fdf3a450b8....50cb")) {
        sVersion = "5.31.009";
        bDetected = true;
    } else if (MSDOS.compareEP("8bc6f7d0d3e88cda2bd073..8cd82bd2d3e003f08eda8bc7")) {
        sVersion = "3.65";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_ExeLITE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "ExeLITE");

function detect() {
    if (MSDOS.compareEP("fc8cc80106....ba....03c28bd805....8edb8ec033ff33f6b9....f3a5484b4a75..8ec38ed8be")) {
        sVersion = "1.00";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....bb....0e5a03c20e5053cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_LGLZ.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "LGLZ");

function detect() {
    if (MSDOS.compareEP("fc1e060e8cc80106....ba....03c28bd805....8edb8ec033f633ffb9....f3a54b484a79..8ec38ed8be....ad95b2..ea")) {
        sVersion = "1.04";
        sOptions = "by G.Lyapko";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_LZEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "LZEXE");

function detect() {
    if (MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb")) {
        sVersion = "0.91, 1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3b4..31edfdac01c5aae2")) {
        sVersion = "0.90";
        bDetected = true;
    } else if (MSDOS.compareEP("50060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb")) {
        sVersion = "0.91c";
        bDetected = true;
    } else if (MSDOS.compareEP("50060e1f8b36....83e6..8bfe8bced1e9418cdb031e....8ec3fdf3a553b8....50cb")) {
        sVersion = "0.91c";
        bDetected = true;
    } else if (MSDOS.compareEP("50060e1f8b0e....8bf14e8cdb89f703......8ec3fdf3a4b8....5350cb")) {
        sVersion = "0.91";
        sOptions = "1990";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f068b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f8b0e....89ce504e8cdb0689f7031e....fd8ec3f3a453b8....50cb")) {
        sVersion = "?.?";
        bDetected = true;
    } else if (MSDOS.compareEP("060e1f8b0e....8bf14e8bfe8cdb031e....8ec3fdf3a453b8....50cb")) {
        sVersion = "1.0a";
        bDetected = true;
    } else if (MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb031e....fd8ec3f3a453b8....50cb")) {
        sVersion = "1.0a";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd805....2e0106....2eff2e")) {
        sVersion = "1.00a";
        sOptions = "suspicious, look like a trick";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_MSLite.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "MSLite");

function detect() {
    if (MSDOS.compareEP("538cd315....8beceb$$b8....ffe0")) {
        sVersion = "2.3";
        sOptions = "1998 by A.Cheng //Mercury Soft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Optlink.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Optlink");

function detect() {
    if (MSDOS.compareEP("87c0eb$$fc8c..83c2..5216070e1f0116....0116....33f633ffb9....f3a506b8....50cb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("87c006571e56525153509cfc8cc283c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("87c0eb$$8cda83c2..5216070e1f0116....0116....33f633ffb9....f3a506b8....50cb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("87c0fc8cda83c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("87c0555657525153509cfc8cda83c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")) {
        sOptions = "prepacked";
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....8edffa8ed781c4....fbb430cd21a2....8826....3c..73..8d16....b409cd2133c05006cb")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("87c08cda83c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_PGMPAK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PGMPAK");

function detect() {
    if (MSDOS.compareEP("fa1e1750b430cd213c..73..b44ccd21fcbe....bf....e8....e8....bb....ba....8ac38bf3")) {
        sVersion = "0.13";
        bDetected = true;
    }
    if (MSDOS.compareEP("1e1750b430cd213c..73..b44ccd21fcbe....bf....e8....e8....bb....ba....8ac38bf3")) {
        sVersion = "0.15";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_PKEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PKEXE");

function detect() {
    if (MSDOS.compareEP("fa50535152565755061e8cc88bd88ed80106....0106....0306....33f68ec006e8")) {
        sOptions = "1994 by D.Usov";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_PKLITE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "PKLITE");

function detect() {
    if (MSDOS.compare("'PKLITE'", 0x1E) || MSDOS.compare("'PKlite'", 0x1E)) {
        var bBit = MSDOS.readByte(0x1D);
        sVersion = (bBit & 0x7) + "." + ("0" + MSDOS.readByte(0x1C)).slice(-2);

        if (bBit & 0x8) {
            sOptions = "Extra compression";
        }
        if (bBit & 0x10) {
            sOptions = sOptions.append("Multi-segment file");
        }

        bDetected = true;
    } else if (MSDOS.compareEP("1FB409BA....CD21B8....CD21")) {
        sVersion = "1.50";
        sOptions = "CRC check";
        bDetected = true;
    } else if (MSDOS.compareEP("50B8....BA....05....3B060200")) {
        sVersion = "1.50";
        bDetected = true;
    } else if (MSDOS.compareEP("B8....BA....05....3B060200")) {
        sVersion = "1.12-1.13";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....ba....05....2d....fa8ed0fb2d....8ec050b9....33ff57be....fc565706518cc88ec0")) {
        sVersion = "1.12";
        sOptions = "extra compression";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....b8....05....3B06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")) {
        sVersion = "1.1X";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....05....3B06....72..cd20b9....2d....8ed02d....8ec006ba....be....33ff571e571feb")) {
        sVersion = "1.1X";
        bDetected = true;
    } else if (MSDOS.compareEP("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")) {
        sVersion = "1.12, 1.20";
        bDetected = true;
    } else if (MSDOS.compareEP("50532b06....0a06....8b1e....5b58b8....ba....8cdb03d83b1e....73..83eb..fa8ed3bc....fb")) {
        sVersion = "1.05";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd805....ba....903b06....72..b409ba....cd21cd20")) {
        sVersion = "1.15";
        bDetected = true;
    } else if (MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")) {
        sVersion = "1.03-1.05";
        bDetected = true;
    } else if (MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..908ec353b9....33ff57be....90fcf3a5cb")) {
        sVersion = "1.03";
        sOptions = "type 2";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c1e....8b1e....8cda81c2....3bda72..81eb....83eb..fa8ed3bc....fbfdbe....8bfe8ccab9....03d1")) {
        sVersion = "1.00c";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....ba....3b06....73..2d....8ed02d....518ec050b9....33ff57be....fcf3a5")) {
        sName += " [hacked] by Shay Lev Ary";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_PKTINY.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PKTINY");

function detect() {
    if (MSDOS.compareEP("2ec606......2ec606......2ec606......e9")) {
        sVersion = "1.0"
        sOptions = "by Thomas Monkemeier";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_PMWLite.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PMWLite");

function detect() {
    if (MSDOS.compareEP("e8$$$$fc1633c033db8ec026c406....26813e........75..26813e........74..26891e....26891e....07c3")) {
        sVersion = "1.33";
        sOptions = "by Daredevil & Tran";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_PRO-PACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("packer", "PRO-PACK");

function detect() {
    if (MSDOS.compareEP("0e8cd38ec38cca8eda8b......8bf183....8bfed1..fdf3a553b8....508b")) {
        sVersion = "2.13-2.14";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd38ec38cca8eda8b0e....8bf183ee..8bfed1..fdf3a553b8....508b......cb")) {
        sVersion = "2.08";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Pack");

function detect() {
    if (MSDOS.compareEP("eb$$2e8c1e....2e8c06....8cc383c3..2e891e....8cc88ed8505351525657061eb462cd212e891e....b4..33db4bcd21")) {
        sVersion = "1.0";
        sOptions = "1987 by K.Kokkonen";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Packers.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Packer");

function detect() {
    if (MSDOS.compareEP("fd1e0e81de....89f63bf23ab0....03f433f003f333f781d6....0e28de1a72..00d62250..1250..81e6....07")) {
        sOptions = "by mARQUIS dE sOIRPE //mDS/uCF";
        bDetected = true;
    } else if (MSDOS.compareEP("e800005e83c6..90b9....8cd805....2ec43c8cc303d88ec326010583c6..e2")) {
        sName = "relocation packer";
        sOptions = "by The DoP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_RERP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "RERP");

function detect() {
    if (MSDOS.compareEP("fc1e068cc383c3..0e1fbe....b9....ad3bc175..ad3bc174..03c38ec0ad8bf826011deb")) {
        sVersion = "0.02";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_RIXEPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "RIXEPACK");

function detect() {
    if (MSDOS.compareEP("eb$$fc2e8c1e....8cc88ed8a3....8cc34b8ec326031e....81eb....0306....05....3bc3")) {
        sOptions = "1986, 1990 by RIX SoftWorks, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_RJcrush.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "RJcrush");

function detect() {
    if (MSDOS.compareEP("06FC8CC8BA....03D052BA....52BA....03C28BD805....8EDB8EC033F633FFB9")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_Relpack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Relpack");

function detect() {
    if (MSDOS.compareEP("eb$$2e8c1e....2e8c06....8cc383c3..8cc88ed8be....fcad3d........ad3d........03c38ec0ad")) {
        sVersion = "1.0";
        sOptions = "by TurboPower Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_SCRNCH.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "SCRNCH");

function detect() {
    if (MSDOS.compareEP("eb$$bb....b44acd2181eb....73..ba....b9....e9$$$$0e1fb440bb....cd21b8....cd21")) {
        sVersion = "1.02";
        sOptions = "by Graeme W. McRae";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_SEA-AXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "SEA-AXE");

function detect() {
    if (MSDOS.compareEP("fcbc....0e1fe8....26a1....8b1e....2bc38ec0b1..d3e38bcbbf....8bf7f3a5bf....0657cb")) {
        bDetected = true;
    } else if (MSDOS.compareEP("fcbc....0e1fa3....e8....a1....8b1e....2bc38ec0b1..d3e38bcbbf....8bf7f3a5bf....0657cb")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Scramb.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Scramb");

function detect() {
    if (MSDOS.compareEP("e9$$$$e8$$$$5b0e1f81eb....8bc305....508bc803d12bfac3")) {
        sVersion = "1.20";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Shrinker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Shrinker");

function detect() {
    if (MSDOS.compareEP("bb....ba....81c3....b8....b1..d3e803c38cd9498ec12603......2bc872..fa8ed3bc....fb")) {
        sVersion = "3.0";
        sOptions = "1997 by A.S.M.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_TSCRUNCH.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "TSCRUNCH");

function detect() {
    if (MSDOS.compareEP("e9$$$$061e55575652515350161f0e078bf4bf....b9....fcf3a4b430cd213c0373..be....e9")) {
        sOptions = "by Clarion software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Tenth_Planet.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Tenth Planet Soft packer");

function detect() {
    if (MSDOS.compareEP("50068cca8edabe....fcad95ad9303da8ec38b0c8bf14e8bfefdf3a4b8....0650cb")) {
        sOptions = "1996";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_TinyProg.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "TinyProg");

function detect() {
    if (MSDOS.compareEP("e9$$$$eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")) {
        sVersion = "3.X";
        sOptions = "modified";
        bDetected = true;
    } else if (MSDOS.compareEP("83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$2ec606......e9$$$$83ec..83e4..8bec50be............8cd28cd803....33c275..fc8ec233ff")) {
        sVersion = "3.X";
        sOptions = "modified";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_Tinyprot.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "TinyProt");

function detect() {
    if (MSDOS.compareEP("061e575650535152bd....0e1f8cc005....8ec0be....8b44..8cc103c18944..06b8....cd21891e....8c06....b8....cd21891e....8c06....07ba....b8....45cd21cd01")) {
        bDetected = true;
    } else if (MSDOS.compareEP("18..00..eb$$83ec..83e4..8bec50be....0336....8cd28cd80344..33c275..fc")) {
        sVersion = "1.0c-e";
        sOptions = "1996 by I.Hakszer";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_UCEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "UCEXE");

function detect() {
    if (MSDOS.compareEP("501e0e1ffc33f6e8....160733f633ffb9....f3a506b8....50cb")) {
        sVersion = "2.3";
        sOptions = "1996 by A.Cadach";
        bDetected = true;
    } else if (MSDOS.compareEP("501e0e1ffc2bf6e8....16072bf68bfeb9....f3a406b8....50cb")) {
        sVersion = "2.4";
        sOptions = "1996 by A.Cadach";
        bDetected = true;
    } else if (MSDOS.compareEP("501e0e1ffc160733f633ffb9....f3a506b8....50cb")) {
        sVersion = "3.0";
        sOptions = "1996 by A.Cadach";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_UPX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "UPX");

function getUPXVersion(nSize) {
    var sResult = "",
        nOffset = MSDOS.findString(0, nSize, "$Id: UPX");

    if (nOffset !== -1) {
        sResult = MSDOS.getString(nOffset + 9, 4);
    }

    return sResult;
}

function detect() {
    sVersion = getUPXVersion(Math.min(8192, MSDOS.getSize()));
    if (sVersion) {
        bDetected = true;
    } else {
        if (MSDOS.compareEP("..............fcb430cd213c03")) {
            sVersion = "3.X";
            bDetected = true;
        } else if (MSDOS.compareEP("B9....BE....89F71EA9....8CC805....8ED805....8EC0FDF3A5FC2E........73..92AFAD0E0E")) {
            sVersion = "0.82";
            bDetected = true;
        } else if (MSDOS.compareEP("8CCBB9....BE....89F71EA9....8D......8ED805....8EC0FDF3A5FC")) {
            sVersion = "0.20-0.60";
            bDetected = true;
        } else if (MSDOS.isSignaturePresent(0, Math.min(128, MSDOS.getSize()), "'UPX!'")) {
            bDetected = true;
        } else if (MSDOS.compareEP("f99cb9....be....89f71ea9....8cc805....8ed805....8ec0fdf3a5fc2e........73..92afad0e0e")) {
            sVersion = "?.??";
            bDetected = true;
        } else if (MSDOS.compareEP("8ccb8dbf....57b9....ba....be....89f71e1ea9....8d87....8daf....8ed88ec5fdf3a5fc")) {
            sVersion = "0.05";
            bDetected = true;
        }

        if (bDetected) {
            // Correct version for large files.
            sUPXVersion = getUPXVersion(MSDOS.getSize());
            if (sUPXVersion) {
                sVersion = sUPXVersion;
            }
        }
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_WWPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "WWPACK");

function detect() {
    if (MSDOS.compare("'WWP'", 0x1c)) {
        if (MSDOS.compareEP("B8....8CCA03D08CC981C1....51")) {
            if (MSDOS.compareEP("6A..06068CD383....536A..FC", 14)) {
                sVersion = "3.00";
                sOptions = "Extractable";
            } else if (MSDOS.compareEP("33C9B1..510606BB....538CD3", 14)) {
                sVersion = "3.02";
                sOptions = "Extractable";
            } else if (MSDOS.compareEP("BB....53", 20)) {
                sVersion = "3.03";
            } else if (MSDOS.compareEP("B1..518CD3", 20)) {
                sVersion = "3.05c4";
                sOptions = "Modified";
            }
        } else if (MSDOS.compareEP("BE....BA....BF....B9....8CCD8EDD81ED....06068BDD2BDA8BD3FC")) {
            sVersion = "3.00";
            sOptions = "Relocations pack";
        } else if (MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA1E8EDB011533C02EAC")) {
            sVersion = "3.02";
            sOptions = "Relocations pack";
        } else if (MSDOS.compareEP("0305....B8....8CCA03D08CC981C1....51B9....510606B1..518CD3")) {
            sVersion = "3.05c4";
            if (MSDOS.compareEP("1A", 3)) {
                sOptions = "Extractable";
            } else if (MSDOS.compareEP("1B", 3)) {
                sOptions = "Unextractable";
            }
            if (MSDOS.compareEP("C0", 2)) {
                sOptions = sOptions.append("Password check", "Virus shield");
            } else if (MSDOS.compareEP("80", 2)) {
                sOptions = sOptions.append("Password check");
            } else if (MSDOS.compareEP("40", 2)) {
                sOptions = sOptions.append("Virus shield");
            }
        }
        bDetected = true;
    } else if (MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA")) {
        sVersion = "3.04/3.05";
        sOptions = "Relocations pack";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..518cd383eb..53b1")) {
        sVersion = "3.05beta P";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606fc8cd5b1..51b1..8cd3")) {
        sVersion = "3.0x P";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..51fc8cd5b1..8cd3")) {
        sVersion = "3.0x P";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606bb....538cd383eb..53b1")) {
        sVersion = "3.03 PU";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08cc981c1....5133c9b1..510606bb....538cd383eb..53b1")) {
        sVersion = "3.02, 3.02a P";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d0fc8cd58cc981c1....51b9....510606b1..51b1..8cd383eb..53514d")) {
        sVersion = "3.04 PR";
        sOptions = "Relocations pack";
        bDetected = true;
    } else if (MSDOS.compareEP("fa1e8ed8b8....cd218ed98bd3b8....cd211fe800005a83c2..87d4ffe4")) {
        sVersion = "3.05 PU";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08cc981c1....516a..06068cd383eb..536a..fc8cd5be....33ff")) {
        sVersion = "3.0 P";
        bDetected = true;
    } else if (MSDOS.compareEP("be....ba....bf....b9....8ccd8edd81ed....06068bdd2bda8bd3fc8ec3")) {
        sVersion = "3.0";
        sOptions = "Relocations pack";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....faf9............72..0633c98ec1bf....ab8bc6ab07e8....5a")) {
        sVersion = "3.03 PU";
        sOptions = "Relocations pack modified";
        bDetected = true;
    } else if (MSDOS.compareEP("faba....f8bb....b9....73..0633c98ec1bf....ab8bc6ab07e8....5a")) {
        sVersion = "3.03 PU";
        sOptions = "Relocations pack";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....8cca03d08ccd81c5....55b9....510606b1..518cd383eb..53b1..51fc8cd5be....33ff")) {
        sVersion = "3.05c PU";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/packer_XPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "XPACK");

function detect() {
    if (MSDOS.compareEP("8becfa33c08ed0bc....2e8f06....2e8f06....eb$$0ebb....535feb$$178be5fb48d1e8eb")) {
        sVersion = "1.52";
        bDetected = true;
    }
    if (MSDOS.compareEP("e90000e9$$$$2ec706........8beceb$$2ec606......eb009a")) {
        sVersion = "1.0j";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....15....8beceb$$b8....ffe0")) {
        sVersion = "1.65, 1.66";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....15....813e........e8$$$$e8$$$$eb$$1e0e1f8beceb")) {
        sVersion = "1.67.l";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....15....eb$$b8....ffe0")) {
        sVersion = "1.67j";
        bDetected = true;
    }
    if (MSDOS.compareEP("8beceb$$b8....ffe0")) {
        sVersion = "1.65b2";
        bDetected = true;
    }
    if (MSDOS.compareEP("e9$$$$8beceb$$b8....ffe0")) {
        sVersion = "1.44";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_ZIPSCRUB.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "ZIPSCRUB relocations compressor");

function detect() {
    if (MSDOS.compareEP("8cc88ed88cc381c3....891e....8bc30306....8ec08b0e....8bf14e8bfefdf3a450b8....50cb")) {
        bDetected = true;
    } else if (MSDOS.compareEP("8cc88ed88cc381c3....8bc30306....8ec08b0e....8bf14e8bfefdf3a450b8....50cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/packer_aPACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "aPACK");

function detect() {
    if (MSDOS.compareEP("1E068CCBBA....03DAFC33F633FF4B8EDB8D......8EC0B9....F3A54A75..8EC38ED833FFBE....05....0E50")) {
        sVersion = "0.90-0.99,XE_1.3-1.4";
        bDetected = true;
    } else if (MSDOS.compareEP("1E068CCBBA....03DA8D87....FC33F633FF484B8EC08EDBB9....F3A54A75..8EC38ED833FFBE....05....0E50")) {
        sVersion = "0.82";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc88ed805....8ec050be....33fffcb2..bd....33c950a4ffd5")) {
        sVersion = "0.94";
        sOptions = "-m -d";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc880c4..8ec0fcb9....be....8bfe57f3a55fbe....06ba....521e078ed8cb")) {
        sVersion = "0.82-0.94";
        sOptions = "converted to exe";
        bDetected = true;
    } else if (MSDOS.compareEP("1e060e1f0e07be....bf....8bcffc57f3a4c3")) {
        sVersion = "0.98, 0.99";
        sOptions = "-t";
        bDetected = true;
    } else if (MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffcb6..bd....ffd5")) {
        sVersion = "0.69-0.74";
        sOptions = "-t";
        bDetected = true;
    } else if (MSDOS.compareEP("be....bf....8bcffc57f3a4c3")) {
        sVersion = "0.98-0.99 small";
        bDetected = true;
    } else if (MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffcb6..bd....8bde83e6..c1eb..8cd803c38ed8")) {
        sVersion = "0.73-0.74 big";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f0e07be....bf....8bcffc57f3a4c3")) {
        sVersion = "0.98";
        bDetected = true;
    } else if (MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffcb2..bd....33c950a4")) {
        sVersion = "0.96";
        sOptions = "-m";
        bDetected = true;
    } else if (MSDOS.compareEP("1e06ba....8ccb03dafc33f633ff4b8edb8d87....8ec0b9....f3a54a75..8ec38ed833ffbe....05....0e506a..cb")) {
        sVersion = "0.90-0.99";
        bDetected = true;
    } else if (MSDOS.compareEP("8cc88ed805....8ec050be....33fffcb6..bd....ffd5")) {
        sVersion = "0.73-0.82";
        sOptions = "-d";
        bDetected = true;
    } else if (MSDOS.compareEP("1e068cc88ed805....8ec0be....33fffcb6..bd....ffd5")) {
        sVersion = "0.58";
        sOptions = "type 2";
        bDetected = true;
    } else if (MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffc8cc82e0106....b2..bd....33c9")) {
        sVersion = "0.98, 0.99";
        sOptions = "-m -h";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/patcher_Patchers.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "Patcher");

function detect() {
    if (MSDOS.compareEP("b409ba....cd21ba....cd21b8....ba....cd2173..b409ba....cd21ba....cd21cd20a3....b409ba....cd21")) {
        sName = "CrAcKeR";
        sVersion = "0.2a";
        sOptions = "by Deu$";
        bDetected = true;
    } else if (MSDOS.compareEP("b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb")) {
        sOptions = "by Mr. KIM";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_$pirit.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "$pirit");

function detect() {
    if (MSDOS.compareEP("E8....F9E8....B4..CD212D....13F2E8....2A01F5E9")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("ACB4..CD2106B4..CD21079FE8....FC90")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("123fe8$$$$e4..900c..36e6..ba....f9525289d126b8....36b5..3ecd16fd5a")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("ac03d9e8$$$$e4..fb0c..fbe6..90ba....5252fd89d1b8....30ed2ecd16905a87d190b8....fb86cdf530ed3ecd16f95ac3")) {
        sOptions = "$UPD 2.1 1996 by Night $pirit";
        bDetected = true;
    } else if (MSDOS.compareEP("1c..3a1fe8....f5e8....fde8....04..9035....f8f6dff9d0d5fdfbfcc3")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$e4210c1ae6212eb9....2e51f85189c9f8b8....b5..2ecd163659fdfd87c986cd3eb5..2eb8....f9cd1659c3")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$ba....f8ec0c..36eef5b8....50f950269089c128edf9b8....cd165887c1b8....f886e93e30ed36cd1658fdc3")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$ba....fbec0c..eeb9....51512efd89c9fdb8....b5..3ecd165987c9b8....86e9b5..f8cd1659f9c3")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$e4212e0c..e6212eb9....5151fd89c93eb5..fcb8....fbcd162e5987c926b8....fd")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$26e421f80c..e621f98d1e....53365389d93e30edb8....cd165b")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("91221db4..cd21d2d1e9$$$$b4..cd21a6e8")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("b4..cd21b4..cd21e8$$$$ba....ec900c..26ee8d0e....51fd51")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (MSDOS.compareEP("95e8$$$$fbba....3eecfc0c..3eeefb8d0e....51512687c9b8....28ed26cd162e59fdfb87c9b8....fd88e9f8b5..cd1626592ec3")) {
        sVersion = "1.5";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ABKprot.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ABKprot");

function detect() {
    if (MSDOS.compareEP("B430CD2186E03D....73..9C8CC0065B595153BA....87F256CF0E1F0E07")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_AEP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "AEP");

function detect() {
    if (MSDOS.compareEP("E8$$$$E4212EA3....33C08BD85DB9....50B8....E6210FA9E6..538BDFE42123D84B0FA14B66")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_ALEC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ALEC");

function detect() {
    if (MSDOS.compareEP("c1ed..1346..2e391cb9....f981c1....bb....81c3....2ec007..431346..4975..8e0000d518de3701e2c8......330ce8")) {
        sVersion = "1.3";
        sOptions = "1996 by rANDOM //UCF";
        bDetected = true;
    } else if (MSDOS.compareEP("b9....81c1....bb....81c3....71..908a24402e802f..4372..90")) {
        sVersion = "1.3";
        sOptions = "1996 by rANDOM //UCF";
        bDetected = true;
    } else if (MSDOS.compareEP("b9....81c1....84221a24bf....81c7....2e3856..408422")) {
        sVersion = "1.6";
        sOptions = "1996 by rANDOM //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ANTI-TRACE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ANTI-TRACE");

function detect() {
    if (MSDOS.compareEP("2ec606......eb$$e9$$$$8cd805....50b8....5033c0cb")) {
        sVersion = "1.0";
        sOptions = "by Oren Maurice";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_AVAST_CRC-Check.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "AVAST CRC-CHECK");

function detect() {
    if (MSDOS.compareEP("eb$$8cc82e0306....502eff36....CB")) {
        sVersion = "7.70";
        sOptions = "1999";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Aluwain.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Aluwain");

function detect() {
    if (MSDOS.compareEP("8BEC1EE8....9D5E")) {
        sVersion = "8.09";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Anti-LAME.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Anti-LAME");

function detect() {
    if (MSDOS.compareEP("060e07bb....31c09090b9....268a0730e0268807fec443e2..078cc005....05....50b8....50b8....50c3")) {
        sOptions = "by [ptPower";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Antilame.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Antilame");

function detect() {
    if (MSDOS.compareEP("fd2ad01e03fa33fe81d7....2efe06....12d30e0e0780f6..1f85fe33ff1216....b2..81d2....84e2ba....d1c232f7")) {
        sVersion = "1.0b";
        sOptions = "by Phantomlord";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Bitlok.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "BITLOK");

function detect() {
    if (MSDOS.compareEP("eb$$b430cd213c..72..2e8c1e....8cdb83c3..2e011e....0e1feb$$33c0eb$$bf....eb$$b9....eb$$51eb$$2bcf")) {
        sVersion = "3.1";
        sOptions = "by Yellow Rose Software Workgroup";
        bDetected = true;
    } else if (MSDOS.compareEP("fa8ccc8ed4bc....9c51525657550e1f2e8c06....2ec606......0e07be....b9....b0..e3")) {
        sName = "BITLOK-7NT";
        sVersion = "11/13/93-04/22/95";
        sOptions = "by Mr. Lei (Yellow Rose Co.)";
        bDetected = true;
    } else if (MSDOS.compareEP("fa8ccc8ed4bc....9c51525657550e1f2e8c06....0e07be....b9....b0..e3")) {
        sName = "BITLOK-7NT";
        sVersion = "05/21/93";
        sOptions = "by Mr. Lei (Yellow Rose Co.)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Bunny.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Bunny");

function detect() {
    if (MSDOS.compareEP("fae9$$$$8cc02ea3....8cd82ea3....8cd02ea3....8bc42ea3....8cc88ed88ec08ed0bc....e8")) {
        sVersion = "4.1";
        sOptions = "1993 by M.Bunjes";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CC");

function detect() {
    if (MSDOS.compareEP("b8....ba....3be073..b409ba....cd21b8....cd218bdc81eb....83e3..fcbe....8bfbb9....f3a48bc3b1..d3e88cc903c15033c050cb")) {
        sVersion = "1.0";
        sOptions = "1991 by B.Vorontsov";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....b430cd213c..73..33c00650cbb9....b8....eb$$05....fc80c4..eb")) {
        sVersion = "2.61 Beta";
        sOptions = "by UniHackers";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CEPexe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CEPexe");

function detect() {
    if (MSDOS.compareEP("8cdd0e070e1fbf....be....b9....fcf3a41f5f8f..8f....8f....8c....8f....8f....595f5e8cc88ec08ed8ea")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CERBERUS.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CERBERUS");

function detect() {
    if (MSDOS.compareEP("9C2BED8C....8C....FAE4..88....1607BF....8EDD9BF5B9....FCF3A5")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_COMCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COMCRYPT");

function detect() {
    if (MSDOS.compareEP("e9$$$$b9....be....89f70e1f0e07bb....fcad31d8abe2")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$eb$$5053575152061e572e8b36....81c6....8a5c..2e881e....8a5c")) {
        sVersion = "1.0b";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_COMPROTECT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "COMPROTECT");

function detect() {
    if (MSDOS.compareEP("b8....15....72..8ac4bb....50515253555657061e50b8....58eb")) {
        sVersion = "2.10";
        sOptions = "1988-95 by Ralph Roth (converted to exe)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CONVOY.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CONVOY++");

function detect() {
    if (MSDOS.compareEP("e9$$$$2e8c06....2ea3....b8....cd2f3c..75..b8....ba....0e1fcd21b8....cd21")) {
        sOptions = "1993 by ELIAS Copy-Protection System";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$2e8c06....2ea3....e8$$$$5056571e062e8b3e....2e8106........2e893e....0e0733c08ed833f6b9")) {
        sVersion = "3.2";
        sOptions = "1993 by ELIAS Copy-Protection System";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CRYPTEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CRYPTEXE");

function detect() {
    if (MSDOS.compareEP("EB..8BDCEB..EA........01EA83FC..74..EB")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$8bdceb$$bc....eb$$83fc..74..eb$$cd20eb$$8be3")) {
        sVersion = "1.04";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c1e....eb$$fa50b8....58eb$$eb$$8bdceb$$bc....eb$$83fc..eb$$74..fa")) {
        sVersion = "1.01b";
        sOptions = "1996 by DoP";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_China Locker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "China Locker");

function detect() {
    if (MSDOS.compareEP("e9$$$$fc2e891e....2e890e....2e8916....2e8936....2e893e....2e8c16....2e8926....2e8c1e....90909090")) {
        sVersion = "1995.02.02";
        sOptions = "by China Locker Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Ciphator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Ciphator");

function detect() {
    if (MSDOS.compareEP("9393E8$$$$586A..0E68....CF")) {
        sVersion = "4.6";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Codesafe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Codesafe");

function detect() {
    if (MSDOS.compareEP("e9$$$$5033c08ec02ef606......74..26ff36....061e07e8....07268f06....fb2e8c1e....26ff36....268f06")) {
        sOptions = "by EliaShim Ltd";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ComProtector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ComProtector");

function detect() {
    if (MSDOS.compareEP("E9....E8....5E8BEE81......8D......B9....F61446E2..4B")) {
        sVersion = "1.0b";
        bDetected = true;
    } else if (MSDOS.compareEP("E9....B9....BB....BF....2E....34..FEC8C0....2E....2E....2E....4743E2")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_ComprEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ComprEXE");

function detect() {
    if (MSDOS.compareEP("fc1e068cdd83c5..89e8ba....8b1e....29d3538ed88ec331f631ffb9....f3a540434a75..b8....50cb")) {
        sVersion = "1.0";
        sOptions = "by Tom Torfs";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Copy_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Copy Protector");

function detect() {
    if (MSDOS.compareEP("2EA2....5351521E06B4..1E0E1FBA....CD211F")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("E9....505351521E0657E8....5F83EF..B4..1E0E1F")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Copylock_PC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Copylock PC");

function detect() {
    if (MSDOS.compareEP("0e1fb9....bf....8135....83c7..e2")) {
        sOptions = "1990 by Rob Northen Computing";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f8c1e....8c06....1e07bf....33f6")) {
        sOptions = "1990 by Rob Northen Computing";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1fb9....bf........83c7..e2")) {
        sOptions = "1990 by Rob Northen Computing";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1fb9....bf............83c7..e2")) {
        sOptions = "1990 by Rob Northen Computing";
        bDetected = true;
    } else if (MSDOS.compareEP("0e1f8cc0a3....90909090909090909090a1")) {
        sOptions = "1990 by Rob Northen Computing";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CrAcKeR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CrAcKeR");

function detect() {
    if (MSDOS.compareEP("eb$$be....8bfe5633c0be....ac02e081fe....72..5eac34..aa81fe....72")) {
        sVersion = "0.2a";
        sOptions = "by Deu$";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CrackStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CrackStop");

function detect() {
    if (MSDOS.compareEP("B4..BB....B9....8BECCD21FAFC03....05....FFE0")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....be....ffe6")) {
        sVersion = "1.0b";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Cruncher.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Cruncher");

function detect() {
    if (MSDOS.compareEP("2E........2E......B430CD213C0373..BB....8EDB8D......B409CD210633C050CB")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_CryExe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CryExe");

function detect() {
    if (MSDOS.compareEP("E9$$$$E9$$$$E9$$$$BB....E8$$$$31EDEB$$8EDDEB$$872FE8$$$$E8$$$$55E9$$$$E9$$$$31C0EB$$EB$$E8")) {
        sVersion = "4.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_CryptCom.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "CryptCom");

function detect() {
    if (MSDOS.compareEP("e9$$$$be....56b9....c704....c644....8134....4646e2..31f631c9c3")) {
        sVersion = "2.0";
        sOptions = "by Nowhere Man";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_CrypteXeC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CrypteXeC");

function detect() {
    if (MSDOS.compareEP("FD25....E8....3EBA....EC0C..26EE..B9....5151..87C9")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (MSDOS.compareEP("06b4..cd2107e8....acac3ee8....d7e9")) {
        sVersion = "1.01";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Crypto-box.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Crypto-box");

function detect() {
    if (MSDOS.compareEP("e9$$$$9c50520e538bec2e892e....1e06b8....8bf80e07b8....8ed82e8b1e....8b078bf0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_DCREXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "DCREXE");

function detect() {
    if (MSDOS.compareEP("e8$$$$52e8$$$$5a83c2..ffe2")) {
        sVersion = "2.0";
        sOptions = "by LuCe"
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$53e8$$$$5b83c3..ffe3")) {
        sVersion = "2.0";
        sOptions = "by LuCe"
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_DMC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "DMC");

function detect() {
    if (MSDOS.compareEP("e9$$$$2e8c16....2e8926....2ea3....8cc88ed0bc....2ea1....505351525657551e060e1f8c06....a1")) {
        sVersion = "3.5";
        sOptions = "by Adlersparre & Associates"
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Deeper.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Deeper");

function detect() {
    if (MSDOS.compareEP("90e9$$$$e8000059fa8bdc36c747......36837f....75..fb66fafb8be981ed....81e9....be....8dbe....668b05668904")) {
        sVersion = "1.0c";
        bDetected = true;
    }
    if (MSDOS.compareEP("90e9$$$$e80000fa8bdc36c747......36837f....75..fb598be981ed....81e9....be....8dbe....668b05668904")) {
        sVersion = "1.0a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_E-PROT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "E-PROT 386+");

function detect() {
    if (MSDOS.compareEP("81f8....be....90bd....2e8076....454e75")) {
        sVersion = "1.0.3";
        sOptions = "2000 by MasterBall Systems, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_EEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "EEXE");

function detect() {
    if (MSDOS.compareEP("B430CD213C0373..BA1F000E1FB409CD21B8FF4CCD21")) {
        sVersion = "1.12";
        sOptions = "1994 by F.P.Budzyn"
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd213c..73..0e1fb409ba....cd21b8....cd21")) {
        sOptions = "1994 by F.P.Budzyn"
        bDetected = true;
    } else if (MSDOS.compareEP("33c08ed806be....bf....b9....fcf3a5b4..cd21")) {
        sVersion = "1.11";
        sOptions = "1994 by F.P.Budzyn"
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_EPW.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "EPW");

function detect() {
    if (MSDOS.compareEP("06571e5655525153502e8c......8cc005....2ea3....8ed8a1")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (MSDOS.compareEP("06571E5655525153502E8C0608008CC083")) {
        sVersion = "1.30";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$06571e565552515350bb....81c3....2e8b078ccb03c305....50b8....50cb")) {
        sVersion = "1.20";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_ETS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ETS (ENCRYPT THE SHiT)");

function detect() {
    if (MSDOS.compareEP("60061eeb$$bf....8cc82e8985....2e8b8d....8ec02e8bbd....e8")) {
        sVersion = "1.0";
        sOptions = "by Da BLoB / MAFiA";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_EXE-Crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXE-Crypt");

function detect() {
    if (MSDOS.compareEP("90eb$$2e8c......2e89......8cc88ed0bc....1e060e1f8cc005....8ec01ee8....1f8cc3be....2e8b......83....74")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_EXE-Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXE-Protect");

function detect() {
    if (MSDOS.compareEP("e800005d81ed....1e06..1fb4..8db6....b9....8a1446cd21909090")) {
        sOptions = "by Phrozen Crew";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_EXEGUARD.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "EXEGUARD");

function detect() {
    if (MSDOS.compareEP("BA....BF....EB$$E8$$$$53BB....EB$$EB$$5B0E075051535653BB....EB")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_EXEHigh.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXEHigh");

function detect() {
    if (MSDOS.compareEP("8cca8b2e....8eda8c06....8cda2bea8b3e....81ff....73..bf....893e....81c7....033e....b1..d3ef47d3e7fa")) {
        sVersion = "1.01";
        sOptions = "by NoddegamrA";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_EXETools.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "EXETools");

function detect() {
    if (MSDOS.compareEP("e800005d83ed..1e8cda83c2..8eda8ec2bb....ba....85d274..b4..33ff33f6b9....ac32c4c0c4")) {
        sVersion = "2.1 /E";
        bDetected = true;
    } else if (MSDOS.compareEP("68....68....68....be....bf....57b9....f3a4c3")) {
        sVersion = "2.1 /E";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Encriptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Encriptor");

function detect() {
    if (MSDOS.compareEP("EB..B9....BE....BF....ACD0C8AAE2..BE....BF....ACAA")) {
        sVersion = "1.00c";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Enkryptonator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Enkryptonator");

function detect() {
    if (MSDOS.compareEP("1e1eb430cd21b4..3c..73..cd21be....e8....e8....e8....1f07e9")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ExeCode.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ExeCode");

function detect() {
    if (MSDOS.compareEP("E9$$$$FA8CC302DF5033C02E8C16....2E8926....8ED0BC....BE....B9....33FF2EC706........32DBB0..E664AC")) {
        sVersion = "1.0";
        sOptions = "1995 by Balazs Scheidler";
        bDetected = true;
    } else if (MSDOS.compareEP("E9$$$$8be8ba....b409cd212ea1....8cc303c3b1..2e8b1e....f7c3....74..83c3..d3eb2e891e....be....bf....b9....f3a5")) {
        sVersion = "1.0 unregistered";
        sOptions = "1995 by Balazs Scheidler";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ExeLock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "EXELock666");

function detect() {
    if (MSDOS.compareEP("068CC88EC0BE....26....34..26....4681......75..40B3..B3..F3")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....bf....eb$$e8$$$$53bb....eb$$eb$$5beb$$0633c08ec0b8....26a3....268c0e....075052faba....b0..ee")) {
        sVersion = "1.0X";
        sOptions = "by ST!LLS0N";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_FACRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "FACRYPT");

function detect() {
    if (MSDOS.compareEP("B9....B3..33D2BE....8BFEAC32C3AA494332E403D0E3")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_FSE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "FSE by ZeNiX Yang //pCE'98");

function detect() {
    if (MSDOS.compareEP("607d..7a..d1ce89f68bf601fb8bf731f781c7....f8f8")) {
        sVersion = "0.6";
        bDetected = true;
    } else if (MSDOS.compareEP("60d1cef533de33c8c7c6....d1cee9$$$$fbf98bd029c131db")) {
        sVersion = "0.6+";
        bDetected = true;
    } else if (MSDOS.compareEP("607d..7a..d1ce89f68bf601fb8bf731f781c7....f8e8")) {
        sVersion = "0.6+";
        bDetected = true;
    } else if (MSDOS.compareEP("60b3..b7..7e..f5d1c2fb81e9....c7c0....bd....81c5....d1ce33c4fd79..e9")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$6025....eb$$eb$$8cc0fa66c1cc..eb$$44bc....eb$$2ea3....66c1cc..e9")) {
        sVersion = "0.4+";
        bDetected = true;
    } else if (MSDOS.compareEP("60fff08fc603f6b1..b5..fff18fc2f8e9")) {
        sVersion = "0.55";
        bDetected = true;
    } else if (MSDOS.compareEP("60cefd33db81c3....81f3....81c3....fd45eb")) {
        sVersion = "0.5c";
        bDetected = true;
    } else if (MSDOS.compareEP("607c..79..81ef....cc7f..8bc82bc103d431db81c3....fb81ea....e9")) {
        sVersion = "0.5c02";
        bDetected = true;
    } else if (MSDOS.compareEP("6033f131c731f78bd9be....d1cf31c1c7c3....d1c3fd8bf8fb33c7bf....d1c7")) {
        sVersion = "0.5c04";
        bDetected = true;
    } else if (MSDOS.compareEP("60be....c7c5....c7c3....c7c2....81f2....2e319a....33d62e8bba....31ef")) {
        sVersion = "0.5s";
        bDetected = true;
    } else if (MSDOS.compareEP("6031fbce29f6c7c7....d1c333dfe8....76..c8......e8")) {
        sVersion = "0.6";
        bDetected = true;
    } else if (MSDOS.compareEP("60fdd1c3f533ebc7c3....87d389d79705....7c..e9")) {
        sVersion = "0.61+";
        bDetected = true;
    } else if (MSDOS.compareEP("6072..fbe9$$$$03cee9$$$$b9....d1c981f1....8bd9d1cf")) {
        sVersion = "0.61+";
        bDetected = true;
    } else if (MSDOS.compareEP("6089f731fffbb8....03e9c7c1....47f9fceb")) {
        sVersion = "0.62";
        bDetected = true;
    } else if (MSDOS.compareEP("60be....c7c3....2e3198....81c3....81c6....8bfe01df75..e9")) {
        sVersion = "0.62";
        bDetected = true;
    } else if (MSDOS.compareEP("60fff08fc2f9bf....fb31da8bf42bdef5f971..03f0c7c3....87dd")) {
        sVersion = "0.63";
        bDetected = true;
    } else if (MSDOS.compareEP("60c7c6....b8....bf....bb....2e81b1........81f6....81c3....81c7....05....75..543e51")) {
        sVersion = "0.63";
        bDetected = true;
    } else if (MSDOS.compareEP("60fc81f3....f5be....fde9$$$$2be84a8bd129d9")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (MSDOS.compareEP("6033d9c7c1....7c..c7c6....75..76..bd....2bcd31c2")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (MSDOS.compareEP("60c7c5....c7c6....bf....31f62e31ab")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (MSDOS.compareEP("60c7c7....c7c3....c7c5....2e31ab....2e31bb....81c5")) {
        sVersion = "0.5";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_GA-Header.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "GA-Header");

function detect() {
    if (MSDOS.compareEP("8cd02ea3....2e8926....8cc88ed0bc....061e0e1fbe....b8....8ec0bf....b9")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_GOAT.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "GOAT");

function detect() {
    sOptions = "1996 by Martin Overton //ChekWARE";
    if (MSDOS.compareEP("5051568bc033c0904149813c....75..83f9..75..0bc033c058595eb8")) {
        bDetected = true;
    } else if (MSDOS.compareEP("515056528bc233d2f7e04149813c....75..3d....73..0bc933d259585e5ab8")) {
        bDetected = true;
    } else if (MSDOS.compareEP("1650525351564a33db74..434b813c....74..81f9....75..0bd2b8....8ed85e585a5b5917b8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_HACKSTOP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "HackStop");

function detect() {
    if (MSDOS.compareEP("FABD....FFE56A49480C..E4..3F983F")) {
        sVersion = "1.00";
        bDetected = true;
    } else if (MSDOS.compareEP("B430CD2186E03D....73..B42FCD21B0..B44CCD2150B8....58EB")) {
        sVersion = "1.10/1.11";
        bDetected = true;
    } else if (MSDOS.compareEP("B430CD2186E03D000373..B42FCD21B42ACD21B42CCD21B0FFB44CCD2150B8....58EB")) {
        sVersion = "1.10p1";
        bDetected = true;
    } else if (MSDOS.compareEP("B430CD2186E03D....73..B4..CD21B0..B44CCD2153BB....5BEB")) {
        sVersion = "1.11c";
        bDetected = true;
    } else if (MSDOS.compareEP("B430CD2186E03D....73..B0..B4..CD2150B8....58EB$$EB$$b8....CD2150B2..B8....CD21")) {
        sVersion = "1.00";
        bDetected = true;
    } else if (MSDOS.compareEP("521eb430cd2186e03d....73..cd200e1fb4..e8")) {
        sVersion = "1.11f-1.12s";
        bDetected = true;
    } else if (MSDOS.compareEP("FABD....D4854E32EBEB")) {
        sVersion = "1.13";
        bDetected = true;
    } else if (MSDOS.compareEP("fabd....ffe5")) {
        sVersion = "1.13cs";
        sOptions = "converted to exe";
        bDetected = true;
    } else if (MSDOS.compareEP("52B8....1ECD2186E03D....73..CD200E1FB409E8....24..EA")) {
        sVersion = "1.13";
        bDetected = true;
    } else if (MSDOS.compareEP("FABE....050C00071D4A461E16FDAC44........F16D84D33D....CFAFFB34DB33..........D0D6....92B4249E")) {
        sVersion = "1.17";
        bDetected = true;
    } else if (MSDOS.compareEP("52BA....5AEB..9A........30CD21......FD02....CD200E1F52BA....5AEB")) {
        sVersion = "1.18";
        bDetected = true;
    } else if (MSDOS.compareEP("52BA....5AEB..9A........30CD21......D602....CD200E1F52BA....5AEB")) {
        sVersion = "1.19s";
        bDetected = true;
    } else if (MSDOS.compareEP("52B430CD2152FA..FB3D....EB..CD200E1FB409E8")) {
        sVersion = "1.11f";
        sOptions = "modified";
        bDetected = true;
    } else if (MSDOS.compareEP("53bb....5beb$$eb$$9c1e52b430cd2186c43d....73..cd200e1f53bb....5beb")) {
        sVersion = "1.20";
        bDetected = true;
    } else if (MSDOS.compareEP("1e52B8....cd2186c43d....73..cd2052ba....5aeb")) {
        sVersion = "1.18s";
        bDetected = true;
    } else if (MSDOS.compareEP("5d1eb430cd2186e03d....73..cd200e1fb409e8")) {
        sVersion = "1.11gs";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$3adb74..b8014ccd21eb..b430cd21fa8bec8b46..05....ffe0")) {
        sVersion = "1.17 regged";
        bDetected = true;
    } else if (MSDOS.compareEP("521ee9$$$$0e1fb409e8$$$$5acd211f5a53bb....5beb$$eb$$e8$$$$e8$$$$52ba....5aeb")) {
        sVersion = "1.11f";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....521ecd2186e03d....73..cd200e1fb4..e8$$$$5acd211f5a53bb....5beb")) {
        sVersion = "1.12cs";
        bDetected = true;
    } else if (MSDOS.compareEP("50b8....58eb$$eb$$9c1e52b430cd2186c43d....73..cd200e1f50")) {
        sVersion = "1.19/386";
        bDetected = true;
    } else if (MSDOS.compareEP("9c5751e8$$$$e8$$$$5fb9....b8....2e87052e3185....47d1c8e2")) {
        sVersion = "1.20/386";
        bDetected = true;
    } else if (MSDOS.compareEP("b430cd2186e03d....73..b0..b44ccd2150b8....58eb")) {
        sVersion = "0.97.6-0.99b";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_HASP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "HASP Key Envelope");

function detect() {
    if (MSDOS.compareEP("e9$$$$e800005d81ed....2ea3....8cd82ea3....05....2ea3....2e0306....2ea3....2e833e......75..e8")) {
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e800005d81ed....2ea3....8cd82ea3....83c0..2ea3....2e0306....2ea3....2e833e......75..e8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_HEALTH.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "HEALTH");

function detect() {
    if (MSDOS.compareEP("1EE8....2E8C06....2E893E....8BD7B8....CD218BD80E1FE8....0657A1....26")) {
        sVersion = "5.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_HaSPeX-Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "HaSPeX-Protect");

function detect() {
    if (MSDOS.compareEP("fa8cc88ed88cd38bd48ed0bc....b9....8bf44444fdad35....50eb")) {
        sOptions = "1996";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Hardlock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Hardlock");

function detect() {
    if (MSDOS.compareEP("2ec6........be....bf....b9....2ea1....d1e92e8b1d2e31052e030402e12bc6d0c403c34683ef")) {
        sOptions = "dongle envelope by Aladdin";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Inertia.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Inertia encryption");

function detect() {
    if (MSDOS.compareEP("505351525657551e060eb8....500e5805....5031c050cb")) {
        bDetected = true;
    } else if (MSDOS.compareEP("505351525657551e8cc88ed8be....8cc3011e....8cc92bcb83e9..33db8cc005....8ed8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Int01-Destroyer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Int01-Destroyer");

function detect() {
    if (MSDOS.compareEP("fc33d28ec2bf....abab8cca33ff81ea....52ba....521e0733d2cb")) {
        sOptions = "1994";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Ironthorn.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Ironthorn");

function detect() {
    if (MSDOS.compareEP("9ce80000581e5704..bf....5feb$$ffd0")) {
        sVersion = "1.0:2000";
        sOptions = "modified HackStop 1.19 by ReDragon";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_JAM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "JAM");

function detect() {
    if (MSDOS.compareEP("50061607BE....8BFEB9....FDFAF32EA5FB06BD....55CB")) {
        sVersion = "2.21";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_JmCryptExe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "JmCryptExe");

function detect() {
    if (MSDOS.compareEP("e9$$$$e9$$$$1e068cd805....8ed88ec02e0106....2e0106....8be82ea1....2e8b0e")) {
        sVersion = "0.7i";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e9$$$$2e8c1e....e8$$$$530633db8ec3bb....268e47..bb....26813f....74..e9")) {
        sVersion = "0.7";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$2e8c1e....8cc88ed806a1....8ec08b1e....b4..cd210773..e9")) {
        sVersion = "0.7?";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Joke.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Joke fileheader");

function detect() {
    if (MSDOS.compareEP("bb....e8....bd....2863..53454ee8....9893928a80....52cb")) {
        sOptions = "by SEN";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_KeyMaker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "KeyMaker");

function detect() {
    if (MSDOS.compareEP("fc0e1f8706....871e....870e....8716....8736....873e....872e....268b07a3....8cc0a3....8cc88ec08edaf3a5")) {
        sVersion = "3.0";
        sOptions = "1998 by TIME Software";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Kvetch.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Kvetch");

function detect() {
    if (MSDOS.compareEP("bb....ba....0e1f068cd005....8ec00efc8bcbd1e133ffd1e18bf7d1e1f3a5b8....0650cb")) {
        sVersion = "1.X";
        sOptions = "1992 by Tal Nevo";
        bDetected = true;
    } else if (MSDOS.compareEP("ba....bb....060e0e1f8cd005....8ec08bcbd1e1d1e1d1e133ff8bf7fcf3a506b8....50cb")) {
        sVersion = "1.02c";
        sOptions = "1992 by Tal Nevo";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_LOCK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "LOCK");

function detect() {
    if (MSDOS.compareEP("b430cd21faba....2e8006......80ea..2e8816....e8$$$$2ec606......fbbf....b9....0e072e8a0534..aae2")) {
        sVersion = "1.1";
        sOptions = "by Psycho //ENiAC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_LOCK91.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "LOCK91");

function detect() {
    if (MSDOS.compareEP("eb$$8cc88ed88ec08cd8a3....a1....2906....e421500c..24..e621e8")) {
        sOptions = "dongle envelope";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_LamerStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "LamerStop");

function detect() {
    if (MSDOS.compareEP("E8....05....CD2133C08EC026......2E......26......2E......BA....FA")) {
        sVersion = "1.0c";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_LockTite+.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "LockTite+");

function detect() {
    if (MSDOS.compareEP("8cc88ed88cc381c3....8bc30306....8ec08b0e....8bf14e8bfefdf3a450b8....50cb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_MEGALITE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "MEGALITE");

function detect() {
    if (MSDOS.compareEP("B8....BA....05....3B2D73..72..B409BA....CD21CD90")) {
        sVersion = "1.20a";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_MESS.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "MESS");

function detect() {
    if (MSDOS.compareEP("....................B9....F3..ACE3..EB..BA....B409CD21CD20..............................B430CD213C0277")) {
        sVersion = "1.07";
        bDetected = true;
    } else if (MSDOS.compareEP("........FAB9....F326ACE3..EB$$1E0E1FBA....81EA....B409CD211FB44CCD21")) {
        sVersion = "1.20";
        bDetected = true;
    } else if (MSDOS.compareEP("........FA545b3bdc75..eb$$9c5b81cb....5381e3....75..9d9c5825....75..1e0e1f")) {
        sVersion = "1.29";
        bDetected = true;
    } else if (MSDOS.compareEP("........FAb9....f326ace3..eb$$1e0e1fba....b409cd211fb44ccd21")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (MSDOS.compareEP("'MESS'b9....83c4..f326ace3..eb$$ba....b409cd21cd20")) {
        sVersion = "1.07";
        bDetected = true;
    } else if (MSDOS.compareEP("'MESS'fa545b3bdc75..eb$$9c5b81cb....539d9c5825....75..1e0e1fba....b409cd211f")) {
        sVersion = "1.25";
        bDetected = true;
    } else if (MSDOS.compareEP("'MESS'b9....83c4..f326ace3..eb")) {
        sVersion = "1.14";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Maker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Maker (CDAT)");

function detect() {
    if (MSDOS.compareEP("eb$$558bec9ceb$$505351525657061eb8....cd210653eb$$b8....cd2106531e1e0e1f8ccab1..eb")) {
        sVersion = "3.0";
        sOptions = "1992 by PST";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Mandrake.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Mandrake");

function detect() {
    if (MSDOS.compareEP("b8....8ed8b8....8ec0e8$$$$bb....b9....b8....2bc1568bf0268a3488305ee2..b4..b7..cd10")) {
        sOptions = "by H.P.G. Soft";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_MutaWWP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MutaWWP");

function detect() {
    if (MSDOS.compareEP("e8$$$$5e8bd683ea..83c6..060e1e0e1f33ff8cd383eb..8ec3b9....f3a45805....500e5333c951cb")) {
        sVersion = "1.0";
        sOptions = "by Stefan Esser";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Mutate.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Mutate");

function detect() {
    if (MSDOS.compareEP("e8$$$$58e9$$$$2ec606......eb$$1eeb$$50eb$$33c0f872..eb")) {
        sVersion = "1.1 (16,20.05.1996)";
        sOptions = "1996 by PReDaToR 666";
        bDetected = true;
    } else if (MSDOS.compareEP("33c0eb$$83e8..e9$$$$2e802e......eb$$1eeb$$50eb$$33c0f872..eb")) {
        sVersion = "1.1 (18.05.1996)";
        sOptions = "1996 by PReDaToR 666";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$f8e9$$$$2e8006......eb$$1eeb$$50e9$$$$33c0f873..e9")) {
        sVersion = "1.1 (20.05.1996)";
        sOptions = "1996 by PReDaToR 666";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_NOCLIP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "NOCLIP");

function detect() {
    if (MSDOS.compareEP("e9$$$$ff26....9c5053518cd8a3")) {
        sVersion = "4.X";
        sOptions = "by TD Technologia Digital";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_NOTA.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "NOTA");

function detect() {
    if (MSDOS.compareEP("eb$$061e33c08ed8be....0e07bf....b9....fcf3a41f8cd3be....8bd48ed6bc....8bf436c744......36c744......8ed38be2ba....e8")) {
        sVersion = "1.1";
        sOptions = "1990 by Novitex";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_NTShell.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "NTShell");

function detect() {
    if (MSDOS.compareEP("2e8c1e....8cca8eda8ec2fa8ed2bc....fbe80000eb$$b9....5e8bfeeb")) {
        sVersion = "4.0";
        sOptions = "by Mr. ZhouHui";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c06....8cc88ed8fa8ed0bc....fbff36....268b1e....8ec333ffb9")) {
        sVersion = "2.01";
        sOptions = "by Mr. ZhouHui";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Nodebug.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Nodebug");

function detect() {
    if (MSDOS.compareEP("fcbe....b9....31d22ead01c2e2")) {
        sVersion = "1.0 part 2";
        sOptions = "by JVP";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Novex.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Novex Key Envelope");

function detect() {
    if (MSDOS.compareEP("0e1f06b8....bb....0e07cd012ea1....263947..070675..2ec606......eb..06f8b8....cd212e891e....2e8c06....b8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Overlay.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Overlay");

function detect() {
    if (MSDOS.compareEP("fa8cc283c2..2e0116....8cc82bc22e8b0e....8bea8bf8be....8bc103c903c881c1....03c18ad983e3..2e0387")) {
        sVersion = "3.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_PACKWIN.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PACKWIN");

function detect() {
    if (MSDOS.compareEP("8cc0fa8ed0bc....fb060e1f2e8b0e....8bf14e8bfe8cdb2e031e....8ec3fdf3a453b8....50cb")) {
        sVersion = "1.0";
        sOptions = "by Yellow Rose";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_PC-Guard.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PC-Guard");

function detect() {
    if (MSDOS.compareEP("b8....fcfdb9....be....f82e180cf5fcfc74..fccc")) {
        sVersion = "3.05 PRO";
        sOptions = "1994/97 by Ceklic Blagoje //COMSEC";
        bDetected = true;
    } else if (MSDOS.compareEP("2bdb81cb....f8fdbf....2bd281ca....f52e291dfcf7d3fdfccc")) {
        sVersion = "3.05";
        sOptions = "1994/97 by Ceklic Blagoje //COMSEC";
        bDetected = true;
    } else if (MSDOS.compareEP("bb....f5b9....fcfdbe....fdfc2e190cfcfdf8f7d9d1d9f8f8")) {
        sVersion = "3.XX";
        sOptions = "by Ceklic Blagoje //COMSEC";
        bDetected = true;
    } else if (MSDOS.compareEP("be....fcb9....fdf5f5ba....fc2e102cf8d1d1d1c9f7d9")) {
        sVersion = "3.XX";
        sOptions = "by Ceklic Blagoje //COMSEC";
        bDetected = true;
    } else if (MSDOS.compareEP("33db81c3....f8fdbe....f8f5fcba....f52e111cfcfd72")) {
        sVersion = "3.XX";
        sOptions = "by Ceklic Blagoje //COMSEC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_PCOM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PCOM");

function detect() {
    if (MSDOS.compareEP("be....b9....2e8a0434..2e880446e2")) {
        sVersion = "2.8b2, 2.8b3 -e -i";
        sOptions = "1999";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_PROTECT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PROTECT! EXE");

includeScript("read");

function detect() {

    var bEnableNewEngine = true; // Need more researches

    if (bEnableNewEngine) {
        var a1 = [0xFD, 0x1E, 0x0E, 0x0E, 0x07, 0x1F], a2 = [0xFD, 0x1E, 0x0E, 0x07, 0x0E, 0x1F],
            a3 = [0xFC, 0x1E, 0x0E, 0x1F, 0x0E, 0x07], a4 = [0xFC, 0x1E, 0x0E, 0x0E, 0x1F, 0x07],
            a5 = [0x1E, 0xFD, 0x0E, 0x07, 0x0E, 0x1F], a6 = [0x1E, 0xFD, 0x0E, 0x0E, 0x07, 0x1F],
            a7 = [0x1E, 0xFC, 0x0E, 0x1F, 0x0E, 0x07], a8 = [0x1E, 0xFC, 0x0E, 0x0E, 0x1F, 0x07],
            bt = [0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
            cnt_arr = 0,
            ep = MSDOS.OffsetToVA(MSDOS.getEntryPointOffset()),
            count = 0;
        while (count < 0x50) {
            count++;
            var byte = MSDOS.readByte(MSDOS.VAToOffset(ep));
            if (byte == 0xFD || byte == 0x1E || byte == 0x0E || byte == 0x07 || byte == 0x1F || byte == 0xFC) {
                bt[cnt_arr] = byte; cnt_arr++;
            }
            if (cnt_arr == 6) { break; }
            ep = MSDOS.getDisasmNextAddress(ep);
        }
        if (compareArrays(a1, bt) || compareArrays(a2, bt) || compareArrays(a3, bt) ||
            compareArrays(a4, bt) || compareArrays(a5, bt) || compareArrays(a6, bt) ||
            compareArrays(a7, bt) || compareArrays(a8, bt)) { sVersion = "5.5"; bDetected = true; }
    }

    if (MSDOS.compareEP("1e0e0e1f07") || MSDOS.compareEP("1e0e0e071f") || MSDOS.compareEP("1e0e1f0e07")) {
        var b = MSDOS.readByte(MSDOS.getEntryPointOffset() + 5);
        if (b == 0xBA || b == 0xBB || b == 0xBD || b == 0xBE || b == 0xBF || b == 0xE8) {
            sVersion = "5.0"; sOptions = "type 1";
            bDetected = true;
        }
    } else if (MSDOS.compareEP("5053515657061e0e1f")) {
        sVersion = "5.0"; sOptions = "type 2";
        bDetected = true;
    } else if (MSDOS.compareEP("0e071e0e1f")) {
        var b = MSDOS.readByte(MSDOS.getEntryPointOffset() + 5);
        if (b == 0xBA || b == 0xBB || b == 0xBD || b == 0xBE || b == 0xBF) {
            sVersion = "4.1";
            bDetected = true;
        }
    } else if (MSDOS.compareEP("8cdb0e0e1f07b9....e800005e81c6....89f7ac34..aae2")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ed8fafcbe....0e07")) {
        sVersion = "3.1";
        bDetected = true;
    } else if (MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ec0fafc26a1....2ea3....26a1")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$1e068cc88ed88ec0be....8bfeb9....ac")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$1e068cc88ed88ec02ec606")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd805....50b8....501e068cda83c2..b9....be....0e1fad8bd8ad03c28ec0260117e2")) {
        sOptions = "relocpacker";
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("1eb430cd213c..73..cd20be....e8....e8")) {
        sVersion = "6.0";
        bDetected = true;
    }
    return result();
}

================================================
FILE: db/MSDOS/protector_PVAC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PVAC");

function detect() {
    if (MSDOS.compareEP("33c08ed806be....bf....b9....fcf3a5bf....b2..fa8926....bc....8bf42e8a0402c2a3....a3....8cdb")) {
        sVersion = "1.04";
        sOptions = "(1993) by Fernando Papa Budzyn"
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_PassEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PassEXE");

function detect() {
    if (MSDOS.compareEP("061E0E0E071FBE....B9....871481......EB..C7......840087......FB1F584A")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_Pksmart.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Pksmart");

function detect() {
    if (MSDOS.compareEP("ba....8cc88bc803c281c1....51b9....511e8cd38d6f..55b1..51fc4bbe....33ff8ed88ec3b1..f3a5484a79..0e078edb33f633ffcb")) {
        sVersion = "1.0b";
        sOptions = "by Alex";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ProtEXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ProtEXE");

function detect() {

    // new algo

    var ep_off = MSDOS.getEntryPointOffset();
    var i = 0;

    while (i < 20) {
        i++;
        switch (MSDOS.readByte(ep_off)) {
            case 0xE9:
                {
                    var addr = MSDOS.readWord(ep_off + 1);
                    if (addr > 0x7fff) { ep_off = ep_off - (0xffff - addr) + 2 } else { ep_off = ep_off + addr + 3 }
                    break;
                }
            case 0xE8:
                {
                    var addr = MSDOS.readWord(ep_off + 1);
                    if (addr > 0x7fff) { ep_off = ep_off - (0xffff - addr) + 2 } else { ep_off = ep_off + addr + 3 }
                    break;
                }
            case 0xEB:
                {
                    var addr = MSDOS.readByte(ep_off + 1);
                    if (addr > 0x7f) { ep_off = ep_off - (0xff - addr) + 1 } else { ep_off = ep_off + addr + 2 }
                    break;
                }
        }
        var a = MSDOS.readByte(ep_off);
        if ((a == 0xbb || a == 0xbe || a == 0xbf) && MSDOS.compare("0600", ep_off + 1)) {
            sVersion = "3.10-3.11";
            bDetected = true;
            break;
        }
        if (a != 0xbb && a != 0xbe && a != 0xbf && a != 0xe9 && a != 0xe8 && a != 0xeb) {
            break;
        }
    }

    // some old sigs

    if (MSDOS.compareEP("9c9c5825....509d9c5825....3d....74..9c5825....0d....509d9c5825....74..ba....b0..eb")) {
        sVersion = "2.11";
        bDetected = true;
    } else if (MSDOS.compareEP("9c505351525657551e06fcb8....cd2184c075..cd20a8..04..eb$$eb$$ba....ec0c..eb")) {
        sVersion = "3.0";
        sOptions = "by T.Torfs";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Protector");

function detect() {
    if (MSDOS.compareEP("'FCP/IV'bc....c3", -6)) {
        sOptions = "by FCP/IV (Future Crew)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Quadru-Lock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Quadru-Lock");

function detect() {
    if (MSDOS.compareEP("9c508cda5252bb....8cc8488ed805....8ec0b9....8bf12bf38bfefdf3a44050ffd1")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_R-Crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "R-Crypt");

function detect() {
    if (MSDOS.compareEP("e9$$$$68....60bf....b9....b0..2e3005fec047e2..61c706........c606")) {
        sVersion = "0.91, 0.93";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_REC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "REC");

function detect() {
    if (MSDOS.compareEP("061eb430cd213c..73..33c00650cbbf....8b36....2bf781fe....eb$$52ba....5aeb")) {
        sVersion = "0.33-0.35";
        bDetected = true;
    } else if (MSDOS.compareEP("061e52b8....1ecd2186e03d....73..cd200e1fb4..e8$$$$5acd21")) {
        sVersion = "0.24-0.32";
        bDetected = true;
    } else if (MSDOS.compareEP("061eb430cd213c..73..33c00650cb")) {
        sVersion = "0.40c2";
        bDetected = true;
    } else if (MSDOS.compareEP("061e53bb....5beb$$eb$$eb$$2ec606")) {
        sVersion = "0.40.5, 0.40.6";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_RHC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "RHC");

function detect() {
    if (MSDOS.compareEP("8cd8ba....8eda8ec2a3....b8....cd10b8....8ec0be....bb....b9....518bfbb9....b4..acabe2")) {
        sVersion = "1.99.test";
        sOptions = "1999 by Rowdy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_ROSETINY.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "RoseTiny");

function detect() {
    if (MSDOS.compareEP("e8$$$$53bb....5beb$$eb$$582d....50061e5751e8$$$$e8$$$$5fb9....b8....2e87052e3145..47d1c8e2")) {
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$5053b430cd2186e03d....73..cd2006502bc08ec08506....b8....eb")) {
        sVersion = "0.95";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_SSI-Lock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SSI-Lock");

function detect() {
    if (MSDOS.compareEP("1e0e1fba....b4..cd211f2bc00650cb")) {
        sVersion = "3.0 (overlay)";
        sOptions = "1991, 1992 by Software Security, Inc.";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c06....2e8c1e....0e1f8c06....892e....893e....8936....8916....890e....891e....a3....9c5825....a3....fb0e1f")) {
        sVersion = "3.0";
        sOptions = "1991, 1992 by Software Security, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Secure.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Secure");

function detect() {
    if (MSDOS.compareEP("8CC805....50B8....50B0..068CD20683....50B0..52FC508CD28CCDBB....03EB4A8EDD8EC24DB9....33FFBE....AD35....ABE2")) {
        sVersion = "2.1b";
        bDetected = true;
    } else if (MSDOS.compareEP("8CC805....50B8....50CB")) {
        sVersion = "2.1b";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$fa4c904c81f3....56be....5eeb$$eb$$81f3....444490fb5bf7c2....eb$$53b9....eb")) {
        sVersion = "0.29";
        bDetected = true;
    } else if (MSDOS.compareEP("e8")) {
        var offset = MSDOS.readWord(MSDOS.getEntryPointOffset() + 1) + MSDOS.getEntryPointOffset() + 3;
        if (MSDOS.findSignature(offset, MSDOS.getSize() - offset, "2e8037..43e2f9") != -1) {
            sVersion = "0.19";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_SelfChk.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SelfChk");

function detect() {
    if (MSDOS.compareEP("1e1eb430cd21b44c3c..73..cd21be....e8....e8....b8....1f07e9....0e0e1f07fcc3")) {
        sVersion = "1.21";
        sOptions = "1999 by Tsahi Chitin";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Shrink.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Shrink");

function detect() {
    if (MSDOS.compareEP("509CFCBE....BF....57B9....F3A48B......BE....BF....F3A4C3")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("E9....509CFCBE....8BFE8CC805....8EC00657B9")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_SnoopStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SnoopStop");

function detect() {
    if (MSDOS.compareEP("..E9....EB..20......73..20....411A05")) {
        sVersion = "1.15";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_SuckStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SuckStop");

function detect() {
    if (MSDOS.compareEP("EB......BE....B430CD21EB..9B")) {
        sVersion = "1.11";
        bDetected = true;
    } else if (MSDOS.compareEP("'KAOT'58eb$$be....b430cd21eb$$3c..77..cd204e75..6a..0e6a..fec3cf")) {
        sVersion = "1.11r";
        sOptions = "1997 by KA0T //N0Ps";
        bDetected = true;
    } else if (MSDOS.compareEP("'KAOT'5ceb$$be....b430cd21eb$$3c..77..cd204e75..c706........1e6a..0fa1")) {
        sVersion = "1.10r";
        sOptions = "1997 by KA0T //N0Ps";
        bDetected = true;
    } else if (MSDOS.compareEP("'KAOT'5ceb$$be....b430cd21eb$$3c..77..cd204e75..6a..0e6a..fec3cf")) {
        sOptions = "1997 by KA0T //N0Ps";
        bDetected = true;
    } else if (MSDOS.compareEP("3a324a1d....fb37fb1d....1d....be....81ee....6a..593a32")) {
        sVersion = "1.0";
        sOptions = "1997 by KA0T //N0Ps";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_TCEC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "TCEC");

function detect() {
    if (MSDOS.compareEP("e4640c..e66466fae800005d81ed....b8....8bd48da6....b9....8bdc2ec00f..2e30072e000f44e2")) {
        sVersion = "3.59r5";
        sOptions = "by ThE CLERiC! //LZ0, EVD";
        bDetected = true;
    } else if (MSDOS.compareEP("54434543b9....83c4..33c0509df326ace3..eb")) {
        sVersion = "3.55";
        sOptions = "by ThE CLERiC! //LZ0, EVD";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_TraceLock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "TraceLock");

function detect() {
    if (MSDOS.compareEP("1e06e8$$$$0e0e1f07b4..b9....be....8bfefcac32c4d2c802e1aae2..b8....35....8706....c3")) {
        sVersion = "0.9";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Trap.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Trap");

function detect() {
    if (MSDOS.compareEP("e800005b83c3..908bd3e8$$$$5b2e803f..74..90908bdab9....eb")) {
        sVersion = "1.21";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd0bb....8ed333c98ed0b9....eb$$e2..33d2")) {
        sVersion = "1.18";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd0bb....8ed333d28ed0b9....eb$$e2..33d2")) {
        sVersion = "1.X";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("b9....eb$$e2$$eb..90cd20e2")) {
        sVersion = "1.15";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("e800005b83c3..908bd3e8$$$$5b2e803f..74..90908bdab9....2ec0")) {
        sVersion = "1.20";
        sOptions = "1998 by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("05....eb$$bb....81ebfa..85f9eb$$eb$$39fbeb")) {
        sVersion = "1.22";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("81ea....eb$$b9....81c1....39d0bb....85c3b9....f505....bb....ba....81c2")) {
        sVersion = "1.23";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$39c281c3....eb$$81c3....39cc81ea....39e2b9....85da39e9eb")) {
        sVersion = "1.24";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd1ba....8ed233d28ed18bcaeb")) {
        sVersion = "1.13";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$5d81ed....458cd68bfc0f23c70f23ceb0..e6..fa0e17")) {
        sVersion = "1.26b1";
        sOptions = "2000 by Christoph Gabler";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd1ba....8ed233d28ed18bcab9....eb")) {
        sVersion = "1.14";
        sOptions = "by Christoph Gabler";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_Un2pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Un2pack");

function detect() {
    if (MSDOS.compareEP("9cba....2d....81e1....81f3....b4..9db8....ba....8cdb03d83b1e....73..83eb..fa8ed3bc")) {
        sVersion = "2.0";
        sOptions = "1994 by The CCS-Productions";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_UnPackStop.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "UnPackStop");

function detect() {
    if (MSDOS.compareEP("3670..b8....81c0....bb....43e8....5f83c7..0e570656cbbe....eb")) {
        sVersion = "0.9X";
        sOptions = "by Szaszi (Szabo Laszlo)";
        bDetected = true;
    } else if (MSDOS.compareEP("68....c3")) {
        var nOffset = MSDOS.readWord(MSDOS.getEntryPointOffset() + 1) - 32;
        if (MSDOS.compare("bf....e2..a541b9....2e31154747e2", nOffset)) {
            sVersion = "0.95";
            sOptions = "by Szaszi (Szabo Laszlo)";
            bDetected = true;
        } else if (MSDOS.compare("b9....39fe2e31154747eb", nOffset)) {
            sVersion = "0.95 freeware";
            sOptions = "by Szaszi (Szabo Laszlo)";
            bDetected = true;
        }
    } else if (MSDOS.compareEP("4e46555dbb....70..b8....81c0....4c44cd213efc268b2e....8ec5")) {
        sVersion = "0.94";
        sOptions = "by Szaszi (Szabo Laszlo)";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....40bb....4be8$$$$be....eb$$5f83c7..0e570656cb")) {
        sVersion = "0.94";
        sOptions = "by Szaszi (Szabo Laszlo)";
        bDetected = true;
    } else if (MSDOS.compareEP("424a5159bb....4bb8....404a42cd2190fc")) {
        sVersion = "0.96";
        sOptions = "by Szaszi (Szabo Laszlo)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_XDOC.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XDOC");

function detect() {
    if (MSDOS.compareEP("2e8c16....eb00ea....ffff")) {
        sVersion = "1.20";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_aPatch.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "aPatch");

function detect() {
    if (MSDOS.compareEP("e8$$$$fde8$$$$ffc75e83ee..e8$$$$5d8176......c646....eb$$ffe5")) {
        sVersion = "0.05-0.33";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_cramble.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "cramble");

function detect() {
    if (MSDOS.compareEP("E9....609CFC..................01..012A..FF")) {
        sVersion = "0.2b3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/protector_iLUCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "iLUCRYPT");

function detect() {
    if (MSDOS.compareEP("8becfac746......4c4cc3fbbf....b8....2e3105d1c84f")) {
        sVersion = "4.01X";
        sOptions = "by Christian Schwarz";
        bDetected = true;
    } else if (MSDOS.compareEP("bf....b8....2e3105d1c84f81ff....73..b7..df53..961e")) {
        sVersion = "4.017";
        sOptions = "by Christian Schwarz";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/protector_nbuild.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "nbuild");

function detect() {
    if (MSDOS.compareEP("B9....BB....C0....80....43E2")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/runtime_VROOMM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

meta("runtime", "VROOMM (Virtual Real-time Object-Oriented Memory)");

function detect() {
    if (MSDOS.compareOverlay("46424f56")) { // FBOV
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_ANS2ALL.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "ANS2ALL");

function detect() {
    if (MSDOS.compareEP("eb$$be....bf....b9....8ccd81ed....8bdd83eb..8bd3fcfa909090909090")) {
        sVersion = "0.9beta";
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_GIFEXE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "GIFEXE");

function detect() {
    if (MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06") &&
        MSDOS.compareOverlay("'GIF87a'") &&
        MSDOS.isSignaturePresent(MSDOS.getSize()-6, 6, "'GIFEXE'")) {
            sVersion = "1.0";
            sOptions = "1990, 1991 by Steve Enns and Dan Magosse";
            bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_RELETTER.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "RELETTER");

function detect() {
    if (MSDOS.compareEP("e9$$$$bc....bf....bb....8a0784c075..e9....438a073c..74..3c..74..89da438a073c..74")) {
        sVersion = "1.0";
        sOptions = "1993 by Hans J. Baer (converted to exe)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_SimplyWare.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "");

function detect() {
    if (MSDOS.compareEP("b8....8ed88c06....fa8ed0bc....fbb430cd21a3....0650b434cd218c06....8bc3485b86df81fb")) {
        var nOffset = MSDOS.getOverlayOffset();
        if (MSDOS.findSignature(nOffset - 0x1000, 0x1000, "'Simply Docs Viewer'") != -1) {
            sName = "Simply Docs Viewer";
            sVersion = "3.0";
            sOptions = "1990-94 by SimpleWare";
            bDetected = true;
        } else if (MSDOS.compareOverlay("'Simply Help!'")) {
            sName = "Simply Help! TSR Viewer"
            sOptions = "1990-94 by SimpleWare";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_TXT2COM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "TXT2COM + generic com2exe");

function detect() {
    if (MSDOS.compareEP("e8$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7")) {
        sVersion = "1.1";
        sOptions = "1987 by Keith P. Graham";
        bDetected = true;
    } else if (MSDOS.compareEP("8d26....e8$$$$b4..cd103c..74..c706........c706........3c..74..3c..74..8d16....b409cd21cd20c706")) {
        sVersion = "2.06";
        sOptions = "1989 by Keith P. Graham";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_TXTmaker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "TXTmaker");

function detect() {
    if (MSDOS.compareEP("eb$$b4..33dbcd1080fc..74..b0..eb$$b44ccd21")) {
        sVersion = "1.22";
        sOptions = "1991 by Jack A. Orman";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_Txt2Exe.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "Txt2Exe");

function detect() {
    if (MSDOS.compareEP("8cc88ed88cc08ed0bc....b4..cd10a2....3c..74..268a1e....0e07")) {
        sVersion = "4.01";
        sOptions = "1996 by Wang Lisan";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/self-displayer_self-displayer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("self-displayer", "Unknown");

function detect() {
    if (MSDOS.compareEP("b8....cd10b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb")) {
        sOptions = "1997 //d4c";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_ARC.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "ARC SFX");

function detect() {
    if (MSDOS.compareEP("8CC88CDB8ED88EC089......2BC3A3....89......BE....B9....BF....BA....FCAC32C28AD8")) {
        sVersion = "1.10";
        sOptions = "1986-89 by Wayne Chin and Vernon D. Buerg";
        bDetected = true;
    } else if (MSDOS.compareEP("558bec83ec..32c02ea2....2ea2....2ea2....8cd78ec78d7e..be....fcac3c..74..3c..76..3c..75..ac")) {
        sOptions = "1988-89 by NoGate Consulting";
        bDetected = true;
    } else if (MSDOS.compareEP("558bec83ec..a1....2ea3....2ec606......8cd78ec78d7e..be....fcac3c..74..3c..76..3c..75..ac")) {
        sOptions = "1988-89 by NoGate Consulting";
        bDetected = true;
    } else if (MSDOS.compareEP("bb....8edb8c06....c706........8cd02bc3b9....d3e003c4fa8ed38be0fb05....b9....d3e8408cd303c3a3")) {
        sVersion = "7.1";
        sOptions = "1990 by System Enhancement Associates (SEA), Inc.";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/sfx_ARJ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "ARJ");

function detect() {
    if (MSDOS.compare("'RJSX'", 0x1c)) {
        sVersion = "old";
        bDetected = true;
    } else if (MSDOS.isSignaturePresent(0, Math.min(1000, MSDOS.getSize()), "'aRJsfX'")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/sfx_ChSFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "CHZ SFX (ChSFX)");

function getChSFXVersion() {
    var sResult = "";
    var nStringOffset = MSDOS.findString(0, Math.min(0x100, MSDOS.getSize()), "ChSFX");
    if (nStringOffset != -1) {
        sResult = MSDOS.getString(nStringOffset + 6);
        sResult = sResult.replace(/\s+$/, '');
    }

    return sResult;
}

function detect() {
    if (MSDOS.compareEP("ba....e8$$$$1e0e1fe8$$$$52568bf2fcb4..eb$$ac0ac075")) {
        sVersion = getChSFXVersion();
        bDetected = true;
    } else if (MSDOS.compareEP("8d16....e8$$$$1e0e1fe8$$$$52568bf2fcb4..eb$$ac0ac075")) {
        sVersion = getChSFXVersion();
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_EXARJ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "EXARJ small");

function detect() {
    if (MSDOS.compareEP("fcbb....e8....b430cd218bd8063c..72..8e06....33c08bf8b9....f2aeae75..40af061f8bd775..e8")) {
        sOptions = "1994 by Jakub Jelinek";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_ICE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "ICE SFX");

function detect() {
    if (MSDOS.compareEP("eb$$be....8bfe8b0e....8b16....b8....50fcad33c2ab8bd0e2")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_LH.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "LH");

function detect() {
    if (MSDOS.compare("'LH'27's SFX '", 0x24)) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/MSDOS/sfx_LHA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LHA SFX");

function detect() {
    if (MSDOS.compareEP("eb$$fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")) {
        sVersion = "2.05L, 2.10-2.13, 2.55";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$fcbc....8cc805....8ec0e8....bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8")) {
        sVersion = "2.13";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$00fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")) {
        sVersion = "2.13S";
        sOptions = "converted to exe";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$fcbc....8cc805....8ec0b8....cd21be....268816....26c706........ac")) {
        sVersion = "1.13L";
        sOptions = "converted to exe";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_LHarc.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LHarc SFX");

function detect() {
    if (MSDOS.compareEP("eb$$fcbc....bb....e8....8cc82e0306....8ed88ec005....2e3b06....76..bb....e9....bf....33d28bc2b9....d1e873..35....e2..abfec275..be....bf....b8....ba....2e3a24")) {
        sVersion = "1.13S, 1.13L";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$fcbc....bb....e8....8cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")) {
        sVersion = "1.14c";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$fcbc....e8....9090908cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")) {
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$0d....fcbc....bb....e8....8cc82e0306....8ed88ec005....2e3b06....76..bb....e9")) {
        sVersion = "1.14c";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_PKSFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "PKSFX");

function detect() {
    if (MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf0")) {
        if (MSDOS.compareOverlay("1a")) {
            sOptions = "ARC";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_PKZIP-SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "PKZIP-SFX");

function detect() {
    if (MSDOS.compareEP("fc2e8c......a1....8ccb81c3....3bc372..2d....2d....fabc....8ed0fb2d....a3....8ec0e8....a1")) {
        sVersion = "1.1(1989-90)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_PKZIP_mini-sfx.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "PKZIP mini-sfx");

function detect() {
    if (MSDOS.compareEP("b9....bf....2bcf32c0f3aab430cd21a3....8926....e8....b8....e8....e8")) {
        sVersion = "2.04c(1992)";
        bDetected = true;
    }
    if (MSDOS.compareEP("b8....a3....bf....b9....2bcf32c0f3aab430cd21a3....a1....a3....e8....b8")) {
        sVersion = "1.1(1990)";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "SFX");

function detect() {
    if (MSDOS.compareEP("fc1e8a1e....16070e1f33d2e8....bd....885e..8f46..bf....33d28bc2b9....d1e873..35....e2..abfec275..be....e8")) {
        sVersion = "3.33";
        sOptions = "(LHA archive) by LARC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/sfx_ZOO.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "ZOO SFX");

function detect() {
    if (MSDOS.compareEP("ba....2e8916....8b2e....8eda8c06....b8....8cda05....83c3..8ed28be0e8")) {
        if (MSDOS.compareOverlay("'ZOO'............'Archive'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/MSDOS/unknown_immunizer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("immunizer", "unknown immunizer");

function detect() {
    if (MSDOS.compareEP("be....e9$$$$501e06b8....cd21fc80fc..75..3c..75..b4..cd213c")) {
        sOptions = "type 1";
        bDetected = true;
    } else if (MSDOS.compareEP("be....8e06....8cdd31ff8bc7b9....f2aeae75..af061f")) {
        sOptions = "type 2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/MSDOS/virus.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("virus", "");

function detect() {
    if (MSDOS.compareEP("e8....5e83ee..b8....cd213d....75..0e1f81c6....bf....b9....fcf3a4061f06b8....50cb")) {
        sName = "TaiPan.438";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$9090be....8bfee8$$$$5081c7....b9....b8....902e31054790e2")) {
        sName = "Burglar.1150";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/_NE.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Windows");

function detect() {
    if (NE.isVerbose()) {
        sName = NE.getOperationSystemName();
        sVersion = NE.getOperationSystemVersion();
        sOptions = NE.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/NE/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = NE;
var X = NE;

================================================
FILE: db/NE/compiler_Borland_C++.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Borland C++");

function detect() {
    if (NE.compareEP("53510633c0509a........5807595b9a........0bc075..e9")) {
        sOptions = "1994 type 1";
        bDetected = true;
    } else if (NE.compareEP("893e....56571e510656e3..1e33c050519a........91e3")) {
        sOptions = "1994 type 2";
        bDetected = true;
    } else if (NE.compareEP("53510633c050e8....5807595b9a........0bc075..e9")) {
        sOptions = "1993 type 1";
        bDetected = true;
    } else if (NE.compareEP("b8....8ed853510633c0509a........5807595b9a........0bc075..e9")) {
        sOptions = "1993 type 2";
        bDetected = true;
    } else if (NE.compareEP("893e....56571e510656e3..1e33c05051900ee8....91e3")) {
        sOptions = "1991";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/compiler_Borland_Pascal.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Borland Pascal");

function detect() {
    if (NE.compareEP("9a........9a........9a........9a........9a........5589e56a..9a........ff36....bf....1e5768....9a")) {
        sVersion = "7.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/compiler_Watcom_C.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Watcom C");

function detect() {
    if (NE.compareEP("e9$$$$9a........0bc074..8c06....5756065352891e....8c06....2bc0509a")) {
        sOptions = "1991";
        bDetected = true;
    } else if (NE.compareEP("e9$$$$b9....51b9....51b9....51b9....5153508cd18bdc83c3..8cd2b8....ea")) {
        sOptions = "1991";
        bDetected = true;
    } else if (NE.compareEP("e9$$$$535152565706558becb9....51b9....51b9....51b9....5153508cd18bdc83c3..8cd2b8....9a")) {
        sOptions = "1991";
        bDetected = true;
    } else if (NE.compareEP("e9$$$$9a........0bc075..e9....8c06....575606535253be....8936....8c1e....268a078804")) {
        sOptions = "1993";
        bDetected = true;
    } else if (NE.compareEP("eb$$9a........09c075..e9....8c06....5756065352891e....8c06....29c0509a")) {
        sName = "Watcom C/C++16";
        sOptions = "1995";
        bDetected = true;
    } else if (NE.compareEP("eb$$5351525657065589e553508cd189e383c3..8cd23eb8....9a")) {
        sName = "Watcom C/C++16";
        sOptions = "1995";
        bDetected = true;
    } else if (NE.compareEP("e9$$$$535152565706558bec53508cd18bdc83c3..8cd2b8")) {
        sOptions = "1992";
        bDetected = true;
    } else if (NE.compareEP("eb$$535152565706558bec53508cd18bdc83c3..8cd2b8")) {
        sName = "Open Watcom C/C++16 for OS/2";
        sOptions = "2002";
        bDetected = true;
    } else if (NE.compareEP("eb$$9a........0bc075$$8c06....575606535253be")) {
        sName = "Open Watcom C/C++16 for Windows";
        sOptions = "2002";
        bDetected = true;
    }

    sLang = sName.indexOf("C++") !== -1 ? "C" : "C++";

    return result();
}

================================================
FILE: db/NE/game_engine_DirectorPlayer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Director
meta("game engine", "Director Player");

function detect() {
    if (NE.compareOverlay("140002004d11650000000200c0252500")) {
        sVersion = "1.0-3.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/installer_CoktelVisionInstaller.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Coktel_Vision
meta("installer", "Coktel Vision");

function detect() {
    if (NE.compareOverlay("65000300ea010400fa0c0300e6010400")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/installer_Setup-Specialist.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Setup-Specialist");

function detect() {
    if (NE.compareEP("eb$$53510633c0509a........5807595b9a........0bc075..e9")) {
        sOptions = "1995-1998 by Thilo-Alexander Ginkel";
        bDetected = true;
    } else if (NE.compareEP("eb$$53510633c050900ee8....5807595b9a........0bc075..e9")) {
        sOptions = "1995-1997 by Thilo-Alexander Ginkel";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/library_MS_RTL.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "MS RTL");

function detect() {
    if (NE.compareEP("fca3....891e....49890e....bb....8c1f83e4..8967..b8....508967..f7d0508967..8967..8926....1e68....1e68....9a")) {
        sOptions = "1990 type 1";
        bDetected = true;
    } else if (NE.compareEP("558bec508bc416509a........5886e0a3....1e68....1e68....9a")) {
        sOptions = "1988 type 1";
        bDetected = true;
    } else if (NE.compareEP("fc8926....8926....8c1e....49890e....a3....891e")) {
        sOptions = "1988 type 2";
        bDetected = true;
    } else if (NE.compareEP("fc8926....49890e....a3....891e....1e68....1e68....9a")) {
        sOptions = "1988 type 3";
        bDetected = true;
    } else if (NE.compareEP("c8......57561eb8....8ed89a")) {
        sOptions = "1990 type 2";
        bDetected = true;
    } else if (NE.compareEP("c8......5756bb....8ec326a3....9a")) {
        sOptions = "1990 type 3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/sfx_ARC_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "ARC SFX");

function detect() {
    if (NE.compareEP("a3....891e....890e....8b0e....bb....e8....72..8b0e....bb....e8....73..b9....890e....bb....e8")) {
        sOptions = "1991 by SEA, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/sfx_PKZIP-SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "PKZIP-SFX");

function detect() {
    if (NE.compareEP("fca3....891e....49890e....bb....8c1f83e4..8967..b8....508967..f7d0508967..8967..8926....508bc416509a")) {
        sOptions = "1989-91 by PKWARE Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NE/sfx_Sydex_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Sydex SFX");

function detect() {
    if (NE.compareEP("b8....8ec0e8....ba....3d....72..e8....26a3....26890e....268916....68....1ee8....83c4..ba....85c074")) {
        sOptions = "1995 by Sydex, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/NPM/_NPM.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "NodeJS package");

function detect() {
    if (NPM.isVerbose()) {
        sType = "operation system";
        sName = NPM.getOperationSystemName();
        sVersion = NPM.getOperationSystemVersion();
        sOptions = NPM.getOperationSystemOptions();

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/NPM/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = NPM;
var X = NPM;

================================================
FILE: db/NPM/language_JavaScript.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("language", "JavaScript");

function detect() {
    if (NPM.isArchiveRecordPresentExp("(.*?).js")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/NPM/language_TypeScript.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("language", "TypeScript");

function detect() {
    if (NPM.isArchiveRecordPresentExp("(.*?).ts")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/NPM/package_PackageName.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("package", "");

function detect() {
    var _sName = NPM.getPackageJsonRecord("name");

    if (_sName) {
        sName = _sName;
        sVersion = NPM.getPackageJsonRecord("version");
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PDF/_PDF.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "PDF");

function detect() {
    sName = PDF.getFileFormatName();
    sVersion = PDF.getFileFormatVersion();
    sOptions = PDF.getFileFormatOptions();

    bDetected = true;

    return result();
}


================================================
FILE: db/PDF/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = PDF;
var X = PDF;

================================================
FILE: db/PDF/converter_markdown-pdf.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("converter", "markdown-pdf");

function detect() {
    if (PDF.compare("'%PDF-1.4'0A'1 0 obj'0A'<<'0A'/Title ('FEFF')'0A'/Creator ('FEFF')'0A'/Producer ('FEFF00'Q'00't'00' '00'5'00'.'00'5'00'.'00'1)'")) {
        sVersion = "11.0.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PDF/converter_mdpdf.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("converter", "mdpdf");

function detect() {
    if (PDF.compare("'%PDF-1.4'0A'%'D3EBE9E10A'1 0 obj'0A'<</Title '++0A'/Creator (Mozilla/5.0 '5C'(Windows NT 10.0; Win64; x64'5C') AppleWebKit/537.36 '5C'(KHTML, like Gecko'5C') HeadlessChrome/138.0.0.0 Safari/537.36)'0A'/Producer (Skia/PDF m138)")) {
        sVersion = "3.1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PDF/format_HeaderComment.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "pdf");

function detect() {
    var sHeaderComment =  PDF.getHeaderCommentAsHex();
    if (sHeaderComment) {
        _setResult("complier", "HeaderComment", sHeaderComment, "");
    }
}


================================================
FILE: db/PDF/format_PersonalData.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "pdf");

function detect() {
    var list_autor = PDF.getStringValuesByKey("/Author");

    for (var i = 0; i < list_autor.length; i++) {
        _setResult("personal data", "Author", "", list_autor[i]);
    }
}


================================================
FILE: db/PDF/format_RTSN_secure.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "pdf");

function detect() {
    if (PDF.findSignature(0, PDF.getSize(), "'obj'0D'<< '0D'/Filter /RTSN_secure '0D'/V 1 '0D'/pw (BLUEMOON)'0D'>> '0D'endobj'") != -1) {
        _setResult("protector", "RTSN_secure", "1.0", "");
    }
}


================================================
FILE: db/PDF/format_Tools.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "pdf");

function detect() {
    var list_creator = PDF.getStringValuesByKey("/Creator");

    for (var i = 0; i < list_creator.length; i++) {
        _setResult("tool", "Creator", PDF.getHeaderCommentAsHex(), list_creator[i]);
    }

    var list_producer = PDF.getStringValuesByKey("/Producer");

    for (var i = 0; i < list_producer.length; i++) {
        _setResult("tool", "Producer", PDF.getHeaderCommentAsHex(), list_producer[i]);
    }
}


================================================
FILE: db/PE/ACE.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("ACE");

function detect() {
    detect_ACE(0);

    return result();
}

================================================
FILE: db/PE/Cab.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("cab");

function cab_resource(bShowOptions) {
    for (var i = 0; i < PE.resource.length; i++) {
        if (detect_Cab(PE.resource[i].Offset, PE.resource[i].Size, bShowOptions)) {
            return true;
        }
    }

    return false;
}

function detect(bShowOptions) {
    if (!detect_Cab(PE.getOverlayOffset(), PE.getOverlaySize(), bShowOptions) &&
        !cab_resource(bShowOptions)) {
        var rsrcSection = PE.section[".rsrc"];

        if (rsrcSection) {
            if (rsrcSection.FileOffset > rsrcSection.VirtualSize) {
                var nOffset = rsrcSection.FileOffset + rsrcSection.VirtualSize;
                nOffset = (nOffset + 0x1ff) & -0x200;
                while (!detect_Cab(nOffset, rsrcSection.FileSize, bShowOptions) && nOffset > rsrcSection.FileOffset && !_isStop()) {
                    nOffset -= 0x200;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/Microsoft.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// This file has a lot of results
// Microsoft linker
// Microsoft Visual C/C++
// Visual Basic
// MASM
// MFC

// Rewritten by DosX: 2 jul 2025

function detect() {
    var linkerName = String(),
        linkerVersion = String(),
        linkerOptions = String(),
        cppCompilerName = String(),
        cppCompilerVersion = String(),
        cppCompilerOptions = String(),
        masmCompilerName = String(),
        masmCompilerVersion = String(),
        masmCompilerOptions = String(),
        vbCompilerName = String(),
        vbCompilerVersion = String(),
        vbCompilerOptions = String(),
        dotNetLibraryName = String(),
        dotNetLibraryVersion = String(),
        dotNetLibraryOptions = String(),
        mfcLibraryName = String(),
        mfcLibraryVersion = String(),
        mfcLibraryOptions = String(),
        toolName = String(),
        toolVersion = String(),
        toolOptions = String();




    //
    // ==================================================
    //     Advanced detection of .NET applications
    // ==================================================
    //        Author: DosX
    //        E-Mail: collab@kay-software.ru
    //        GitHub: https://github.com/DosX-dev
    //        Telegram: @DosX_dev
    // ==================================================
    //

    function findNetCoreConfigOffset() {
        return PE.findString(PE.section[0].FileOffset, PE.getSize(), ".NETCoreApp,Version=v");
    }

    function findNetFrameworkConfigOffset() {
        return PE.findString(PE.section[0].FileOffset, PE.getSize() - PE.getOverlaySize(), ".NETFramework,Version=v");
    }

    function getNetConfigStringByOffset(configOffset) {
        var result = PE.getString(configOffset).split("=")[1];

        if (result && result[0] !== 'v' && result.length > 7)
            result = String();

        result = result.substr(1);

        return File.cleanString(result);
    }

    if (PE.isNet()) {

        const netFrameworkConfigPattern = findNetFrameworkConfigOffset();

        if (netFrameworkConfigPattern != -1) {

            dotNetLibraryName = ".NET Framework"; // .NET Framework better than .NET Core
            dotNetLibraryVersion = String(getNetConfigStringByOffset(netFrameworkConfigPattern));

            if (dotNetLibraryVersion) {
                // antifake
                if (dotNetLibraryVersion.length >= 4 &&
                    dotNetLibraryVersion[1] !== "4" &&
                    dotNetLibraryVersion[1] !== "3" &&
                    dotNetLibraryVersion[1] !== "2" &&
                    dotNetLibraryVersion[2] !== "." &&
                    isNaN(Number(dotNetLibraryVersion[3]))) {
                    dotNetLibraryVersion = String();
                }
            }

        } else if (PE.isRichSignaturePresent() && PE.isTLSPresent()) {
            const netCoreConfigPattern = findNetCoreConfigOffset();

            if (netCoreConfigPattern != -1 && PE.compare("18", netCoreConfigPattern - 1) && PE.getNETVersion().substr(0, 4) === "v4.0") { // Is .NET Core DLL
                dotNetLibraryName = ".NET Core";
                dotNetLibraryVersion = getNetConfigStringByOffset(netCoreConfigPattern); // antifake
                if (dotNetLibraryVersion.length >= 2 && isNaN(Number(dotNetLibraryVersion[1]))) {
                    dotNetLibraryVersion = String();
                }
            }

        }

        dotNetLibraryVersion = File.cleanString(dotNetLibraryVersion); // remove strange symbols

        if (PE.isSignaturePresent(0x00, PE.getSize(), "'.NETCoreApp'")) {
            dotNetLibraryName = ".NET Core";
        } else if (!dotNetLibraryName) {
            dotNetLibraryName = ".NET Framework";
        }

        var clrVersion = File.cleanString(PE.getNETVersion());

        clrVersion = clrVersion.substring(1, clrVersion.length);

        dotNetLibraryVersion += (dotNetLibraryVersion ? ", " : String()) + "CLR " + clrVersion;

        // dotNetLibraryVersion = PE.getNETVersion();

        if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....00000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000")) {
            linkerName = "Microsoft Linker";
        }
    } else {
        var isNetNative = false;

        var rdataSection = PE.section[".rdata"];

        if (rdataSection &&
            PE.isFunctionPresent("LoadLibraryExW") &&
            PE.isFunctionPresent("ShellExecuteW") &&
            PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "__clrcall") !== -1 && (
                PE.isSignatureInSectionPresent(rdataSection.Number, "002E004E0045005400200043006F00720065") ||
                PE.isSignatureInSectionPresent(rdataSection.Number, "2E004E00450054002000520075006E00740069006D006500")
            )
        ) {
            dotNetLibraryVersion = "Loader";
        }

        const dotNetDebugHeaderName = "DotNetRuntimeDebugHeader";

        var secondSection = PE.section[1]; // By index, can be ".rdata" or ".managed"

        // Checking for signs of .NET Native debug information
        var isDotNetRuntimeDebugBuild = (
            secondSection && (
                PE.isExportFunctionPresent(dotNetDebugHeaderName) || (
                    PE.compare("48 8d 05", secondSection.FileOffset) && ( // .managed, debug
                        PE.section[".managed"] || // .NET ~8.X
                        PE.section["hydrated"]
                    )
                )
            )
        );

        // General PE format check
        if (PE.compareEP("48") &&
            PE.compare("90", PE.getEntryPointOffset() - 1) && // NOP before OEP
            PE.isRichSignaturePresent() &&
            PE.getExportSection() !== -1 && // EAT always present
            PE.getNumberOfSections() >= 6) { // PE.isLibraryPresentExp(/^api-ms-win-crt-.*\.dll$/)
            if (isDotNetRuntimeDebugBuild || (
                PE.isSignatureInSectionPresent(secondSection.Number, "'System.' %% %% %% %% %% %%") && (
                    PE.isSignatureInSectionPresent(secondSection.Number, "'DOTNET_' %%") || // .rdata, release
                    PE.isSignatureInSectionPresent(secondSection.Number, "'D'00'O'00'T'00'N'00'E'00'T'00'_'") // .rdata, release (.NET 10)
                )
            )) {
                isNetNative = true;

                if (isDotNetRuntimeDebugBuild) {
                    dotNetLibraryOptions = "debug";
                } else {
                    dotNetLibraryOptions = "release";
                }

                if (PE.section[0].Name !== ".text" || (secondSection.Name !== ".rdata" && secondSection.Name !== ".managed") || (
                    !PE.isDll() && // executable?
                    PE.getNumberOfExports() === 1 && // only one export
                    PE.getExportFunctionName(0) !== dotNetDebugHeaderName // and it's not DotNetRuntimeDebugHeader
                )) {
                    dotNetLibraryOptions = dotNetLibraryOptions.append("modified");
                }
            }

            // TODO: Improve & add .NET 10 support (!!!!!!)
            const netCoreConfigPattern = findNetCoreConfigOffset();

            if (netCoreConfigPattern != -1) dotNetLibraryVersion = getNetConfigStringByOffset(netCoreConfigPattern);
        }

        if (dotNetLibraryVersion !== String() || dotNetLibraryOptions !== String()) dotNetLibraryName = ".NET " + (isNetNative ? "Native" : "Core");

        if (isNetNative) {
            _setLang("Native MSIL/C#");
        }
    }

    //
    // ==================================================
    //




    var isCppDetected = false,
        hasWideMainFunction = 0;

    msvcRuntimeLibrary = PE.isLibraryPresentExp(/^MSVCR/i);

    if (msvcRuntimeLibrary) {
        hasWideMainFunction = PE.isLibraryFunctionPresent(msvcRuntimeLibrary[0], "__wgetmainargs");
    }

    if (!PE.is64()) {
        if (PE.compareEP("558BEC51C745FC01000000837D0C007510833D")) {
            if (PE.compareEP("00", -4)) {
                sOptions = mfcLibraryOptions.append("libcd");
            } else if (PE.compareEP("00", -8)) {
                sOptions = mfcLibraryOptions.append("libcmtd");
            } else {
                sOptions = mfcLibraryOptions.append("msvcrtd");
            }
            cppCompilerVersion = "12.00";
            isCppDetected = true;
        } else if (PE.compareEP("558BEC538B5D08568B750C578B7D1085F67509833D")) {
            if (PE.compareEP("CA", -1)) {
                cppCompilerOptions = cppCompilerOptions.append("libc");
            } else if (PE.compareEP("59", -7)) {
                cppCompilerOptions = cppCompilerOptions.append("libcmt");
            } else {
                cppCompilerOptions = cppCompilerOptions.append("msvcrt");
            }
            cppCompilerVersion = "12.00";
            isCppDetected = true;
        } else if (PE.compareEP("558BEC6AFF68........68........64A100000000506489250000000083")) {
            var mainFunctionOffset;
            switch (PE.readByte(PE.getEntryPointOffset() + 31)) {
                case 0x10:
                    if (PE.compareEP("83", 107)) {
                        cppCompilerOptions = cppCompilerOptions.append("libc");
                        mainFunctionOffset = 116;
                    } else {
                        cppCompilerOptions = cppCompilerOptions.append("libcmt");
                        mainFunctionOffset = 133;
                    }
                    if (PE.compareEP("E8", mainFunctionOffset)) {
                        cppCompilerOptions = cppCompilerOptions.append("wmain");
                        --mainFunctionOffset;
                    }
                    if (PE.compareEP("FF", mainFunctionOffset + 25)) {
                        cppCompilerOptions = cppCompilerOptions.append("glob");
                    }
                    break;
                case 0x20:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrt");
                    if (hasWideMainFunction) {
                        cppCompilerOptions = cppCompilerOptions.append("wmain");
                    }
                    if (PE.compareEP("FF", 109)) {
                        cppCompilerOptions = cppCompilerOptions.append("glob");
                    }
                    break;
                case 0x58:
                    if (PE.compareEP("33", 87)) {
                        cppCompilerOptions = cppCompilerOptions.append("libc");
                        mainFunctionOffset = 116;
                    } else {
                        cppCompilerOptions = cppCompilerOptions.append("libcmt");
                        mainFunctionOffset = 134;
                    }
                    if (PE.compareEP("E8", mainFunctionOffset)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    break;
                case 0x68:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrt");
                    if (PE.compareEP("5F", 45)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    break;
                case 0x90:
                    cppCompilerOptions = cppCompilerOptions.append("libcd");
                    if (PE.compareEP("E8", 241)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    break;
                case 0x94:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrtd");
                    if (PE.compareEP("83", 233)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    break;
                case 0xA4:
                    if (PE.compareEP("00", 125)) {
                        cppCompilerOptions = cppCompilerOptions.append("libcd");
                        mainFunctionOffset = 160;
                    } else {
                        cppCompilerOptions = cppCompilerOptions.append("libcmtd");
                        mainFunctionOffset = 179;
                    }
                    if (PE.compareEP("E8", mainFunctionOffset)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    break;
                case 0xE0:
                    switch (PE.readByte(PE.getEntryPointOffset() + 38)) {
                        case 0xB8:
                            cppCompilerOptions = cppCompilerOptions.append("libcd");
                            if (PE.compareEP("E8", 241)) {
                                cppCompilerOptions = cppCompilerOptions.append("wmain");
                            }
                            break;
                        case 0xC7:
                            cppCompilerOptions = cppCompilerOptions.append("msvcrtd");
                            if (hasWideMainFunction) {
                                cppCompilerOptions = cppCompilerOptions.append("wmain");
                            }
                            if (PE.compareEP("FF", 121)) {
                                cppCompilerOptions = cppCompilerOptions.append("glob");
                            }
                            break;
                    }
                    break;
                case 0xE8:
                    cppCompilerOptions = cppCompilerOptions.append("libcd");
                    break;
                case 0xF0:
                    if (PE.compareEP("00", 125)) {
                        cppCompilerOptions = cppCompilerOptions.append("libcd");
                        mainFunctionOffset = 160;
                    } else {
                        cppCompilerOptions = cppCompilerOptions.append("libcmtd");
                        mainFunctionOffset = 179;
                    }
                    if (PE.compareEP("E8", mainFunctionOffset)) {
                        cppCompilerOptions = cppCompilerOptions.append("wmain");
                        --mainFunctionOffset;
                    }
                    if (PE.compareEP("FF", mainFunctionOffset + 25)) {
                        cppCompilerOptions = cppCompilerOptions.append("glob");
                    }
                    break;
            }
            cppCompilerVersion = "11.00-13.10";
            isCppDetected = true;
        } else if (PE.compareEP("6A0C68........E8........33C0408945E48B750C33FF3BF7750C393D")) {
            switch (PE.readByte(PE.getEntryPointOffset() - 1)) {
                case 0xC0:
                    cppCompilerOptions = cppCompilerOptions.append("libc");
                    break;
                case 0x00:
                    cppCompilerOptions = cppCompilerOptions.append("libcmt");
                    break;
            }
            cppCompilerVersion = "13.10";
            isCppDetected = true;
        } else if (PE.compareEP("6A..68........E8........66813D")) {
            cppCompilerVersion = "13.10";
            isCppDetected = true;
        } else if (PE.compareEP("6A..68........E8........BF940000008BC7E8")) {
            mainFunctionOffset = 0;
            var mainFunctionType;
            switch (PE.readByte(PE.getEntryPointOffset() + 1)) {
                case 0x18:
                    mainFunctionType = "wmain";
                    mainFunctionOffset = 197;
                    break;
                case 0x60:
                    mainFunctionType = "wWinMain";
                    mainFunctionOffset = 199;
                    break;
            }
            if (mainFunctionOffset) {
                if (PE.compareEP("6A", mainFunctionOffset)) {
                    cppCompilerOptions = cppCompilerOptions.append("libcmt");
                    mainFunctionOffset += 62;
                } else {
                    cppCompilerOptions = cppCompilerOptions.append("libc");
                    mainFunctionOffset += 69;
                }
                if (PE.compareEP("E8", mainFunctionOffset)) {
                    cppCompilerOptions = cppCompilerOptions.append(mainFunctionType);
                }
            }
            cppCompilerVersion = "13.10";
            isCppDetected = true;
        } else if (PE.compareEP("8BFF558BEC837D0C017505E8")) {
            if (PE.compareEP("8B", 16)) {
                cppCompilerOptions = cppCompilerOptions.append(PE.compareEP("E8", 74) ? "libcmtd" : "msvcrtd");
            } else {
                cppCompilerOptions = cppCompilerOptions.append(PE.compareEP("8B", 35) ? "libcmt" : "msvcrt");
            }
            cppCompilerVersion = "15.00-16.00";
            isCppDetected = true;
        } else if (PE.compareEP("8BFF558BECE8......00E8......005DC3")) {
            switch (PE.readByte(PE.getEntryPointOffset() + 58)) {
                case 0x88:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrtd", "wWinMain");
                    cppCompilerVersion = "15.00";
                    break;
                case 0x8C:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrtd");
                    cppCompilerVersion = "15.00";
                    break;
                case 0x90:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrtd");
                    if (hasWideMainFunction) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    cppCompilerVersion = "16.00";
                    break;
                case 0x94:
                    cppCompilerOptions = cppCompilerOptions.append("libcmtd");
                    if (PE.compareEP("52", 145)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    cppCompilerVersion = "15.00";
                    break;
                case 0x98:
                    cppCompilerOptions = cppCompilerOptions.append("libcmtd");
                    if (PE.compareEP("6A", 645)) {
                        cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                    }
                    cppCompilerVersion = "16.00";
                    break;
                case 0xE4:
                    cppCompilerOptions = cppCompilerOptions.append("msvcrtd");
                    if (hasWideMainFunction) {
                        cppCompilerOptions = cppCompilerOptions.append("wmain");
                    }
                    if (PE.compareEP("FF", -0x9B)) {
                        cppCompilerOptions = cppCompilerOptions.append("glob");
                    }
                    cppCompilerVersion = "15.00-16.00";
                    break;
                case 0xE8:
                    cppCompilerOptions = cppCompilerOptions.append("libcmtd");
                    if (PE.compareEP("E8", 92)) {
                        if (PE.compareEP("E8", 184)) {
                            cppCompilerOptions = cppCompilerOptions.append("wmain");
                            hasWideMainFunction = 1;
                        }
                        cppCompilerVersion = "15.00";
                    } else {
                        if (PE.compareEP("E8$$$$$$$$8BFF558BEC83EC10", 213)) {
                            cppCompilerOptions = cppCompilerOptions.append("wmain");
                            hasWideMainFunction = 1;
                        }
                        cppCompilerVersion = "16.00";
                    }
                    if (hasWideMainFunction) {
                        if (PE.compareEP("10", -6)) {
                            cppCompilerOptions = cppCompilerOptions.append("glob");
                        }
                    } else {
                        if (PE.compareEP("CC", -2)) {
                            cppCompilerOptions = cppCompilerOptions.append("glob");
                        }
                    }
                    break;
            }
            isCppDetected = true;
        } else if (PE.compareEP("E8......00E9$$$$$$$$6A..68........E8")) {
            var nEP = PE.getEntryPointOffset();
            nEP += 10 + ~~PE.readDword(nEP + 6);
            if (PE.compare("10", nEP + 1)) {
                cppCompilerOptions = cppCompilerOptions.append("msvcrt");
                if (hasWideMainFunction) {
                    cppCompilerOptions = cppCompilerOptions.append("wmain");
                }
                if (PE.compareEP("FF", -48)) {
                    cppCompilerOptions = cppCompilerOptions.append("glob");
                }
            } else if (PE.compare("33DB", nEP + 12)) {
                cppCompilerOptions = cppCompilerOptions.append("msvcrt");
                if (PE.compare("89", nEP + 53) || PE.compare("E0", nEP + 60)) {
                    cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                }
            } else if (PE.compare("3935", nEP + 14)) {
                cppCompilerOptions = cppCompilerOptions.append("libcmt");
                if (PE.compareEP("E8$$$$$$$$8B", -150)) {
                    cppCompilerOptions = cppCompilerOptions.append("wmain");
                }
                if (PE.compareEP("FF", -0xA3)) {
                    cppCompilerOptions = cppCompilerOptions.append("glob");
                }
            } else if (PE.compare("8D4598", nEP + 12)) {
                cppCompilerOptions = cppCompilerOptions.append("libcmt");
                if (PE.compareEP("51", 15)) {
                    cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                }
            } else if (PE.compare("33F68975FC", nEP + 12)) {
                cppCompilerOptions = cppCompilerOptions.append("libcmt");
                if (PE.compare("E8", nEP + 170)) {
                    cppCompilerOptions = cppCompilerOptions.append("wWinMain");
                }
            } else if (PE.compare("B8'MZ'", nEP + 12)) {
                cppCompilerOptions = cppCompilerOptions.append("libcmt");
                if (PE.compare("E8", nEP + 149)) {
                    cppCompilerOptions = cppCompilerOptions.append("wmain");
                    --nEP;
                }
                if (PE.compare("FF", nEP + 174)) {
                    cppCompilerOptions = cppCompilerOptions.append("glob");
                }
            }
            cppCompilerVersion = "15.00-16.00";
            isCppDetected = true;
        } else if (PE.compareEP("64A100000000558BEC6AFF68")) {
            isCppDetected = true;
        } else if (PE.compareEP("64A100000000506489250000000083C4A8535657")) {
            cppCompilerVersion = "11.00";
            isCppDetected = true;
        } else if (PE.compareEP("535657BB........8B......553BFB75")) {
            cppCompilerVersion = "8.00";
            isCppDetected = true;
        } else if (PE.compareEP("56E8........8BF0E8........68........68........E8........6A..68........56E8")) {
            cppCompilerVersion = "8.00";
            isCppDetected = true;
        } else if (PE.compareEP("53B8........8B......565785DB5575")) {
            cppCompilerVersion = "10.20";
            isCppDetected = true;
        } else if (PE.compareEP("558BEC83EC4456FF15........6A018BF0FF15")) {
            cppCompilerVersion = "12.00";
            isCppDetected = true;
        } else if (PE.compareEP("558BEC83EC4456FF15........8BF08A063C22")) {
            cppCompilerVersion = "12.00";
            isCppDetected = true;
        } else if (PE.compareEP("558D6C....81EC........8B45..83F801560F84........85C00F84")) {
            cppCompilerVersion = "12.00";
            isCppDetected = true;
        }
        // else if(PE.compareEP("837C24080175098B442404A3....0010E88BFFFFFF")) { // Pure Basic 4.0
        //     cppCompilerVersion = "12.00";
        //     isCppDetected = true;
        // }
        else if (PE.compareEP("558BEC538B5D08568B750C85F6578B7D10")) {
            cppCompilerVersion = "13.00";
            isCppDetected = true;
        } else if (PE.compareEP("833D........00741A68........E8........85C059740BFF742404FF15........59E8........68........68........E8........85C059597554565768........E8........BE........8BC6BF")) {
            cppCompilerVersion = "14.00";
            isCppDetected = true;
        } else if (PE.compareEP("6A1468........E8........BB94000000536A008B..........FFD750FF..........8BF085F6750A6A12E8........59EB18891E56FF..........5685C0751450FFD750FF..........B8")) {
            cppCompilerVersion = "14.00";
            isCppDetected = true;
        } else if (PE.compareEP("8BFF558BEC538B5D08568B750C85F6578B7D100F84....000083FE01")) {
            cppCompilerVersion = "14.00";
            isCppDetected = true;
        } else if (PE.compareEP("8BFF558BEC538B5D08568B750C85F6578B7D107509833D........00EB2683FE01740583FE027522A1........85C07409575653FFD085C0740C575653E8......FF85C0750433C0EB4E575653E8......FF83FE0189450C750C85C07537575053E8......FF85F6740583FE037526575653E8......FF85C0750321450C837D0C007411A1........85C07408575653FFD089450C8B450C5F5E5B5DC20C00")) {
            cppCompilerVersion = "14.00";
            isCppDetected = true;
        } else if (PE.compareEP("558BEC83EC10A1........8365F8008365FC005357BF4EE640BB3BC7BB0000FFFF740D85C37409F7D0A3........EB60568D45F850FF15........8B75FC3375F8FF15........33F0FF15........33F0FF15........33F08D45F050FF15........8B45F43345F033F03BF77507BE4FE640BBEB0B85F375078BC6C1E0100BF08935........F7D68935........5E5F5BC9C3")) {
            cppCompilerVersion = "14.00";
            isCppDetected = true;
        } else if (PE.compareEP("558BEC83EC245356578965F8")) {
            isCppDetected = true;
        }
    } else {
        if (PE.compareEP("4883EC2885D248895C243048896C243848897424408BDA488BE9498BF0751E3915")) {
            cppCompilerVersion = "14.00"; // DLL
            isCppDetected = true;
        } else if (PE.compareEP("4883EC5848895C247048897C247866813D")) {
            cppCompilerVersion = "14.00"; // console, msvcrt
            isCppDetected = true;
        } else if (PE.compareEP("4883EC3848895C245048897C2458FF15")) {
            cppCompilerVersion = "14.00"; // console, static
            isCppDetected = true;
        } else if (PE.compareEP("488BC44881EC........4889581848897820488D4888FF15")) {
            cppCompilerVersion = "14.00"; // GUI
            isCppDetected = true;
        } else if (PE.compareEP("4883EC28E8........4883C428E9$$$$$$$$48895C24")) {
            cppCompilerVersion = "16.00";
            isCppDetected = true;
        } else if (PE.compareEP("4883EC28E8........E8........4883C428C3")) {
            cppCompilerVersion = "16.00"; // debug
            isCppDetected = true;
        } else if (PE.compareEP("48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8")) {
            cppCompilerVersion = "16.00"; // DLL
            isCppDetected = true;
        } else if (PE.compareEP("4C894424188954241048894C24084883EC28837C2438017505E8")) {
            cppCompilerVersion = "16.00"; // DLL debug
            isCppDetected = true;
        }
    }

    if (isCppDetected) {
        cppCompilerName = "Microsoft Visual C/C++";
    }

    if (PE.isRichSignaturePresent()) {
        linkerName = "Microsoft Linker";
    }

    var mfcLibraryMatch = PE.isLibraryPresentExp(/^MFC(\d+?)(u?)(d?)\.dll/i);

    if (mfcLibraryMatch) {
        mfcLibraryVersion = (mfcLibraryMatch[1] / 10).toFixed(1);

        if (mfcLibraryMatch[2]) {
            mfcLibraryOptions = "Unicode";
        }

        if (mfcLibraryMatch[3]) {
            mfcLibraryOptions = mfcLibraryOptions.append("debug");
        }

        mfcLibraryName = "MFC";
    }

    if (PE.isDeepScan() && (mfcLibraryName == String())) {
        var dataSection = PE.section[".data"];

        if (dataSection && PE.isSignatureInSectionPresent(dataSection.Number, "'CMFCComObject'")) {
            mfcLibraryName = "MFC";
            mfcLibraryOptions = "static";
        }
    }

    if (PE.isNet()) {
        if (PE.isNetObjectPresent("Microsoft.VisualBasic")) {
            vbCompilerName = "VB.NET";
            vbDetected = true;
        }
    } else if (PE.isLibraryPresentExp(/^MSVBVM60(\.DLL)?/i)) {
        vbCompilerName = "Microsoft Visual Basic";
        vbCompilerVersion = "6.0";
        vbCompilerOptions = getVbOptions();
    } else if (PE.isLibraryPresentExp(/^MSVBVM50(\.DLL)?/i)) {
        vbCompilerName = "Microsoft Visual Basic";
        vbCompilerVersion = "5.0";
        vbCompilerOptions = getVbOptions();
    } else if (PE.isLibraryPresentExp(/^VB40032(\.DLL)/i)) {
        vbCompilerName = "Microsoft Visual Basic";
        vbCompilerVersion = "4.0";
    }

    if (vbCompilerVersion && (
        PE.isLibraryPresentExp(/^(VB40032|MSVBVM[56]0)$/i) ||
        (vbCompilerVersion === "6.0" && !PE.isRichSignaturePresent())
    )) {
        vbCompilerOptions = vbCompilerOptions.append("modified/patched");
    }

    // Rich
    var richLinkerName = String(),
        richLinkerVersion = String(),
        richLinkerOptions = String(),
        richCppCompilerName = String(),
        richCppCompilerVersion = String(),
        richCppCompilerOptions = String(),
        richMasmCompilerName = String(),
        richMasmCompilerVersion = String(),
        richMasmCompilerOptions = String(),
        richVbCompilerName = String(),
        richVbCompilerVersion = String(),
        richVbCompilerOptions = String();

    for (var i = PE.getNumberOfRichIDs() - 1; i >= 0; i--) {
        var richId = PE.getRichID(i);

        if (richId > 1) {
            var richVersion = String(),
                richOptions = String(),
                isLinker = 0,
                isCompiler = 0,
                isMasm = 0,
                isBasic = 0;

            var richIdMap = {
                0x0002: { isLinker: 1, richVersion: "5.10" },
                0x0004: { isLinker: 1, richVersion: "6.00" },
                0x0007: { isBasic: 1, richVersion: "5.00", richOptions: "Native" },
                0x0008: { isCompiler: 1, richVersion: "11.00", richOptions: "C/C++" },
                0x0009: { isBasic: 1, richVersion: "6.00", richOptions: "Native" },
                0x000a: { isCompiler: 1, richVersion: "12.00", richOptions: "C" },
                0x000b: { isCompiler: 1, richVersion: "12.00", richOptions: "C++" },
                0x000e: { isMasm: 1, richVersion: "6.13" },
                0x000f: { isMasm: 1, richVersion: "7.01" },
                0x0010: { isLinker: 1, richVersion: "5.11" },
                0x0012: { isMasm: 1, richVersion: "6.14", richOptions: "MMX2 support" },
                0x0013: { isLinker: 1, richVersion: "5.12" },
                0x0015: { isCompiler: 1, richVersion: "12.00", richOptions: "C/std" },
                0x0016: { isCompiler: 1, richVersion: "12.00", richOptions: "C++/std" },
                0x0017: { isCompiler: 1, richVersion: "12.00", richOptions: "C/book" },
                0x0018: { isCompiler: 1, richVersion: "12.00", richOptions: "C++/book" },
                0x001b: { isBasic: 1, richVersion: "7.00", richOptions: "Native" },
                0x001c: { isCompiler: 1, richVersion: "13.00", richOptions: "C" },
                0x001d: { isCompiler: 1, richVersion: "13.00", richOptions: "C++" },
                0x001e: { isLinker: 1, richVersion: "6.10" },
                0x0020: { isLinker: 1, richVersion: "6.01" },
                0x0022: { isBasic: 1, richVersion: "6.10", richOptions: "Native" },
                0x0023: { isCompiler: 1, richVersion: "12.10", richOptions: "C" },
                0x0024: { isCompiler: 1, richVersion: "12.10", richOptions: "C++" },
                0x0025: { isLinker: 1, richVersion: "6.20" },
                0x0028: { isLinker: 1, richVersion: "6.21" },
                0x002a: { isMasm: 1, richVersion: "6.15" },
                0x002b: { isCompiler: 1, richVersion: "13.00", richOptions: "LTCG/C" },
                0x002c: { isCompiler: 1, richVersion: "13.00", richOptions: "LTCG/C++" },
                0x002d: { isMasm: 1, richVersion: "6.20" },
                0x002f: { isBasic: 1, richVersion: "6.20", richOptions: "Native" },
                0x0030: { isCompiler: 1, richVersion: "12.20", richOptions: "C" },
                0x0031: { isCompiler: 1, richVersion: "12.20", richOptions: "C++" },
                0x0032: { isCompiler: 1, richVersion: "12.20", richOptions: "C/std" },
                0x0033: { isCompiler: 1, richVersion: "12.20", richOptions: "C++/std" },
                0x0034: { isCompiler: 1, richVersion: "12.20", richOptions: "C/book" },
                0x0035: { isCompiler: 1, richVersion: "12.20", richOptions: "C++/book" },
                0x0039: { isCompiler: 1, richVersion: "13.00", richOptions: "C/std" },
                0x003a: { isCompiler: 1, richVersion: "13.00", richOptions: "C++/std" },
                0x003c: { isLinker: 1, richVersion: "6.22" },
                0x003d: { isLinker: 1, richVersion: "7.00" },
                0x0040: { isMasm: 1, richVersion: "7.00" },
                0x0041: { isCompiler: 1, richVersion: "13.00", richOptions: "POGO_I_C" },
                0x0042: { isCompiler: 1, richVersion: "13.00", richOptions: "POGO_I_CPP" },
                0x0043: { isCompiler: 1, richVersion: "13.00", richOptions: "POGO_O_C" },
                0x0044: { isCompiler: 1, richVersion: "13.00", richOptions: "POGO_O_CPP" },
                0x0047: { isLinker: 1, richVersion: "7.10p" },
                0x004b: { isMasm: 1, richVersion: "7.10p" },
                0x004c: { isCompiler: 1, richVersion: "13.10p", richOptions: "C" },
                0x004d: { isCompiler: 1, richVersion: "13.10p", richOptions: "C++/book" },
                0x004e: { isCompiler: 1, richVersion: "13.10p", richOptions: "C/std" },
                0x004f: { isCompiler: 1, richVersion: "13.10p", richOptions: "C++/std" },
                0x0050: { isCompiler: 1, richVersion: "13.10p", richOptions: "LTCG/C" },
                0x0051: { isCompiler: 1, richVersion: "13.10p", richOptions: "LTCG/C++" },
                0x0052: { isCompiler: 1, richVersion: "13.10p", richOptions: "POGO_I_C" },
                0x0053: { isCompiler: 1, richVersion: "13.10p", richOptions: "POGO_I_C" },
                0x0054: { isCompiler: 1, richVersion: "13.10p", richOptions: "POGO_O_C" },
                0x0055: { isCompiler: 1, richVersion: "13.10p", richOptions: "POGO_O_CPP" },
                0x0056: { isLinker: 1, richVersion: "6.24" },
                0x005a: { isLinker: 1, richVersion: "7.10" },
                0x005f: { isCompiler: 1, richVersion: "13.10", richOptions: "C" },
                0x0060: { isCompiler: 1, richVersion: "13.10", richOptions: "C++/book" },
                0x0061: { isCompiler: 1, richVersion: "13.10", richOptions: "C/std" },
                0x0062: { isCompiler: 1, richVersion: "13.10", richOptions: "C++/std" },
                0x0063: { isCompiler: 1, richVersion: "13.10", richOptions: "LTCG/C" },
                0x0064: { isCompiler: 1, richVersion: "13.10", richOptions: "LTCG/C++" },
                0x0065: { isCompiler: 1, richVersion: "13.10", richOptions: "POGO_I_C" },
                0x0066: { isCompiler: 1, richVersion: "13.10", richOptions: "POGO_I_C" },
                0x0067: { isCompiler: 1, richVersion: "13.10", richOptions: "POGO_O_C" },
                0x0068: { isCompiler: 1, richVersion: "13.10", richOptions: "POGO_O_CPP" },
                0x006d: { isCompiler: 1, richVersion: "14.00", richOptions: "C" },
                0x006e: { isCompiler: 1, richVersion: "14.00", richOptions: "C++/book" },
                0x006f: { isCompiler: 1, richVersion: "14.00", richOptions: "C/std" },
                0x0070: { isCompiler: 1, richVersion: "14.00", richOptions: "C++/std" },
                0x0071: { isCompiler: 1, richVersion: "14.00", richOptions: "LTCG/C" },
                0x0072: { isCompiler: 1, richVersion: "14.00", richOptions: "LTCG/C++" },
                0x0073: { isCompiler: 1, richVersion: "14.00", richOptions: "POGO_I_C" },
                0x0074: { isCompiler: 1, richVersion: "14.00", richOptions: "POGO_I_C" },
                0x0075: { isCompiler: 1, richVersion: "14.00", richOptions: "POGO_O_C" },
                0x0076: { isCompiler: 1, richVersion: "14.00", richOptions: "POGO_O_CPP" },
                0x0078: { isLinker: 1, richVersion: "8.00" },
                0x007d: { isMasm: 1, richVersion: "8.00" },
                0x0080: { isCompiler: 1, richVersion: "14.00", richOptions: "CVTCIL/C" },
                0x0081: { isCompiler: 1, richVersion: "14.00", richOptions: "CVTCIL/C++" },
                0x0082: { isCompiler: 1, richVersion: "14.00", richOptions: "LTCG/MSIL" },
                0x0083: { isCompiler: 1, richVersion: "15.00", richOptions: "C" },
                0x0084: { isCompiler: 1, richVersion: "15.00", richOptions: "C++" },
                0x0085: { isCompiler: 1, richVersion: "15.00", richOptions: "C/std" },
                0x0086: { isCompiler: 1, richVersion: "15.00", richOptions: "C++/std" },
                0x0087: { isCompiler: 1, richVersion: "15.00", richOptions: "CVTCIL/C" },
                0x0088: { isCompiler: 1, richVersion: "15.00", richOptions: "CVTCIL/C++" },
                0x0089: { isCompiler: 1, richVersion: "15.00", richOptions: "LTCG/C" },
                0x008a: { isCompiler: 1, richVersion: "15.00", richOptions: "LTCG/C++" },
                0x008b: { isCompiler: 1, richVersion: "15.00", richOptions: "LTCG/MSIL" },
                0x008c: { isCompiler: 1, richVersion: "15.00", richOptions: "POGO_I_C" },
                0x008d: { isCompiler: 1, richVersion: "15.00", richOptions: "POGO_I_C" },
                0x008e: { isCompiler: 1, richVersion: "15.00", richOptions: "POGO_O_C" },
                0x008f: { isCompiler: 1, richVersion: "15.00", richOptions: "POGO_O_CPP" },
                0x0091: { isLinker: 1, richVersion: "9.00" },
                0x0095: { isMasm: 1, richVersion: "9.00" },
                0x009d: { isLinker: 1, richVersion: "10.00" },
                0x009e: { isMasm: 1, richVersion: "10.00" },
                0x00aa: { isCompiler: 1, richVersion: "16.00", richOptions: "C" },
                0x00ab: { isCompiler: 1, richVersion: "16.00", richOptions: "C++" },
                0x00ac: { isCompiler: 1, richVersion: "16.00", richOptions: "CVTCIL/C" },
                0x00ad: { isCompiler: 1, richVersion: "16.00", richOptions: "CVTCIL/C++" },
                0x00ae: { isCompiler: 1, richVersion: "16.00", richOptions: "LTCG/C" },
                0x00af: { isCompiler: 1, richVersion: "16.00", richOptions: "LTCG/C++" },
                0x00b0: { isCompiler: 1, richVersion: "16.00", richOptions: "LTCG/MSIL" },
                0x00b1: { isCompiler: 1, richVersion: "16.00", richOptions: "POGO_I_C" },
                0x00b2: { isCompiler: 1, richVersion: "16.00", richOptions: "POGO_I_C" },
                0x00b3: { isCompiler: 1, richVersion: "16.00", richOptions: "POGO_O_C" },
                0x00b4: { isCompiler: 1, richVersion: "16.00", richOptions: "POGO_O_CPP" },
                0x00ba: { isLinker: 1, richVersion: "10.10" },
                0x00bb: { isMasm: 1, richVersion: "10.10" },
                0x00bc: { isCompiler: 1, richVersion: "16.10", richOptions: "C" },
                0x00bd: { isCompiler: 1, richVersion: "16.10", richOptions: "C++" },
                0x00be: { isCompiler: 1, richVersion: "16.10", richOptions: "CVTCIL/C" },
                0x00bf: { isCompiler: 1, richVersion: "16.10", richOptions: "CVTCIL/C++" },
                0x00c0: { isCompiler: 1, richVersion: "16.10", richOptions: "LTCG/C" },
                0x00c1: { isCompiler: 1, richVersion: "16.10", richOptions: "LTCG/C++" },
                0x00c2: { isCompiler: 1, richVersion: "16.10", richOptions: "LTCG/MSIL" },
                0x00c3: { isCompiler: 1, richVersion: "16.10", richOptions: "POGO_I_C" },
                0x00c4: { isCompiler: 1, richVersion: "16.10", richOptions: "POGO_I_C" },
                0x00c5: { isCompiler: 1, richVersion: "16.10", richOptions: "POGO_O_C" },
                0x00c6: { isCompiler: 1, richVersion: "16.10", richOptions: "POGO_O_CPP" },
                0x00cc: { isLinker: 1, richVersion: "11.00" },
                0x00cd: { isMasm: 1, richVersion: "11.00" },
                0x00ce: { isCompiler: 1, richVersion: "17.00", richOptions: "C" },
                0x00cf: { isCompiler: 1, richVersion: "17.00", richOptions: "C++" },
                0x00d0: { isCompiler: 1, richVersion: "17.00", richOptions: "CVTCIL/C" },
                0x00d1: { isCompiler: 1, richVersion: "17.00", richOptions: "CVTCIL/C++" },
                0x00d2: { isCompiler: 1, richVersion: "17.00", richOptions: "LTCG/C" },
                0x00d3: { isCompiler: 1, richVersion: "17.00", richOptions: "LTCG/C++" },
                0x00d4: { isCompiler: 1, richVersion: "17.00", richOptions: "LTCG/MSIL" },
                0x00d5: { isCompiler: 1, richVersion: "17.00", richOptions: "POGO_I_C" },
                0x00d6: { isCompiler: 1, richVersion: "17.00", richOptions: "POGO_I_C" },
                0x00d7: { isCompiler: 1, richVersion: "17.00", richOptions: "POGO_O_C" },
                0x00d8: { isCompiler: 1, richVersion: "17.00", richOptions: "POGO_O_CPP" },
                0x00de: { isLinker: 1, richVersion: "12.00" },
                0x00df: { isMasm: 1, richVersion: "12.00" },
                0x00e0: { isCompiler: 1, richVersion: "18.00", richOptions: "C" },
                0x00e1: { isCompiler: 1, richVersion: "18.00", richOptions: "C++" },
                0x00e2: { isCompiler: 1, richVersion: "18.00", richOptions: "CVTCIL/C" },
                0x00e3: { isCompiler: 1, richVersion: "18.00", richOptions: "CVTCIL/C++" },
                0x00e4: { isCompiler: 1, richVersion: "18.00", richOptions: "LTCG/C" },
                0x00e5: { isCompiler: 1, richVersion: "18.00", richOptions: "LTCG/C++" },
                0x00e6: { isCompiler: 1, richVersion: "18.00", richOptions: "LTCG/MSIL" },
                0x00e7: { isCompiler: 1, richVersion: "18.00", richOptions: "POGO_I_C" },
                0x00e8: { isCompiler: 1, richVersion: "18.00", richOptions: "POGO_I_C" },
                0x00e9: { isCompiler: 1, richVersion: "18.00", richOptions: "POGO_O_C" },
                0x00ea: { isCompiler: 1, richVersion: "18.00", richOptions: "POGO_O_CPP" },
                0x00f0: { isLinker: 1, richVersion: "12.10" },
                0x00f1: { isMasm: 1, richVersion: "12.10" },
                0x00f2: { isCompiler: 1, richVersion: "18.10", richOptions: "C" },
                0x00f3: { isCompiler: 1, richVersion: "18.10", richOptions: "C++" },
                0x00f4: { isCompiler: 1, richVersion: "18.10", richOptions: "CVTCIL/C" },
                0x00f5: { isCompiler: 1, richVersion: "18.10", richOptions: "CVTCIL/C++" },
                0x00f6: { isCompiler: 1, richVersion: "18.10", richOptions: "LTCG/C" },
                0x00f7: { isCompiler: 1, richVersion: "18.10", richOptions: "LTCG/C++" },
                0x00f8: { isCompiler: 1, richVersion: "18.10", richOptions: "LTCG/MSIL" },
                0x00f9: { isCompiler: 1, richVersion: "18.10", richOptions: "POGO_I_C" },
                0x00fa: { isCompiler: 1, richVersion: "18.10", richOptions: "POGO_I_C" },
                0x00fb: { isCompiler: 1, richVersion: "18.10", richOptions: "POGO_O_C" },
                0x00fc: { isCompiler: 1, richVersion: "18.10", richOptions: "POGO_O_CPP" },
                0x0102: { isLinker: 1, richVersion: "14.00" },
                0x0103: { isMasm: 1, richVersion: "14.00" },
                0x0104: { isCompiler: 1, richVersion: "19.00", richOptions: "C" },
                0x0105: { isCompiler: 1, richVersion: "19.00", richOptions: "C++" },
                0x0106: { isCompiler: 1, richVersion: "19.00", richOptions: "CVTCIL/C" },
                0x0107: { isCompiler: 1, richVersion: "19.00", richOptions: "CVTCIL/C++" },
                0x0108: { isCompiler: 1, richVersion: "19.00", richOptions: "LTCG/C" },
                0x0109: { isCompiler: 1, richVersion: "19.00", richOptions: "LTCG/C++" },
                0x010a: { isCompiler: 1, richVersion: "19.00", richOptions: "LTCG/MSIL" },
                0x010b: { isCompiler: 1, richVersion: "19.00", richOptions: "POGO_I_C" },
                0x010c: { isCompiler: 1, richVersion: "19.00", richOptions: "POGO_I_C" },
                0x010d: { isCompiler: 1, richVersion: "19.00", richOptions: "POGO_O_C" },
                0x010e: { isCompiler: 1, richVersion: "19.00", richOptions: "POGO_O_CPP" }
            };

            var richInfo = richIdMap[richId];
            if (richInfo) {
                isLinker = richInfo.isLinker || 0;
                isCompiler = richInfo.isCompiler || 0;
                isMasm = richInfo.isMasm || 0;
                isBasic = richInfo.isBasic || 0;
                richVersion = richInfo.richVersion || String();
                richOptions = richInfo.richOptions || String();
            }

            var formattedVersion = richVersion + "." + PE.getRichVersion(i);

            if (isLinker && richVersion == "14.00" || isMasm && richVersion == "14.00" || isCompiler && richVersion == "19.00") {
                var buildNumber = PE.getRichVersion(i);
                var minorVersion = 0;

                if (buildNumber > 25000) {
                    if (buildNumber < 25506) minorVersion = 10;
                    else if (buildNumber < 25830) minorVersion = 11;
                    else if (buildNumber < 26128) minorVersion = 12;
                    else if (buildNumber < 26428) minorVersion = 13;
                    else if (buildNumber < 26726) minorVersion = 14;
                    else if (buildNumber < 26926) minorVersion = 15;
                    else if (buildNumber < 27508) minorVersion = 16;
                    else if (buildNumber < 27702) minorVersion = 20;
                    else if (buildNumber < 27905) minorVersion = 21;
                    else if (buildNumber < 28105) minorVersion = 22;
                    else if (buildNumber < 28314) minorVersion = 23;
                    else if (buildNumber < 28610) minorVersion = 24;
                    else if (buildNumber < 28805) minorVersion = 25;
                    else if (buildNumber < 29110) minorVersion = 26;
                    else if (buildNumber < 29333) minorVersion = 27;
                    else if (buildNumber < 30133) minorVersion = 28;
                    else if (buildNumber < 30401) minorVersion = 29;
                    else if (buildNumber < 30818) minorVersion = 30;
                    else if (buildNumber < 31114) minorVersion = 31;
                    else if (buildNumber < 31424) minorVersion = 32;
                    else if (buildNumber < 31721) minorVersion = 33;
                    else if (buildNumber < 32019) minorVersion = 34;
                    else if (buildNumber < 32019) minorVersion = 34;
                    else if (buildNumber < 32323) minorVersion = 35;
                    else if (buildNumber < 32532) minorVersion = 36;  // VS 2022 17.6.x
                    else if (buildNumber < 32543) minorVersion = 36;  // VS 2022 17.6.x (14.36.32532-14.36.32535)
                    else if (buildNumber < 32822) minorVersion = 36;  // VS 2022 17.7.0 (14.36.32543)
                    else if (buildNumber < 33130) minorVersion = 37;  // VS 2022 17.7.x
                    else if (buildNumber < 33520) minorVersion = 38;  // VS 2022 17.8.0 (14.38.33135)
                    else if (buildNumber < 33811) minorVersion = 39;  // VS 2022 17.9.x (14.39.33520-14.39.33523)
                    else if (buildNumber < 34120) minorVersion = 40;  // VS 2022 17.10.x (14.40.33811-14.40.33818)
                    else if (buildNumber < 34436) minorVersion = 41;  // VS 2022 17.11.0 (14.41.34120)
                    else if (buildNumber < 34808) minorVersion = 42;  // VS 2022 17.12.4 (14.42.34436)
                    else if (buildNumber < 35000) minorVersion = 43;  // VS 2022 17.13.x (14.43.34808-14.43.34810)
                    else if (buildNumber < 35224) minorVersion = 44;  // VS 2022 17.14.x (14.44.35207-14.44.35223)
                    else if (buildNumber < 36000) minorVersion = 50;  // VS 2026 18.0.x-18.3.x (14.50.35503-14.50.35724)
                    else if (buildNumber < 37000) minorVersion = 51;  // VS 2026 18.0.4 (14.51.36014)
                    else minorVersion = 51;  // Future versions
                }

                if (minorVersion) {
                    if (isLinker || isMasm) {
                        formattedVersion = "14." + minorVersion + "." + buildNumber;
                    } else if (isCompiler) {
                        formattedVersion = "19." + minorVersion + "." + buildNumber;
                    }
                }
            }

            if (isLinker) {
                if (formattedVersion > richLinkerVersion) {
                    richLinkerName = "Microsoft Linker";
                    richLinkerVersion = formattedVersion;
                    richLinkerOptions = richOptions;
                }
            } else if (isCompiler) {
                if (formattedVersion > richCppCompilerVersion) {
                    richCppCompilerName = "Microsoft Visual C/C++";
                    richCppCompilerVersion = formattedVersion;
                    richCppCompilerOptions = richOptions;
                }
            } else if (isMasm) {
                if (formattedVersion > richMasmCompilerVersion) {
                    richMasmCompilerName = "MASM";
                    richMasmCompilerVersion = formattedVersion;
                    richMasmCompilerOptions = richOptions;
                }
            } else if (isBasic) {
                if (formattedVersion > richVbCompilerVersion) {
                    richVbCompilerName = "Visual Basic";
                    richVbCompilerVersion = formattedVersion;
                    richVbCompilerOptions = richOptions;
                }
            }
        }
    }

    if (richLinkerName) {
        linkerName = richLinkerName;
        linkerVersion = richLinkerVersion;
        linkerOptions = richLinkerOptions;
    }

    if (richVbCompilerName) {
        vbCompilerName = richVbCompilerName;
        vbCompilerVersion = richVbCompilerVersion;
        vbCompilerOptions = richVbCompilerOptions;
    } else if (richCppCompilerName) {
        cppCompilerName = richCppCompilerName;
        cppCompilerVersion = richCppCompilerVersion;
        cppCompilerOptions = richCppCompilerOptions;
    } else if (richMasmCompilerName) {
        masmCompilerName = richMasmCompilerName;
        masmCompilerVersion = richMasmCompilerVersion;
        masmCompilerOptions = richMasmCompilerOptions;
    }

    if (PE.isDeepScan()) {
        if (richCppCompilerName == String()) {
            if (PE.section.length >= 3) {
                var msVisualCrtPattern = "'Microsoft Visual C++ Runtime Library'"
                if (PE.isSignatureInSectionPresent(0, msVisualCrtPattern) ||
                    PE.isSignatureInSectionPresent(1, msVisualCrtPattern) ||
                    PE.isSignatureInSectionPresent(2, msVisualCrtPattern)) {
                    cppCompilerName = "Microsoft Visual C/C++";
                }
            }
        }
    }

    if (PE.isVerbose()) {
        if (richCppCompilerName == String()) {
            if (PE.isLibraryPresent("msvcrt.dll")) {
                var nMajorLinkerVersion = PE.getMajorLinkerVersion(),
                    nMinorLinkerVersion = PE.getMinorLinkerVersion();

                if (nMajorLinkerVersion >= 3 && nMajorLinkerVersion <= 14 && nMinorLinkerVersion < 40) {
                    cppCompilerName = "Microsoft Visual C/C++";
                }
            }
        }
    }

    if (PE.isVerbose()) {
        if (mfcLibraryName) {
            if (cppCompilerName == String()) {
                cppCompilerName = "Microsoft Visual C/C++";
                // TODO Version
            }
            if (linkerName == String()) {
                linkerName = "Microsoft Linker";
                // TODO Version
            }
        }

        if (cppCompilerName || richVbCompilerName || masmCompilerName) {
            if (linkerName == String()) {
                var nMajorLinkerVersion = PE.getMajorLinkerVersion(),
                    nMinorLinkerVersion = PE.getMinorLinkerVersion();

                if (nMajorLinkerVersion >= 3 && nMajorLinkerVersion <= 14 && nMinorLinkerVersion < 40) {
                    linkerName = "Microsoft Linker";
                }
            }
        }
    }

    if (linkerName) {
        if (linkerVersion == String()) {
            var nMajorLinkerVersion = PE.getMajorLinkerVersion(),
                nMinorLinkerVersion = PE.getMinorLinkerVersion();

            if (nMajorLinkerVersion >= 3 && nMajorLinkerVersion <= 14 && nMinorLinkerVersion < 40) {
                linkerVersion = PE.getCompilerVersion();
            }
        }
    }

    if (cppCompilerName && linkerName) {
        var linkerMajorVersion = linkerVersion.match(/\d+\.\d+/gm);

        if (linkerMajorVersion) {
            toolName = "Microsoft Visual Studio";

            var vsVersionMap = {
                "6.00": "6.0",
                "7.00": "2002",
                "7.10": "2003",
                "8.00": "2005",
                "9.00": "2008",
                "10.00": "2010",
                "11.00": "2012",
                "12.00": "2013",
                "14.00": "2015",
                "14.10": "2017, 15.0-15.2",
                "14.11": "2017, 15.3",
                "14.12": "2017, 15.5",
                "14.13": "2017, 15.6",
                "14.14": "2017, 15.7",
                "14.15": "2017, 15.8",
                "14.16": "2017, 15.9",
                "14.20": "2019, 16.0",
                "14.21": "2019, 16.1",
                "14.22": "2019, 16.2",
                "14.23": "2019, 16.3",
                "14.24": "2019, 16.4",
                "14.25": "2019, 16.5",
                "14.26": "2019, 16.6",
                "14.27": "2019, 16.7-16.8",
                "14.28": "2019, 16.9-16.10",
                "14.29": "2019, 16.11",
                "14.30": "2022, 17.0",
                "14.31": "2022, 17.1",
                "14.32": "2022, 17.2",
                "14.33": "2022, 17.3",
                "14.34": "2022, 17.4",
                "14.35": "2022, 17.5",
                "14.36": "2022, 17.6",
                "14.37": "2022, 17.7",
                "14.38": "2022, 17.8",
                "14.39": "2022, 17.9.1",
                "14.40": "2022, 17.10",
                "14.41": "2022, 17.11",
                "14.42": "2022, 17.12",
                "14.43": "2022, 17.13",
                "14.44": "2022, 17.14",
                "14.50": "2026, 18.0-18.3",
                "14.51": "2026, 18.4"
            };

            toolVersion = vsVersionMap[linkerMajorVersion] || "";
        }
    }

    if (masmCompilerVersion == "6.14.8444" && linkerVersion == "5.12.8078") {
        toolName = "MASM32";
        toolVersion = "8-11";
    }

    if (vbCompilerName) {
        _setLang("VB" + (vbCompilerName.indexOf(".NET") !== -1 ? ".NET" : ""));
        _setResult("compiler", vbCompilerName, vbCompilerVersion, vbCompilerOptions);
    } else if (cppCompilerName) {

        if (!_isResultPresent("compiler", "Rust")) { // check is Rust detected

            if (cppCompilerOptions.indexOf("C++") !== -1 || cppCompilerOptions.indexOf("CPP") !== -1) {
                _setLang("C++");
            } else if (cppCompilerOptions == "C" || cppCompilerOptions.indexOf("/C") !== -1 || cppCompilerOptions.indexOf("_C") !== -1) {
                _setLang("C");
            } else {
                _setLang("C/C++");
            }

        }

        // if not detected
        if (!_isResultPresent("compiler", cppCompilerName)) _setResult("compiler", cppCompilerName, cppCompilerVersion, cppCompilerOptions);
    } else if (masmCompilerName) {
        _setLang("ASMx" + (PE.is64() ? "64" : "86"));
        _setResult("compiler", masmCompilerName, masmCompilerVersion, masmCompilerOptions);
    }


    if (dotNetLibraryName) {

        if (PE.isNetObjectPresent("FSharp.Core")) _setLang("F#");
        if (!_isLangDetected()) _setLang("MSIL/C#");

        _setResult("library", dotNetLibraryName, dotNetLibraryVersion, dotNetLibraryOptions);
    }

    if (mfcLibraryName) {
        _setResult("library", mfcLibraryName, mfcLibraryVersion, mfcLibraryOptions);
    }

    if (linkerName && _getNumberOfResults("linker") < 1) {
        _setResult("linker", linkerName, linkerVersion, linkerOptions);
    }

    if (toolName && toolVersion) {
        _setResult("tool", toolName, toolVersion, toolOptions);
    }
}

function getVbOptions() {
    var result = String();

    // Check if sections exist before accessing section[0]
    if (PE.getNumberOfSections() === 0) {
        return result;
    }
    var firstSection = PE.section[0];

    var vbSignatureOffset = PE.findDword(firstSection.FileOffset, firstSection.FileSize, 0x21354256);

    if (vbSignatureOffset === -1) {
        vbSignatureOffset = PE.findDword(firstSection.FileOffset, firstSection.FileSize, 0x21364256);
    }

    if (vbSignatureOffset !== -1) {
        var virtualAddress = PE.readDword(vbSignatureOffset + 0x30),
            fileOffset = PE.VAToOffset(virtualAddress);

        if (fileOffset !== -1) {
            result = (PE.readDword(fileOffset + 0x20) === 0) ? "P-Code" : "Native";
        }
    }

    return result;
}


================================================
FILE: db/PE/Microsoft_Class_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Microsoft Class Installer for Java");

function detect() {
    if (PE.compareEP("64A1........558BEC6A..68........68........50648925........83EC..5356578965..FF15")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.resource[i].Type == 280) { // ZIP
                if (PE.compare("'PK'0304", PE.resource[i].Offset)) {
                    sVersion = "4.X";
                    sOptions = "zip";
                    bDetected = true;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/Microsoft_Compound-based_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Microsoft Compound-based installer (MSI)");

function detect() {
    if (PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c05568........64ff3064892033c05568") &&
        PE.compareOverlay("d0cf11e0a1b11ae1")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/Microsoft_Help.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "Microsoft Help (compiled) (.hxs)");

function detect() {
    if (PE.isSectionNamePresent(".its")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/Microsoft_JScript.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "JScript");

function detect() {
    if (PE.isNetObjectPresent("Microsoft.JScript.Vsa")) {
        bDetected = true;
    }

    sLang = "JavaScript";

    return result();
}


================================================
FILE: db/PE/_FixDetects.9.sg
================================================
// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function detect() {
    removeFalsePositive({
        falsePositive: { packer: "AHpacker" },
        ifPresents: { packer: "ExE Pack" }
    });

    removeFalsePositive({
        falsePositive: { linker: "Turbo Linker" },
        ifPresents: { linker: "Microsoft Linker" }
    });

    removeFalsePositive({
        falsePositive: { tool: "Borland Delphi" },
        ifPresents: { tool: "Microsoft Linker" }
    });

    removeFalsePositive({
        falsePositive: { compiler: "FASM", language: "ASMx86" },
        ifPresents: { packer: "Simple Pack" }
    });

    // Number of "compiler" more than 1? Remove Visual C++.
    if (_isResultPresent("compiler", "Microsoft Visual C/C++") && _getNumberOfResults("compiler") > 1) {
        _removeResult("compiler", "Microsoft Visual C/C++");

        if (_getNumberOfResults("language") > 1 && _isLangPresent("C/C++")) {
            _removeResult("language", "C/C++");
        }
    }

    // Visual Studio? -> C#
    if (_isLangPresent("MSIL/C#") && _isResultPresent("tool", "Microsoft Visual Studio")) {
        _removeResult("language", "MSIL/C#");
        _setLang("C#");
    }
}

function removeFalsePositive(data) {

    var falsePositive = data.falsePositive,
        ifPresents = data.ifPresents;

    var falsePositiveKey = String(),
        falsePositiveValue = String();

    for (var key in falsePositive) {
        if (falsePositive.hasOwnProperty(key)) {
            falsePositiveKey = key;
            falsePositiveValue = falsePositive[key];
            break;
        }
    }

    var ifPresentsKey = String(),
        ifPresentsValue = String();

    for (var key in ifPresents) {
        if (ifPresents.hasOwnProperty(key)) {
            ifPresentsKey = key;
            ifPresentsValue = ifPresents[key];
            break;
        }
    }

    if (_isResultPresent(falsePositiveKey, falsePositiveValue) && _isResultPresent(ifPresentsKey, ifPresentsValue)) {
        _removeResult(falsePositiveKey, falsePositiveValue);
    }
}

================================================
FILE: db/PE/_NetCompilersLibs.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function detect() {
    // https://github.com/0xd4d/dnlib
    if (PE.isNetObjectPresent("dnlib") && PE.isNetObjectPresent("ModuleDef"))
        _setResult("library", "dnlib", "", "");

    // https://www.mono-project.com/docs/tools+libraries/libraries/Mono.Cecil/
    if (PE.isNetObjectPresent("Mono.Cecil"))
        _setResult("library", "Mono.Cecil", "", "");

    // https://github.com/Washi1337/AsmResolver
    if (PE.isNetObjectPresent("AsmResolver"))
        _setResult("library", "AsmResolver", "", "");

    // https://learn.microsoft.com/en-us/dotnet/framework/reflection-and-codedom/using-the-codedom
    if (PE.isNetObjectPresent("System.CodeDom.Compiler")) { // Standard .NET library
        var languages = "";

        if (PE.isNetObjectPresent("CSharpCodeProvider"))
            languages = "C#";

        if (PE.isNetObjectPresent("VBCodeProvider"))
            languages += (languages ? " + " : "") + "VB.NET";

        if (PE.isNetObjectPresent("JScriptCodeProvider")) // Should check the relation to System.CodeDom......
            languages += (languages ? " + " : "") + "JScript";

        if (languages) {
            _setResult("library", "CodeDom Compiler", "", languages);
        }
    }
}

================================================
FILE: db/PE/_PE.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("operation system", "Windows");

function detect() {
    if (PE.isVerbose()) {
        sName = PE.getOperationSystemName();
        sOptions = PE.getOperationSystemOptions();

        bDetected = true;

        var rossymSection = PE.section[".rossym"];

        if (rossymSection && rossymSection.Characteristics == 0x42000802) {
            sVersion = "React OS, 0.3+";
        } else {
            sVersion = PE.getOperationSystemVersion();
        }
    }

    return result();
}


================================================
FILE: db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

/*
              ██████╗ ███████╗███╗   ██╗███████╗██████╗ ██╗ ██████╗
             ██╔════╝ ██╔════╝████╗  ██║██╔════╝██╔══██╗██║██╔════╝
             ██║  ███╗█████╗  ██╔██╗ ██║█████╗  ██████╔╝██║██║
             ██║   ██║██╔══╝  ██║╚██╗██║██╔══╝  ██╔══██╗██║██║
             ╚██████╔╝███████╗██║ ╚████║███████╗██║  ██║██║╚██████╗
              ╚═════╝ ╚══════╝╚═╝  ╚═══╝╚══════╝╚═╝  ╚═╝╚═╝ ╚═════╝
   ██╗    ██╗  ██╗███████╗██╗   ██╗██████╗ ██╗███████╗████████╗██╗ ██████╗    ██╗
  ██╔╝    ██║  ██║██╔════╝██║   ██║██╔══██╗██║██╔════╝╚══██╔══╝██║██╔════╝    ╚██╗
 ██╔╝     ███████║█████╗  ██║   ██║██████╔╝██║███████╗   ██║   ██║██║          ╚██╗
 ╚██╗     ██╔══██║██╔══╝  ██║   ██║██╔══██╗██║╚════██║   ██║   ██║██║          ██╔╝
  ╚██╗    ██║  ██║███████╗╚██████╔╝██║  ██║██║███████║   ██║   ██║╚██████╗    ██╔╝
   ╚═╝    ╚═╝  ╚═╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═╝╚══════╝   ╚═╝   ╚═╝ ╚═════╝    ╚═╝
            █████╗ ███╗   ██╗ █████╗ ██╗  ██╗   ██╗███████╗██╗███████╗
           ██╔══██╗████╗  ██║██╔══██╗██║  ╚██╗ ██╔╝██╔════╝██║██╔════╝
           ███████║██╔██╗ ██║███████║██║   ╚████╔╝ ███████╗██║███████╗
           ██╔══██║██║╚██╗██║██╔══██║██║    ╚██╔╝  ╚════██║██║╚════██║
           ██║  ██║██║ ╚████║██║  ██║███████╗██║   ███████║██║███████║
           ╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚══════╝╚═╝   ╚══════╝╚═╝╚══════╝
*/

//       ┌──────────────────────────┤ ABOUT ├──────────────────────────┐
//       │     This heuristic analysis helps detect the presence of    │
//       │     obfuscation, packers, licensing systems, debugging      │
//       │     information, file integrity issues, or even potential   │
//       │     malicious code using advanced and complex checks. It    │
//       │     includes pinpoint scanning, intelligent inspections,    │
//       │     signature-based analysis, thorough file content         │
//       │     evaluation, and much more! >:)                          │
//       │                                                             │
//       │     Supported archictures:                                  │
//       │      1.  I386 (x86_32)            2.  AMD64 (x86_64)        │
//       │      3.  ARM                      4.  ARM THUMB             │
//       │      5.  ARMNT (ARMv7)                                      │
//       │                                                             │
//       └─────────────────────────────────────────────────────────────┘

//       ┌─────────────────────────┤ CONTACTS ├────────────────────────┐
//       │       ┌ Author is DosX                                      │
//       │       └┬─ E-Mail: collab@kay-software.ru                    │
//       │        ├─ GitHub: https://github.com/DosX-dev               │
//       │        └─ Telegram: @DosX_dev                               │
//       ├─────────────────────────────────────────────────────────────┤
//       │      If I don't respond to email, message to Telegram       │
//       └─────────────────────────────────────────────────────────────┘

//       ┌──────────────────────────┤ DONATE ├─────────────────────────┐
//       │  ┌ Did you like my work? Thank you! What about donation?    │
//       │  │ This will greatly help the development!                  │
//       │  └─┐                                                        │
//       │    ├─ BTC:   bc1qclzlujunh8zyyxaar8y8t0chwfardesq9uvphh     │
//       │    │                                                        │
//       │    ├─ SOL:   6693kpkspRU2fauVpMkVznnETGX7GdMsLFQED6QFfaWa   │
//       │    │                                                        │
//       │    ├─ TRX:   TYezKdq5YkrSmmUy6d9e212KcHxQigtTqJ             │
//       │    │                                                        │
//       │    ├─ ETH:   0xd5f1e450a4A9325165ed6b5ed5E28Da882AB932a     │
//       │    │  ERC-20 ─┘                                             │
//       │    │                                                        │
//       │    └─ USDT:  TYezKdq5YkrSmmUy6d9e212KcHxQigtTqJ             │
//       │       TRC-20 ─┘                                             │
//       └─────────────────────────────────────────────────────────────┘

//              ┌───────────────────────────────────────────────┐
//              │   For the module to work correctly, official  │
//              │   Detect It Easy components are recommended   │
//              ├───────────────────────────────────────────────┘
//              └─┐
//                └──  Please don't read the code out loud
//                     unless you have exorcism skills

"use strict";

const
    PE_Cached = {}, // PE-related cache-map
    logType = {
        warning: -2, // Service warnings
        about: -1,   // Information about a module
        nothing: 0,  // General information about the scanning process
        any: 1,      // Native and .NET
        net: 2       // .NET only
    },
    heurLabel = "HEUR";

var lastOffsetDetected = "0x00";



function detect() {
    if (stubForWrongEnvironment()) return null; // 'PE' is undefined
    if (stubForLegacyEngines()) return null; // old DIE version

    return main();
}



function main() {
    initializeCache();

    if (PE.isHeuristicScan()) {
        if (!PE.isVerbose()) {
            log(logType.warning, "To get the full heuristic scan result use \"--verbose\"");
        }

        log(logType.about, "Generic Heuristic Analysis by DosX (@DosX_dev)");

        log(logType.nothing, "Scanning has begun!");

        if (PE_Cached.isDotNet) {
            // Detection obfuscation and anti-analysis techniques specific to .NET
            scanForObfuscations_NET();
            scanForAntiAnalysis_NET();
        } else {
            // Detection of anomalies specific to Native
            scanForObfuscations_Native();
        }

        // Detection of anomalies most commonly found in packers, cryptors, protectors...
        scanForPackersAndCryptors_NET_and_Native();

        // Detection licensing information (detecting possible DRM systems or licensing strings)
        scanForLicensingSystems_NET_and_Native();

        // A cursory checks of the file format integrity
        scanForBadFileFormat_NET_and_Native();

        // Detection of debug information (headers, sections, strings...)
        scanForDebugData_NET_and_Native();

        // Detection for suspicious or potentially malicious patterns
        scanForMaliciousCode_NET_and_Native();

        if (PE.isVerbose()) {
            // Detection of programming language, compiler, linker
            scanForLanguagesAndCompilers_NET_and_Native();

            // Detection of specific markers and pointers that are read by the operating system
            scanForInterestingMarkers_NET_and_Native();
        }

        // >> Happy end <<
        log(logType.nothing, "Scan completed.");
    } else {
        log(logType.warning, "Heuristic scan is disabled. Use '--heuristicscan' to enable");
    }

    unloadCache();
}



function stubForLegacyEngines() {
    if (typeof PE.getNetAssemblyName === "undefined") {
        stdout(">>> Update DIE Engine to 3.20 and higher for using Heuristic-analyzer by DosX <<<");
        debugger;
        return true;
    }

    return false;
}



function stubForWrongEnvironment() {
    if (typeof PE === "undefined") {
        stdout(">>> Wrong environment! 'PE' is undefined. Check DIE-engine for correct installation <<<");
        debugger;
        return true;
    }

    if (PE.isHeuristicScan() && PE.isVerbose() && !_getNumberOfResults("operation system")) {
        stdout(">>> Script is running outside the environment! Are you in debug mode? <<<");
        debugger;
    }

    return false;
}



/**
 * Outputs a warning message to the appropriate output stream.
 *
 * Depending on the environment, this function will:
 * - Use `console.warn` if `console` is available.
 * - Use `_setResult` if `File` is available.
 * - Use `_error` if it is defined as a function.
 * - Throw an error if none of the above conditions are met.
 *
 * @param {string} stringToOut - The warning message to output.
 * @returns {void} No return value;
 */
function stdout(stringToOut) {
    if (typeof console === "object") {
        console.warn(stringToOut);
    } else if (typeof File === "object") {
        _setResult("~warning", stringToOut, String(), String());
    } else {
        if (typeof _error === "function") {
            _error(stringToOut);
        } else {
            throw stringToOut;
        }
    }
}



/**
 * Initialize the PE-related cache by reading values from the PE API and storing them
 * into the global PE_Cached object.
 *
 * The function constructs a temporary map containing typed entries sourced from the PE
 * interface, then copies each entry into PE_Cached.
 *
 * Side effects:
 *  - Mutates the global PE_Cached object by adding/updating the keys listed above.
 *
 * @function initializeCache
 * @returns {void} No return value; updates PE_Cached as a side effect.
 */
function initializeCache() {
    var cacheMap = {
       /* Local functions */
       /* Boolean */ isArchX86: isArchX86,
       /* Boolean */ isCppClrLikeApp: isCppClrLikeApp,
       /* Boolean */ isVbNetStandardLibraryPresent: isVbNetStandardLibraryPresent,
       /* Boolean */ isJscriptNetStandardLibraryPresent: isJscriptNetStandardLibraryPresent,
       /* String  */ firstEpAsmInstruction: getFirstEpAsmInstruction,
       /* Native functions */
       /* Boolean */ is64bit: PE["is64"],
       /* Boolean */ isDotNet: PE["isNet"],
       /* Boolean */ isDynamicLinkLibrary: PE["isDll"],
       /* Boolean */ isNetGlobalCctorPresent: PE["isNetGlobalCctorPresent"],
       /* Boolean */ isRichSignaturePresent: PE["isRichSignaturePresent"],
       /* Number  */ numberOfSections: PE["getNumberOfSections"],
       /* Number  */ numberOfRichIDs: PE["getNumberOfRichIDs"],
       /* Number  */ numberOfUnmanagedResources: PE["getNumberOfResources"],
       /* Number  */ numberOfUnmanagedImports: PE["getNumberOfImports"],
       /* Number  */ numberOfUnmanagedExports: PE["getNumberOfExports"],
       /* Number  */ indexOfImportsSection: PE["getImportSection"],
       /* Number  */ indexOfExportsSection: PE["getExportSection"],
       /* String  */ nameOfNetAssemblyName: PE["getNetAssemblyName"],
       /* String  */ nameOfNetModuleName: PE["getNetModuleName"]
    };

    for (var key in cacheMap) {
        const functionBody = cacheMap[key];

        if (functionBody) {
            PE_Cached[key] = functionBody();
        } else {
            stdout(">>> PE API function '" + key + "' is undefined! <<<");
            debugger;
        }
    }
}



/**
 * Clears the PE cache by setting it to undefined.
 * 
 * @function unloadCache
 * @returns {void} No return value; sets PE_Cached to undefined.
 */
function unloadCache() {
    PE_Cached = undefined;
}



// #region "obfuscations (.NET)"
function scanForObfuscations_NET() {
    log(logType.nothing, "Scanning for obfuscation...");

    var options = String();

    var isDetected = Boolean();




    // Is managed entry point modified? Let's check it using default .NET EP names

    var isEntryPointModified = false;

    const vbNetEntries = [
        "Main",
        "main",
        "MAIN",
        "MyApplication"
    ], defaultEntries = [ // like MSIL, C#, C++ NET etc
        "Main",
        "main", // F# entry
        "main@", // F# entry
        "<Main>$", // For programs with top-level operators (C#)
        "mainCRTStartup", // C++ CLR .NET (CLI)
        "wWinMainCRTStartup", // C++ CLR .NET (GUI)
        "_WinMainCRTStartup"
    ]

    if (!PE_Cached.isDynamicLinkLibrary) {
        if (PE_Cached.isVbNetStandardLibraryPresent) {
            if (isAllNetReferencesMissing(vbNetEntries)) {
                isEntryPointModified = true;
            }
        } else if (isAllNetReferencesMissing(defaultEntries)) {
            isEntryPointModified = true;
        }

        if (isEntryPointModified) {
            log(logType.net, "No \"Main\" method found");
        }
    }

    if (isEntryPointModified) options = "Modified managed EP";




    // <Module>.cctor can execute code before the Main method is called 

    var isNetCctorPresent = false;

    if (PE_Cached.isNetGlobalCctorPresent && !PE_Cached.isCppClrLikeApp && !isUnpackagedWindowsAppSdkLinked()) {
        log(logType.net, "Global constructor detected!");

        isNetCctorPresent = true;
    }

    if (isNetCctorPresent) options = addOption(options, "CLR constructor");




    // If .NET meta headers are not present in the default .NET section, then the file is mutant

    var isStrangeEpPosition = false;

    const netMetaHeaders = [
        "~",
        "Strings",
        "US",
        "GUID",
        "Blob"
    ];

    // Specify the default .NET section index
    const defaultNetSection = 0;

    // Check conditions for a strange entry point position (not for CLR apps)
    if (!PE_Cached.isDynamicLinkLibrary && PE_Cached.numberOfSections > 1 && !PE_Cached.isCppClrLikeApp) {
        // Iterate through .NET metadata headers
        for (var s = 0; s < netMetaHeaders.length; s++) {
            const headerName = netMetaHeaders[s];

            // Check if the signature is not present in the default .NET section
            if (!PE.isSignatureInSectionPresent(defaultNetSection, "00'#" + headerName + "'00")) {
                isStrangeEpPosition = true;
                break;
            }
        }
    }

    if (isStrangeEpPosition) options = addOption(options, "Strange EP position");




    // .NET files has a specific pattern of the entry point

    var isNativeEntryPointModified = false;

    if (!PE_Cached.isDynamicLinkLibrary && !PE_Cached.isCppClrLikeApp) { // not for CLR apps
        if (!PE_Cached.is64bit && PE_Cached.isArchX86) {
            // FF2500????00: jmp dword ptr [ ... ]
            const firstOpCode = getFirstEpAsmOpCode();

            if (firstOpCode !== "JMP") {
                if (PE.VAToOffset(PE.getAddressOfEntryPoint()) !== -1) {
                    log(logType.net, "Very strange EP pattern: " + getEpAsmPattern(true, 4).split("|").join(" .. "));
                } else {
                    log(logType.net, "No native entry point");
                }

                isNativeEntryPointModified = true;
            }
        } else { // AMD64
            if (PE.VAToOffset(PE.getAddressOfEntryPoint()) !== 0x00) {
                isNativeEntryPointModified = true;
            }
        }
    }

    if (isNativeEntryPointModified) options = addOption(options, "Modified native EP");




    // Check if the specified DOS message is not found in the DOS stub

    var isDosMessageModified = false;

    if (PE.findSignature(PE.getDosStubOffset(), PE.getDosStubSize(), "'This program cannot be run in DOS mode.'") === -1) {
        log(logType.net, "DOS-stub modified!");

        isDosMessageModified = true;
    }

    if (isDosMessageModified) options = addOption(options, "Modified DOS");




    // PE file must contain at least two sections: one for code and one for resources.

    var isOneSectionFile = false;

    if (PE_Cached.numberOfSections === 1) {
        log(logType.net, "Only one section found!");

        isOneSectionFile = true;
    }

    if (isOneSectionFile) options = addOption(options, "Only one section");




    // Check for strange sections

    var isStrangeSectionsPresent = false;

    const badChars = '_-=+~!@#$%^&*()"№;%:?*():;,/\\|\'`<>.0123456789'; // Very very bad!

    if (PE_Cached.numberOfSections > (!PE_Cached.isCppClrLikeApp ? 6 : 10) || !PE.section[".text"]) { isStrangeSectionsPresent = true; } else {
        // Iterate through each section
        for (var i = 0; i < PE_Cached.numberOfSections && !isStrangeSectionsPresent; i++) {
            const sectionName = PE.getSectionName(i);

            // Check if the first character is not "." and the length of name is less than 3
            if (sectionName[0] !== "." && sectionName.length < 3) {
                isStrangeSectionsPresent = true;
                break;
            }

            // Iterate through characters after "."
            // Check if the character is in the badChars list
            for (var d = 0; d < badChars.length && !isStrangeSectionsPresent; d++) {
                if (sectionName.substr(1, sectionName.length).indexOf(badChars[d]) !== -1) {
                    isStrangeSectionsPresent = true;
                }
            }

            if (!isAsciiString(sectionName) && !isStrangeSectionsPresent) {
                isStrangeSectionsPresent = true;
            }
        }
    }

    if (isStrangeSectionsPresent) options = addOption(options, "Strange sections");




    // Check for strange resources

    var isStrangeUnmanagedResourcesPresent = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedResources && !isStrangeUnmanagedResourcesPresent; i++) {
        const unmanagedResourceName = PE.getResourceNameByNumber(i);

        if (unmanagedResourceName && (!isAsciiString(unmanagedResourceName) || isNameObfuscated(unmanagedResourceName))) {
            log(logType.net, "Strange unmanaged resource name: " + unmanagedResourceName);

            isStrangeUnmanagedResourcesPresent = true;
        }
    }

    if (isStrangeUnmanagedResourcesPresent) options = addOption(options, "Strange unmanaged resources");




    // Check for a lot of sections (more than 10 -> this is a lot for .NET)

    var tooManySectionsPresent = false;

    if (PE_Cached.numberOfSections > 10) {
        tooManySectionsPresent = true;
    }

    if (tooManySectionsPresent) options = addOption(options, "Too many sections");




    const opCodes = new NetOpCodes();




    // A popular way to obfuscate numbers/booleans

    var isIntConfusionPresent = false;

    const intConfusionXorPattern = opCodes.ldc_i4 + opCodes.ldc_i4 + opCodes.xor + opCodes.ldc_i4;

    if (validateNetByteCode(intConfusionXorPattern)) {
        if (validateNetByteCode( // samples by: Inx Obfuscator
            intConfusionXorPattern +
            (opCodes.setStrict(opCodes.bne_un_s, "09") + opCodes.ldc_i4_2 + opCodes.stloc_0 + opCodes.sizeof + opCodes.add)
        ) ||
            validateNetByteCode( // samples by: MindLated, NetShield
                intConfusionXorPattern +
                (opCodes.bne_un + opCodes.ldc_i4 + opCodes.stloc + opCodes.sizeof + opCodes.add)
            ) ||
            validateNetByteCode( // samples by: VavilonProtect
                intConfusionXorPattern +
                (opCodes.bne_un + opCodes.ldc_i4_2 + opCodes.stloc_s + opCodes.sizeof + opCodes.add)
            )
        ) {
            log(logType.net, "Int confusion detected! Offset: " + lastOffsetDetected);

            isIntConfusionPresent = true;
        }
    }

    if (isIntConfusionPresent) options = addOption(options, "Int confusion");




    // Virtualization is a method of protection in which some code segments are rewritten into instructions inherent in the built-in virtual machine and executed by it

    var isVirtualizationPresent = false;

    if (
        isAllNetReferencesPresent(
            [
                "System.Reflection", // System.Reflection.dll
                "GetILGenerator", // MSIL: 'System.Reflection.Emit.DynamicMethod::GetILGenerator()'
                "BeginInvoke",
                "EndInvoke",
                "OpCode" // MSIL: 'System.Reflection.Emit.OpCode'
            ]
        ) &&
        (
            validateNetObject("Ldarg_0") || // MSIL: 'System.Reflection.Emit.OpCodes.Ldarg_0'
            validateNetObject("CreateDelegate") // MSIL: 'System.Delegate.CreateDelegate'
        ) && !isFrameworkComponent()
    ) {
        log(logType.net, "Virtualization-like behavior detected!");

        isVirtualizationPresent = true;
    }

    if (isVirtualizationPresent) options = addOption(options, "Virtualization");




    // Hiding calls using delegate tricks

    var callsEncrypt = false;

    if (
        isAllNetReferencesPresent(
            [
                "GetTypeFromHandle", // MSIL: 'System.Type::GetTypeFromHandle( ... )'
                "BinaryReader", // MSIL: 'System.IO.BinaryReader'
                "CreateDelegate", // MSIL: '[Delegate].CreateDelegate'
                "MakeByRefType", // MSIL: 'System.Type::MakeByRefType()'
                "DynamicMethod" // MSIL: 'System.Reflection.Emit.DynamicMethod'
            ]
        ) && !isFrameworkComponent()
    ) {
        callsEncrypt = true;
    }

    if (callsEncrypt) options = addOption(options, "Calls encrypt");




    // https://learn.microsoft.com/en-us/dotnet/api/system.runtime.compilerservices.suppressildasmattribute

    var isAntiIldasmPresent = false;

    if (validateNetObject("SuppressIldasmAttribute")) {
        isAntiIldasmPresent = true;
    }

    if (isAntiIldasmPresent) options = addOption(options, "Anti-ILDASM");




    // Anti de4dot via inheritance

    var isAntiDe4dotPresent = false;

    if (
        validateSignature("'Form'******00'Form'******00'Form'******00") || // samples by: NetShield
        validateNetObject("Form0") // samples by: MindLated
    ) {
        log(logType.net, "File may be protected by de4dot!");

        isAntiDe4dotPresent = true;
    }

    if (isAntiDe4dotPresent) options = addOption(options, "Anti-de4dot");




    // An obfuscation method in which calli is used instead of regular calls

    var isCalliInvokesPresent = false;

    if (validateNetByteCode( // samples by: MindLated
        opCodes.setStrict(opCodes.ldftn, "** ?? 00 0A") +
        opCodes.setStrict(opCodes.calli, "** 00 00 11")
    ) ||
        validateNetByteCode( // samples by: ArmDot, DarksProtector
            opCodes.ldelem_i +
            opCodes.setStrict(opCodes.calli, "** 00 00 11")
        )) {
        log(logType.net, "Calli invokes detected! Offset: " + lastOffsetDetected);

        isCalliInvokesPresent = true;
    }

    if (isCalliInvokesPresent) options = addOption(options, "Calli invokes");




    // An obfuscation method that uses ldftn to create pointers to methods, which are then used in the code

    var isLdftnPointersPresent = false;

    if (validateNetByteCode(
        opCodes.nop + opCodes.setStrict(opCodes.ldftn, "** 00 00 06") + opCodes.stelem_i
    ) ||
        validateNetByteCode(
            opCodes.nop + opCodes.setStrict(opCodes.ldftn, "** 00 00 0A") + opCodes.stelem_i
        ) ||
        validateNetByteCode( // samples by: Quantum (private)
            opCodes.setStrict(opCodes.ldftn, "** 00 00 0A") +
            opCodes.setStrict(opCodes.calli, "** 00 00 11")
        )) {
        log(logType.net, "Ldftn pointers method-obfuscation detected! Offset: " + lastOffsetDetected);

        isLdftnPointersPresent = true;
    }

    if (isLdftnPointersPresent) options = addOption(options, "Ldftn pointers");




    // Turns the code into spaghetti by splitting it into blocks that it executes depending on the situation

    var isCtrlFlowPresent = false;

    if (
        validateNetByteCode( // samples by: ConfuserEx
            opCodes.nop + opCodes.ldloc_0 + opCodes.ldc_i4 + opCodes.mul + opCodes.ldc_i4 + opCodes.xor + opCodes.br_s +
            opCodes.nop + opCodes.ldloc_0 + opCodes.ldc_i4 + opCodes.mul + opCodes.ldc_i4 + opCodes.xor + opCodes.br_s
        ) ||
        validateNetByteCode( // samples by: ConfuserEx (neo mod)
            opCodes.ldc_i4 + opCodes.ldc_i4 + opCodes.xor + opCodes.dup + opCodes.stloc_0 + opCodes.ldc_i4_3 + opCodes.rem_un + opCodes.switch__nobody
        ) ||
        validateNetByteCode( // samples by: .NET Reactor (v6.9.8)
            opCodes.setStrict(opCodes.ldc_i4, "00 00 00 00") + opCodes.br + opCodes.br + opCodes.ldloc
        ) ||
        validateNetByteCode( // samples by: .NET Reactor
            opCodes.ldsfld + opCodes.brfalse + opCodes.pop +
            opCodes.setStrict(opCodes.ldc_i4, "01 00 00 00") + // MSIL: 'ldc.4 1'
            opCodes.br + opCodes.nop
        ) ||
        validateNetByteCode( // samples by: .NET Reactor
            opCodes.setNullValue(opCodes.ldc_i4) +
            opCodes.ldsfld + opCodes.brtrue + opCodes.pop + opCodes.ldc_i4 +
            opCodes.br
        ) ||
        validateNetByteCode( // samples by: .NET Reactor (legacy~~)
            opCodes.stloc + opCodes.ldloc +
            opCodes.joinNoBodyAndValue(opCodes.switch__nobody, "** ** ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00", "switch__nobody") +
            opCodes.ldc_i4 + opCodes.br
        ) ||
        validateNetByteCode( // Crypto Obfuscator
            opCodes.ldc_i4_3 + opCodes.joinNoBodyAndValue(opCodes.switch__nobody, "01 00 00 00 F6 FF FF FF") + opCodes.ldc_i4_1 + opCodes.brtrue_s + opCodes.ldtoken + opCodes.pop
        ) ||
        validateNetByteCode( // samples by: MindLated, NetShield
            opCodes.setNullValue(opCodes.ldc_i4) + // MSIL: 'ldc.i4 0'
            opCodes.stloc + opCodes.br + opCodes.nop + opCodes.ldloc +
            opCodes.setStrict(opCodes.ldc_i4, "01 00 00 00") + // MSIL: 'ldc.i4 1'
            opCodes.ceq + opCodes.brfalse
        ) ||
        validateNetByteCode( // samples by: Rose Obfuscator
            opCodes.setNullValue(opCodes.ldc_i4) + // MSIL: 'ldc.i4 0'
            opCodes.stloc + opCodes.br + opCodes.nop + opCodes.ldloc + opCodes.ldc_i4 + opCodes.ceq + opCodes.brfalse
        ) ||
        validateNetByteCode( // samples by: Smart Assembly
            opCodes.ldc_i4 + opCodes.br + opCodes.ldloc_s + opCodes.ldc_i4_s + opCodes.ldc_i4_0 + opCodes.stelem_i1 +
            opCodes.ldc_i4 + opCodes.br
        ) ||
        validateNetByteCode( // samples by: ConfuserEx (Beds mod)
            opCodes.ldc_i4 + opCodes.ldc_i4 + opCodes._unknown + opCodes.ldc_i4 + opCodes._unknown + opCodes.stloc_0 + opCodes.nop + opCodes.ldloc_0 +
            opCodes.ldc_i4 + opCodes.ldc_i4 + opCodes._unknown + opCodes.ldc_i4 + opCodes._unknown + opCodes.ceq + opCodes.brfalse_s
        ) ||
        validateNetByteCode( // samples by: DotNetPatcher
            opCodes.setStrict(opCodes.stloc_s, "05") + opCodes.nop + opCodes.ldloc_s + opCodes._unknown + opCodes.ceq + opCodes.brfalse_s + opCodes._unknown +
            opCodes.setStrict(opCodes.stloc_s, "05") + opCodes.nop + opCodes.ldloc_s + opCodes._unknown + opCodes.ceq + opCodes.brfalse_s
        ) ||
        validateNetByteCode( // samples by: VMProtect
            opCodes.ldloc_0 + opCodes.setStrict(opCodes.ldc_i4, "?? ** ** **") + opCodes._unknown + opCodes.stloc_0 +
            opCodes.ldloc_0 + opCodes.setStrict(opCodes.ldc_i4, "?? ** ** **") + opCodes.xor + opCodes.stloc_0
        ) ||
        validateNetByteCode( // samples by: VMProtect
            opCodes.setStrict(opCodes.ldc_i4, "?? ** ** **") + opCodes._unknown + opCodes.stloc_0 + opCodes.setStrict(opCodes.ldftn, "** ?? ?? ??")
        )
    ) {
        log(logType.net, "Control flow obfuscation detected! Offset: " + lastOffsetDetected);

        isCtrlFlowPresent = true;
    }

    if (isCtrlFlowPresent) options = addOption(options, "Ctrl flow");




    const afterCtorOffset = PE.findSignature(PE.getDosStubOffset() + PE.getDosStubSize(), PE.getSize() - PE.getOverlaySize(), "'<Module>'00**") + 8;




    // Indicates that the file uses short object names. Typically this indicates the presence of an obfuscation
    // There are two ways to detect short names - find one-letter objects or just use signature mask at Ctor offset :D

    var isShortNamesPresent = false;

    if (PE.compare("00**00**00", afterCtorOffset) ||
        PE.compare("00****00****00****00", afterCtorOffset) ||
        PE.compare("00******00******00******00", afterCtorOffset) ||
        PE.compare("00********00********00********00", afterCtorOffset) ||
        PE.compare("00****00****00", afterCtorOffset) ||
        PE.compare("00****00**00", afterCtorOffset) ||
        PE.compare("00**00****00", afterCtorOffset)) {
        log(logType.net, "Short names detected! (mask)");

        isShortNamesPresent = true;
    }

    if (!isShortNamesPresent && PE.compare("00**00", afterCtorOffset)) { // the second way :D
        var shortNamesFound = 0;

        const chars = "QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm";

        for (var i = 1; i < chars.length && !isShortNamesPresent; i++) {
            if (PE.isNetObjectPresent(chars[i])) {
                log(logType.net, "Short name found: \"" + chars[i] + "\" (" + shortNamesFound + "/20)");

                shortNamesFound++;
            }

            if (shortNamesFound === 20) {
                isShortNamesPresent = true;
            }
        }
    }

    if (isShortNamesPresent) options = addOption(options, "Short names");




    // Scan for strange patterns after <Module> .ctor (like "a1b2c3d4e5f6g7h8i9j0")

    var badNamings = false;

    var buffer = String();

    // get next 0x12c bytes after <Module> .ctor
    for (var i = 0; i < 0x12c; i++) {
        var currentByte = PE.readByte(afterCtorOffset + i).toString(16);

        if (currentByte === '0') currentByte += '0';

        buffer += currentByte;
        buffer += ' ';
    }

    var bufferString = String();

    // 0x00 to [0x20, 0x20, 0x20]
    const bufferArray = replaceAllInString(buffer, '00 ', '20 20 20 ').split(' ');

    // buffer to a string
    for (var i = 0; i < bufferArray.length; i++)
        bufferString += String.fromCharCode(parseInt(bufferArray[i], 16));


    const patternsToExplore = bufferString.split("   ");

    var strangePatternsCounter = 0;

    // https://web.archive.org/web/20190719134346/http://bartdesmet.net/blogs/bart/archive/2008/08/21/how-c-array-initializers-work.aspx
    var isPrivateImplementationDetailsPresent = validateNetObject("<PrivateImplementationDetails>");

    for (var i = 0; i < patternsToExplore.length && !badNamings; i++) {

        const currentStringPattern = patternsToExplore[i];

        if (isPrivateImplementationDetailsPresent && currentStringPattern.length === 40) {
            break;
        }

        if (currentStringPattern.indexOf("<") === -1 &&
            !/^([0-9A-F]{64})$/.test(currentStringPattern) && // These names may be generated by the compiler
            isNameObfuscated(currentStringPattern)) {
            strangePatternsCounter++;
        }

        if (strangePatternsCounter > 2)
            badNamings = true;

    }

    if (badNamings) options = addOption(options, "Bad namings");




    // AntiTamper protects the file from modification

    var isAntiTamperPresent = false;

    if (
        validateNetUnicodeString(" is tampered.") || // samples by: .NET Reactor
        validateNetUnicodeString("ping 127.0.0.1 > nul") || // samples by: ConfuserEx (Trinity, SkiDzEx like)
        validateNetUnicodeString("/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"") || // samples by: MindLated
        validateNetUnicodeString( // samples by: ConfuserEx
            opCodes.ldloc_s + opCodes.ldc_i4_0 + opCodes.ldloc_s + opCodes.ldc_i4_0 + opCodes.ldelem_u4 + opCodes.ldloc_s + opCodes.ldc_i4_0 + opCodes.ldelem_u4 + opCodes._unknown + opCodes.stelem_i4 +
            opCodes.ldloc_s + opCodes.ldc_i4_1 + opCodes.ldloc_s + opCodes.ldc_i4_1 + opCodes.ldelem_u4 + opCodes.ldloc_s + opCodes.ldc_i4_1 + opCodes.ldelem_u4 + opCodes._unknown + opCodes.stelem_i4 +
            opCodes.ldloc_s + opCodes.ldc_i4_2 + opCodes.ldloc_s + opCodes.ldc_i4_2 + opCodes.ldelem_u4 + opCodes.ldloc_s + opCodes.ldc_i4_2 + opCodes.ldelem_u4 + opCodes._unknown + opCodes.stelem_i4 +
            opCodes.ldloc_s + opCodes.ldc_i4_3 + opCodes.ldloc_s + opCodes.ldc_i4_3 + opCodes.ldelem_u4 + opCodes.ldloc_s + opCodes.ldc_i4_3 + opCodes.ldelem_u4 + opCodes._unknown + opCodes.stelem_i4 +
            opCodes.ldloc_s + opCodes.ldc_i4_4 + opCodes.ldloc_s + opCodes.ldc_i4_4 + opCodes.ldelem_u4 + opCodes.ldloc_s + opCodes.ldc_i4_4 + opCodes.ldelem_u4 + opCodes._unknown + opCodes.stelem_i4
        ) ||
        validateNetByteCode( // samples: ConfuserEx (Beds mod, private)
            opCodes.ldloc_s + opCodes._unknown + opCodes.shr_un + opCodes.ldloc_s + opCodes.ldc_i4_s + opCodes.shl + opCodes.or + opCodes.stloc_s +
            opCodes.ldloc_s + opCodes._unknown + opCodes.shr_un + opCodes.ldloc_s + opCodes.ldc_i4_s + opCodes.shl + opCodes.or + opCodes.stloc_s +
            opCodes.ldloc_s + opCodes._unknown + opCodes.shr_un + opCodes.ldloc_s + opCodes.ldc_i4_s + opCodes.shl + opCodes.or + opCodes.stloc_s
        )
    ) {
        log(logType.net, "Anti-tamper detected!");

        isAntiTamperPresent = true;
    }

    if (isAntiTamperPresent) options = addOption(options, "Anti-tamper");




    // If in the assembly you can find the second object starting with “<Module>”, then this is a fakeee!

    var isModuleCtorMultiple = false;

    var currentCtorOffset = PE.findSignature(PE.getDosStubOffset() + PE.getDosStubSize(), PE.getSize() - PE.getOverlaySize(), "00'<Module>'00");

    if (currentCtorOffset !== -1) {
        var secondCtorNameOffset = PE.findSignature(currentCtorOffset + 10, PE.getSize() - PE.getOverlaySize(), "'<Module>'");

        if (secondCtorNameOffset !== -1 && PE.readByte(secondCtorNameOffset + 8) !== 0x00) {
            log(logType.net, "Fake <Module> detected! Offset: 0x" + Number(secondCtorNameOffset).toString(16));

            isModuleCtorMultiple = true;
        }
    }

    if (isModuleCtorMultiple) options = addOption(options, "Fake .cctor name");




    var isBadCctor = false;

    if (currentCtorOffset === -1) {
        log(logType.net, "It seems that the .cctor is missing. Bad PE format!");

        isBadCctor = true;
    }

    if (isBadCctor) options = addOption(options, "Bad .cctor format");




    // Detects the use of unusual mathematical expressions that would be simplified by the compiler. 
    // For example, an expression like "912874 + 39188124^834"

    var isMutationsPresent = false;

    const mathOpCodes = [
        opCodes.add, opCodes.sub,
        opCodes.mul, opCodes.div,
        opCodes.xor, opCodes.shr,
        opCodes.shl, opCodes.or,
        opCodes.not, opCodes.and
    ];

    const mathTemplates = [ // %s = math opcode
        opCodes.ldc_i4 + opCodes.ldc_i4 + "%s" + opCodes.stloc, // samples by: .NET Reactor
        opCodes.ldc_i4 + opCodes.ldc_i4 + "%s" + opCodes.ldsfld, // samples by: .NET Reactor
        opCodes.ldc_i4 + opCodes.ldc_i4 + "%s" + opCodes.ldc_i4 + opCodes.add, // samples by: ConfuserEx (Beds mod)
        opCodes.ldloc_1 + opCodes.ldc_i4 + opCodes.ldc_i4 + "%s" + opCodes.ldc_i4 + opCodes.ldc_i4, // samples by: SkiDzEX
        opCodes.ldloc + opCodes.ldc_i4 + opCodes.ldc_i4 + opCodes.ldc_i4 + "%s" + opCodes.stelem_i1, // samples by: .NET Reactor
        opCodes.ldc_i4 + opCodes.ldc_i4 + "%s" + opCodes.br_s // samples by: [Unknown protector, only samples]
    ];

    for (var y = 0; y < mathTemplates.length && !isMutationsPresent; y++) {
        const template = mathTemplates[y];

        for (var e = 0; e < mathOpCodes.length && !isMutationsPresent; e++) {
            if (e === 0 && !validateNetByteCode(replaceAllInString(template, "%s", opCodes._unknown))) break; // No math mutations

            const pattern = replaceAllInString(template, "%s", mathOpCodes[e]);

            if (validateNetByteCode(pattern)) {
                log(logType.net, "Math mutations detected! Offset: " + lastOffsetDetected);

                isMutationsPresent = true;
            }
        }
    }

    if (isMutationsPresent) options = addOption(options, "Math mutations");




    // VB NET apps with resources only

    var isStringsEncryptionPresent = false;

    if (PE_Cached.isVbNetStandardLibraryPresent && !isFrameworkComponent()) {
        if (validateNetObject("Resources") && !validateGlobalUnicodeString(".Resources")) {
            log(logType.net, "It appears that the strings are hidden/encrypted and can be loaded dynamically.");

            isStringsEncryptionPresent = true;
        }
    }

    if (isStringsEncryptionPresent) options = addOption(options, "Strings encryption");




    // A type of obfuscation of numbers in which they are inverted several times from positive to negative and vice versa...

    var isMathInversionsPresent = false;

    if (validateNetByteCode(opCodes.ldc_i4 + opCodes.not) && (
        validateNetByteCode( // ~(-(~(-(~(-(~(-( num ))))))))
            opCodes.ldc_i4 +
            opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
            opCodes.not + opCodes.neg + opCodes.not + opCodes.neg
        ) ||
        validateNetByteCode( // ~(~(-(-(~(~( num ))))))
            opCodes.ldc_i4 +
            opCodes.not + opCodes.not + opCodes.neg + opCodes.neg +
            opCodes.not + opCodes.not
        ) ||
        validateNetByteCode( // ~(-(~(~(-(-( num ))))))
            opCodes.ldc_i4 +
            opCodes.not + opCodes.neg + opCodes.not + opCodes.not +
            opCodes.neg + opCodes.neg
        ) ||
        validateNetByteCode( // ~(-(~(-(~(~( num ))))))
            opCodes.ldc_i4 +
            opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
            opCodes.not + opCodes.not
        ) ||
        validateNetByteCode( // ~(-(~(-(~(-( num ))))))
            opCodes.ldc_i4 +
            opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
            opCodes.not + opCodes.neg
        )
    )) {
        log(logType.net, "Math inversions detected, offset " + lastOffsetDetected);

        isMathInversionsPresent = true;
    }

    if (isMathInversionsPresent) options = addOption(options, "Math inversions");




    // A technique that allows you to avoid code decompilation. dnSpy gives a parsing error when trying to open such a file

    var invalidOpCodes = false;

    if (
        /* validateNetByteCode( // samples by: SugarGuard
            opCodes.setStrict(opCodes.box, "?? 00 00 01") + opCodes.ret
        ) || */
        validateNetByteCode( // samples by: ConfuserEx (Beds mod)
            opCodes.setStrict(opCodes.calli, "FF FF FF FF") + opCodes.setStrict(opCodes.sizeof, "FF FF FF FF")
        )
    ) {
        log(logType.net, "Invalid OpCodes detected, offset " + lastOffsetDetected);

        invalidOpCodes = true;
    }

    if (invalidOpCodes) options = addOption(options, "Invalid OpCodes");




    // Some protections include their own dependencies in the form of runtime libraries

    var isProtectionRuntimePresent = false;

    var runtimeFound = String();

    const protectionsRuntime = [ // Need more
        { lib: "haspdnert.dll", name: "SafeNet Sentinel LDK" },
        { lib: "AgileDotNet.VMRuntime.dll", name: "Agile" },
        { lib: "Xerin.Runtime.dll", name: "XerinFuscator" },
        { lib: "CliSecureRd64.dll", name: "CliSecure" },
        { lib: "CliSecureRd.dll", name: "CliSecure" },
        { lib: "Protect32.dll", name: "ILProtector" },
        { lib: "Protect64.dll", name: "ILProtector" },
        { lib: "OneVM.Runtime.dll", name: "OneVM" },
        { lib: "MRuntime3.dll", name: "Maxtocode" },
        { lib: "Attick.dll", name: "Maxtocode" },
        { lib: "HVMRuntm.dll", name: "DNGuard" }
    ];

    for (var i = 0; i < protectionsRuntime.length; i++) {
        const
            runtimeInfo = protectionsRuntime[i],
            runtimeLibraryName = runtimeInfo.lib,
            protectorName = runtimeInfo.name;

        if (validateNetObject(runtimeLibraryName) || // "runtime.dll"
            validateNetObject(runtimeLibraryName.substring(0, runtimeLibraryName.length - 4))) { // "runtime"
            log(logType.net, protectorName + " runtime detected!");

            isProtectionRuntimePresent = true;
            runtimeFound = protectorName;
            break;
        }
    }

    // Clean up: release the dictionary
    protectionsRuntime = undefined;

    if (isProtectionRuntimePresent) options = addOption(options, runtimeFound + " runtime");




    const obfuscatorsAttributes = [
        "Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode", // Xenocode
        "CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute", // Crypto Obfuscator
        "SecureTeam.Attributes.ObfuscatedByAgileDotNetAttribute", // Agile.NET
        "Xenocode.Client.Attributes.AssemblyAttributes", // Xenocode
        "SmartAssembly.Attributes.PoweredByAttribute", // Smart Assembly
        "ObfuscatedByAgileDotNetAttribute", // Agile.NET
        "NineRays.Obfuscator.Evaluation", // Spices.Net
        "ObfuscatedByCliSecureAttribute", // CliSecure
        "BabelObfuscatorAttribute", // Babel
        "AsStrongAsFuckAttribute", // AsStrongAsFuck
        "ProtectedByDotnetsafer", // DotNetSafer
        "Macrobject.Obfuscator", // Macrobject
        "DotfuscatorAttribute", // Dotfuscator
        "CodeWallTrialVersion", // CodeWall
        "ConfusedByAttribute", // ConfuserEx
        "ObfuscatedByGoliath", // Goliath
        "NETSpider.Attribute", // NETSpider
        "NineRays.Obfuscator", // Spices.Net
        "PoweredByAttribute", // Smart Assembly
        "RustemSoft.Skater", // Skater
        "Beds-Protector", // fake Beds Protector
        "BabelAttribute", // Babel
        "MRuntime3.dll", // Maxtocode
        "YanoAttribute", // Yano
        "EMyPID_8234_", // Eazfuscator.NET
        "ZYXDNGuarder", // DNGuard
        "SkiDzEX", // ConfuserEx based
        "Sixxpack", // Sixxpack
        "____KILL", // CodeVeil
        "Reactor", // Fake .NET Reactor
    ];

    var isFakeSignaturesPresent = false;

    var isWatermarkPresent = false;

    var signaturesCounter = 0;

    var obfuscatorAttributeFound = String();

    // Iterate through obfuscators attributes
    for (var t = 0; t < obfuscatorsAttributes.length; t++) {
        if (validateNetObject(obfuscatorsAttributes[t])) {
            obfuscatorAttributeFound = obfuscatorsAttributes[t];
            signaturesCounter++;

            if (signaturesCounter > 1) {
                isFakeSignaturesPresent = true;
                break;
            }
        }
    }

    if (isFakeSignaturesPresent) {
        options = addOption(options, "Fake signatures");
    } else {
        // "Watermark" is only possible in the absence of fake signatures

        if (signaturesCounter === 1) {
            log(logType.net, "Watermark (Attribute) found: \"" + obfuscatorAttributeFound + "\"");

            isWatermarkPresent = true;
        }

        if ((!isWatermarkPresent && (
            validateSignature("'Obfuscated'") ||
            validateSignature("'obfuscated'") ||
            validateSignature("'ByAttribute'") ||
            validateSignature("'ObfuscatorAttribute'") ||
            validateNetObject("ObfuscationAttribute")
        )) && !isFrameworkComponent()) { // System.Reflection.ObfuscationAttribute
            isWatermarkPresent = true;
        }
    }

    if (isWatermarkPresent) options = addOption(options, "Watermark");




    // The module name must always contain the assembly name and the output file extension (Assembly "App", Module "App.dll").
    // If this standard is not followed, it means that the sample was modified after compilation.

    var isBuildInfoModified = false;

    var buildAssemblyName = PE_Cached.nameOfNetAssemblyName,
        buildModuleName = PE_Cached.nameOfNetModuleName;

    if (buildAssemblyName.indexOf("Interop.") === 0) {
        buildAssemblyName = buildAssemblyName.substring(8, buildAssemblyName.length);
    }

    if (buildAssemblyName !== getFileNameWithoutExtension(buildModuleName) || buildAssemblyName === buildModuleName) {
        isBuildInfoModified = true;

        if (PE_Cached.isJscriptNetStandardLibraryPresent && buildModuleName === "JScript Module") {
            isBuildInfoModified = false;
        }
    }

    if (isBuildInfoModified) options = addOption(options, "Modified build info");




    const protectorsLabelsToRemove = [ // Protectors with these names will be removed from results
        "SafeNet Sentinel LDK .NET",
        "Xenocode Postbuild",
        "Smart Assembly",
        "Dotfuscator",
        "Babel .NET",
        "Spices.Net",
        "Maxtocode",
        "FISH .NET",
        "CliSecure",
        "CodeWall",
        "CodeVeil",
        "Sixxpack",
        "DNGuard",
        "Goliath",
        "Agile",
        "Yano"
    ], packersLabelsToRemove = [
        "Quest PowerGUI",
        "DataAnubis",
        "NsPack",
        "ASPack"
    ], protectionsLabelsToRemove = [
        "Sentinel SuperPro dongle reference",
        "Unikey/Activator dongle reference",
        "Eutron SmartKey dongle reference",
        "SenseLock dongle reference",
        "Hardlock dongle reference",
        "WIBU Key dongle reference",
        "Wizzkey dongle reference",
        "SoftLok dongle reference",
        "NetHASP dongle reference"
    ];

    // Волки делают АУФ 🐺☝️

    if (isFakeSignaturesPresent) {
        for (var i = 0; i < protectorsLabelsToRemove.length; i++) {
            _removeResult("protector", protectorsLabelsToRemove[i]);
        }

        for (var i = 0; i < packersLabelsToRemove.length; i++) {
            _removeResult("cryptor", packersLabelsToRemove[i]);
            _removeResult("packer", packersLabelsToRemove[i]);
        }

        for (var i = 0; i < protectionsLabelsToRemove.length; i++) {
            _removeResult("protection", protectionsLabelsToRemove[i]);
        }
    }




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~protection", "Obfuscation", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion



// #region "anti-analysis (.NET)"
function scanForAntiAnalysis_NET() {
    log(logType.nothing, "Scanning for anti-analysis tricks...");

    var options = String();

    var isDetected = false;


    // Assumes the file can detect debugging protection

    var isAntiDebugPresent = false;

    const debuggerObject = "Debugger", // MSIL: 'System.Diagnostics.Debugger' from System.Diagnostics.dll
        isAttached = "get_IsAttached", // MSIL: '*.Debugger::get_IsAttached()'
        isLogging = "IsLogging" // MSIL: '*.Debugger::IsLogging()'

    if (
        (
            ( // .NET Functions
                validateNetObject(debuggerObject) || validateNetUnicodeString(debuggerObject) // Check for 'Debugger'
            ) && (
                (validateNetObject(isAttached) || validateNetUnicodeString(isAttached)) || // Check for 'get_IsAttached' property
                (validateNetObject(isLogging) || validateNetUnicodeString(isLogging)) // Check for 'IsLogging' function
            ) ||
            ( // Native (WinAPI) functions
                validateNetObject("CheckRemoteDebuggerPresent") || validateNetObject("IsDebuggerPresent") ||
                validateNetObject("NtRemoveProcessDebug") || validateNetObject("NtQueryInformationProcess")
            )
        ) && !isFrameworkComponent()
    ) {
        isAntiDebugPresent = true;
    }

    if (isAntiDebugPresent) options = addOption(options, "Anti-debug");




    // A type of protection in which, after launching an application, it erases the headers and/or PE signature behind itself

    var isAntiDumpPresent = false;

    if (
        !isFrameworkComponent() && validateNetObject("VirtualProtect") && ( // from 'kernel32.dll', WinAPI
            // Need to check
            isAllNetReferencesPresent( // samples by: ConfuserEx, SkiDzEX
                [
                    "System.Runtime.InteropServices", // System.Runtime.InteropServices.dll
                    "Marshal", // MSIL: '*.Marshal::GetHINSTANCE( ... )'
                    "GetHINSTANCE", // MSIL: '*.Marshal::GetHINSTANCE( ... )'
                    "IntPtr", // MSIL: 'System.IntPtr'
                    "op_Explicit" // MSIL: 'System.IntPtr::op_Explicit'
                ]
            ) ||
            isAllNetReferencesPresent( // samples by: Inx Obfuscator
                [
                    "System.Diagnostics", // System.Diagnostics
                    "memcpy", // from 'msvcrt.dll', WinAPI
                    "IntPtr", // MSIL: 'System.IntPtr'
                    "get_MainModule", // MSIL: '*.Process::get_MainModule()'
                    "get_BaseAddress" // MSIL: '*.ProcessModule::get_BaseAddress()'
                ]
            ) ||
            isAllNetReferencesPresent( // samples by: MindLated
                [
                    "System.Runtime.InteropServices", // System.Runtime.InteropServices.dll
                    "Marshal", // MSIL: '*.Marshal::GetHINSTANCE( ... )'
                    "GetHINSTANCE", // MSIL: '*.Marshal::GetHINSTANCE( ... )'
                    "IntPtr", // MSIL: 'System.IntPtr'
                    "CopyBlock",
                    "InitBlock"
                ]
            )
        )
    ) {
        isAntiDumpPresent = true;
    }

    if (isAntiDumpPresent) options = addOption(options, "Anti-dump");




    // https://medium.com/@tarunrd77/dnspy-static-analysis-of-a-net-malware-012806424acf

    const antiDnSpyTriggers = [
        "dnspy",
        "dnSpy",
        "DNSPY"
    ];

    var isAntiDnSpyPresent = false;

    // Iterate through anti-DnSpy triggers
    for (var l = 0; l < antiDnSpyTriggers.length && !isAntiDnSpyPresent; l++) {
        const dnSpyName = antiDnSpyTriggers[l];

        // Check if the signature for anti-DnSpy trigger is valid using Unicode signature mask or the original signature
        if (
            validateGlobalUnicodeString(dnSpyName) ||
            validateSignature("'" + dnSpyName + "'")
        ) {
            isAntiDnSpyPresent = true;
        }
    }

    if (isAntiDnSpyPresent) options = addOption(options, "Anti-dnSpy");




    // https://github.com/icsharpcode/ILSpy

    const antiIlSpyTriggers = [
        "ilspy",
        "ilSpy",
        "ILSpy",
        "ILSPY"
    ];

    var isAntiIlSpyPresent = false;

    for (var l = 0; l < antiIlSpyTriggers.length && !isAntiIlSpyPresent; l++) {
        const ilSpyName = antiIlSpyTriggers[l];

        // Check if the signature for anti-ILSpy trigger is valid using Unicode signature mask or the original signature
        if (
            validateGlobalUnicodeString(ilSpyName) ||
            validateSignature("'" + ilSpyName + "'")
        ) {
            isAntiIlSpyPresent = true;
        }
    }

    if (isAntiIlSpyPresent) options = addOption(options, "Anti-ILSpy");




    const isGetModuleHandleDetected = validateSignature("'GetModuleHandle'"); // from 'kernel32.dll'




    // https://en.wikipedia.org/wiki/Sandboxie

    const sbieVariants = [
        "sbiedll.",
        "SbieDll.",
        "SBIEDLL."
    ];

    var isAntiSbiePresent = false;

    if (isGetModuleHandleDetected) {
        // Iterate through Sandboxie variants
        for (var l = 0; l < sbieVariants.length && !isAntiSbiePresent; l++) {
            const sbieLib = sbieVariants[l];

            // Check if the signature for Sandboxie variant is valid using Unicode signature mask or the original signature
            if (
                PE.isNetObjectPresent("IsSandboxiePresent") || // https://github.com/AdvDebug/AntiCrack-DotNet/blob/f3cd8104e952580e0edf298101139d15befe008e/AntiCrack-DotNet/AntiVirtualization.cs#L53
                validateGlobalUnicodeString(sbieLib) ||
                validateSignature("'" + sbieLib + "'")
            ) {
                isAntiSbiePresent = true;
            }
        }
    }

    if (isAntiSbiePresent) options = addOption(options, "Anti-SandBoxie");




    // https://help.comodo.com/topic-394-1-767-9229-the-sandbox.html

    const comodoVariants = [
        "cmdvrt32.",
        "cmdvrt64.",
        "CMDVRT32.",
        "CMDVRT64."
    ];

    var isAntiComodoPresent = false;

    if (isGetModuleHandleDetected) {
        // Iterate through Comodo Sandbox variants
        for (var l = 0; l < comodoVariants.length && !isAntiComodoPresent; l++) {
            const comodoLib = comodoVariants[l];

            // Check if the signature for Comodo Sandbox variant is valid using Unicode signature mask or the original signature
            if (
                PE.isNetObjectPresent("IsComodoSandboxPresent") || // https://github.com/AdvDebug/AntiCrack-DotNet/blob/f3cd8104e952580e0edf298101139d15befe008e/AntiCrack-DotNet/AntiVirtualization.cs#L64
                validateGlobalUnicodeString(comodoLib) ||
                validateSignature("'" + comodoLib + "'")
            ) {
                isAntiComodoPresent = true;
            }
        }
    }

    if (isAntiComodoPresent) options = addOption(options, "Anti-Comodo");




    // https://blog.360totalsecurity.com/en/how-to-use-360-sandbox/

    const qihoo360Variants = [
        "SxIn.",
        "SXIn."
    ];

    var isAntiQihoo360Present = false;

    if (isGetModuleHandleDetected) {
        // Iterate through Qihoo 360 Sandbox variants
        for (var l = 0; l < qihoo360Variants.length && !isAntiQihoo360Present; l++) {
            const qihoo360Lib = qihoo360Variants[l];

            // Check if the signature for Qihoo 360 Sandbox variant is valid using Unicode signature mask or the original signature
            if (
                PE.isNetObjectPresent("IsQihoo360SandboxPresent") || // https://github.com/AdvDebug/AntiCrack-DotNet/blob/f3cd8104e952580e0edf298101139d15befe008e/AntiCrack-DotNet/AntiVirtualization.cs#L75
                validateGlobalUnicodeString(qihoo360Lib) ||
                validateSignature("'" + qihoo360Lib + "'")
            ) {
                isAntiQihoo360Present = true;
            }
        }
    }

    if (isAntiQihoo360Present) options = addOption(options, "Anti-Qihoo 360");




    // https://www.networkintelligence.ai/blogs/cuckoo-sandbox/

    const cuckooVariants = [
        "cuckoomon.",
        "CUCKOOMON."
    ];

    var isAntiCuckooPresent = false;

    if (isGetModuleHandleDetected) {
        // Iterate through Cuckoo Sandbox variants
        for (var l = 0; l < cuckooVariants.length && !isAntiCuckooPresent; l++) {
            const cuckooLib = cuckooVariants[l];

            // Check if the signature for Cuckoo Sandbox variant is valid using Unicode signature mask or the original signature
            if (
                PE.isNetObjectPresent("IsCuckooSandboxPresent") || // https://github.com/AdvDebug/AntiCrack-DotNet/blob/f3cd8104e952580e0edf298101139d15befe008e/AntiCrack-DotNet/AntiVirtualization.cs#L86
                validateGlobalUnicodeString(cuckooLib) ||
                validateSignature("'" + cuckooLib + "'")
            ) {
                isAntiCuckooPresent = true;
            }
        }
    }

    if (isAntiCuckooPresent) options = addOption(options, "Anti-Cuckoo");




    // https://www.winehq.org/

    var isAntiWinePresent = false;

    var wineGetUnixFileName = "wine_get_unix_file_name";

    if (isGetModuleHandleDetected && (
        validateGlobalUnicodeString(wineGetUnixFileName) ||
        validateSignature("'" + wineGetUnixFileName + "'")
    )) {
        isAntiWinePresent = true;
    }

    if (isAntiWinePresent) options = addOption(options, "Anti-Wine");




    var isAntiVmPresent = false;

    if (validateNetUnicodeString("vmware") ||
        validateNetUnicodeString("VirtualBox") ||
        validateNetUnicodeString("VMBusHID") ||
        validateGlobalUnicodeString("WDAGUtilityAccount")) {
        isAntiVmPresent = true;
    }

    if (isAntiVmPresent) options = addOption(options, "Anti-VM");




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~protection", "Anti analysis", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion




/**
 * Determines if the current PE file is a C++/CLR .NET application.
 *
 * @returns {boolean} True if the PE file matches the C++/CLR .NET application heuristics, otherwise false.
 */
function isCppClrLikeApp() {
    return PE_Cached.isDotNet && PE_Cached.isRichSignaturePresent && PE.isLibraryPresent("KERNEL32.DLL") && PE_Cached.isNetGlobalCctorPresent;
}



/**
 * Checks if the PE file is linked with an unpackaged Windows App SDK.
 * 
 * This function verifies the presence of specific .NET objects that indicate
 * the application uses the Windows App SDK in an unpackaged deployment scenario.
 * 
 * @returns {boolean} True if both "AutoInitialize" and "InitializeWindowsAppSDK" 
 *                    .NET objects are present in the PE file, false otherwise.
 */
function isUnpackagedWindowsAppSdkLinked() {
    return PE.isNetObjectPresent("AutoInitialize") && PE.isNetObjectPresent("InitializeWindowsAppSDK");
}



/**
 * Microsoft Intermediate Language (MSIL) OpCodes class for .NET assembly analysis.
 * 
 * This class provides a comprehensive collection of MSIL instruction opcodes with their
 * corresponding bytecode patterns for signature-based detection in .NET assemblies.
 * All opcode values are verified against the official Microsoft .NET Runtime source code
 * and ECMA-335 Common Language Infrastructure (CLI) specification.
 * 
 * @class NetOpCodes
 * @description Represents MSIL opcodes as hexadecimal string patterns for bytecode matching.
 * 
 * Features:
 * - Complete MSIL instruction set coverage (93 opcodes)
 * - Support for both single-byte (0x00-0xFF) and two-byte (0xFE00-0xFEFF) opcodes
 * - Wildcard pattern support using '?' for variable operands
 * - Prefix instruction handling (volatile, tail, readonly, etc.)
 * - Helper methods for strict value substitution and null value setting
 * 
 * Pattern Format:
 * - Fixed bytes: "58" (add instruction)
 * - Variable operands: "28????????" (call with 4-byte method token)
 * - Short operands: "2B??" (br.s with 1-byte offset)
 * - Two-byte opcodes: "FE01" (ceq instruction)
 * 
 * Helper Methods:
 * - setStrict(opcode, value): Sets specific operand values for opcodes
 * - setNullValue(opcode): Replaces wildcards with zero bytes
 * 
 * @see {@link https://docs.microsoft.com/en-us/dotnet/api/system.reflection.emit.opcodes} Microsoft OpCodes Documentation
 * @see {@link https://www.ecma-international.org/publications-and-standards/standards/ecma-335/} ECMA-335 CLI Specification
 * @see {@link https://github.com/dotnet/runtime/blob/main/src/libraries/System.Private.CoreLib/src/System/Reflection/Emit/OpCodes.cs} .NET Runtime Source
 */
function NetOpCodes() {
    // ========== BASIC STACK OPERATIONS ==========
    this.dup = "25";                    // MSIL: 'dup'              - Duplicate top stack value
    this.nop = "00";                    // MSIL: 'nop'              - No operation
    this.pop = "26";                    // MSIL: 'pop'              - Remove top stack value

    // ========== ARITHMETIC OPERATIONS ==========
    this.add = "58";                    // MSIL: 'add'              - Add two values
    this.add_ovf = "D6";                // MSIL: 'add.ovf'          - Add signed integer values with overflow check
    this.add_ovf_un = "D7";             // MSIL: 'add.ovf.un'       - Add unsigned integer values with overflow check
    this.div = "5B";                    // MSIL: 'div'              - Divide two values
    this.div_un = "5C";                 // MSIL: 'div.un'           - Divide unsigned values
    this.mul = "5A";                    // MSIL: 'mul'              - Multiply two values
    this.mul_ovf = "D8";                // MSIL: 'mul.ovf'          - Multiply signed integer values with overflow check
    this.mul_ovf_un = "D9";             // MSIL: 'mul.ovf.un'       - Multiply unsigned integer values with overflow check
    this.neg = "65";                    // MSIL: 'neg'              - Negate value
    this.rem = "5D";                    // MSIL: 'rem'              - Remainder when dividing two values
    this.rem_un = "5E";                 // MSIL: 'rem.un'           - Remainder (unsigned)
    this.sub = "59";                    // MSIL: 'sub'              - Subtract two values
    this.sub_ovf = "DA";                // MSIL: 'sub.ovf'          - Subtract native int with overflow check
    this.sub_ovf_un = "DB";             // MSIL: 'sub.ovf.un'       - Subtract unsigned int with overflow check

    // ========== LOGICAL OPERATIONS ==========
    this.and = "5F";                    // MSIL: 'and'              - Bitwise AND
    this.not = "66";                    // MSIL: 'not'              - Bitwise NOT
    this.or = "60";                     // MSIL: 'or'               - Bitwise OR
    this.shl = "62";                    // MSIL: 'shl'              - Shift left
    this.shr = "63";                    // MSIL: 'shr'              - Shift right
    this.shr_un = "64";                 // MSIL: 'shr.un'           - Shift right (unsigned)
    this.xor = "61";                    // MSIL: 'xor'              - Bitwise XOR

    // ========== COMPARISON OPERATIONS ==========
    this.ceq = "FE01";                  // MSIL: 'ceq'              - Compare equal
    this.cgt = "FE02";                  // MSIL: 'cgt'              - Compare greater than
    this.cgt_un = "FE03";               // MSIL: 'cgt.un'           - Compare greater than (unsigned)
    this.clt = "FE04";                  // MSIL: 'clt'              - Compare less than
    this.clt_un = "FE05";               // MSIL: 'clt.un'           - Compare less than (unsigned)

    // ========== CONSTANT LOADING ==========
    this.ldc_i4_m1 = "15";              // MSIL: 'ldc.i4.m1'        - Load constant -1
    this.ldc_i4 = "20????????";         // MSIL: 'ldc.i4'           - Load 32-bit integer constant
    this.ldc_i4_0 = "16";               // MSIL: 'ldc.i4.0'         - Load constant 0
    this.ldc_i4_1 = "17";               // MSIL: 'ldc.i4.1'         - Load constant 1
    this.ldc_i4_2 = "18";               // MSIL: 'ldc.i4.2'         - Load constant 2
    this.ldc_i4_3 = "19";               // MSIL: 'ldc.i4.3'         - Load constant 3
    this.ldc_i4_4 = "1A";               // MSIL: 'ldc.i4.4'         - Load constant 4
    this.ldc_i4_5 = "1B";               // MSIL: 'ldc.i4.5'         - Load constant 5
    this.ldc_i4_6 = "1C";               // MSIL: 'ldc.i4.6'         - Load constant 6
    this.ldc_i4_7 = "1D";               // MSIL: 'ldc.i4.7'         - Load constant 7
    this.ldc_i4_8 = "1E";               // MSIL: 'ldc.i4.8'         - Load constant 8
    this.ldc_i4_s = "1F??";             // MSIL: 'ldc.i4.s'         - Load small integer constant
    this.ldc_i8 = "21????????????????"; // MSIL: 'ldc.i8'           - Load 64-bit integer constant
    this.ldc_r4 = "22????????";         // MSIL: 'ldc.r4'           - Load 32-bit float constant
    this.ldc_r8 = "23????????????????"; // MSIL: 'ldc.r8'           - Load 64-bit float constant
    this.ldnull = "14";                 // MSIL: 'ldnull'           - Load null reference

    // ========== ARGUMENT OPERATIONS ==========
    this.ldarg = "FE09????";            // MSIL: 'ldarg'            - Load argument
    this.ldarg_0 = "02";                // MSIL: 'ldarg.0'          - Load argument 0
    this.ldarg_1 = "03";                // MSIL: 'ldarg.1'          - Load argument 1
    this.ldarg_2 = "04";                // MSIL: 'ldarg.2'          - Load argument 2
    this.ldarg_3 = "05";                // MSIL: 'ldarg.3'          - Load argument 3
    this.ldarg_s = "0E??";              // MSIL: 'ldarg.s'          - Load argument (short form)
    this.starg_s = "10??";              // MSIL: 'starg.s'          - Store to argument (short form)
    this.ldarga = "FE0A????";           // MSIL: 'ldarga'           - Load argument address
    this.ldarga_s = "0F??";             // MSIL: 'ldarga.s'         - Load argument address (short form)
    this.starg = "FE0B????";            // MSIL: 'starg'            - Store to argument
    this.ldloca = "FE09????";           // MSIL: 'ldloca'           - Load local variable address
    this.ldloca_s = "12??";             // MSIL: 'ldloca.s'         - Load local variable address (short form)

    // ========== LOCAL VARIABLE OPERATIONS ==========
    this.ldloc = "FE0C????";            // MSIL: 'ldloc'            - Load local variable
    this.ldloc_0 = "06";                // MSIL: 'ldloc.0'          - Load local variable 0
    this.ldloc_1 = "07";                // MSIL: 'ldloc.1'          - Load local variable 1
    this.ldloc_2 = "08";                // MSIL: 'ldloc.2'          - Load local variable 2
    this.ldloc_3 = "09";                // MSIL: 'ldloc.3'          - Load local variable 3
    this.ldloc_s = "11??";              // MSIL: 'ldloc.s'          - Load local variable (short form)
    this.stloc = "FE0E????";            // MSIL: 'stloc'            - Store to local variable
    this.stloc_0 = "0A";                // MSIL: 'stloc.0'          - Store to local variable 0
    this.stloc_1 = "0B";                // MSIL: 'stloc.1'          - Store to local variable 1
    this.stloc_2 = "0C";                // MSIL: 'stloc.2'          - Store to local variable 2
    this.stloc_3 = "0D";                // MSIL: 'stloc.3'          - Store to local variable 3
    this.stloc_s = "13??";              // MSIL: 'stloc.s'          - Store to local variable (short form)

    // ========== FIELD OPERATIONS ==========
    this.ldfld = "7B????????";          // MSIL: 'ldfld'            - Load instance field
    this.ldflda = "7C????????";         // MSIL: 'ldflda'           - Load field address
    this.ldsfld = "7E????????";         // MSIL: 'ldsfld'           - Load static field
    this.ldsflda = "7F????????";        // MSIL: 'ldsflda'          - Load static field address
    this.stfld = "7D????????";          // MSIL: 'stfld'            - Store to instance field
    this.stsfld = "80????????";         // MSIL: 'stsfld'           - Store to static field

    // ========== ARRAY OPERATIONS ==========
    this.ldelem = "A3????????";         // MSIL: 'ldelem'           - Load array element
    this.ldelem_i = "97";               // MSIL: 'ldelem.i'         - Load array element (native int)
    this.ldelem_i1 = "90";              // MSIL: 'ldelem.i1'        - Load array element (8-bit signed)
    this.ldelem_i2 = "92";              // MSIL: 'ldelem.i2'        - Load array element (16-bit signed)
    this.ldelem_i4 = "94";              // MSIL: 'ldelem.i4'        - Load array element (32-bit signed)
    this.ldelem_i8 = "96";              // MSIL: 'ldelem.i8'        - Load array element (64-bit signed)
    this.ldelem_r4 = "98";              // MSIL: 'ldelem.r4'        - Load array element (32-bit float)
    this.ldelem_r8 = "99";              // MSIL: 'ldelem.r8'        - Load array element (64-bit float)
    this.ldelem_ref = "9A";             // MSIL: 'ldelem.ref'       - Load array element (object reference)
    this.ldelem_u1 = "91";              // MSIL: 'ldelem.u1'        - Load array element (unsigned 8-bit)
    this.ldelem_u2 = "93";              // MSIL: 'ldelem.u2'        - Load array element (unsigned 16-bit)
    this.ldelem_u4 = "95";              // MSIL: 'ldelem.u4'        - Load array element (unsigned 32-bit)
    this.ldelema = "8F????????";        // MSIL: 'ldelema'          - Load array element address
    this.ldlen = "8E";                  // MSIL: 'ldlen'            - Load array length
    this.newarr = "8D????????";         // MSIL: 'newarr'           - Create new array
    this.stelem = "A4????????";         // MSIL: 'stelem'           - Store to array element
    this.stelem_i = "9B";               // MSIL: 'stelem.i'         - Store to array element (native int)
    this.stelem_i1 = "9C";              // MSIL: 'stelem.i1'        - Store to array element (8-bit)
    this.stelem_i2 = "9D";              // MSIL: 'stelem.i2'        - Store to array element (16-bit)
    this.stelem_i4 = "9E";              // MSIL: 'stelem.i4'        - Store to array element (32-bit)
    this.stelem_i8 = "9F";              // MSIL: 'stelem.i8'        - Store to array element (64-bit)
    this.stelem_r4 = "A0";              // MSIL: 'stelem.r4'        - Store to array element (32-bit float)
    this.stelem_r8 = "A1";              // MSIL: 'stelem.r8'        - Store to array element (64-bit float)
    this.stelem_ref = "A2";             // MSIL: 'stelem.ref'       - Store to array element (object reference)

    // ========== INDIRECT OPERATIONS ==========
    this.ldind_i = "4D";                // MSIL: 'ldind.i'          - Load indirect native int
    this.ldind_i1 = "46";               // MSIL: 'ldind.i1'         - Load indirect 8-bit value
    this.ldind_i2 = "48";               // MSIL: 'ldind.i2'         - Load indirect 16-bit value
    this.ldind_i4 = "4A";               // MSIL: 'ldind.i4'         - Load indirect 32-bit value
    this.ldind_i8 = "4C";               // MSIL: 'ldind.i8'         - Load indirect 64-bit value
    this.ldind_r4 = "4E";               // MSIL: 'ldind.r4'         - Load indirect 32-bit float
    this.ldind_r8 = "4F";               // MSIL: 'ldind.r8'         - Load indirect 64-bit float
    this.ldind_ref = "50";              // MSIL: 'ldind.ref'        - Load indirect object reference
    this.ldind_u1 = "47";               // MSIL: 'ldind.u1'         - Load indirect unsigned 8-bit value
    this.ldind_u2 = "49";               // MSIL: 'ldind.u2'         - Load indirect unsigned 16-bit value
    this.ldind_u4 = "4B";               // MSIL: 'ldind.u4'         - Load indirect unsigned 32-bit value
    this.stind_i = "DF";                // MSIL: 'stind.i'          - Store indirect native int
    this.stind_i1 = "52";               // MSIL: 'stind.i1'         - Store indirect 8-bit value
    this.stind_i2 = "53";               // MSIL: 'stind.i2'         - Store indirect 16-bit value
    this.stind_i4 = "54";               // MSIL: 'stind.i4'         - Store indirect 32-bit value
    this.stind_i8 = "55";               // MSIL: 'stind.i8'         - Store indirect 64-bit value
    this.stind_r4 = "56";               // MSIL: 'stind.r4'         - Store indirect 32-bit float
    this.stind_r8 = "57";               // MSIL: 'stind.r8'         - Store indirect 64-bit float
    this.stind_ref = "51";              // MSIL: 'stind.ref'        - Store indirect object reference

    // ========== CONTROL FLOW ==========
    this.beq = "3B????????";            // MSIL: 'beq'              - Branch if equal
    this.beq_s = "2E??";                // MSIL: 'beq.s'            - Branch if equal (short form)
    this.bge = "3C????????";            // MSIL: 'bge'              - Branch if greater or equal
    this.bge_s = "2F??";                // MSIL: 'bge.s'            - Branch if greater or equal (short form)
    this.bge_un = "41????????";         // MSIL: 'bge.un'           - Branch if greater or equal (unsigned/unordered)
    this.bge_un_s = "34??";             // MSIL: 'bge.un.s'         - Branch if greater or equal (unsigned/unordered, short)
    this.bgt = "3D????????";            // MSIL: 'bgt'              - Branch if greater than
    this.bgt_s = "30??";                // MSIL: 'bgt.s'            - Branch if greater than (short form)
    this.bgt_un = "42????????";         // MSIL: 'bgt.un'           - Branch if greater than (unsigned/unordered)
    this.bgt_un_s = "35??";             // MSIL: 'bgt.un.s'         - Branch if greater than (unsigned/unordered, short)
    this.ble = "3E????????";            // MSIL: 'ble'              - Branch if less or equal
    this.ble_s = "31??";                // MSIL: 'ble.s'            - Branch if less or equal (short form)
    this.ble_un = "43????????";         // MSIL: 'ble.un'           - Branch if less or equal (unsigned/unordered)
    this.ble_un_s = "36??";             // MSIL: 'ble.un.s'         - Branch if less or equal (unsigned/unordered, short)
    this.blt = "3F????????";            // MSIL: 'blt'              - Branch if less than
    this.blt_s = "32??";                // MSIL: 'blt.s'            - Branch if less than (short form)
    this.blt_un = "44????????";         // MSIL: 'blt.un'           - Branch if less than (unsigned/unordered)
    this.blt_un_s = "37??";             // MSIL: 'blt.un.s'         - Branch if less than (unsigned/unordered, short)
    this.bne_un = "40????????";         // MSIL: 'bne.un'           - Branch if not equal (unsigned)
    this.bne_un_s = "33??";             // MSIL: 'bne.un.s'         - Branch if not equal (unsigned, short)
    this.br = "38????????";             // MSIL: 'br'               - Unconditional branch
    this.br_s = "2B??";                 // MSIL: 'br.s'             - Unconditional branch (short form)
    this.break_ = "01";                 // MSIL: 'break'            - Breakpoint instruction
    this.brfalse = "39????????";        // MSIL: 'brfalse'          - Branch if false/null/zero
    this.brfalse_s = "2C??";            // MSIL: 'brfalse.s'        - Branch if false/null/zero (short)
    this.brtrue = "3A????????";         // MSIL: 'brtrue'           - Branch if true/non-null/non-zero
    this.brtrue_s = "2D??";             // MSIL: 'brtrue.s'         - Branch if true/non-null/non-zero (short)
    this.call = "28????????";           // MSIL: 'call'             - Call method
    this.calli = "29????????";          // MSIL: 'calli'            - Call indirect
    this.callvirt = "6F????????";       // MSIL: 'callvirt'         - Call virtual method
    this.jmp = "27????????";            // MSIL: 'jmp'              - Jump to method
    this.ldtoken = "D0????????";        // MSIL: 'ldtoken'          - Load metadata token
    this.ldftn = "FE06????????";        // MSIL: 'ldftn'            - Load function pointer
    this.ldvirtftn = "FE07????????";    // MSIL: 'ldvirtftn'        - Load virtual function pointer
    this.leave = "DD????????";          // MSIL: 'leave'            - Exit protected region
    this.leave_s = "DE??";              // MSIL: 'leave.s'          - Exit protected region (short form)
    this.ret = "2A";                    // MSIL: 'ret'              - Return from method
    this.switch__nobody = "45";         // MSIL: 'switch'           - Switch statement

    // ========== TYPE OPERATIONS ==========
    this.box = "8C????????";            // MSIL: 'box'              - Convert value type to object reference
    this.castclass = "74????????";      // MSIL: 'castclass'        - Cast object to class
    this.ckfinite = "C3";               // MSIL: 'ckfinite'         - Check if value is finite number
    this.conv_i = "D3";                 // MSIL: 'conv.i'           - Convert to native int
    this.conv_i1 = "67";                // MSIL: 'conv.i1'          - Convert to 8-bit integer
    this.conv_i2 = "68";                // MSIL: 'conv.i2'          - Convert to 16-bit integer
    this.conv_i4 = "69";                // MSIL: 'conv.i4'          - Convert to 32-bit integer
    this.conv_i8 = "6A";                // MSIL: 'conv.i8'          - Convert to 64-bit integer
    this.conv_ovf_i = "D4";             // MSIL: 'conv.ovf.i'       - Convert to native int with overflow check
    this.conv_ovf_i_un = "8A";          // MSIL: 'conv.ovf.i.un'    - Convert unsigned to native int with overflow check
    this.conv_ovf_i1 = "B3";            // MSIL: 'conv.ovf.i1'      - Convert to 8-bit integer with overflow check
    this.conv_ovf_i1_un = "82";         // MSIL: 'conv.ovf.i1.un'   - Convert to unsigned 8-bit integer with overflow check
    this.conv_ovf_i2 = "B5";            // MSIL: 'conv.ovf.i2'      - Convert to 16-bit integer with overflow check
    this.conv_ovf_i2_un = "83";         // MSIL: 'conv.ovf.i2.un'   - Convert to unsigned 16-bit integer with overflow check
    this.conv_ovf_i4 = "B7";            // MSIL: 'conv.ovf.i4'      - Convert to 32-bit integer with overflow check
    this.conv_ovf_i4_un = "84";         // MSIL: 'conv.ovf.i4.un'   - Convert to unsigned 32-bit integer with overflow check
    this.conv_ovf_i8 = "B9";            // MSIL: 'conv.ovf.i8'      - Convert to 64-bit integer with overflow check
    this.conv_ovf_i8_un = "85";         // MSIL: 'conv.ovf.i8.un'   - Convert to unsigned 64-bit integer with overflow check
    this.conv_ovf_u = "D5";             // MSIL: 'conv.ovf.u'       - Convert to native unsigned int with overflow check
    this.conv_ovf_u_un = "8B";          // MSIL: 'conv.ovf.u.un'    - Convert unsigned to native unsigned int with overflow check
    this.conv_ovf_u1 = "B4";            // MSIL: 'conv.ovf.u1'      - Convert to unsigned 8-bit integer with overflow check
    this.conv_ovf_u1_un = "86";         // MSIL: 'conv.ovf.u1.un'   - Convert unsigned to unsigned 8-bit integer with overflow check
    this.conv_ovf_u2 = "B6";            // MSIL: 'conv.ovf.u2'      - Convert to unsigned 16-bit integer with overflow check
    this.conv_ovf_u2_un = "87";         // MSIL: 'conv.ovf.u2.un'   - Convert unsigned to unsigned 16-bit integer with overflow check
    this.conv_ovf_u4 = "B8";            // MSIL: 'conv.ovf.u4'      - Convert to unsigned 32-bit integer with overflow check
    this.conv_ovf_u4_un = "88";         // MSIL: 'conv.ovf.u4.un'   - Convert unsigned to unsigned 32-bit integer with overflow check
    this.conv_ovf_u8 = "BA";            // MSIL: 'conv.ovf.u8'      - Convert to unsigned 64-bit integer with overflow check
    this.conv_ovf_u8_un = "89";         // MSIL: 'conv.ovf.u8.un'   - Convert unsigned to unsigned 64-bit integer with overflow check
    this.conv_r_un = "76";              // MSIL: 'conv.r.un'        - Convert unsigned integer to floating-point
    this.conv_r4 = "6B";                // MSIL: 'conv.r4'          - Convert to 32-bit float
    this.conv_r8 = "6C";                // MSIL: 'conv.r8'          - Convert to 64-bit float
    this.conv_u = "E0";                 // MSIL: 'conv.u'           - Convert to native unsigned int
    this.conv_u1 = "D2";                // MSIL: 'conv.u1'          - Convert to unsigned 8-bit integer
    this.conv_u2 = "D1";                // MSIL: 'conv.u2'          - Convert to unsigned 16-bit integer
    this.conv_u4 = "6D";                // MSIL: 'conv.u4'          - Convert to unsigned 32-bit integer
    this.conv_u8 = "6E";                // MSIL: 'conv.u8'          - Convert to unsigned 64-bit integer
    this.isinst = "75????????";         // MSIL: 'isinst'           - Test if object is instance of class
    this.mkrefany = "C6????????";       // MSIL: 'mkrefany'         - Push typed reference to value
    this.refanytype = "FE1D";           // MSIL: 'refanytype'       - Push type token from typed reference
    this.refanyval = "C2????????";      // MSIL: 'refanyval'        - Push address from typed reference
    this.sizeof = "FE1C????????";       // MSIL: 'sizeof'           - Get size of value type
    this.unbox = "79????????";          // MSIL: 'unbox'            - Convert object reference to value type
    this.unbox_any = "A5????????";      // MSIL: 'unbox.any'        - Convert boxed type to value

    // ========== OBJECT OPERATIONS ==========
    this.cpblk = "FE17";                // MSIL: 'cpblk'            - Copy block of memory
    this.cpobj = "70????????";          // MSIL: 'cpobj'            - Copy value type
    this.initblk = "FE18";              // MSIL: 'initblk'          - Initialize block of memory
    this.initobj = "FE15????????";      // MSIL: 'initobj'          - Initialize value type
    this.ldobj = "71????????";          // MSIL: 'ldobj'            - Load value type from address
    this.ldstr = "72????????";          // MSIL: 'ldstr'            - Load string literal
    this.localloc = "FE0F";             // MSIL: 'localloc'         - Allocate space from local memory pool
    this.newobj = "73????????";         // MSIL: 'newobj'           - Create new object instance
    this.stobj = "81????????";          // MSIL: 'stobj'            - Store value type to address

    // ========== EXCEPTION HANDLING ==========
    this.endfilter = "FE11";            // MSIL: 'endfilter'        - End exception filter clause
    this.endfinally = "DC";             // MSIL: 'endfinally'       - End finally clause
    this.rethrow = "FE1A";              // MSIL: 'rethrow'          - Rethrow current exception
    this._throw = "7A";                 // MSIL: 'throw'            - Throw exception

    // ========== PREFIX INSTRUCTIONS ==========
    this.constrained = "FE16????????"; // MSIL: 'constrained'       - Constrain type for virtual method call
    this.no_ = "FE19??";               // MSIL: 'no.'               - Skip fault check (typecheck, rangecheck, nullcheck)
    this.readonly = "FE1E";            // MSIL: 'readonly'          - Subsequent array address operation performs no type check
    this.unaligned = "FE12??";         // MSIL: 'unaligned.'        - Subsequent pointer instruction might be unaligned (alignment: 1, 2, or 4)
    this.volatile = "FE13";            // MSIL: 'volatile'          - Subsequent pointer reference is volatile

    // ========== UTILITY OPCODES ==========
    this._unknown = "**";              // MSIL: -                   - Unknown opcode pattern (any byte except 0x00)
    this._any = "??";                  // MSIL: -                   - Any single byte pattern
    this.arglist = "FE00";             // MSIL: 'arglist'           - Return argument list handle

    /**
     * Sets strict operand values for MSIL opcodes with variable operands.
     * 
     * This method replaces wildcard patterns ('??') in opcode masks with specific 
     * hexadecimal values, allowing for precise bytecode pattern matching.
     * 
     * @method setStrict
     * @param {string} opCodeMask - The opcode pattern with wildcards (e.g., "20????????")
     * @param {string} value - The hexadecimal value to substitute (e.g., "01 00 00 00")
     * @returns {string} The opcode pattern with substituted values
     * 
     * @example
     * // Set ldc.i4 instruction to load constant value 1
     * var pattern = opCodes.setStrict(opCodes.ldc_i4, "01 00 00 00");
     * // Result: "2001000000" (ldc.i4 1)
     * 
     * @example
     * // Set specific method token for call instruction
     * var callPattern = opCodes.setStrict(opCodes.call, "10 00 00 06");
     * // Result: "2810000006" (call method token 0x06000010)
     * 
     * @throws {Error} If operand size doesn't match the expected size
     */
    this.setStrict = function (opCodeMask, value) {
        // Remove spaces from opcode mask and value
        opCodeMask = removeWhitespaces(opCodeMask);
        value = removeWhitespaces(value);

        // Find the index of the special pattern "??" in the opcode mask
        var indexOfSpecialPattern = opCodeMask.indexOf("??");

        // Check if the opcode mask has a body (contains the special pattern "??")
        var isOpCodeMaskHasBody = indexOfSpecialPattern !== -1; // -1 if not found

        // Extract the opcode in hexadecimal
        var opCodeInHex = isOpCodeMaskHasBody ? opCodeMask.substring(0x00, indexOfSpecialPattern) : opCodeMask;

        // Check if the opcode mask has a body and the length of the body matches the length of the value
        if (isOpCodeMaskHasBody && opCodeMask.substring(opCodeInHex.length).length != value.length) {
            _error("The size of the input values does not match.");
        }

        // Combine the opcode in hexadecimal with the value
        return opCodeInHex + value;
    }

    /**
     * Sets all wildcard operands in an opcode pattern to zero bytes.
     * 
     * This method replaces all wildcard patterns ('??') in the opcode mask with 
     * zero bytes ('00'), useful for matching instructions with null/empty operands.
     * 
     * @method setNullValue
     * @param {string} opCodeMask - The opcode pattern containing wildcards
     * @returns {string} The opcode pattern with all wildcards replaced by '00'
     * 
     * @example
     * // Set ldc.i4 instruction to load zero value
     * var pattern = opCodes.setNullValue(opCodes.ldc_i4);
     * // Result: "2000000000" (ldc.i4 0)
     * 
     * @example
     * // Create null branch instruction
     * var brPattern = opCodes.setNullValue(opCodes.br);
     * // Result: "3800000000" (br with zero offset)
     * 
     * @throws {Error} If the opcode mask contains no wildcards to replace
     */
    this.setNullValue = function (opCodeMask) {

        if (opCodeMask.indexOf("??") === -1) {
            _error("Instruction does not have a body to overwrite the value.");
        }

        return replaceAllInString(opCodeMask, "??", "00");
    }

    /**
     * Joins an opcode without wildcards with additional bytes.
     * 
     * This method concatenates opcodes that don't have wildcards (like switch) 
     * with specific byte sequences, useful for instructions with variable-length operands.
     * 
     * @method joinNoBodyAndValue
     * @param {string} opCode - The opcode without wildcards (e.g., "45" for switch)
     * @param {string} value - The hexadecimal bytes to append (e.g., "02 00 00 00 XX XX XX XX")
     * @param {string} [opCodeName] - Optional: name of the opcode variable for validation
     * @returns {string} The combined opcode pattern
     * 
     * @example
     * // Create switch instruction with 2 targets
     * var switchPattern = opCodes.joinNoBodyAndValue(opCodes.switch__nobody, "02 00 00 00 10 00 00 00 20 00 00 00", "switch__nobody");
     * // Result: "45020000001000000020000000" (switch with 2 targets at offsets 0x10 and 0x20)
     * 
     * @throws {Error} If the opcode contains wildcards (should use setStrict instead)
     * @throws {Error} If opCodeName is provided but doesn't contain '__nobody'
     */
    this.joinNoBodyAndValue = function (opCode, value, opCodeName) {
        // Type validation
        if (!opCode || typeof opCode !== "string") {
            _error("Invalid opcode provided.");
        }
        if (!value || typeof value !== "string") {
            _error("Invalid value provided.");
        }

        // Check that opcode doesn't contain wildcards
        if (opCode.indexOf("??") !== -1) {
            _error("Opcode contains wildcards. Use setStrict() instead.");
        }

        // Optional validation: check if opcode name contains '__nobody'
        if (opCodeName && typeof opCodeName === "string") {
            if (opCodeName.indexOf("__nobody") === -1) {
                _error("joinNoBodyAndValue should only be used with '__nobody' opcodes (variable-length instructions).");
            }
        }

        return opCode + removeWhitespaces(value);
    }
}



/**
 * Removes all whitespace characters from a string including spaces, tabs, newlines, and carriage returns.
 * 
 * @param {string} inputString - The input string to remove whitespaces from
 * @returns {string} The string with all whitespace characters removed, or an empty string if input is invalid
 */
function removeWhitespaces(inputString) {
    // Type validation to prevent runtime errors
    if (!inputString || typeof inputString !== "string") {
        return String();
    }

    // Regex removes all whitespace: spaces, tabs, newlines, carriage returns
    return inputString.replace(/\s+/g, String());
}



/**
 * Replaces all occurrences of a specified substring within a given string with a new substring.
 * Uses split/join algorithm for single-pass replacement.
 *
 * @param {string} inputString - The original string in which to perform the replacements.
 * @param {string} search - The substring to search for within the input string.
 * @param {string} replacement - The substring to replace each occurrence of the search substring with.
 * @returns {string} - The modified string with all occurrences of the search substring replaced by the replacement substring.
 */
function replaceAllInString(inputString, search, replacement) {
    // Type validation to prevent runtime errors
    if (!inputString || typeof inputString !== "string") {
        return String();
    }

    if (!search || typeof search !== "string") {
        return inputString;
    }

    if (typeof replacement !== "string") {
        replacement = String();
    }

    // Split on search string and join with replacement (single pass)
    return inputString.split(search).join(replacement);
}



/**
 * Sanitizes section names to prevent DiE output corruption from malformed PE files.
 * Removes control characters that could break console output or cause display issues.
 * 
 * @param {string} sectionName - The section name to clean and sanitize.
 * @returns {string} - The sanitized section name safe for DiE output.
 */
function clearSectionName(sectionName) {
    // Type validation to prevent runtime errors
    if (!sectionName || typeof sectionName !== "string") {
        return String();
    }

    // Remove control characters (0x00-0x1F) and extended control chars (0x7F-0x9F)
    // This prevents newlines, tabs, null bytes from breaking DiE output format
    var cleaned = sectionName.replace(/[\x00-\x1F\x7F-\x9F]/g, String());

    // Remove leading/trailing whitespace
    cleaned = cleaned.trim();

    return cleaned;
}



/**
 * Checks if a given string consists only of ASCII printable characters (ASCII range 0x20 to 0x7E).
 *
 * @param {string} inputString - The string to validate.
 * @returns {boolean} Returns true if the string contains only ASCII printable characters, otherwise false.
 */
function isAsciiString(inputString) {
    // Type validation to prevent runtime errors
    if (!inputString || typeof inputString !== "string") {
        return false;
    }

    return /^[\x20-\x7E]+$/.test(inputString);
}



/**
 * Returns the file name without its extension.
 *
 * @param {string} fileName - The name of the file, possibly including an extension.
 * @returns {string} The file name without the extension. If no extension is found, returns the original file name.
 */
function getFileNameWithoutExtension(fileName) {
    // Type validation to prevent runtime errors
    if (!fileName || typeof fileName !== "string") {
        return String();
    }

    // Remove the file extension by splitting on the last dot and returning the first part
    var lastDotIndex = fileName.lastIndexOf(".");
    if (lastDotIndex === -1) {
        return fileName; // No extension found, return original name
    }

    return fileName.substring(0, lastDotIndex);
}



// #region "packers and cryptors (.NET and Native)"
function scanForPackersAndCryptors_NET_and_Native() { // For .NET and Native apps
    log(logType.nothing, "Scanning for packers and cryptors...");

    var options = String();

    var isDetected = Boolean(),
        isCryptor = Boolean();




    if (PE_Cached.isDotNet) {

        var isAssemblyInvokeFound = false;

        if (!isFrameworkComponent() && PE_Cached.nameOfNetModuleName !== "System.dll" && isAllNetReferencesPresent( // TODO: update [!!!]
            [
                "System.Reflection", // System.Reflection.dll
                "get_EntryPoint", // MSIL: '*.Assembly::get_EntryPoint()'
                "Assembly", // MSIL: 'System.Reflection.Assembly' from System.Reflection.dll
                "Invoke", // MSIL: '*.MethodBase::Invoke(object, object[])'
                "Load" // MSIL: '*.Assembly::Load(uint8[])'
            ]
        )) {
            isAssemblyInvokeFound = true;

            options = "Assembly invoke";
        }




        // Check if any class from System.Security.Cryptography namespace is used (non-full name) - for cryptors
        if (findAndMark("System.Security.Cryptography", false) != String()) {

            // Specify cryptography classes to look for
            const cryptoClasses = [
                "TripleDESCryptoServiceProvider",
                "RSACryptoServiceProvider",
                "DSACryptoServiceProvider",
                "DESCryptoServiceProvider",
                "AesCryptoServiceProvider",
                "Rfc2898DeriveBytes",
                "TripleDES",
                "Rijndael",
                "ECDsaCng",
                "AesAEAD",
                "Aes192Cbc",
                "Aes256Cbc",
                "Aes128Cbc",
                "AesManaged",
                "AesCng",
                "RC2CryptoServiceProvider",
                "RNGCryptoServiceProvider"
            ];

            // Iterate through cryptography classes
            for (var i = 0; i < cryptoClasses.length; i++) {
                if (!isCryptor) {
                    var cryptoClassSign = cryptoClasses[i],
                        result = findAndMark(
                            cryptoClassSign, true
                        );

                    // Check if assembly invoke is found and the cryptography class is present
                    if (isAssemblyInvokeFound && result.length) {
                        log(logType.net, "Crypto class present: " + cryptoClassSign);

                        isCryptor = true;

                        // Add the cryptography class to options
                        options = addOption(options, cryptoClassSign);
                    }
                }
            }
        }




        // Check if any class from System.IO.Compression namespace is used (non-full name)
        if (findAndMark("System.IO.Compression", false).length) {

            // Specify compression classes to look for
            const compressionClasses = [
                "DeflateStream",
                "GZipStream"
            ];

            // Iterate through compression classes
            for (var i = 0; i < compressionClasses.length; i++) {
                var compressionClassSign = compressionClasses[i],
                    result = findAndMark(compressionClassSign, true);

                // Check if assembly invoke is found and the compression class is present
                if (isAssemblyInvokeFound && result.length) {
                    log(logType.net, "Compression class present: " + compressionClassSign);

                    // If it's a cryptor, add the compression class to options
                    if (isCryptor) options = addOption(options, compressionClassSign);

                    // Break the loop if a match is found
                    break;
                }
            }
        }




        // RunPE is a method for running payload from RAM, with minimal writing to disk.

        var isRunPePresent = false;

        if (validateNetObject("RunPE") ||
            validateNetObject("PELoader") || // https://github.com/nettitude/RunPE/blob/main/RunPE/Internals/PELoader.cs
            validateNetObject("CMemoryExecute") || // https://github.com/wojciech-kulik/Sample-Projects/blob/master/Windows%20Desktop/WIN32_MemoryAppLoader/MemoryAppLoader/CMemoryExecute.cs
            (validateNetObject("GetProcAddress") && validateNetUnicodeString("WriteProcessMemory") && validateNetUnicodeString("VirtualAllocEx") && validateNetUnicodeString("ZwUnmapViewOfSection")) ||
            (
                (validateNetObject("WriteProcessMemory") || validateNetObject("NtWriteVirtualMemory")) &&
                (validateNetObject("ZwUnmapViewOfSection") || validateNetObject("NtUnmapViewOfSection")) &&
                (validateNetObject("CreateProcess") || validateNetObject("NtCreateProcess") || validateNetObject("CreateProcessA") || validateNetObject("CreateProcessW")) &&
                validateNetObject("VirtualAllocEx"))
        ) {
            log(logType.net, "RunPE-like behavior detected!");

            isRunPePresent = true;
        }

        if (isRunPePresent) options = addOption(options, "RunPE");
    }




    // Self-Extracting archives
    // TODO: Upgrade

    var isSfx = false;

    if (!PE_Cached.isDynamicLinkLibrary && PE.isOverlayPresent()) {
        const overlayPatterns = [
            "'Rar!'", // samples by: WinRAR
            "'PK'03", // samples by: Zip SFX (by Intel)
            "';!@Install@!UTF-8!'", "'7z'BCAF271C", "efbbbf';!@Install@!UTF-8!'" // samples by: 7z
        ]

        for (var l = 0; l < overlayPatterns.length; l++) {
            if (PE.compareOverlay(overlayPatterns[l])) {
                log(logType.nothing, "SFX overlay pattern: " + overlayPatterns[l]);

                isSfx = true;
            }
        }


        if (!isSfx && !PE_Cached.isDotNet) {
            const sfxEntries = [
                // "E8$$$$$$$$558BEC83EC..A1........8365....8365....5357BF........3BC7BB........74..85C374..F7D0", // samples by: WinZip
                // "558BEC6A..68........68........64A1........50648925........83....5356578965..FF15", // samples by: Zip SFX
                // "E8$$$$$$$$558BEC83EC..8365....8365....A1........5657BF........BE........3BC7", // samples by: WinRAR Installer
                // "E8$$$$$$$$8BFF558BEC83EC..A1........8365....8365....5357BF........BB", // samples by: Zip SFX
                // "558BEC83C4..B8........E8........33C05568........64FF30648920E8", // samples by: Zip SFX
                // "4883EC..E8$$$$$$$$48895C24..55488BEC4883EC..488365....48BB................488B05........483BC375", // samples by: WinRAR Installer
                "83EC..5657FF15........8BF08D4424..50C74424..........FF15........8A068B3D........3C..75..56FFD7", // samples by: Zip SFX
                "E9$$$$$$$$558BEC81EC........830D..........5356576A..33DBBF........68........895D..881D", // samples by: Microsoft Cabinet
                "558BEC83EC..56FF15........8BF08A003C..75..84C074..803E..74..46803E..75..803E..75..46EB", // samples by: Zip SFX
                "6A..33C0505050FF15........50E8$$$$$$$$55B8........8BECE8........53B9........5657BE", // samples by: Zip SFX
                "6A..68........E8........66813D............75..A1........81B8................75..", // samples by: Microsoft Cabinet
                "558BEC83EC..565733FFFF15........8BF0897D..8D45..50FF15........8A063C..75..56FF15", // samples by: Zip SFX
                "51526A..2EFF15........506A..6A..2EFF15........50E8........502EFF15........5A59C3", // samples by: WinIMP
                "558BEC81EC........535657FF15........A3........FF15........A1........6625....3D", // samples by: Microsoft Cabinet
                "558BECB8........E8........5356BE........578D45..5633DB5053FF15........85C00F84", // samples by: Zip SFX
                "A1........C1E0..A3........575133C0BF........B9........3BCF76..2BCFFCF3AA595F", // samples by: WinRAR Installer
                "558BEC83C4..5356E8$$$$$$$$E8........6A..E8........8905........E8........8905", // samples by: Zip SFX
                "FF15........B1..380874..B1..4080....74..380874..4080....75..80....74..4033", // samples by: WinZip
                "53FF15........B3..38..74..80C3..4033D28A083ACA74..3ACB74..408A083ACA75", // samples by: WinZip
                "558BEC83C4..535657E8........E8........33C05568........64FF30648920E8", // samples by: WinRAR
                "53FF15........B3..38..74..80C3..8A48..4033D23ACA74..3ACB74..8A48..40", // samples by: WinZip
                "E8$$$$$$$$53BB........E8........85C074..33D28A1083FA..75..40EB", // samples by: WinRAR
                "FFFE2A002A002A006D0065007300730061006700650073002A002A002A00", // samples by: WinRAR Installer
                "E8$$$$$$$$558BEC83C4..B8........53", // samples by: WinRAR Installer
                "8A48014033D23ACA740A3ACB74068A4801" // samples by: WinZip
            ]

            if (PE.isSectionNamePresent("_winzip_")) {
                isSfx = true;
            }

            if (PE_Cached.isArchX86) {
                for (var k = 0; k < sfxEntries.length; k++) {
                    if (PE.compareEP(sfxEntries[k])) {
                        log(logType.nothing, "EP like SFX: \"" + sfxEntries[k] + "\"");

                        isSfx = true;
                    }
                }
            }
        }
    }

    if (isSfx) options = addOption(options, "SFX");




    var entryLikePacker = false;

    const entries = [
        "53565755488D35........488DBE", // samples by: UPX (x64)
        "B8........68........64", // samples by: Petite (x32)
        "60..................E8", // samples by: Anticrack Software (x32)
        "33C08BC068........68", // samples by: ExE Pack (x32)
        "74..E9........60E8", // samples by: PE-PACK
        "EB0668........C39C", // samples by: PECompact (x32)
        "93071F05....8ED0BC", // samples by: aPack (x32)
        "60BE........8DBE", // samples by: UPX (x32)
        "B8........6A..68", // samples by: Petite (x32)
        "BE........AD8BF8", // samples by: WinUPack (x32)
        "68........9C60E8", // samples by: XComp, XPACK (x32)
        "53558BE833DBEB60", // samples by: WWPack (x32)
        "E8000000005D81ED", // samples by: ASPack (x32), TTP Pack (x32)
        "BD........C745", // samples by: kkrunchy (x32)
        "57565351524150", // samples by: mpress (x64)
        "B8........5064", // samples by: PECompact (x32)
        "8CCBBA....03DA", // // samples by: aPack (x32)
        "B8........669C", // samples by: Petite, Themida (x32)
        "E8........53", // samples by: Themida (x32), Safengine Shielden
        "8CC0FA8ED0BC", // samples by: PACKWIN (x32)
        "B8........60", // samples by: Petite, Themida (x32)
        "8B44240456", // samples by: ASDPack (x32)
        "1E068CC88E", // samples by: aPack (x32)
        "1E068CCBBA", // samples by: aPack (x32)
        "EB..9C60E8", // samples by: PECompact (x32)
        "9C60E8CA", // samples by: Petite (x??)
        "60FCBED4", // samples by: ANDPakk (x32)
        "60EB..5D", // samples by: ASPack (x32)
        "60EB..E8", // samples by: G!X Protector
        "64FF35", // samples by: Petite (x32)
        "6033C0", // samples by: yzPack (x32)
        "669C60", // samples by: Petite (x??)
        "EB..60", // samples by: kkryptor, dePACK (x32)
        "60E8", // samples by: mpress, Packman, Pack Master, Yodas Crypter, DxPack, ASPack, MSLRH, tElock (x32), WinUPack
        "6068", // samples by: BeRo, ExE Pack, AHPacker (x32)
        "9C60" // samples by: PEBundle (x32)
    ];

    // Iterate through the entries to check against the entry point
    for (var e = 0; e < entries.length && !entryLikePacker; e++) {
        if (PE_Cached.isArchX86) {
            const entryToCheck = entries[e];

            // If the entry point matches the current entry, set the flag to true and break the loop
            if (PE.compareEP(entryToCheck)) {
                log(logType.nothing, "EP like a packer: \"" + entryToCheck + "\"");

                entryLikePacker = true;
            }
        }
    }

    if (entryLikePacker) options = addOption(options, "EntryPoint");




    // Check if the first instruction at entry point starts with a stack operation

    var isStartsWithStackOperation = false,
        firstEpAsmOpCode;

    // Get the opcode of the first instruction at entry point and check for specific stack operations
    if (PE_Cached.isArchX86) {
        firstEpAsmOpCode = getFirstEpAsmOpCode();

        switch (firstEpAsmOpCode) {
            case "PUSHAL":
            case "PUSHA":
            case "PUSHF":
            case "POPA":
                log(logType.nothing, "\"" + firstEpAsmOpCode + "\" at EP");

                isStartsWithStackOperation = true;
        }
    } else {
        firstEpAsmOpCode = getFirstEpAsmOpCode();

        switch (firstEpAsmOpCode) {
            case "POP":
            case "STMDB":
            case "LDMIA":
            case "STMFD":
            case "LDMFD":
                log(logType.nothing, "\"" + firstEpAsmOpCode + "\" at EP");

                isStartsWithStackOperation = true;
        }
    }

    if (isStartsWithStackOperation) options = addOption(options, firstEpAsmOpCode[0].toUpperCase() + firstEpAsmOpCode.toLowerCase().substring(1, firstEpAsmOpCode.length) + " at EP");




    // Check if the entry point is in the last section

    var isLastSectionEP = false;

    if (!PE_Cached.isDynamicLinkLibrary) {
        if (PE_Cached.numberOfSections > 1) {
            // Get addresses of the last section and entry point

            var lastSectionAddress = -1,
                entryPointAddress = -1;


            // Get last section with non -1 address
            for (var i = 1; lastSectionAddress == -1; i++) {
                lastSectionAddress = PE.OffsetToVA(PE.getSectionFileOffset(PE_Cached.numberOfSections - i));
            }

            entryPointAddress = PE.getAddressOfEntryPoint();


            // Check if the entry point is greater than or equal to the last section address
            if (entryPointAddress >= lastSectionAddress) {
                log(logType.nothing, "EP address (0x" + entryPointAddress.toString(16) + ") more than last section address (0x" + lastSectionAddress.toString(16) + ")");

                isLastSectionEP = true;
            }
        }
    }

    if (isLastSectionEP) options = addOption(options, "Last section EP");




    // Check for strange calls if entry point is in the last section

    var isStrangeCallOrJmpPresent = false,
        firstOpCode;

    if (PE_Cached.isArchX86) {
        firstOpCode = getAsmOpCode(PE_Cached.firstEpAsmInstruction);

        if (!PE_Cached.isDynamicLinkLibrary) {
            if (isLastSectionEP && !PE.compareEP("E8 00 00 00 00") && (firstOpCode === "CALL" || firstOpCode === "JMP")) {
                log(logType.nothing, "Strange " + firstOpCode.toLowerCase() + " at EP to address: " + PE_Cached.firstEpAsmInstruction.split(" ")[1].toLowerCase());

                isStrangeCallOrJmpPresent = true;
            }
        }
    } else {
        // ARM: Check for strange branch instructions
        firstOpCode = getAsmOpCode(PE_Cached.firstEpAsmInstruction);

        if (!PE_Cached.isDynamicLinkLibrary) {
            // ARM uses B (branch) and BL (branch with link) for jumps and calls
            if (isLastSectionEP && (firstOpCode === "B" || firstOpCode === "BL" || firstOpCode === "BX" || firstOpCode === "BLX")) {
                log(logType.nothing, "Strange " + firstOpCode.toLowerCase() + " at EP to address: " + PE_Cached.firstEpAsmInstruction.split(" ")[1].toLowerCase());

                isStrangeCallOrJmpPresent = true;
            }
        }
    }

    if (isStrangeCallOrJmpPresent) options = addOption(options, "Strange " + firstOpCode.toLowerCase() + " at EP");




    // Check for packers and protections by imports (hashes)

    var isImportsLikePacker = false;

    // [{Name}, {Version}, {ImportLibraryIndex}, {Hash/Hashes}, {Type (0 = packer, 1 = cryptor, 2 = protector, 3 = protection)}]
    // If {ImportLibraryIndex} is -1, it means the hash has no index

    var dbCollectionOfHashesDict = [
        // packers
        ["UPX", "0.59-0.93", 0, 0xd4fdcab1, 0], // https://github.com/upx/upx
        ["UPX", "0.94-1.93", 0, 0x1d51299a, 0],
        ["UPX", "1.94-2.03", 0, [0xb3318086, 0x3778aab9], 0],
        ["UPX", "2.90-3.XX", 0, 0xf375ee03, 0],
        ["UPX", "2.90-3.XX", -1, 0xf737d853, 0],
        ["UPX", "3.91+", -1, [0x82a048fc, 0x554a1748], 0],
        ["PESpin", null, 2, 0xd4fdcab1, 0],
        ["NsPack", null, 0, 0xf375ee03, 0], // https://nspack.apponic.com/
        ["NsPack", "3.X", 0, 0x86111e49, 0], // For .NET
        ["ASPack", "1.XX-2.XX", 0, 0x1272f45b, 0], // https://www.aspack.com/
        ["ASPack", null, 0, 0xee6ea174, 0],
        ["MKFPACK", null, 0, 0x42b3e7f9, 0],
        ["MPRESS", null, 0, 0x174efb84, 0], // https://www.autohotkey.com/mpress/mpress_web.htm
        ["Packman", "0.0.0.1", 0, 0x174efb84, 0],
        ["Packman", "1.0", 0, 0x69076a83, 0],
        ["PECompact", "0.90-0.91", -1, 0xbea416d1, 0], // https://bitsum.com/portfolio/pecompact/
        ["PECompact", "0.92-0.94", -1, 0x93312c2e, 0],
        ["PECompact", "0.97-0.971b", -1, 0xe6aa8495, 0],
        ["PECompact", "1.10b7-1.34", -1, 0xe4c11305, 0],
        ["PECompact", "1.30-1.40", 0, 0x9b3305ed, 0],
        ["PECompact", "1.40-1.84", 0, 0xcc5b2a3c, 0],
        ["PECompact", "2.40-3.XX", 0, 0x2652ce4f, 0],
        ["PECompact", "2.40-3.XX", -1, 0xdb8fbb75, 0],
        ["tElock", "1.0", -1, 0x051946f7, 0], // https://www.softpedia.com/get/Programming/Packers-Crypters-Protectors/Telock.shtml
        ["tElock", "0.98", 0, 0x3651f68d, 0],
        ["JDPACK", "2.00", 0, 0xc002db0e, 0],
        ["CRINKLER", null, 0, 0x0b0e1fbf, 0],
        ["XComp", "0.97-0.98", -1, 0xea1e66e4, 0],
        ["XPack", null, -1, [0x2ac44dd2, 0x6c170ab3], 0],
        ["kkrunchy", null, 0, 0x29188619, 0], // https://www.farbrausch.de/~fg/kkrunchy/
        ["ANDPakk2", "0.18", -1, 0x29188619, 0],
        ["RLPack", "1.1-1.2", 0, 0x5bd1d713, 0],
        ["RLPack", "1.16+", 0, 0x6889715b, 0],
        ["Petite", "2.2", -1, 0x61e53682, 0], // https://www.un4seen.com/petite/
        ["bambam", "0.1-0.4", 0, 0xb5b153cd, 0],
        ["py2exe", null, 2, 0xe5907ffa, 0],
        ["py2exe", null, -1, 0xc544ca52, 0],
        ["MEW", null, 0, 0x87214e52, 0],
        ["nPack", "1.1+", 0, 0xba8bf4be, 0],
        ["CExe", "1.0a", 0, 0xdcf764d2, 0],
        ["PE-PACK", "1.0", 0, 0xa4d96677, 0],
        ["BoxedApp", null, 0, 0x6206c0c2, 0],
        ["VPacker", "0.02.X", 0, 0xebc3bc90, 0],
        ["PKLITE32", "1.1", 0, [0x621f19fb, 0xee04c332], 0],
        ["PKLITE32", "1.1", 1, 0x184539e7, 0],
        ["PeX", "0.99", 0, 0x5fbf5fd8, 0],
        ["XComp", null, 0, 0x4bc52e77, 0],
        ["Fatpack", null, 0, 0x74244911, 0],
        // cryptors
        ["Yoda's Crypter", "1.X", -1, 0x1303a51b, 1],
        ["EXECryptor", "1.4-1.5", -1, 0xd1de53b5, 1],
        ["EXECryptor", "2.X", -1, 0xf51b2817, 1],
        ["Amber", null, -1, 0x97c72051, 1],
        ["Lumy", null, -1, 0x821669d5, 1],
        // protectors
        ["ASProtect", "1.XX-2.XX", 0, 0x1272f45b, 2], // https://www.asprotect.ru/
        ["Shrinker", "3.2", 0, [0xb2a64858, 0x158af2d0, 0x49e8aa1f], 2],
        ["Shrinker", "3.5", 0, [0xe9ea0851, 0x3344b95d, 0x586088f3], 2],
        ["Enigma", "1.00-3.60", 0, 0xc002db0e, 2], // https://enigmaprotector.com/
        ["Enigma", "2.XX", 0, 0xdd92de10, 2],
        ["Enigma", "3.70+", 0, 0xd04c7a50, 2],
        ["PCGUARD", "5.04-5.05", 0, [0x5a169c7a, 0x0b0b2965], 2],
        ["Vbs To Exe", null, 1, [0x2bc5f1f9, 0x009a2869, 0x5a7ce7d6, 0xe513a67d, 0x4d65f922], 2],
        ["eXPressor", "1.2", -1, [0x66b35c6e, 0x32f4466c], 2], // https://www.cgsoftlabs.ro/express.html
        ["eXPressor", "1.3", -1, [0x921d0280, 0xf51eba68, 0xbc84ce09], 2],
        ["eXPressor", "1.4.5.X", 0, [0x427816ab, 0x3c705cae, 0x4d02e093, 0x958a9ea2], 2],
        ["eXPressor", "1.5.0.X", -1, [0x7ababb5a, 0x95ca15e4, 0xbd41da20], 2],
        ["eXPressor", "1.6", -1, 0xca58fa0c, 2],
        ["eXPressor", "1.6", 0, 0x30bc0039, 2],
        ["eXPressor", "1.6.1", 0, 0xa5792a26, 2],
        ["eXPressor", "1.6.1", -1, 0x48ffd359, 2],
        ["VMProtect", "1.70", -1, 0x1ff3103f, 2], // https://vmpsoft.com/
        ["VMProtect", "2.0.3-2.13", -1, 0x9d12b153, 2],
        ["VMProtect", "3.0.0", -1, 0x1e5500c1, 2],
        ["VMProtect", "3.0.9", -1, 0xc5fb6a4b, 2],
        ["VMProtect", "3.2.0-3.5.0", -1, 0x5caa99c7, 2],
        ["VMProtect", "3.6.0+", -1, [0x66e03954, 0xdae9f570], 2],
        ["YodasProtector", "1.0b", -1, 0x1303a51b, 2],
        ["ASM Guard", "2.XX+", -1, 0xf1e0d63b, 2], // https://github.com/DosX-dev/ASM-Guard
        ["Themida", "2.XX-3.XX", 0, 0x3ffccc8a, 2],
        ["Themida", null, 0, 0xad97c503, 2],
        [".NET Reactor", null, 0, 0x96be8e26, 2], // https://www.eziriz.com/dotnet_reactor.htm
        [".NET Reactor", null, 1, 0xb4cda32f, 2],
        ["Bat To Exe Converter", null, 0, 0x72a2ca64, 2],
        ["Vbs To Exe Converter", null, 0, 0x182aac68, 2],
        ["DNGuard", null, 0, 0x38432571, 2], // https://www.dnguard.net/
        ["DNGuard", "4.9+", 0, 0x99f8b58e, 2],
        ["obfus.h", null, -1, 0x02f4771f, 2], // https://github.com/DosX-dev/obfus.h  ;  default, antidebug v1
        ["Crunch", "1.0-2.0", 0, 0x615665dd, 2],
        ["Private EXE Protector", null, 0, 0xd89af68d, 2], // https://www.privacy-tutorials.com/private-exe-protector/
        ["CodeVirtualizer", null, 4, 0x4fbeea23, 2], // https://www.oreans.com/CodeVirtualizer.php
        ["PELock", null, 0, [0x6eb8f6f1, 0xe571f715], 2],
        ["PELock", "2.X", 0, 0xe1689d7c, 2],
        ["CrypToCrack", "0.9.X", 0, 0x8b28bb4e, 2],
        ["DBPE", null, 0, [0x301ad755, 0x33406ae3], 2],
        ["Virbox", null, 0, 0xe6eb008d, 2], // https://lm-global.virbox.com/detail/virboxProtector.html
        ["Quick Batch File Compiler", null, -1, 0x347060fa, 2], // https://www.abyssmedia.com/quickbfc/
        ["CodeVeil", null, 0, 0xd2c88a9c, 2]
    ];

    const importValidatingResult = validateImportHashes(dbCollectionOfHashesDict);

    var versionByImportsDetected;

    if (importValidatingResult != null) {
        versionByImportsDetected = importValidatingResult[1];

        log(logType.nothing, "Imports hash like " + importValidatingResult[0] + (versionByImportsDetected ? " (version " + versionByImportsDetected + ")" : String()));

        isImportsLikePacker = true;
    }

    // Clean up: release the dictionary
    dbCollectionOfHashesDict = undefined;

    if (isImportsLikePacker) options = addOption(options, "Imports like " + importValidatingResult[0] + (versionByImportsDetected ? " (v" + importValidatingResult[1] + ")" : String()));




    // Check for packers and protections by section names

    var isSectionNameLikePacker = false;

    // [{Name}, {Version}, {SectionNameSignature}]

    var dbCollectionOfSectionNamesDict = [
        ["DBPE", null, "        "],
        ["Themida", "2.XX", "   "],                                                  // https://www.oreans.com/Themida.php
        ["Themida", "3.XX", [".imports", ".loadcon", ".themida", ".winlice"]],       // .
        ["Themida", null, [".stub01", "WinLicen", ".v-lizer", "Themida "]],          // .
        ["PEBundle", null, /^(PEB|peb)undle$/],                                      // https://bitsum.com/pebundle.htm
        ["DZA Patcher", null, "yoda"],
        ["UPX", null, /^UPX[0-3]$/],                                                 // https://github.com/upx/upx
        ["VMProtect", null, /^\.vmp[0-3]$/],                                         // https://vmpsoft.com/
        [".NET Reactor", "2.XX", ".reacto"],                                         // https://www.eziriz.com/dotnet_reactor.htm
        ["ACProtect", null, ".perplex"],                                             // https://acprotect-standard.soft112.com/
        ["ANDpakk2", null, "ANDpakk2"],
        ["ASM Guard", "2.XX", [".asmg", "ASMGUARD"]],                                // https://github.com/DosX-dev/ASM-Guard
        ["ASPack", "1.08-2.XX", ".adata"],                                           // https://www.aspack.com/
        ["ASPack", "2.XX", ".aspack"],                                               // .
        ["ASPack", null, /^(\.)?ASPack$/],                                           // .
        ["Alienyze", null, ".alien"],                                                // https://alienyze.com/
        ["BoxedApp", null, ".bxpck"],                                                // https://www.boxedapp.com/
        ["CodeVirtualizer", null, ".vlizer"],                                        // https://www.oreans.com/CodeVirtualizer.php
        ["Enigma", null, /^\.enigma[12]$/],                                          // https://enigmaprotector.com/
        ["Eronana", null, ".packer"],                                                // https://github.com/Eronana/packer
        ["MPRESS", null, /^\.MPRESS[12]$/],                                          // https://www.autohotkey.com/mpress/mpress_web.htm
        ["NsPack", null, [/^(\.)?nsp[01]$/, /^PE[Pp][01]$/, ".Packer!"]],            // https://nspack.apponic.com/
        ["PE Diminisher", null, ".teraphy"],                                         // https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/win/ped.zip
        ["PE-SHiELD", null, "PESHiELD"],                                             // https://webscene.ir/tools/show/PE-SHIELD-0.25
        ["PECompact", null, [/^PEC2(MO)?$/, /^pec(1)?$/]],                           // https://bitsum.com/portfolio/pecompact/
        ["PELock", null, ["PELOCKnt", ".pelock"]],                                   // https://www.pelock.com/ 💩
        ["Petite", null, /^(\.)?petite$/],                                           // https://www.un4seen.com/petite/
        ["SecuROM", null, [/^\.cms_[dt]$/, ".securom", ".dsstext"]],                 // https://en.wikipedia.org/wiki/SecuROM
        ["StarForce", "3.X", [".sforce3", ".brick"]],                                // https://www.star-force.com/
        ["Wise Installer", null, ".wise"],                                           // https://wpkg.org/WISE_installer
        ["Gentee Installer", null, ".gentee"],                                       // https://www.gentee.com/download/
        ["Nullsoft Installer", null, ".ndata"],                                      // https://sourceforge.net/projects/nsis/
        ["WiX Installer", null, ".wixburn"],                                         // https://github.com/wixtoolset
        ["BeRoEXEPacker", null, ["packerBY", "bero^fr "]],                           // https://blog.rosseaux.net/page/875fbe6549aa072b5ee0ac9cefff4827/BeRoEXEPacker
        ["Warbird", null, "?g_Encry"],                                               // https://security-explorations.com/microsoft-warbird-pmp.html
        ["YodasCrypter", "1.X", "yC"],                                               // https://sourceforge.net/projects/yodap/files/Yoda%20Crypter/1.3/yC1.3.zip/download
        ["eXPressor", null, /^\.ex_(cod|rsc)$/],                                     // https://www.cgsoftlabs.ro/express.html
        ["kkrunchy", null, "kkrunchy"],                                              // https://www.farbrausch.de/~fg/kkrunchy/
        ["tElock", null, "UPX!"],                                                    // https://www.softpedia.com/get/Programming/Packers-Crypters-Protectors/Telock.shtml
        ["Private EXE Protector", null, [".-PEP-", ".TRIAL!", ".const"]],            // https://github.com/NIKJOO/PEP
        ["AtomPePacker", null, ".ATOM"],                                             // https://web.archive.org/web/20221012050538/https://github.com/ORCx41/AtomPePacker
        ["ExeStealth", null, "ExeS"],                                                // https://web.archive.org/web/20250124130104/https://www.webtoolmaster.com/exestealth.htm
        ["RLPack", null, [".RLPack", ".packed"]],
        ["RLPack", null, "Obsidium"],                                                // (Fake Obsidium section name)
        ["BattlEye", null, /^\.be[0-2]$/],                                           // https://www.battleye.com/ (VMProtect-based)
        ["YodasProtector", "1.0b", [".y0da", ".yP"]],                                // https://yodap.sourceforge.net/
        ["obfus.h", null, ".obfh"],                                                  // https://github.com/DosX-dev/obfus.h
        ["Windows PE Packer by Chenzs108", null, ".shell"],                          // https://github.com/czs108/Windows-PE-Packer
        ["SoftSentry", null, [/^_(stext|rdata|data|idata|rsrc|reloc)$/, ".prdata"]], // https://forum.exetools.com/showthread.php?t=1181
        ["PE Lock Phantasm", "1.X", "DINGBOY"],                                      // https://www.arteam.accessroot.com/download39d1.html
        ["XComp", null, /^\.XComp(0)?$/],                                            // http://www.soft-lab.de/JoKo/
        ["XVolkolak", null, ".xvlk"],                                                // unpacker & reconstructor
        ["NetShield", null, "!Sugar"],                                               // https://github.com/AdvDebug/NetShield_Protector
        ["Fatpack", null, ".fpack  "],                                               // https://github.com/Fatmike-GH/Fatpack
        ["Safengine Shielden", null, ".sedat"],                                      // https://safengine.com/downloads/get-demo
        ["Inquartos Obfuscator", null, ".inq"],                                      // http://www.vbnet.ru/forum/show.aspx?id=175877
        ["WinUPack", null, [".ByDwing", ".Upack"]],                                  // https://www.softpedia.com/get/PORTABLE-SOFTWARE/Compression-Tools/Windows-Portable-Applications-Portable-WinUpack.shtml
        ["Xenocode Postbuild", null, ".xcpad"],                                      // https://download.cnet.com/xenocode-postbuild/3000-10250_4-10506240.html
        ["Alloy", null, ".alloy32"],
        ["Crinkler", null, "lz32.dll"],
        ["Crunch", "2.0", "BitArts"],
        ["CrypToCrack", null, ".ccp3p"],
        ["DxPack", "1.0", ["coderpub", ".reloc1"]],
        ["EXE Pack", null, "!EPack"],
        ["FishPE Shield", null, ".FishPE"],
        ["FishPE", null, ".FISHEP"],
        ["G!X Protector", null, ".g!x"],
        ["JDPack", null, ".jdpack"],
        ["Krypton", null, ["krypton", "YADO", "_!_!_!_"]],
        ["MEW", null, "MEW"],
        ["MaskPE", null, ".MaskPE"],
        ["Morphnah", "1.0.X", ".nah"],
        ["NakedPacker", null, /^\.naked[12]$/],
        ["NativeCryptor", null, /^(NATIVES|CONFIG|(F)?CRYPT)~$/],
        ["NeoLite", null, ".neolite"],
        ["PE-PACK", "1.0", "PEPACK!!"],
        ["Perplex", null, ".perplex"],
        ["RLP", null, ".rlp"],
        ["ORiEN", "2.XX", ".loader"],
        ["SC Pack", null, ".scpack"],
        ["SVK Protector", null, ["SVKP", /\.svkp( )?/]],
        ["SafeNet", null, /^\.AKS[1-3]$/],
        ["Shrinker", null, ".shrink1"],
        ["Simple Pack", null, ".spack"],
        ["Software Compress", null, "SoftComp"],
        ["StarForce", "4.X-5.X", ".ps4"],
        ["VCL", null, ".vcl"],
        ["VirtualizeProtect", null, "VProtect"],
        ["WWPack", null, ".WWPACK"],
        ["WWPack32", null, ".WWP32"],
        ["dePack", "1.3.5", ".depack"],
        ["hmimys", "1.3", "hmimys"],
        ["nPack", null, ".nPack"],
        ["yzPack", null, ".yzpack2"],
        ["NeoLite", null, ".neolit"],
        ["bambam", null, ".bedrock"],
        ["WibuKey", null, ".wibu"],
        ["Wibu CodeMeter", null, /^__wibu0[01]$/],
        ["AverCryptor", "1.0-1.02", [".avc", ".Polyene"]],
        ["Huan", null, ".huan"],
        ["Morphnah", "1.0.X", ".nah"],
        ["TSULoader", null, ".tsustub"],
        ["RPCrypt", null, /^\.R(Cryptor|PCrypt)$/],
        ["ExE Pack", null, ["!EPack", ".!ep"]],
        ["XerinFuscator", null, ".Xerin"],
        ["AZProtect 0001", null, "AZPR0001"],
        ["ExeShield", null, ".shield"],
        ["XPack", null, /^\.XPack(0)?$/],
        ["KByS", null, ".shoooo"],
        ["HyperTech Crackproof", null, "peC"],
        ["Byfron", null, /^\.byfron(1)?$/],
        ["DYAMAR", "1.3.X", /^\.dyamar[CD]$/],
        ["Alcatraz", null, ".0Dev"],
        ["Squishy", null, "logicoma"],
        ["DragonArmor", "0.0.4.1", /^(\.)?DAStub$/],
        ["EXECrypt", "1.0", "CRPT"],
        ["N-Code", "0.2", [".pepsi", "n-coded", ".vrs"]],
        ["NoodleCrypt", "2.X", [".Ncryo  ", ".De-vir "]],
        ["TheArk", null, ["30cm", ".tw"]],
        ["Virbox", null, /^\.v(data[1-9]|irbox[1-9]?)$/],
        ["ElecKey", null, ".sstb"],
        ["PKLITE32", "1.1", ".pklstb"],
        [".BJFnt", "1.X", ".BJFnt"],
        ["Goliath", null, ".GOLIATH"],
        ["PE Encrypt", null, [".ice", ".lea"]],
        ["PECRYPT32", null, ".ficken"],
        ["PolyCrypt", "2.8", /^sec[0-9]$/],
        ["RCryptor", null, /^(\.)?RCryptor$/],
        ["SDProtector", null, ".data "],
        ["Shielden", null, ".sedata"],
        ["SimbiOZ", null, ".ximera"],
        ["LARP", "2.X", "SnD "],
        ["DalKrypt", "1.X", ".DalKiT"],
        ["Fish PE", "1.2-1.4", ".PEDATA"],
        ["NoobyProtect (Safengine)", null, "SE"],
        ["KeySec", null, ".ksec"],
        ["Lumy", null, ".lumy"],
        ["TomatoX", null, ".tomato"],
        ["PwdProtect", null, ".pwdprot"],
        ["ID Application", null, /^\.Prt(1)?$/],
        ["PETetris", null, "PETETRIS"]
    ];

    const sectionNamesValidatingResult = validateSectionNames(dbCollectionOfSectionNamesDict.concat(
        (function () {
            var dbCollectionOfFakeSectionNamesDict = [
                ["Enigma", /^(\.)?enigma$/i],
                ["UPX", [/^\.upx/i, /^upx/]],
                ["VMProtect", /^(\.)?vmp$/i],
                ["MPRESS", /^mpress/i],
                ["Denuvo", /denuvo/i],
                ["Themida", ".Themida"]
            ];

            return dbCollectionOfFakeSectionNamesDict.map(function (entry) {
                return ["fake " + entry[0], null, entry[1]];
            });
        })()
    ).concat(
        [
            ["a packer", null, [/p(a)?ck|sh(e)?ll|exe|^\.pe/i, /^PE/]],
            ["a cryptor", null, [/crypt|crpt|stub|enc|inj/i, /stb/]],
            ["a protector", null, [/(?!^prot$)prot|safe|lock|sec|virt|obf|guard|sh(ie)?ld/i, /DRM|drm/]]
        ]
    ));

    var versionBySectionDetected = String();

    if (sectionNamesValidatingResult != null) {
        versionBySectionDetected = sectionNamesValidatingResult[1];

        log(logType.nothing, "Sections like " + sectionNamesValidatingResult[0] + (versionBySectionDetected ? " (v" + versionBySectionDetected + ")" : String()));

        isSectionNameLikePacker = true;
    }

    // Clean up: release the dictionary
    dbCollectionOfSectionNamesDict = undefined;

    if (isSectionNameLikePacker) options = addOption(options, "Sections like " + sectionNamesValidatingResult[0] + (versionBySectionDetected ? " (v" + sectionNamesValidatingResult[1] + ")" : String()));




    // Check for packers and protections by resource names

    var isResourceNameLikePacker = false;

    // [{Name}, {Version}, {ResourceNameSignature}]

    var dbCollectionOfResourceNamesDict = [
        ["Bat To Exe Converter", null, /^(?=[0-9A-F]{40}$)(?=.*[0-9])(?=.*[A-F])[0-9A-F]{40}$/],
        ["Fatpack", null, "FPACK"],
        ["Quick Batch File Compiler", null, "PLATFORMTARGETS"],
        ["ScriptCryptor", null, "AOPT"],
        ["ExeStealth", null, "TN"],
        [".NET Reactor", null, "__"],
        ["SoftEntry", null, "SENTRYABORTDLG"],
        ["ASM Guard", null, "ASMG.DLL"],
        ["UPX Protector", null, "SCAREBYTE"],
        ["Vbs To Exe", null, "B"],
        ["QQProtect", null, "QQPROTECT"]
    ];

    const resourceNamesValidatingResult = validateResourceNames(dbCollectionOfResourceNamesDict);

    var versionByResourceDetected = String();

    if (resourceNamesValidatingResult != null) {
        versionByResourceDetected = resourceNamesValidatingResult[1];

        log(logType.nothing, "Resources like " + resourceNamesValidatingResult[0] + (versionByResourceDetected ? " (v" + versionByResourceDetected + ")" : String()));

        isResourceNameLikePacker = true;
    }

    // Clean up: release the dictionary
    dbCollectionOfResourceNamesDict = undefined;

    if (isResourceNameLikePacker) options = addOption(options, "Resources like " + resourceNamesValidatingResult[0] + (versionByResourceDetected ? " (v" + versionByResourceDetected + ")" : String()));




    // Check if there is a collision in sections

    var isCollisionInSectionsPresent = false;

    // Get section name collision between "0" and "1"
    const sectionNameCollision = PE.getSectionNameCollision("0", "1");

    // Check if there is a collision
    if (sectionNameCollision.length) {
        log(logType.nothing, "Section names collision: \"" + clearSectionName(sectionNameCollision) + "\"");

        isCollisionInSectionsPresent = true;
    }

    if (isCollisionInSectionsPresent) options = addOption(options, "Sections collision (\"" + clearSectionName(sectionNameCollision) + "\")");




    // Check if there are repeating section names

    var isSectionNamesRepeatingPresent = false;

    var sectionNamesDict = {};

    for (var i = 0; i < PE_Cached.numberOfSections && !isSectionNamesRepeatingPresent; i++) {
        var sectionName = PE.getSectionName(i);
        sectionNamesDict[sectionName] = (sectionNamesDict[sectionName] || 0) + 1;
        if (sectionNamesDict[sectionName] > 1) {
            log(logType.nothing, "Section names repeating: \"" + clearSectionName(sectionName) + "\"");

            isSectionNamesRepeatingPresent = true;
        }
    }

    // Clean up: release the dictionary
    sectionNamesDict = undefined;

    if (isSectionNamesRepeatingPresent) options = addOption(options, "Section names repeating");




    // Check for compressed sections using entropy

    var isCompressedSectionPresent = false;

    var compressedSectionIndex = -1;

    for (var t = 0; t < PE_Cached.numberOfSections && !isCompressedSectionPresent; t++) {
        compressedSectionIndex = t;
        if (PE.calculateEntropy(PE.getSectionFileOffset(compressedSectionIndex), PE.getSectionFileSize(compressedSectionIndex)) > 7.4) {
            log(logType.any, "Section #" + compressedSectionIndex + " (\"" + clearSectionName(PE.getSectionName(compressedSectionIndex)) + "\") entropy: " + PE.calculateEntropy(PE.getSectionFileOffset(compressedSectionIndex), PE.getSectionFileSize(compressedSectionIndex)));

            isCompressedSectionPresent = true;
        }
    }

    if (isCompressedSectionPresent) options = addOption(options, "Section #" + compressedSectionIndex + " (\"" + clearSectionName(PE.getSectionName(compressedSectionIndex)) + "\") compressed");




    var standardSectionsWithUnusualValuesDict = [".bss", "BSS", ".tls", "hydrated"];




    // Check for sections with strange characteristics

    var isSectionHasWrongOffsetOrSize = false;

    var sectionWithWrongOffsetOrSizeIndex = -1;

    var wrongOffset = false,
        wrongSize = false;

    for (var t = 0; t < PE_Cached.numberOfSections && !isSectionHasWrongOffsetOrSize; t++) {
        sectionWithWrongOffsetOrSizeIndex = t;
        if (standardSectionsWithUnusualValuesDict.indexOf(PE.getSectionName(sectionWithWrongOffsetOrSizeIndex)) === -1) {
            const currentSection = PE.section[sectionWithWrongOffsetOrSizeIndex];

            // Todo: add more checks
            if (currentSection.FileOffset === 0x00 || currentSection.FileOffset > (PE.getSize() - PE.getOverlaySize())) {
                wrongOffset = true;
            }

            if (currentSection.FileSize === 0x00 || currentSection.FileSize > (PE.getSize() - PE.getOverlaySize())) {
                wrongSize = true;
            }

            isSectionHasWrongOffsetOrSize = wrongOffset || wrongSize;

            if (isSectionHasWrongOffsetOrSize) {
                log(logType.any,
                    "Section #" + sectionWithWrongOffsetOrSizeIndex + " (\"" + clearSectionName(PE.getSectionName(sectionWithWrongOffsetOrSizeIndex)) + "\") has wrong " +
                    (wrongOffset ? "offset (0x" + currentSection.FileOffset.toString(16) + ")" : String()) + (wrongOffset && wrongSize ? ", " : String()) + (wrongSize ? "size (0x" + currentSection.FileSize.toString(16) + ")" : String()));
            }
        }
    }

    if (isSectionHasWrongOffsetOrSize) options = addOption(options, "Section #" + sectionWithWrongOffsetOrSizeIndex + " (\"" + clearSectionName(PE.getSectionName(sectionWithWrongOffsetOrSizeIndex)) + "\") has wrong " + (wrongOffset ? "offset" : String()) + (wrongOffset && wrongSize ? " and " : String()) + (wrongSize ? "size" : String()));




    // Check for sections with identical offsets

    var isSectionHasDuplicateOffset = false;

    var currentSectionIndex = -1;

    var firstSectionIndex = 0,
        firstSectionName = String(),
        secondSectionIndex = 0,
        secondSectionName = String();

    var sectionOffsetsDict = {};

    for (var i = 0; i < PE_Cached.numberOfSections && !isSectionHasDuplicateOffset; i++) {
        currentSectionIndex = i;
        if (standardSectionsWithUnusualValuesDict.indexOf(PE.getSectionName(currentSectionIndex)) === -1) {
            var currentSectionOffset = PE.section[currentSectionIndex].FileOffset;
            if (currentSectionOffset !== 0) {
                if (typeof sectionOffsetsDict[currentSectionOffset] === "undefined") {
                    sectionOffsetsDict[currentSectionOffset] = [currentSectionIndex];
                } else {
                    log(logType.any, "Section #" + sectionOffsetsDict[currentSectionOffset][0] + " (\"" + clearSectionName(PE.getSectionName(sectionOffsetsDict[currentSectionOffset][0])) + "\") and #" + currentSectionIndex + " (\"" + clearSectionName(PE.getSectionName(currentSectionIndex)) + "\") have one offset: 0x" + currentSectionOffset.toString(16));

                    firstSectionIndex = sectionOffsetsDict[currentSectionOffset][0];
                    secondSectionIndex = currentSectionIndex;

                    firstSectionName = clearSectionName(PE.getSectionName(firstSectionIndex));
                    secondSectionName = clearSectionName(PE.getSectionName(secondSectionIndex));

                    isSectionHasDuplicateOffset = true;
                }
            }
        }
    }

    // Clean up: release the dictionary
    sectionOffsetsDict = undefined;

    if (isSectionHasDuplicateOffset) options = addOption(options, "Section #" + firstSectionIndex + " (\"" + firstSectionName + "\") and #" + secondSectionIndex + " (\"" + secondSectionName + "\") have one offset");




    // Check for 'MZ' signature in the overlay

    var isPeAtOverlayDetected = false;

    if (PE.isOverlayPresent() &&
        PE.getOverlaySize() >= 100 &&
        PE.compareOverlay("'MZ'")) {
        log(logType.any, "PE signature at overlay detected");

        isPeAtOverlayDetected = true;
    }

    if (isPeAtOverlayDetected) options = addOption(options, "PE at overlay");




    // Check for a strange overlay in the PE file

    var hasStrangeOverlay = false;

    // Conditions to check for a strange overlay
    if (!isPeAtOverlayDetected && !isSfx && !PE.isSigned() && PE.isOverlayPresent()) {
        var overlayEntropy = PE.calculateEntropy(PE.getOverlayOffset(), PE.getOverlaySize());

        if (
            PE.getOverlaySize() > 150 && overlayEntropy > 7 ||
            PE.getOverlaySize() > (PE.getSize() - PE.getOverlaySize())
        ) {
            log(logType.any, "Overlay size: " + PE.getOverlaySize() + " bytes; Entropy: " + overlayEntropy);

            hasStrangeOverlay = true;
        }
    }

    if (hasStrangeOverlay) options = addOption(options, "Strange overlay");




    // Checks if a PE file is embedded in the resources

    var isPeInResourcesPresent = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedResources && !isPeInResourcesPresent; i++) {
        const resourceOffset = PE.getResourceOffsetByNumber(i);

        if (PE.compare("'MZ'", resourceOffset)) {
            log(logType.any, "PE signature in resources detected");

            isPeInResourcesPresent = true;
        }
    }

    if (isPeInResourcesPresent) options = addOption(options, "PE in resources");




    // Flag to indicate high entropy

    var isHighEntropy = false;

    // Checks for high entropy (ignore overlay)
    if (!(PE_Cached.isDynamicLinkLibrary && (PE.section[".rdata"] || PE.isSectionNamePresent(".rsrc"))) && // .dll with resources
        PE.calculateEntropy(0x00, PE.getSize() - PE.getOverlaySize()) > 7.3) {
        isHighEntropy = true;
    }

    if (isHighEntropy) options = addOption(options, "High entropy");




    // Check for recurring import names

    var recurringImports = false;

    var importNamesDict = {};

    if (!_isResultPresent("linker", "Turbo Linker")) { // Ignore Delphi
        for (var i = 0; i < PE_Cached.numberOfUnmanagedImports && !recurringImports; i++) {
            var name = PE.getImportLibraryName(i);
            importNamesDict[name] = (importNamesDict[name] || 0) + 1;
            if (importNamesDict[name] >= 3) {
                log(logType.nothing, "Recurring import name: \"" + name + "\"");

                recurringImports = true;
            }
        }
    }

    // Clean up: release the dictionary
    importNamesDict = undefined;

    if (recurringImports) options = addOption(options, "Recurring import names");




    if (isImportsLikePacker && !_getNumberOfResults("packer") && !_getNumberOfResults("cryptor") && !_getNumberOfResults("protector") && !_getNumberOfResults("protection")) {
        var typeOfDetectedItem = String();

        switch (importValidatingResult[4]) {
            case 0: typeOfDetectedItem = "packer"; break;
            case 1: typeOfDetectedItem = "cryptor"; break;
            case 2: typeOfDetectedItem = "protector"; break;
            case 3: typeOfDetectedItem = "protection"; break;
        }

        if (typeOfDetectedItem) {
            var version = String(),
                importAndSectionValidationVerdictsDiffer = false;

            if (importValidatingResult[1]) {
                version = importValidatingResult[1];
            } else if (isSectionNameLikePacker && !/^(a [pc]|fake )$/.test(sectionNamesValidatingResult[0])) {
                if (importValidatingResult[0] === sectionNamesValidatingResult[0]) { // is same result
                    if (sectionNamesValidatingResult[1]) {
                        version = sectionNamesValidatingResult[1];
                    }
                } else { // Inconsistency of verdicts
                    importAndSectionValidationVerdictsDiffer = true;
                }
            }

            _setResult("~" + typeOfDetectedItem, importValidatingResult[0] + (importAndSectionValidationVerdictsDiffer ? "-like" : String()), version, "Suspicion only");
        }
    }




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        var detectedType = isCryptor ? "cryptor" : "packer";

        _setResult("~" + detectedType, "Generic", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion



// #region "licensing systems (.NET and Native)"
function scanForLicensingSystems_NET_and_Native() { // For .NET and Native apps
    log(logType.nothing, "Scanning for licensing systems...");

    var options = String();

    var isDetected = Boolean();




    if (PE_Cached.isDotNet) {

        var isLicenseCheckingPresent = false;

        if (validateNetObject("CheckLicense") || validateNetObject("set_License") || validateNetObject("Licensing")) {
            isLicenseCheckingPresent = true;
        }

        if (isLicenseCheckingPresent) options = "DotNET methods";




        // https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.licenseproviderattribute

        var isLicenseProviderPresent = false;

        if (validateNetObject("LicenseProviderAttribute")) {
            isLicenseProviderPresent = true;
        }

        if (isLicenseProviderPresent) options = addOption(options, "Provider attribute");




        // https://learn.microsoft.com/ru-ru/dotnet/api/system.componentmodel.licensemanager

        var isLicenseManagerPresent = false;

        if (validateNetObject("LicenseManager")) {
            isLicenseManagerPresent = true;
        }

        if (isLicenseManagerPresent) options = addOption(options, "License manager");

    }




    // Check for licensing strings

    var isInterestingStringsFound = false;

    const licesingStrings = [ /*[E]*/ "nter serial ", /*[S]*/ "erial key ", " activate ", " trial ", /*[W]*/ "rong activation", /*[W]*/ "rong licens", /*[L]*/ "icense expire", "valid license", /*[L]*/ "icense key", " full version", " purchase a "];

    for (var i = 0; i < licesingStrings.length; i++) {
        const currentPatternToFind = licesingStrings[i];

        if (PE.isSignaturePresent(0x00, PE.getSize(), "'" + currentPatternToFind + "'") ||
            PE.isSignaturePresent(0x00, PE.getSize(), "'" + generateUnicodeSignatureMask(currentPatternToFind) + "'")) {
            isInterestingStringsFound = true;
            break;
        }
    }

    if (isInterestingStringsFound) options = addOption(options, "Strings");




    var isDenuvoLibraryPresent = false;

    if (PE.isLibraryPresentExp(/(Core\\Activation|Activation64)/i)) {
        isDenuvoLibraryPresent = true;
    }

    if (isDenuvoLibraryPresent) options = addOption(options, "Denuvo DRM");




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~licensing", "Contains", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion



// #region "corrupted data (.NET and Native)"
function scanForBadFileFormat_NET_and_Native() {
    log(logType.nothing, "Scanning for corrupted data...");

    var options = String();

    var isDetected = Boolean();




    // EP check

    var isEntryPointIncorrect = false;

    if (!PE.isEntryPointCorrect()) {
        isEntryPointIncorrect = true;
    }

    if (isEntryPointIncorrect) options = addOption(options, "EntryPoint");




    // Section alignment check

    var isSectionAlignmentIncorrect = false;

    if (!PE.isSectionAlignmentCorrect()) {
        isSectionAlignmentIncorrect = true;
    }

    if (isSectionAlignmentIncorrect) options = addOption(options, "Section alignment");




    // File alignment check

    var isFileAlignmentIncorrect = false;

    if (!PE.isFileAlignmentCorrect()) {
        isFileAlignmentIncorrect = true;
    }

    if (isFileAlignmentIncorrect) options = addOption(options, "File alignment");




    // Check for correct header

    var isHeaderIncorrect = false;

    if (!PE.isHeaderCorrect()) {
        isHeaderIncorrect = true;
    }

    if (isHeaderIncorrect) options = addOption(options, "Header");




    // Check for correct section headers

    var isRelocsTableIncorrect = false;

    if (!PE.isRelocsTableCorrect()) {
        isRelocsTableIncorrect = true;
    }

    if (isRelocsTableIncorrect) options = addOption(options, "Relocs");




    // Check IAT (Import Address Table)
    // Can be destroyed when the PE dumped from memory

    var isImportTableIncorrect = false;

    if (!PE.isImportTableCorrect()) {
        isImportTableIncorrect = true;
    }

    if (isImportTableIncorrect) options = addOption(options, "IAT");




    // Check EAT (only for .dll)

    var isExportTableIncorrect = false;

    if (PE_Cached.isDynamicLinkLibrary && !PE.isExportTableCorrect()) {
        isExportTableIncorrect = true;
    }

    if (isExportTableIncorrect) options = addOption(options, "EAT");




    // Check for resources table

    var isResourcesTableIncorrect = false;

    if (!PE.isResourcesTableCorrect()) {
        isResourcesTableIncorrect = true;
    }

    if (isResourcesTableIncorrect) options = addOption(options, "Resources");




    // Check for corrupted DotNET data

    var isNetImportsCorrupted = false;

    if (!PE_Cached.isDotNet && isNetMetaDataPresent() && PE_Cached.numberOfUnmanagedImports == 0) {
        isNetImportsCorrupted = true;
    }

    if (isNetImportsCorrupted) options = addOption(options, "DotNET headers/meta");




    // Check for corrupted DotNET CLR version

    var isNetClrVersionCorrupted = false;

    if (PE_Cached.isDotNet && !isAsciiString(PE.getNETVersion())) {
        isNetClrVersionCorrupted = true;
    }

    if (isNetClrVersionCorrupted) options = addOption(options, "DotNET CLR version");




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~corrupted data", "Generic", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion



// #region "debug data (.NET and Native)"
function scanForDebugData_NET_and_Native() { // For .NET and Native apps
    log(logType.nothing, "Scanning for debug data...");

    var options = String();

    var isDetected = Boolean();




    // Check for sections with debug data by name

    var isDebugSectionPresent = false;

    var debugSectionIndex = -1;

    for (var i = 0; i < PE_Cached.numberOfSections && !isDebugSectionPresent; i++) {
        debugSectionIndex = i;

        const currentSectionName = PE.getSectionName(i);

        if (/(debug|^\.stab(str)?$)/i.test(currentSectionName)) { // Detects TCC/GCC and modern LLVM debug sections
            log(logType.any, "Debug section detected: \"" + clearSectionName(PE.getSectionName(debugSectionIndex)) + "\"");

            isDebugSectionPresent = true;
        }
    }

    if (isDebugSectionPresent) options = "Section #" + debugSectionIndex + " (\"" + clearSectionName(PE.getSectionName(debugSectionIndex)) + "\")";




    // .NET Native debug header, EAT function

    var isNetNativeDebugDataPresent = false;

    if (!PE_Cached.isDotNet && PE.isExportFunctionPresent("DotNetRuntimeDebugHeader")) {
        log(logType.any, ".NET Native debug symbols detected");

        isNetNativeDebugDataPresent = true;
    }

    if (isNetNativeDebugDataPresent) options = addOption(options, "DotNET runtime header");




    // Check for -Wl,--export-all-symbols linker option

    var isSymbolsExported = false;

    if (!PE_Cached.isDynamicLinkLibrary && PE.isExportFunctionPresent("main")) {
        log(logType.any, "The \"--export-all-symbols\" linker option was probably used");

        isSymbolsExported = true;
    }

    if (isSymbolsExported) options = addOption(options, "Symbols exported");




    // Check for absolute PDB path

    var isPdbFullPathPresent = false;

    var pdbExtensionPatternOffset = PE.findSignature(
        PE.getDosStubOffset() + PE.getDosStubSize(),
        PE.getSize() - PE.getOverlaySize(),
        "%% %% %% '.pdb' 00"
    );

    var pdbPathBeginOffset = 0,
        pdbPath = String();

    if (pdbExtensionPatternOffset !== -1) {

        for (var i = pdbExtensionPatternOffset; i > 0; i--) {
            if (PE.readByte(i) === 0x00) {
                pdbPathBeginOffset = i + 1;
                break;
            }
        }

        pdbPath = PE.getString(pdbPathBeginOffset, 256);

        if (pdbPath.length > 255)
            pdbPath = pdbPath.substring(0, 255) + " . . .";

        pdbPath = pdbPath.replace(/[\n\r]/g, String());

        if (pdbPath.match(/^[a-zA-Z]:\\/) !== null) {
            log(logType.any, "PDB absolute path: \"" + pdbPath + "\"");

            isPdbFullPathPresent = true;
        }
    }

    if (isPdbFullPathPresent) options = addOption(options, "Absolute PDB path");




    // Check for portable (relative path) or embedded PDB

    var isPortableOrEmbeddedPdbDetected = false;

    var pdbTextType = String();

    if (pdbPath && pdbPath[0] !== '.' && !isPdbFullPathPresent) {
        pdbTextType = validateSignature("00 52 53 44 53") ? "Embedded" : "Portable";

        log(logType.any, pdbTextType + " PDB name: \"" + pdbPath + "\"");

        isPortableOrEmbeddedPdbDetected = true;
    }

    if (isPortableOrEmbeddedPdbDetected) options = addOption(options, pdbTextType + " PDB (release)");




    // Check for Costura.Fody embedded PDB. It is a .NET tool (library) that embeds DLL builds into the main assembly.

    var isCosturaEmbeddedDebugData = false;

    if (PE_Cached.isDotNet && validateNetObject("costura.costura.pdb.compressed")) {
        log(logType.any, "Costura embedded PDB detected");

        isCosturaEmbeddedDebugData = true;
    }

    if (isCosturaEmbeddedDebugData) options = addOption(options, "Costura.Fody embedded PDB");




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~debug data", "Contains", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion



/**
 * Checks if the .NET Visual Basic standard library is present.
 *
 * @returns {boolean} True if the Microsoft.VisualBasic library is found; otherwise false.
 */
function isVbNetStandardLibraryPresent() {
    return PE.isNetObjectPresent("Microsoft.VisualBasic");
}




/**
 * Checks if the .NET JScript standard library is present.
 *
 * @returns {boolean} True if the Microsoft.JScript library is found; otherwise false.
 */
function isJscriptNetStandardLibraryPresent() {
    return PE.isNetObjectPresent("Microsoft.JScript");
}



/**
 * Determines if the current PE file is a .NET component.
 *
 * @returns {boolean} Returns true if the PE file is identified as a .NET component, otherwise false.
 */
function isFrameworkComponent() {
    if (!PE_Cached.isDotNet || !PE_Cached.isDynamicLinkLibrary || PE_Cached.isNetGlobalCctorPresent) {
        return false;
    }

    const
        buildAssemblyName = PE_Cached.nameOfNetAssemblyName,
        buildModuleName = PE_Cached.nameOfNetModuleName;

    if (buildAssemblyName.length >= 6 && buildAssemblyName.substring(0, 6) === "System" && buildModuleName === (buildAssemblyName + ".dll")) {
        return true;
    }

    return false;
}



/**
 * Validates the presence of a signature (pattern) within a specified range in a PE file.
 *
 * Searches for the given pattern starting from the DOS stub end until the PE size excluding the overlay.
 * Logs a message if the pattern is found and returns a boolean indicating the result.
 *
 * @param {string} pattern - The pattern to search for within the file.
 * @returns {boolean} True if the pattern is found, false otherwise.
 */
function validateSignature(pattern) {
    const
        offsetFound = PE.findSignature(PE.getDosStubOffset() + PE.getDosStubSize(), PE.getSize() - PE.getOverlaySize(), pattern),
        resultBool = offsetFound != -1;

    if (resultBool) {
        lastOffsetDetected = "0x" + Number(offsetFound).toString(16);
        log(logType.any, "Pattern found: " + pattern);
    }

    return resultBool;
}



/**
 * Searches all sections in the current PE file for the specified byte code.
 * If discovered, logs the offset at which it appears and returns true.
 * 
 * @param {string} byteCode - The byte code signature to locate.
 * @returns {boolean} True if the byte code is found in any section, otherwise false.
 */
function validateNetByteCode(byteCode) {
    for (var s = 0; s < PE_Cached.numberOfSections; s++) {
        const
            sectionOffset = PE.getSectionFileOffset(s),
            sectionSize = PE.getSectionFileSize(s);

        var offsetFound = PE.findSignature(sectionOffset, sectionOffset + sectionSize, byteCode);
        if (offsetFound != -1) {
            lastOffsetDetected = "0x" + Number(offsetFound).toString(16);
            log(logType.net, "ByteCode detected: " + byteCode);
            return true;
        }
    }

    return false;
}



/**
 * Validates if the given .NET object is present in the PE file.
 *
 * @param {Object} object - The object to be validated.
 * @returns {boolean} - Returns true if the object is a .NET object, otherwise false.
 */
function validateNetObject(object) {
    const result = PE.isNetObjectPresent(object);
    if (result) log(logType.net, "Object present: " + object);
    return result;
}



/**
 * Validates if a .NET Unicode string is present in the PE file.
 *
 * @param {string} ustring - The Unicode string to validate.
 * @returns {boolean} - Returns true if the Unicode string is present, otherwise false.
 */
function validateNetUnicodeString(ustring) {
    const result = PE.isNetUStringPresent(ustring);
    if (result) log(logType.net, "String present: \"" + ustring + "\"");
    return result;
}



/**
 * Validates if a given Unicode string exists within the PE file.
 *
 * This function searches for the specified Unicode string within the PE file's
 * memory range, excluding the DOS stub and overlay sections. If the string is
 * found, it logs a message indicating the presence of the string.
 *
 * @param {string} ustring - The Unicode string to search for within the PE file.
 * @returns {boolean} - Returns true if the Unicode string is found, otherwise false.
 */
function validateGlobalUnicodeString(ustring) {
    const result = PE.findSignature(PE.getDosStubOffset() + PE.getDosStubSize(), PE.getSize() - PE.getOverlaySize(), generateUnicodeSignatureMask(ustring)) != -1;
    if (result) log(logType.nothing, "Unicode string found: \"" + ustring + "\"");
    return result;
}



/**
 * Generates a Unicode signature mask for the given input string.
 *
 * This function iterates through each character in the input string and appends
 * its Unicode representation to the output string. The first character is appended
 * without a prefix, while subsequent characters are prefixed with "00".
 * 
 * "test" -> "'t'00'e'00's'00't'"
 *
 * @param {string} ustring - The input string for which to generate the Unicode signature mask.
 * @returns {string} The generated Unicode signature mask.
 */
function generateUnicodeSignatureMask(ustring) {
    var output = String();

    // Iterate through each character in the input string
    for (var c = 0; c < ustring.length; c++) {
        // Append the Unicode representation of the character to the output
        output += (c != 0 ? "00" : String()) + "'" + ustring[c] + "'";
    }

    // Return the generated Unicode signature mask
    return output;
}



/**
 * Checks if all .NET references in the provided array are missing.
 *
 * @param {Array} references - An array of .NET references to check.
 * @returns {boolean} - Returns true if all .NET references are missing, otherwise false.
 */
function isAllNetReferencesMissing(references) {
    // Iterate through the array of .NET references
    for (var i = 0; i < references.length; i++) {
        // Get the current reference
        const ref = references[i];

        // If the .NET object corresponding to the reference is present, return false
        if (PE.isNetObjectPresent(ref)) {
            return false;
        }
    }

    // If all .NET references are missing, return true
    return true;
}



/**
 * Checks if all .NET references are present.
 *
 * @param {Array} references - An array of .NET references to check.
 * @returns {boolean} - Returns true if all .NET references are present, otherwise false.
 */
function isAllNetReferencesPresent(references) {
    // Iterate through the array of .NET references
    for (var i = 0; i < references.length; i++) {
        // Get the current reference
        const ref = references[i];

        // If the .NET object corresponding to the reference is not present, return false
        if (!PE.isNetObjectPresent(ref)) {
            return false;
        }
    }

    // If all .NET references are present, return true
    return true;
}



/**
 * Searches for a signature in the first section of a PE file and marks it if found.
 *
 * @param {string} sign - The signature to search for.
 * @param {boolean} isFullName - A flag indicating whether to append '00' to the signature.
 * @returns {string} - The found signature if present, otherwise an empty string.
 */
function findAndMark(sign, isFullName) {
    if (PE.isSignatureInSectionPresent(0,
        ("00'" + sign + "'") + // 00'string
        (isFullName ? "00" : String()))) { // ... '00
        return sign;
    }
    return String();
}



/**
 * Determines if a given string name is obfuscated.
 *
 * The function checks for obfuscation in two cases:
 * 1. If the name contains spaces, it splits the name into tokens and checks each token for obfuscation.
 * 2. If the name does not contain spaces, it checks each chunk of the string (of size 20) for obfuscation.
 *
 * Logs a message if an obfuscated segment or chunk is found.
 *
 * @param {string} name - The string to analyze for obfuscation.
 * @returns {boolean} True if the name or any of its segments/chunks are obfuscated, false otherwise.
 */
function isNameObfuscated(name) {
    if (!name || name.length === 0) return false;

    if (name.indexOf(' ') !== -1) {
        const tokens = name.split(/\s+/);
        for (var i = 0; i < tokens.length; i++) {
            var currentToken = tokens[i];

            // If it starts with an abbreviation and the string is separated by a space, then it is not obfuscated (samples: The Last Of Us: II Remastered resource files)
            if (i == 0 && currentToken.match(/^[A-Z]{3,}/)) {
                return false;
            }

            if (isTokenObfuscated(currentToken)) {
                log(logType.nothing, "Obfuscated string segment: \"" + currentToken + "\" in \"" + name + "\"");
                return true;
            }
        }
        return false;
    }

    // Split the name into chunks
    const CHUNK_SIZE = 20;

    for (var start = 0; start < name.length; start += CHUNK_SIZE) {
        const chunk = name.substring(start, start + CHUNK_SIZE);
        if (isTokenObfuscated(chunk)) {
            log(logType.nothing, "Obfuscated string chunk: \"" + chunk + "\" in \"" + name + "\"");
            return true;
        }
    }

    return false;
}



/**
 * Determines whether a given token is considered obfuscated based on advanced heuristics.
 * 
 * The function checks for:
 * - Tokens shorter than 7 characters are automatically considered clean
 * - Common legitimate patterns (dates, versions, UUIDs, etc.)
 * - Hexadecimal strings (8+ chars) like 'd3adc0de'
 * - Regular expression patterns indicating mixed alphanumeric sequences
 * - Statistical character analysis with entropy detection
 * - Repetitive pattern detection
 *
 * @param {string} token - The string token to analyze
 * @returns {boolean} True if token matches obfuscation patterns, false otherwise
 */
function isTokenObfuscated(token) {
    if (!token || token.length < 7) return false;

    // === WHITELIST: Common legitimate patterns ===

    // Date patterns: YYYY-YYYY, DD.MM.YYYY, YYYY-MM-DD
    if (token.match(/^\d{4}[-\/\.]\d{4}$/) ||
        token.match(/^\d{1,2}[-\/\.]\d{1,2}[-\/\.]\d{2,4}$/) ||
        token.match(/^\d{4}[-\/\.]\d{1,2}[-\/\.]\d{1,2}$/)) return false;

    // Version numbers: v1.2.3, 1.0.0.0, 10.15.7
    if (token.match(/^v?\d+(\.\d+){1,4}$/i)) return false;

    // UUIDs: 550e8400-e29b-41d4-a716-446655440000
    if (token.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)) return false;

    // Common hex prefixes: 0x1234ABCD, 0X1A2B3C4D
    if (token.match(/^0x[0-9a-f]+$/i)) return false;

    // File sizes with units: 123KB, 45.6MB, 1.5GB
    if (token.match(/^\d+(\.\d+)?(bytes?|[kmgt]b)$/i)) return false;

    // IP addresses: 192.168.1.1
    if (token.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)) return false;

    // Common abbreviations/acronyms (all caps with digits): DX11, OpenGL3, Win32
    if (token.match(/^[A-Z]{2,}[0-9]{1,3}$/)) return false;

    // Changelist/build numbers (pure digits 6-12 chars): CL 35398403, Build 123456
    // Todo: upgrade
    if (token.match(/^\d{6,12}$/)) return false;

    // Version control tags: v1.0, v21.9
    if (token.match(/^[Vv]\d{1,2}\.\d{1,4}/)) return false;

    // Build/CI server patterns: buildbot, jenkins, gitlab-runner, etc.
    // Contains common CI/build keywords with hyphens/underscores
    if (token.match(/(buildbot|builder|jenkins|gitlab|runner|relclient|steam|win32|win64|x64|x86)/i)) return false;


    // === OBFUSCATION DETECTION ===

    var stats = { digits: 0, lower: 0, upper: 0, special: 0, transitions: 0 };
    var charTypes = [];

    for (var i = 0; i < token.length; i++) {
        var char = token[i];
        var prevType = charTypes[charTypes.length - 1];
        var currType;

        if (char >= '0' && char <= '9') {
            stats.digits++;
            currType = 'digit';
        } else if (char >= 'a' && char <= 'z') {
            stats.lower++;
            currType = 'lower';
        } else if (char >= 'A' && char <= 'Z') {
            stats.upper++;
            currType = 'upper';
        } else {
            stats.special++;
            currType = 'special';
        }

        charTypes.push(currType);
        if (prevType && prevType !== currType) {
            stats.transitions++;
        }
    }

    const
        totalChars = token.length,
        alphaChars = stats.lower + stats.upper;

    // Detect excessive character type transitions (obfuscation indicator)
    if ((stats.transitions / totalChars) > 0.6 && stats.digits >= 4) return true;

    // Detect repetitive patterns (e.g., "a1b2c3d4e5")
    if (token.match(/^(?:[a-z]\d){4,}$/i)) return true;

    // Pattern: letter-digit-letter with 4+ total digits
    if (token.match(/^(?=\d|[a-z])(?=.*[a-z]\d[a-z])(?=(?:.*\d){4,})/i)) return true;

    // Detect pure hex strings (8+ chars) - likely hashes
    if (token.match(/^[0-9a-f]{8,}$/i)) {
        // Exception: common words that are hex-valid (like "decade", "faded")
        if (!token.match(/^(dead|beef|cafe|babe|fade|deed|feed|face|decade|deface)$/i)) {
            return true;
        }
    }

    // Repeating syllables/segments (e.g., "jnfasjknjnjnjn" - "nj" repeats 3+ times)
    // Detects 2-3 char segments repeating 3+ times consecutively
    if (token.match(/(.{2,3})\1{2,}/)) return true;

    // Mixed letters and digit clusters (e.g., "ac8a8sic8i19o9oi", "j9813jd1039i098")
    // Pattern: letter(s) + digit(s), repeated 4+ times with varying lengths
    if (token.match(/(?:[a-z]+\d+){4,}/i) && stats.digits >= 4) return true;

    // Chaotic alternating: single letter + multiple digits (e.g., "j9813jd1039i098")
    // Pattern: letter + 3+ digits, repeated 2+ times
    if (token.match(/(?:[a-z]\d{3,}){2,}/i)) return true;

    // Random consonant clusters without vowels (e.g., "jnfsjknjn", "bcdfgh")
    // 6+ consonants in a row (excluding common patterns and abbreviation-style names with doubled consonants like "spprgrss.dll")
    // Doubled consonants (pp, ss, rr, etc.) indicate vowel-stripped abbreviations, not obfuscation
    if (token.match(/[bcdfghjklmnpqrstvwxz]{6,}/i) &&
        !token.match(/str|chr|thr|sch|scr|spr/i) &&
        !token.match(/([bcdfghjklmnpqrstvwxz])\1/i)) return true;

    // Single consonant repeated excessively (e.g., "jnfasjknjnjnjn")
    // Same consonant appears 5+ times in strings shorter than 15 chars
    var consonantCounts = {};
    for (var i = 0; i < token.length; i++) {
        var ch = token[i].toLowerCase();
        if ('bcdfghjklmnpqrstvwxz'.indexOf(ch) !== -1) {
            consonantCounts[ch] = (consonantCounts[ch] || 0) + 1;
            if (consonantCounts[ch] >= 5 && token.length < 15) return true;
        }
    }

    // Keyboard walk patterns (e.g., "qwerty", "asdfgh", "zxcvbn")
    if (token.match(/qwerty|asdfgh|zxcvbn|yuiop|hjkl|cvbnm|poiuy|lkjh/i)) return true;

    // Excessive digit-letter boundaries (e.g., "a1b2c3d4e5f6")
    // Count transitions specifically between letters and digits (8+ transitions)
    var digitLetterTransitions = 0;
    for (var i = 1; i < token.length; i++) {
        var curr = token[i], prev = token[i - 1],
            currIsDigit = (curr >= '0' && curr <= '9'),
            prevIsDigit = (prev >= '0' && prev <= '9'),
            currIsLetter = ((curr >= 'a' && curr <= 'z') || (curr >= 'A' && curr <= 'Z')),
            prevIsLetter = ((prev >= 'a' && prev <= 'z') || (prev >= 'A' && prev <= 'Z'));

        if ((currIsDigit && prevIsLetter) || (currIsLetter && prevIsDigit)) {
            digitLetterTransitions++;
        }
    }
    if (digitLetterTransitions >= 8) return true;

    // Statistical thresholds for obfuscation
    return (
        (stats.digits >= 7) ||  // Too many digits
        (stats.digits >= 4 && stats.digits / totalChars > 0.4) ||  // High digit density (raised from 0.35)
        (stats.digits >= 5 && stats.lower >= 3 && stats.upper >= 3) ||  // Balanced mix (suspicious)
        (stats.digits >= 6 && stats.lower >= 5) ||  // Many digits + lowercase
        (alphaChars >= 5 && stats.digits >= 5 && stats.upper === 0 && stats.lower === alphaChars)  // No uppercase variation
    );
}



// #region "obfuscations (Native)"
function scanForObfuscations_Native() {
    log(logType.nothing, "Scanning for obfuscation...");

    var options = String();

    var isDetected = Boolean();




    // PE file must contain at least two sections: one for code and one for resources.

    var isOneSectionFile = false;

    if (PE_Cached.numberOfSections === 1) {
        log(logType.any, "Only one section found!");

        isOneSectionFile = true;
    }

    if (isOneSectionFile) options = addOption(options, "Only one section");




    // Check for section names containing forbidden characters

    var isStrangeSectionsPresent = false;

    // Define forbidden characters
    const badSectionChars = '-=+~!@#$%^&*()"№;%:?*():;,/\\|\'`<> ';

    // Iterate through sections and characters to check for forbidden characters
    for (var i = 0; i < PE_Cached.numberOfSections && !isStrangeSectionsPresent; i++) {
        var sectionName = PE.getSectionName(i);

        if (sectionName.length < 3 || (/^.\d.+/.test(sectionName) && sectionName !== ".00cfg") || sectionName[0] === " ") {
            isStrangeSectionsPresent = true;
        }

        var isIdioticMinGwSectionsPresent = false;

        if (_isResultPresent("linker", "GNU linker ld (GNU Binutils)")) {
            if (PE.isSectionNamePresent(".build-id")) {
                isIdioticMinGwSectionsPresent = true;
            } else {
                for (var d = 1; d < 10 && !isIdioticMinGwSectionsPresent; d++) { // sections like "/5", "/2" etc
                    if (sectionName.indexOf("/" + d) != -1) {
                        isIdioticMinGwSectionsPresent = true;
                    }
                }
            }
        }

        if (isIdioticMinGwSectionsPresent) {
            isStrangeSectionsPresent = false;
            break;
        }

        for (var d = 0; d < badSectionChars.length && !isStrangeSectionsPresent; d++) {
            // If forbidden character is found, set flag and break
            if (sectionName.indexOf(badSectionChars[d]) !== -1) {
                isStrangeSectionsPresent = true;
            }
        }

        if (!isAsciiString(sectionName) && !isStrangeSectionsPresent) {
            isStrangeSectionsPresent = true;
        }
    }

    if (isStrangeSectionsPresent) options = addOption(options, "Strange sections");




    // Check for DOS header in the PE file

    var isDosMissing = false,
        isCustomDosPresent = false;

    // If DOS stub size is 0, set flag for missing DOS
    if (PE.getDosStubSize() === 0) {
        isDosMissing = true;
    } else {
        // Define messages to check for custom DOS
        const messages = [
            "This program cannot be run in DOS mode.", // most popular (standard)
            "This program must be run under Windows", // twinBASIC
            "This program must be run under Win32",
            "This program must be run under Win64",
            "This program requires Win32",
            "This is a Windows NT character-mode executable" // Watcom C/C++
        ];

        isCustomDosPresent = true;

        // Iterate through messages to check for custom DOS
        for (var d = 0; d < messages.length && isCustomDosPresent; d++) {
            if (PE.isSignaturePresent(PE.getDosStubOffset(), PE.getDosStubSize(), "'" + messages[d] + "'")) {
                isCustomDosPresent = false;
            }
        }
    }

    // Add appropriate option based on DOS presence
    if (isDosMissing) options = addOption(options, "Missing DOS");
    else if (isCustomDosPresent) options = addOption(options, "Custom DOS");




    // It works if the file contains an import without an extension (for example, instead of "kernel32.dll" it is written "kernel32").
    // Compilers don't do that

    var isContainsNoExtensionLibrary = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedImports && !isContainsNoExtensionLibrary; i++) {
        const libraryName = PE.getImportLibraryName(i).toLowerCase();

        if (libraryName.length > 4) {
            if (libraryName[libraryName.length - 4] !== ".") {
                isContainsNoExtensionLibrary = true;
            }
        } else { /* if (libraryName.indexOf(".") === -1) */
            isContainsNoExtensionLibrary = true;
        }
    }

    if (isContainsNoExtensionLibrary) options = addOption(options, "No extension import");




    // .exe files in imports are a separate type of sophistication. But this happens.

    var exeInImports = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedImports && !exeInImports; i++) {
        const libraryName = PE.getImportLibraryName(i).toLowerCase();

        if (libraryName.length > 4) {
            if (libraryName !== "ntoskrnl.exe" && libraryName.substr(libraryName.length - 4, 4) === ".exe") {
                exeInImports = true;
            }
        }
    }

    if (exeInImports) options = addOption(options, "EXE in imports");




    // Checks if application resources can be read or if they are compressed/encrypted

    var isUnreadableResourcesPresent = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedResources && !isUnreadableResourcesPresent; i++) {
        if (PE.getResourceOffsetByNumber(i) === -1) {
            isUnreadableResourcesPresent = true;
        }
    }

    if (isUnreadableResourcesPresent) options = addOption(options, "Unreadable resources");




    // Checks is executable application has been compiled or converted to a DLL
    // Like https://github.com/hasherezade/exe_to_dll

    var exeAsDll = false;

    if (PE_Cached.isDynamicLinkLibrary &&
        PE.isExportFunctionPresentExp(/^(Start|main|_start|(w)?WinMain|EntryPoint)$/)) {
        exeAsDll = true;
    }

    if (exeAsDll) options = addOption(options, "EXE as DLL");




    // The .text section should always come first

    var isTextSectionNotFirst = false;

    if (PE_Cached.numberOfSections > 0 && (PE.section[0].Name !== ".text" && PE.section[0].Name !== ".textbss") && (PE.isSectionNamePresent(".text") || PE.isSectionNamePresent(".textbss")) && PE.section[0] === ".code") {
        isTextSectionNotFirst = true;
    }

    if (isTextSectionNotFirst) options = addOption(options, "\".text\" section is not first");




    // If IAT (Import Address Table) is missing or empty

    var isIatMissing = false,
        isEmptyIatPresent = false;

    if (PE_Cached.indexOfImportsSection === -1 && !PE_Cached.isDynamicLinkLibrary) { // DLLs can be resource-only
        isIatMissing = true;
    } else if (PE_Cached.indexOfImportsSection !== -1 && !PE_Cached.numberOfUnmanagedImports) {
        isEmptyIatPresent = true;
    }

    if (isIatMissing) options = addOption(options, "No IAT");
    else if (isEmptyIatPresent) options = addOption(options, "Empty IAT");




    // If both IAT and EAT are missing (for DLLs only)

    var isDllIatAndEatMissing = false;

    if (PE_Cached.isDynamicLinkLibrary && PE.getAddressOfEntryPoint() && (PE_Cached.indexOfImportsSection === -1 && PE_Cached.indexOfExportsSection === -1)) { // DLLs without imports/exports and with EP (not a resource-only DLL)
        isDllIatAndEatMissing = true;
    }

    if (isDllIatAndEatMissing) options = addOption(options, "No IAT and EAT");




    // If EAT (Export Address Table) is missing or empty (for DLLs only)

    var isDllEatMissing = false,
        isDllEmptyEatPresent = false;

    if (!isDllIatAndEatMissing && PE_Cached.isDynamicLinkLibrary) {
        if (PE_Cached.indexOfExportsSection === -1 && PE.getAddressOfEntryPoint()) { // DLL without exports and with EP (not a resource-only DLL)
            isDllEatMissing = true;
        } else if (PE_Cached.indexOfExportsSection !== -1 && PE_Cached.numberOfUnmanagedExports === 0) { // DLL with empty exports
            isDllEmptyEatPresent = true;
        }
    }

    if (isDllEatMissing) options = addOption(options, "No EAT");
    else if (isDllEmptyEatPresent) options = addOption(options, "Empty EAT");




    // Check if the entry point starts with NOP or a NOP-like instruction

    var isStartsWithNop = false;

    if (PE_Cached.isArchX86) {
        /*
         * NOP-equivalent instructions for x86/x64:
         *     * Standard NOP instructions:
         * - 0x90                                           -> NOP                                          (standard 1-byte NOP)
         * - 0x66 0x90                                      -> XCHG AX, AX                                  (2-byte NOP)
         * - 0x0F 0x1F 0x00                                 -> NOP DWORD PTR [EAX/RAX]                      (3-byte NOP)
         * - 0x0F 0x1F 0x40 0x00                            -> NOP DWORD PTR [EAX/RAX+0x00]                 (4-byte NOP)
         * - 0x0F 0x1F 0x44 0x00 0x00                       -> NOP DWORD PTR [EAX/RAX+EAX/RAX*1+0x00]       (5-byte NOP)
         * - 0x66 0x0F 0x1F 0x44 0x00 0x00                  -> NOP WORD PTR [EAX/RAX+EAX/RAX*1+0x00]        (6-byte NOP)
         * - 0x0F 0x1F 0x80 0x00 0x00 0x00 0x00             -> NOP DWORD PTR [EAX/RAX+0x00000000]           (7-byte NOP)
         * - 0x0F 0x1F 0x84 0x00 0x00 0x00 0x00 0x00        -> NOP DWORD PTR [EAX/RAX+EAX/RAX*1+0x00000000] (8-byte NOP)
         * - 0x66 0x0F 0x1F 0x84 0x00 0x00 0x00 0x00 0x00   -> NOP WORD PTR [EAX/RAX+EAX/RAX*1+0x00000000]  (9-byte NOP)
         * 
         * Functional equivalents of NOP:
         * - 0x89 0xF6                       -> MOV ESI, ESI            (x86)
         * - 0x48 0x89 0xF6                  -> MOV RSI, RSI            (x64)
         * - 0x8D 0x76 0x00                  -> LEA ESI, [ESI+0x00]     (x86)
         * - 0x48 0x8D 0x76 0x00             -> LEA RSI, [RSI+0x00]     (x64)
         * - 0x8D 0x74 0x26 0x00             -> LEA ESI, [ESI+EIZ+0x00] (x86)
         * - 0x48 0x8D 0x74 0x26 0x00        -> LEA RSI, [RSI+RIZ+0x00] (x64)
         * - 0x87 0xDB                       -> XCHG EBX, EBX           (x86)
         * - 0x48 0x87 0xDB                  -> XCHG RBX, RBX           (x64)
         * - 0x87 0xC9                       -> XCHG ECX, ECX           (x86)
         * - 0x48 0x87 0xC9                  -> XCHG RCX, RCX           (x64)
         * - 0x87 0xD2                       -> XCHG EDX, EDX           (x86)
         * - 0x48 0x87 0xD2                  -> XCHG RDX, RDX           (x64)
         * - 0x87 0xFF                       -> XCHG EDI, EDI           (x86)
         * - 0x48 0x87 0xFF                  -> XCHG RDI, RDI           (x64)
         * - 0x87 0xC0                       -> XCHG EAX, EAX           (x86)
         * - 0x48 0x87 0xC0                  -> XCHG RAX, RAX           (x64)
         * - 0x8D 0x00                       -> LEA EAX, [EAX]          (x86)
         * - 0x48 0x8D 0x00                  -> LEA RAX, [RAX]          (x64)
         */

        // Universal NOP equivalents (work on both architectures)
        const nopEquivalentsUniversal = [
            "XCHG AX, AX",
            "XCHG BX, BX", "XCHG CX, CX", "XCHG DX, DX",
            "XCHG SI, SI", "XCHG DI, DI", "XCHG BP, BP"
        ];

        // Collections of NOP-equivalent instructions based on architecture
        const nopEquivalents32bit = [
            // x86
            "MOV ESI, ESI", "XCHG EAX, EAX",
            "XCHG EBX, EBX", "XCHG ECX, ECX",
            "XCHG EDX, EDX", "XCHG EDI, EDI",
            "LEA EAX, [EAX]", "LEA ESI, [ESI]",
            "LEA ESI, CS:[ESI]"
        ];

        const nopEquivalents64bit = [
            // x64
            "MOV RSI, RSI", "XCHG RAX, RAX",
            "XCHG RBX, RBX", "XCHG RCX, RCX",
            "XCHG RDX, RDX", "XCHG RDI, RDI",
            "LEA RAX, [RAX]", "LEA RSI, [RSI]",
            "LEA RSI, CS:[RSI]"
        ];

        // Combine universal and architecture-specific instructions
        const nopEquivalents = nopEquivalentsUniversal.concat(
            PE_Cached.is64bit ? nopEquivalents64bit : nopEquivalents32bit
        );

        // First check for standard NOP opcode which covers all NOP variants with different operands
        if (getFirstEpAsmOpCode() === "NOP") {
            isStartsWithNop = true;
        } else {
            // Then check for all functional NOP equivalents that have different opcodes
            for (var i = 0; i < nopEquivalents.length && !isStartsWithNop; i++) {
                if (PE_Cached.firstEpAsmInstruction === nopEquivalents[i]) {
                    isStartsWithNop = true;
                }
            }
        }
    } else {
        /*
         * NOP-equivalent instructions for ARM/ARM64:
         *     * Standard NOP instructions:
         * - 0x00 0xF0 0x20 0xE3               -> NOP (ARM32 explicit)
         * - 0x1F 0x20 0x03 0xD5               -> NOP (ARM64 explicit)
         * 
         * Functional equivalents of NOP:
         * - 0x00 0x00 0xA0 0xE1               -> MOV R0, R0   (ARM32)
         * - 0x01 0x10 0xA0 0xE1               -> MOV R1, R1   (ARM32)
         * - 0x02 0x20 0xA0 0xE1               -> MOV R2, R2   (ARM32)
         * - 0x03 0x30 0xA0 0xE1               -> MOV R3, R3   (ARM32)
         * - 0x04 0x40 0xA0 0xE1               -> MOV R4, R4   (ARM32)
         * - 0x05 0x50 0xA0 0xE1               -> MOV R5, R5   (ARM32)
         * - 0x06 0x60 0xA0 0xE1               -> MOV R6, R6   (ARM32)
         * - 0x07 0x70 0xA0 0xE1               -> MOV R7, R7   (ARM32)
         * - 0x08 0x80 0xA0 0xE1               -> MOV R8, R8   (ARM32)
         * - 0x09 0x90 0xA0 0xE1               -> MOV R9, R9   (ARM32)
         * - 0x0A 0xA0 0xA0 0xE1               -> MOV R10, R10 (ARM32)
         * - 0x0B 0xB0 0xA0 0xE1               -> MOV R11, R11 (ARM32)
         * - 0x0C 0xC0 0xA0 0xE1               -> MOV R12, R12 (ARM32)
         * - 0xE0 0x03 0x00 0xAA               -> MOV X0, X0   (ARM64)
         * - 0xE1 0x03 0x01 0xAA               -> MOV X1, X1   (ARM64)
         * - 0xE2 0x03 0x02 0xAA               -> MOV X2, X2   (ARM64)
         * - 0xE3 0x03 0x03 0xAA               -> MOV X3, X3   (ARM64)
         * - 0xE4 0x03 0x04 0xAA               -> MOV X4, X4   (ARM64)
         * - 0xE5 0x03 0x05 0xAA               -> MOV X5, X5   (ARM64)
         * - 0xE6 0x03 0x06 0xAA               -> MOV X6, X6   (ARM64)
         * - 0xE7 0x03 0x07 0xAA               -> MOV X7, X7   (ARM64)
         * - 0xE0 0x03 0x00 0x2A               -> MOV W0, W0   (ARM64)
         * - 0xE1 0x03 0x01 0x2A               -> MOV W1, W1   (ARM64)
         * - 0xE2 0x03 0x02 0x2A               -> MOV W2, W2   (ARM64)
         * - 0xE3 0x03 0x03 0x2A               -> MOV W3, W3   (ARM64)
         */

        // ARM/ARM64 NOP equivalents
        const nopEquivalentsArm = [
            "NOP",
            "MOV R0, R0", "MOV R1, R1", "MOV R2, R2", "MOV R3, R3",
            "MOV R4, R4", "MOV R5, R5", "MOV R6, R6", "MOV R7, R7",
            "MOV R8, R8", "MOV R9, R9", "MOV R10, R10", "MOV R11, R11",
            "MOV R12, R12", "MOV R13, R13", "MOV R14, R14", "MOV R15, R15"
        ];

        const nopEquivalentsArm64 = [
            "NOP",
            "MOV X0, X0", "MOV X1, X1", "MOV X2, X2", "MOV X3, X3",
            "MOV X4, X4", "MOV X5, X5", "MOV X6, X6", "MOV X7, X7",
            "MOV W0, W0", "MOV W1, W1", "MOV W2, W2", "MOV W3, W3"
        ];

        const nopEquivalents = PE_Cached.is64bit ? nopEquivalentsArm64 : nopEquivalentsArm;

        // Check for standard NOP opcode
        if (getFirstEpAsmOpCode() === "NOP") {
            isStartsWithNop = true;
        } else {
            // Check for functional NOP equivalents
            for (var i = 0; i < nopEquivalents.length && !isStartsWithNop; i++) {
                if (PE_Cached.firstEpAsmInstruction === nopEquivalents[i]) {
                    isStartsWithNop = true;
                }
            }
        }
    }

    if (isStartsWithNop) options = addOption(options, "Nop at EP");




    // Check for "Stack-push address near EP" (CALL $+5)

    var isAddrToStackTrickPresent = false;

    if (PE_Cached.isArchX86) {
        // Check first 30 instructions for "Stack-push address near EP"
        // This trick uses "CALL $+5" (E8 00 00 00 00) to push next instruction address on stack
        if (!PE_Cached.isDynamicLinkLibrary) {
            for (var i = 0; i < 32 && !isAddrToStackTrickPresent; i++) {
                var asmInstruction = getAsmInstructionByIndex(i);

                if (!asmInstruction) break; // Safety check

                // Check if instruction is CALL
                if (getAsmOpCode(asmInstruction) === "CALL") {
                    // Get address and offset for this instruction
                    var disasmAddress = PE.getAddressOfEntryPoint();

                    for (var j = 0; j < i; j++) {
                        disasmAddress = PE.getDisasmNextAddress(disasmAddress);
                    }

                    var currentOffset = PE.VAToOffset(disasmAddress);

                    // Check if machine code matches E8 00 00 00 00 pattern
                    if (PE.compare("E8 00 00 00 00", currentOffset)) {
                        log(logType.any, "Stack-push address near EP found at offset: 0x" + currentOffset.toString(16));

                        isAddrToStackTrickPresent = true;
                    }
                }
            }
        }
    }

    if (isAddrToStackTrickPresent) options = addOption(options, "Stack-push address near EP");




    // Check for CPUID at entry point

    var isCpuidNearEpPresent = false;

    if (PE_Cached.isArchX86) {
        // Check first 15 instructions for CPUID instruction
        if (!PE_Cached.isDynamicLinkLibrary) {
            for (var i = 0; i < 15 && !isCpuidNearEpPresent; i++) {
                var asmInstruction = getAsmInstructionByIndex(i);

                if (!asmInstruction) break; // Safety check

                // Check if instruction is CPUID
                if (getAsmOpCode(asmInstruction) === "CPUID") {
                    log(logType.any, "CPUID near EP found at instruction index: " + i);

                    isCpuidNearEpPresent = true;
                }
            }
        }
    }

    if (isCpuidNearEpPresent) options = addOption(options, "Cpuid near EP");




    // Check for TLS (Thread Local Storage) with a bad entry point (like INT3 or RET). Trick to hide the real EP. (like BoxedApp)

    var isTlsWithBadEpPresent = false;

    if (PE.isTLSPresent()) {
        if (PE_Cached.isArchX86) {
            if (/^INT( )?3$/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction)) ||    // INT3 (0xCC) / INT 3 (0xCD 0x03)
                /^RET( \d+)?$/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction))) {  // All types of RET
                isTlsWithBadEpPresent = true;
            }
        } else {
            // ARM: Check for breakpoint or return instructions
            if (/^BKPT/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction)) ||    // BKPT  (breakpoint)
                /^BRK/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction)) ||     // BRK   (ARM64 breakpoint)
                /^RET/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction)) ||     // RET   (ARM64 return)
                /^BX( )?LR$/.test(PE_Cached.firstEpAsmInstruction)) {             // BX LR (ARM32 return)) {
                isTlsWithBadEpPresent = true;
            }
        }
    }

    if (isTlsWithBadEpPresent) options = addOption(options, "TLS hidden EP");




    // Check for multiple JMPs leading to each other

    var proxyJumpsAtEpPresent = false;

    if (PE_Cached.isArchX86 && (
        PE.compareEP("EB $$ EB") ||
        PE.compareEP("EB $$ E9") ||
        PE.compareEP("E9 ## ## ## ## EB") ||
        PE.compareEP("E9 ## ## ## ## E9")
    )) {
        proxyJumpsAtEpPresent = true;
    }

    if (proxyJumpsAtEpPresent) options = addOption(options, "Proxy jmp at EP");




    // Check if NOP padding is present at the entry point

    var isNopPaddingPresent = false;

    // Condition to check for NOP padding
    if (!isStartsWithNop && getEpAsmPattern(true, 5).indexOf(getInstructionsAsmPattern(["NOP", "NOP"])) !== -1) {
        isNopPaddingPresent = true;
    }

    if (isNopPaddingPresent) options = addOption(options, "Nop EP padding");




    // Check for sections with full RWX permissions (Read, Write, Execute)

    var isRwxSectionPresent = false;

    var rwxSectionIndex = -1;

    const
        SECTION_FLAGS_EXECUTE = 0x20000000, // IMAGE_SCN_MEM_EXECUTE
        SECTION_FLAGS_READ = 0x40000000,    // IMAGE_SCN_MEM_READ
        SECTION_FLAGS_WRITE = 0x80000000,   // IMAGE_SCN_MEM_WRITE
        SECTION_FLAGS_CODE = 0x00000020;    // IMAGE_SCN_CNT_CODE

    const
        RWX_MASK = SECTION_FLAGS_EXECUTE | SECTION_FLAGS_READ | SECTION_FLAGS_WRITE,
        RWX_CODE_MASK = RWX_MASK | SECTION_FLAGS_CODE;


    for (var i = 0; i < PE_Cached.numberOfSections && !isRwxSectionPresent; i++) {
        var currentSectionCharacteristics = PE.section[i].Characteristics;

        if ((currentSectionCharacteristics & RWX_MASK) === RWX_MASK ||
            (currentSectionCharacteristics & RWX_CODE_MASK) === RWX_CODE_MASK) {
            isRwxSectionPresent = true;
            rwxSectionIndex = i;
        }
    }

    if (isRwxSectionPresent) options = addOption(options, "Section #" + rwxSectionIndex + " (\"" + clearSectionName(PE.getSectionName(rwxSectionIndex)) + "\") has RWX");




    // Check for zero padding at the beginning of the entry point section

    var isEpSectionZeroPaddingPresent = false;

    var epSectionWithZeroPaddingIndex = -1;

    // Find the section that contains the entry point
    const entryPointRva = PE.getAddressOfEntryPoint() - PE.getImageBase();

    for (var i = 0; i < PE_Cached.numberOfSections && !isEpSectionZeroPaddingPresent; i++) {
        const
            sectionVirtualAddress = PE.getSectionVirtualAddress(i),
            sectionVirtualSize = PE.getSectionVirtualSize(i);

        // Check if the entry point is within this section
        if (entryPointRva >= sectionVirtualAddress &&
            entryPointRva < sectionVirtualAddress + sectionVirtualSize) {
            epSectionWithZeroPaddingIndex = i;

            // Check for zero padding at the beginning of the section
            if (PE.compare("00 00 00", PE.getSectionFileOffset(epSectionWithZeroPaddingIndex))) {
                isEpSectionZeroPaddingPresent = true;
            }
        }
    }

    if (isEpSectionZeroPaddingPresent) options = addOption(options, "EP-section #" + epSectionWithZeroPaddingIndex + " (\"" + clearSectionName(PE.getSectionName(epSectionWithZeroPaddingIndex)) + "\") zero padding");




    // Check for a lot of sections (more than 20 -> this is a lot for native builds)

    var tooManySectionsPresent = false;

    if (PE_Cached.numberOfSections > 20) {
        tooManySectionsPresent = true;
    }

    if (tooManySectionsPresent) options = addOption(options, "Too many sections");




    // Check for IAT directory presence

    var isIatDirEmpty = false;

    if (!_isResultPresent("linker", "Turbo Linker")) { // Ignore Delphi
        // Offset of the IAT directory (12 is the number of IMAGE_DIRECTORY_ENTRY_ entries, 8 is the size of each entry)
        const iatDirOffset = getOptHeaderOffset() + (PE_Cached.is64bit ? 0x70 : 0x60) + 12 * 8;

        if (PE_Cached.indexOfImportsSection !== -1 && PE.read_int32(iatDirOffset) === 0) {
            isIatDirEmpty = true;
        }
    }

    if (isIatDirEmpty) options = addOption(options, "IAT directory empty");




    // Check for unused exception section

    var isUnusedExceptionSectionPresent = false;

    if (PE.isSectionNamePresentExp(/^\.[xp]data$/)) {

        // Offset of the exception directory (12 is the number of IMAGE_DIRECTORY_ENTRY_ entries, 8 is the size of each entry)
        var exceptionDirOffset = getOptHeaderOffset() + (PE_Cached.is64bit ? 0x88 : 0x78);

        if (PE.read_int32(exceptionDirOffset) === 0 && PE.read_int32(exceptionDirOffset + 4) === 0) {
            isUnusedExceptionSectionPresent = true;
        }
    }

    if (isUnusedExceptionSectionPresent) options = addOption(options, "Exceptions directory empty");




    // Check for strange exports (Non-ASCII names)

    var isStrangeExportsPresent = false;

    if (PE_Cached.numberOfUnmanagedExports > 0) {
        for (var i = 0; i < PE_Cached.numberOfUnmanagedExports && !isStrangeExportsPresent; i++) {
            const functionName = PE.getExportFunctionName(i);

            if (functionName && (
                /^\d/.test(functionName) ||
                !isAsciiString(functionName) || (
                    !isItemMangled(functionName) &&
                    isNameObfuscated(replaceAllInString(functionName, "_", " "))
                )
            )) {
                isStrangeExportsPresent = true;
            }
        }
    }

    if (isStrangeExportsPresent) options = addOption(options, "Strange exports");




    // Looks for sections whose names contain strange (or invalid) characters

    var isStrangeImportsPresent = false;

    const badImportChars = '=~!@#$%^&*()"№;%:?*():;,|\'`<> ';

    for (var i = 0; i < PE_Cached.numberOfUnmanagedImports && !isStrangeImportsPresent; i++) {
        const libraryName = PE.getImportLibraryName(i);

        if (isAsciiString(libraryName)) {
            for (var l = 0; l < badImportChars.length && !isStrangeImportsPresent; l++) {
                if (!isAsciiString(libraryName) || libraryName.indexOf(badImportChars[l]) !== -1) {
                    isStrangeImportsPresent = true;
                }
            }
        } else if (libraryName.indexOf("MZ") !== 0) { // 'MZ' -> IAT corrupted
            isStrangeImportsPresent = true;
        }
    }

    if (isStrangeImportsPresent) options = addOption(options, "Strange imports");




    // Check for strange resources

    var isStrangeResourcesPresent = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedResources && !isStrangeResourcesPresent; i++) {
        const resourceName = PE.getResourceNameByNumber(i);

        if (resourceName && (!isAsciiString(resourceName) || isNameObfuscated(resourceName))) {
            log(logType.any, "Strange resource name: " + resourceName);

            isStrangeResourcesPresent = true;
        }
    }

    if (isStrangeResourcesPresent) options = addOption(options, "Strange resources");




    // Check for zero linker version

    var isZeroLinkerVersionPresent = false;

    if (PE.getMajorLinkerVersion() === 0 && PE.getMinorLinkerVersion() === 0) {
        isZeroLinkerVersionPresent = true;
    }

    if (isZeroLinkerVersionPresent) options = addOption(options, "Zero linker version");




    // Check for .NET metadata presence

    var isNetMetaDataInNativePresent = false;

    if (isNetMetaDataPresent() && PE_Cached.numberOfUnmanagedImports > 0) {
        isNetMetaDataInNativePresent = true;
    }

    if (isNetMetaDataInNativePresent) options = addOption(options, "DotNET meta");




    // Check for .NET runtime attach functions

    var isNetRuntimeAttachFunctionPresent = false;

    if (PE.isFunctionPresent("_CorExeMain") || PE.isFunctionPresent("_CorDllMain")) {
        isNetRuntimeAttachFunctionPresent = true;
    }

    if (isNetRuntimeAttachFunctionPresent) options = addOption(options, "DotNET runtime attach");




    // ASM Guard fake signatures

    if (PE.section[".asmg"] || PE.section["ASMGUARD"]) {
        for (var f = 0; f < 3; f++)
            _removeResult("packer", ["UPX", "MPRESS", "EP:MPRESS"][f]);
    }




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~protection", "Generic", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion



/**
 * Determines if the PE file's operating system architecture is x86-based.
 *
 * @returns {boolean|undefined} Returns true if the architecture is x86_32 (I386) or x86_64 (AMD64),
 *                               false if the architecture is ARM-based (ARM, ARMNT, THUMB),
 *                               undefined if the architecture is unknown or not recognized.
 */
function isArchX86() {
    switch (PE.getOperationSystemOptions().split(',')[0]) {
        case "I386":  // x86
        case "AMD64": // x86_64
            return true;
        case "ARM":   // ARM
        case "ARMNT": // ARMv7
        case "THUMB": // ARM Thumb
            return false;
        default:
            return undefined;
    }
}



const _patternSplitter = "|";

/**
 * Generates a pattern of assembly instructions or opcodes from the entry point.
 *
 * @param {boolean} onlyOpCodes - If true, only the opcodes of the instructions are included in the pattern.
 * @param {number} numberOf - The number of instructions to include in the pattern.
 * @returns {string} The generated assembly pattern.
 */
function getEpAsmPattern(onlyOpCodes, numberOf) {
    // Initialize the result with a pattern splitter
    var result = _patternSplitter;

    // Get the address of the entry point
    var disasmAddress = PE.getAddressOfEntryPoint();

    // Iterate through instructions up to the specified number
    for (var i = 0; i < numberOf; i++) {

        // Update the address to the next instruction if not the first iteration
        if (i >= 1) {
            disasmAddress = PE.getDisasmNextAddress(disasmAddress);
        }

        // Get the assembly instruction at the current address
        const asmInstruction = PE.getDisasmString(disasmAddress);

        // Append either the opcode or the full instruction to the result
        result += (
            onlyOpCodes ?
                getAsmOpCode(asmInstruction) : // "MOV"
                asmInstruction // "MOV EAX, 4"
        ) + _patternSplitter;
    }

    // Return the generated assembly pattern
    return result;
}



var epAsmInstructions = [];

/**
 * Retrieves the assembly instruction at the specified index from the entry point of a PE file.
 *
 * @param {number} index - The index of the assembly instruction to retrieve.
 * @returns {string} The assembly instruction at the specified index.
 */
function getAsmInstructionByIndex(index) {
    // Check if the instruction is already cached
    if (epAsmInstructions[index] !== undefined) {
        return epAsmInstructions[index];
    }

    // Get the address of the entry point
    var disasmAddress = PE.getAddressOfEntryPoint();

    // Iterate through instructions until the specified index is reached
    for (var i = 0; i <= index; i++) {

        // Update the address to the next instruction if not the first iteration
        if (i >= 1) {
            disasmAddress = PE.getDisasmNextAddress(disasmAddress);
        }

        // Cache the instruction if it hasn't been cached yet
        if (epAsmInstructions[i] === undefined) {
            epAsmInstructions[i] = PE.getDisasmString(disasmAddress);
        }

        // If the current iteration matches the specified index, retrieve the instruction
        if (i === index) {
            // Return the assembly instruction from cache
            return epAsmInstructions[index];
        }
    }
}



/**
 * Generates a subpattern string to search for instructions within a pattern divided by a separator.
 *
 * This function allows you to create a subpattern that can be used to search for specific instructions
 * within a larger pattern string that is divided by a separator (_patternSplitter).
 *
 * Examples:
 * - "|OPCODE1|OPCODE2|OPCODE3|".indexOf("|OPCODE2|")
 * - "|OPCODE1|OPCODE2|OPCODE3|".indexOf(getInstructionsAsmPattern("OPCODE2"))
 * - "|OPCODE1|OPCODE2|OPCODE3|".indexOf("|OPCODE2|OPCODE3|")
 * - "|OPCODE1|OPCODE2|OPCODE3|".indexOf(getInstructionsAsmPattern(["OPCODE2", "OPCODE3"]))
 *
 * @param {string|string[]} instruction - The instruction or array of instructions to create the subpattern for.
 * @returns {string} The generated subpattern string.
 */
function getInstructionsAsmPattern(instruction) {
    return _patternSplitter +
        (
            Array.isArray(instruction) ?
                instruction.join(_patternSplitter) :
                instruction
        ) +
        _patternSplitter;
}



/**
 * Retrieves the first assembly instruction at the entry point of the PE file.
 *
 * @returns {string} The disassembled string of the first instruction at the entry point.
 */
function getFirstEpAsmInstruction() {
    return getAsmInstructionByIndex(0);
    // return PE.getDisasmString(PE.OffsetToVA(PE.getEntryPointOffset()));
}



/**
 * Extracts the opcode from an assembly instruction.
 *
 * @param {string} instruction - The assembly instruction.
 * @returns {string} - The opcode of the instruction.
 */
function getAsmOpCode(instruction) {
    return instruction.indexOf(" ") !== -1 ? instruction.split(" ")[0] : instruction;
}



/**
 * Retrieves the first assembly operation code from the entry point of the executable.
 *
 * @returns {string} The assembly operation code of the first instruction at the entry point.
 */
function getFirstEpAsmOpCode() {
    return getAsmOpCode(PE_Cached.firstEpAsmInstruction);
}



/**
 * Checks if an item pattern appears to be a mangled symbol name.
 * 
 * @param {string} itemPattern - The pattern string to check for mangling
 * @returns {boolean} True if the pattern appears to be a mangled symbol, false otherwise
 */
function isItemMangled(itemPattern) {
    // Check if the pattern is too short to be mangled
    if (itemPattern.length <= 5) {
        return false;
    }

    return (
        (itemPattern[0] === '?' && (itemPattern.indexOf("@@") !== -1 || itemPattern[1] === '?')) || // MSVC mangling: starts with '?' and contains "@@" or has double '?'
        (itemPattern.substring(0, 2) === "_Z") ||                                                   // GNU mangling: starts with "_Z"
        (itemPattern[0] === '@' && itemPattern.indexOf('$') !== -1) ||                              // Borland C++ mangling: starts with '@' and contains '$'
        (itemPattern[0] === '$' && (itemPattern[1] === 's' || itemPattern[1] === 'S'))              // Swift mangling: starts with '$s' or '$S'
    );
}



/**
 * Returns information about the compiler and language based on a mangled symbol pattern.
 *
 * @param {string} itemPattern - The mangled symbol pattern to analyze.
 * @returns {{compiler: string, language: string} | undefined} An object containing the compiler and language if recognized, otherwise undefined.
 */
function getManglerInfoByMangledItem(itemPattern) {
    if (!isItemMangled(itemPattern)) {
        return undefined;
    }

    // Visual C++ (MSVC)
    if (itemPattern[0] === '?') {
        return { compiler: "Microsoft Visual C++", language: "C++" };
    }

    // MinGW (GNU)
    if (itemPattern.substring(0, 2) === "_Z") {
        return { compiler: "MinGW", language: "C++" };
    }

    // Borland C++
    if (itemPattern[0] === '@' && itemPattern.indexOf('$') !== -1) {
        return { compiler: "Borland C++", language: "C++" };
    }

    // Swift
    if (itemPattern[0] === '$' && (itemPattern[1] === 's' || itemPattern[1] === 'S')) {
        return { compiler: "Swift", language: "Swift" };
    }

    return undefined;
}



/**
 * Extracts the unmangled name from a mangled C++ symbol.
 * 
 * This function handles both Microsoft Visual C++ (MSVC) and GNU C++ (GCC) name mangling schemes:
 * - MSVC mangled names start with '?' and include patterns for functions, constructors, destructors, operators, and templates
 * - GCC mangled names start with '_Z' and include patterns for STL functions, namespaced functions, and regular functions
 * - Swift mangled names start with '$s' or '$S' and include patterns for types, functions, properties, and protocols
 * 
 * @param {string} itemPattern - The mangled symbol name to decode
 * @returns {string} The unmangled function/symbol name, or the original pattern if it's not mangled or cannot be decoded
 * 
 * @example
 * // MSVC examples
 * getNameOfMangledItem('?myFunction@@YAXXZ') // returns 'myFunction'
 * getNameOfMangledItem('??0MyClass@@QAE@XZ') // returns 'MyClass' (constructor)
 * getNameOfMangledItem('??$myTemplate@H@@YAXXZ') // returns 'myTemplate'
 * 
 * @example
 * // GCC examples
 * getNameOfMangledItem('_Z9myFunctionv') // returns 'myFunction'
 * getNameOfMangledItem('_ZSt4cout') // returns 'cout'
 * getNameOfMangledItem('_ZN3std4cout') // returns 'cout'
 * 
 * @example
 * // Borland examples
 * getNameOfMangledItem('@func$qi') // returns 'func'
 * getNameOfMangledItem('@Class@method$qpc') // returns 'method'
 * getNameOfMangledItem('@Class@$bctr$qi') // returns 'Class' (constructor)
 * 
 * @example
 * // Swift examples
 * getNameOfMangledItem('$s11MaskStorages4SIMDPTl') // returns 'SIMD'
 * getNameOfMangledItem('$ss9_IndexBoxC6_unboxqd__SgySLRd__lF') // returns '_unbox'
 * getNameOfMangledItem('$sSn11descriptionSSvpMV') // returns 'description'
 */
function getNameOfMangledItem(itemPattern) {
    if (!isItemMangled(itemPattern)) {
        return itemPattern;
    }

    // MSVCPP mangled names start with '?'
    if (itemPattern[0] === '?') {
        // Regular function: ?myFunction@@YAXXZ
        if (itemPattern[1] !== '?') {
            return itemPattern.split("?")[1].split("@")[0];
        }

        // Handle all ?? patterns
        if (itemPattern[1] === '?') {
            var parts, nameWithPrefix;

            // Simple template: ??$myTemplate@H@@YAXXZ
            if (itemPattern[2] === '$') {
                return itemPattern.split("$")[1].split("@")[0];
            }

            // Complex template: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
            if (itemPattern.indexOf('?$') !== -1) {
                var complexMatch = itemPattern.match(/\?\?\d\?\$([^@]+)@/);

                if (complexMatch) {
                    return complexMatch[1];
                }
            }

            // Special mangler: ??_7MyClass@@6B@, ??_EMyClass@@QAEPAXI@Z
            if (itemPattern[2] === '_') {
                parts = itemPattern.split("?");
                if (parts.length >= 3) {
                    nameWithPrefix = parts[2].split("@")[0];
                    // For _E, _G, _R patterns, return the full name
                    if (nameWithPrefix.length > 1 && /[EGR]/.test(nameWithPrefix[1])) {
                        return nameWithPrefix;
                    }

                    // For _7 and other patterns, remove underscore and digit
                    var nameAfterUnderscore = nameWithPrefix.substring(2);

                    return nameAfterUnderscore.indexOf('_') === 0 ? nameAfterUnderscore.substring(1) : nameAfterUnderscore;
                }
            }

            // Constructor/destructor/operators: ??0MyClass@@QAE@XZ, ??1MyClass@@QAE@XZ, ??2@YAPAXI@Z
            if (/[0-9A-D]/.test(itemPattern[2])) {
                parts = itemPattern.split("?");
                if (parts.length >= 3) {
                    nameWithPrefix = parts[2].split("@")[0];

                    // Global operator (single character)
                    if (nameWithPrefix.length === 1 && /[0-9A-D]/.test(nameWithPrefix[0])) {
                        var operatorNames = {
                            '2': 'operator_new', '3': 'operator_delete', '4': 'operator_assign',
                            '5': 'operator_shift_left', '6': 'operator_shift_right', '8': 'operator_equal',
                            '9': 'operator_not_equal', 'A': 'operator_subscript', 'B': 'operator_not',
                            'C': 'operator_cast', 'D': 'operator_cast_const'
                        };

                        return operatorNames[nameWithPrefix[0]] || 'operator_unknown';
                    }

                    // Class functions - remove first character
                    return nameWithPrefix.substring(1);
                }
            }

            // Fallback
            parts = itemPattern.split("?");
            if (parts.length >= 3) {
                var name = parts[2].split("@")[0];

                return (name.length > 0 && /[0-9A-D]/.test(name[0])) ? name.substring(1) : name;
            }
        }
    }

    // GNUCPP mangled names start with '_Z'
    if (itemPattern.substring(0, 2) === "_Z") {
        // STL mangler: _ZSt4cout, _ZSt3minIiET_RKS0_S2_
        if (itemPattern[2] === 'S' && itemPattern[3] === 't') {
            var stlMatch = itemPattern.match(/_ZSt(\d+)(.+)/);

            if (stlMatch) {
                return stlMatch[2].substring(0, parseInt(stlMatch[1], 10));
            }
        } else if (itemPattern[2] === 'N') { // Namespace mangler: _ZN...E
            var components = [],
                remaining = itemPattern.substring(3); // Skip "_ZN"

            // Parse all components
            while (remaining.length > 0 && remaining[0] !== 'E' && /^\d/.test(remaining)) {
                var lengthMatch = remaining.match(/^(\d+)/);

                if (lengthMatch) {
                    var length = parseInt(lengthMatch[1], 10),
                        nameStart = lengthMatch[1].length;

                    if (remaining.length >= nameStart + length) {
                        var name = remaining.substring(nameStart, nameStart + length);
                        components.push(name);
                        remaining = remaining.substring(nameStart + length);
                    } else {
                        break;
                    }
                } else {
                    break;
                }
            }

            // Return the last component (function name)
            if (components.length > 0) {
                return components[components.length - 1];
            }
        } else { // Regular mangler: _Z9myFunctionv, _Z3fooi
            var regularMatch = itemPattern.match(/_Z(\d+)(.+)/);

            if (regularMatch) {
                var funcNameLength = parseInt(regularMatch[1], 10);
                return regularMatch[2].substring(0, funcNameLength);
            }
        }
    }

    // Borland C++ mangled names start with '@'
    if (itemPattern[0] === '@') {
        var parts = itemPattern.split('@');

        // Simple function: @func$qi
        if (parts.length === 2) {
            return parts[1].split('$')[0];
        }

        // Class method: @Class@method$qpc
        if (parts.length >= 3) {
            var methodName = parts[2].split('$')[0];

            // Constructor: @Class@$bctr$...
            if (methodName === '$bctr') {
                return parts[1]; // Return class name
            }

            // Destructor: @Class@$bdtr$...
            if (methodName === '$bdtr') {
                return '~' + parts[1]; // Return destructor name
            }

            // Regular method
            return methodName;
        }
    }

    // Swift mangled names start with '$s' or '$S'
    if (itemPattern[0] === '$' && (itemPattern[1] === 's' || itemPattern[1] === 'S')) {
        var pos = 2,
            identifiers = [];

        // Parse length-prefixed identifier
        function parseIdentifier(str, startPos) {
            if (startPos >= str.length || !/^\d/.test(str[startPos])) {
                return null;
            }

            var match = str.substring(startPos).match(/^(\d+)/);
            if (!match) return null;

            var len = parseInt(match[1], 10),
                digitLen = match[1].length;

            if (startPos + digitLen + len > str.length) {
                return null;
            }

            return {
                name: str.substring(startPos + digitLen, startPos + digitLen + len),
                nextPos: startPos + digitLen + len
            };
        }

        // Parse ALL length-prefixed identifiers, skipping markers/types/substitutions
        // We want to collect ALL readable names and return the last one
        var loopLimit = 50; // Safety limit to prevent infinite loops

        while (pos < itemPattern.length && loopLimit-- > 0) {
            var char = itemPattern[pos];

            // Try to parse length-prefixed identifier
            if (/^\d/.test(char)) {
                var result = parseIdentifier(itemPattern, pos);

                if (result) {
                    identifiers.push(result.name);
                    pos = result.nextPos;
                    continue;
                }
            }

            // Skip substitution references (x, q, y, z and combinations like qd__, yz, etc.)
            if (/^[xqyz]/.test(char)) {
                pos++;
                // Skip additional substitution characters
                while (pos < itemPattern.length && /^[xqyzd_0-9]/.test(itemPattern[pos])) {
                    pos++;
                }
                continue;
            }

            // Skip single-letter markers if followed by digit or known pattern
            if (/^[a-zA-Z]$/.test(char)) {
                var nextChar = pos + 1 < itemPattern.length ? itemPattern[pos + 1] : String();

                // Check for stdlib type codes (2 letters starting with S)
                if (char === 'S' && /^[a-zA-Z]/.test(nextChar)) {
                    var afterStdlib = pos + 2 < itemPattern.length ? itemPattern[pos + 2] : String();
                    // If after stdlib type there's a marker + digit, skip stdlib and continue
                    if (/^[a-z]$/.test(afterStdlib)) {
                        var afterMarker = pos + 3 < itemPattern.length ? itemPattern[pos + 3] : String();
                        if (/^\d/.test(afterMarker)) {
                            pos += 3; // Skip Sx + marker
                            continue;
                        }
                    }
                    // If directly followed by digit, skip stdlib type
                    if (/^\d/.test(afterStdlib)) {
                        pos += 2;
                        continue;
                    }
                }

                // Single letter followed by digit - skip it
                if (/^\d/.test(nextChar)) {
                    pos++;
                    continue;
                }
            }

            // Can't parse further - stop
            break;
        }

        // Return the last identifier (most specific name)
        if (identifiers.length > 0) {
            return identifiers[identifiers.length - 1];
        }

        // Fallback: check for stdlib type codes at current position
        if (pos < itemPattern.length && itemPattern[pos] === 'S' && pos + 1 < itemPattern.length) {
            var typeCode = itemPattern.substring(pos, pos + 2);

            var stdlibTypes = {
                'Sa': 'Array', 'Sb': 'Bool', 'Sc': 'UnicodeScalar', 'Sd': 'Double',
                'Sf': 'Float', 'Sg': 'Optional', 'Sh': 'Set', 'Si': 'Int',
                'SL': 'Collection', 'Sl': 'Slice', 'Sm': 'Mirror', 'Sn': 'Numeric',
                'So': 'ObjectiveC', 'Sp': 'UnsafePointer', 'Sq': 'Optional',
                'SR': 'Sequence', 'Sr': 'UnsafeRawPointer', 'Ss': 'String',
                'SS': 'String', 'St': 'Range', 'ST': 'Equatable', 'Su': 'UInt',
                'Sv': 'UnsafeRawBufferPointer', 'Sw': 'UnsafeBufferPointer',
                'Sx': 'Strideable', 'SY': 'RawRepresentable', 'Sy': 'RawRepresentable',
                'Sz': 'BinaryInteger', 'SD': 'Dictionary', 'SE': 'Encodable',
                'SH': 'Hashable', 'Sk': 'KeyPath', 'SK': 'KeyPath'
            };

            if (stdlibTypes[typeCode]) {
                return stdlibTypes[typeCode];
            }
        }
    }

    return itemPattern;
}



/**
 * Validates import hashes within a database collection.
 * Iterates through each entry in the collection, checking if the import position hash is present.
 * If a matching hash is found, returns the corresponding entry; otherwise, returns null.
 *
 * @param {Array} dbCollection - The database collection to validate, where each entry is an array containing at least a position and hash.
 * @returns {Array|null} The first entry with a matching import position hash, or null if none found.
 */
function validateImportHashes(dbCollection) {
    for (var i = 0; i < dbCollection.length; i++) {
        var position = dbCollection[i][2], hash = dbCollection[i][3];
        if (Array.isArray(hash)) {
            for (var j = 0; j < hash.length; j++) {
                if (PE.isImportPositionHashPresent(position, hash[j])) return dbCollection[i];
            }
        } else if (PE.isImportPositionHashPresent(position, hash)) {
            return dbCollection[i];
        }
    }

    return null;
}



/**
 * Validates section names within a database collection against known PE section names or regular expressions.
 * Iterates through the collection and checks if any section signature matches a known section name or passes a regular expression test.
 *
 * @param {Array} dbCollection - The database collection to validate, where each item is expected to have a section signature at index 2.
 * @returns {Array|null} The first matching item from the collection, or null if no match is found.
 */
function validateSectionNames(dbCollection) {
    for (var i = 0; i < dbCollection.length; i++) {
        var sectionSignature = dbCollection[i][2];
        if (Array.isArray(sectionSignature)) {
            for (var j = 0; j < sectionSignature.length; j++) {
                if ((typeof sectionSignature[j] === "string" && PE.isSectionNamePresent(sectionSignature[j])) ||
                    (sectionSignature[j] instanceof RegExp && PE.isSectionNamePresentExp(sectionSignature[j]))) {
                    return dbCollection[i];
                }
            }
        } else if ((typeof sectionSignature === "string" && PE.isSectionNamePresent(sectionSignature)) ||
            (sectionSignature instanceof RegExp && PE.isSectionNamePresentExp(sectionSignature))) {
            return dbCollection[i];
        }
    }

    return null;
}



/**
 * Validates resource names within a database collection against known PE resource names or regular expressions.
 * Iterates through the collection and checks if any resource signature matches a known resource name or passes a regular expression test.
 *
 * @param {Array} dbCollection - The database collection to validate, where each item is expected to have a resource signature at index 2.
 * @returns {Array|null} The first matching item from the collection, or null if no match is found.
 */
function validateResourceNames(dbCollection) {
    for (var i = 0; i < dbCollection.length; i++) {
        var resourceSignature = dbCollection[i][2];
        if (Array.isArray(resourceSignature)) {
            for (var j = 0; j < resourceSignature.length; j++) {
                if ((typeof resourceSignature[j] === "string" && PE.isResourceNamePresent(resourceSignature[j])) ||
                    (resourceSignature[j] instanceof RegExp && PE.isResourceNamePresentExp(resourceSignature[j]))) {
                    return dbCollection[i];
                }
            }
        } else if ((typeof resourceSignature === "string" && PE.isResourceNamePresent(resourceSignature)) ||
            (resourceSignature instanceof RegExp && PE.isResourceNamePresentExp(resourceSignature))) {
            return dbCollection[i];
        }
    }

    return null;
}



/**
 * Calculates and returns the offset of the PE optional header within the file.
 * 
 * The function reads the e_lfanew field at offset 0x3C to find the PE header start,
 * then adds 4 bytes for the PE signature and 20 bytes for the COFF header to locate
 * the start of the optional header.
 *
 * @returns {number} The offset (in bytes) to the optional header in the PE file.
 */
function getOptHeaderOffset() {
    return PE.read_int32(0x3C) + 4 + 20;
}



/**
 * Checks if the .NET CLR metadata directory is present in the PE file.
 *
 * This function determines the presence of the .NET CLR Runtime Header
 * by reading the appropriate Data Directory entry from the PE Optional Header.
 * It supports both PE32 and PE32+ formats.
 *
 * @returns {boolean} True if the .NET CLR metadata directory is present, false otherwise.
 */
function isNetMetaDataPresent() {
    var optHeaderOffset = getOptHeaderOffset();

    var numRvaAndSizesOffset, clrDirOffset;

    if (!PE_Cached.is64bit) {
        numRvaAndSizesOffset = optHeaderOffset + 0x5C;
        clrDirOffset = optHeaderOffset + 0xD0; // CLR offset for PE32
    } else {
        numRvaAndSizesOffset = optHeaderOffset + 0x6C;
        clrDirOffset = optHeaderOffset + 0xE0; // CLR offset for PE64
    }

    // Check if the offsets are within the bounds of the PE file size
    if (clrDirOffset + 8 > PE.getSize() ||
        numRvaAndSizesOffset + 4 > PE.getSize()) {
        return false;
    }

    // Check if the number of RVA and sizes is valid
    if (PE.read_int32(numRvaAndSizesOffset) < 15) {
        return false;
    }

    // Read CLR directory RVA and size
    var clrRva = PE.read_int32(clrDirOffset),
        clrSize = PE.read_int32(clrDirOffset + 4);

    // Validate CLR directory RVA and size
    return clrRva !== 0 && clrSize !== 0;
}



/**
 * Checks if a compiler has been detected in the analysis results.
 * 
 * @returns {boolean} Returns true if any compiler or compiler-related results are found, false otherwise.
 */
function isCompilerDetected() {
    return _getNumberOfResults("compiler") > 0 || _getNumberOfResults("~compiler") > 0;
}



/**
 * Checks if a linker has been detected in the analysis results.
 * 
 * @returns {boolean} Returns true if any linker or linker-related results are found, false otherwise.
 */
function isLinkerDetected() {
    return _getNumberOfResults("linker") > 0 || _getNumberOfResults("~linker") > 0;
}



// #region "languages and compilers (.NET and Native)"
function scanForLanguagesAndCompilers_NET_and_Native() {
    log(logType.nothing, "Scanning for programming language...");

    var c_cpp = _isLangPresent("C/C++"); // Unknown; C or C++


    const extdb = [
        ["C++", "cpp"],
        ["Rust", "rs"],
        ["Java", "jar"],
        ["Python", "pyd"],
        ["Kotlin", "kt"]
    ];


    for (var i = 0; i < extdb.length; i++) {
        const
            langName = extdb[i][0],
            langExtName = extdb[i][1];

        if (PE.isSignaturePresent(0x00, PE.getSize(), "%% %% %% %% %% %% %% %% '." + langExtName + "' 00")) {
            log(logType.any, "Lines of ." + langExtName + " files (" + langName + ") detected");
            _setLangByHeur(langName);
        }
    }


    if (!_isLangDetected("C++") && PE.isSignaturePresent(0x00, PE.getSize(), "%% %% %% %% %% %% %% %% %% %% '.c' 00")) {
        log(logType.any, "Lines of .c files (C) detected (not a C++)");
        _setLangByHeur("C");
    }


    for (var i = 0; i < PE_Cached.numberOfUnmanagedResources; i++) {
        var resourceOffset = PE.getResourceOffsetByNumber(i);

        if (resourceOffset !== -1) {
            var resourceSignature = PE.getString(resourceOffset, 0x40);

            if (resourceSignature.split(" ")[0] === "object" && resourceSignature.indexOf(": ") !== -1) {
                _setLangByHeur("Object Pascal");
                break;
            }
        }
    }




    var isPpLibraryPresent = false,
        isCLibraryPresent = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedImports; i++) {
        const libraryName = PE.getImportLibraryName(i).toLowerCase();

        // Detect mangler in imported libraries
        for (var k = 0; k < PE.getNumberOfImportThunks(i) && !isPpLibraryPresent; k++) {
            const functionName = PE.getImportFunctionName(i, k); // import, thunk

            if (isItemMangled(functionName)) {
                log(logType.any, "Mangler detected -> \"" + libraryName + "\", at function \"" + getNameOfMangledItem(functionName) + "\"");

                var isNotCpp = false;

                if (!isCompilerDetected()) {
                    var manglerInfo = getManglerInfoByMangledItem(functionName);

                    if (manglerInfo) {
                        _setResult("~compiler", manglerInfo.compiler, String(), String());
                        if (!_isLangDetected()) _setLangByHeur(manglerInfo.language);

                        if (manglerInfo.language !== "C++") isNotCpp = true;
                    }
                }

                isPpLibraryPresent = !isNotCpp; // if language is unknown
            }
        }




        if (
            libraryName.indexOf("++") !== -1 ||
            libraryName.indexOf("cpp") !== -1 ||
            libraryName.indexOf("msvcp") !== -1
        ) {
            log(logType.any, "C++ library present -> \"" + libraryName + "\"");

            isPpLibraryPresent = true;
        }




        if (libraryName.indexOf("msvcr") !== -1 || libraryName.indexOf("crtdll") !== -1) {
            log(logType.any, "C library present -> \"" + libraryName + "\"");

            isCLibraryPresent = true;
        }
    }




    // Detect mangler in exports
    for (var e = 0; e < PE_Cached.numberOfUnmanagedExports && !isPpLibraryPresent; e++) {
        var exportName = PE.getExportFunctionName(e);
        if (exportName && isItemMangled(exportName)) {
            log(logType.any, "Mangler detected at exported item \"" + getNameOfMangledItem(exportName) + "\"");

            var isNotCpp = false;

            if (!isCompilerDetected()) {
                var manglerInfo = getManglerInfoByMangledItem(exportName);

                if (manglerInfo) {
                    _setResult("~compiler", manglerInfo.compiler, String(), String());
                    if (!_isLangDetected()) _setLangByHeur(manglerInfo.language);

                    if (manglerInfo.language !== "C++") isNotCpp = true;
                }
            }

            isPpLibraryPresent = !isNotCpp;
        }
    }




    // Detect compilers by Rich signature

    if (!isCompilerDetected() && PE_Cached.isRichSignaturePresent) {
        for (var j = 0; j < PE_Cached.numberOfRichIDs; j++) {
            const
                richId = PE.getRichID(j),
                richVersion = PE.getRichVersion(j),
                richCount = PE.getRichCount(j);

            if (richId === 0x000d && richVersion === 9782 && richCount === 0x0001) {
                _setResult("~compiler", "Microsoft Visual Basic", "6.0", String());
                _setLangByHeur("VB");
                break;
            } else if (richId === 0x0103) {
                _setResult("~compiler", "MASM", String(), String());
                break;
            }
        }
    }




    // Detect IL2CPP by sections (thanks to AyukiDev)

    if (!isCompilerDetected()) {
        const il2cppSections = [
            ".text$mn",
            ".rdata$zzzdbg",
            ".rtc$IAA",
            ".rtc$IZZ",
            ".rtc$TAA",
            ".rtc$TZZ",
            "il2cpp"
        ];

        for (var i = 0; i < il2cppSections.length; i++) {
            if (PE.isSectionNamePresent(il2cppSections[i])) {
                _setResult("~compiler", "IL2CPP Technology", String(), String());
                _setLangByHeur("Native MSIL/C#");
                break;
            }
        }
    }




    var isCLikeLibsNotFound = !isCLibraryPresent && !isPpLibraryPresent;

    var majorLinkerVersion = PE.getMajorLinkerVersion(),
        minorLinkerVersion = PE.getMinorLinkerVersion();

    if (!isCompilerDetected() && !isLinkerDetected() && !PE_Cached.isDotNet) {
        var ehFrameSection = PE.section[".eh_frame"],
            buildIdSection = PE.section[".build-id"];

        if (!ehFrameSection && !buildIdSection && (
            PE_Cached.isRichSignaturePresent ||
            PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....00000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000") ||
            PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") ||
            PE.isSectionNamePresent(".00cfg")
        )) {
            if (PE.isSectionNamePresent(".gfids") || PE.isSectionNamePresent(".giats") || PE.isSectionNamePresent(".gljmp")) {
                _setResult("~tool", "Microsoft Visual Studio", String(), String())
            }

            _setResult("~linker", "Microsoft Linker", (majorLinkerVersion !== 0 ? (majorLinkerVersion + "." + minorLinkerVersion) : String()), String());
            _setResult("~compiler", "Microsoft Visual C/C++", String(), String());

            if (!_isLangDetected() && isCLikeLibsNotFound) {
                if (isNetMetaDataPresent()) {
                    _setLangByHeur("MSIL/C/C++");
                } else {
                    _setLangByHeur("C/C++");
                }
            }
        } else if (
            ehFrameSection || buildIdSection || (
                PE.isSectionNamePresent(".CRT") && PE.isSectionNamePresent(".rdata") && PE.isSectionNamePresent(".xdata") && PE.isSectionNamePresent(".idata") &&
                (PE.isSectionNamePresent(".tls") || PE.isSectionNamePresent(".bss")) || PE.isSectionNamePresent(".buildid")
            )) {

            _setResult("~compiler", "MinGW", String(), String());

            if (!_isLangDetected() && isCLikeLibsNotFound) {
                _setLangByHeur("C/C++");
            }
        } else if (PE.isSectionNamePresent(".flat") && !isPpLibraryPresent) {
            _setResult("~compiler", "FASM", String(), String());
            _setLangByHeur("ASMx" + (PE_Cached.is64bit ? "64" : "86"));
        }
    }




    const rdataSection = PE.section[".rdata"];

    if (rdataSection) {
        if (c_cpp && // if C/C++ detected by DIE
            PE.isSignaturePresent(
                rdataSection.FileOffset,
                rdataSection.FileSize,
                generateUnicodeSignatureMask("Visual C++"))) {

            log(logType.any, "Embedded Visual C++ Runtime detected.");

            isPpLibraryPresent = true; // Visual C++ Runtime library in resources
        }
    }

    if (isPpLibraryPresent || (c_cpp && PE.isSignaturePresent(0x00, PE.getSize() - PE.getOverlaySize(), "' C++ '"))) {
        _setLangByHeur("C++");
    } else if (!_isLangPresent("C++") && isCLibraryPresent && (PE.isFunctionPresent("_iob") || PE.isFunctionPresent("printf") || PE.isFunctionPresent("malloc") || PE.isFunctionPresent("memset"))) {
        _setLangByHeur("C");
    } else if (PE.isLibraryPresentExp(/^api-ms-win-crt*/i) || PE.isSectionNamePresent(".msvcjmc")) {
        _setLangByHeur("C/C++");
    } else if (!_isLangDetected() && !_getNumberOfResults("compiler") && !PE_Cached.isDotNet) {
        if (!_getNumberOfResults("protector") &&
            !_getNumberOfResults("cryptor") && !_getNumberOfResults("~cryptor") &&
            !_getNumberOfResults("packer") && !_getNumberOfResults("~packer")) {
            _setLangByHeur("ASMx" + (PE_Cached.is64bit ? "64" : "86"));
        }
    }
}
// #endregion



/**
 * Sets the language based on heuristic analysis.
 *
 * @param {string} languageName - The name of the detected language.
 */
function _setLangByHeur(languageName) {
    log(logType.any, languageName + " language detected!");

    _setLang(languageName, heurLabel);
}



/**
 * Adds a new option to the existing options text, separated by " + " if optionsText is not empty.
 *
 * @param {string} optionsText - The current options text.
 * @param {string} newOptionText - The new option to add.
 * @returns {string} The updated options text with the new option appended.
 */
function addOption(optionsText, newOptionText) {
    if (optionsText) optionsText += " + ";
    optionsText += newOptionText;
    return optionsText;
}



/**
 * Logs a message with a specific type and text.
 *
 * @param {number} messageTypeId - The type of the message. 
 *                                 -2: Error, 
 *                                 -1: About, 
 *                                  1: Any, 
 *                                  2: .NET.
 * @param {string} messageText - The text of the message to log. 
 *                               Must not contain newline characters.
 * @throws Will throw an error if the messageText contains a newline character.
 */
function log(messageTypeId, messageText) {
    if (!messageText) {
        return;
    } else if (/\r|\n|\t/.test(messageText)) {
        messageText = messageText.replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim();
        // _error("Illegal char at log( ... )");
    }

    var prefix = String();

    if (messageTypeId !== -2) {
        prefix = heurLabel;
    }

    if (messageTypeId > -2 && messageTypeId !== 0) {
        prefix += "/";
    }

    switch (messageTypeId) {
        case -2: prefix = "!"; break;
        case -1: prefix += "About"; break;
        case 1: prefix += "Any"; break;
        case 2: prefix += ".NET"; break;
    }

    if (typeof _log !== "undefined") {
        _log("[" + prefix + "] " + messageText);
    } else {
        _error("Unable to write log message");
    }
}



//#region "malicious code (.NET and Native)"
function scanForMaliciousCode_NET_and_Native() {
    log(logType.nothing, "Scanning for malicious code...");

    var verdicts = [];

    const mayBeInfected = "May be infected, be careful!";


    if (PE_Cached.isDotNet) {

        var requiredDotNetImports = [
            "System.Diagnostics",
            "System.IO.Compression",
            "user32", "kernel32", "ntdll" // no ext
        ],
            foundImportsCount = 0,
            importSignature, pattern, allPatternImportsFound;

        for (var i = 0; i < requiredDotNetImports.length; i++) {
            importSignature = "00'" + requiredDotNetImports[i] + "'00";
            if (PE.isSignatureInSectionPresent(0, importSignature)) {
                foundImportsCount++;
            }
        }

        if (PE.isSignatureInSectionPresent(0, "00'System.Net.Sockets'00") && foundImportsCount >= 2) {
            var maliciousImportPatterns = [
                {
                    type: "NjRAT",
                    edition: "0.7D Green Edition",
                    references: [
                        "w", "System.Drawing", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll", "capGetDriverDescriptionA",
                        "kernel32", "KERNEL32.DLL", "ntdll",
                        "user32", "GetWindowText", "EnumChildWindows", "SendMessage", "GetWindowTextLength",
                        "user32.dll",
                        "winmm.dll"
                    ],
                    isVbNet: true
                }, {
                    type: "NjRAT",
                    edition: "0.7D Lime Edition",
                    references: [
                        "Stub", "System.Drawing", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll", "capGetDriverDescriptionA",
                        "kernel32",
                        "ntdll", "NtSetInformationProcess",
                        "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState",
                        "user32.dll",
                        "wintrust.dll"
                    ],
                    isVbNet: true
                }, {
                    type: "NjRAT",
                    edition: "0.7D",
                    references: [
                        "Stub", "System.Drawing", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll", "capGetDriverDescriptionA",
                        "kernel32",
                        "ntdll", "NtSetInformationProcess",
                        "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState",
                        "user32.dll"
                    ],
                    isVbNet: true
                }, {
                    type: "NjRAT",
                    edition: "0.11G-0.12G",
                    references: [
                        "k", "System.Drawing", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll", "capGetDriverDescriptionA",
                        "kernel32",
                        "ntdll", "NtsetInformationProcess",
                        "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState", "GetForegroundWindow",
                        "GetWindowTextLengthA", "GetAsyncKeyState",
                        "user32.dll"
                    ],
                    isVbNet: true
                }, {
                    type: "NjRAT",
                    edition: "0.7D Danger Edition",
                    references: [
                        "Stub", "System.Drawing", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll", "capGetDriverDescriptionA",
                        "Kernel32.dll",
                        "KERNEL32.DLL",
                        "user32", "GetWindowText", "EnumChildWindows", "GetForegroundWindow", "SendMessage", "GetWindowTextLength", "SetWindowPos",
                        "user32.dll",
                        "winmm.dll"
                    ],
                    isVbNet: true
                }, {
                    type: "NjRAT",
                    edition: "0.7D Golden Edition",
                    references: [
                        "Stub", "System.Drawing", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll",
                        "kernel32",
                        "Kernel32.dll",
                        "ntdll", "NtSetInformationProcess",
                        "user32", "user32.dll", "GetForegroundWindow", "GetWindowTextA", "winmm.dll"
                    ],
                    isVbNet: true
                }, {
                    type: "XWorm",
                    edition: "3.0-5.0",
                    references: [
                        "System.Core", "System.Drawing", "System.Management", "System.Windows.Forms", "System.Runtime.InteropServices",
                        "avicap32.dll", "capCreateCaptureWindowA",
                        "kernel32.dll", "SetThreadExecutionState",
                        "user32.dll", "GetForegroundWindow", "GetWindowText"
                    ],
                    isVbNet: true
                }, {
                    type: "VenomRAT",
                    edition: "6.X",
                    references: [
                        "Microsoft.CSharp", "System.Core", "System.Drawing", "System.Management",
                        "System.Windows.Forms", "System.Runtime.InteropServices",
                        "kernel32.dll", "SetThreadExecutionState",
                        "ntdll.dll", "RtlSetProcessIsCritical",
                        "user32.dll", "GetWindowText", "GetForegroundWindow"
                    ],
                    isVbNet: true
                }, {
                    type: "RevengeRAT",
                    edition: "0.3",
                    references: [
                        "System.Management", "System.Windows.Forms",
                        "avicap32.dll", "capGetDriverDescriptionA",
                        "kernel32",
                        "psapi", "EmptyWorkingSet",
                        "user32", "GetWindowText"
                    ],
                    isVbNet: true
                }, {
                    type: "Webremote TorCT",
                    edition: undefined,
                    references: [
                        "System.Windows.Forms",
                        "avicap32.dll", "capGetDriverDescriptionA", "capCreateCaptureWindowA",
                        "user32", "SendMessage", "SetWindowPos", "DestroyWindow",
                        "user32.dll", "GetForegroundWindow", "GetWindowText"
                    ],
                    isVbNet: true
                }, { // NjRAT Generic 1
                    type: "NjRAT",
                    edition: undefined,
                    references: [
                        "System.Drawing", "System.Windows.Forms", "GetForegroundWindow", "System.Runtime.InteropServices", "System.Security.Cryptography", "GetWindowText",
                        "avicap32.dll", "A", "kl", "OK"
                    ],
                    isVbNet: true
                }, { // NjRAT Generic 2 (with USB-spreader)
                    type: "NjRAT",
                    edition: undefined,
                    references: [
                        "System.Drawing", "System.Windows.Forms", "GetForegroundWindow", "System.Runtime.InteropServices", "System.Security.Cryptography", "GetWindowText",
                        "avicap32.dll", "A", "kl", "USB"
                    ],
                    isVbNet: true
                }
            ];

            for (var j = 0; j < maliciousImportPatterns.length; j++) {
                pattern = maliciousImportPatterns[j];
                allPatternImportsFound = true;

                for (var k = 0; k < pattern.references.length && allPatternImportsFound; k++) {
                    importSignature = "00'" + pattern.references[k] + "'00";
                    if (!PE.isSignatureInSectionPresent(0, importSignature)) {
                        allPatternImportsFound = false;
                    }
                }

                // If not all pattern imports were found, skip this pattern
                if (!allPatternImportsFound) {
                    continue;
                }

                // Check for VB.NET standard library references
                if (pattern.isVbNet && !PE_Cached.isVbNetStandardLibraryPresent) {
                    continue;
                }

                verdicts.push({
                    type: pattern.type,
                    version: pattern.edition ? pattern.edition : String(),
                    details: String()
                });

                break;
            }
        }

        var separatorToSearch = generateUnicodeSignatureMask("|'|'|") + "00";
        separatorToSearch = "??" + separatorToSearch.substring(2, separatorToSearch.length);

        // NjRAT Generic: Detect NjRAT via requests-separator or assembly name
        if (verdicts.length === 0 && (
            PE_Cached.nameOfNetAssemblyName === "w" || PE_Cached.nameOfNetModuleName === "w.exe" ||
            PE_Cached.nameOfNetAssemblyName === "k" || PE_Cached.nameOfNetModuleName === "k.exe" ||
            PE.isNetObjectPresent("njLogger") || PE.isNetUStringPresent("|PWD| ") || PE.isSignatureInSectionPresent(0, separatorToSearch))) {
            verdicts.push({
                type: "NjRAT",
                version: String(),
                details: String()
            });
        }


        if (verdicts.length === 0 && PE.isNetObjectPresent("avfucker")) {
            verdicts.push({
                type: "RAT Injector",
                version: String(),
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

        if (verdicts.length === 0 && (
            PE_Cached.nameOfNetAssemblyName === "AsyncClient" || PE_Cached.nameOfNetModuleName === "AsyncClient.exe" ||
            PE.isNetObjectPresent("Pastebin")
        )) {
            verdicts.push({
                type: "AsyncRAT",
                version: String(),
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore

        if (verdicts.length === 0 && (PE.isNetObjectPresent("ClientLoaderForm") || PE_Cached.nameOfNetAssemblyName === "NanoCore Client")) {
            verdicts.push({
                type: "NanoCore RAT",
                version: String(),
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.orcus_rat

        if (verdicts.length === 0 && (PE_Cached.nameOfNetModuleName === "Orcus.exe" || PE.isNetObjectPresent("Orcus.Connections"))) {
            verdicts.push({
                type: "Orcus RAT",
                version: "1.3-1.9.1",
                details: String()
            });
        }


        // https://www.broadcom.com/support/security-center/protection-bulletin/liberium-rat-malware

        if (verdicts.length === 0 && (PE_Cached.nameOfNetModuleName === "Client.exe" && PE.isNetObjectPresent("System.Security.Cryptography.X509Certificates"))) {
            verdicts.push({
                type: "Liberium RAT",
                version: String(),
                details: String()
            });
        }


        if (verdicts.length === 0 && PE.isNetObjectPresent("button_unlock_Click")) {
            verdicts.push({
                type: "Liberium WinLocker",
                version: String(),
                details: String()
            });
        }


        if (verdicts.length === 0 && PE_Cached.nameOfNetModuleName === "Kheir.exe") {
            verdicts.push({
                type: "jnRAT",
                version: String(),
                details: String()
            });
        }


        if (verdicts.length === 0 && PE_Cached.nameOfNetModuleName === "QatarC.exe") {
            verdicts.push({
                type: "Qatar RAT",
                version: "1.2",
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.darkrat

        if (verdicts.length === 0 && (PE_Cached.nameOfNetModuleName === "Client.exe" && PE.isNetObjectPresent("fusion"))) {
            verdicts.push({
                type: "DarkRAT",
                version: String(),
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.icarus (??)

        if (verdicts.length === 0 && PE.isNetObjectPresent("tosuck")) {
            verdicts.push({
                type: "ICARUS Evil Worm RAT",
                version: String(),
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.noneuclid_rat

        if (verdicts.length === 0 && PE.isNetObjectPresent("isVM_by_wim_temper")) {
            verdicts.push({
                type: "NonEuclid RAT",
                version: String(),
                details: String()
            });
        }


        // https://malpedia.caad.fkie.fraunhofer.de/details/win.imminent_monitor_rat

        if (verdicts.length === 0 && PE.isNetObjectPresent("LZLoader") && PE.isNetObjectPresent("Injector")) {
            verdicts.push({
                type: "Imminent Monitor RAT",
                version: String(),
                details: String()
            });
        }


        if (verdicts.length === 0 && (PE.isSignatureInSectionPresent(0, "00" + generateUnicodeSignatureMask(" RAT") + "00 **") ||
            PE.isNetObjectPresent("AntiTaskManager") ||
            PE.isNetObjectPresent("BlockAvSites") ||
            PE.isNetObjectPresent("UpdaterEXE") || (
                // System.Net.Sockets + GetForegroundWindow + GetWindowsText
                PE.isNetObjectPresent("System.Net.Sockets") && PE.isNetObjectPresent("GetForegroundWindow") && PE.isNetObjectPresent("GetWindowText") && (
                    // Search for 'AntivirusProduct' or 'DisableTaskMgr'
                    PE.isSignatureInSectionPresent(0, generateUnicodeSignatureMask("AntivirusProduct")) || PE.isSignatureInSectionPresent(0, generateUnicodeSignatureMask("DisableTaskMgr"))
                )
            ) || (
                // GetForegroundWindow + GetWindowText + NtSetInformationProcess
                PE.isNetObjectPresent("GetForegroundWindow") && PE.isNetObjectPresent("GetWindowText") && PE.isNetObjectPresent("NtSetInformationProcess")
            ))) {
            verdicts.push({
                type: "RAT",
                version: String(),
                details: "General signs"
            });
        }
    }




    if (verdicts.length === 0 && (
        PE.isNetObjectPresent("potentiallyVulnerablePasswords") ||
        PE.isNetObjectPresent("ScanGeckoBrowsersPaths") ||
        PE.isNetObjectPresent("ScannedWallets") ||
        PE.isNetObjectPresent("GetPasswords") ||
        PE.isNetObjectPresent("ScanSteam") ||
        PE.isNetObjectPresent("GetCookies")
    )) {
        verdicts.push({
            type: "Stealer",
            version: String(),
            details: "General signs"
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit

    if (verdicts.length === 0 && PE.isSectionNamePresent(".rmnet")) {
        verdicts.push({
            type: "Ramnit",
            version: String(),
            details: "infected"
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

    if (verdicts.length === 0 && PE_Cached.isArchX86 && PE.compareEP(
        "55" +              // push ebp
        "8B EC" +           // mov ebp, esp
        "83 C4 E0" +        // add esp, -0x20
        "33 C0" +           // xor eax, eax
        "89 45 E0" +        // mov dword ptr [ebp - 0x20], eax
        "89 45 E8" +        // mov dword ptr [ebp - 0x18], eax
        "89 45 E4" +        // mov dword ptr [ebp - 0x1c], eax
        "89 45 EC" +        // mov dword ptr [ebp - 0x14], eax
        "B8 54 80 40 00" +  // mov eax, 0x408054
        "E8 12 BE FF FF" +  // call $+5 - 0x41EE
        "33 C0" +           // xor eax, eax
        "55" +              // push ebp
        "68 20 82 40 00" +  // push 0x408220
        "64 FF 30" +        // push dword ptr fs:[eax]
        "64 89 20" +        // mov dword ptr fs:[eax], esp
        "B8 A8 91 40 00" +  // mov eax, 0x4091a8
        "B9 0B 00 00 00"    // mov ecx, 0xb
    )) {
        verdicts.push({
            type: "Neshta",
            version: String(),
            details: "infected"
        });
    }




    // https://citec.us/forum/showthread.php/15998-ConsoleDevil

    if (verdicts.length === 0 && PE_Cached.isArchX86 && PE.compareEP(
        "68 .. .. .. .." +  // push [...]
        "68 00 00 00 00" +  // push 0
        "68 .. .. .. .." +  // push [...]
        "E8 .. .. .. .." +  // call [...]
        "83 C4 0C" +        // add esp, 0xc
        "68 00 00 00 00"    // push 0
    )) {
        var consoleDevilVersion = String();

        if (PE.isImportPositionHashPresent(0, 0xb27ceda0) && PE.isImportPositionHashPresent(1, 0xa77d975c)) {
            consoleDevilVersion = "1.0";
        } else if (PE.isImportPositionHashPresent(0, 0x1dec6c44) && PE.isImportPositionHashPresent(1, 0xf1ed6358)) {
            consoleDevilVersion = "1.2";
        }

        if (consoleDevilVersion) {
            verdicts.push({
                type: "ConsoleDevil RAT",
                version: consoleDevilVersion,
                details: String()
            });
        }
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy

    if (verdicts.length === 0 && PE_Cached.isArchX86 && PE.compareEP(
        "B8 00 04 40 00" +  // mov eax, 0x400400
        "FF D0" +           // call eax
        "6A 00"             // push 0
    ) && PE.isImportPositionHashPresent(0, 0xbd365a2a)) {
        verdicts.push({
            type: "Poison Lvy RAT",
            version: String(),
            details: String()
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat

    if (verdicts.length === 0 && PE.isExportFunctionPresent("Ip")) {
        verdicts.push({
            type: "Gh0st RAT",
            version: String(),
            details: String()
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcomet

    if (verdicts.length === 0 &&
        // Todo fix
        /* (PE.isImportPositionHashPresent(0, 0xcf603a7d) && PE.isImportPositionHashPresent(1, 0xe6aa7d45) && PE.isImportPositionHashPresent(2, 0xa26edfd0)) || */
        // UPX packed
        (PE.isImportPositionHashPresent(0, 0xf375ee03) && PE.isImportPositionHashPresent(1, 0x6043ad68) && PE.isImportPositionHashPresent(2, 0x49e8b6dd)) ||
        // MPRESS packed
        (PE.isImportPositionHashPresent(0, 0x174efb84) && PE.isImportPositionHashPresent(1, 0x4afe3a51) && PE.isImportPositionHashPresent(2, 0x3d9a43d0))
    ) {
        verdicts.push({
            type: "DarkComet RAT",
            version: "5.3",
            details: String()
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat

    if (verdicts.length === 0 &&
        PE_Cached.numberOfUnmanagedImports === 1) {
        var isBitRatDetected = false,
            isBitRatTorStubVersion = false;

        if (PE.isImportPositionHashPresent(0, 0x202c6668)) {
            isBitRatDetected = true;
        } else if (PE.isImportPositionHashPresent(0, 0x249e9ed3)) {
            isBitRatDetected = true;
            isBitRatTorStubVersion = true;
        }

        if (isBitRatDetected) {
            verdicts.push({
                type: "BitRAT",
                version: String(),
                details: isBitRatTorStubVersion ? "Tor" : String()
            });
        }
    }




    if (verdicts.length === 0 &&
        (PE.isImportPositionHashPresent(0, 0x991f7f9a) && PE.isImportPositionHashPresent(1, 0x3495fca1)) ||
        (PE.isImportPositionHashPresent(0, 0x7d78c0f9) && PE.isImportPositionHashPresent(1, 0x4b76cb0f))) {
        verdicts.push({
            type: "Furax RAT",
            version: String(),
            details: String()
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/ps1.octopus

    if (verdicts.length === 0 &&
        (PE.isImportPositionHashPresent(0, 0x42600eef) && PE.isSignatureInSectionPresent(0, "'Octopus'"))) {
        verdicts.push({
            type: "Octopus RAT",
            version: String(),
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        (PE_Cached.numberOfUnmanagedImports === 1 && PE.isImportPositionHashPresent(0, 0x06a04d16)) ||
        (PE_Cached.numberOfUnmanagedImports > 4 && PE.isImportPositionHashPresent(0, 0xa719918b) && PE.isImportPositionHashPresent(-1, 0x9f8ccfc6))
    ) {
        verdicts.push({
            type: "Biorante",
            version: "1.X",
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        PE.isImportPositionHashPresent(0, 0xb3318086) && // UPX packed
        PE.isImportPositionHashPresent(1, 0x3d9a43d0) &&
        PE.isImportPositionHashPresent(7, 0xf3b2674d)) {
        verdicts.push({
            type: "Smart RAT",
            version: "1.0.X",
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        PE_Cached.numberOfUnmanagedImports === 1 && PE.isImportPositionHashPresent(0, 0x1b62aa20)) {
        verdicts.push({
            type: "Ace RAT",
            version: "1.X",
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        PE_Cached.numberOfUnmanagedImports === 1 &&
        PE_Cached.isRichSignaturePresent &&
        PE.isImportPositionHashPresent(0, 0x2d6f7e88)) {
        verdicts.push({
            type: "Aquates RAT",
            version: "1.0",
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        PE.section[0].Name === "\uFFFD\uFFFD50") {
        verdicts.push({
            type: "Exception RAT",
            version: "1.0",
            details: String()
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.bozok

    if (verdicts.length === 0 &&
        !PE_Cached.isRichSignaturePresent &&
        PE.isImportPositionHashPresent(0, 0xbd365a2a)) { // kernel32.dll->ExitProcess
        var bozokRatVersion = String();

        if (PE.isImportPositionHashPresent(1, 0x0ed01f83)) {
            bozokRatVersion = "1.0";
        } else if (PE.isImportPositionHashPresent(1, 0xefd4be65)) {
            bozokRatVersion = "1.2-1.3";
        } else if (PE.isImportPositionHashPresent(1, 0x58133a50)) {
            bozokRatVersion = "1.4-1.5.X";
        }

        if (bozokRatVersion) {
            verdicts.push({
                type: "Bozok RAT",
                version: bozokRatVersion,
                details: String()
            });
        }
    }




    if (verdicts.length === 0 && !PE_Cached.isRichSignaturePresent) { // VB5
        var aquaRatVersion = String();

        if (PE.isImportPositionHashPresent(0, 0xfc2095af)) {
            aquaRatVersion = "0.0.1";
        } else if (PE.isImportPositionHashPresent(0, 0x8bc8445e)) {
            aquaRatVersion = "0.2";
        }

        if (aquaRatVersion && PE.isSignatureInSectionPresent(0, "'Aqua'")) {
            verdicts.push({
                type: "Aqua RAT",
                version: aquaRatVersion,
                details: String()
            });
        }
    }




    if (verdicts.length === 0 &&
        (PE.isImportPositionHashPresent(0, 0x90648ec6) && PE.isImportPositionHashPresent(1, 0x199ccb02) && PE.isImportPositionHashPresent(2, 0x4bb25d37)) ||
        (PE.isImportPositionHashPresent(0, 0x41b27a00) && PE.isImportPositionHashPresent(1, 0x56a9aa44) && PE.isImportPositionHashPresent(2, 0x4bb25d37)) ||
        (PE.isImportPositionHashPresent(0, 0xc649d485) && PE.isImportPositionHashPresent(1, 0xf2e69b15) && PE.isImportPositionHashPresent(2, 0x4bb25d37)) ||
        (PE.isImportPositionHashPresent(0, 0xe27edc0d) && PE.isImportPositionHashPresent(1, 0x1da5760e) && PE.isImportPositionHashPresent(2, 0x42779d34)) ||
        // UPX packed
        (PE.isImportPositionHashPresent(0, 0x3d9a43d0) && PE.isImportPositionHashPresent(1, 0xc28f4fe3) && PE.isImportPositionHashPresent(2, 0x5d1bddcc)) ||
        (PE.isImportPositionHashPresent(0, 0xf375ee03) && PE.isImportPositionHashPresent(1, 0x3d9a43d0) && PE.isImportPositionHashPresent(2, 0xc28f4fe3) && (PE.isImportPositionHashPresent(3, 0x5d1bddcc) || PE.isImportPositionHashPresent(3, 0xa2163984)))
    ) {
        verdicts.push({
            type: "Babylon RAT",
            version: String(),
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        PE.isImportPositionHashPresent(0, 0x519fb9a6) &&
        PE.isImportPositionHashPresent(1, 0x69561fa8) &&
        PE.isImportPositionHashPresent(2, 0xe6aa7d45)) {
        verdicts.push({
            type: "Sinique RAT",
            version: "1.0",
            details: String()
        });
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.netwire

    if (verdicts.length === 0 &&
        PE.isImportPositionHashPresent(1, 0x5d1bddcc)) {
        var netWireVersion = String();

        if (PE.isImportPositionHashPresent(0, 0xfa0dd025)) {
            netWireVersion = "1.2.X";
        } else if (PE.isImportPositionHashPresent(0, 0x7845f465)) {
            netWireVersion = "1.4";
        }

        if (netWireVersion) {
            verdicts.push({
                type: "NetWire RAT",
                version: netWireVersion,
                details: String()
            });
        }
    }




    // https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

    if (verdicts.length === 0 &&
        PE.isImportPositionHashPresent(0, 0xf25ba92f) &&
        PE.isImportPositionHashPresent(1, 0xf740ae08) &&
        PE.isImportPositionHashPresent(2, 0xba3a1112)) {
        verdicts.push({
            type: "Remcos RAT",
            version: String(),
            details: String()
        });
    }




    // https://web.archive.org/web/20260108153947/https://indetectables.net/viewtopic.php?t=20716

    if (verdicts.length === 0 &&
        !PE_Cached.isRichSignaturePresent &&
        PE_Cached.numberOfUnmanagedImports === 20 &&
        PE.isImportPositionHashPresent(9, 0x5206612e) &&
        PE.isImportPositionHashPresent(16, 0xf3b2674d) &&
        PE.isImportPositionHashPresent(19, 0xabde73fb)) {
        verdicts.push({
            type: "Daleth RAT",
            version: "1.0",
            details: String()
        });
    }




    // https://web.archive.org/web/20090902161812/http://synsecurity.net/index.php?page=downloads

    if (verdicts.length === 0 &&
        !PE_Cached.isRichSignaturePresent &&
        PE_Cached.numberOfUnmanagedImports === 31 &&
        PE.isImportPositionHashPresent(0, 0xcf603a7d) &&
        PE.isImportPositionHashPresent(-1, 0x0201b2be) &&
        PE.isImportPositionHashPresent(-1, 0x3ca208f6)) {
        verdicts.push({
            type: "Syndrome RAT",
            version: "4.3.X",
            details: String()
        });
    }




    if (verdicts.length === 0 &&
        !PE_Cached.isRichSignaturePresent && PE.isTLSPresent() && (
            (PE.isImportPositionHashPresent(18, 0xc3df3568) && PE.isSignatureInSectionPresent(0, "'lock_text'00")) ||
            (PE.isImportPositionHashPresent(4, 0xc3df3568) && PE.isImportPositionHashPresent(5, 0x622ae906)) // UPX packed
        )) {
        verdicts.push({
            type: "Amp WinLocker",
            version: "Sumhex Edition",
            details: String()
        });
    }




    // https://max.ru/

    if (verdicts.length === 0 && (
        PE.getVersionStringInfo("ProductName") === "Max" ||
        PE.getVersionStringInfo("CompanyName") === "Communication Platform LLC"
    )) {
        verdicts.push({
            type: "MAX Spyware",
            version: String(),
            details: String()
        });
    }




    // Many not-so-smart virus writers use base64 to pack
    // or hide malicious code, but do not realize that this
    // is very easily detected by heuristic analysis.

    const signaturesVariants = [
        "TVoAAAAAA", // MZ ~[00 00 00 00 00]
        "TVqQAA", // MZ ~[90 00 03]
        "TVpQAA", // MZ ~[50 00 02]
        "TVp4AA" // MZ ~[78 00 01]
    ];

    // Iterate through signature variants
    for (var s = 0; s < signaturesVariants.length; s++) {
        const trigger = signaturesVariants[s];

        // Check if the signature is valid using Unicode signature mask or the original signature
        if (
            validateGlobalUnicodeString(trigger) ||
            validateSignature("'" + trigger + "'")
        ) {
            verdicts.push({
                type: "Base64 payload",
                version: String(),
                details: mayBeInfected
            });

            break;
        }
    }




    // Check for obfuscated names and anomalous signs in .NET and native assemblies

    if (PE_Cached.isDotNet && (
        PE_Cached.nameOfNetAssemblyName.toLowerCase() === "stub" ||
        PE_Cached.nameOfNetModuleName.toLowerCase().indexOf("stub.") === 0 ||
        PE_Cached.nameOfNetAssemblyName.toLowerCase().indexOf("crypted") !== -1 ||
        PE_Cached.nameOfNetModuleName.toLowerCase().indexOf("crypted") !== -1 ||
        PE_Cached.nameOfNetAssemblyName.toLowerCase().indexOf("payload") !== -1 ||
        PE_Cached.nameOfNetModuleName.toLowerCase().indexOf("payload") !== -1 ||
        isNameObfuscated(PE_Cached.nameOfNetAssemblyName) ||
        isNameObfuscated(PE_Cached.nameOfNetModuleName) ||
        /(^tmp|\.tmp$)/.test(PE_Cached.nameOfNetModuleName)
    ) ||
        PE.getVersionStringInfo("OriginalFilename").toLowerCase().indexOf("stub.") === 0 ||
        PE.getVersionStringInfo("InternalName").toLowerCase().indexOf("stub.") === 0 ||
        (function () {
            var fieldsToCheck = [
                "Comments",
                "CompanyName",
                "FileDescription",
                "ProductName",
                "LegalCopyright",
                "LegalTrademarks",
                "OriginalFilename",
                "InternalName"
            ];

            for (var i = 0; i < fieldsToCheck.length; i++) {
                if (isNameObfuscated(PE.getVersionStringInfo(fieldsToCheck[i]))) {
                    return true;
                }
            }

            return false;
        })()
    ) {
        verdicts.push({
            type: "Anomalous build info",
            version: String(),
            details: mayBeInfected
        });
    }




    if (PE.isResourceNamePresentExp(/^(STUB|SERVER)(\.[A-Z]{3})?$/) ||
        PE.isResourceNamePresentExp(/(PAYLOAD|SHELLCODE|INJECT|CRYPTED)/)) {
        verdicts.push({
            type: "Anomalous resources",
            version: String(),
            details: mayBeInfected
        });
    }




    for (var v = 0; v < verdicts.length; v++) {
        var verdict = verdicts[v];

        _setResult("~malware", verdict.type, verdict.version, verdict.details);
    }
}
// #endregion



// #region "interesting markers (.NET and Native)"
function scanForInterestingMarkers_NET_and_Native() {
    log(logType.nothing, "Scanning for interesting markers...");

    var options = String();

    var isDetected = Boolean();




    // https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ee417681(v=vs.85)#:~:text=Root%20Element:%20GameDefinitionFile,GameDefinition%20Attributes

    var isGdfSchemaPresent = false;

    for (var i = 0; i < PE_Cached.numberOfUnmanagedResources && !isGdfSchemaPresent; i++) {
        if (PE.getResourceNameByNumber(i) === "__GDF_XML") {
            if (PE.isSignaturePresent(
                PE.getResourceOffsetByNumber(i),
                PE.getResourceSizeByNumber(i), generateUnicodeSignatureMask("GameDefinitionFile"))) {
                isGdfSchemaPresent = true;
            }
        }
    }

    if (isGdfSchemaPresent) options = "GDF Schema";




    if (options.length != 0) isDetected = true;


    if (isDetected) {
        _setResult("~marker", "Contains", String(), PE.isVerbose() ? options : String());
    }
}
// #endregion

// Every time I start writing bad code I get hit with my head on the keybofewuihdsowefjfqodgsa79dowqhdsioefurogrwhuoguethuhofrwyioguqwehuf


================================================
FILE: db/PE/_debug_data.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Detect It Easy: detection rule file
// Reports each PE Debug Directory entry as a separate detection result.
// For UNKNOWN-typed entries the raw data is inspected to identify the format.

meta("debug data", "Records");

function detect() {
    var numOfDebugDataRecords = PE.getNumberOfDebugDataRecords();

    if (numOfDebugDataRecords > 0) {
        bDetected = true;
    }

    for (var i = 0; i < numOfDebugDataRecords; i++) {
        var sType = PE.getDebugDataType(i);

        if (sType === "UNKNOWN") {
            detectUnknownDebugData(PE.getDebugDataOffset(i), PE.getDebugDataSize(i));
        } else {
            sOptions = sOptions.append(sType.toLowerCase());
        }
    }

    return result();
}

function detectUnknownDebugData(nDataOffset, nDataSize) {
    if (nDataSize < 2) {
        return;
    }

    // Borland TDS (Turbo Debugger Symbols)
    if (PE.readWord(nDataOffset) === 0x52FB) {
        var minor = PE.readByte(nDataOffset + 2),
            major = PE.readByte(nDataOffset + 3),
            minorStr = ((minor >> 4) * 10 + (minor & 0x0F)).toString(),
            majorStr = ((major >> 4) * 10 + (major & 0x0F)).toString(),
            sVer = majorStr + "." + minorStr,
            nSymbols = PE.readWord(nDataOffset + 0xE);

        _setResult("debug data", "Borland TDS", sVer, nSymbols ? (nSymbols + " symbols") : "");
    } else if (PE.compare("'FB09'", nDataOffset)) {
        _setResult("debug data", "Borland TDS", "", "Delphi TDS");
    } else if (PE.compare("'FB0A'", nDataOffset)) {
        _setResult("debug data", "Borland TDS", "", "C++ TDS");
    }
}


================================================
FILE: db/PE/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = PE;
var X = PE;

/**
 * Get the signature at an offset of the entry point.
 * @see Binary.getSignature
 */
PE.getEntryPointSignature = function (nOffset, nSize) {
    return PE.getSignature(PE.nEP + nOffset, nSize);
}


/**
 * Add console and/or administrator requirement to the general options.
 * @returns {String}
 */
PE.getGeneralOptionsEx = function () {
    sResult = PE.getGeneralOptions();
    if (PE.isConsole()) {
        sResult = sResult.append("console");
    }
    if (/requireAdministrator/.test(PE.getManifest())) {
        sResult = sResult.append("admin");
    }
    if (PE.isSignedFile()) {
        sResult = sResult.append("signed");
    }

    return sResult;
}


/**
 * Locate the first library matching a pattern.
 * @returns {?Array} <code>null</code> if not found, otherwise:
 * <br><code>[-1]</code> is the number of the library;
 * <br><code>[0]</code> is the name of the library (lower cased);
 * <br><code>[1]</code> onwards are the captured subpatterns.
 */
PE.isLibraryPresentExp = function (sLibraryPattern) {
    var aMatch = null;
    for (var n = 0; n < PE.getNumberOfImports(); n++) {
        aMatch = PE.getImportLibraryName(n).match(sLibraryPattern);
        if (aMatch) {
            aMatch[-1] = n;
            aMatch[0] = PE.getImportLibraryName(n).toLowerCase();
            break;
        }
    }

    return aMatch;
}


/**
 * Locate the first export function matching a pattern.
 * @returns {?Array} <code>null</code> if not found, otherwise:
 * <br><code>[-1]</code> is the number of the export function;
 * <br><code>[0]</code> is the name of the export function;
 * <br><code>[1]</code> onwards are the captured subpatterns.
 */
PE.isExportFunctionPresentExp = function (sExportPattern) {
    var aMatch = null;
    for (var n = 0; n < PE.getNumberOfExportFunctions(); n++) {
        aMatch = PE.getExportFunctionName(n).match(sExportPattern);
        if (aMatch) {
            aMatch[-1] = n;
            aMatch[0] = PE.getExportFunctionName(n);
            break;
        }
    }

    return aMatch;
}


/**
 * Locate the first section matching a pattern.
 * @returns {?Array} <code>null</code> if not found, otherwise:
 * <br><code>[-1]</code> is the number of the section;
 * <br><code>[0]</code> is the name of the section;
 * <br><code>[1]</code> onwards are the captured subpatterns.
 */
PE.isSectionNamePresentExp = function (sSectionPattern) {
    var aMatch = null;
    for (var n = 0; n < PE.getNumberOfSections(); n++) {
        aMatch = PE.getSectionName(n).match(sSectionPattern);
        if (aMatch) {
            aMatch[-1] = n;
            aMatch[0] = PE.getSectionName(n);
            break;
        }
    }

    return aMatch;
}


/**
 * Locate the first resource matching a pattern.
 * @returns {?Array} <code>null</code> if not found, otherwise:
 * <br><code>[-1]</code> is the number of the resource;
 * <br><code>[0]</code> is the name of the resource;
 * <br><code>[1]</code> onwards are the captured subpatterns.
 */
PE.isResourceNamePresentExp = function (sResourcePattern) {
    var aMatch = null;
    for (var n = 0; n < PE.getNumberOfResources(); n++) {
        aMatch = PE.getResourceNameByNumber(n).match(sResourcePattern);
        if (aMatch) {
            aMatch[-1] = n;
            aMatch[0] = PE.getResourceNameByNumber(n);
            break;
        }
    }

    return aMatch;
}


/**
 * The number of the last section.
 */
PE.nLastSection = PE.getNumberOfSections() - 1;

function Section(number, name, virtsize, rva, filesize, offset, characteristics) {
    this.Number = number;
    this.Name = name;
    this.VirtualSize = virtsize;
    this.VirtualAddress = rva;
    this.FileSize = filesize;
    this.FileOffset = offset;
    this.Characteristics = characteristics;
}

/**
 * An array of sections, indexed by number and name (if not numeric). Members are the same as the functions.
 * @example
 * var rsrcSection = PE.section[".rsrc"].FileOffset;
 */
PE.section = [];
for (var i = 0; i <= PE.nLastSection; i++) {
    PE.section[i] = new Section(i,
        PE.getSectionName(i),
        PE.getSectionVirtualSize(i),
        PE.getSectionVirtualAddress(i),
        PE.getSectionFileSize(i),
        PE.getSectionFileOffset(i),
        PE.getSectionCharacteristics(i));
    if (PE.section[i].Name) {
        var name = PE.section[i].Name;
        // Don't do numeric names, as they are always treated as an index.
        if (+name.toString() != name) { // parseInt crashes the application if Delphi project uses diedll :(
            PE.section[name] = PE.section[i];
        }
    }
}

// Create dummy sections for the few files that need them.
PE.section[-1] = new Section(-1, "\0", 0, 0, 0, PE.getSize(), 0);
if (PE.nLastSection == -1) {
    PE.section[0] = PE.section[-1];
}


// Create an array of resources.

function Resource(number, id, name, offset, size, type) {
    this.Number = number;
    this.Id = id;
    this.Name = name;
    this.Offset = offset;
    this.Size = size;
    this.Type = type;
}

/**
 * An array of resources, indexed by number and name (if not numeric). Members are the same as the functions.
 * @example
 * var packageInfoResource = PE.resource["PACKAGEINFO"].Offset;
 */
PE.resource = [];
for (var i = 0; i < PE.getNumberOfResources(); i++) {
    PE.resource[i] = new Resource(i,
        PE.getResourceIdByNumber(i),
        PE.getResourceNameByNumber(i),
        PE.getResourceOffsetByNumber(i),
        PE.getResourceSizeByNumber(i),
        PE.getResourceTypeByNumber(i));
    if (PE.resource[i].Name) {
        var name = PE.resource[i].Name;
        // Don't do numeric names, as they are always treated as an index.
        if ((+name).toString() != name) { // parseInt crashes the application if Delphi project uses diedll :(
            PE.resource[name] = PE.resource[i];
        }
    }
}

================================================
FILE: db/PE/archive_7z.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("archive", "7-Zip");

function detect() {
    const overlayOffset = PE.getOverlayOffset();

    if (PE.compareOverlay("';!@Install@!UTF-8!'") || PE.compareOverlay("efbbbf';!@Install@!UTF-8!'")) {
        if (PE.isSignaturePresent(overlayOffset, 0x2000, "'7z'BCAF271C")) {
            sVersion = "SFX";
            bDetected = true;
        }
    } else if (PE.compare("'7z'BCAF271C", overlayOffset)) {
        sVersion = PE.readByte(overlayOffset + 6) + "." + PE.readByte(overlayOffset + 7);

        if (sVersion.match(/^\d+\.\d+$/)) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/arj.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("arj");

function detect() {
    detect_ARJ(0);

    return result();
}

================================================
FILE: db/PE/compiler_BatchToApp.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/BatchToApp
meta("compiler", "BatchToApp");

function detect() {
    bDetected = PE.isNetObjectPresent("GeneratedWithBatchToApp") && PE.isNetUStringPresent("Unable to execute.");

    sLang = "Batch";

    return result();
}

================================================
FILE: db/PE/compiler_BeRo_Tiny_Pascal.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "BeRo Tiny Pascal");

function detect() {
    if (PE.compareEP("E9........' Compiled by: BeRoTinyPascal - (C) Copyright 2006, Benjamin '27'BeRo'27' Rosseaux '")) {
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}


================================================
FILE: db/PE/compiler_Borland_C++.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// https://docwiki.embarcadero.com/RADStudio/Alexandria/en/Compiler_Versions
// coauthor: sendersu (If errors pls contact sendersu on cracklab.team)

meta("compiler", "Borland C++");

includeScript("Borland");

function detect() {
    bDetected = bBorlandC;

    if (bDetected == 2) {
        sVersion = "1999";
        bDetected = true;
    }

    if (bDetected) {
        var dvclalResource = PE.resource["DVCLAL"];

        if (PE.resource["PACKAGEINFO"] || dvclalResource) {
            sVersion = "Builder";

            if (dvclalResource) {
                // try to decode DVCLAL (Delphi Visual Component Library Access License) values
                nOffset = PE.getResourceNameOffset("DVCLAL");
                if (PE.compare("A28CDF987B3C3A7926713F090F2A2517", nOffset)) {
                    sOptions = "Professional";
                } else if (PE.compare("23785D23B6A5F31943F3400226D111C7", nOffset)) {
                    sOptions = "Standard";
                } else if (PE.compare("263D4F38C28237B8F3244203179B3A83", nOffset)) {
                    sOptions = "Enterprise";
                }
            }
        }
    }

    sLang = "C++";

    return result();
}


================================================
FILE: db/PE/compiler_Cygwin32.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Cygwin32");

function detect() {
    if (PE.compareEP("5589E583EC04833D")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/compiler_DECFortran.4.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("compiler", "DEC Visual Fortran (Windows)");

function detect() {
    if (PE.isSectionNamePresent(".data")) {
        var dataSection = PE.section[".data"];

        var nVersionOffset = PE.findString(dataSection.FileOffset, dataSection.FileSize, "DEC Fortran RTL Message Catalog");
        if (nVersionOffset != -1) {
            sVersion = "14-Jul-1999"
            bDetected = true;
        }
    }

    sLang = "Fortran";

    return result();
}


================================================
FILE: db/PE/compiler_DMD.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// 27.12.2023 @DosX_dev add strings
// 29.06.2025 @DosX_dev rule logic optimized

// TODO: Rewrite this script

meta("compiler", "DMD");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (PE.isSectionNamePresent(".minfo") && PE.isSectionNamePresent("._deh")) {
        bDetected = true;
    }

    var rdataSection = PE.section[".rdata"],
        rdataSectionOffset = -1,
        rdataSectionSize = -1;

    if (rdataSection) {
        rdataSectionOffset = rdataSection.FileOffset;
        rdataSectionSize = rdataSection.FileSize;
    }

    if (!bDetected) {
        if (rdataSection && PE.isDeepScan()) {
            if (PE.findSignature(rdataSectionOffset, rdataSectionSize, "'core.sys.windows.dll'") != -1 &&
                PE.findSignature(rdataSectionOffset, rdataSectionSize, "'string.d'") != -1) {
                bDetected = true;
            }
        }
    }

    if (bDetected && rdataSection) {
        var strOffset = PE.findString(rdataSectionOffset, rdataSectionSize, "This program will continue, but will not operate when using DMD ");

        if (strOffset != -1) {
            sVersion = PE.getString(strOffset - 7, 5);

            if (sVersion.indexOf(".") == -1 || sVersion.split(".")[0].length != 1) {
                sVersion = String();
            }
        }
    }

    sLang = "D";

    return result();
}


================================================
FILE: db/PE/compiler_DarkBASIC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "DarkBASIC Professional");

function detect() {
    if (PE.isOverlayPresent() && PE.isSignaturePresent(PE.getOverlayOffset(), 2048, "'dbprocore.dll'")) {
        bDetected = true;
    }

    sLang = "DarkBASIC";

    return result();
}


================================================
FILE: db/PE/compiler_Delphi.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// 1995-2007 Borland Delphi
// 2007-2014 Embarcadero Delphi;
// https://docwiki.embarcadero.com/RADStudio/Alexandria/en/Compiler_Versions
// coauthor: sendersu

meta("compiler", "Borland Delphi");

includeScript("Borland");

function getVersion() {
    if (PE.isNet()) {
        sOptions = ".NET";

        if (PE.isNetObjectPresent("Borland.Vcl.Types")) {
            sVersion = "8";
        } else if (PE.isNetObjectPresent("Borland.Eco.Interfaces")) {
            sVersion = "8 Eco WinForm";
        } else if (PE.isNetObjectPresent("Borland.Delphi.System") &&
            PE.isNetObjectPresent("WinForm")) {
            sVersion = "8 WinForm";
        } else if (PE.isNetObjectPresent("Borland.Delphi.Units")) {
            sVersion = "2005";
        } else if (PE.isNetObjectPresent("Borland.Studio.Delphi")) {
            sName = "Embarcadero Delphi";
            sVersion = "XE*";
        } else {
            return false;
        }

        return true;
    }

    var nSectionOffset = PE.section[0].FileOffset,
        nSectionSize = PE.section[0].FileSize,
        nOffset = nSectionOffset,
        nSize = nSectionSize,
        nOffset2,
        nAddress,
        nLng,
        nLng1,
        bNewVersion = false;

    var nAddressSize = PE.is64() ? 8 : 4;

    while (nSize > 0) {
        nOffset = PE.findSignature(nOffset, nSize, "0708'TControl'");

        if (nOffset == -1) {
            break;
        }

        nAddress = PE.readDword(nOffset + 10);
        nOffset2 = PE.VAToOffset(nAddress);

        if (nOffset2 != -1) {
            if (nOffset2 >= nSectionOffset && (nOffset2 < nSectionOffset + nSectionSize)) {
                nLng = PE.readDword(nOffset2 - 10 * nAddressSize);
                nLng1 = PE.readDword(nOffset2 - 10 * nAddressSize - 11 * nAddressSize);

                switch (nLng) {
                    case 0:
                        if (nLng1 == 0x746E4907) {
                            sVersion = "3";
                        } else if (nLng1 == 0x4F540774) {
                            sVersion = "2";
                        }

                        break;
                    case 0x0B4: sVersion = "C++ Builder"; break;
                    case 0x114: sVersion = "4"; break;
                    case 0x120: sVersion = "5"; break;
                    case 0x128: sVersion = "6 CLX"; break;
                    case 0x12C: sVersion = "7 CLX"; break;
                    case 0x138: sVersion = "Kylix"; break;
                    case 0x15C:
                    case 0x160: sVersion = (nLng1 == 0x40100000 || nLng1 == 0x100000) ? "7" : "6"; break;
                    case 0x164: sVersion = "2005"; break;
                    case 0x190: sVersion = "2006"; break;

                    default:
                        nLng = PE.readDword(nOffset2 - 13 * nAddressSize);

                        if (nLng == 0x1A4) {
                            sName = "Embarcadero Delphi";
                            sVersion = "2009";
                        } else if (nLng == 0x1AC) {
                            var packageInfoResource = PE.resource["PACKAGEINFO"];

                            if (packageInfoResource) {

                                nOffset = packageInfoResource.Offset;
                                nSize = packageInfoResource.Size;

                                if (PE.isSignaturePresent(nOffset, nSize, "'ExcUtils'")) {
                                    sName = "Embarcadero Delphi";
                                    sVersion = "XE";
                                } else if (PE.isSignaturePresent(nOffset, nSize, "'StrUtils'")) {
                                    sName = "Embarcadero Delphi";
                                    sVersion = "2010";
                                } else {
                                    sName = "Embarcadero Delphi";
                                    sVersion = "2010 or XE";
                                }
                            }
                        } else if (nLng == 0x1B4) {
                            // 32
                            sName = "Embarcadero Delphi";
                            sVersion = "XE2-XE4";
                        } else if (nLng == 0x2F0 || nLng == 0x2F8) {
                            // 64
                            sName = "Embarcadero Delphi";
                            sVersion = "XE2";
                        } else if (nLng == 0x1BC) {
                            // 32
                            sName = "Embarcadero Delphi";
                            sVersion = "XE5-XE6";
                            bNewVersion = true;
                        } else {
                            if (nAddressSize == 8) {
                                nLng = PE.readDword(nOffset2 - 16 * nAddressSize);
                                if (nLng == 0x2F8) {
                                    // 64
                                    sName = "Embarcadero Delphi";
                                    sVersion = "XE3-X4";
                                } else if (nLng == 0x308) {
                                    // 64
                                    sName = "Embarcadero Delphi";
                                    sVersion = "XE5-XE6";
                                    bNewVersion = true;
                                }
                            }
                        }
                }

                if (sVersion && !bNewVersion) {
                    return true;
                }
            }
        }

        nOffset++;
        nSize = nSectionSize - (nOffset - nSectionOffset + 1);
    }

    if (PE.resource["PACKAGEINFO"]) {
        nOffset = PE.resource["PACKAGEINFO"].Offset;
        nSize = PE.resource["PACKAGEINFO"].Size;

        if (PE.isSignaturePresent(nOffset, nSize, "'System.SysUtils'")) {
            sName = "Embarcadero Delphi";
            sVersion = "XE2-XE6";
            bNewVersion = true;
        } else if (PE.isSignaturePresent(nOffset, nSize, "'ExcUtils'")) {
            sName = "Embarcadero Delphi";
            sVersion = "XE";
        } else if (PE.isSignaturePresent(nOffset, nSize, "'StrUtils'")) {
            sName = "Embarcadero Delphi";
            sVersion = "2009-2010";
        } else if (PE.isSignaturePresent(nOffset, nSize, "'ImageHlp'")) {
            sVersion = "2006";
        } else if (PE.isSignaturePresent(nOffset, nSize, "'SysInit'")) {
            sVersion = "6-7 or 2005";
        }

        if (sVersion && !bNewVersion) {
            return true;
        }
    } else {
        if (PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "Borland\\Delphi") != -1) {
            sVersion = "2-3";
            return true;
        }
    }

    if (bNewVersion) {
        var rdataSection = PE.section[".rdata"];

        if (rdataSection) {
            var nVersionOffset = PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Embarcadero Delphi for Win");

            if (nVersionOffset != -1) {
                var sCompilerVersion = PE.getString(nVersionOffset + 46, 4);
                if (sCompilerVersion == "28.0") {
                    sVersion = "XE7";
                } else if (sCompilerVersion == "29.0") {
                    sVersion = "XE8";
                } else if (sCompilerVersion == "30.0") {
                    sVersion = "10 Seattle";
                } else if (sCompilerVersion == "31.0") {
                    sVersion = "10.1 Berlin";
                } else if (sCompilerVersion == "32.0") {
                    sVersion = "10.2 Tokyo";
                } else if (sCompilerVersion == "33.0") {
                    sVersion = "10.3 Rio";
                } else if (sCompilerVersion == "34.0") {
                    sVersion = "10.4 Sydney";
                } else if (sCompilerVersion == "35.0") {
                    sVersion = "11.0 Alexandria";
                } else if (sCompilerVersion == "36.0") {
                    sVersion = "12.0 Athens";
                } else {
                    sVersion = "12.X Athens++";
                }
            }
        }

        return true;
    }

    return false;
}

function detect() {
    if (bBorlandC) { // can't be Delphi if it's already C/C++
        return;
    }

    if (PE.resource["PACKAGEINFO"]) {
        bDetected = true;
        getVersion();
    }
    if (PE.resource["DVCLAL"]) {
        bDetected = true;
        getVersion();

        // try to decode DVCLAL (Delphi Visual Component Library Access License) values
        nOffset = PE.getResourceNameOffset("DVCLAL");
        if (PE.compare("A28CDF987B3C3A7926713F090F2A2517", nOffset)) {
            sOptions = "Professional";
        } else if (PE.compare("23785D23B6A5F31943F3400226D111C7", nOffset)) {
            sOptions = "Standard";
        } else if (PE.compare("263D4F38C28237B8F3244203179B3A83", nOffset)) {
            sOptions = "Enterprise";
        }
    } else if (PE.resource["TMAINFORM"]) {
        bDetected = true;
        getVersion();
    } else if (PE.isNet()) {
        if (getVersion()) {
            bDetected = true;
        }
    } else if (PE.compare("0A06'string'", PE.section[0].FileOffset)) {
        sVersion = "2";
        bDetected = true;
    } else if (PE.findSignature(PE.section[0].FileOffset, 100, "07'Boolean'") != -1) {
        bDetected = true;
        getVersion();
    } else if (PE.findSignature(PE.section[0].FileOffset, 100, "06'String'") != -1) {
        bDetected = true;
        getVersion();
    } else if (PE.findSignature(PE.section[0].FileOffset, 0x100, "FF25........8BC0FF25........8BC0")) {
        if (getVersion()) {
            bDetected = true;
        }
    }

    sLang = "Object Pascal (Delphi)";

    return result();
}


================================================
FILE: db/PE/compiler_EuroASM.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://euroassembler.eu/
meta("compiler", "EuroASM");

function detect() {
    if (!PE.isNet() && !PE.isTLSPresent() && !PE.isRichSignaturePresent() &&
        PE.getMajorLinkerVersion() === 1 && PE.getMinorLinkerVersion() === 0 &&
        PE.getImageOptionalHeader("CheckSum") === 0) {
        if (PE.compare("89000100000004002100FFFF05000002618A00000000400000000000000000000000000000000000000000000000000000000000000000000000900000000E1FBA0E00B409CD21B8084CCD21", 2)) {
            sVersion = "20180508-20190402";
            bDetected = true;
        } else if (PE.compare("89000100000004002100FFFF05000002BFA200000000400000000000000000000000000000000000000000000000000000000000000000000000900000000E1FBA0E00B409CD21B8084CCD21", 2)) {
            sVersion = "20240831+";
            bDetected = true;
        } else if (PE.compare("'This program was launched in DOS but it requires Windows.'", 0x4e)) {
            bDetected = true;
        }
    }

    sLang = "ASMx" + (PE.is64() ? "64" : "86");

    return result();
}

================================================
FILE: db/PE/compiler_Excelsior_JET.4.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("compiler", "Excelsior JET");

function detect() {
    var nFound = 0;

    for (var i = 0; i <= PE.nLastSection; i++) {
        var nOffset = PE.section[i].FileOffset,
            sSection = PE.section[i].Name;

        if (sSection == ".jidata") {
            if (PE.isSignaturePresent(nOffset, 16, "'JIMP'")) {
                ++nFound;
            }
        } else if (sSection == ".jedata") {
            if (PE.isSignaturePresent(nOffset, 16, "'JEXP'")) {
                ++nFound;
            }
        } else if (sSection == ".config") {
            ++nFound;
        }
        if (nFound == 3) {
            bDetected = true;
            break;
        }
    }

    sLang = "Java";

    return result();
}

================================================
FILE: db/PE/compiler_FASM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "FASM");

includeScript("FASM");

function detect() {
    if (bFASM) {
        sVersion = PE.getCompilerVersion();
        bDetected = true;

        // Correct version
        if (PE.getMajorLinkerVersion() > 2) {
            sVersion += "*";
        }
    }

    sLang = "ASMx" + (PE.is64() ? "64" : "86");

    return result();
}


================================================
FILE: db/PE/compiler_FreeBasic.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://freebasic.net/
meta("compiler", "FreeBASIC");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (PE.isSectionNamePresent(".CRT") && PE.isLibraryPresent("msvcrt.dll")) {
        sVersion = "MinGW";

        // fb_StrAllocTempDescZEx
        if (PE.is64()) {
            bDetected = PE.compareEP("48") && PE.isSignatureInSectionPresent(0, "564889CE534889D34883EC28E8........4885C074..48893048895808488958104883C4285B5EC3");
        } else {
            bDetected = PE.compareEP("83") && PE.isSignatureInSectionPresent(0, "5383EC088B5C2414E8........85C074..8B542410895804895808891083C4085BC20800");
        }
    }

    if (!bDetected && PE.compareEP("E8....0000E801000000C35589E5")) {
        sVersion = "0.11+";
    }

    sLang = "FreeBASIC";

    return result();
}

================================================
FILE: db/PE/compiler_Free_Pascal.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Free Pascal");

includeScript("FPC");

function detect() {
    if (PE.compareEP("E8006E00005589E58B7D0C8B750889F88B5D1029")) {
        sVersion = "0.99.10";
        bDetected = true;
    } else if (PE.compareEP("E8006E00005589E58B7D0C8B750889F88B5D1029", 19)) {
        sVersion = "0.99.10";
        bDetected = true;
    } else if (PE.compareEP("C605........01E8....0000C605........00E8....000050E800000000FF25........55")) {
        sVersion = "1.0.10";
        sOptions = "win32 console";
        bDetected = true;
    } else if (PE.compareEP("C605........00E8....000050E800000000FF25........5589E5")) {
        sVersion = "1.0.10";
        sOptions = "win32 GUI";
        bDetected = true;
    } else if (PE.compareEP("5589E5C605........00E8........5531ED89E0A3........668CD5892D")) {
        sVersion = "1.0.4";
        bDetected = true;
    } else if (PE.compareEP("C605........005589E55356578B7D08893D........8B7D0C893D........8B7D10893D")) {
        sVersion = "1.0.4";
        sOptions = "DLL";
        bDetected = true;
    } else if (PE.compareEP("5589E5C605........00E8........6A0064FF350000000089E0A3")) {
        sVersion = "2.0.0";
        bDetected = true;
    } else if (PE.compareEP("C605........01E874000000C605........00E86800000050E800000000FF25........90")) {
        sVersion = "2.0.0";
        bDetected = true;
    } else if (PE.compareEP("5589E5C605........0168........6AF6E8........50E8")) {
        sVersion = "2.6.0";
        bDetected = true;
    } else if (PE.compareEP("C605..........E8$$$$$$$$5589E5C605..........E8........5531ed89e0A3........668cd5892d........dbe3d9")) {
        sVersion = "1.0.2";
        bDetected = true;
    }
    if (bFPC) {
        var nVersionOffset = PE.findString(nOffset, 0x1024, "FPC ");

        if (nVersionOffset !== -1) {
            sVersion = PE.getString(nVersionOffset + 4);
        }

        bDetected = true;
        // Gui Lazarus ?
        if (PE.getResourceNameOffset("LAZ_PIC_DIALOG_TEMPLATE") != -1) {
            sOptions = "Lazarus";
        }
    }

    sLang = "Pascal";

    return result();
}


================================================
FILE: db/PE/compiler_Go.4.sg
================================================
// Detect It Easy: detection rule file
// created by A.S.L - asl@onet.eu - 2019.01
// improved by fernandom - menteb.in - 2020.04
// improved by sendersu - cracklab.team - 2024.04

meta("compiler", "Go");

function detect() {
    bDetected = false;

    // All **UNMODIFIED** go compiled PE binaries have a .symtab section
    if (!PE.section[".symtab"]) {
        // If it doesn't have, let's try a heuristic only, no pattern matching
        // Who knows if pattern matching is good enough
        if (PE.isSignatureInSectionPresent(0, "ff20'Go build ID: '")) {
            sVersion = "1.15.0+";
            bDetected = true;
        }
    } else {
        bDetected = true;
        if (PE.compareEP("488d742408488b3c24488d0510000000ffe0cccccccccccccccccccccccccccc") ||
            PE.compareEP("83ec0c8b44240c8d5c241089442404895c2408c70424ffffffffe901000000cc")) {
            sVersion = "1.7.X-1.9.X";
        } else if (PE.compareEP("e90bd8ffffcccccccccccccccccccccc8b5c240464c705340000000000000089") ||
            PE.compareEP("e92bc7ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")) {
            sVersion = "1.10";
        } else if (PE.compareEP("e98bc8ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c") ||
            PE.compareEP("e90bd9ffffcccccccccccccccccccccc8b5c240464c705340000000000000089")) {
            sVersion = "1.10.X";
        } else if (PE.compareEP("e98bdbffffcccccccccccccccccccccc8b5c240464c705340000000000000089") ||
            PE.compareEP("e9dbc5ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")) {
            sVersion = "1.11-1.11.X";
        } else if (PE.compareEP("e9ebc5ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c") ||
            PE.compareEP("e99bdbffffcccccccccccccccccccccc8b5c240464c705340000000000000089")) {
            sVersion = "1.12 or 1.12.2-1.12.9";
        } else if (PE.compareEP("e98bc4ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c") ||
            PE.compareEP("e99bdaffffcccccccccccccccccccccc8b5c240464c705340000000000000089")) {
            sVersion = "1.12.1";
        } else if (PE.compareEP("e92bc5ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c") ||
            PE.compareEP("e9cbdaffffcccccccccccccccccccccc8b5c240464c705340000000000000089")) {
            sVersion = "1.13 or 1.13.2";
        } else if (PE.compareEP("e9cbc3ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c") ||
            PE.compareEP("e9cbd9ffffcccccccccccccccccccccc8b5c240464c705340000000000000089")) {
            sVersion = "1.13.1 or 1.13.3-9";
        } else if (PE.compareEP("e9cbd8ffffcccccccccccccccccccccc8b5c240464c705340000000000000089") ||
            PE.compareEP("e9cbc1ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")) {
            sVersion = "1.14 or 1.14.X";
        } else if (PE.compareEP("e9....ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c2530000000c7476800000000") ||
            PE.compareEP("e9....ffffcccccccccccccccccccccc8b5c240464c705340000000000000089e58b4b0489c8c1e00229c489e78b7308fcf3")) {
            sVersion = "1.X";
        } else if (PE.compareEP("e9....ffffcccccccccccccccccccccc83ec28895c241c896c241089742414897c2418890424894c2404e8") ||
            PE.compareEP("e9$$$$$$$$488b3c24488d742408e9$$$$$$$$4889f84889f34883ec284883e4f0")) { // x86-64
            sVersion = "1.18.X-1.24.0";
        } else if (PE.isSignatureInSectionPresent(0, "ff20'Go build ID: '")) {
            sVersion = "1.15.0+";
        } else {
            bDetected = false;
        }
    }

    sLang = "Go";

    return result();
}


================================================
FILE: db/PE/compiler_IBM_VisualAge_C.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "IBM VisualAge C/C++");

function detect() {
    if (PE.compareEP("558bec68........64ff35........648925........83ec0457e8$$$$$$$$dbe3c3")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (PE.compareEP("83ec..837c24....75..ff15........85c075..33c0e8")) {
        sVersion = "4.0";
        sOptions = "DLL";
        bDetected = true;
    } else if (PE.compareEP("83ec..837c24....75..e8........85c00f85........33c0e8")) {
        sVersion = "4.0";
        sOptions = "DLL";
        bDetected = true;
    } else if (PE.compareEP("535783ec..e8........ff15........b8........e8........85c075..83c4..b8")) {
        sVersion = "3.5";
        bDetected = true;
    } else if (PE.compareEP("558bec68........64ff35........648925........e8........ff15........83ec04b8........e8$$$$$$$$b801000000c3")) {
        sVersion = "3.6";
        bDetected = true;
    } else if (PE.compareEP("558bec8b45..83f8..74..85c074..eb..6a006a006a00ff15")) {
        sOptions = "1996";
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}

================================================
FILE: db/PE/compiler_IBM_VisualAge_COBOL.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "IBM VisualAge COBOL");

function detect() {
    if (PE.compareEP("558bec81ec........e8$$$$$$$$558becb8........2d........8b40..c9c3")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("558bec68........64ff35........648925........e8........e8")) {
        sVersion = "2.2";
        bDetected = true;
    }

    sLang = "COBOL";

    return result();
}

================================================
FILE: db/PE/compiler_IBM_VisualAge_PL_I.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "IBM VisualAge PL/I");

function detect() {
    if (PE.compareEP("558bfc83e4..8bec33c08d15........8d0d........515250e8")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/compiler_Intel_C.6.sg
================================================
// Detect It Easy: detection rule file
// Authors: hypn0, BJNFNE, DosX

meta("compiler", "Intel C/C++");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    const watermarkPos = 0x4ce;

    if (PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..463c..74..84c074..8a46..463c..75..803e..75..46eb")) {
        bDetected = true;
    } else if (PE.compare("'Intel(R) C++ Compiler for 32-bit applications'", watermarkPos)) {
        sVersion = PE.getString(watermarkPos + 55, 8);
        if (sVersion && sVersion.indexOf(" ") !== -1) {
            sVersion = sVersion.split(" ")[0];
        } else {
            sVersion = String();
        }

        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/PE/compiler_Kotlin.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Kotlin");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    const rdataSection = PE.section[".rdata"];

    if (rdataSection && PE.isSignaturePresent(rdataSection.Offset, 512, "6B006F0074006C0069006E0078002E00630069006E007400650072006F007000")) {
        bDetected = true;
    }

    sLang = "Kotlin";

    return result();
}


================================================
FILE: db/PE/compiler_LCC-Win32.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("compiler", "LCC-Win32")

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (PE.compareEP("64a1........5589e56a..68........68........506489..........83ec..53565789")) {
        sVersion = "1.3";
        bDetected = true;
    }

    sLang = "C";

    return result();
}


================================================
FILE: db/PE/compiler_LDC.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "LDC");

function detect() {
    if (PE.isSectionNamePresent(".minfo") && (!(PE.isSectionNamePresent("._deh")))) {
        bDetected = true;
    }

    sLang = "D";

    return result();
}


================================================
FILE: db/PE/compiler_LLVM.6.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/llvm/llvm-project
meta("compiler", "LLVM");

function detect() {
    if (PE.section[".buildid"] || PE.compare("'LLD PDB.'", 0x0a27)) {
        sOptions = "LLD compiled";
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}

================================================
FILE: db/PE/compiler_Lahey_Fortran_90.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Lahey Fortran 90");

function detect() {
    if (PE.compareEP("eb$$b8........a3........c705................6a..e8$$$$$$$$558becff75..e8........595dc3")) {
        sVersion = "1994";
        sOptions = "by Lahey Computer Systems Inc.";
        bDetected = true;
    } else if (PE.compareEP("558bec8b45..83e8..72..74..4874..4874..eb..68........e8........59e8")) {
        sVersion = "2001";
        sOptions = "by Lahey Computer Systems Inc.";
        bDetected = true;
    }

    sLang = "Fortran";

    return result();
}

================================================
FILE: db/PE/compiler_MinGW.6.sg
================================================
// Detect It Easy: detection rule file
// Authors: DosX, fernandom

meta("compiler", "MinGW");

includeScript("FPC");

function getMinGWVersion() {
    var sResult = "";

    var rdataSection = PE.section[".rdata"];

    if (rdataSection) {
        var nOffset = rdataSection.FileOffset,
            nSize = rdataSection.FileSize,
            nVersionOffset = PE.findString(nOffset, nSize, "GCC: ");

        if (nVersionOffset != -1) {
            sResult = PE.getString(nVersionOffset, 128);
        }

        if (!sResult) {
            var nVersionOffset = PE.findString(nOffset, nSize, "gcc-");
            if (nVersionOffset != -1) {
                sResult = PE.getString(nVersionOffset);
                sResult = sResult.substring(0, sResult.indexOf('/'));
            }
        }
    }

    return sResult;
}

function detect() {
    if (PE.getMajorLinkerVersion() == 2) {
        var minor = PE.getMinorLinkerVersion();

        if (!bFPC && (minor <= 30 || minor == 36 || minor == 41 || minor == 44 || minor == 56)) {
            if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000000000'PE'0000")) {
                if (!PE.isSectionNamePresent(".rsrc")) {
                    bDetected = true;
                } else {
                    var rsrcSection = PE.section[".rsrc"];

                    if (rsrcSection && !PE.isSignaturePresent(rsrcSection.FileOffset + rsrcSection.FileOffset - 512, 512, "'Microsoft Corp.'")) {
                        bDetected = true;
                    }
                }
            }
        }
    }

    if (!bDetected && PE.compareEP("5589e583ec..e8$$$$$$$$5589e583ec..5383c4..68........e8........83c4..e8........e8........e8........83c4")) {
        sVersion = "2.9X";
        bDetected = true;
    }

    if (bDetected) {
        sVersion = getMinGWVersion();
    } else {
        var buildidSection = PE.section[".buildid"],
            rdataSection = PE.section[".rdata"];

        if (rdataSection) {
            bDetected = PE.isSignaturePresent(rdataSection.FileOffset, 256, "'mingw'")
        }

        if (!bDetected && buildidSection && rdataSection) {
            bDetected = PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "'Mingw'");
        }
    }

    if (bDetected && !PE.isOverlayPresent()) {
        sOptions = "stripped";
    } else if (!bDetected) {
        if (PE.isOverlayPresent()) {
            if (PE.compareOverlay("'.file' 00 00 00")) {
                bDetected = true;
            }
        } else {
            var ehFrameSection = PE.section[".eh_frame"];

            if (ehFrameSection && (ehFrameSection.Characteristics & 0x40000040)) {
                bDetected = true;
            }
        }
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/PE/compiler_Nim.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Nim");

function detect() {
    var rdataSection = PE.section[".rdata"];

    if (!PE.isRichSignaturePresent() && rdataSection && PE.isLibraryPresentExp(/^msvcrt/i)) {
        var nOffset = rdataSection.FileOffset,
            nSize = rdataSection.FileSize;

        if (PE.findString(nOffset, nSize, "io.nim") !== -1 || PE.findString(nOffset, nSize, "fatal.nim") !== -1) {
            bDetected = true;
        }
    }

    sLang = "Nim";

    return result();
}


================================================
FILE: db/PE/compiler_Pelles_C.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("compiler", "Pelles C")

function detect() {
    if (PE.compareEP("5589E56AFF68........68........64FF35000000006489250000000083EC0C")) {
        bDetected = true;
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/PE/compiler_PerlApp.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "PerlApp");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..8365....6a..ff15")) {
        for (var i = 0; i < PE.getNumberOfResources(); i++) {
            if ((PE.resource[i].Type == "232") || (PE.resource[i].Name == "BFS")) { // BFS
                if (PE.compare("ff'BFS'01", PE.resource[i].Offset)) {
                    bDetected = true;
                    break;
                }
            }
        }
    }

    sLang = "Perl";

    return result();
}

================================================
FILE: db/PE/compiler_PowerBASIC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "PowerBASIC");

function detect() {
    if (PE.compareEP("558bec535657bb........662ef705............0f85........6a..ff15........e8........c783")) {
        bDetected = true;
    }

    sLang = "Basic";

    return result();
}


================================================
FILE: db/PE/compiler_PureBasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "PureBasic");

function detect() {


    var codeSectionDetected = false; // If no code section is detected, then it is not PureBasic

    for (var i = 1; i < PE.getNumberOfSections() && !codeSectionDetected; i++) {
        if (PE.section[i].Characteristics == 0x60000020) {
            codeSectionDetected = true;
        }
    }

    if (!codeSectionDetected) return false;


    if (!PE.is64()) {
        if (PE.compareEP("68....0000680000000068......00E8......0083C40C6800000000E8......00A3")) {
            sVersion = "4.X-6.X";
            bDetected = true;
        } else if (PE.compareEP("837C24080175..8B442404A3........E8")) {
            sVersion = "4.X";
            bDetected = true;
        }
    } else {
        if (PE.compareEP("4883EC..49C7C0........4831D248B9................E8........4831C9E8")) {
            sVersion = "4.X-6.X";
            bDetected = true;
        }
    }

    if (PE.isSectionNamePresent(".drectve")) {
        var sn = PE.getSectionNumber(".drectve");

        if (PE.isSignatureInSectionPresent(sn, "'pb_datapointer'")) {
            sVersion = "6.X";
            sOptions = "gcc";
            bDetected = true;
        }
    }

    if (!bDetected && PE.getImportLibraryName(0) === "KERNEL32.dll") {
        const rdataSection = PE.section[".rdata"];

        if (rdataSection) {
            bDetected = PE.findSignature(rdataSection.FileOffset, 5120, "1415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F30313233") !== -1;
        }
    }

    sLang = "PureBasic";

    return result();
}


================================================
FILE: db/PE/compiler_RADBasic.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.radbasic.dev/
meta("compiler", "RAD Basic");

function detect() {
    if (PE.compareEP(PE.is64() ? "48 83 EC" : "E8") && PE.getImportFunctionName(0, 0) === "CloseHandle") {
        const rdataSection = PE.section[".rdata"];

        if (rdataSection && PE.isSignatureInSectionPresent(rdataSection.Number, "'RADBasic'")) {
            bDetected = true;
        }
    }

    if (!bDetected && PE.isResourceNamePresent("RADBASICAPPICON")) {
        bDetected = true;
    }

    sLang = "VB";

    return result();
}

================================================
FILE: db/PE/compiler_RealBasic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("compiler", "REALbasic (by Xojo.com)");

function detect() {
    if (PE.isOverlayPresent()) {
        var nOffset = PE.getOverlayOffset(),
            nSize = PE.getOverlaySize();

        if (PE.isResourceGroupNamePresent("PICKLE") &&
            PE.findString(nOffset, nSize, "REALbasic.Point") !== -1 &&
            PE.findString(nOffset, nSize, "Xojo.Introspection") !== -1) {
            bDetected = true;
        }
    }

    sLang = "Basic";

    return result();
}

================================================
FILE: db/PE/compiler_RosASM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "RosASM");

includeScript("RosASM");

function detect() {
    if (bRosASM) {
        sVersion = PE.getCompilerVersion();
        sOptions = PE.getGeneralOptionsEx(); // RosASM doesn't have a linker
        bDetected = true;

        // Correct version
        if (PE.getMajorLinkerVersion() > 3) {
            sVersion += "*";
        }
    }

    sLang = "ASMx" + (PE.is64() ? "64" : "86");

    return result();
}


================================================
FILE: db/PE/compiler_Rust.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("compiler", "Rust");

function detect() {
    /* if (!PE.is64()) {
         if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8")) {
             sVersion = "i686-pc-windows-msvc";
             bDetected = true;
         }
     } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc3")) {
           sVersion = "x86_64-pc-windows-msvc";
           bDetected = true;
     } else if (PE.compareEP("48895c24..48897424..574883ec..498bf88bda488bf183fa..75..e8$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc3")) {
           sVersion = "x86_64-pc-windows-msvc";
           bDetected = true;
     } */

    var rdataSection = PE.section[".rdata"];

    if (PE.isTLSPresent() && rdataSection && PE.section["_RDATA"] &&
        PE.findSignature(rdataSection.FileOffset, rdataSection.FileSize, "4C6F63616C5C527573744261636B74726163654D75746578") != -1 &&
        PE.findSignature(rdataSection.FileOffset, rdataSection.FileSize, "'/rust'") != -1) {
        bDetected = true;
    }

    sLang = "Rust";

    return result();
}

================================================
FILE: db/PE/compiler_SpASM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "SpASM");

includeScript("SpASM");

function detect() {
    if (bSpASM) {
        sVersion = PE.getCompilerVersion();
        sOptions = PE.getGeneralOptionsEx(); // SpASM doesn't have a linker
        bDetected = true;

        // Correct version
        if (PE.getMajorLinkerVersion() > 3) {
            sVersion += "*";
        }
    }

    _sLang = "ASMx" + (PE.is64() ? "64" : "86");

    return result();
}


================================================
FILE: db/PE/compiler_Swift.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/swiftlang/swift
meta("compiler", "Swift");

function detect() {
    if (PE.isNet() || PE.isRichSignaturePresent()) return; // Doesn't support .NET and files with Rich Signature

    if (PE.isLibraryPresentExp(/^swift/)) {
        bDetected = true;

        if (PE.isLibraryPresent("swiftCRT.dll")) {
            sOptions = "dynamic";
        }
    }

    if (PE.getNumberOfSections() > 15 && PE.isSectionNamePresentExp(/^.sw5/)) {
        sVersion = "5.X";
        bDetected = true;
    }

    sLang = "Swift";
    sLangVersion = sVersion;

    return result();
}

================================================
FILE: db/PE/compiler_Symantec_C.6.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Symantec C/C++");

function detect() {
    if (PE.compareEP("83ec08535556578b7c24..8b7424..8b6c24..ff15........894424..a9........74..807c24")) {
        sVersion = "7.2";
        sOptions = "DLL";
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/PE/compiler_TASM32.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Turbo Assembler 32 (TASM32) by Borland.
// Versions: 5.X.  Linker: TLINK32.
// https://en.wikipedia.org/wiki/Turbo_Assembler

meta("compiler", "TASM32");

includeScript("Borland"); // sets bBorlandC
includeScript("TASM32");  // uses bBorlandC; sets bTASM32

function detect() {
    if (bTASM32) {
        // Map TLINK32 linker version to TASM32 product version.
        // TLINK32 always stamps major version 2 in the PE optional header.
        if (PE.getMajorLinkerVersion() == 2 && PE.getMinorLinkerVersion() == 25) {
            sVersion = "5.x";
        }

        bDetected = true;
    }

    sLang = "ASMx86";

    return result();
}


================================================
FILE: db/PE/compiler_Virtual_Pascal.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Virtual Pascal");

function detect() {
    if (PE.compareEP("b9........b8........e8$$$$$$$$83ec..fc51e8")) {
        sVersion = "2.1";
        bDetected = true;
    }

    sLang = "Pascal";

    return result();
}

================================================
FILE: db/PE/compiler_Visual_Objects.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Visual Objects");

function detect() {
    if (PE.compare("'This Visual Objects application cannot be run in DOS mode'", 0x312)) {
        sVersion = "2.XX";
        bDetected = true;
    }

    sLang = "Visual Objects";

    return result();
}


================================================
FILE: db/PE/compiler_Visual_Prolog.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("compiler", "Visual Prolog");

function detect() {
    if (PE.compareEP("558bec57dbe3d92d........68........e8........8325..........75..6a..eb..33c066a1........50e8........8038")) {
        sVersion = "5.2";
        bDetected = true;
    }

    sLang = "Visual Prolog";

    return result();
}


================================================
FILE: db/PE/compiler_Watcom.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Watcom C/C++");

function detect() {
    if (PE.compare( /*[Tt]*/ "'his is a Windows '" /*(?:95|NT)*/, 0x4f)) {
        bDetected = true;
    } else if (PE.findString(PE.getEntryPointOffset(), 32, "watcom") != -1) {
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$5351525589e583ec..b8........e8........a1........83c0..24..31d229c489e18b1d")) {
        sOptions = "1995 by Watcom International";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$535657558b7c24..8b7424..8b6c24..83fe..0f87........89f02eff")) {
        sVersion = "1995"; // DLL32
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$535657558b7424..8b7c24..8b6c24..83ff..0f87........89f82eff")) {
        sVersion = "1995"; // DLL32
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$535589e583ec..b8........e8........a1........83c0..24..29c489e38b15")) {
        sVersion = "1995 EXE32, console";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$535152565783ec..e8........a3........894424..8d4424..31dbe8")) {
        sVersion = "1995"; // EXE32, console
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$535657558b7424..8b7c24..8b6c24..83ff..0f87........2eff")) {
        sVersion = "2000"; // DLL32
        bDetected = true;
    } else if (PE.compareEP("c705................e9$$$$$$$$5351525589e583ec..b8........e8........a1........83c0..24..31d229c489e1")) {
        sVersion = "1995"; // EXE32
        bDetected = true;
    }

    sLang = "C/C++";

    return result();
}


================================================
FILE: db/PE/compiler_WutaoEPL.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.dywt.com.cn/
meta("compiler", "Wutao Easy Compiler");

function detect() {
    var ecodeSection = PE.section[".ecode"];

    if (ecodeSection && PE.compare("'WTNE / MADE BY E COMPILER - WUTAO '", ecodeSection.FileOffset)) {
        sVersion = "4.X";
        bDetected = true;
    }

    sLang = "Easy (EPL)";

    return result();
}

================================================
FILE: db/PE/compiler_Xbase.4.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

// https://www.alaska-software.com/products/features-list.cxp#F14CTT
meta("compiler", "Xbase++ Native Code Compiler");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    var xppSection = PE.section[".xpp"];

    if (xppSection) {
        bDetected = PE.findString(xppSection.FileOffset, xppSection.FileSize, "XBPEXCEPTION");
    }

    if (PE.isLibraryPresent("XBTBase1.dll")) {
        sOptions = "Runtime";
        bDetected = true;
    }

    sLang = "Xbase++";

    return result();
}


================================================
FILE: db/PE/compiler_Zig.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("compiler", "Zig");

function detect() {
    if (PE.compare("'MZ'78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\
0000'PE'0000")) {
        var rdataSection = PE.section[".rdata"];

        if (rdataSection && PE.isDeepScan()) {
            bDetected = (PE.findSignature(rdataSection.FileOffset, rdataSection.FileSize, "5A00490047005F00440045004200550047005F0043004F004C004F005200") !== -1); // ZIG_DEBUG_COLOR
        }
    }

    sLang = "Zig";

    return result();
}


================================================
FILE: db/PE/compiler_tcc.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// The best compiler for C. Better than VC/Clang/GCC!
// Thank you, Bellard. ;)

// https://bellard.org/tcc/
meta("compiler", "Tiny C");

function detect() {
    if (PE.isNet()) return;

    var isLinkerDetected = false,
        isInitFuncDetected = false,
        isStdLibUsed = PE.isLibraryPresent("msvcrt.dll");

    if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000'PE'0000") &&
        PE.getCompilerVersion() == "6.0" && !PE.section[".reloc"] && !PE.section[".tls"] && !PE.section[".rdata"] && !PE.section[".rsrc"]) {
        _setResult("linker", "TCC Linker", "6.0", "");
        isLinkerDetected = true;
    }

    if (isStdLibUsed && PE.compareEP(PE.is64() ?
        "554889e54881ec........b8........8945..b8........4989c24c89d1e8" :
        "5589e581ec........908d45..50e8........83c4..b8........8945..b8........50e8........83c4"))
        isInitFuncDetected = true;

    if (isLinkerDetected || isInitFuncDetected) bDetected = true;

    if (bDetected && !isInitFuncDetected && PE.compareEP("5589E581EC........90E8")) {
        sVersion = "legacy";
        isInitFuncDetected = true;
    }

    if (bDetected) {
        if (!isStdLibUsed) sOptions = "no std"; // detectible on last versions
        if (!isInitFuncDetected) sOptions = sOptions.append("no init"); // if EP is '_start()'
    }

    sLang = "C";

    return result();
}

================================================
FILE: db/PE/compiler_twinBASIC.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://twinbasic.com/
meta("compiler", "twinBASIC");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (!PE.isRichSignaturePresent()) {
        if (PE.isImportPositionHashPresent(0, 0xc28f4fe3) && PE.isImportPositionHashPresent(1, 0x3f8b3302) ||
            PE.isResourceNamePresent("TWINBASIC.ICO")) {
            bDetected = true;

            if (PE.is64()) {
                sVersion = "Professional/Ultimate";
            }
        }
    }

    sLang = "twinBASIC";

    return result();
}

================================================
FILE: db/PE/cryptor_Amber.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/EgeBalci/amber
meta("cryptor", "Amber");

function detect() {
    if (PE.isImportPositionHashPresent(-1, 0x97c72051) &&
        PE.compareEP(PE.is64() ?
            "48 83 EC .. 48 8B 05 .. .. .. .. C7 00 .. .. .. .. E8 .. .. .. .. E8 .. .. .. .. 90 90 48 83 C4" : // 64 bit
            "83 EC 0C C7 05 94 53 40 00 01 00 00 00 E8 9E 02 00 00 83 C4 0C E9 A6 FC FF FF 8D B6 00 00 00 00 83 EC 0C C7 05 94 53 40 00 00 00 00 00 E8 7E 02 00 00 83 C4 0C E9 86 FC FF FF 8D B6 00 00 00 00 83 EC 1C 8B 44 24 20 89 04 24 E8 1D 12 00 00 85 C0 0F 94 C0 83 C4 1C 0F B6 C0 F7 D8 C3 90 90 90 55 89 E5 83")) { // 32 bit
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/cryptor_AverCryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://web.archive.org/web/20071012084924/http://secnull.org/
meta("cryptor", "AverCryptor");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........8BBD........8B8D........B8")) {
        bDetected = true;

        switch (PE.readByte(PE.getEntryPointOffset() + 65)) {
            case 0xFA: sVersion = "1.0"; break;
            case 0xF7: sVersion = "1.02";
        }

        if (!PE.isSectionNamePresent(".avc")) {
            sOptions = "modified";
        }
    }

    return result();
}


================================================
FILE: db/PE/cryptor_BattleshipCrypter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Author A.S.L

meta("cryptor", "Battleship Crypter");

function detect() {
    if (PE.compareEP("6818144000E8F0FFFFFF0000000000003000000038000000000000007A88CD659A43264D8DF747BE8615237F")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/cryptor_CronosCrypter.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/TalosSec/Cronos-Crypter
meta("cryptor", "CronosCrypter");

function detect() {
    if (PE.isNet() && PE.isSignatureInSectionPresent(0, "43 72 6F 6E 6F 73 2D 43 72 79 70 74 65 72")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/cryptor_CryptEngine_MalwareCryptor.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/NET-MalwareCryptor
meta("cryptor", "CryptEngine");

function detect() {
    if (PE.isNetObjectPresent("Inject") && PE.isNetUStringPresent("EntryPoint") && PE.isNetUStringPresent("Invoke") && PE.isNetUStringPresent("Load")) {
        sVersion = "NET-MalwareCryptor";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/cryptor_Duals_eXe_Encryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "Duals eXe Encryptor");

function detect() {
    if (PE.compareEP("558BEC81EC00050000E8000000005D81ED0E")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 18)) {
            case 0x308: sVersion = "1.0"; break;
            case 0x43A: sVersion = "1.0b"; break;
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/cryptor_EXECryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "EXECryptor");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8")) {
        sVersion = "2.0/2.1";
        sOptions = "protected IAT";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84")) {
        sVersion = "2.0/2.1";
        bDetected = true;
    } else if (PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15")) {
        sVersion = "2.1.17";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68")) {
        sVersion = "2.2.4";
        bDetected = true;
    } else if (PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9")) {
        sVersion = "2.2.6";
        sOptions = "minimum protection";
        bDetected = true;
    } else if (PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81")) {
        sVersion = "2.2.6";
        sOptions = "DLL/minimum protection";
        bDetected = true;
    } else if (PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8")) {
        sVersion = "2.2/2.3";
        sOptions = "compressed code";
        bDetected = true;
    } else if (PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8")) {
        sVersion = "2.2/2.3";
        sOptions = "protected IAT";
        bDetected = true;
    } else if (PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000")) {
        sVersion = "2.3.9";
        sOptions = "compressed resources";
        bDetected = true;
    } else if (PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84")) {
        sVersion = "2.3.9";
        sOptions = "minimum protection";
        bDetected = true;
    } else if (PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9")) {
        sVersion = "2.3.9";
        sOptions = "DLL/compressed resources";
        bDetected = true;
    } else if (PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1")) {
        sVersion = "2.3.9";
        sOptions = "DLL/minimum protection";
        bDetected = true;
    } else if (PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889")) {
        sVersion = "2.XX";
        sOptions = "compressed resources";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A")) {
        sVersion = "2.XX";
        sOptions = "max. compressed resources";
        bDetected = true;
    } else if (PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1")) {
        sVersion = "1.3.0.45";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4")) {
        sVersion = "1.4X-1.5X";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3")) {
        sVersion = "1.5X";
        bDetected = true;
    } else if (PE.compareEP("83C6148B55FCE9..FFFFFF")) {
        sVersion = "2.1X";
        bDetected = true;
    } else if (PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1")) {
        sVersion = "2.1X";
        bDetected = true;
    } else if (PE.compareEP("FFE0E804000000FFFFFFFF5EC300")) {
        sVersion = "2.2X";
        bDetected = true;
    } else if (PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F")) {
        bDetected = true;
    }

    if (!bDetected) {
        var nNumberOfSections = PE.section.length;
        if (nNumberOfSections > 3 &&
            PE.getNumberOfImports() == 2 &&
            PE.getNumberOfImportThunks(1) == 1 &&
            PE.getImportFunctionName(1, 0) == "MessageBoxA") {
            for (var nAdjust = 1; nAdjust < 3; nAdjust++) {
                if (PE.getImportSection() == nNumberOfSections - nAdjust &&
                    PE.section[nNumberOfSections - nAdjust - 1].FileSize == 0) {
                    sVersion = nNumberOfSections > 4 ? "2.4X" : "2.X";
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/cryptor_Huan.1.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

// https://github.com/frkngksl/Huan
meta("cryptor", "Huan");

function detect() {
    if (PE.isSectionNamePresent(".huan")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/cryptor_KCryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "K!Cryptor");

function detect() {
    if (PE.compareEP("558bec83ec..53565733db53ff15........8b3d........8945..b8........ff30be........56e8........68........6a..e8........83c4..6a..68........5753ffd0")) {
        sVersion = "0.11";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/cryptor_Kryptonit.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// sign by A.S.L - asl@onet.eu

// https://github.com/ximerus/Kryptonite
meta("cryptor", "Kryptonite");

function detect() {
    nOffset = 0x0093;
    if (PE.compareEP("558BEC")) {
        if (PE.compare("'Krypton'", nOffset)) {
            sVersion = "0.1-0.2";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/cryptor_LimeCrypter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("cryptor", "LimeCrypter");

function detect() {
    if (PE.isNet()) {
        bDetected = true;
        if (validateReferences(
            isPositive = true,
            references = [
                "System.Security.Cryptography",
                "System.Collections.Generic",
                "System.Resources",
                "System.Reflection"
            ]
        )) {
            bDetected = false;
            return; // end
        }

        if (!PE.isSignatureInSectionPresent(0, "3c50726976617465496d706c656d656e746174696f6e44657461696c733e7b........................................................................7d") ||
            !PE.isSignatureInSectionPresent(0, "24........................................................................") ||
            !PE.isNetObjectPresent("<Initialize>o__SiteContainer0") ||
            !PE.isNetObjectPresent("$$method0x6000005-1") ||
            !PE.isNetObjectPresent("Assembly") ||
            !PE.isNetObjectPresent("Rfc2898DeriveBytes") ||
            !PE.isNetObjectPresent("AES_Decrypt") ||
            !PE.isNetObjectPresent("<>p__Site1") || PE.isNetObjectPresent("Chainski")) {
            bDetected = false;
        }
    }

    return result();
}


// validateReferences by DosX
function validateReferences(isPositive, references) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive == true) {
            if (!PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        }
    }
    return false;
}

================================================
FILE: db/PE/cryptor_NativeCryptor_by_DosX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "NativeCryptor by DosX");

function detect() {
    bDetected = PE.getNumberOfSections() >= 3 && PE.compareOverlay("'7stgc_hdr'00");

    return result();
}


================================================
FILE: db/PE/cryptor_PEUnion.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research
// Edited: DosX

meta("cryptor", "PEUnion");

function detect() {
    // 32bit RUNPE stub
    if (!PE.isNet()) {
        bDetected = true;

        if (PE.is64()) {
            bDetected = false;
        }

        const kLib = "kernel32.dll";

        if (validateNativeImports(
            isPositive = true,
            references = [
                [kLib, "GetProcAddress"],
                [kLib, "ExitProcess"],
                [kLib, "GetModuleFileNameA"],
                [kLib, "GetComputerNameA"],
                [kLib, "VirtualAllocExNuma"],
                ["shlwapi.dll", "PathFindFileNameA"]
            ]
        )) {
            bDetected = false;
        }

        // ====== ENTRY POINT ======
        //      E8:  call ...
        //      6A:  push 0
        //  FF15A4:  call dword ptr [...]
        //      C3:  ret
        // =========================
        const entryPoint = "E8??????006A00FF15A4????00C3";

        if (PE.getNumberOfSections() != 3 ||
            !PE.compareEP(entryPoint) ||
            !PE.isSectionNamePresent(".rsrc") || !PE.isSectionNamePresent(".idata") || !PE.isSectionNamePresent(".text") ||
            PE.findString(PE.section[".rsrc"].FileOffset, PE.section[".rsrc"].FileSize, "</assembly>") == -1 ||
            !(PE.getSectionVirtualSize(1) + PE.getSectionVirtualSize(2) < PE.getSectionVirtualSize(0)) ||
            !PE.isSignatureInSectionPresent(1, "00'Shlwapi.dll'00")) { // validate imports with signature <[S]hlwapi.dll>
            bDetected = false;
        }


        sOptions += "RunPE"
    }

    if (PE.isNet()) {
        bDetected = true;
        if (validateReferences(
            isPositive = true,
            references = [
                "kernel32.dll", "LoadLibraryA", "GetProcAddress",
                "System.Runtime.InteropServices",
                "System.Runtime.CompilerServices",
                "System.IO",
                "System.Reflection",
                "System.Resources",
                "System.Collections.Generic",
                "System.Core",
                "System.Linq",
                "IEnumerable`1", "<>c__DisplayClass1", "Func`2"
            ],
            section = 0
        )) {
            bDetected = false;
        }

        if (PE.isNetObjectPresent("BeginInvoke") ||
            PE.isNetObjectPresent("EndInvoke")) {
            sOptions += "Invoke"
        }

    }

    sVersion = "4.0";
}


// validateReferences by DosX
function validateReferences(isPositive, references, section) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive == true) {
            if (!PE.isSignatureInSectionPresent(section, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(section, sign)) {
                return true;
            }
        }
    }
    return false;

    return result();
}

// and validateNativeImports by DosX also
function validateNativeImports(isPositive, references) { // references[2]
    for (var i = 0; i < references.length; i++) {
        var importSign = references[i],
            library = importSign[0],
            entry = importSign[1];
        if (isPositive == true) {
            if (!PE.isLibraryFunctionPresent(library, entry)) {
                return true;
            }
        } else { // negative
            if (PE.isLibraryFunctionPresent(library, entry)) {
                return true;
            }
        }
    }
    return false;
}

// I like coffee. Preferably with milk

================================================
FILE: db/PE/cryptor_RCryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "RCryptor");

function detect() {
    if (PE.compareEP("90589050908B00903C5090580F8567D6EF115068")) {
        sVersion = "1.??";
        bDetected = true;
    } else if (PE.compareEP("8B042483E84F68........FFD0")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("558BEC8B44240483E84F68........FFD0585950")) {
        sVersion = "1.3/1.4";
        bDetected = true;
    } else if (PE.compareEP("6183EF4F6068........FFD7")) {
        sVersion = "1.3b";
        bDetected = true;
    } else if (PE.compareEP("832C244F68........FF542404834424044F")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (PE.compareEP("33D068........FFD2")) {
        sVersion = "1.6";
        bDetected = true;
    } else if (PE.compareEP("8BC70304242BC78038500F851B8B1FFF68")) {
        sVersion = "1.6b/1.6c";
        bDetected = true;
    } else if (PE.compareEP("60906161807FF04590600F851B8B1FFF68")) {
        sVersion = "1.6d";
        bDetected = true;
    } else if (PE.compareEP("F7D183F1FF6A00F7D183F1FF810424........F7D183F1FF")) {
        if (PE.compareEP("E8", 24)) {
            sOptions = "Hide EP";
        }
        sVersion = "2.0";
        bDetected = true;
    }

    if (bDetected && !PE.isSectionNamePresentExp(/^(\.)?RCryptor$/)) {
        sOptions = "modified";
    }

    return result();
}


================================================
FILE: db/PE/cryptor_RDG_Tejon_Crypter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "RDG Tejon Crypter");

function detect() {
    if (PE.compareEP("6850171001E8EEFFFFFF000000000000300000003800000100000000B365D0B8919CE145AA1BEEE0C80467EE")) {
        sVersion = "0.7";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/cryptor_ReXCrypter.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/syrex1013/rexcrypter-2
meta("cryptor", "ReXCrypter");

function detect() {
    if (PE.isNet()) {
        var netAssemblyName = PE.getNetAssemblyName();

        if (netAssemblyName.indexOf("ReXStub ") === 0) {
            var stubVersion = netAssemblyName.split(" ")[1];

            if (stubVersion && stubVersion.length < 5) {
                sVersion = "1.0-2.0, stub " + stubVersion;
            }

            bDetected = true;
        }

        if (!bDetected) {
            if (PE.isNetObjectPresent("GetConsoleWindow") && PE.isNetObjectPresent("LoadInMem")) {
                sVersion = "custom stub";
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/cryptor_Stones_PE_Encryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "Stone's PE Encryptor");

function detect() {
    if (PE.compareEP("555756525153E8........5D8BD581ED........2B95........83EA0B8995")) {
        switch (PE.getEntryPointSignature(35, 2)) {
            case "8DB5": sVersion = "1.0"; break;
            case "0195": sVersion = "1.13"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("535152565755E8........5D81ED........FF95........B8........03C52B85")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/cryptor_Virogen_Crypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Virogen Crypt");

function detect() {
    if (PE.compareEP("9c55e8$$$$$$$$e8000000008b2c2481ed........83c4..c3")) {
        sVersion = "0.75";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/cryptor_XorCryptor.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/DotNET_XorCryptor
meta("cryptor", "XorCryptor");

function detect() {
    if (/^[A-Za-z]{10,31}$/.test(PE.getNetAssemblyName()) &&
        PE.isNetObjectPresent("LateIndexGet") &&
        PE.isNetUStringPresent("System.Reflection.Assembly") &&
        PE.isNetUStringPresent("EntryPoint") &&
        PE.isNetUStringPresent("Load") &&
        PE.isNetUStringPresent("Invoke")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/cryptor_Yodas_Crypter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "Yoda's Crypter");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........E8A1000000E8D1000000E885010000F785")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED........B9....00008DBD........8BF7")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 14)) {
            case 0x009E: sVersion = "1.1"; break;
            case 0x097B: sVersion = "1.2"; break;
            default:
                sVersion = "1.X";
        }

        bDetected = true;
    } else if (PE.compareEP("558BEC53565760E8000000005D81ED")) {
        if (PE.compareEP("E803000000EB01", 19)) {
            sVersion = "1.0b";
            bDetected = true;
        } else if (PE.compareEP("B9", 19)) {
            sVersion = "1.3";
            bDetected = true;
        }
    } else if (PE.compareEP("558BEC81ECC00000005356578DBD40FFFFFFB930000000B8CCCCCCCCF3AB60")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/custom_sfx_installers.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx");

function detect() {
    if (PE.compareEP("558bec6aff68........68........64a1........50648925........83ec..535657")) {
        if (PE.compareOverlay("....'-lh5-'")) {
            sName = "Toxsoft SFX";
            bDetected = true;
        } else if (PE.findSignature(PE.getOverlayOffset(), 0x100, "'MSCF'") !== -1) {
            sName = "Webest SFX";
            sVersion = "1.0";
            bDetected = true;
        } else if (PE.compareOverlay("a6d6b210")) {
            sType = "installer";
            sName = "Sax Software installer";
            bDetected = true;
        } else if (PE.compareOverlay("'Win_Sfx_For_Windows_'")) {
            sName = "XZIP-SFX";
            sOptions = "by Netzip";
            bDetected = true;
        } else if (PE.getNumberOfResources() > 0) {
            for (var i = 0; i < PE.resource.length && !bDetected; i++) {
                if (PE.compare("'SZDD'88", PE.resource[i].Offset)) {
                    sType = "installer";
                    sName = "custom installer with SZDD-archives";
                    bDetected = true;
                }
            }
        }
    } else if (PE.compareEP("558bec81ec........5333db53ff15........a3........891d........891d........e8........391d")) {
        if (PE.compareOverlay("'PK'0304")) {
            sType = "sfx";
            sName = "ZIP-SFX";
            sOptions = "by Ashampoo";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.getNumberOfResources() > 0 && PE.compare("5d00008000........000000000000", PE.resource[0].Offset)) {
            sType = "installer";
            sName = "Microsoft Windows update";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")) {
        if (PE.compareOverlay("........00020200")) {
            var a = PE.getOverlayOffset();
            var b = PE.readWord(a);
            if (PE.compare("'SDLSOPKG'", a + b)) {
                sType = "installer";
                sName = "SysDev Laboratories";
                bDetected = true;
            }
        }
    } else if (PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d")) {
        if (PE.compareOverlay("'PK'0304")) {
            sType = "sfx";
            sName = "ZIP-SFX";
            sOptions = "by Aeco Systems";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/dotnet_only/about.txt
================================================
Scripts for .NET files only will be located here (PE.isNet() == true)

================================================
FILE: db/PE/emulator_Wine.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("emulator", "Wine");

function detect() {
    if (PE.compare("'Wine'", 0x40)) {
        sVersion = "1.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/engine_AGS.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.adventuregamestudio.co.uk/
meta("engine", "Adventure Game Studio (AGS)");

function detect() {
    if (PE.compareOverlay("434c49421a..00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/format_AutoHotKey.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "Compiled AutoHotKey");

function detect() {
    if (PE.resource[">AUTOHOTKEY SCRIPT<"]) {
        sVersion = PE.getFileVersion();
        bDetected = true;
    } else {
        var sManifest = PE.getManifest();

        if (sManifest.indexOf("AutoHotkey") !== -1 && // First, we look for a substring to save processor cycles
            sManifest.match(/(\n?)<assemblyIdentity.*?(\n?).*version(.*?)(\n?)name=\"AutoHotkey\"/)) {
            aVersion = sManifest.match(/version=\"(.*?)\" ?name=\"AutoHotkey/);
            sVersion = aVersion[1];
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/format_AutoIt.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://en.wikipedia.org/wiki/AutoIt
meta("format", "AutoIt");

function detect() {
    if (PE.isResourceNamePresent("SCRIPT")) {
        sVersion = "3.XX";
        bDetected = true;
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0") && PE.compareOverlay("a3484bbe986c4aa9")) {
        sVersion = "3.XX";
        bDetected = true;
    } else if (PE.getVersionStringInfo("FileDescription") == "Compiled AutoIt Script") {
        sVersion = PE.getFileVersionMS();
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/game_engine_Atlas.3.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Engines/Atlas
meta("game engine", "Atlas");

function detect() {
    if (PE.getVersionStringInfo("ProductName") == "Atlas Game Engine") {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/game_engine_DEV7.3.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=DEV7_Information
meta("game engine", "DEV7");

function detect() {
    if (PE.getVersionStringInfo("ProductName") == "Dev7 VM v1.30b") {
        sVersion = "1.30b";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Loader 7 v1.10a") {
        sVersion = "1.10a";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Dev7 VM v1.30a") {
        sVersion = "1.30a";
        sOptions = "Антошка 3";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Dev7 VM v1.30") {
        sVersion = "1.30";
        bDetected = true;
    }
    return result();
}

================================================
FILE: db/PE/game_engine_Director.3.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Director
meta("game engine", "Director");

function detect() {
    if (PE.isExportFunctionPresent("_FindEmbeddedMovie") || PE.isExportFunctionPresent("_GetCurrentEmbeddedMovie")) {
        sVersion = "7.0-7.0.2";
        bDetected = true;
    } else if (PE.getVersionStringInfo("LegalCopyright") == "Copyright © 1985-1996 Macromedia, Inc.") {
        sVersion = "5.0-5.0.1";
        bDetected = true;
    } else if (PE.getVersionStringInfo("LegalCopyright") == "Copyright © 1985-1997 Macromedia, Inc.") {
        sVersion = "6.0-6.5";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Director 8 Shockwave Studio") {
        sVersion = "8.0";
        sOptions = "Shockwave Studio";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Director 8.5 Shockwave Studio") {
        sVersion = "8.5";
        sOptions = "Shockwave Studio";
        bDetected = true;
    } else if (PE.getVersionStringInfo("LegalCopyright") == "Copyright © 1985-2002 Macromedia, Inc.") {
        sVersion = "9.0";
        bDetected = true;
    } else if (PE.getVersionStringInfo("LegalCopyright") == "Copyright © 1985-2003 Macromedia, Inc.") {
        sVersion = "10.0";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Director MX 2004") {
        sVersion = "10.1";
        sOptions = "MX 2004";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Director 11.3") {
        sVersion = "11.0.3";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductName") == "Director 11.5") {
        sVersion = "11.5";
        bDetected = true;
    } else if (PE.getVersionStringInfo("ProductVersion") == "12.0.1 Development") {
        sVersion = "12.0.1";
        sOptions = "Development build";
        bDetected = true;
    }
    return result();
}

================================================
FILE: db/PE/game_engine_Godot.3.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://godotengine.org
meta("game engine", "Godot");

function detect() {
    if (PE.getVersionStringInfo("FileDescription") == "Godot Engine") {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/game_engine_Wintermute.3.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Wintermute
meta("game engine", "Wintermute");

function detect() {
    if (PE.getVersionStringInfo("FileDescription") == "Wintermute Engine Runtime") {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/game_engine_XPAT.3.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Engines/XPAT
meta("game engine", "XPAT");

function detect() {
    if (PE.getVersionStringInfo("FileDescription") === "Xpat Runtime Engine") {
        sVersion = "1.0.0.1";
        sOptions = "1995";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/game_engine_Xash.3.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("game engine", "Xash3D");

function detect() {
    var dataSection = PE.section[".data"];

    if (dataSection &&
        PE.findString(dataSection.FileOffset, dataSection.FileSize, "Xash Error") != -1 &&
        PE.findString(dataSection.FileOffset, dataSection.FileSize, "xash.dll") != -1 &&
        PE.findString(dataSection.FileOffset, dataSection.FileSize, "Unable to load the xash.dll") != -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_ACCAStore.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "ACCAStore");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1") &&
        PE.getNumberOfResources() > 0 &&
        PE.getResourceNameOffset("METRO_INFO") !== -1) {
        sVersion = "1.9.4.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_AOLSetup.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "AOLSetup");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..535657")) {
        if (PE.compareOverlay("'RS'")) {
            sVersion = "by America Online";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Acronis_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Acronis installer");

function detect() {
    if (PE.compareOverlay("'PK'0304")) {
        if (PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15") ||
            PE.compareEP("6a..68........e8$$$$$$$$68........64a1........508b4424..896c24..8d6c24..2be05356578b45..8965..508b45..c7") ||
            PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74") ||
            PE.compareEP("558bec8b45..8b4d..8b55..83f8..75..8915........894d..8945..8955..5de9") ||
            PE.compareEP("8b4424..83f8..8b4c24..8b5424..75..8915........894c24..894424..895424..e9") ||
            PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
            sOptions = "ZIP";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Actual_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://www.actualinstaller.ru/
meta("installer", "Actual Installer");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3")) {
        if (PE.compareOverlay("....................'MSCF'00")) {
            sVersion = "1.0.0.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Adobe_FlashPlayer_downloader.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// created by A.S.L - asl@onet.eu - 2019
// 2020.07 fixed

meta("installer", "Adobe FlashPlayer downloader");

function detect() {
    if (PE.compareEP("B8......005064FF3500") && PE.isOverlayPresent()) {
        if (PE.getVersionStringInfo("InternalName") == "Adobe Download Manager") {
            sVersion = "2.0";
            sOptions = "PECompact"; // packed stub
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_Adobe_installers.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Adobe");

function detect() {
    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == 3284) { // ARCHIVE_7Z
                if (PE.findSignature(PE.resource[i].Offset, 6, "'7z'BCAF271C") != -1) {
                    sName += " Reader Installer";
                    sOptions = "7zip sfx";
                    bDetected = true;
                    break;
                }
            }
        }
    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'^OPT'")) {
            var ArcOffset = PE.findString(PE.getOverlayOffset(), 0x50, "^ARC");
            if (ArcOffset != -1) {
                if (PE.compare("1f8b08", ArcOffset + 4)) {
                    sName += " SVG Installer";
                    sOptions = "gzip";
                    bDetected = true;
                }
            }
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.resource[0] && PE.findSignature(PE.resource[0].Offset, 6, "'7z'BCAF271C") != -1) {
            sName += " WebInstaller";
            sOptions = "7zip sfx";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Advanced_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Advanced Installer");

function detect() {
    if (PE.compareOverlay("2f30ee1f5e4ee51e")) {
        if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
            bDetected = true;
        } else if (PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7")) {
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc83bcf75..b9........eb")) {
            bDetected = true;
        }
    } else if (PE.compareOverlay("d0cf11e0a1b11ae1")) {
        if (PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7")) {
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
            bDetected = true;
        }
    } else if (PE.isSignaturePresent(PE.getSize() - 0x50, 0x50, "'ADVINSTSFX'")) {
        if (PE.compareEP("558bec837d....75..e8$$$$$$$$8b0d........5657bf........be........3bcf74")) {
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
            bDetected = true;
        } else if (PE.compareEP("558bec837d....75..e8........ff75..ff75..ff75..e8........83c4..5d")) {
            sVersion = "12.6.1";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.read_unicodeString(PE.getOverlayOffset() + 2, 16) == "[GeneralOptions]") {
            bDetected = true;
        }
    } else if (PE.compareOverlay("c885'CP'd8e3")) {
        if (PE.compareEP("558bec837d....75..e8........ff75..ff75..ff75..e8........83c4..5d")) {
            sVersion = "16.3.0.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Adveractive.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Adveractive");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15") && PE.compareOverlay("'10JP'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Aeco_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Aeco Systems installer");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d........83ec..8901") &&
        PE.compareOverlay("'EWETAR DATA FILE!! VER 1.00 <<<>>>'")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Alchemy_Mindworks_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Alchemy Mindworks installer");

function detect() {
    if (PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf") && PE.getNumberOfResources() > 0) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.compare("504b0304", PE.resource[i].Offset))
                bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Astrum.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Astrum");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.isOverlayPresent() != -1) {
            for (var i = 0; i < PE.getNumberOfResources(); i++) {
                if (PE.resource[i].Type == 77) {
                    if (PE.findSignature(PE.resource[i].Offset, 0x140, "'AstrumInstallWizard'") != -1) {
                        bDetected = true;
                        break;
                    }
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_AutoPlay_Media_Studio.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "AutoPlay Media Studio");

function detect() {
    if (PE.compareOverlay("0b0bafaf0b0ba4")) {
        if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb")) {
            sVersion = "8.X";
            bDetected = true;
        }
        if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc8")) {
            sVersion = "7.5.X";
            bDetected = true;
        }
    }

    if (bDetected) {
        var sRawVersion = PE.getFileVersion().replace(/\.0\.0$/, "");
        if (sRawVersion) {
            sVersion = sRawVersion;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Autodesk_Self-Extract.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Autodesk Self-Extract");

function detect() {
    if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7d0") &&
        PE.compareOverlay("'00000000000000BD00000000000000010000000000000001'", 0x19a0)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_AutorunProEnterprise.1.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("installer", "Autorun Pro Enterprise");

function detect() {
    var rsrcSection = PE.section[".rsrc"];

    if (rsrcSection && PE.isSectionNamePresent("CODE")) {
        if (PE.findString(rsrcSection.FileOffset, rsrcSection.FileSize, "9AutoRunObjects") !== -1 &&
            PE.findString(rsrcSection.FileOffset, rsrcSection.FileSize, "AutoRunObjects") !== -1) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_AutorunProEnterpriseII.1.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("installer", "Autorun Pro Enterprise II");

function detect() {
    var rsrcSection = PE.section[".rsrc"],
        codeSection = PE.section["CODE"];

    if (rsrcSection && codeSection) {
        bDetected =
            PE.findString(codeSection.FileOffset, codeSection.FileSize, "TAutoRunProjectX") !== -1 &&
            PE.findString(rsrcSection.FileOffset, rsrcSection.FileSize, "AutoRunObjects") !== -1;
    }

    return result();
}

================================================
FILE: db/PE/installer_BitRock_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "BitRock Installer");

function detect() {
    if (PE.compareOverlay("........'.eh_frame'00")) {
        if (PE.compareEP("60be........8dbe........c787................5789e58d9c24........31c05039dc75..46465368")) {
            bDetected = true;
        } else if (PE.compareEP("83ec..c70424........ff15........e8........8d7426..8dbc27........a1........ffe0")) {
            bDetected = true;
        }
    }

    if (!bDetected) {
        if (/BitRock/.test(PE.getManifest())) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Bytessence_Install_Maker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Bytessence Install Maker");

function detect() {
    if (PE.compareOverlay("'$_BIM_CONFIG_START_$'")) {
        if (PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68")) {
            sVersion = "5.40";
            bDetected = true;
        } else if (PE.compareEP("4883ec..49c7c0........4831d248b9................e8........4831c9e8........488905........4d31c048c7c2........4831c9e8........488905........48b8")) {
            sVersion = "5.40";
            sOptions = "x64";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_CNetX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "CNetX");

function detect() {
    if (PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..4684c074..3c..75")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.compare("784b0304", PE.resource[i].Offset)) {
                sOptions = "modified ZIP";
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_CSDD_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "CSDD's");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")) {
        if (PE.getNumberOfResources() > 0) {
            if (PE.resource[0].Name = "1") {
                if (PE.compare("ec7c7f7c", PE.getResourceOffsetByNumber(0))) {
                    sVersion = "1.1";
                    bDetected = true;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_CZ_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "CZ installer");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3") &&
        PE.getNumberOfResources() > 0 &&
        PE.getResourceNameOffset("CZ_STORAGE") != -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Calibre_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// sign by A.S.L  - asl@onet.eu 2022.11.05
// compiler : x64 MSC++ v.14.19
// "LZIP" unpacker : nongnu.org/lzip/lzip.html - Antonio Diaz Diaz

meta("installer", "Calibre Portable Installer");

function detect() {
    if (PE.resource["EXTRA"] && PE.section[".rsrc"].FileSize > 0x6000000 && // over 100 MB
        PE.getVersionStringInfo("ProductName") == "calibre") {

        sVersion = PE.getVersionStringInfo("FileVersion");
        sOptions = ".LZ Archive";
        bDetected = true;

    }

    return result();
}


================================================
FILE: db/PE/installer_Chaos_Software_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Chaos Software installer");

function detect() {
    if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b..........48836424....48bf................483bc774") && PE.compareOverlay("276327631226097513180178")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_ClickTeam.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://www.clickteam.com/download-centre/install-creator
meta("installer", "ClickTeam");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'wwgT)'")) {
            bDetected = true;
        } else if (PE.compareOverlay("..120100....0000")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Codegear_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Codegear Installer");

function detect() {
    if (PE.compareEP("60be........8dbe........5783cd..eb$$8b1e83ee..11db72..b8........01db75..8b1e") && PE.compareOverlay("........'GRCSETUPINFORMATION'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_CreateInstall.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "CreateInstall");

function detect() {
    if (PE.compareEP("558BEC81EC200200005356576A00FF15........68........894508FF15........85C074276A00A1........50FF15")) {
        bDetected = true;
    } else if (PE.compareEP("81EC0C0400005356575568605040006A016A00FF15........8BF0FF15........3DB7000000750F56FF15")) {
        if (PE.compareOverlay("02060a0405fd59")) {
            sVersion = "2003.3.5";
            bDetected = true;
        }
    } else if (PE.compareOverlay("'aWAW'")) {
        if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
            bDetected = true;
        } else if (PE.compareEP("68........ff15........0bc074..e8")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_CrypKey_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "CrypKey");

function detect() {
    if (PE.compareEP("e8$$$$$$$$5668........e8........8bf068........56e8........a3........68........56e8........a3........68........56e8........a3........68........56e8........a3........68........56e8")) {
        if (PE.compareOverlay("'CK16'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_DeployMaster.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "DeployMaster");

function detect() {
    if (PE.compareEP("558bec81c4........5333c08985........8985........b8........e8........33c05568........64ff30") && PE.compareOverlay("'BZh91'")) {
        sVersion = "2.8.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_DesktopX_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "DesktopX Installer");

function detect() {
    if (PE.compareEP("6a..68........6a..6a..ff15........50e8........50ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == 630 || PE.resource[i].Type == 726 || PE.resource[i].Type == 678 || PE.resource[i].Type == 774) {
                if (PE.compare("'PK'0304", PE.getResourceOffsetByNumber(i))) {
                    bDetected = true;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Eschalon_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Eschalon Installer");

function detect() {
    if (PE.compareEP("558bec81c4........53565733c08985........8985........e8$$$$$$$$e8$$$$$$$$31d28d")) {
        if (PE.compareOverlay("'EPSF'")) {
            sVersion = PE.getFileVersion().replace(/\.0\.0$/, String());
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Excelsior_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Excelsior Installer");

function detect() {
    if (PE.compareEP("83ec..53555657e8........6a..5b391d........8bf37e..8b3d........a1........8b....8a08")) {
        if (PE.compareOverlay("'ExcelsiorII1'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_FDM_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L <asl@onet.eu>

meta("installer", "FDM Installer");

function detect() {
    if (PE.compareOverlay("'###FDMDATA###'")) {
        bDetected = true;

        if (PE.compareEP("558BEC6AFF6820714000682C364000")) {
            sVersion = "1.0";
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_GPInstall.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "GPInstall");

function detect() {
    if (PE.compareOverlay("........'SPIS'1a'LH5'")) {
        sOptions = "SPIS LH5";
        if (PE.compareEP("558bec83c4..5333c08945..b8........e8........33c05568........64ff30648920ba........33c0e8")) {
            bDetected = true;
        } else if (PE.compareEP("558bec83c4..53565733c08945..b8........e8........33c05568........64ff30648920ba........33c0e8")) {
            bDetected = true;
        } else if (PE.compareEP("558bec33c951515151515151535657b8........e8........33c05568........64ff30648920ba........33c0")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Gentee_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Gentee Installer");

function detect() {
    if (PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x80, "'GEA'") != -1) {
            bDetected = true;
        } else if (PE.getNumberOfResources() > 0 && PE.compare("'GEA'", PE.getResourceNameOffset("SETUP_TEMP"))) {
            bDetected = true;
        }

    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x80, "'GEA'") != -1 ||
            PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".data")), 0x80, "'gentee'") != -1) {
            bDetected = true;
        }
    } else if (PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56") && PE.compareOverlay("'OWS9G1'", 0xb) != -1) {
        bDetected = true;
    } else if (PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Ghost_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Ghost Installer");

function detect() {
    if (PE.compareEP("60be........8dbe........c787................5783cd..eb") && PE.compareOverlay("c0dececb8d8d8d8d")) {
        sOptions = "xored MSCF, mask: 8D";
        sVersion = "1.0.0.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Gremlin_Patcher.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Gremlin Software Patcher/Updater");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == 9942) { // FILES_MAIN (Name: IDR_FILES_MAIN)
                if (PE.findSignature(PE.resource[i].Offset, 256, "'SZDD'")) {
                    sOptions = "SZDD";
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_I-D_Media_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "I-D Media installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")) {
        if (PE.compareOverlay("'XXataDfOnigeB'")) {
            sVersion = "1.0.0.13";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_IDM_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Internet Download Manager Installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")) {
        if (PE.compareOverlay("2a330000da050000fec1cd666ebccf01fec1cd666ebccf0100..............78da")) {
            sOptions = "zlib";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_INTENIUM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("installer", "INTENIUM");

function detect() {
    if (PE.compareOverlay("'stgc_hdr'")) {
        sVersion = PE.getFileVersion();
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Inno_Setup_Module.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "Inno Setup Module");

function getVersionAndOptions(nOffset) {
    var sRawVersion = PE.getString(nOffset);
    sVersion = sRawVersion.substring(0, sRawVersion.indexOf(')'));
    if (/\(u\)/.test(sRawVersion)) {
        sOptions = sOptions.append("unicode");
    } else if (/\(a\)/.test(sRawVersion)) {
        sOptions = sOptions.append("ANSI");
    }
}

function getVersion(sSection) {
    if (PE.section[sSection]) {
        var nOffset = PE.section[sSection].FileOffset,
            nSize = PE.section[sSection].FileSize;

        if (nSize < 0x4000) {  // There are files with "data" section's size more as 0x2000
            var nInno = PE.findString(nOffset, nSize, "Inno Setup Setup Data");
            if (nInno != -1) {
                getVersionAndOptions(nInno + 23);
                return true;
            } else {
                nInno = PE.findSignature(nOffset, nSize, "'i1.'............'32'1A");
                if (nInno != -1) {
                    sVersion = PE.getString(nInno + 1).replace(/-.*/, "");
                    return true;
                }
            }
        }
    }

    return false;
}

function detect() {
    if (PE.compareOverlay("'zlb'1A") || PE.compareOverlay("'idska32'1A")) {
        if (!getVersion("DATA")) {
            getVersion(".data");
        }

        bDetected = true;
    } else {
        if (PE.getString(0x30, 4) == "InUn") {
            sOptions = "uninstall";
            var nOffset = PE.findString(PE.getOverlayOffset(), Math.min(0x100, PE.getOverlaySize()), "Inno Setup Messages");

            if (nOffset != -1) {
                getVersionAndOptions(nOffset + 21);
                bDetected = true;
            }

            if (!bDetected) {
                nOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "Inno Setup version");
                if (nOffset != -1) {
                    getVersionAndOptions(nOffset + 19);
                    bDetected = true;
                }
            }

            if (!bDetected) {
                if (getVersion("DATA") || getVersion(".data")) {
                    bDetected = true;
                }
            }
        }
    }

    if (!bDetected) {
        if (PE.compareOverlay("'Inno Setup Messages'")) {
            sOptions = "uninstall";
            getVersionAndOptions(PE.getOverlayOffset() + 21);
            bDetected = true;
        } else if (PE.compareOverlay("'Inno Setup Setup Data'")) {
            getVersionAndOptions(PE.getOverlayOffset() + 23);
            bDetected = true;
        }
    }

    if (PE.compareOverlay("78da")) {
        sOptions = "zlib";
        if (PE.compareEP("558bec83c4..53565733c08945..8945")) {
            bDetected = true;
        } else if (PE.compareEP("558bec83c4..e8........e8........e8")) {
            bDetected = true;
        }
    } else if (PE.compareOverlay("'Inno'", 0x34)) {
        sOptions = "with stub";
        bDetected = true;
    }
    if (!bDetected) {
        if (PE.isNet()) {
            if (PE.getVersionStringInfo("Comments") == "This installation was built with Inno Setup.") {
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_Instalit.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Instalit");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.resource[i].Type == 854 || PE.resource[i].Type == 808 || PE.resource[i].Type == 884) { // DLLFILE or EXEFILE or CFGFILE
                sVersion = "7.10.11, x32";
                bDetected = true;
            } else if (PE.resource[i].Type == 686 || PE.resource[i].Type == 640) { // CFGFILE or EXEFILE
                sVersion = "6.59.09, x32";
                bDetected = true;
            }

        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Install4j_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Install4j Installer");

function detect() {
    if (PE.compareOverlay("d513e4e801000000")) {
        if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774")) {
            bDetected = true;
        } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_InstallAnywhere.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "InstallAnywhere");

function detect() {
    if (PE.compareEP("60BE........8DBE0070FDFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB7507")) {
        sVersion = "6.1";
        bDetected = true;
    } else if (PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15........8b4e..890d")) {
        if (PE.compareOverlay("5b3e")) {
            var ArcOffset = PE.findSignature(PE.getOverlayOffset(), 0x500, "'PK'0304");
            if (ArcOffset != -1) {
                sOptions = "zip";
                bDetected = true;
            }
        }
    } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b..........488365....48bb................483bc375")) {
        if (PE.compareOverlay("5b3e")) {
            var ArcOffset = PE.findSignature(PE.getOverlayOffset(), 0x500, "'PK'0304");
            if (ArcOffset != -1) {
                sOptions = "zip";
                bDetected = true;
            }
        }
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")) {
        if (PE.compareOverlay("5b3e")) {
            var ArcOffset = PE.findSignature(PE.getOverlayOffset(), 0x500, "'PK'0304");
            if (ArcOffset != -1) {
                sOptions = "zip";
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_InstallShield.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "InstallShield");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.isOverlayPresent()) {
            nOffset = PE.readByte(PE.getOverlayOffset()) + PE.getOverlayOffset() + 12;
            if (PE.compare("135d658c", nOffset)) {
                sVersion = "3.X";
                bDetected = true;
            } else if (PE.compare("'PK'0304", nOffset)) {
                sVersion = "3.X";
                sOptions = "zip";
                bDetected = true;
            }
        } else {
            for (var i = 0; i < PE.resource.length; i++) {
                if (PE.resource[i].Type == 3000) //IS2
                {
                    if (PE.compare("'SZDD'", PE.resource[i].Offset)) {
                        sVersion = "2.X"
                        bDetected = true;
                        break;
                    }
                }
            }
        }

        if (PE.isSectionNamePresent("_cabinet")) {
            bDetected = true;
        }

    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x100, "'InstallShield Native Installer'") !== -1) {
            sName += " Java Edition";
            bDetected = true;
        } else if (PE.findSignature(PE.getOverlayOffset(), 0x100, "'setup.class'") !== -1) {
            sName += " Java Edition";
            sVersion = "3.X";
            bDetected = true;
        }
    } else if (PE.compareEP("558BEC83EC4456FF15........8BF085F675086AFFFF15........8A06578B3D")) {
        bDetected = true;
    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d2")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x2000, PE.getOverlaySize()), "'ISc('") !== -1) {
            sVersion = "19.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x2000, PE.getOverlaySize()), "'ISSetupStream'") !== -1) {
            sVersion = "18.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc7")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x10000, PE.getOverlaySize()), "'ISc('") !== -1) {
            sVersion = "25.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.compareOverlay("'ISSetupStream'")) {
            sVersion = "29.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")) {
        if (PE.compareOverlay("'ISSetupStream'")) {
            sVersion = "19.X";
            bDetected = true;
        }
    }

    if (PE.getVersionStringInfo("ProductName").substr(0, 13) == "InstallShield" || PE.getVersionStringInfo("CompanyName") == "InstallShield Software Corporation") {
        sVersion = PE.getVersionStringInfo("FileVersion").replace(/, /g, ".").trim();
        bDetected = true;
    }

    if (!bDetected) {
        if (/InstallShield/.test(PE.getManifest())) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_InstallUs.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "InstallUs");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8........a1........8b00ba........e8........8b0d........a1........8b008b15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "'SPIS'1a'LZH'") !== -1) {
            sOptions = "SPIS LZH";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Install_Factory.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Install Factory");

function detect() {
    if (PE.compareOverlay("a7870800")) {
        if (PE.compareEP("5589e55383ec..55b8........505068........64ff35........648925........83ec..83e4..68")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_LucasArts_Update_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "LucasArts Update Installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15") && PE.compareOverlay("'1CNT'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Miktex_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "MiKTeX Installer");

function detect() {
    if (PE.compareEP("e9$$$$$$$$4883ec..e8$$$$$$$$e9$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..488365")) {
        if (PE.compareOverlay("'TARTARTARTARTART'")) {
            sOptions = "tar";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Mioplanet_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Mioplanet installer");

function detect() {
    if (PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8")) {
        if (PE.compareOverlay("'[(*|*)]MZ'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Morton_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Morton Software Installer");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == 856) { // RT_RCDATA
                if (PE.compare("'SZDD'", PE.resource[i].Offset)) {
                    sOptions = "SZDD";
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Multimedia_Fusion_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Multimedia Fusion Installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965")) {
        if (PE.compareOverlay("'wwwwI'874712")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Myriad_Install.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Myriad Install");

function detect() {
    if (PE.compareEP("5589e5535683ec..55b8........505068........64ff35........648925........68........e8")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x100, "01006215") != -1) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_NOS_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "NOS Installer");

function detect() {
    if (PE.compareEP("50e8000000005b81eb........b9........2bd98bf381eb........8bfb81eb........575156e8........83c4..8bab........8d2c2b4d8a4d..80f9..74..83ed..8bd32b53")) {
        if (PE.compareOverlay("'PK??NOS_PO'") || PE.compareOverlay("'NOS_PO'")) {
            bDetected = true;
        }
    }

    if (PE.compareEP("e8$$$$$$$$58bb........8bb3........8d0433488a0880f9..74..83e8..8b108bb3........03f38dbb........578bca2bce5156")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Nullsoft_Scriptable_Install_System.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "Nullsoft Scriptable Install System");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    var nOffset = PE.getOverlayOffset();
    if (!PE.compareOverlay("EFBEADDE'Null'..'oftInst'", 4) && !PE.compareOverlay("EFBEADDE'nsisinstall'")) {
        if (PE.isOverlayPresent()) {
            nOffset += PE.readDword(nOffset);
            if (nOffset + 4 >= PE.getSize() || !PE.compare("EFBEADDE'Null' %% 'oftInst'", nOffset + 4)) {
                nOffset = 0;
            }
        }
    }
    if (nOffset && PE.isOverlayPresent()) {
        // Method detection adapted from 7-Zip.
        nOffset += 0x1C;
        if (PE.compare("5D0000..00", nOffset)) {
            sOptions = sOptions.append("lzma", "solid");
        } else if (PE.compare("5D0000....00", nOffset + 4)) {
            sOptions = sOptions.append("lzma");
        } else {
            function BorZ(nOffset) {
                if (PE.readByte(nOffset) == 0x31 && PE.readByte(nOffset + 1) < 14) {
                    return "bzip2";
                } else {
                    return "zlib";
                }
            }

            if (PE.compare("8", nOffset + 3)) {
                sOptions = sOptions.append(BorZ(nOffset + 4));
            } else {
                sOptions = sOptions.append(BorZ(nOffset), "solid");
            }
        }
        bDetected = true;
    }

    var aVersion = PE.getManifest().match(/Null[sS]oft Install System v?(.*?)</);
    if (aVersion) {
        sVersion = aVersion[1];
        bDetected = true;
    } else if (PE.compareEP("558BEC83EC2C535633F657568975DC8975F4BBA49E4000FF1560704000BFC0B24000")) {
        sVersion = "1.XX";
        bDetected = true;
    } else if (PE.compareEP("558BEC81EC....000056576A..BE........598DBD")) {
        sVersion = "1.3X";
        bDetected = true;
    } else if (PE.compareEP("83EC5C53555657FF15")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (PE.compareEP("83EC0C535657FF15....40000")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 8)) {
            case 0x812C: sVersion = "1.98"; break;
            case 0x10B4: sVersion = "2.0a0"; break;
            default: sVersion = "1.XX";
        }
        bDetected = true;
    } else if (PE.compareEP("83EC0C53555657FF15..7040008B35..92400005E803000089442414B320FF152C704000")) {
        sVersion = "2.0b2/2.0b3";
        bDetected = true;
    } else if (PE.compareEP("83EC14836424040053555657C644241320FF1530704000BE00207A00")) {
        sVersion = "2.0b4";
        bDetected = true;
    } else if (PE.compareEP("83EC1053555657C7442414....400033EDC644241320FF152C704000")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 11)) {
            case 0x91F0: sVersion = "2.0b4"; break;
            case 0x9270: sVersion = "2.0 RC2"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("83EC0C53555657C7442410........33DBC644241420FF15........53FF15")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("83EC2053555633DB57895C2418C7442410........C644241420FF15")) {
        sVersion = "2.06";
        bDetected = true;
    } else if (PE.compareEP("558bec83ec..535633f657568975..8975..bb........ff15........bf........68........5750a3........ff15")) {
        sVersion = "0.98";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/installer_O'Setup95.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "O'Setup95");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'FILE'")) {
            sOptions = "Celtech Software";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_PCInstall.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "PCInstall");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'[20/20]'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_PIMP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "PIMP Installer");

function detect() {
    if (PE.compareEP("558bec81ec........56576a..be........598dbd........f3a56a..33c0598dbd........f3ab8d85........68........33f65056ff") &&
        PE.compareOverlay("'PIMPFILE'00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_PackageForTheWeb.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "PackageForTheWeb");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")) {
        if (PE.compareOverlay("....0000dcedbd")) {
            sOptions = "InstallShield";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Pantaray_QSetup.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Pantaray QSetup");

function detect() {

    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3")) {
        if (PE.compareOverlay("970300000201")) {
            sVersion = "10.0.0.X";
            bDetected = true;
        } else if (PE.compareOverlay("370700000201")) {
            sVersion = "11.0.0.X";
            bDetected = true;
        }

        if (PE.findSignature(PE.getOverlayOffset(), 0x400, "'|http:'") !== -1) {
            sVersion = "6.0.0.0";
            bDetected = true;
        }

        if (PE.findSignature(PE.getOverlayOffset(), 0x400, "'|www.'") !== -1) {
            sVersion = "8.0.0.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Paquet_Builder.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Paquet Builder");

function detect() {
    if (PE.compareEP("5589e56a..68........68........64ff35........648925........83ec..83ec..5356578965..68")) {
        if (PE.compareOverlay("'PB'................................'7z'")) {
            sOptions = "7zip";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Quick_Install.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Quick Install");

function detect() {
    if (PE.compareEP("558bec68........64ff35........648925........83ec0457e8$$$$$$$$dbe3c3") &&
        PE.isSectionNamePresent("txt0")) {
            sOptions = "by Snow Storm Software";
            bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_RNsetup.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "RNsetup");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")) {
        if (PE.getNumberOfResources() > 0) {
            if (PE.resource[0].Name = "Archive") {
                if (PE.compare("'.rzt'", PE.getResourceOffsetByNumber(0))) {
                    sVersion = "6.0";
                    bDetected = true;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_SCE_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Silver Creek Entertainment");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.compare("789c", PE.resource[i].Offset)) {
                sOptions = "zlib";
                bDetected = true;
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_STATICSUP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "STATICSUP");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("67155234ff4d3642")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Setup-Specialist.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Setup-Specialist");

function detect() {
    if (PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15") && PE.compareOverlay("'TGCF'")) {
        sVersion = "4.0.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Setup_Factory.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "Setup Factory");

function detect() {
    if (PE.compareEP("558BEC6AFF68..61400068..43400064A1000000005064892500000000")) {
        if (PE.compareEP("90614000", 6)) {
            sVersion = "6.0.0.3";
        } else {
            sVersion = "6.X";
        }
        bDetected = true;
    } else if (PE.compareOverlay("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7")) {
        if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0a3........eb")) {
            sVersion = "8.0";
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb")) {
            sVersion = "9.0";
            bDetected = true;
        } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0488905........eb")) {
            sVersion = "9.5";
            bDetected = true;
        }
    } else if (PE.compareOverlay("e0e1e2e3e4e5e6")) {
        if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
            sVersion = "5.0";
            bDetected = true;
        } else if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
            sVersion = "4.02";
            bDetected = true;
        }
    }

    if (bDetected) {
        if (PE.getVersionStringInfo("Comments").indexOf("Trial") >= 0) {
            sOptions = "Trial";
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_SfxCA.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Sfx Custom Action");

function detect() {
    if (PE.compareOverlay("'MSCF'00000000")) {
        if (PE.compareEP("48895c24..48897424..574883ec..498bf88bda488bf183fa..75..e8........4c8bc7")) {
            sVersion = "3.8, by Outercurve Foundation";
            bDetected = true;
        } else if (PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
            sVersion = "3.10, by Outercurve Foundation";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Smart_Install_Maker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://smart-install-maker.software.informer.com/
meta("installer", "Smart Install Maker");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3")) {
        if (PE.compareOverlay("'Smart Install Maker v'")) {
            sVersion = PE.getString(PE.getOverlayOffset() + 0x17);
            bDetected = true;
        } else if (PE.compareOverlay("..........87000001........5d0000800000")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Sony_Windows_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Sony Windows Installer");

function detect() {
    if (PE.compareOverlay("'UM'030a00")) {
        if (PE.compareEP("4883ec..e8$$$$$$$$48895c....574883ec..488b..........48836424....48bf................483bc774")) {
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Spoon_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// updated A.S.L <asl@onet.eu>  2022.08.06

meta("installer", "Spoon Installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'BZh91AY&SY'")) {
            sOptions = "BZIP2";
            bDetected = true;
        } else if (PE.compareOverlay("']'00008000")) {
            sOptions = "Lzma";
            bDetected = true;
        }

        if (PE.getAddressOfEntryPoint() == 0x0040C36E) {
            sVersion = "11 2005";
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Squirrel.1.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/Squirrel/Squirrel.Windows
meta("installer", "Squirrel");

function detect() {
    var versionString = PE.getVersionStringInfo("SquirrelAwareVersion");

    if (versionString) {
        sVersion = versionString;
        if (sVersion == "1") {
            sVersion = "1.0.0-1.9.1";
        }

        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_SwiftView_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "SwiftView Inc. installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965") && PE.compareOverlay("'This is the end of the executable'")) {
        sVersion = "6.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Synactis_In-The-Box_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L. <asl@onet.eu> 2019.07.25

meta("installer", "Synactis In-The-Box Installer");

function detect() {
    if (PE.getAddressOfEntryPoint() == 0x00A98B0) {
        if (PE.compareEP("558bEC83C4F0B8") && PE.compareOverlay("'['")) {
            sVersion = "4.0";
            sOptions = "zip sfx";
            bDetected = true;
        }
    } else if (PE.compareEP("'All In-The-Box Installer'", 0x60)) {
        sOptions = "zip sfx";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Tarma_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Tarma Installer");

function detect() {
    if (PE.compareOverlay("'tiz1'........78da")) {
        sOptions = "zlib";
        if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..e8")) {
            bDetected = true;
        } else if (PE.compareEP("60be........8dbe........5783cd..eb")) {
            bDetected = true;
        }
    }
    if (PE.isSectionNamePresent(".tsustub") && PE.isSectionNamePresent(".tsuarch")) {
        if (PE.compareEP("558bec81ec........535633db5766899d........895d..895d..ff15")) {
            sName = "Tarma InstallMate";
            sVersion = "9.0";
            bDetected = true;
        } else if (PE.compareEP("48895c24..48896c24..48897424..574881ec........66836424....33f633ffff15........488d8c24........8bd8ff15")) {
            sName = "Tarma InstallMate";
            sVersion = "9.0";
            sOptions = "x64";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Themepak.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "THEMEPAK");

function detect() {
    if (PE.compareEP("558bec81ec........535657c745..........ff75..64ff35........648925........8d45")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_UFI_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L. <asl@onet.eu> 2020.09.30

meta("installer", "UFI installer");

function detect() {
    if (PE.compareEP("558BEC") && PE.resource["BINFILE"] && PE.resource["BINFILE_2"]) {
        sVersion = "1.X, Flash";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_VMWare.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "VMWare");

function detect() {
    if (PE.compareOverlay("'RWMV'")) {
        if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
            sName += " Installation Launcher";
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
            sName += " Installation Launcher";
            bDetected = true;
        } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0")) {
            sName += " Installation Launcher";
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
            sName += " Installation Launcher";
            bDetected = true;
        }
    }

    if (PE.isOverlayPresent() && PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
        var nSize = Math.min(PE.getOverlaySize(), 0x100);
        if (PE.findString(PE.getOverlayOffset(), nSize, "BZh91AY&") != -1) {
            sName += " Software Installer";
            sOptions = "bzip2";
            bDetected = true;
        } else if (PE.findSignature(PE.getOverlayOffset(), nSize, "d0cf11e0a1b11ae1") != -1) {
            sName += " Software Installer";
            sOptions = "MS Compound";
            bDetected = true;
        }
    }

    if (bDetected) {
        sVersion = PE.getFileVersion();
    }

    return result();
}

================================================
FILE: db/PE/installer_Vise.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Vise");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'ESIV'")) {
            bDetected = true;
        } else if (PE.compare("'SIVM'", 0xf000)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_WiX_Toolset_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "WiX Toolset Installer");

function detect() {
    if (PE.compareOverlay("'MSCF'00000000")) {
        if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")) {
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc774..85c674..f7")) {
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7")) {
            bDetected = true;
        } else if (PE.isSectionNamePresent(".wixburn")) {
            sVersion = "1.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_WinRAR_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "WinRAR Installer");

function detect() {
    if (PE.compareEP("e8$$$$$$$$558bec83c4..b8........53")) {
        if (PE.compareOverlay("'***messages***'")) {
            bDetected = true;
        }
    } else if (PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f")) {
        if (PE.compareOverlay("'Rar!'1a")) {
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..68........68........e8........59598945..837d")) {
        if (PE.compareOverlay("'PK'0304")) {
            bDetected = true;
        }
    }
    if (PE.compareOverlay("fffe2a002a002a006d0065007300730061006700650073002a002a002a00")) {
        sOptions = "Unicode";
        if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488365....48bb................488b05........483bc375")) {
            sVersion = "5.X";
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
            sVersion = "5.X";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Winamp_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Winamp Installer");

function detect() {
    if (PE.compareEP("81ec........a1........8b0d........8b15........53894424..a1........894c24..8a0d........555657894424..884c24..b9")) {
        sVersion = "1.0";
        sOptions = "1997-98 by Nullsoft, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/installer_Windows_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("installer", "Windows Installer");

function detect() {
    for (var i = 0; i < PE.resource.length; i++) {
        if (PE.compare("D0CF11E0A1B11AE1", PE.resource[i].Offset)) {
            var nOffset = PE.findString(PE.resource[i].Offset, PE.resource[i].Size, "Windows Installer");
            if (nOffset != -1) {
                var aVersion = PE.getString(nOffset).match(/ XML \((.*?)\)/);
                if (aVersion) {
                    sOptions = "XML";
                    sVersion = aVersion[1];
                }

                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_Wise_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "Wise Installer");

function detect() {
    if (PE.getOverlaySize() > 80) {
        var nOffset = PE.getOverlayOffset() + 77;
        if (PE.readDword(nOffset) == PE.getSize()) {
            bDetected = true;
        } else if (PE.isSectionNamePresent(".WISE")) {
            bDetected = true;
        } else if (PE.compareEP("558bec81ec........5356576a..ff15........ff15........8bf08975..8a063c..0f85........8a46..46")) {
            bDetected = true;
        } else if (PE.compareEP("558bec81ec........5356576a..5e6a..8975..ff15........ff15........8bf8897d..8a073c..0f85........8a47..47")) {
            bDetected = true;
        }
    } else if (PE.compareEP("81ec........535556576a..ff15........33db895c24..895c24..895c24..895c24..895c24..ff15........8a08894424")) {
        if (PE.isSectionNamePresent(".WISE")) {
            sOptions = "CAB";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec81ec........53565733f6466a..8975..ff15........ff15........8bf88a07")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "'Wise Installation Wizard...'") != -1) {
            bDetected = true;
        }
    }
    if (PE.isSectionNamePresent(".WISE")) {
        if (PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".WISE")), 0x1000, "'Wise Installation Wizard...'") != -1) {
            bDetected = true;
        }
    }
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "504b0304") != -1) {
            sOptions = "ZIP";
            bDetected = true;
        } else if (PE.compareOverlay("'MSCF'0000")) {
            sOptions = "CAB";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec81ec........538d85........5633db57be........565053ff15........568d85........5050ff15........538d8d........536a..536a..68........51ff15")) {
        bDetected = true;
    }
    if (PE.compareEP("558bec81ec........538d85........565733f6")) {
        bDetected = true;
    }
    if (PE.compareEP("558bec81ec........5356be........578d85........5633db5053")) {
        if (PE.compare("'GLB'00", PE.getSectionFileOffset(PE.getSectionNumber(".data")) + 0x10)) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/installer_Xoreax_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Xoreax Installer");

function detect() {
    if (PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c055")) {
        for (var i = 0; i < PE.getNumberOfResources(); i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                if (PE.compare("5d0000", PE.resource[i].Offset)) {
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_distutils.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "distutils");

function detect() {
    if (PE.compareOverlay("'[metadata]'")) {
        if (PE.compareEP("e8........e9$$$$$$$$6a5868........e8........33f68975..8d45..50ff15........6a..5f897d..b8........663905........75")) {
            sVersion = "2.6"
            bDetected = true;
        } else if (PE.compareEP("6a..68........e8........33db895d..538b3d........ffd766........75..8b48..03c88139........75..0fb7")) {
            sVersion = "2.5"
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/installer_sqx.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L <asl@onet.eu>
// SIGNATURE CREATED : 2023.10.02

meta("installer", "SQX Archive Installer 2002");

function detect() {
    var dataSection = PE.section[".data"];

    if (PE.compareEP("558bec83ec44") && dataSection && PE.findString(dataSection.FileOffset, dataSection.FileSize, "SFX kann nicht gestartet werden") != 1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/joiner_Celesty_File_Binder.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Eliseu Filipi

meta("joiner", "Celesty File Binder");

function detect() {
    if (PE.compareEP("E8261F0000E989FEFFFF8BFF558BEC83EC208B450856576A0859BE0C9240008D7DE0F3A58945F88B450C5F8945FC5E85C074")) {
        sVersion = "1.0";
        sOptions = "static";
        bDetected = true;
    } else if (PE.compareEP("E896040000E963FDFFFF8BFF558BEC81EC28030000A3E8514000890DE45140008915E0514000891DDC5140008935D8514000893DD4514000668C1500")) {
        sVersion = "1.0";
        sOptions = "dynamic"; // AnyCPU
        bDetected = true;
    }

    sLang = "C++";

    return result();
}

================================================
FILE: db/PE/joiner_ExeSplitter.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("joiner", "ExeSplitter");

function detect() {
    if (PE.compareEP("E99502000064A1000000008338FF74048B00EBF78B4004C3558BECB8000000008B750881E60000FFFF")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("E8000000005D81ED........E866FEFFFF55508D9D........538D9D")) {
        sVersion = "1.3";
        sOptions = "Split Method";
        bDetected = true;
    } else if (PE.compareEP("E9FE010000..............000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073766345723031312E746D7000")) { // s v c E r 0 1 1 . t m p
        sVersion = "1.3";
        sOptions = "Split Method";
        bDetected = true;
    } else if (PE.compareEP("E8000000005D81ED........B9........8D85........80306640E2FA8F98676666")) {
        sVersion = "1.3";
        sOptions = "Split+Crypt Method";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/joiner_FreeJoiner.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("joiner", "FreeJoiner");

function detect() {
    if (PE.compareEP("9087FF9090B92B000000BA........83C2039087FF9090B9040000009087FF9033C9C705")) {
        sVersion = "1.5.1";
        bDetected = true;
    } else if (PE.compareEP("E846FDFFFF50E80C000000FF25........FF25........FF25........FF25........FF25")) {
        sVersion = "1.5.2 Stub engine 1.6";
        bDetected = true;
    } else if (PE.compareEP("E833FDFFFF50E80D000000CCFF25........FF25........FF25........FF25........FF25")) {
        sVersion = "1.5.3 Stub engine 1.7";
        bDetected = true;
    } else if (PE.compareEP("86D69086F2B9936008FE9086D69086F2B99D13450186D69086F281C2936008FE33C9B930744D")) {
        sVersion = "1.5.3 Stub engine 1.7.1";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4F086FF680001000068........6A00E8F30100008AC06A0068800000006A036A00")) {
        sVersion = "Small build 014/015";
        bDetected = true;
    } else if (PE.compareEP("E8....FFFF6A00E80D000000CCFF25........FF25........FF25........FF25........FF25")) {
        sVersion = "Small build 014-020";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4F086FF86DB86FF680001000068........6A00E8FF0100008AE46A0068800000006A03")) {
        sVersion = "Small build 017";
        bDetected = true;
    } else if (PE.compareEP("E8E1FDFFFF6A00E80C000000FF25........FF25........FF25........FF25........FF25")) {
        sVersion = "Small build 023";
        bDetected = true;
    } else if (PE.compareEP("5032C48AC358E8DEFDFFFF6A00E80D000000CCFF25........FF25........FF25........FF25")) {
        sVersion = "Small build 029";
        bDetected = true;
    } else if (PE.compareEP("5032..668BC358E8..FDFFFF6A00E80D000000CCFF25........FF25........FF25........FF25")) {
        sVersion = "Small build 031/032";
        bDetected = true;
    } else if (PE.compareEP("506633C3668BC158E8ACFDFFFF6A00E80D000000CCFF25........FF25........FF25........FF25")) {
        sVersion = "Small build 033";
        bDetected = true;
    } else if (PE.compareEP("5133CB86C959E89EFDFFFF6687DB6A00E80C000000FF25........FF25........FF25........FF25")) {
        sVersion = "Small build 035";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/joiner_MicroJoiner.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("joiner", "MicroJoiner");

function detect() {
    if (PE.compareEP("BE........BB........33ED83EE04392E7411")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("BF........83EC308BECE8C8FFFFFFE8C3FFFFFF")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (PE.compareEP("33C0648B38488BC8F2AFAF8B1F6633DB66813B")) {
        sVersion = "1.6";
        bDetected = true;
    } else if (PE.compareEP("BF........8D5F216A0A586A04596057E88E000000")) {
        sVersion = "1.7";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/joiner_N-Joiner.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("joiner", "N-Joiner");

function detect() {
    if (PE.compareEP("6A0068........68........6A00E8140000006A00E813000000CCFF25........FF25........FF25........FF25")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/joiner_OxiJoiner.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

// https://happy-hack.net/pentest/10639-oxi-joiner-by-vazonez.html
meta("joiner", "OxiJoiner");

function detect() {
    var rsrcSection = PE.section[".rsrc"];

    if (PE.compareEP("e85c000000a30b3040006a00e868000000a313304000e86a000000a3703c40006a0aff350b3040006a00ff3513304000e8eaf4ffff6a00e813000000ccff257c204000ff2508204000ff250c204000ff") &&
        rsrcSection && PE.findString(rsrcSection.FileOffset, rsrcSection.FileSize, "PAPADDING") !== -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/joiner_RJoiner.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("joiner", "RJoiner");

function detect() {
    if (PE.compareEP("558BEC81EC0C0200008D85F4FDFFFF56506804010000FF15")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("558BEC81EC0C0100008D85F4FEFFFF56506804010000FF15")) {
        sVersion = "1.2a";
        bDetected = true;
    } else if (PE.compareEP("E803FDFFFF6A00E80C000000FF25........FF25........FF25")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/joiner_SFXRun.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("joiner", "SFXRun");

function detect() {
    if (PE.compareEP("ff15........8038..75..8a48..4080f9..74..84c975..eb..408a0880f9..74..80f9..74")) {
        sVersion = "1.1";
        sOptions = "1999 by Sergey Sorokin";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/joiner_inPEct.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("joiner", "inPEct");

function detect() {
    if (PE.compareEP("E8000000005D5583C5208BF58BFEB9......00BA........AD8BD833C2C1C20703D3ABE2F3")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/library_16Edit.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// http://old-dos.ru/index.php?page=files&mode=files&do=list&cat=231
meta("library", "16Edit");

function detect() {
    if (PE.isLibraryPresent("16Edit.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_7z.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "7-Zip");

function detect() {
    if (PE.isLibraryPresentExp(/^7z/) || PE.isLibraryPresentExp(/lib7z/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_AMD_FSR.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.amd.com/en/products/graphics/technologies/fidelityfx/super-resolution.html
meta("library", "AMD FSR");

function detect() {
    if (PE.is64()) {
        if (PE.isLibraryPresentExp(/^ffx_fsr2/i)) {
            sVersion = "2.X";
        } else if (PE.isExportFunctionPresent("ffxFsr2ContextCreate")) {
            sOptions = "static"; // EAT
            sVersion = "2.X";
        } else if (PE.isLibraryPresentExp(/^ffx_fsr3/i)) {
            sVersion = "3.X";
        } else if (PE.isExportFunctionPresent("ffxFsr3UpscalerContextCreate")) {
            sOptions = "static"; // EAT
            sVersion = "3.X";
        } else if (PE.isLibraryPresentExp(/^ffx_fsr/i) || PE.isLibraryPresentExp(/fidelityfx/i)) { // unknown version
            bDetected = true;
        } else if (PE.isExportFunctionPresentExp(/^ffxFsr/)) {
            sOptions = "static"; // EAT
        }
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}

================================================
FILE: db/PE/library_AMD_GraphicalServices.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://gpuopen.com/amd-gpu-services-ags-library/
meta("library", "AMD Graphical Services");

function detect() {
    if (PE.isLibraryPresentExp(/^amd_ags_x(86|64)/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ASIPort.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Copyright (c) 1991 Altura Software, Inc.

// https://wiki.scummvm.org/index.php?title=Director
meta("library", "ASIPort");

function detect() {
    if (PE.compareOverlay("35394a50")) {
        sVersion = "1.0";
        sOptions = "Director Engine";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_AjaxMin.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// http://ajaxmin.codeplex.com/
meta("library", "AjaxMin");

function detect() {
    if (PE.isNetObjectPresent("AjaxMin")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Alibaba_CloudSDK.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/aliyun/aliyun-openapi-net-sdk
meta("library", "Alibaba Cloud SDK");

function detect() {
    if (PE.isNetObjectPresent("aliyun-net-sdk-ram")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_CloudWatch.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.CloudWatch
meta("library", "Amazon CloudWatch");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.CloudWatch")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_CloudWatchLogs.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.CloudWatchLogs
meta("library", "Amazon CloudWatchLogs");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.CloudWatchLogs")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_DynamoDB.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.DynamoDBv2
meta("library", "Amazon DynamoDB");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.DynamoDBv2")) {
        sVersion = "2, 3.X-4.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_ElasticComputeCloudService.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.EC2
meta("library", "Amazon Elastic Compute Cloud Service");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.EC2")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_Glue.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.Glue
meta("library", "Amazon Glue");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.Glue")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_Kinesis.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.Kinesis
meta("library", "Amazon Kinesis");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.Kinesis")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_Lambda.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.Lambda
meta("library", "Amazon Lambda");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.Lambda")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_RelationalDatabaseService.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.RDS
meta("library", "Amazon Relational Database Service");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.RDS")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_SecretsManager.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.SecretsManager
meta("library", "Amazon SecretsManager");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.SecretsManager")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_SecurityToken.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.SecurityToken
meta("library", "Amazon Security Token Service");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.SecurityToken")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_ServicesSDK.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/aws/aws-sdk-net
meta("library", "Amazon Services SDK");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_SimpleEmail.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.SimpleEmail
meta("library", "Amazon SimpleEmail");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.SimpleEmail")) {
        sVersion = "2, 3.X-4.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_SimpleQueueService.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.S3
meta("library", "Amazon Simple Queue Service");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.SQS")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_SimpleStorageService.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.S3
meta("library", "Amazon Simple Storage Service");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.S3")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_SingleSignOn.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.SSO
meta("library", "Amazon Single Sign-On");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.SSO")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Amazon_X-Ray.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/AWSSDK.Glue
meta("library", "Amazon X-Ray");

function detect() {
    if (PE.isNetObjectPresent("AWSSDK.XRay")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_AngleSharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/AngleSharp/AngleSharp
meta("library", "AngleSharp");

function detect() {
    if (PE.isNetObjectPresent("AngleSharp")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Antlr.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/Antlr
meta("library", "Antlr");

function detect() {
    if (PE.isNetObjectPresent("Antlr3.Runtime")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (PE.isNetObjectPresent("Antlr4.Runtime")) {
        sVersion = "4.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_AppleSoftwareUpdate.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.dllme.com/dll/files/softwareupdatefiles
meta("library", "Apple Software Update");

function detect() {
    if (PE.isLibraryPresent("SoftwareUpdateFiles.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Argon2.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/P-H-C/phc-winner-argon2
meta("library", "Argon2");

function detect() {
    if (PE.isFunctionPresent("argon2_hash")) {
        bDetected = true;
    } else if (PE.isExportFunctionPresent("argon2_hash")) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_AtMsg32.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/Engines/Atlas#AtMsg32.dll
meta("library", "AtMsg32");

function detect() {
    if (PE.isLibraryPresent("AtMsg32.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Atlantic.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.magix.com/
meta("library", "VEGAS Atlantic Component");

function detect() {
    if (PE.isLibraryPresent("Atlantic.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Authorwave.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Adobe_Authorware
meta("library", "Adobe Authorware");

function detect() {
    if (PE.compareOverlay("'PCRS'afbcadac16000000f8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Autofac.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/autofac/Autofac
meta("library", "Autofac IoC Container");

function detect() {
    if (PE.isNetObjectPresent("Autofac")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_BenchmarkDotNet.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/dotnet/BenchmarkDotNet
meta("library", "BenchmarkDotNet");

function detect() {
    if (PE.isNetObjectPresent("BenchmarkDotNet")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Boost.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.boost.org/
meta("library", "Boost");

function detect() {
    if (PE.isLibraryPresentExp(/libboost/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_BrotliSharpLib.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/master131/BrotliSharpLib
meta("library", "BrotliSharpLib");

function detect() {
    if (PE.isNetObjectPresent("BrotliSharpLib")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_CUDA-Driver.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "CUDA Driver");

function detect() {
    if (PE.isLibraryPresentExp(/^nvcuda/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Castle.Net.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/castleproject/Core
meta("library", "Castle");

function detect() {
    if (PE.isNetObjectPresent("Castle.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ChilkatNativeLib.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.chilkatsoft.com/
meta("library", "ChilkatNativeLib");

function detect() {
    if (PE.isNetObjectPresent("ChilkatNativeLib")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Chromium_Embedded_Framework.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Chromium Framework");

function detect() {
    if (PE.isLibraryPresent("libcef.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Chromium_WebView.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Chromium WebView");

function detect() {
    if (PE.isLibraryPresent("chrome_elf.dll") || PE.isSectionNamePresent("CPADinfo")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_CliWrap.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Tyrrrz/CliWrap
meta("library", "CliWrap");

function detect() {
    if (PE.isNetObjectPresent("CliWrap")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ClosedXML.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ClosedXML/ClosedXML
meta("library", "ClosedXML");

function detect() {
    if (PE.isNetObjectPresent("ClosedXML")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_CodeBase.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/MPSystemsServices/CodeBase-for-DBF
meta("library", "CodeBase");

function detect() {
    if (PE.isExportFunctionPresent("??4l4linkSt@@QAEAAU0@ABU0@@Z")) {
        sVersion = "4.0";
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_CommandLineParser.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/commandlineparser/commandline
meta("library", "CommandLineParser");

function detect() {
    if (PE.isNetObjectPresent("CommandLine") && PE.isNetObjectPresent("ParseArguments")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Costura.Fody.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Costura.Fody");

function detect() {
    if (PE.isNetGlobalCctorPresent() && (PE.isNetObjectPresent("costura.costura.dll.compressed") || PE.isNetUStringPresent("costura.costura.dll.compressed"))) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/library_Crc32_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/force-net/Crc32.NET
meta("library", "Crc32.NET");

function detect() {
    if (PE.isNetObjectPresent("Crc32.NET")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Crc_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/GediminasMasaitis/crc-dot-net
meta("library", "Crc.NET");

function detect() {
    if (PE.isNetObjectPresent("Crc") && (PE.isNetObjectPresent("CrcBase") || PE.isNetObjectPresent("Crc32Base")) && PE.isNetObjectPresent("Crc32") && PE.isNetObjectPresent("ComputeHash")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_CsvHelper.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/JoshClose/CsvHelper
meta("library", "CsvHelper");

function detect() {
    if (PE.isNetObjectPresent("CsvHelper")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_D3DRM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/DirectSound
meta("library", "Direct3D Retained Mode");

function detect() {
    if (PE.isLibraryPresent("D3DRM.DLL")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_D3DXOF.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://learn.microsoft.com/en-us/windows/win32/direct3d9/directxfilecreate
meta("library", "D3DXOF");

function detect() {
    if (PE.isLibraryPresent("d3dxof.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Dapper.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DapperLib/Dapper
meta("library", "Dapper");

function detect() {
    if (PE.isNetObjectPresent("Dapper")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DeepCloner.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/force-net/DeepCloner
meta("library", "DeepCloner");

function detect() {
    if (PE.isNetObjectPresent("DeepCloner")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Direct2D.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Direct2D");

function detect() {
    if (PE.isLibraryPresentExp(/^d2d*/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Direct3D.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Direct3D");

function detect() {
    var maxVersion = 0,
        re = /d3dx?(\d+)/i;

    for (var n = 0; n < PE.getNumberOfImports(); n++) {
        var m = PE.getImportLibraryName(n).match(re);
        if (m && /^\d+$/.test(m[1]) && Number(m[1]) > maxVersion) {
            maxVersion = Number(m[1]);
        }
    }

    for (var n = 0; n < PE.getNumberOfExportFunctions(); n++) {
        var m = PE.getExportFunctionName(n).match(re);
        if (m && /^\d+$/.test(m[1]) && Number(m[1]) > maxVersion) {
            maxVersion = Number(m[1]);
        }
    }

    if (maxVersion > 0) {
        sVersion = String(maxVersion);
        bDetected = true;
    } else if (PE.isLibraryPresentExp(/^d3d/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DirectDraw.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/DirectDraw
meta("library", "DirectDraw");

function detect() {
    if (PE.isLibraryPresent("DDRAW.DLL")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DirectInput.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/DirectInput
meta("library", "DirectInput");

function detect() {
    if (PE.isLibraryPresent("DINPUT.DLL")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DirectSound.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/DirectSound
meta("library", "DirectSound");

function detect() {
    if (PE.isLibraryPresent("DSOUND.DLL")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DirectX.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "DirectX Graphics");

function detect() {
    if (PE.isLibraryPresentExp(/^dxgi/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DirectorAPI.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Director
meta("library", "Director API");

function detect() {
    if (PE.compareOverlay("..304a50")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Discord.Net.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/discord-net/Discord.Net
meta("library", "Discord.Net");

function detect() {
    if (PE.isNetObjectPresent("Discord.Net.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_DnsClient.NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MichaCo/DnsClient.NET
meta("library", "DnsClient.NET");

function detect() {
    if (PE.isNetObjectPresent("DnsClient")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Dryloc.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/dadhi/DryIoc
meta("library", "Dryloc IoC Container");

function detect() {
    if (PE.isNetObjectPresent("Dryloc")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_EAX_Unified.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://community.pcgamingwiki.com/files/file/367-eax-unified/
meta("library", "EAX Unified");

function detect() {
    if (PE.isLibraryPresent("EAX.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_EcmaScript_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/PureKrome/EcmaScript.NET
meta("library", "EcmaScript.NET");

function detect() {
    if (PE.isNetObjectPresent("EcmaScript.NET")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Edit_Dev.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV6_Information
meta("library", "Edit_Dev");

function detect() {
    if (PE.isLibraryPresent("edit_dev.dll")) {
        sOptions = "DEV6";
        sVersion = "ADI4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ElectronApp.4.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("library", "Electron package");

function detect() {
    var cpadInfoSection = PE.section["CPADinfo"];

    if (cpadInfoSection &&
        PE.isSectionNamePresent(".00cfg")) {

        bDetected = PE.findString(cpadInfoSection.FileOffset, cpadInfoSection.FileSize, "daPC");
    }

    return result();
}

================================================
FILE: db/PE/library_EpicGames.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://onlineservices.epicgames.com/en-US/sdk
meta("library", "Epic Games Services");

function detect() {
    if (PE.isLibraryPresentExp(/^EOSSDK/)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ExcelDataReader.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ExcelDataReader/ExcelDataReader
meta("library", "ExcelDataReader");

function detect() {
    if (PE.isNetObjectPresent("ExcelDataReader")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ExcelNumberFormat.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/andersnm/ExcelNumberFormat
meta("library", "ExcelNumberFormat");

function detect() {
    if (PE.isNetObjectPresent("ExcelNumberFormat")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ExifLibNet.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/oozcitak/exiflibrary
meta("library", "ExifLibrary");

function detect() {
    if (PE.isNetObjectPresent("ExifLibrary")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FAAD.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.rarewares.org/aac-decoders.php
meta("library", "FAAD");

function detect() {
    if (PE.isLibraryPresentExp(/libfaad/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FFmpeg.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.ffmpeg.org/
meta("library", "FFmpeg");

function detect() {
    if (PE.isLibraryPresentExp(/ffmpeg/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FastExpressionCompiler.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/dadhi/FastExpressionCompiler
meta("library", "FastExpressionCompiler");

function detect() {
    if (PE.isNetObjectPresent("FastExpressionCompiler")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FastMember.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/mgravell/fast-member
meta("library", "FastMember");

function detect() {
    if (PE.isNetObjectPresent("FastMember")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FastRsync_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/GrzegorzBlok/FastRsyncNet
meta("library", "FastRsync.NET");

function detect() {
    if (PE.isNetObjectPresent("FastRsync")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Fastenshtein.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DanHarltey/Fastenshtein
meta("library", "Fastenshtein");

function detect() {
    if (PE.isNetObjectPresent("Fastenshtein")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Fasterflect.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/buunguyen/fasterflect
meta("library", "Combres Optimizer");

function detect() {
    if (PE.isNetObjectPresent("Fasterflect")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FlashPlayer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "Flash Player");

function detect() {
    if (PE.compareEP("83....56FF15........8BF08A063C..75..8A....463C..74..84C074..8A....463C..75..80....75..46EB..3C..7E..8A")) {
        sVersion = PE.getFileVersion();
        bDetected = true;
    } else if (PE.compareEP("83....56FF15........8BF08A063C..75..8A....463C..74..84C075..3c..75..46eb..3c..76..8da4")) {
        sVersion = "8.0";
        bDetected = true;
    } else if (PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..463c..74..84c074..8a46..463c..75..803e..75..46eb")) {
        if (PE.compareOverlay("'CWS'") || PE.compareOverlay("'FWS'")) {
            sVersion = "7.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/library_FluentValidation.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/FluentValidation/FluentValidation
meta("library", "FluentValidation");

function detect() {
    if (PE.isNetObjectPresent("FluentValidation")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Fox_Pro.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "FOXPRO");

function detect() {
    for (var i = 0; i <= PE.nLastSection; i++) {
        var nOffset = PE.findString(PE.section[i].FileOffset, 512, "VisualFoxProRuntime.");
        if (nOffset != -1) {
            sVersion = PE.getString(nOffset + 20) + ".0";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/library_FusionCache.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ZiggyCreatures/FusionCache
meta("library", "FusionCache");

function detect() {
    if (PE.isNetObjectPresent("ZiggyCreatures.FusionCache")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_FuzzySharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/JakeBayer/FuzzySharp
meta("library", "FuzzySharp");

function detect() {
    if (PE.isNetObjectPresent("FuzzySharp")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_GitLabApiClient.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/nmklotas/GitLabApiClient
meta("library", "GitLabApiClient");

function detect() {
    if (PE.isNetObjectPresent("GitLabApiClient")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_GoldSrc.3.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

// https://en.wikipedia.org/wiki/GoldSrc
meta("library", "GoldSrc");

function detect() {
    var dataSection = PE.section[".data"];

    if (dataSection) {
        if (PE.findString(dataSection.FileOffset, dataSection.FileSize, "VENGINE_") !== -1 &&
            PE.findString(dataSection.FileOffset, dataSection.FileSize, "VFileSystem") !== -1 &&
            PE.findString(dataSection.FileOffset, dataSection.FileSize, "_API_VERSION")) {
            bDetected = true;

            var apiVersion = PE.findString(dataSection.FileOffset, dataSection.FileSize, "_API_VERSION");

            sOptions = "API v" + PE.getString(apiVersion + 12, apiVersion + 3);
        }

    }

    return result();
}

================================================
FILE: db/PE/library_Google_APIs.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/googleapis/google-api-dotnet-client
meta("library", "Google APIs");

function detect() {
    if (PE.isNetObjectPresent("Google.Apis") || PE.isNetObjectPresent("Google.Apis.Auth") || PE.isNetObjectPresent("Google.Apis.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Google_ProtoBuf.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/LibNoise
meta("library", "Google ProtoBuf");

function detect() {
    if (PE.isNetObjectPresent("LibNoise")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Harmony.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/pardeike/Harmony
meta("library", "Harmony");

function detect() {
    if (PE.isNetObjectPresent("0Harmony")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_HtmlAgilityPack.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://html-agility-pack.net/
meta("library", "Html Agility Pack");

function detect() {
    if (PE.isNetObjectPresent("HtmlAgilityPack")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Humanizer.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Humanizr/Humanizer
meta("library", "Humanizer");

function detect() {
    if (PE.isNetObjectPresent("Humanizer")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ImageSharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/SixLabors/ImageSharp
meta("library", "ImageSharp");

function detect() {
    if (PE.isNetObjectPresent("SixLabors.ImageSharp")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Intel_IPP.4.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

// https://en.wikipedia.org/wiki/Integrated_Performance_Primitives
meta("library", "Intel IPP");

function detect() {
    if (PE.isSectionNamePresent("IPPCODE") && PE.isSectionNamePresent("IPPDATA")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Intel_TBB.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://ru.wikipedia.org/wiki/Intel_Threading_Building_Blocks
meta("library", "Intel TBB");

function detect() {
    if (PE.isLibraryPresent("tbb.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Intel_XeSS.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.intel.com/content/www/us/en/developer/topic-technology/gamedev/xess2.html
meta("library", "Intel XeSS");

function detect() {
    if (PE.isLibraryPresentExp(/(lib|ig)xess/)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Irony.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/daxnet/irony
meta("library", "Irony");

function detect() {
    if (PE.isNetObjectPresent("Irony")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LCL.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

includeScript("FPC");

meta("library", "LCL");

function detect() {
    if (bFPC) {
        var verInfoOffset = PE.findSignature(PE.section[0].FileOffset, PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize(), "'LCLVersion' ?? ?? %% '.' %%");
        if (verInfoOffset != -1) {
            sVersion = PE.getString(verInfoOffset + 12);
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/library_LINQKit.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/scottksmith95/LINQKit
meta("library", "LINQKit");

function detect() {
    if (PE.isNetObjectPresent("LinqKit")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LZMA.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/LZMA
meta("library", "LZMA");

function detect() {
    if (PE.isLibraryPresentExp(/liblzma/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LazyCache.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/alastairtree/LazyCache
meta("library", "LazyCache");

function detect() {
    if (PE.isNetObjectPresent("LazyCache")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Lego1.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.legoisland.org/wiki/Local_Files
meta("library", "Lego1");

function detect() {
    if (PE.isLibraryPresent("Lego1.dll")) {
        sVersion = "release";
        bDetected = true;
    } else if (PE.isLibraryPresent("Lego1d.dll")) {
        sVersion = "debug";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LibLog.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/damianh/LibLog
meta("library", "LibLog");

function detect() {
    if (PE.isNetObjectPresent("LibLog")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LibNoise.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/LibNoise
meta("library", "MoLibNoise");

function detect() {
    if (PE.isNetObjectPresent("LibNoise")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LibPhoneNumber_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/twcclegg/libphonenumber-csharp
meta("library", "LibPhoneNumber.NET");

function detect() {
    if (PE.isNetObjectPresent("PhoneNumbers")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LibSassBuilder.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/johan-v-r/LibSassBuilder
meta("library", "LibSassBuilder");

function detect() {
    if (PE.isNetObjectPresent("LibSassBuilder")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LibVLCSharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/LibVLCSharp
meta("library", "LibVLCSharp");

function detect() {
    if (PE.isNetObjectPresent("LibVLCSharp") || PE.isNetObjectPresent("LibVLCSharp.Shared")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LiteDB.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/mbdavid/litedb
meta("library", "LiteDB");

function detect() {
    if (PE.isNetObjectPresent("LiteDB")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_LoadServ.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php?title=Gob/DEV6_Information
meta("library", "LoadServ");

function detect() {
    if (PE.isLibraryPresent("LoadServ.dll")) {
        sOptions = "DEV6";
        sVersion = "Adibou2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Lua_Runtime.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Lua Runtime");

function detect() {
    if (PE.isLibraryPresentExp(/^lua5/i)) {
        sLang = "Lua";
        sVersion = "5.X";
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^lua(L)?_/)) {
        sOptions = "static"; // EAT
        bDetected = true;

        var rdataSection = PE.section[".rdata"];

        if (rdataSection) {
            var embeddedLuaVersion = PE.findSignature(rdataSection.FileOffset, rdataSection.FileSize, "'Lua ' %% '.' %%");

            if (embeddedLuaVersion !== -1) {
                sVersion = PE.getString(embeddedLuaVersion + 4, 3);
            }
        }
    }


    return result();
}

================================================
FILE: db/PE/library_MacroMix.4.sg
================================================
// Detect It Easy: detection rule file format
// Author: BJNFNE <bjnfne@web.de>
// Rewritten by: DosX

// https://wiki.scummvm.org/index.php/Director/Games
meta("library", "MacroMix");

function detect() {
    var macroMixSection = PE.section["MacroMix"];

    if (macroMixSection && (macroMixSection.Characteristics & 0x60000020)) {
        sOptions = "Director Engine";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MailKit.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/jstedfast/MailKit
meta("library", "MailKit");

function detect() {
    if (PE.isNetObjectPresent("MailKit")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ManagedCuda.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/kunzmi/managedCuda
meta("library", "ManagedCuda");

function detect() {
    if (PE.isNetObjectPresent("ManagedCuda")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Mapster.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MapsterMapper/Mapster
meta("library", "Mapster");

function detect() {
    if (PE.isNetObjectPresent("Mapster")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Markdig.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/xoofx/markdig
meta("library", "Markdig");

function detect() {
    if (PE.isNetObjectPresent("Markdig")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MassTransit.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MassTransit/MassTransit
meta("library", "MassTransit");

function detect() {
    if (PE.isNetObjectPresent("MassTransit")) {
        bDetected = true;
    }

    if (PE.isNetObjectPresent("MassTransit.AmazonSQS")) {
        sVersion = "AmazonSQS";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MediatR.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/LuckyPennySoftware/MediatR
meta("library", "MediatR");

function detect() {
    if (PE.isNetObjectPresent("MediatR")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MemoryPack.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "MemoryPack Serializer");

function detect() {
    if (PE.isNetObjectPresent("MemoryPack") && PE.isNetObjectPresent("MemoryPack.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MessagePack.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MessagePack-CSharp/MessagePack-CSharp
meta("library", "MessagePack Serializer");

function detect() {
    if (PE.isNetObjectPresent("MessagePack")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Microsoft_AzureSDK.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nuget.org/packages/Azure.Core
meta("library", "Microsoft Azure SDK");

function detect() {
    if (PE.isNetObjectPresent("Azure.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Microsoft_Azure_SDK.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Microsoft Azure SDK");

function detect() {
    if (PE.isNetObjectPresent("Azure.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Microsoft_C_Runtime.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Microsoft C/C++ Runtime");

function detect() {
    if (PE.isLibraryPresent("vcruntime140.dll") ||
        PE.isLibraryPresent("vcruntime140_1.dll")) {
        sOptions = "dynamic";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Microsoft_Edge_WebView.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Microsoft Edge Chromium WebView");

function detect() {
    if (PE.isLibraryPresent("WebView2Loader.dll") || PE.isLibraryPresent("msedge_elf.dll")) {
        bDetected = true;
    } else if (PE.isNetObjectPresent("Microsoft.Web.WebView2") || PE.isNetObjectPresent("Microsoft.Web.WebView2.WinForms") || PE.isNetObjectPresent("Microsoft.Web.Wpf")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Microsoft_NET_Runtime.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", ".NET Core runtime");

function detect() {
    if (PE.isLibraryPresent("coreclr.dll")) {
        bDetected = true;
        sVersion = "5.XX+";
    }

    return result();
}

================================================
FILE: db/PE/library_Microsoft_OpenAPI.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Microsoft/OpenAPI.NET
meta("library", "Microsoft OpenAPI");

function detect() {
    if (PE.isNetObjectPresent("Microsoft.OpenApi")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MilesSoundSystem.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.radgametools.com/miles.htm
meta("library", "Miles Sound System");

function detect() {
    if (PE.isLibraryPresent("mss32.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MimeKit.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/jstedfast/MimeKit
meta("library", "MimeKit");

function detect() {
    if (PE.isNetObjectPresent("MimeKit")) {
        if (PE.isNetObjectPresent("MimeKitLite")) {
            sVersion = "Lite";
        }

        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MongoDB.NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/mongodb/mongo-csharp-driver
meta("library", "MongoDB.NET Driver");

function detect() {
    if (PE.isNetObjectPresent("MongoDB") ||
        PE.isNetObjectPresent("MongoDB.Driver") ||
        PE.isNetObjectPresent("MongoDB.Driver.Core") ||
        PE.isNetObjectPresent("MongoDB.Analyzer")) {
        bDetected = true;
    }

    if (PE.isNetObjectPresent("MongoDB.AspNetCore.OData")) {
        sVersion = "ASP.NET Core";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_MonkeyCache.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/jamesmontemagno/monkey-cache
meta("library", "MonkeyCache");

function detect() {
    if (PE.isNetObjectPresent("MonkeyCache")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Moq.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/devlooped/moq
meta("library", "Moq");

function detect() {
    if (PE.isNetObjectPresent("Moq") && PE.isNetObjectPresent("DownloadExists")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_NJsonSchema.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/RicoSuter/NJsonSchema
meta("library", "NJsonSchema");

function detect() {
    if (PE.isNetObjectPresent("NJsonSchema")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_NSubstitute.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/nsubstitute/NSubstitute
meta("library", "NSubstitute");

function detect() {
    if (PE.isNetObjectPresent("NSubstitute")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_NUnit.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/nunit/nunit
meta("library", "NUnit");

function detect() {
    if (PE.isNetObjectPresent("NUnit") || PE.isNetObjectPresent("nunit.framework")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Nerdbank.Streams.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/dotnet/Nerdbank.Streams
meta("library", "Nerdbank.Streams");

function detect() {
    if (PE.isNetObjectPresent("Nerdbank.Streams")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Newtonsoft.Json.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Newton Json");

function detect() {
    if (PE.isNetObjectPresent("Newtonsoft.Json")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Ninject.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// http://www.ninject.org/
meta("library", "Ninject");

function detect() {
    if (PE.isNetObjectPresent("Ninject")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_NodaTime.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/nodatime/nodatime
meta("library", "NodaTime");

function detect() {
    if (PE.isNetObjectPresent("NodaTime")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Nvidia_DLSS.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nvidia.com/en-gb/geforce/technologies/dlss/
meta("library", "Nvidia DLSS");

function detect() {
    if (PE.isLibraryPresentExp(/^nvngx_dlss|\.dlss(\.|_)/i)) {
        bDetected = true;
    } else if (PE.isLibraryPresentExp(/^d3d/i) || PE.isLibraryPresentExp(/^physx/i)) {
        var rdataSection = PE.section[".rdata"];

        if (rdataSection && PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "%% 'DLSS' %%")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/library_Nvidia_PhysX.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nvidia.com/en-gb/drivers/physx/physx-9-19-0218-driver/
meta("library", "Nvidia PhysX");

function detect() {
    if (PE.is64() && PE.section[".rdata"] && PE.isLibraryPresentExp(/^physx/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Nvidia_Streamline.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://developer.nvidia.com/rtx/streamline
meta("library", "Nvidia Streamline");

function detect() {
    if (PE.isLibraryPresent("sl.interposer.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OodleCompression.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.radgametools.com/oodle.htm
meta("library", "Oodle Compression");

function detect() {
    var oodleLibrary = PE.isLibraryPresentExp(/^oo2core_\d{1,2}_win/i);

    if (oodleLibrary) {
        var version = String(oodleLibrary).split("_")[1];

        if (version) {
            sVersion = version;
        }

        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^OodleLZ/)) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenAI.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "OpenAI SDK");

function detect() {
    if (PE.isNetObjectPresent("OpenAI")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenAL.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "OpenAL");

function detect() {
    if (PE.isLibraryPresentExp(/openal/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenCL.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "OpenCL");

function detect() {
    if (PE.isLibraryPresentExp(/opencl/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenCV.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/opencv/opencv
// https://github.com/shimat/opencvsharp
meta("library", "OpenCV");

function detect() {
    if (PE.isNetObjectPresent("OpenCvSharp")) {
        bDetected = true;
    } else if (PE.isLibraryPresentExp(/^opencv/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenColorIO.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://opencolorio.org/
meta("library", "OpenColorIO");

function detect() {
    if (PE.isLibraryPresentExp(/^OpenColorIO/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenGL.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "OpenGL");

function detect() {
    if (PE.isLibraryPresentExp(/opengl/i)) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^ANGLE(GetDisplayPlatform|ResetDisplayPlatform)/)) {
        sVersion = "ANGLE";
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenIddict.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://openiddict.com/
meta("library", "OpenIddict");

function detect() {
    if (PE.isNetObjectPresent("OpenIddict.Client") || PE.isNetObjectPresent("OpenIddict.Abstractions")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenSSL.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "OpenSSL");

function detect() {
    if (PE.isLibraryPresentExp(/libssl|libcrypto/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpenTelemetry.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/open-telemetry/opentelemetry-dotnet
meta("library", "OpenTelemetry");

function detect() {
    if (PE.isNetObjectPresent("OpenTelemetry") || PE.isNetObjectPresent("OpenTelemetry.Api")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_OpusAudio.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/xiph/opus
meta("library", "Opus Audio");

function detect() {
    if (PE.isLibraryPresentExp(/^(opus(enc)?\.)|(ms|lib)opus|bass(_)?opus/i)) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^opus_(de|en)code/)) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_PdfPig.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/UglyToad/PdfPig
meta("library", "PdfPig");

function detect() {
    if (PE.isNetObjectPresent("UglyLoad.PdfPig")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Perfolizer.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/AndreyAkinshin/perfolizer
meta("library", "Perfolizer");

function detect() {
    if (PE.isNetObjectPresent("Perfolizer")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Perl.3.sg
================================================
// Detect It Easy: detection rule file
// Author: hbasrc <rob.cheung+git@gmail.com>

meta("library", "Perl5 xs");

function detect() {
    if (!PE.isDll()) return;

    var sLib = PE.isLibraryPresentExp(/perl(5)_?(\d\d*)/i);
    if (sLib) {
        bDetected = true;
        sVersion = sLib[1] + "." + sLib[2];

        sLang = "Perl";
    }

    if (PE.isExportFunctionPresentExp("Perl_sv_bless|perl_parse")) {
        bDetected = true;
        sVersion = getPerlVersion();

        sLang = "Perl";

        return _setResult("library", "Perl Runtime", sVersion, "");
    }

    return result();
}

function getPerlVersion() {
    const verSig = [
        "'erl5' %% '.dll'", // v5.X
        "'erl5' %% %% '.dll'", // v5.XX
        "'erl5_' %% '.dll'", // cygwin or msys
        "'erl5_' %% %% '.dll'"
    ];

    var nExp = PE.getExportSection(),
        sPLVersion = String(),
        nMinorVer = 0,
        nGot = -1;

    for (var i = 0; i < verSig.length; ++i) {
        nGot = PE.findSignature(PE.section[nExp].FileOffset, PE.getSize(), verSig[i]);
        if (nGot > -1) break;
    }

    if (nGot > 0) {
        var sRes = PE.getString(nGot, 12);

        sRes = sRes.match(/(5)_?(\d\d*)/);

        if (sRes) {
            sPLVersion = sRes[1] + "." + sRes[2];
            nMinorVer = Number(sRes[2]);
        } else {
            return sPLVersion;
        }

        // find 5.X.X or 5.XX.X
        var sSign = nMinorVer > 9 ? "'5.' %% %% '.' %% " : "'5.' %% '.' %%",
            patchVer = findPatchVersion(sSign);

        if (patchVer > 0) sPLVersion += "." + patchVer;
    }

    return sPLVersion;
}

function findPatchVersion(sSign) {
    var nOffset = 0,
        nSize = PE.getSize(),
        nPatchVer = 0,
        nGot = -1;

    // Traverse and find the max number
    while ((nGot = PE.findSignature(nOffset, nSize, sSign)) != -1) {
        var sRes = PE.getString(nGot, 12);
        nOffset = nGot + sRes.length;

        sRes = sRes.match(/5\.\d\d*\.(\d\d*)/);
        if (sRes && sRes[1] > nPatchVer) nPatchVer = sRes[1];
    }

    return nPatchVer;
}

================================================
FILE: db/PE/library_Plivo.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// http://github.com/plivo/plivo-dotnet
meta("library", "Plivo");

function detect() {
    if (PE.isNetObjectPresent("Plivo")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Polly.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/App-vNext/Polly
meta("library", "Polly");

function detect() {
    if (PE.isNetObjectPresent("Polly") || PE.isNetObjectPresent("Polly.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_PortAudio.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.portaudio.com/
meta("library", "PortAudio");

function detect() {
    if (PE.isLibraryPresentExp(/^portaudio_x(86|64)/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Python.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Python"); // !!!! 🐓🐓🐓🐓🐓 !!!!

function detect() {
    var aPython = PE.isLibraryPresentExp(/^python(\d)(\d+)/i);
    if (aPython) {
        sVersion = aPython[1] + "." + aPython[2];
        bDetected = true;
    }

    var aPython2 = PE.isLibraryPresentExp(/^libpython(\d.\d)/i);
    if (aPython2) {
        sVersion = aPython2[1];
        bDetected = true;
    }

    sLang = "Python";
    sLangVersion = sVersion;

    return result();
}


================================================
FILE: db/PE/library_QMixer.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.ixbt.com/multimedia/3dsoundfaq.html
meta("library", "QMixer");

function detect() {
    if (PE.isLibraryPresent("QMDX.DLL")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Qt.4.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// coauthor: sendersu

meta("library", "Qt");

includeScript("QtFramework");

function detect() {
    if (aQt) {
        sVersion = PE.getPEFileVersion(PE.getFileDirectory() + "/" + aQt[0]);
        if (!sVersion) {
            if (PE.getVersionStringInfo("ProductName") == "The Qt Company Ltd" ||
                PE.getVersionStringInfo("ProductName") == "Qt5") {
                sVersion = PE.getPEFileVersion(PE.getFileDirectory() + "/" + ownName); // Check Linux !!!
            }
            if (!sVersion)
                sVersion = (aQt[3] ? aQt[3] : aQt[1]) + ".X";
        }
        if (aQt[2]) {
            sOptions = "debug";
        }
        bDetected = true;
    }

    if (!aQt && PE.section[".rdata"]) {
        if (PE.findString(PE.section[".rdata"].FileOffset, PE.section[".rdata"].FileSize, "QWidget") != -1) {
            sOptions = "static";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/library_RADVideoTools.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.radgametools.com/bnkdown.htm
meta("library", "RAD Video Tools");

function detect() {
    if (PE.isLibraryPresentExp(/^(binkw|bink2|video_bink)/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_RNNoise.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/xiph/rnnoise
meta("library", "RNNoise Noise Suppressor");

function detect() {
    if (PE.isLibraryPresentExp(/rnnoise/i) || PE.isFunctionPresent("rnnoise_init")) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^rnnoise_/)) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_RabbitMQ.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/rabbitmq/rabbitmq-dotnet-client
meta("library", "RabbitMQ");

function detect() {
    if (PE.isNetObjectPresent("RabbitMQ.Client")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_RamlToOpenApiConverter.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/StefH/RamlToOpenApiConverter
meta("library", "RamlToOpenApiConverter");

function detect() {
    if (PE.isNetObjectPresent("RamlToOpenApiConverter")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_RestSharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/restsharp/RestSharp
meta("library", "RestSharp HTTP");

function detect() {
    if (PE.isNetObjectPresent("RestSharp")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_SDL.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/libsdl-org/SDL
meta("library", "SDL");

function detect() {
    if (PE.isLibraryPresentExp(/^sdl2/i)) {
        sVersion = "2";
    } else if (PE.isLibraryPresentExp(/^sdl3/i)) {
        sVersion = "3";
    } else if (PE.isLibraryPresentExp(/^sdl/i)) {
        bDetected = true;
    }

    bDetected = bDetected || Boolean(sVersion);

    return result();
}

================================================
FILE: db/PE/library_ScePad.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "PlayStation Controller SDK");

function detect() {
    if (PE.isLibraryPresentExp(/^libscepad/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ScriptHookV.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.dev-c.com/gtav/scripthookv/
meta("library", "ScriptHookV for GTA V");

function detect() {
    if (PE.isLibraryPresent("ScriptHookV.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Scrutor.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/khellang/Scrutor
meta("library", "Scrutor");

function detect() {
    if (PE.isNetObjectPresent("Scrutor")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_SecretRabbitCode.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://libsndfile.github.io/libsamplerate/
meta("library", "Secret Rabbit Code");

function detect() {
    if (PE.isLibraryPresentExp(/^libsamplerate/i) ||
        PE.isFunctionPresent("src_set_ratio")) {
        bDetected = true;
    } else if (
        PE.isExportFunctionPresent("src_set_ratio") ||
        PE.isExportFunctionPresent("src_simple") ||
        PE.isExportFunctionPresent("src_is_valid_ratio")) {
        sOptions = "static"; // EAT
        bDetected = true;
    }
    return result();
}

================================================
FILE: db/PE/library_Serilog.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Serilog");

function detect() {
    if (PE.isNetObjectPresent("Serilog")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_SharpCompress.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/adamhathcock/sharpcompress
meta("library", "SharpCompress");

function detect() {
    if (PE.isNetObjectPresent("SharpCompress")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_SharpZipLib.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/icsharpcode/SharpZipLib
meta("library", "SharpZipLib Compression");

function detect() {
    if (PE.isNetObjectPresent("SharpZipLib")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Sigil.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/kevin-montrose/Sigil
meta("library", "Sigil Helper");

function detect() {
    if (PE.isNetObjectPresent("Sigil")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_SkiaSharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/mono/SkiaSharp (.NET)
meta("library", "SkiaSharp");

function detect() {
    if (PE.isNetObjectPresent("SkiaSharp")) {
        sVersion = "Mono-based";
        bDetected = true;
    } else if (PE.isLibraryPresentExp(/^libskiasharp/i)) {
        sVersion = "Native";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Smacker.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.multimedia.cx/index.php/RAD_Game_Tools_Smacker_API
meta("library", "RAD Game Tools Smacker API");

function detect() {
    if (PE.isLibraryPresent("smackw32.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_SmartHeap.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.xlsoft.com/en/products/microquill/smartheap.html
meta("library", "SmartHeap");

function detect() {
    if (PE.isLibraryPresent("SHW32.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Snappier.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/brantburnett/Snappier
meta("library", "Snappier Compression");

function detect() {
    if (PE.isNetObjectPresent("Snappier")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Spectre.Console.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/spectreconsole/spectre.console
meta("library", "Spectre.Console");

function detect() {
    if (PE.isNetObjectPresent("Spectre.Console")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Stackify.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/stackify/stackify-api-dotnet
meta("library", "Stackify");

function detect() {
    if (PE.isNetObjectPresent("StackifyLib")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Starkbank_ECDSA.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/starkbank/ecdsa-dotnet
meta("library", "Starkbank ECDSA");

function detect() {
    if (PE.isNetObjectPresent("StarkbankEcdsa")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Steam.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Steam");

function detect() {
    if (PE.isLibraryPresentExp(/^steam/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Swashbuckle.AspNetCore.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/domaindrivendev/Swashbuckle.AspNetCore
meta("library", "Swashbuckle.AspNetCore");

function detect() {
    if (PE.isNetObjectPresent("Swashbuckle.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_TNTSI.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://otvet.mail.ru/question/64229866
meta("library", "TNTSI");

function detect() {
    if (PE.isLibraryPresent("TNTSI.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Tabula.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/BobLd/tabula-sharp
meta("library", "Tabula");

function detect() {
    if (PE.isNetObjectPresent("Tabula")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Telegram.Bot.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/TelegramBots/Telegram.Bot
meta("library", "Telegram.Bot");

function detect() {
    if (PE.isNetObjectPresent("Telegram.Bot")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Twilio.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/twilio/twilio-csharp
meta("library", "Twilio REST Helper");

function detect() {
    if (PE.isNetObjectPresent("Twilio")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Twilio_SendGrid.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/sendgrid
meta("library", "Twilio SendGrid");

function detect() {
    if (PE.isNetObjectPresent("SendGrid")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_UAParser.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ua-parser/uap-csharp
meta("library", "UAParser");

function detect() {
    if (PE.isNetObjectPresent("UAParser")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Unity.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Unity Engine");

function detect() {
    if (PE.isLibraryPresent("UnityPlayer.dll") || PE.isExportFunctionPresent("UnityMain")) {
        bDetected = true;
    }

    if (PE.isExportFunctionPresent("il2cpp_alloc")) {
        sLang = "Native MSIL/C#";
        sOptions = "IL2CPP";
        bDetected = true;

        _setResult("compiler", "IL2CPP Technology", String(), String());
    }

    return result();
}

================================================
FILE: db/PE/library_VFW.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Video_for_Windows
meta("library", "Video for Windows (VFW)");

function detect() {
    if (PE.isLibraryPresent("MSVFW32.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Vorbis.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>
// Rewritten by: DosX

// https://en.wikipedia.org/wiki/Vorbis
meta("library", "Vorbis");

function detect() {
    if (PE.isLibraryPresentExp(/vorbis/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Vulkan.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Vulkan");

function detect() {
    if (PE.isLibraryPresentExp(/[V|v]ulkan/i)) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/VULKAN/)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WF.Guna.UI2.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Guna UI");

function detect() {
    if (PE.isNetObjectPresent("Guna.UI2") && PE.isNetObjectPresent("Guna.UI2.WinForms")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WF.Krypton.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Krypton UI");

function detect() {
    if (PE.isNetObjectPresent("ComponentFactory.Krypton.Toolkit")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WF.MetroFramework.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "MetroFramework UI");

function detect() {
    if (PE.isNetObjectPresent("MetroFramework")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WF.ReaLTaiizor.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Taiizor/ReaLTaiizor
meta("library", "ReaLTaiizor UI");

function detect() {
    if (PE.isNetObjectPresent("ReaLTaiizor")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WF_WPF.MaterialSkin.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "MaterialSkin UI");

function detect() {
    if (PE.isNetObjectPresent("MaterialSkin")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WPF.AvalonEdit.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/icsharpcode/AvalonEdit
meta("library", "AvalonEdit");

function detect() {
    if (PE.isNetObjectPresent("AvalonEdit")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WPF.ControlzEx.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MahApps/MahApps.Metro
meta("library", "ControlzEx UI");

function detect() {
    if (PE.isNetObjectPresent("ControlzEx")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WPF.MahApps_Metro.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MahApps/MahApps.Metro
meta("library", "MahApps Metro UI");

function detect() {
    if (PE.isNetObjectPresent("MahApps.Metro")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WebActivatorEx.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/davidebbo/WebActivator
meta("library", "WebActivator");

function detect() {
    if (PE.isNetObjectPresent("WebActivatorEx")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WinSparkle.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/vslavik/winsparkle
meta("library", "WinSparkle");

function detect() {
    if (PE.isLibraryPresent("WinSparkle.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_WwiseAudioEngine.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.audiokinetic.com/en/wwise/overview/
meta("library", "Wwise Audio Engine");

function detect() {
    if (PE.isFunctionPresent("g_pAKPluginList")) {
        bDetected = true;
    } else if (PE.isExportFunctionPresent("g_pAKPluginList")) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_XLive.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://www.xbox.com/en-us/live
meta("library", "Xbox Live");

function detect() {
    if (PE.isLibraryPresent("xlive.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_XPatFC.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://landbeforetime.fandom.com/wiki/The_Land_Before_Time:_Kindergarten_Adventure
meta("library", "XPatFC");

function detect() {
    if (PE.isLibraryPresent("XpatFC.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Xerces-CPP.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/apache/xerces-c
meta("library", "Xerces-C++ XML Parser");

function detect() {
    if (PE.isLibraryPresentExp(/^xerces/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Xojo.4.sg
================================================
// Detect It Easy: detection rule file
// Author: Jupiter

// https://www.xojo.com
meta("library", "Xojo");

function detect() {
    if (PE.section["xojoinit"]) {
        // plugins
        if (PE.section["xojoplgn"]) {
            sOptions = sOptions.append("plugins");
        }

        // x64 | x86
        if (PE.isLibraryPresent("XojoGUIFramework64.dll")) {
            sVersion = "x64";
        } else if (PE.isLibraryPresent("XojoGUIFramework32.dll")) {
            sVersion = "x86";
        }
        //sVersion="2018r2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_YUICompressor_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/YUICompressor-NET/YUICompressor.NET
meta("library", "YUICompressor.NET");

function detect() {
    if (PE.isNetObjectPresent("Yahoo.Yui.Compressor")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_YamlDotNet.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/aaubry/YamlDotNet
meta("library", "YamlDotNet");

function detect() {
    if (PE.isNetObjectPresent("YamlDotNet")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_ZstdSharp.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/oleg-st/ZstdSharp
meta("library", "ZstdSharp");

function detect() {
    if (PE.isNetObjectPresent("ZstdSharp")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_Zydis.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Zyan Disassembler");

function detect() {
    if (PE.isLibraryPresent("zydis.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_combres.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/buunguyen/combres
meta("library", "Combres Optimizer");

function detect() {
    if (PE.isNetObjectPresent("Combres")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_curl.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "Curl");

function detect() {
    if (PE.isLibraryPresentExp(/libcurl/i)) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^curl_easy_/)) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_discord-rpc.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://github.com/discord/discord-rpc
meta("library", "Discord RPC");

function detect() {
    if (PE.isLibraryPresent("discord-rpc.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_dotless.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/dotless/dotless
meta("library", "dotless");

function detect() {
    if (PE.isNetObjectPresent("dotless.Core")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_expat_xml_parser.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://libexpat.github.io/
meta("library", "Expat XML Parser");

function detect() {
    if (PE.isLibraryPresentExp(/^libexpat/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_gRPC_NET.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/grpc/grpc-dotnet
meta("library", "gRPC.NET");

function detect() {
    if (PE.isNetObjectPresent("Grpc.Core.Api")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_iMuse.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// https://wiki.scummvm.org/index.php/SCUMM/Technical_Reference/iMuse_data
meta("library", "iMuse");

function detect() {
    if (PE.isLibraryPresent("iMUSE.dll")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_java.3.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("library", "Java");

function detect() {
    if (PE.getOverlaySize() > 0x40) {
        if (PE.findString(PE.getOverlayOffset(), 0x40, "META-INF/MANIFEST.MF") != -1) {
            var nResSection = PE.getResourceSection();
            if (nResSection != -1) {
                if (PE.isSignatureInSectionPresent(nResSection, "'Java Runtime Environment'")) {
                    bDetected = true;
                }
            }
        }
    }

    sLang = "Java";

    return result();
}


================================================
FILE: db/PE/library_libfvad.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/dpirch/libfvad
meta("library", "libfvad");

function detect() {
    if (PE.isLibraryPresentExp(/fvad\./i)) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^fvad_/)) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_libpng.4.sg
================================================
// Detect It Easy: detection rule file
// Author: BJNFNE <bjnfne@web.de>

// http://www.libpng.org/
meta("library", "libpng");

function detect() {
    if (PE.isLibraryPresentExp(/^libpng/i)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_log4net.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/apache/logging-log4net
meta("library", "log4net");

function detect() {
    if (PE.isNetObjectPresent("log4net")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_lz4net.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MiloszKrajewski/lz4net
meta("library", "lz4net");

function detect() {
    if (PE.isNetObjectPresent("LZ4")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_nClam.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/tekmaven/nClam
meta("library", "nClam");

function detect() {
    if (PE.isNetObjectPresent("nClam")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_rlottie.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Samsung/rlottie
meta("library", "rlottie");

function detect() {
    if (PE.isLibraryPresentExp(/^rlottie/i)) {
        bDetected = true;
    } else if (PE.isExportFunctionPresentExp(/^(\?|_)+.{6,}rlottie/)) {
        sOptions = "static"; // EAT
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_sqlite.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/praeclarum/sqlite-net (.NET)
meta("library", "SQLite");

function detect() {
    var sLibrary = PE.isLibraryPresentExp(/sqlite\d+/i);
    if (sLibrary) {
        var match = /sqlite(\d+)/i.exec(sLibrary);

        if (match) {
            sVersion = match[1];
        }

        bDetected = true;
    } else {
        var sExportFunction = PE.isExportFunctionPresentExp(/sqlite\d+/i);
        if (sExportFunction) {
            sOptions = "static"; // EAT

            var match = /sqlite(\d+)/i.exec(sExportFunction);

            if (match) {
                sVersion = match[1];
            }

            bDetected = true;
        } else if (PE.isLibraryPresentExp(/sqlite|sqlmin|sqllang|sqltses|sqldk/i)) {
            bDetected = true;
        }
    }

    if (!bDetected && PE.isNet()) {
        if (PE.isNetObjectPresent("SQLite-net")) {
            sName += "-net";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/library_wxWidgets.5.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("library", "wxWidgets");

includeScript("wxWidgets");

function detect() {
    if (aWx == 1) {
        sOptions = "static";
        bDetected = true;
    } else if (aWx) {
        sVersion = (aWx[2] / 10).toFixed(1);

        if (aWx[1]) {
            sOptions = "universal";
        }

        if (aWx[3]) {
            sOptions = sOptions.append("unicode");
        }

        if (aWx[4]) {
            sOptions = sOptions.append("debug");
        }

        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_xUnit.net.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/xunit/xunit
meta("library", "xUnit.net");

function detect() {
    if (PE.isNetObjectPresent("xunit.core") || PE.isNetObjectPresent("xunit.assert") || PE.isNetObjectPresent("xunit.analyzers")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/library_zlib.4.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("library", "zlib");

function detect() {
    if (PE.isLibraryPresentExp(/^zlib*/)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/linkers.6.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("linker");

includeScript("FASM");
includeScript("RosASM");
includeScript("SpASM");
includeScript("FPC");

function detect() {
    sVersion = PE.getCompilerVersion();

    if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'0000000000000'PE'0000")) {
        var nMajor = PE.getMajorLinkerVersion(),
            nMinor = PE.getMinorLinkerVersion();

        if (nMajor == 2) {
            if (nMinor == 55) {
                sName = "LCC Linker";
                sVersion += "*";
                sLang = "C";
                bDetected = true;
            } else if (nMinor <= 40 || nMinor == 56) {
                sName = "GNU Linker ld (GNU Binutils)";
                if (nMinor == 56) {
                    sVersion += "*";
                }
                bDetected = true;
            } else if (nMinor == 50) {
                sName = "Polink";
                sVersion += "*";
                bDetected = true;
            }
        } else if (nMajor == 1) {
            if (nMinor == 3) {
                sName = "LCC Linker";
                bDetected = true;
            }
        }
    } else if (PE.compare("'This program must be run under Win'....0D0A24..00", 0x50)) {
        sName = "Turbo Linker";
        if (sVersion == "2.25") {
            if (PE.isSectionNamePresent(".tls")) {
                sLang = "Object Pascal (Delphi)";
            }
        }
        bDetected = true;
    } else if (PE.compare("FB..'jr'", 0x1e)) {
        sName = "Turbo Linker";
        sVersion = (PE.readByte(0x1f) / 16).toFixed(1);
        if (PE.compare("'32STUB'", 0x200)) {
            sOptions = sOptions.append("RTM32");
        }
        bDetected = true;
    } else if (PE.compare( /*[Tt]*/ "'his is a Windows '" /*(?:95|NT)*/, 0x4f)) {
        sName = "Watcom Linker";
        sVersion += "*";
        bDetected = true;
    } else if (PE.compare("'MZ'6c000100000002000000ffff000000000000110000004000000000000000'Win'....' Program!\r\n\b409ba0001cd21b44ccd2160000000'GoLink, GoAsm www.GoDevTool.com'00")) {
        sName = "GoLink";
        bDetected = true;
    }

    var nMajor = PE.getMajorLinkerVersion(),
        nMinor = PE.getMinorLinkerVersion();

    if (nMajor == 2 && nMinor == 18) {
        sName = "Watcom Linker";
        bDetected = true;
    } else if (nMajor == 2 && nMinor == 52) {
        sName = "PowerBASIC Linker";
        sLang = "Basic";
        bDetected = true;
    } else if (nMajor == 255 && nMinor == 255) {
        sName = "IBM VisualAge";
        bDetected = true;
    } else if (nMajor == 7 && nMinor == 32) {
        sName = "Symantec C/C++";
        sVersion = "7.2";
        bDetected = true;
    }
    // Correct version
    if (sName == "Borland Linker") {
        if (PE.getMajorLinkerVersion() > 15) {
            sVersion += "*";
        }
    }

    // Doesn't have a linker.
    if (bFASM || bRosASM || bSpASM || bFPC) {
        bDetected = false;
    }

    return result();
}


================================================
FILE: db/PE/marker_AMD_PowerXpress.5.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://en.wikipedia.org/wiki/AMD_Hybrid_Graphics#PowerXpress
meta("marker", "AMD PowerXpress");

function detect() {
    if (PE.isExportFunctionPresent("AmdPowerXpressRequestHighPerformance")) {
        bDetected = true;
    } else if (PE.isExportFunctionPresent("NoAmdPwrXpressRequestHighPerformance")) {
        sOptions = "Disabled";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/marker_Nvidia_Optimus.5.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.nvidia.com/en-us/geforce/technologies/optimus/technology/
meta("marker", "Nvidia Optimus");

function detect() {
    if (PE.isExportFunctionPresent("NvOptimusEnablement")) {
        bDetected = true;
    } else if (PE.isExportFunctionPresent("NoNvOptimEnablement")) {
        sOptions = "Disabled";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/native_only/about.txt
================================================
Scripts for Native files only will be located here (PE.isNet() == false)

================================================
FILE: db/PE/other_Dolphin_VM.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// Executable made by Dolphin XP ToGo Application (Dolphin Smalltalk platform)

meta("other", "Dolphin Virtual Machine");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")) {
        if (PE.compareOverlay("'IST'00")) {
            sVersion = "5.0";
            sOptions = "2003 by Object Arts";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/other_FileSplit_Self-Merger.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "Partridgesoft FileSplit Self-Merger");

function detect() {
    if (PE.compareEP("56576a..ff15........8bf8ff15........8a088b35........80f9..75..50ffd68a0884c974..80f9..75..50ffd6")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/other_GSplit.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("other", "GSplit Self-Uniting");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0")) {
        if (PE.getNumberOfResources() > 0) {
            nOffset = PE.getResourceNameOffset("ENG"); {
                if (PE.compare("'GS'", nOffset)) {
                    sVersion = "3.0";
                    bDetected = true;
                }
            }

        }
    }

    return result();
}

================================================
FILE: db/PE/packer_32LiTe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.softpedia.com/get/Compression-tools/32LiTE.shtml
meta("packer", "32LiTe");

function detect() {
    if (PE.compareEP("6006FC1E07BE........6A0468........68")) {
        sVersion = "0.03a";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_AHpacker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "AHpacker");

function detect() {
    const epackSectionName = "!EPack";

    if (PE.compareEP("6068........B8........FF1068........50B8........FF1068........6A40FFD08905") &&
        PE.section[0].Name !== epackSectionName &&
        PE.section[PE.nLastSection].Name !== epackSectionName) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_ANDpakk.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "ANDpakk");

function detect() {
    if (PE.compareEP("60FCBED4004000BF001000015783CDFF33C9F9EB05A402DB75058A1E4612DB72F4")) {
        sVersion = "2.0.06";
        bDetected = true;
    } else if (PE.getNumberOfSections() == 1 && PE.getNumberOfImports() == 1 && PE.getNumberOfImportThunks(0) == 2) {
        if (PE.section[0].Name == "ANDpakk2") {
            sVersion = "2.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_ASDPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "ASDPack");

function detect() {
    if (PE.compareEP("8B442404565753E8CD010000C30000000000000000000000000010000000")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (
        PE.getNumberOfImports() === 1 &&
        PE.getNumberOfSections() === 3 &&
        PE.getImportLibraryName(0) === "Kernel32.dll" &&
        PE.isImportPositionHashPresent(0, 0x3651f68d) // GetModuleHandleA
    ) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_ASPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// http://www.aspack.com/
meta("packer", "ASPack");

function getASPackVersion(nOffset) {
    if (PE.compare("60E8000000005D81ED........B8........03C5", nOffset)) {
        sVersion = "1.00b-1.07b";
    } else if (PE.compare("60EB..5DEB..FF..........E9", nOffset)) {
        sVersion = "1.08.00-1.08.02";
    } else if (PE.compare("60E8000000005D............BB........03DD", nOffset)) {
        sVersion = "1.08.03";
    } else if (PE.compare("60E8000000005D81ed........BB........01eb", nOffset)) {
        sVersion = "1.08.X";
        sOptions = "possibly";
    } else if (PE.compare("60E841060000EB41", nOffset)) {
        sVersion = "1.08.04";
    } else if (PE.compare("60EB..5DFFE5E8........81ED........BB........03DD2B9D", nOffset)) {
        sVersion = "1.08.X";
    } else if (PE.compare("60E870050000EB4C", nOffset)) {
        sVersion = "2.000";
    } else if (PE.compare("60E872050000EB4C", nOffset)) {
        sVersion = "2.001";
    } else if (PE.compare("60E872050000EB3387DB9000", nOffset)) {
        sVersion = "2.1";
    } else if (PE.compare("60E93D040000", nOffset)) {
        sVersion = "2.11";
    } else if (PE.compare("60E802000000EB095D5581ED39394400C3E93D040000", nOffset)) {
        sVersion = "2.11b";
    } else if (PE.compare("60E802000000EB095D5581ED39394400C3E959040000", nOffset)) {
        sVersion = "2.11c-2.11d";
    } else if (PE.compare("60E802000000EB095D55", nOffset)) {
        sVersion = "2.11d";
    } else if (PE.compare("60E803000000E9EB045D4555C3E801", nOffset)) {
        sVersion = "2.12-2.42";
    } else if (PE.compare("9060E8$$$$$$$$5D4555C3", nOffset)) {
        sVersion = "2.12b";
    } else if (PE.compare("60e8$$$$$$$$8b2c2481ed........c3", nOffset)) {
        sVersion = "2.1X-2.39";
    } else if (PE.compare("9060e8$$$$$$$$8b2c2481ed........c3", nOffset)) {
        sVersion = "2.1X-2.39";
    } else {
        return false;
    }

    return true;
}

function detect() {
    var nOffset = PE.getEntryPointOffset();
    if (nOffset != -1) {
        if (!getASPackVersion(nOffset)) {
            if (PE.compareEP("7500E9")) {
                nOffset += 3;
                bDetected = true;
            } else if (PE.compareEP("907500E9")) {
                nOffset += 4;
                bDetected = true;
            } else if (PE.compareEP("90907500E9")) {
                nOffset += 5;
                bDetected = true;
            } else if (PE.compareEP("90750190E9")) {
                nOffset += 5;
                bDetected = true;
            } else if (PE.compareEP("907501FFE9")) {
                nOffset += 5;
                bDetected = true;
            } else if (PE.compareEP("9090907500E9")) {
                nOffset += 6;
                bDetected = true;
            } else if (PE.compareEP("9090750190E9")) {
                nOffset += 6;
                bDetected = true;
            } else if (PE.compareEP("909090750190E9")) {
                nOffset += 7;
                bDetected = true;
            }
            if (bDetected) {
                // Can't simply adjust the offset, as the destination may be in a different section.
                nOffset = PE.RVAToOffset(PE.OffsetToRVA(nOffset) + 4 + ~~PE.readDword(nOffset));
                bDetected = getASPackVersion(nOffset);
            }
        } else {
            bDetected = true;
        }
    }

    if (!bDetected) {
        if (PE.section[".aspack"] && PE.section[".adata"]) {
            sVersion = "2.12-2.XX";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_Advanced_BAT_to_EXE_Converter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L. <asl@onet.eu> 2018

// https://www.battoexeconverter.com/
meta("packer", "Advanced BAT to EXE Converter");

function detect() {
    if (PE.compareEP("558BEC6AFF68") && PE.compareOverlay("..02020202363A38393a")) {
        sVersion = "2.X-4.X";
        bDetected = true;
    }

    sLang = "Batch";

    return result();
}

================================================
FILE: db/PE/packer_AlushPacker.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Alon-Alush/AlushPacker
meta("packer", "AlushPacker");

function detect() {
    if (PE.getNumberOfImports() > 2 &&
        PE.isRichSignaturePresent() &&
        PE.isLibraryPresentExp(/vcruntime140/i) && (
            PE.getImportFunctionName(0, 0) === "VirtualProtect" &&
            PE.getImportFunctionName(0, 1) === "GetCurrentProcess" &&
            PE.getImportFunctionName(0, 2) === "GetModuleHandleA" &&
            PE.getImportFunctionName(0, 3) === "MultiByteToWideChar" &&
            PE.getImportFunctionName(0, 4) === "FlushInstructionCache"
        )) {
        var packedLatestSection = PE.section[".packed"];

        if (!packedLatestSection) {
            packedLatestSection = PE.section[PE.getNumberOfSections() - 1];
            sOptions = "modified";
        }

        if (PE.compare("00 ** ?? 00", packedLatestSection.FileOffset)) {
            bDetected = true;
        }

    }

    return result();
}

================================================
FILE: db/PE/packer_Anskya_NTPacker_Generator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Anskya NTPacker Generator");

function detect() {
    if (PE.compareEP("558BEC83C4F053B8881D0010E8C7FAFFFF6A0A68201E0010A11431001050")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_AtomPePacker.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://web.archive.org/web/20221012050538/https://github.com/ORCx41/AtomPePacker
meta("packer", "AtomPePacker");

function detect() {
    if (PE.is64() && PE.compareEP("4053574883EC**65488B1C25........FF15**......BA........41B8........488BC8")) {
        sOptions = PE.isSectionNamePresent(".ATOM") ? "x64 stub" : "modified";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_BatToExe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Bat To Exe");

function detect() { // Fatih Kodak
    if (PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68........e8........a3")) {
        for (var i = 0; i < PE.getNumberOfResources() && !bDetected; i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                bDetected = PE.compare("78 9c 63 60 18 05 23 19 00 00 02 00 00 01", PE.resource[i].Offset);
            }
        }
    }

    sLang = "Batch";

    return result();
}


================================================
FILE: db/PE/packer_BatToExeConverter.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("packer", "Bat To Exe Converter");

function detect() {
    if ((
        PE.isImportPositionHashPresent(0, 0x72a2ca64) ||
        PE.isImportPositionHashPresent(0, 0x2afcef3f)
    ) && PE.compareEP(PE.is64() ?
        "48 83 EC .. 49 C7 C0 .. .. .. .. 48 31 D2 48 B9 .. .. .. .. .. .. .. .. E8 .. .. .. .. 48 31 C9 E8 .. .. .. .. 48 89 05 .. .. .. .." : // 64 bit
        "68 .. .. .. .. 68 .. .. .. .. 68 .. .. .. .. E8 .. .. .. .. 83 C4 .. 68 .. .. .. .. E8 .. .. .. .. A3 .. .. .. ..")) { // 32 bit
        bDetected = true;
    }

    sLang = "Batch";

    return result();
}

================================================
FILE: db/PE/packer_BeRoEXEPacker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://blog.rosseaux.net/page/875fbe6549aa072b5ee0ac9cefff4827/BeRoEXEPacker
meta("packer", "BeRoEXEPacker");

function detect() {
    var nEP = PE.compareEP("837C2408010F85") ? 11 : 0;
    if (PE.compareEP("60BE........BF........FCB28033DBA4B302E8", nEP)) {
        sVersion = "1.00";
        sOptions = "LZBRR";
    } else if (PE.compareEP("60BE........BF........FCAD8D1C07B0803BFB733BE8", nEP)) {
        sVersion = "1.00";
        sOptions = "LZBRS";
    } else if (PE.compareEP("6068........68........68........E8........BE........B9")) {
        sVersion = "1.00";
        sOptions = "LZMA";
    } else if (PE.compareEP("BA........8DB2........8B46..85C0745103C28B7E..8B1E85DB75028BDF03DA03FA525750FF15")) {
        sVersion = "1.00";
    } else if (PE.compareEP("6068........68......0068........e8..040000..................00")) {
        sVersion = "1.00";
        sOptions = "LZMA";
    } else if (PE.compareEP("60e8000000005e81c6....0000bf........6081ec0804000089e357fc31c0b4")) {
        sVersion = "1.00";
        sOptions = "CTX1";
    } else if (PE.compareEP("60c8940c0060fcbe........ad8945fc33c0f7d08945f8f7d0b408b923030000")) {
        sVersion = "1.00";
        sOptions = "LZBRA";
    } else if (PE.compare("52c3'(C)BeRo!PE'0000", 2)) {
        bDetected = true;
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}


================================================
FILE: db/PE/packer_BoxedApp.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.boxedapp.com/
meta("packer", "BoxedApp");

function detect() {
    if (PE.isTLSPresent()) {
        const boxedAppSection = PE.section[".bxpck"];

        if (boxedAppSection && PE.getNumberOfSections() > 2) {

            const mainSection = PE.section[boxedAppSection.Number + 1];

            if (mainSection && mainSection.Name === ".main") {
                bDetected = true;
            }
        }

        if (!bDetected && PE.getNumberOfImports() === 2 && PE.compareEP("C200000000000000000000000000000000")) {
            sOptions = "modified";
            bDetected = true;
        }

        if (bDetected && boxedAppSection && PE.isSignatureInSectionPresent(boxedAppSection.Number, "2000640065006D006F0020")) {
            sVersion = "demo";
        }
    }

    return result();
}

================================================
FILE: db/PE/packer_CExe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://compression.ru/arctest/self/cexe.htm
meta("packer", "CExe");

function detect() {
    if (PE.compareEP("558BEC81EC0C02....56BE........8D85F8FEFFFF56506A..FF15........8A8DF8FEFFFF33D284C98D85F8FEFFFF7416")) {
        sVersion = "1.0a";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_CICompress.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "CICompress");

function detect() {
    if (PE.compareEP("6A046800100000FF35........6A00FF15........A3........97BE........E8710000003B05")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Cxfreeze.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Made by KDSS-Research <koffidev365supp@gmail.com>

// Rewritten by: DosX

meta("packer", "CX_Freeze");

function detect() {
    var rdataSection = PE.section[".rdata"];

    if (rdataSection) {

        bDetected = (PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Unable to change DLL search path!") !== -1 &&
            PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "25006C0073005C006C00690062005C006C006900620072006100720079002E007A00690070003B0025006C0073005C006C0069006200") &&
            PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Out of memory creating sys.path!") !== -1 &&
            PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Unable to calculate directory of executable!") !== -1);

    }

    sLang = "Python";

    return result();
}


================================================
FILE: db/PE/packer_DxPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "DxPack");

function detect() {
    if (PE.compareEP("60E8........5D8BFD81ED........2BB9........81EF........83BD..........0F84")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 32)) {
            case 0xB9: sVersion = "1.0"; break;
            case 0xBD: sVersion = "0.86"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("EB03C20C00558BEC81EC00100000B80000....B900100000BA0000....89")) {
        sVersion = "1.0";
        bDetected = true;
    }

    var coderpubSection = PE.section["coderpub"];

    if (bDetected && !coderpubSection) {
        sOptions = "modified";
    } else if (!bDetected && coderpubSection) {
        if (PE.compareEP("558BEC") || PE.compareEP("880D........CC")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_EXE32Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://exe32pack.apponic.com/
meta("packer", "Exe32Pack");

function detect() {
    if (PE.compareEP("3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB7401BE5D8BD581ED")) {
        sVersion = "1.4X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_ExE_Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "ExE Pack");

function detect() {
    if (PE.compareEP("6068........B8........FF1068........50B8........FF1068........6A40FFD08905")) {
        if (PE.section[0].Name == "!EPack") {
            sVersion = "1.0-1.2";
            bDetected = true;
        }
    } else if (PE.compareEP("9090909061B8........FFE0558BEC60558B75088B7D0CE802000000EB048B1C24C381C3")) {
        sVersion = "1.4 lite final";
        bDetected = true;
    } else if (PE.compareEP("33C08BC068........68........E8")) {
        sVersion = "1.4 lite final";
        bDetected = true;
    } else if (PE.section[PE.nLastSection].Name == ".!ep") {
        sVersion = "1.4";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_FSG.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "FSG");

function detect() {
    if (PE.compareEP("BE........BF........BB........53BB........B280")) {
        sVersion = "1.31";
    } else if (PE.compareEP("BB........BF........BE........53E80A00000002D275058A164612D2")) {
        sVersion = "1.0";
    } else if (PE.compareEP("BB........BF........BE........FCB2808A064688074702D275058A16")) {
        sVersion = "1.1";
    } else if (PE.compareEP("EB02CD2003..8D..80....00..................EB02")) {
        sVersion = "1.10";
        sOptions = "Watcom C/C++ EXE";
    } else if (PE.compareEP("80E9A1C1C11368E4167546C1C1055EEB019D6864863746EB028CE05FF7D0")) {
        sVersion = "1.10";
        sOptions = "WinRAR-SFX";
    } else if (PE.compareEP("EB0102EB02CD20B8........EB0155BEF400000013DF13D80FB638D1F3F7")) {
        sVersion = "1.10";
        sOptions = "WinRAR-SFX";
    } else if (PE.compareEP("EB02CD202BC868........EB021EBB5EEB02CD2068B12B6E37405B0FB6C9")) {
        sVersion = "1.10";
        sOptions = "Borland C++ 1999";
    } else if (PE.compareEP("23CAEB025A0DE8020000006A3558C1C910BE........0FB6C9EB02CD20BB")) {
        sVersion = "1.10";
        sOptions = "Borland C++";
    } else if (PE.compareEP("2BC2E802000000954A598D3D52F12AE8C1C81CBE2E....18EB02ABA003F7")) {
        sVersion = "1.10";
        sOptions = "Borland Delphi/Borland C++";
    } else if (PE.compareEP("EB012EEB02A555BB........87FE8D05AACEE063EB0175BA5ECEE063EB02")) {
        sVersion = "1.10";
        sOptions = "Borland Delphi/Borland C++";
    } else if (PE.compareEP("EB02CD20EB02CD20EB02CD20C1E618BB........EB0282B8EB01108D05F4")) {
        sVersion = "1.10";
        sOptions = "Borland Delphi/Microsoft Visual C++/ASM";
    } else if (PE.compareEP("C1C810EB010FBF03746677C1E91D6883....77EB02CD205EEB02CD202BF7")) {
        sVersion = "1.10";
        sOptions = "Borland Delphi/Microsoft Visual C++";
    } else if (PE.compareEP("1BDBE8020000001A0D5B68........E801000000EA5A58EB02CD2068F400")) {
        sVersion = "1.10";
        sOptions = "Borland Delphi/Microsoft Visual C++";
    } else if (PE.compareEP("EB0156E802000000B2D9596880..4100E8020000006532595EEB02CD20BB")) {
        sVersion = "1.10";
        sOptions = "Borland Delphi 2.0";
    } else if (PE.compareEP("F7D80FBEC2BE........0FBEC9BF083B6507EB02D829BBECC59AF8EB0194")) {
        sVersion = "1.10";
        sOptions = "MASM32/TASM32/Microsoft Visual Basic";
    } else if (PE.compareEP("03F723FE33FBEB02CD20BB........EB0186EB0190B8F400000083EE052B")) {
        sVersion = "1.10";
        sOptions = "MASM32/TASM32";
    } else if (PE.compareEP("EB01DBE80200000086435E8D1DD075CF83C1EE1D6850..8F83EB023D0F5A")) {
        sVersion = "1.10";
        sOptions = "MASM32";
    } else if (PE.compareEP("EB0209940FB7FF68........81F68E0000005BEB0211C28D05F400000047")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual Basic/MASM32";
    } else if (PE.compareEP("C1CB10EB010FB90374F6EE0FB6D38D0583....EF80F3F62BC1EB01DE6877")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual Basic 5.0/6.0";
    } else if (PE.compareEP("2C711BCAEB012AEB01658D3580....0080C98480C968BBF4000000EB01EB")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 4.X/LCC Win32 1.X";
    } else if (PE.compareEP("33D20FBED2EB01C7EB01D88D0580......EB02CD20EB01F8BEF4000000EB")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 5.0/6.0";
    } else if (PE.compareEP("E8010000005A5EE802000000BADD5E03F2EB0164BB........8BFAEB01A8")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0/7.0/ASM";
    } else if (PE.compareEP("0BD08BDAE80200000040A05AEB019DB8........EB02CD2003D38D35F400")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0/7.0";
    } else if (PE.compareEP("87FEE80200000098CC5FBB80....00EB02CD2068F4000000E801000000E3")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0/7.0";
    } else if (PE.compareEP("F7D84049EB02E00A8D3580......0FB6C2EB019C8D1DF4000000EB013C80")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0/7.0";
    } else if (PE.compareEP("F7DB80EABFB92F4067BAEB010168AF..A7BA80EA9D58C1C2092BC18BD768")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0/7.0";
    } else if (PE.compareEP("F7D0EB02CD20BEBB741CFBEB02CD20BF3B....FBC1C10333F7EB02CD2068")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0/ASM";
    } else if (PE.compareEP("03DEEB01F8B8........EB02CD206817A0B3ABEB01E8590FB6DB680BA1B3")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("91EB02CD20BF50BC046F91BED0....6FEB02CD202BF7EB02F0468D1DF400")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("C1CE10C1F60F68........2BFA5B23F98D15........E801000000B65E0B")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("E8010000000E59E8010000005858BE........EB0261E968F4000000C1C8")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("EB014D83F64C68........EB02CD205BEB012368481C2B3AE80200000038")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("EB02AB35EB02B5C68D05........C1C211BEF4000000F7DBF7DB0FBE38E8")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("EB02CD20..CF....80....00................00")) {
        sVersion = "1.10";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("C1F007EB02CD20BE........1BC68D1DF40000000FB606EB02CD208A160F")) {
        sVersion = "1.20";
        sOptions = "Borland C++";
    } else if (PE.compareEP("0FBEC1EB010E8D35C3BEB622F7D16843....22EB02B5155FC1F11533F780")) {
        sVersion = "1.20";
        sOptions = "Borland Delphi/Borland C++";
    } else if (PE.compareEP("0FB6D0E8010000000C5AB8........EB0200DE8D35F4000000F7D2EB020E")) {
        sVersion = "1.20";
        sOptions = "Borland Delphi/Microsoft Visual C++";
    } else if (PE.compareEP("33C22CFB8D3D7E45B480E8020000008A45586802..8C7FEB02CD205E80C9")) {
        sVersion = "1.20";
        sOptions = "MASM32/TASM32";
    } else if (PE.compareEP("EB02CD20EB01918D35........33C26883937E7D0CA45B23C36877937E7D")) {
        sVersion = "1.20";
        sOptions = "Microsoft Visual C++ 6.0/7.0";
    } else if (PE.compareEP("C1E006EB02CD20EB0127EB0124BE........49EB01998D1DF4000000EB01")) {
        sVersion = "1.20";
        sOptions = "Microsoft Visual C++ 6.0";
    } else if (PE.compareEP("BB........BF........BE........53BB........B280A4B680FFD373F9")) {
        sVersion = "1.31";
    } else if (PE.compareEP("BE........AD93AD97AD5696B280A4B680FF1373")) {
        sVersion = "1.33";
    } else if (PE.compareEP("BE........AD97AD569683CD..EB")) {
        sVersion = "1.3.3";
    } else if (PE.compareEP("8725........619455A4B6..FF13")) {
        sVersion = "2.0";
    }

    bDetected = bDetected || Boolean(sVersion);

    return result();
}


================================================
FILE: db/PE/packer_Fatpack.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Fatmike-GH/Fatpack
meta("packer", "Fatpack");

function detect() {
    if (!PE.isNet() && PE.is64() && PE.isTLSPresent()) {
        if (PE.getNumberOfImports() === 1 && PE.isImportPositionHashPresent(0, 0x74244911)) {
            bDetected = true;

            if (PE.getNumberOfSections() === 6 && PE.getNumberOfResources() > 0) {
                sOptions = "resources payload";

                if (!PE.isResourceNamePresent("FPACK")) {
                    sOptions = sOptions.append("modified");
                }
            } else if (PE.getNumberOfSections() === 5) {
                sOptions = "section payload";

                if (PE.section[PE.nLastSection].Name !== ".fpack  ") {
                    sOptions = sOptions.append("modified");
                }
            } else {
                sVersion = "custom";
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/packer_HTML_executable.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "HTML Executable");

function detect() {
    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3")) {
        if (PE.compareOverlay("'GHE32'")) {
            bDetected = true;
        }
    } else if (PE.compareEP("558becb9........6a..6a..4975..535657b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3")) {
        if (PE.compareOverlay("'HEEG'")) {
            bDetected = true;
        }
    }

    sLang = "HTML";

    return result();
}

================================================
FILE: db/PE/packer_JDPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "JDPack");

function detect() {
    if (PE.compareEP("60E8000000005D8BD581ED........2B95........81EA06......8995........83BD")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000......E801000000")) {
        sVersion = "2.00";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_KByS.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "KByS");

function detect() {
    if (PE.compareEP("60E8000000005E83EE0A8B0603C28B08894EF383EE0F56528BF0ADAD03C28BD86A04BF00100000")) {
        sVersion = "0.28b";
        bDetected = true;
    } else if (PE.compareEP("68........E801000000C3C3608B7424248B7C2428FCB28033DBA4")) {
        sVersion = "0.28";
        bDetected = true;
    } else if (PE.compareEP("B8........BA........03C2FFE0........60E800000000")) {
        sVersion = "0.28";
        bDetected = true;
    } else if (PE.compareEP("68........90b8........c3608b7424..8b7c24")) {
        sVersion = "0.28b";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_MEW.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "MEW");

function detect() {
    if (PE.compareEP("33C0e9$$$$$$$$be........ac91ad95ad92ad515687f297fcb2..33dba4b3..ff55")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("E9........000000020000000C")) {
        sVersion = "SE 1.0";
        bDetected = true;
    } else if (PE.compareEP("E9......FF0C")) {
        sVersion = "SE 1.1-1.2";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$be........8bdeadad50ad97b2")) {
        sVersion = "SE 1.1-1.2";
        bDetected = true;
    } else if (PE.compareEP("BE5B00....AD91AD9353AD96565FACC0C0")) {
        bDetected = true;
    } else if (PE.compareEP("2BC0E9D090FFFF6AE0E8382B23700EA31C504018186824511007E565F8E8AF7022DD15D8023B558B00EC535756817D0C1060")) {
        sVersion = "10 1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_MPRESS.2.sg
================================================
// Detect It Easy: detection rule file
// Author: ajax, adoxa
// History:
// 13:37 05.02.2013 create (ajax)
//       2014-05-10 rewrite (adoxa)

meta("packer", "MPRESS");

function detect() {
    var nSig = PE.getString(0x2e, 13);
    switch (nSig) {
        case "It's .NET EXE":
        case "Win32 .EXE.\r\n":
        case "Win64 .EXE.\r\n":
        case "Win32 .DLL.\r\n":
        case "Win64 .DLL.\r\n":
            var nOffset = PE.findString(0x1f0, 16, "v");

            if (nOffset != -1) {
                sVersion = PE.getString(nOffset + 1, 0x1ff - nOffset);
            }

            bDetected = true;
            break;
        default:
            sOptions = "modified";
    }

    if (!bDetected && !PE.isNet()) {
        if (PE.compareEP("575653515255e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")) {
            sVersion = "0.71-0.75";
            bDetected = true;
        } else if (PE.compareEP("60e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")) {
            sVersion = "0.77";
            bDetected = true;
        } else if (PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc857498a4439..74..880431eb")) {
            sVersion = "0.85-0.97";
            bDetected = true;
        } else if (PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..74..880431eb")) {
            sVersion = "1.27";
            bDetected = true;
        } else if (PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..88043175")) {
            sVersion = "2.01-2.12";
            bDetected = true;
        }

        if (PE.is64()) {
            if (PE.compareEP("57565351524150e8$$$$$$$$488d05........488b304803f0482bc0488bfe66adc1e0..488bc8ad2bc84803f18bc8ffc98a4439..74..880431eb")) {
                sVersion = "0.71-0.92";
                bDetected = true;
            } else if (PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857ffc98a4439..74..880431eb")) {
                sVersion = "0.97";
                bDetected = true;
            } else if (PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857448bc1ffc98a4439..88043175")) {
                sVersion = "1.27-2.12";
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/packer_MoleBox.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "MoleBox");

function detect() {
    if (PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15")) {
        sVersion = "2.3.3-2.6.4";
        bDetected = true;
    } else if (PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$8b4424..508b4424..50e8$$$$$$$$558bec83ec..5356576a..ff15")) {
        sVersion = "2.3.3-2.6.4";
        bDetected = true;
    } else if (PE.compareEP("60e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15")) {
        sVersion = "2.0.0-2.3.0";
        bDetected = true;
    } else if (PE.compareEP("eb$$b8........8338..74..50ff70..ff3050830424..e8$$$$$$$$558beca1........53568b75..85c0578bde75..6a..68........68........ff15")) {
        sVersion = "2.36";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Mystic_Compressor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Mystic Compressor");

function detect() {
    if (PE.compareEP("558bec83ec..6a..ff35........6a..ff15........8d55..5268........68........ff15........6a..ff35")) {
        bDetected = true;
    } else if (PE.compareEP("558bec83c4..68........ff15........8945..68........ff75..ff15........8945..8d55..526a..68")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_NETZ.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", ".NETZ");

function detect() {
    if (PE.isNetObjectPresent("NetzStarter") && PE.isSignatureInSectionPresent(0, "00'NetzStarter'00'netz'00")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_NOS_Packer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "NOS Packer");

function detect() {
    if (PE.compareEP("50e8000000005b81eb........b9........2bd98bf381eb........8bfb81eb........575156e8........83c4..8bab........8d2c2b4d8a4d..80f9..74..83ed..8bd32b53")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_NTPacker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://hacking-software-free-download.blogspot.com/2013/02/nt-packer-v21.html
meta("packer", "NTPacker");

function detect() {
    if (PE.compareEP("558BEC83C4E05333C08945E08945E48945E88945ECB8........E8....FFFF33C05568")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_NTShell.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "NTSHELL");

function detect() {
    if (PE.compareEP("55e8........5d81ed........eb$$eb$$8d85........8dbd........eb$$8db5........eb$$8bcfeb$$2bc84ffdeb$$33dbeb$$8a07eb$$d2c8eb$$2a....eb$$E8")) {
        sVersion = "5.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_NakedPacker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "NakedPacker");

function detect() {
    if (PE.compareEP("60FC0FB605............7531B8........2B05..............................05........A3........E89A000000A3")) {
        sVersion = "1.0";
        sOptions = "by BigBoote";
        bDetected = true;
    } else if (PE.isSectionNamePresent(".naked1") && PE.compareEP("60")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_NeoLite.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/russdill/Neo-Executable-Decompressor
meta("packer", "NeoLite");

function detect() {
    if (PE.compareEP("8B4424048D5424FC2305........E8........FF35........50FF25")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("E9$$$$$$$$8B44....2305........E8$$$$$$$$5351525657C8......5081ED........8D..........B8........8B1D")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("E9") && (PE.compareEP("'NeoLite'", 29) || PE.compareEP("'NeoLite'", 33))) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("E9A6000000")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("8B4424042305........50E8........83C404FE05........0BC074")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$8b4424..8d5424..2e2305........e8........09c074..2eff35")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8b4424..8d5424..2e2305........e8........09c074..2eff35")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8b4424..8d5424..2305........e8........ff35........50ff25")) {
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$8b4424..8d5424..2305........e8........ff35........50ff25")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$8b4424..2305........e8........fe05........ffe0")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_NodeJS_Nexe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/nexe/nexe
meta("packer", "nexe");

function detect() {
    if (!PE.isExportFunctionPresent("napi_wrap"))
        return;

    // Has overlay at all
    bDetected = PE.isOverlayPresent() && PE.getOverlaySize() >= 0x100 && PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "nexe~~sentinel") !== -1;

    sLang = "JavaScript";

    return result();
}


================================================
FILE: db/PE/packer_NodeJS_Pkg.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/vercel/pkg
meta("packer", "pkg");

function detect() {
    if (!PE.isExportFunctionPresent("napi_wrap"))
        return;

    // Has overlay at all
    bDetected = PE.isOverlayPresent() && PE.getOverlaySize() >= 0x100 && PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "pkg/prelude/bootstrap.js") != -1;

    sLang = "JavaScript";

    return result();
}


================================================
FILE: db/PE/packer_NsPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "NsPack");

function getNSPackVersion() {
    if (PE.section[0].FileSize > 0 && PE.section[0].FileOffset < 0x200) {
        sVersion = "2.X";
    } else if (PE.section[0].FileSize == 0 && PE.section[0].FileOffset >= 0x200) {
        sVersion = "3.X";
    }
}

function detect() {
    var nNumberOfFunctions = PE.getNumberOfImportThunks(0);
    if (nNumberOfFunctions == 6 && !PE.getSizeOfCode()) {
        if (PE.getImportFunctionName(0, 0) == "LoadLibraryA" &&
            PE.getImportFunctionName(0, 1) == "GetProcAddress" &&
            PE.getImportFunctionName(0, 2) == "VirtualProtect" &&
            PE.getImportFunctionName(0, 3) == "VirtualAlloc" &&
            PE.getImportFunctionName(0, 4) == "VirtualFree" &&
            PE.getImportFunctionName(0, 5) == "ExitProcess") {
            getNSPackVersion();
            bDetected = true;
        }
    }
    if (!bDetected) {
        if (PE.isLibraryPresent("mscoree.dll") &&
            PE.getImportLibraryName(0) == "KERNEL32.dll" &&
            PE.getImportFunctionName(0, nNumberOfFunctions - 1) == "GetSystemInfo") {
            getNSPackVersion();
            sOptions = ".NET";
            bDetected = true;
        } else if (PE.isImportPositionHashPresent(0, 0x86111e49) && PE.isNetObjectPresent("nsnet")) {
            sVersion = "3.X";
            bDetected = true;
        } else if (PE.compareEP("9c60e8..........83....8d8d........8039..0f..........c601..8bc5")) {
            sVersion = "3.7";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d9d........8a033c..74..8d9d........8a03")) {
            sVersion = "3.1";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8338..0f..........c700........8bd5")) {
            sVersion = "3.6";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8038..0f..........c600..8bd5")) {
            sVersion = "3.5";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5db8........2be88db5........8a063c..74..8bf5")) {
            sVersion = "2.9";
            bDetected = true;
        } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$e9$$$$$$$$9c60e8........5db8........2be88db5........8b06")) {
            sVersion = "2.3-2.9";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8038..74..8d85........8038..0f84........c600..8bd5")) {
            sVersion = "3.3";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_Nuitka.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research (koffidev365supp@gmail.com)

// Rewritten by DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Nuitka/Nuitka
meta("packer", "Nuitka");

function detect() {
    var dataSection = PE.section[".rdata"]

    if (dataSection && !PE.isRichSignaturePresent()) {
        var dataSectionOffset = dataSection.FileOffset,
            dataSectionSize = dataSection.FileSize;

        if (PE.findString(dataSectionOffset, dataSectionSize, "__nuitka_version__") != -1) {
            bDetected = true;
        } else if (PE.findString(dataSectionOffset, dataSectionSize, "NUITKA_ONEFILE_PARENT") != -1) {
            sOptions = "OneFile";
            bDetected = true;
        }
    }

    sLang = "Python";

    return result();
}

================================================
FILE: db/PE/packer_PACKWIN.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "PACKWIN");

function detect() {
    if (PE.compareEP("8CC0FA8ED0BC....FB060E1F2E........8BF14E8BFE8CDB2E........8EC3FDF3A453B8....50CB")) {
        sVersion = "1.01p";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_PE-PACK.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "PE-PACK");

function detect() {
    if (PE.compareEP("60E8000000005D83ed..80bd..........0f84........c685..........8bc52b..........89..........89")) {
        sVersion = "0.99";
        bDetected = true;
    } else if (PE.compareEP("74..E9$$$$$$$$60E8........5D83ED..80............0F84........C685..........8BC52B..........89")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_PECompact.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "PECompact");

function detect() {
    if (PE.compareEP("EB0668........C39C60BD........B902......B0908DBD........F3AA01AD........FFB5")) {
        sVersion = "0.90-0.92";
        bDetected = true;
    } else if (PE.compareEP("EB0668........C39C60E8........5D555881ED........2B85........0185........50B902")) {
        sVersion = "0.94";
        bDetected = true;
    } else if (PE.compareEP("EB$$9C60E8$$$$$$$$8BC483....938BE38B....81EB........87DD8B85........0185........66C785")) {
        sVersion = "1.68-1.84";
        bDetected = true;
    } else if (PE.compareEP("eb$$9c60e8$$$$$$$$83c4..8b4424..50505b5d81ed........8b85........0185........66c785")) {
        sVersion = "1.00-1.3X";
        bDetected = true;
    } else if (PE.compareEP("eb$$9c60e8$$$$$$$$5d555b81ed........8b85........0185........66c785")) {
        sVersion = "1.00-1.3X";
        bDetected = true;
    } else if (PE.compareEP("33C08BC483C004938BE38B5BFC81")) {
        sVersion = "1.84";
        bDetected = true;
    } else if (PE.compareEP("B8........05........5064FF350000000064892500000000CC90909090")) {
        sVersion = "2.0 beta";
        bDetected = true;
    } else if (PE.compareEP("B8........80002840")) {
        sVersion = "2.X beta version";
        bDetected = true;
    } else if (PE.compareEP("B8........5064FF35000000006489250000000033C08908'PECompact2'00")) {
        sVersion = "3.02.2 or 3.03.21 beta";
        bDetected = true;
    } else if (PE.compareEP("B8........5064FF..........6489..........33C08908")) {
        sVersion = "2.20-3.02";
        bDetected = true;
    } else if (PE.compareEP("B8........5064FF35000000006489250000000033C08908'PEC'")) {
        sVersion = "2.X";
        if (PE.compareEP("32", 27)) {
            sOptions = "Slim Loader";
        }
        bDetected = true;
    } else if (PE.compareEP("B8........5553515756528D98........8B5318528BE86A406800100000FF7304")) {
        sVersion = "2.53-2.76";
        bDetected = true;
    } else if (PE.compareEP("B8........5064ff35........648925........33c0890800000000")) {
        sVersion = "2.78a-3.11";
        bDetected = true;
    } else if (PE.compareEP("b8########b8........5553515756528d98")) {
        bDetected = true;
    }
    if (bDetected) {
        var nOffset = PE.findString(0, 0x600, "PEC2");
        if (nOffset != -1) {
            var nBuildNumber = PE.readDword(nOffset + 4);
            switch (nBuildNumber) {
                case 20206: sVersion = "2.70"; break;
                case 20240: sVersion = "2.78a"; break;
                case 20243: sVersion = "2.79b1"; break;
                case 20245: sVersion = "2.79bB"; break;
                case 20247: sVersion = "2.79bD"; break;
                case 20252: sVersion = "2.80b1"; break;
                case 20256: sVersion = "2.80b5"; break;
                case 20261: sVersion = "2.82"; break;
                case 20285: sVersion = "2.92.0"; break;
                case 20288: sVersion = "2.93b3"; break;
                case 20294: sVersion = "2.96.2"; break;
                case 20295: sVersion = "2.97b1"; break;
                case 20296: sVersion = "2.98"; break;
                case 20300: sVersion = "2.98.04"; break;
                case 20301: sVersion = "2.98.05"; break;
                case 20302: sVersion = "2.98.06"; break;
                case 20303: sVersion = "2.99b"; break;
                case 20308: sVersion = "3.00.2"; break;
                case 20312: sVersion = "3.01.3"; break;
                case 20317: sVersion = "3.02.1"; break;
                case 20318: sVersion = "3.02.2"; break;
                case 20323: sVersion = "3.03.5b"; break;
                case 20327: sVersion = "3.03.9b"; break;
                case 20329: sVersion = "3.03.10b"; break;
                case 20334: sVersion = "3.03.12b"; break;
                case 20342: sVersion = "3.03.18b"; break;
                case 20343: sVersion = "3.03.19b"; break;
                case 20344: sVersion = "3.03.20b"; break;
                case 20345: sVersion = "3.03.21b"; break;
                case 20348: sVersion = "3.03.23b"; break;
                default:
                    if (nBuildNumber) {
                        if (X.isVerbose()) sOptions = "unknown magic: " + nBuildNumber
                    }
            }
        }
    } else if (PE.isNet()) {
        if (PE.isSignaturePresent(0, 512, "00'PEC2XO'000000000000..0000..'.rsrc'00")) {
            sVersion = "2.X-3.X";
            sOptions = ".NET";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'mscoree.dll'000000'CorBindToRuntimeEx'")) {
            sVersion = "2.X-3.X";
            sOptions = ".NET";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_PKLITE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "PKLITE32");

function detect() {
    if (PE.compareEP("68........68........68........e8$$$$$$$$558beca1")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("68........68........B8........2b4424..50e8$$$$$$$$558beca1")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Pack_Master.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Pack Master");

function detect() {
    if (PE.compareEP("60E801000000E883C404E801000000E95D81ED........E804020000E8EB08EB02CD20FF24249A66BE4746")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Packanoid.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Packanoid");

function detect() {
    if (PE.compareEP("BF........BE........E89D000000B8........8B308B7804BB")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Packman.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Packman");

function detect() {
    if (PE.compareEP("0F85..FFFFFF8DB3........EB3D8B460C03C350FF5500568B36")) {
        sVersion = "0.0.0.1";
        bDetected = true;
    } else if (PE.compareEP("60E800000000588D..........8D..........8D")) {
        sVersion = "0.0.0.1";
        bDetected = true;
    } else if (PE.compareEP("60E8000000005B8D5BC6011B8B138D73146A08590116AD4975FA")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_PeX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "PeX");

function detect() {
    if (PE.compareEP("E9$$$$$$$$60e8$$$$$$$$83c404e8")) {
        sVersion = "0.99";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Petite.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Petite");

function detect() {
    if (PE.compareEP("9C60E8CA......03..04..05..06..07..08")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("669C60E8$$$$$$$$582c..508bc88bd081c1........81c2........89208be15081")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("669C60508D8800F000008D90041600008BDC8BE1")) {
        sVersion = "1.3";
        bDetected = true;
    }
    /*else if (PE.compareEP("B8........669C60508BD8030068........6a..ff....8bcc8da0")) {
        sVersion = "1.4";
        bDetected = true;
    }*/
    else if (PE.compareEP("669C60508BD803006854BC00006A00FF50148BCC")) {
        sVersion = "1.4";
        bDetected = true;
    } else if (PE.compareEP("64FF350000000064892500000000669C60508BD8")) {
        sVersion = "2.1-2.3";
        bDetected = true;
    } else if (PE.compareEP("B8........669C60508D..........68........83")) {
        bDetected = true;
    } else if (PE.compareEP("B8........669C60508D88........8d90........8bdc8be168")) {
        sVersion = "1.3, 1.3a";
        bDetected = true;
    }
    /*else if (PE.compareEP("B8........669C60508BD803..6854BC....6A..FF50188BCC8DA054BC")) {
        sVersion = "2.0";
        bDetected = true;
    }*/
    else if (PE.compareEP("B8........6A..68........64FF35........648925........669C6050")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (PE.compareEP("B8........68........64FF35........648925........669C6050")) {
        sVersion = "2.2";
        bDetected = true;
    } else if (PE.compareEP("b8........669c605033db8d90........68........833a..0f84........8b0a")) {
        sVersion = "2.2";
        bDetected = true;
    } else if (PE.compareEP("b8........669c60508bd803..68........6a..ff50")) {
        sVersion = "1.4-2.2";
        bDetected = true;
    } else if (PE.compareEP("B8........608DA8........68........6A40680030000068........6A00FF90........8944241CBB........8DB5........8BF850")) {
        sVersion = "2.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_PyInstaller.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("packer", "PyInstaller"); // python = 💩

includeScript("python");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET files

    const overlaySignatureDetected = PE.compareOverlay("78da");

    if (overlaySignatureDetected) {
        const rdata = PE.section[".rdata"];

        if (rdata &&
            PE.findString(
                rdata.FileOffset,
                rdata.FileSize,
                "PyInstaller: FormatMessageW failed."
            ) != -1) {
            bDetected = true;
        }
    }

    for (var i = 0; i < PE.getNumberOfResources() && !bDetected; i++) {
        const resSize = PE.getResourceSizeByNumber(i);
        if ((
            resSize == 0x909b && // black
            PE.calculateMD5(PE.getResourceOffsetByNumber(i), resSize) == "20d36c0a435caad0ae75d3e5f474650c"
        ) || (
                resSize == 0x952c && // white
                PE.calculateMD5(PE.getResourceOffsetByNumber(i), resSize) == "f6fbada22d6a6c07ef8fdaa504f117d5"
            )) {

            if (!overlaySignatureDetected) {
                sOptions = "custom";
            } else {
                sOptions = PE.section[".rdata"] ? "modified" : "packed";
            }

            bDetected = true;
        }
    }

    if (!bDetected && overlaySignatureDetected && PE.findSignature(
        PE.getOverlayOffset(),
        PE.getOverlaySize(),
        "4d45490c0b0a0b0e"
    ) != -1) {
        sOptions = "overlay";
        bDetected = true;
    }

    var version;

    if (bDetected) {
        for (var i = 0; i < 2 && !version; i++) {
            var sign = PE.findSignature(
                PE.getOverlayOffset(),
                PE.getOverlaySize(),
                "70 79 74 68 6F 6E'" + [2, 3][i] + "'");

            if (sign && PE.findString(sign, 15, ".") != -1) {
                version = getPythonVersionByDll(PE.getString(sign - 1, 15));
            }
        }
    }

    sLang = "Python";
    sLangVersion = version;

    return result();
}


================================================
FILE: db/PE/packer_QuestPowerGUI.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Arjan Onwezen

// Rewritten by: DosX

meta("packer", "Quest PowerGUI");

function detect() {
    bDetected = PE.isNetObjectPresent("Quest.PowerGUI.ScriptRunner");

    sOptions = (bDetected && !PE.isConsole()) ? "Hide console" : "";

    sLang = "PowerShell";

    return result();
}

================================================
FILE: db/PE/packer_RLPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "RLPack");

function detect() {
    // DLL
    var nEP = PE.compareEP("807C2408010F85") ? 11 : 0;
    if (PE.compareEP("608BDDE8000000005D9532C095899D80000000B8", nEP)) {
        sVersion = "0.7.3 beta";
        bDetected = true;
    } else if (PE.compareEP("60E8000000008D6424048B6C24FC8DB5........8D9D........33FF", nEP)) {
        sVersion = "1.0 beta";
        bDetected = true;
    } else if (PE.compareEP("60E8000000008B2C2483C404", nEP)) {
        if (PE.compareEP("33FFEB", nEP + 24)) {
            sVersion = "1.11-1.14";
            sOptions = "aPlib";
        } else if (PE.compareEP("33FF6A", nEP + 24)) {
            sVersion = "1.11-1.14";
            sOptions = "LZMA";
        } else if (PE.compareEP("0000EB", nEP + 29)) {
            sVersion = "1.15-1.18";
            sOptions = "aPlib";
        } else if (PE.compareEP("00006A", nEP + 29)) {
            sVersion = "1.15-1.18";
            sOptions = "LZMA";
        } else if (PE.compareEP("33FFE8", nEP + 55)) {
            sVersion = "1.19-1.20";
            sOptions = "aPlib";
        } else if (PE.compareEP("33FF6A", nEP + 55)) {
            sVersion = "1.19-1.20";
            sOptions = "LZMA";
        } else if (PE.compareEP("EB0FFF", nEP + 56)) {
            sVersion = "1.17 Full Edition";
            sOptions = "aPLib";
        } else if (PE.compareEP("6A4068", nEP + 51)) {
            sVersion = "1.17 Full Edition";
            sOptions = "LZMA";
        } else if (PE.compareEP("33ffe8", nEP + 60)) {
            sVersion = "1.21";
            sOptions = "aPLib";
        }

        bDetected = true;
    } else if (PE.getNumberOfImports() === 1 && PE.compareEP("60") && PE.isSectionNamePresent(".RLPack")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_SC_Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "SC Pack");

function detect() {
    if (PE.compareEP("558bec83c4..5356578d7d..50e8........5825........05........8945")) {
        sVersion = "0.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_SecuPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "SecuPack");

function detect() {
    if (PE.compareEP("558BEC83C4F053565733C08945F0B8CC3A4000E8E0FCFFFF33C05568EA3C400064FF306489206A0068800000006A036A006A")) {
        sVersion = "1.5";
        sOptions = "Soft Stuttgart";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_SerGreen_Appacker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "SerGreen Appacker");

function detect() {
    if (PE.isNet() && PE.compareOverlay("'<SerGreen>'")) {
        sVersion = "1.XX";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_SimplePackerByEronana.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/Eronana/packer
meta("packer", "Eronana");

function detect() {
    if (PE.isSectionNamePresent(".packer") && PE.compareEP("60 68 00 ?? ?? ?? E8 17 FC FF FF 89 45 FC 61 FF 65 FC 00 00 00 00 00 00 00 00 00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_Simple_Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Simple Pack");

function detect() {
    if (PE.compareEP("60e8$$$$$$$$5b8d5b..6a..ff93........89c58b7d..8d74....8dbe........8b86........09c075..8d83........506a..68........55ff93")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("60e8$$$$$$$$5b8d5b..bd........8b7d..8d74....8dbe........0fb776..4e8b47..09c074..0fb747..09c074..6a..68........ff77..6a..ff93")) {
        sVersion = "1.2X";
        bDetected = true;
    } else if ((PE.compareEP("6050") || PE.compareEP("55")) && PE.isSectionNamePresent(".spack")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Software_Compress.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Software Compress");

function detect() {
    if (PE.compareEP("E9BE000000608B7424248B7C2428FCB28033DBA4B302E86D0000")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("E800000000812C24AA1A41005DE800000000832C246E8B855D1A4100")) {
        sVersion = "1.4 LITE";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_Squishy.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Made by KDSS-Research

meta("packer", "Squishy");

function detect() {
    if (PE.isSectionNamePresent("logicoma")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_TPP_Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "TPP Pack");

function detect() {
    if (PE.compareEP("e8$$$$$$$$5d81ed........60e8$$$$$$$$5883c0..ffe0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_TheArk.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("packer", "TheArk");

function detect() {
    if (PE.isSectionNamePresent("adr") && PE.isSectionNamePresent("have") && PE.isSectionNamePresent("30cm") && PE.isSectionNamePresent(".tw")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_UPX.2.sg
================================================
// Detect It Easy: detection rule file
// Authors: horsicq, ajax, adoxa, DosX

meta("packer", "UPX");

function isPatchedUPX() {
    var isDetected = 0,
        nNumberOfFunctions = PE.getNumberOfImportThunks(0);

    if (nNumberOfFunctions > 1 && nNumberOfFunctions < 7) {
        if (PE.getSizeOfCode() && PE.getSizeOfUninitializedData() && PE.section.length > 2 && PE.section[0].FileSize == 0) {
            var funcCounter = 0;

            if (PE.getImportFunctionName(0, 0) == "LoadLibraryA") {
                funcCounter++;
            }

            if (PE.getImportFunctionName(0, 1) == "GetProcAddress") {
                funcCounter++;
            }

            if (nNumberOfFunctions == 4) {
                if (PE.getImportFunctionName(0, 2) == "VirtualProtect") {
                    funcCounter++;
                }

                if (PE.getImportFunctionName(0, 3) == "ExitProcess") {
                    funcCounter++;
                }
            }

            if (nNumberOfFunctions >= 3 && funcCounter < 4) {
                if (PE.getImportFunctionName(0, 2) == "ExitProcess") {
                    funcCounter++;
                } else if (PE.isDll()) {
                    if (PE.getImportFunctionName(0, 2) == "VirtualProtect") {
                        funcCounter++;
                    }
                }
            }

            if (nNumberOfFunctions == 6) {
                if (PE.getImportFunctionName(0, 2) == "VirtualProtect") {
                    funcCounter++;
                }

                if (PE.getImportFunctionName(0, 3) == "VirtualAlloc") {
                    funcCounter++;
                }

                if (PE.getImportFunctionName(0, 4) == "VirtualFree") {
                    funcCounter++;
                }

                if (PE.getImportFunctionName(0, 5) == "ExitProcess") {
                    funcCounter++;
                }
            }

            if (funcCounter == 2 && nNumberOfFunctions == 2 ||
                funcCounter == 3 && nNumberOfFunctions >= 3 ||
                funcCounter == 4 && nNumberOfFunctions == 4 ||
                funcCounter == 6 && nNumberOfFunctions == 6) {
                isDetected = true;
            }

            if (isDetected) {
                if (PE.getAddressOfEntryPoint() == 0x00001018) {
                    // (Win)Upack
                    isDetected = false;
                }
            }
        }
    }

    return isDetected;
}

function getUPXOptions(nOffset) {
    var nMethod = PE.readByte(nOffset + 2),
        nLevel = PE.readByte(nOffset + 3),
        sCompression = "";

    switch (nMethod) // From http://sourceforge.net/p/upx/code/ci/default/tree/src/conf.h
    {
        case 2: case 3:
        case 4: case 5:
        case 6: case 7:
        case 8: case 9:
        case 10: sCompression = "NRV"; break;
        case 14: sCompression = "LZMA"; break;
        case 15: sCompression = "zlib"; break;
    }

    if (sCompression) {
        sOptions = sOptions.append(sCompression);
        if (nLevel == 8) {
            sOptions = sOptions.append("best");
        } else {
            sOptions = sOptions.append("brute");
        }
    }
}

function getUPXVersion() {
    var nOffset1 = PE.findString(0, 1024, "$Id: UPX "),
        nOffset2 = PE.findString(0, 1024, "UPX!");

    if (nOffset2 != -1) {
        getUPXOptions(nOffset2 + 4);
    }

    if (nOffset1 != -1) {
        sVersion = PE.getString(nOffset1 + 9, 4);
    }

    if (!sVersion && nOffset2 != -1) {
        sVersion = PE.getString(nOffset2 - 5, 4);
    }

    if (sVersion) {
        if (+sVersion.toString() != sVersion) {
            if (PE.is64()) {
                sVersion = "3.91+";
            } else {
                sVersion = "0.89+";
            }
            sOptions = "modified";
        }
    }
}

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (!PE.is64()) {
        if (PE.compareEP("60BE........8DBE........57", PE.compareEP("807C") ? 27 : 0)) {
            bDetected = true;
        } else if (PE.compareEP("60e8000000005883e8..508db8........578db0........83cd..31db9090909001db75")) {
            sVersion = "0.70";
            bDetected = true;
        }
    } else {
        if (PE.compareEP("53565755488D35........488DBE........57", PE.compareEP("4889") ? 24 : 0)) {
            bDetected = true;
        }
    }

    getUPXVersion();

    if (sVersion) {
        bDetected = true;
    }

    if (!bDetected) {
        bDetected = isPatchedUPX();
    } else {
        if (!sVersion) {
            if (PE.is64()) {
                sVersion = "3.91+"; // UPX 3.91 was the first version with a PE+ support.
            }

            sOptions = "modified";
        } else if (!PE.isSectionNamePresent("UPX0")) {
            sOptions = sOptions.append("modified");
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_VPacker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "VPacker");

function detect() {
    if (PE.compareEP("60e8$$$$$$$$558bec83c4..5356578b45..83c0..8b008945..837d....75..e8........8945..e8........8b10")) {
        sVersion = "0.02.10";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_VbsToExeConverter.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("packer", "Vbs To Exe Converter");

function detect() {
    if (PE.isImportPositionHashPresent(0, 0x182aac68) && PE.compareEP(PE.is64() ?
            "48 83 EC .. 49 C7 C0 .. .. .. .. 48 31 D2 48 B9 .. .. .. .. .. .. .. .. E8 .. .. .. .. 48 31 C9 E8 .. .. .. .. 48 89 05 .. .. .. .." : // 64 bit
            "68 .. .. .. .. 68 .. .. .. .. 68 .. .. .. .. E8 .. .. .. .. 83 C4 .. 68 .. .. .. .. E8 .. .. .. .. A3 .. .. .. ..")) { // 32 bit
        bDetected = true;
    }

    sLang = "VBScript";

    return result();
}

================================================
FILE: db/PE/packer_WWPack32.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Enhanced by: DosX

// https://www.wwpack32.venti.pl/
meta("packer", "WWPack32");

function detect() {
    if (PE.compareEP("53558be833dbeb$$e8000000005d3e807d....0f84........6083ed..33c033c9")) {
        sVersion = "1.XX";
        bDetected = true;
    } else if (PE.isDll() && PE.section[PE.nLastSection].Name === ".WWP32") {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_WinUpack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "(Win)Upack");

function detect() {
    if (PE.compareEP("BE........AD8BF895A533C033")) {
        sVersion = "0.1X/0.20/0.21/0.24 beta";
    } else if (PE.compareEP("BE........AD8BF86A0495A533C0AB")) {
        sVersion = "0.21 beta";
    } else if (PE.compareEP("BE........AD8BF895AD91F3A5ADB5")) {
        sVersion = "0.24-0.27 beta/0.28 alpha";
    } else if (PE.compareEP("BE........AD50FF7634EB7C4801")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 62)) {
            case 0x37: sVersion = "0.37 beta"; break;
            case 0x38: sVersion = "0.38 beta"; break;
            case 0x39: sVersion = "0.39 final"; break;
            case 0x3A: sVersion = "0.399"; break;
        }
    } else if (PE.compareEP("6A07BE........AD8BF85995F3A5")) {
        sVersion = "0.22/0.23 beta";
    } else if (PE.compareEP("BE........AD50..AD91F3A5")) {
        sVersion = "0.32 beta";
        sOptions = "Patch";
    } else if (PE.compareEP("BE........AD50..AD91..F3A5")) {
        sVersion = "0.32 beta";
    } else if (PE.compareEP("BE........AD50....AD91F3A5")) {
        sVersion = "0.32 beta";
    } else if (PE.compareEP("BE........AD50AD5066BE....6A..BF")) {
        sVersion = "0.34";
    } else if (PE.compareEP("BE........FF36E9C3000000")) {
        sVersion = "0.36 beta";
    } else if (PE.compareEP("60E809000000..................33C95E870E")) {
        sOptions = "Alt stub";
    } else if (PE.compare("4D5A4C6F61644C696272617279410000504500004C0102004B45524E454C3332")) {
        sVersion = "0.33";
    } else if (PE.compare("4D5A4B45524E454C33322E444C4C00004C6F61644C696272617279410000000047657450726F63416464726573730000")) {
        sVersion = "0.32";
    } else if (PE.compare("4D5A4B45524E454C33322E444C4C00005045")) {
        bDetected = true;
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}


================================================
FILE: db/PE/packer_Windows_PE_Packer_by_Chenzs108.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/czs108/Windows-PE-Packer
meta("packer", "Windows PE Packer by Chenzs108");

function detect() {
    if (!PE.is64() && !PE.isNet() &&
        PE.getNumberOfSections() > 2 &&
        PE.getNumberOfImports() === 1 &&
        PE.isImportPositionHashPresent(0, 0x1272f45b)) {
        if (PE.compareEP("60E8E10000002E0002000000000000")) {
            var shellSectionByIndex = PE.section[PE.nLastSection];

            if (shellSectionByIndex.Characteristics & 0xe0000040) { // R/W/X
                bDetected = true;

                if (shellSectionByIndex.Name !== ".shell") {
                    sOptions = "modified sections";
                }
                if (PE.getImportLibraryName(0) !== "Kernel32.dll") {
                    sOptions += (sOptions ? " and " : "modified ") + "IAT";
                }
            }
        }

    }

    return result();
}

================================================
FILE: db/PE/packer_XComp.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "XComp");

function detect() {
    if (PE.getNumberOfImports() == 1 &&
        PE.isImportPositionHashPresent(0, 0x4bc52e77)) { // GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, VirtualProtect
        if (PE.compareEP("68........9C60E8$$$$$$$$E8$$$$$$$$5B5D833B00")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_XPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "XPack");

function detect() {
    if (PE.getNumberOfImports() == 1 &&
        PE.isImportPositionHashPresent(0, 0x6c170ab3)) { // GetProcAddress, LoadLibraryA, VirtualProtect
        if (PE.compareEP("68........9C60E8$$$$$$$$E8$$$$$$$$5B5D833B00")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_aPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "aPack");

function detect() {
    if (PE.compareEP("1E068CC88ED8......8EC050BE....33FFFCB6")) {
        sVersion = "0.62";
        bDetected = true;
    } else if (PE.compareEP("1E068CCBBA....03DA8D......FC33F633FF484B8EC08EDB")) {
        sVersion = "0.82";
        bDetected = true;
    } else if (PE.compareEP("1E068CC88ED805....8EC050BE....33FFFCB2..BD....33C950A4BB....3BF376")) {
        sVersion = "0.98";
        sOptions = "-m";
        bDetected = true;
    } else if (PE.compareEP("8CCBBA....03DAFC33F633FF4B8EDB8D......8EC0B9....F3A54A75")) {
        sVersion = "0.98b";
        bDetected = true;
    } else if (PE.compareEP("93071F05....8ED0BC....EA")) { // exe
        sVersion = "0.98b";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_dePACK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "dePack");

function detect() {
    if (PE.compareEP("eb$$6068........68........e8$$$$$$$$558bec60558b75..8b7d..e8........eb..8b1c24c3")) {
        bDetected = true;
    } else if (PE.compareEP("eb$$6090eb$$61b8........ffe0")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_ezip.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "ezip");

function detect() {
    if (PE.isOverlayPresent()) {
        if (PE.compareEP("E919320000E97C2A0000E919240000E9FF230000E91E2E0000E9882E0000E92C250000E9AE150000E9772B0000E987020000E9702E")) {
            bDetected = true;
            sVersion = "1.X";
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_hXOR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

// https://github.com/akuafif/hXOR-Packer
meta("packer", "hXOR");

function detect() {
    if (PE.compareEP("5589e583ec18c7042402000000ff1538424100e8f8feffff908db426000000005589e583ec18c7042401000000ff1538424100e8d8feffff908db426000000005589e55383ec148b45088b008b003d")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_hmimys_PE-Pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "hmimys PE-Pack");

function detect() {
    if (PE.compareEP("E8000000005D83ED056A00FF95E10E00008985850E00008B583C03D881C3F8000000")) {
        sVersion = "0.1";
        bDetected = true;
    } else if (PE.compareEP("5E83C664AD50AD5083EE6CAD50AD50AD50AD50AD50E8E707")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$5EAD50AD5097AD50AD50AD50E8C0010000AD50AD9387DEB9")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.isSectionNamePresent("hmimys")) {
        if (PE.compareEP("E8")) {
            sVersion = "1.3";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_kkrunchy.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "kkrunchy");

function detect() {
    if (PE.compareEP("BD........C745..........B8........89450489455450C74510")) {
        sVersion = "0.23 alpha 2";
        bDetected = true;
    } else if (PE.compareEP("BD........C745..........FF4D08C6450C058D7D1431C0B40489C1F3ABBF")) {
        sVersion = "0.2X";
        bDetected = true;
    } else if (PE.compareEP("bd........c7............fcff4d0831d28d7d30be")) {
        bDetected = true;
    } else if (PE.compare("'MZfarbrauschPE'")) {
        bDetected = true;
    }

    if (bDetected && !PE.isSectionNamePresent("kkrunchy")) {
        sOptions = "modified";
    }

    return result();
}


================================================
FILE: db/PE/packer_mPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "mPack");

function detect() {
    if (PE.compareEP("E90000000060E8140000005D81ED000000006A45E8A30000006800000000E85861E8AA0000004E")) {
        sVersion = "0.0.2";
        bDetected = true;
    } else if (PE.compareEP("558BEC83....33C08945F0B8........E867C4FFFF33C05568........64FF306489208D55F033C0E893C8FFFF")) {
        sVersion = "0.0.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/packer_mkfPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "mkfPack");

function detect() {
    if (PE.compareEP("e8$$$$$$$$5b81eb........8b93........536a..68........526a..ff93........5b8bf08bbb........03fb5657e8........83c4..8d93........5253ffe6")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_nPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "nPack");

function detect() {
    if (PE.compareEP("833D..........7505E901000000C3E841000000B8........2B05........A3........E85E000000E8")) {
        switch (PE.getEntryPointSignature(42, 7)) {
            case "E0010000E8EC06": sVersion = "1.1.150.2006.Beta"; break;
            case "EC010000E8F806": sVersion = "1.1.200.2006.Beta"; break;
            default: sVersion = "1.1.XXX";
        }

        bDetected = true;
    } else if (PE.compareEP("833D..........7505E901000000C3E846000000E873000000B8........2B05........A3........E89C000000E8")) {
        switch (PE.readDword(PE.getEntryPointOffset() + 47)) {
            case 0x204: sVersion = "1.1.250.2006.Beta"; break;
            case 0x22D: sVersion = "1.1.300.2006.Beta"; break;
            case 0x248: sVersion = "1.1.800.2008.Beta"; break;
            default: sVersion = "1.1.XXX";
        }

        bDetected = true;
    } else if (PE.compareEP("833C24..0F84........8D6424") && PE.isImportPositionHashPresent(0, 0xba8bf4be)) {
        bDetected = true;
    }

    if (bDetected && !PE.isSectionNamePresent(".nPack")) {
        sOptions = "modified";
    }

    return result();
}


================================================
FILE: db/PE/packer_netshrink.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", ".netshrink");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "20fe2b136028........13..203b28136028........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            sOptions = "Encrypted/Password mode";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "20ad65133228........13..206866133228........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            sOptions = "Encrypted/Password mode";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "20b9059f0728........13..2066059f0728........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "20e6ea19be28........13..2039ea19be28........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/packer_ps2exe.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/MScholtes/PS2EXE
meta("packer", "PS2EXE");

function detect() {
    bDetected = PE.isNetUStringPresent("^-([^: ]+)[ :]?([^:]*)$");

    sLang = "PowerShell";

    return result();
}

================================================
FILE: db/PE/packer_py2exe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "py2exe");

function detect() {
    for (var i = 0; i < PE.getNumberOfResources(); i++) {
        // py2exe magic number
        if (PE.compare("12345678", PE.resource[i].Offset)) {
            bDetected = true;
            break;
        }
    }

    sLang = "Python";

    return result();
}


================================================
FILE: db/PE/packer_scr2exe.2.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// Edited: DosX

// www.screen-record.com/screen2exe.htm

meta("packer", "SCREEN2EXE/SCREEN2SWF");

function detect() {
    var rdataSection = PE.section[".rdata"];

    if (!PE.is64() && PE.compareEP("E8........E9........8BFF558BEC83EC..5356") && rdataSection && PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Video created by SCREEN2EXE/SCREEN2SWF") != -1) {
        sVersion = PE.getFileVersion().split(", ").join(".");
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/packer_yzPack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "yzPack");

function detect() {
    if (PE.compareEP("6033C08D480750E2FD8BEC648B4030780C8B400C")) {
        sVersion = "1.0-1.1";
        bDetected = true;
    } else if (PE.compareEP("4D5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")) {
        sVersion = "1.12";
        bDetected = true;
    } else if (PE.compareEP("25........6187CC5545455581EDCA00000055A4B302FF142473F833C9FF1424731833C0FF1424731FB3")) {
        sVersion = "2.0";
        bDetected = true;
    }
    /* else if (PE.isSignaturePresent(0, 512, "'MZKERNEL32'")) { // false detect (Win)Upack
        sVersion = "2.0";
        bDetected = true;
    } */

    return result();
}


================================================
FILE: db/PE/patcher_CodeFusion_Wizard.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "CodeFusion Wizard");

function detect() {
    if (PE.compareEP("558bec83c4..535657e8........e8........33c05568........64ff30648920e8........e8........a3........833d")) {
        if (PE.compareOverlay("'@._P-DATA_.@'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/patcher_PMaker.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "PMAKER");

function detect() {
    if (PE.compareEP("68........e8........6a..e8........a3........8b58..03d80fb743..0fb74b..8d7c18..813f........74..83c7")) {
        sVersion = "0.9";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/patcher_RPP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "R!SC Process Patcher");

function detect() {
    if (PE.compareEP("68........c705................68........68........6a..6a..6a..6a..6a..6a..6a..68........e8")) {
        sVersion = "1.X";
        sOptions = "by R!SC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/patcher_RTPatch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "RTPatch");

function detect() {
    if (PE.compareOverlay("4B2A9A") || PE.compareOverlay("4B2A84")) {
        if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
            sVersion = "10.50";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/patcher_dUP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "dUP diablo2oo2's Universal Patcher");

function detect() {
    if (PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68")) {
        if (PE.getNumberOfResources() > 0) {
            nOffset = PE.getResourceNameOffset("DLL"); {
                if (PE.compare("a2", nOffset)) {
                    sVersion = "2.0";
                    bDetected = true;
                }
            }
        }

    }

    return result();
}

================================================
FILE: db/PE/patcher_simple_patch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "simple patch");

function detect() {
    if (PE.compareEP("33c040c2")) {
        bDetected = true;
    } else if (PE.compareEP("33c0c3")) {
        bDetected = true;
    } else if (PE.compareEP("b801000000c2")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/player_Power_Screen_Recorder.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("player", "Power Screen Recorder");

function detect() {
    if (PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8")) {
        if (PE.findSignature(PE.getSize() - 0x500, 0x500, "'xzjtlx'") != -1) {
            sVersion = "6.X-7.X";
            sOptions = "by www.tlxsoft.com";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_BattlEye.5.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.battleye.com/
meta("protection", "BattlEye");

function detect() {
    if (PE.getSectionNameCollision("0", "1") === ".be" && // VMProtect'ed
        (PE.isLibraryPresentExp(/ntdll/) || PE.isFunctionPresent("CryptCATAdminAcquireContext")) &&
        PE.isSigned()) {
        bDetected = true;

        if (PE.isSignaturePresent(0x00, PE.getSize() - PE.getOverlaySize(), "'https://cdn.battleye.com/%S/%s/%s'")) {
            sVersion = "Launcher";
        }
    }

    return result();
}


================================================
FILE: db/PE/protection_DS.Eutron_SmartKey_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Eutron SmartKey dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "skeydrv.dll") !== -1) {
        bDetected = true;
    } else {
        var nOffset = 0;
        var foundOffset;
        while ((foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\")) !== -1) {
            nOffset = foundOffset + 4;
            if (PE.compare("'eusk2'", nOffset) ||
                PE.compare("'Skey-'", nOffset) ||
                PE.compare("'SkeyDev'", nOffset)) {
                bDetected = true;
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.HASP_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "HASP dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "HASPDOSDRV") != -1 ||
        PE.findString(0, nSize, "HASPUT16.DLL") != -1) {
        bDetected = true;
    } else if ((PE.isLibraryPresent("MSVBVM60.DLL") || PE.isLibraryPresent("MSVBVM50.DLL")) && PE.findString(0, nSize, "haspvb32.dll") !== -1) {
        sVersion = "Visual Basic";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.Hardlock_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Hardlock dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    var nOffset = 0;
    var foundOffset;
    while (true) {
        foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\");
        if (foundOffset === -1) break;
        nOffset = foundOffset + 4;
        if (PE.compare("'HARDLOCK.VXD'", nOffset) ||
            PE.compare("'FEnteDev'", nOffset)) {
            bDetected = true;
            break;
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.MARX_Crypto-Box_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "MARX Crypto-Box dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "MARXDEV1.SYS") !== -1) {
        bDetected = true;
    } else {
        var nOffset = 0;
        var foundOffset;
        while (true) {
            foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\");
            if (foundOffset === -1) break;
            nOffset = foundOffset + 4;
            if (PE.compare("'MARXDEV'", nOffset) ||
                PE.compare("'Cb7Dev'", nOffset) ||
                PE.compare("'CB7'", nOffset) ||
                PE.compare("'CBUSB'", nOffset)) {
                bDetected = true;
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.Matrix_Hardware_Lock_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Matrix Hardware Lock dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "MxLPT_Sem") !== -1 ||
        PE.findString(0, nSize, "MxUSB_Sem") !== -1) { // PE.findString(0, nSize, "MATRIX.INI") != -1
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.NetHASP_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "NetHASP dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "NETHASP_00112233445566zz") !== -1 ||
        PE.findString(0, nSize, "nethasp.ini") !== -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.SenseLock_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "SenseLock dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "sense4.dll") !== -1 ||
        PE.findString(0, nSize, "S4Open") !== -1) {

        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.Sentinel_SuperPro_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Sentinel SuperPro dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    // Originally searched for "RNBOsproInitialize", "RNBOsproGetKeyInfo" and
    // "RNBOsproGetVersion", but this should be enough.
    if (PE.findString(0, nSize, "RNBOspro") !== -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.Sentinel_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Rainbow Sentinel dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "SNTNLUSB") !== -1) {
        bDetected = true;
    } else {
        var nOffset = 0;
        var foundOffset;

        while (true) {
            foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\");
            if (foundOffset === -1) break;
            nOffset = foundOffset + 4;
            if (PE.compare("'SENTINEL.VXD'", nOffset) ||
                PE.compare("'SntnlUsb'", nOffset)) {
                bDetected = true;
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.SoftLok_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "SoftLok dongle reference");

function detect() {
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findSignature(0, nSize, "5c5c2e5c'MNXX'") !== -1 || PE.findSignature(0, nSize, "5c5c2e5c'SoftLok'") !== -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.Unikey_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Unikey/Activator dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "SSIVDDP.DLL") !== -1 ||
        PE.findSignature(0, nSize, "5C004400650076006900630065005C005300530049005000440044005000") !== -1) { // L"\\Device\\SSIPDDP"
        bDetected = true;
    } else {
        var nOffset = 0;
        var foundOffset;
        while (true) {
            foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\");
            if (foundOffset === -1) break;
            nOffset = foundOffset + 4;
            if (PE.compare("'SSIPDDP'", nOffset) ||
                PE.compare("'PIPE\\SSINetPipe'", nOffset)) {
                bDetected = true;
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_DS.WIBU_Key_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "WIBU Key dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "WIBUKEY") !== -1 ||
        PE.findString(0, nSize, "WkWin32.dll") !== -1 ||
        PE.findString(0, nSize, "WKWIN32.DLL") !== -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_HASP_HL_Protection.5.sg
================================================
// Detect It Easy: detection rule file
// Author: ajax
// History:
// 23:45 16.01.2013 add HASP SRM x32 1.X and HASP SRM x64 1.x
// 15:40 19.01.2013 change name
//  0:01 12.02.2013 add HASP 4/HL x32

meta("protection", "HASP HL/SRM");

function detect() {
    if (!PE.is64()) {
        if (PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........74..8b0d........51ff15")) {
            sVersion = "4.X";
            sOptions = "HL";
            bDetected = true;
        } else if (PE.compareEP("57565351E801000000..5805........508B3003F02BC08BFE66AD")) {
            sVersion = "1.X";
            sOptions = "SRM";
            bDetected = true;
        } else if (PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........0f84........a1........50ff15")) {
            sVersion = "1.X";
            sOptions = "HL";
            bDetected = true;
        }
    } else {
        if (PE.compareEP("5750569C53515241504151488D05........488B304803F0482BC0488BFE66AD")) {
            sVersion = "1.X";
            sOptions = "SRM";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_Microsoft_Warbird.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protection", "Microsoft Warbird");

function detect() {
    bDetected = PE.section["?g_Encry"] && PE.isFunctionPresent("NtQuerySystemInformation");

    if (bDetected && PE.findSignature(0, PE.getSize() - PE.getOverlaySize(), "'?g_EncryptedSegmentSystemCall_"))
        sOptions = "VM";

    return result();
}

================================================
FILE: db/PE/protection_Softlocx.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Softlocx");

function detect() {
    if (PE.compareEP("eb$$55e8000000005d81ed........8bc555609c2b85........8985........ff74")) {
        sVersion = "6.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_SteamStub.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://gameindustry.eu/blog/steamstub-drm/
meta("protection", "SteamStub");

function detect() {
    if (PE.compareEP("e800000000505351525657558b4424..2d........8bcc83e4..51515150e8........83c4..5959598be1894424..5d5f5e5a595b58c3")) {
        bDetected = true;
    } else if (PE.compareEP("e8000000005053515256575541504151415241534154415541564157488b4c24..4881e9........488bc44883e4..50504883ec..e8........4883c4..5959")) {
        sOptions = "x64";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protection_Wibu_Codemeter.1.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("protection", "Wibu Codemeter");

function detect() {
    var nFound = 0;
    var nOffset;

    for (var i = 0; i <= PE.nLastSection; i++) {
        nOffset = PE.section[i].FileOffset;
        sSection = PE.section[i].Name;
        if (sSection == "__wibu00") {
            ++nFound;
        } else if (sSection == "__wibu01") {
            ++nFound;
        }
        // actually you may see many more __wibuXX sections,
        // we test just first two
        if (nFound == 2) {
            bDetected = true;
            break;
        }
    }

    return result();
}

================================================
FILE: db/PE/protection_obfus_h.5.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/obfus.h
meta("protection", "obfus.h");

function detect() {
    if ((PE.section[".obfh"] || PE.isExportFunctionPresent("WhatSoundDoesACowMake")) && PE.isFunctionPresent("vsprintf"))
        bDetected = true;

    sLang = "C";

    return result();
}

================================================
FILE: db/PE/protection_obfusheader_h.5.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ac3ss0r/obfusheader.h
meta("protection", "obfusheader.h");

function detect() {
    if (PE.section[".rdata"] && PE.isFunctionPresent("LoadLibraryA") && PE.isFunctionPresent("GetProcAddress") && PE.isSignaturePresent(
        PE.section[0].FileOffset, PE.getSize() - PE.getOverlaySize(),
        "00 'Stop reversing the ' ** ** ** **")) {
        bDetected = true;
    }

    const dataSection = PE.section[".data"];
    if (dataSection && PE.compare("6162636465666768696A6B6C6D6E6F707172737475767778797A534C41494450", dataSection.FileOffset)) {
        sOptions = "data consts";
        bDetected = true;
    }

    if (bDetected && PE.section[".vmp0"]) {
        sOptions = sOptions.append("fake signs");
        _removeResult("protector", ["Enigma", "SecuROM", "Denuvo", "Themida/Winlicense"]);
    }

    sLang = "C++";

    return result();
}

================================================
FILE: db/PE/protector_ACProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ACProtect");

function detect() {
    if (PE.compareEP("60F950E801000000..58584950E801000000..5858790466B9B872E801000000")) {
        sVersion = "1.09g";
    } else if (PE.compareEP("E801000000..83")) {
        sVersion = "1.41";
    } else if (PE.compareEP("6050E801000000..83")) {
        sVersion = "1.3X";
    } else if (PE.compareEP("60E801000000..83042406C3")) {
        sVersion = "1.4X";
    } else if (PE.compareEP("600F87020000001BF8E801000000..83042406C3")) {
        sVersion = "1.90g";
    } else if (PE.compareEP("68........68........C3C3")) {
        sVersion = "2.0.X";
    } else {
        var perplexSection = PE.section[".perplex"];

        if (perplexSection && (perplexSection.Characteristics & 0xe0000060)) {
            sVersion = "1.X";
        }
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}


================================================
FILE: db/PE/protector_AHTeam_EP_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "AHTeam EP Protector");

function detect() {
    if (PE.compareEP("90") && PE.compareEP("90FFE0", 47)) {
        sVersion = "0.3";
        bDetected = true;

        if (PE.compareEP("60E8........5EB9000000002BC0", 50)) {
            sOptions = "fake k.kryptor 9/kryptor a";
        } else if (PE.compareEP("6A0068........E8........BF", 50)) {
            sOptions = "fake Microsoft Visual C++ 7.0";
        } else switch (PE.getEntryPointSignature(50, 14)) {
            case "60E803000000E9EB045D4555C3E8": sOptions = "fake ASPack 2.12"; break;
            case "60E801000000905D81ED00000000": sOptions = "fake ASProtect 1.0"; break;
            case "538BD833C0A3000000006A00E800": sOptions = "fake Borland Delphi 6.0-7.0"; break;
            case "FC5550E8000000005DEB01E360E8": sOptions = "fake PCGuard 4.03-4.15"; break;
            case "EB03CD20C71EEB03CD20EA9CEB02": sOptions = "fake PE Lock NT 2.04"; break;
            case "E8000000005B83EB05EB04524E44": sOptions = "fake PE-Crypt 1.02"; break;
            case "60E800000000414E414B494E5D83": sOptions = "fake PESHiELD 2.X"; break;
            case "B800000000680000000064FF3500": sOptions = "fake PEtite 2.2"; break;
            case "9C608B442424E8000000005D81ED": sOptions = "fake Spalsher 1.X-3.X"; break;
            case "535152565755E8000000005D81ED": sOptions = "fake Stone's PE Encryptor 2.0"; break;
            case "60E8000000005D81ED06000000EB": sOptions = "fake SVKP 1.3X"; break;
            case "E90000000060E8000000005883C0": sOptions = "fake tElock 0.61"; break;
            case "EB16A85400004741424C4B434743": sOptions = "fake VIRUS/I-Worm Hybris"; break;
            case "5F81EF00000000BE000040008B87": sOptions = "fake VOB ProtectCD"; break;
            case "E8000000005D8100000000006A45": sOptions = "fake Xtreme-Protector 1.05"; break;
            case "E912000000000000000000000000": sOptions = "fake ZCode 1.01"; break;
        }
    } else if (PE.compareEP("55908bec906aff9090")) {
        sVersion = "0.3";
        sOptions = "alt";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_ASM_Guard.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/DosX-dev/ASM-Guard
meta("protector", "ASM Guard");

function detect() {
    if (PE.isOverlayPresent()) {
        if (PE.isSectionNamePresent("ASMGUARD")) {
            sVersion = "2.XX";
            sOptions = "shell mutation";
            bDetected = true;
        } else if (PE.isResourceNamePresent("NT.DLL")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_ASProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ASProtect");

function detect() {
    if (PE.compareEP("6801......E801000000C3C3")) {
        sVersion = "1.23-2.56";
    } else if (PE.compareEP("68########9060e8$$$$$$$$5d4555c3")) {
        sVersion = "SKE 2.1-2.2";
    } else if (PE.compareEP("68########60e8$$$$$$$$5d4555c3")) {
        sVersion = "SKE 2.3-2.5";
    } else if (PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00......807D4D01750C8B74242883FE01895D4E75318D45535053FFB5ED0900008D453550E9820000000000000000000000000000000000")) {
        sVersion = "SKE 2.1/2.2";
    } else if (PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00......807D4D01750C8B74242883FE01895D4E75318D45535053FFB5ED0900008D453550E98200000000000000000000000000000000")) {
        sVersion = "SKE 2.1/2.2";
    } else if (PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00......807D4D01750C8B74242883FE01895D4E75318D45535053FFB5E50B00008D453550E98200000000000000000000000000000000")) {
        sVersion = "SKE 2.3";
    } else if (PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00....00807D4D01750C8B74242883FE01895D4E75318D45535053FFB5DD0900008D453550E98200000000000000000000000000000000")) {
        bDetected = true;
    } else if (PE.compareEP("60E801000000905D81ED........BB........03DD2B9D")) {
        sVersion = "1.0";
    } else if (PE.compareEP("60E9..05")) {
        sVersion = "1.1 BRS";
    } else if (PE.compareEP("60E9........9178797979E9")) {
        sVersion = "1.1 MTE";
    } else if (PE.compareEP("9060E9..04")) {
        sVersion = "1.1 MTEb";
    } else if (PE.compareEP("9060E81B......E9FC")) {
        sVersion = "MTEc";
    } else if (PE.compareEP("60E9..04....E9..............EE")) {
        sVersion = "1.1";
    } else if (PE.compareEP("60E9$$$$$$$$81da........e8$$$$$$$$0fbffe0fbffd")) {
        sVersion = "1.1";
    } else if (PE.compareEP("6801......C3")) {
        sVersion = "1.2";
    } else if (PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB........807D4D01750C8B74242883FE01895D4E75318D45535053FFB5D50900008D453550E98200000000000000000000000000000000")) {
        sVersion = "1.23 RC4 build 08.07";
    } else if (PE.compareEP("60E8........E9........05........B9........AD35........AB4975F6EB045D4555C3")) {
        sVersion = "1.1";
    }

    bDetected = bDetected || Boolean(sVersion);

    return result();
}


================================================
FILE: db/PE/protector_AT4RE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://bbs.kanxue.com/thread-67920-1.htm
meta("protector", "AT4RE");

function detect() {
    if (PE.compareEP("0f3133c903c8eb$$0f312bc13d........0f83........e9$$$$$$$$b8........33f633db8a1c0680eb")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_AZProtect_0001.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://forum.hellroom.ru/index.php?topic=17435.0
meta("protector", "AZProtect 0001");

function detect() {
    if (PE.compareEP("EB70FC608C804D110070258100400D91BB608C804D11007021811D610D810040CE608C804D11007025812581258125812961418131611D610040B730")) {
        bDetected = true;

        if (!PE.isSectionNamePresent("AZPR0001")) {
            sOptions = "modified";
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_AbyssMedia_ScriptCryptor.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.abyssmedia.com/scriptcryptor/
meta("protector", "ScriptCryptor");

function detect() {
    if (PE.isNet() || PE.isRichSignaturePresent() || !PE.getNumberOfExports()) return; // Doesn't support .NET, files with Rich Signature and without exports

    if (PE.isResourceNamePresent("AOPT") && PE.isImportPositionHashPresent(0, 0xcf603a7d) && PE.getNumberOfImports() === 15) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_ActiveMark.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ActiveMARK");

function detect() {
    if (PE.compareOverlay("00'TMSAMVOH'")) {
        sVersion = "5.X";
        bDetected = true;
    } else if (PE.compareEP("8925........EB")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Agile.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Agile");

function detect() {
    if (_getNumberOfResults("protector") <= 2 && PE.isNetObjectPresent("ObfuscatedByAgileDotNetAttribute")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Alcatraz.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

// https://github.com/weak1337/Alcatraz
// https://www.elastic.co/security-labs/deobfuscating-alcatraz (protector was used in doubleloader)
meta("protector", "Alcatraz");

function detect() {
    if (PE.isSectionNamePresent(".0Dev")) { // need more samples
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Alienyze.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev
// ---
// First version of detect made by KDSS-Research

// https://alienyze.com/
meta("protector", "Alienyze");

function detect() {
    bDetected = PE.compareEP("55 8b ec") && !PE.getNumberOfImports() && PE.getNumberOfSections() > 4 && PE.getSectionFileOffset(0) == 0x00;

    if (bDetected && PE.isSignaturePresent(0, PE.getSize(), "540068006900730020006D00650073007300610067006500200077006F006E002700740020006100")) {
        sVersion = "demo";
    }

    if (bDetected && !PE.isSectionNamePresent(".alien")) {
        sOptions = "modified";
    }

    return result();
}

================================================
FILE: db/PE/protector_AntiDote.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "AntiDote");

function detect() {
    if (PE.compareEP("E8BBFFFFFF84C0742F680401000068C02360006A00FF1508106000E840FFFFFF50")) {
        sVersion = "1.0 Beta";
        bDetected = true;
    } else if (PE.compareEP("6869D60000E8C6FDFFFF6869D60000E8BCFDFFFF83C408E8A4FFFFFF84C074")) {
        sVersion = "1.2 Beta";
        bDetected = true;
    } else if (PE.compareEP("e8$$$$$$$$e8000000005853515657508b1c2481")) {
        sVersion = "1.2 Demo";
        bDetected = true;
    } else if (PE.compareEP("EB1066623A432B2B484F4F4B90E9083290909090909090909090807C240801")) {
        sVersion = "1.2 Demo";
        bDetected = true;
    } else if (PE.compareEP("6890030000E8C6FDFFFF6890030000E8BCFDFFFF6890030000E8B2FDFFFF50")) {
        sVersion = "1.4 SE";
        bDetected = true;
    } else if (PE.compareEP("E8F7FEFFFF05CB220000FFE0E8EBFEFFFF05BB190000FFE0E8BD00000008B2")) {
        sVersion = "1.2 Demo";
        bDetected = true;
    } else if (PE.compareEP("6895010000E8D0FDFFFF6895010000E8C3FDFFFF6890030000E8BCFDFFFF68")) {
        sVersion = "1.4 osCE";
        bDetected = true;
    } else if (PE.compareEP("68....0000E8..FDFFFF68....0000E8..FDFFFF6890030000E8..FDFFFF")) {
        sVersion = "1.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Anticrack_Software.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.softpedia.com/get/Security/Encrypting/Anti-Crack-Software-Protector-Basic.shtml
meta("protector", "AntiCrack Software Basic");

function detect() {
    if (PE.compareEP("60..................E801000000............................................0000......04")) {
        sVersion = "1.09";
        bDetected = true;
    } else if (PE.compareEP("60................0000........................E801000000..83042406C3..........00")) {
        sVersion = "1.09";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_ArmDot.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.armdot.com/
meta("protector", "ArmDot");

function detect() {
    if (PE.isNet() &&
        PE.isSignatureInSectionPresent(0, "20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. ..") &&
        PE.isSignatureInSectionPresent(0, "20 .. .. .. .. FE 0C .. .. 3F .. .. 00 00 20 .. .. .. .. FE 0C .. .. 3D .. .. 00 00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Armadillo.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Armadillo");

function detect() {
    if (PE.compareEP("60E8000000005D50510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D1595850510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08")) {
        sVersion = "3.X-9.X";
        bDetected = true;
    } else if (PE.compareEP("558BEC83EC0C5356578B450850FF15........83C4048945FC8B45FC51B900080000B906000000")) {
        sVersion = "4.44a public build";
        bDetected = true;
    } else if (PE.compareEP("E8E3400000E916FEFFFF6A0C68........E8441500008B4D0833FF3BCF762E6AE05833D2F7F13B")) {
        sVersion = "5.00";
        bDetected = true;
    } else if (PE.compareEP("837C2408017505E8DE4B0000FF7424048B4C24108B54240CE8EDFEFFFF59C20C006A0C68")) {
        sVersion = "5.00";
        sOptions = "DLL";
        bDetected = true;
    } else if (PE.compareEP("6A..8BB5........C1E6048B85........2507....8079054883C8F84033C98A88........8B95........81E207....8079054A83CAF84233C08A82")) {
        sVersion = "2.XX";
        sOptions = "CopyMem II";
        bDetected = true;
    } else if (PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959586033C9")) {
        sVersion = "3.00";
        bDetected = true;
    } else if (PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB")) {
        sVersion = "3.00a-3.70a";
        bDetected = true;
    } else {
        if (PE.getMajorLinkerVersion() == 0x53 && PE.getMinorLinkerVersion() == 0x52) {
            for (var i = 0; i <= PE.nLastSection; i++) {
                if (PE.compare("'PDATA000'", PE.section[i].FileOffset)) {
                    sVersion = "6.X-9.X";
                    break;
                }
            }
            if (!sVersion) {
                if (PE.section.length > 7) {
                    sVersion = "6.X-9.X";
                }
            }
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Arxan.2.sg
================================================
// Detect It Easy: detection rule file
// Author: securitystar

meta("protector", "Arxan");

function detect() {
    if (PE.is64() && !PE.isNet()) {
        if (PE.compareEP("40 50 40 51 40 52 40 53 55 56 57 9C 48 83 EC 38 FC B8 01 00 00 00 B9 FF FF 00 00 E0 FE")) {
            bDetected = true;
            sVersion = "GuardIT ~2013";
        } else {
            var ep = skipJumpsAndNops(PE.getEntryPointOffset()),
                rva = PE.compare("48 83 EC 28 E8", ep) ? PE.OffsetToRVA(ep) + PE.readSDword(ep + 5) + 9 : PE.OffsetToRVA(ep);

            if (rva != -1) {
                var addr = PE.OffsetToVA(PE.RVAToOffset(rva));
                const limit = 32;

                var pushCount = 0;

                for (var i = 0; i < limit; i++) {
                    if (PE.getDisasmString(addr).indexOf("PUSH") !== 0) break;
                    pushCount++;
                    addr = PE.getDisasmNextAddress(addr);
                }

                if (pushCount > 3 && PE.getDisasmString(addr).indexOf("LEA RSP,") === 0) {
                    addr = PE.getDisasmNextAddress(addr);

                    var movupdCount = 0;
                    for (var i = 0; i < limit; i++) {
                        if (PE.getDisasmString(addr).indexOf("MOVUPD") !== 0) break;
                        movupdCount++;
                        addr = PE.getDisasmNextAddress(addr);
                    }

                    if (movupdCount > 0 &&
                        PE.getDisasmString(addr) === "PUSH 0X10" &&
                        PE.getDisasmString(PE.getDisasmNextAddress(addr)) === "TEST RSP, 0XF") {

                        bDetected = true;
                        sVersion = "GuardIT ";
                        sVersion += (pushCount < 14 || movupdCount < 16) ? "12.0+" : "2014-2021";
                    }
                }
            }
        }
    }

    return result();
}

function skipJumpsAndNops(offset) {
    var rva = PE.OffsetToRVA(offset);
    while (true) {
        const byte = PE.readByte(PE.RVAToOffset(rva));
        if (byte === 0xE9) {
            rva += PE.readSDword(PE.RVAToOffset(rva + 1)) + 5;
        } else if (byte === 0xEB) {
            rva += PE.readSByte(PE.RVAToOffset(rva + 1)) + 2;
        } else if (byte === 0x90) {
            rva++;
        } else {
            break;
        }
    }

    return PE.RVAToOffset(rva);
}

================================================
FILE: db/PE/protector_BJFnt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", ".BJFnt");

function detect() {
    if (PE.compareEP("EB01EA9CEB01EA53EB01EA51EB01EA52EB01EA56")) {
        sVersion = "1.1b";
        bDetected = true;
    } else if (PE.compareEP("EB0269B183EC04EB03CD20EBEB01EB9CEB01EBEB")) {
        sVersion = "1.2 RC";
        bDetected = true;
    } else if (PE.compareEP("EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Babel_.NET.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Babel .NET");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("BabelObfuscatorAttribute")) {
            sVersion = "1.0-2.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("BabelAttribute")) {
            sVersion = "3.X";
            bDetected = true;
        }

        // fake signatures
        if (bDetected &&
            PE.isNetObjectPresent("BabelAttribute") &&
            PE.isNetObjectPresent("BabelObfuscatorAttribute")) {
            bDetected = false;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Berio.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Berio");

function detect() {
    if (PE.compareEP("909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090E9011200")) {
        sVersion = "1.00 beta";
        bDetected = true;
    } else if (PE.compareEP("909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090E9017401")) {
        sVersion = "2.00 beta";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_ByfronTech.2.sg
================================================
// Detect It Easy: detection rule file
// Author: @justmazz_

meta("protector", "Byfron Technologies");

function detect() {
    // Engine-managed detection flag
    // Set bDetected = true when detection criteria is met

    var containsRunExport = false,
        containsTextSection = false,
        containsByfronCodeSection = false,
        containsByfronDataSection = false;

    // --- EXPORT DETECTION ---
    // Byfron often exports a function named 'run'
    if (PE.isExportFunctionPresent("run")) {
        containsRunExport = true;
    }

    // --- SECTION ANALYSIS ---
    // .text - standard code section
    // .byfron - custom RX section used by Byfron
    // .byfron1 - initialized, discardable data used by Byfron

    const FLAGS_RX = 0x60000020, FLAGS_INITIALIZED_DATA_DISCARDABLE = 0x02000040;

    for (var i = PE.nLastSection; i >= 0; i--) {
        var sectionName = PE.getSectionName(i),
            sectionCharacteristics = PE.getSectionCharacteristics(i);

        if (sectionName == ".text") {
            containsTextSection = true;
            continue;
        }

        if (sectionName == ".byfron" && sectionCharacteristics == FLAGS_RX) {
            containsByfronCodeSection = true;
            continue;
        }

        if (sectionName == ".byfron1" && sectionCharacteristics == FLAGS_INITIALIZED_DATA_DISCARDABLE) {
            containsByfronDataSection = true;
            continue;
        }
    }

    // --- VALIDATION LOGIC ---
    // Conditions typically associated with Byfron:
    // 1. Exported function named 'run'
    // 2. No standard .text section
    // 3. Presence of either .byfron or .byfron1 sections

    if (containsRunExport) {
        if (!containsTextSection) {
            if (containsByfronCodeSection || containsByfronDataSection) {
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_ByteGuard.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/mt-code/ByteGuard
meta("protector", "ByteGuard");

function detect() {
    if (PE.isNet() && PE.isNetGlobalCctorPresent() && (PE.section[0].Name === ".text" || PE.isSectionNamePresent("UPX")) &&
        PE.isNetUStringPresent("C# version only supports level 1 and 3") &&
        PE.compareOverlay("%% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %%")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Cameyo.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Cameyo");

function detect() {
    if (PE.isOverlayPresent() && PE.compareOverlay("'MZ'") && PE.getVersionStringInfo("ProductName") == "Cameyo Application Virtualization") {
        sVersion = PE.getFileVersion();
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_CliSecure.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://marketplace.visualstudio.com/items?itemName=MikeDr.CliSecureObfuscateNETCodeProtectionTool
meta("protector", "CliSecure");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("ObfuscatedByCliSecureAttribute")) {
            sVersion = "4.0-5.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("CliSecureRd.dll") || PE.isNetObjectPresent("CliSecureRd64.dll")) {
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'Cli'00'S'00'e'00'c'00'u'00'r'00'e'")) {
            bDetected = true;
        }
    } else if (PE.compareEP("e9$$$$$$$$558bec81ec4c020000a1........33c58945f483")) {
        sVersion = "4.5";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Code-Lock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://web.archive.org/web/20240616203445/http://www.chosenbytes.com/
meta("protector", "Code-Lock");

function detect() {
    if (PE.isLibraryPresent("CODE-LOCK.OCX")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_CodeCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CodeCrypt");

function detect() {
    if (PE.compareEP("E9........EB02833D58EB02FF1D5BEB020FC75F")) {
        switch (PE.readDword(PE.getEntryPointOffset() + 1)) {
            case 0x2c5: sVersion = "0.14b"; break;
            case 0x331: sVersion = "0.15b"; break;
            case 0x32e: sVersion = PE.compareEP("EB03FF1D34", 20) ? "0.164" : "0.16b-0.163b";
        }

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_CodeVeil.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CodeVeil");

function detect() {
    if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.isNet()) {
        if (PE.isNetObjectPresent("____KILL")) {
            sVersion = "4.X";
            bDetected = true;
        } else if (PE.isNetUStringPresent("E_TamperDetected")) {
            sVersion = "3.X-4.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Code_Virtualizer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Code Virtualizer");

function detect() {
    if (PE.compareEP("609CFCE8000000005F81EF........8BC781C7........3B472C7502EB2E89472CB9A7000000EB0501448F")) {
        sVersion = "1.3.1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Codewall.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CodeWall");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("CodeWallTrialVersion") || PE.isNetObjectPresent("CodeWallTrialVersion\u0001")) {
            sVersion = "4.X";
            sOptions = "demo";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "9161d281........11..175813..11..11..32..28........11..6f........13..7e........2d..73")) {
            sVersion = "4.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Confuser.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Levis <levintaeyeon@live.com> http://ltops9.wordpress.com/

meta("protector", "Confuser");

function getConfuserVersion() {
    var sResult = String();

    var nVersionOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "Confuser v");
    if (nVersionOffset !== -1) {
        sResult = PE.getString(nVersionOffset + 10);
    }

    return sResult;
}

function detect() {
    if (PE.isNetObjectPresent("ConfusedByAttribute")) {
        var sConfuserVersion = getConfuserVersion();
        if (sConfuserVersion) {
            sVersion = sConfuserVersion;
        } else {
            sVersion = "1.X";
        }

        bDetected = true;
    } else if (PE.isNet()) {
        if (PE.section.length >= 2) {
            var nVersionOffset = PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "ConfuserEx v");
            if (nVersionOffset != -1) {
                sVersion = PE.getString(nVersionOffset + 12, 7);
                sName = "ConfuserEx";
                bDetected = true;
            }
        }
    }

    if (PE.getNetAssemblyName().indexOf("вє∂ѕ ρяσтє¢тσя") == 0) {
        sName = "ConfuserEx";
        sVersion = "Bed's mod";
        bDetected = true;
    } else if (bDetected && PE.isNetObjectPresent("DotNetPatcherPackerAttribute")) {
        sName = "ConfuserEx";
        sVersion = "DotNetPatcher mod";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_CopyMinder.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.microcosm.com/software-protection/copyminder
meta("protector", "CopyMinder");

function detect() {
    if (PE.compareEP("8325........EF6A00E8........E8........CCFF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Crinkler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Crinkler");

function detect() {
    if (PE.compareEP("B9........01C068........6A0058506A005F485DBB03000000BE........E9")) {
        sVersion = "0.1-0.2";
        bDetected = true;
    } else if (PE.compareEP("B8........31DB43EB58")) {
        sVersion = "0.3-0.4";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Crunch.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Crunch");

function detect() {
    if (PE.compareEP("EB100000000000000000000000000000000055E800000000")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (PE.compareEP("EB1503000000060000000000000000000000680000000055E800000000")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (PE.compareEP("55E8........5D83ED068BC5556089AD........2B85")) {
        switch (PE.getEntryPointSignature(32, 2)) {
            case "80BD": sVersion = "1.0"; break;
            case "55BB": sVersion = "2.0"; break;
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_CrypKey.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.crypkey.com/
meta("protector", "CrypKey");

function detect() {
    if (PE.compareEP("8B1D........83FB00750AE83C000000E8..0A00008B44240850E8..020000A1")) {
        bDetected = true;
    } else if (PE.compareEP("E8........5883E805505F578BF781EF........83C639BA........8BDFB90B......8B06")) {
        sVersion = "5.X-6.X";
        bDetected = true;
    } else if (PE.compareEP("E8........E8........83F80075076A00E8")) {
        sVersion = "5.6.X";
        bDetected = true;
    } else if (PE.compareEP("833D........00753468........E8")) {
        sVersion = "6.1X";
        bDetected = true;
    } else if (PE.compareEP("8b4424..50e8$$$$$$$$558bec81c4........5081c4........53c745")) {
        sOptions = "Core module";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_CrypToCrack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://bbs.kanxue.com/thread-37904.htm
meta("protector", "CrypToCrack");

function detect() {
    if (PE.compareEP("E801000000E8585B81E300FFFFFF66813B4D5A753784DB75338BF303....813E504500007526")) {
        sVersion = "0.9.2";
        bDetected = true;
    } else if (PE.compareEP("5B81E300FFFFFF66813B4D5A75338BF303733C813E5045000075260FB746188BC869C0AD0B0000F7E02DAB5D414B69C9DEC0000003C1")) {
        sVersion = "0.9.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Cryptect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Cryptect");

function detect() {
    if (PE.compareEP("68........e8$$$$$$$$5052e9$$$$$$$$53660fcb560fb7df9c0fbff381d6........d2e7558bda57")) {
        bDetected = true;
    } else if (PE.compareEP("68........e8$$$$$$$$525166990fca999cf550c0de..d2d40fb7c3550fabe5f8565766")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_CryptoObfuscator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Crypto Obfuscator");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "000220....000a20ffffff0028........2a")) {
            sVersion = "5.X";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "0291203fffffff5f1f18620a067e........021758911f1062600a067e")) {
            sVersion = "5.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_DBPE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DBPE");

function detect() {
    if (PE.compareEP("9C5557565251539CFAE8........5D81ED5B5340..B0..E8........5E83C611B927......3006464975FA")) {
        sVersion = "1.53";
        bDetected = true;
    } else if (PE.compareEP("9C6A10730BEB02C151E806......C41173F75BCD83C404EB0299EBFF0C247101E879E07A017583C4049DEB017568")) {
        sVersion = "2.10";
        bDetected = true;
    } else if (PE.compareEP("EB$$9C5557565251539CE8........5D81ED")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 0x5c)) {
            case 0xEB: sVersion = "2.10"; break;
            case 0x9C: sVersion = "2.33"; break;
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_DNGuard.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DNGuard");

function detect() {
    if (PE.isNet() && PE.isNetGlobalCctorPresent()) {
        if (_getNumberOfResults("protector") <= 1) {
            if (PE.isNetObjectPresent("ZYXDNGuarder") || PE.isNetObjectPresent("HVMRuntm.dll")) {
                bDetected = true;
            } else if (PE.isSignatureInSectionPresent(0, "'A newer version of DNGuard Runtime library is needed to run this application.'")) {
                bDetected = true;
            }
        }
    } else if (PE.is64()) {
        var rdataSection = PE.section[".rdata"];

        if (rdataSection &&
            PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "'DNGuard'") &&
            PE.isImportPositionHashPresent(0, 0x38432571) && PE.compareEP("48 83 EC 28 E8 07 AD")) {
            bDetected = true;
        }
    } else if (!PE.is64() && PE.isImportPositionHashPresent(0, 0x99f8b58e)) {
        sVersion = "4.9+";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_DS.Sentinel_SuperPro.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Sentinel SuperPro");

function detect() {
    if (PE.compareEP("68........6A016A00FF15........A3........FF15........33C93DB7000000A1")) {
        sVersion = "6.4.0";
        sOptions = "Automatic Protection";
        bDetected = true;
    } else if (PE.compareEP("A1........558B......85C074..85ED75..A1........5055FF15........8B0D")) {
        sVersion = "6.4.1";
        sOptions = "Automatic Protection";
        bDetected = true;
    } else if (PE.compareEP("A1........85C00F85........C705................33C050C70485................E8")) {
        sVersion = "6.4.5.0";
        sOptions = "Automatic Protection";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_DYAMAR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DYAMAR");

function detect() {
    if (PE.isSectionNamePresentExp(/^\.dyamar[CD]$/)) {
        sVersion = "1.3.5";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_DZA_Patcher.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DZA Patcher");

function detect() {
    if (PE.compareEP("EB08'5H40L1N'0060E8000000005D8BD581ED........2B95........83EA108995........8B442420250000FFFF")) {
        sVersion = "1.3";
        bDetected = true;
    } else if (PE.compareEP("BF........9968........68........5252525252525257E81501000085C0751C9952525752E8CB000000FF35")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Daemon_Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Daemon Protect");

function detect() {
    if (PE.compareEP("60609c8cc932c9e3$$9d6130e230e231c055e8")) {
        sVersion = "0.6.7";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_DalKrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DalKrypt");

function detect() {
    if (PE.compareEP("68........5868........5F33DBEB0D8A140380EA0780F2048814034381FB........72EBFFE7")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_DeepSea.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DeepSea");

function detect() {
    if (PE.isNet()) {
        var nOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "DeepSeaObfuscator");

        if (nOffset !== -1) {
            if (PE.compare("'Evaluation'", nOffset + 18)) {
                sOptions = "Evaluation";
                sVersion = "4.X";
            }

            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Denuvo.2.sg
================================================
// Detect It Easy: detection rule file
// Author: deadmau5 <deadmau5@tutanota.de>
// Updated: DosX (@DosX-dev)
// Updated 2: Nitr0-G (@Nitr0-G) (16.05.2025)
// Updated 3: 0x80000003 (@0x80000003) (20.09.2025)
// Updated 4: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Denuvo
meta("protector", "Denuvo");

function detect() {
    if (PE.isNet()) return; // Native code only

    if (PE.isSectionNamePresentExp(/\.(e|sr|x(p|d))data$/) || PE.isSectionNamePresent(".arch") || PE.isSectionNamePresent(".xtext") || PE.isSectionNamePresent(".xtls")) {
        if (PE.is64()) {
            // Mad Max, Metal Gear Solid: TPP, Rise of the Tomb Raider
            if (PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")) {
                sVersion = "1.0";
                bDetected = true;
            }
            // Lords of the Fallen, Batman: AK, Just Cause 3, Sherlock Holmes: TdD, Tales of Berseria etc
            else if (PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")) {
                sVersion = "2.0a";
                bDetected = true;
            }
            // Yesterday Origins
            else if (PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")) {
                sVersion = "2.0b";
                bDetected = true;
            }
            // Sniper Ghost Warrior 3 (beta), Dead Rising 4 (SteamStub-free)
            else if (PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")) {
                sVersion = "3.0a";
                bDetected = true;
            }
            // Atomic Heart
            else if (PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")) {
                sVersion = "17.0"; // v17.0, what? How?
                bDetected = true;
            }
            // Train Sim World CSX Heavy Haul
            else if (PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")) {
                sVersion = "3.0b";
                bDetected = true;
            }
            // Hello Kitty : Island Adventure / Unity
            else if (PE.compareEP("47 61 6D 65 41 73 73 65 6D 62 6C 79 44 65 6E 75 76 6F 44 72 6D 2E 64 6C 6C")) {
                sOptions = "Unity"; // The actual game exe won't show up as Denuvo because it only loads the GameAssembly.dll which is the one protected by Denuvo
                bDetected = true;
            } else if (PE.isSignaturePresent(PE.section[0].FileOffset, PE.getSize() - PE.getOverlaySize(), "64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00")) {
                bDetected = true;
            }

            // Check if steam_api64.dll present
            if (PE.isLibraryPresent("steam_api64.dll")) {
                sOptions = "Steam";
                bDetected = true;
            }
            // Check if eossdk-win32-shipping.dll present
            if (PE.isLibraryPresent("eossdk-win64-shipping.dll")) {
                sOptions = "Epic Games";
                bDetected = true;
            }

        } else {
            // Pro Evolution Soccer 2017, Champions of Anteria
            if (PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")) {
                sVersion = "1.0";
                bDetected = true;
            }
            // Romance of 13 Kingdoms, 2Dark
            else if (PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")) {
                sVersion = "2.0";
                bDetected = true;
            }

            // Check if steam_api.dll present
            if (PE.isLibraryPresent("steam_api.dll")) {
                sOptions = "Steam";
                bDetected = true;
            }

            // Check if eossdk-win64-shipping.dll present
            if (PE.isLibraryPresent("eossdk-win32-shipping.dll")) {
                sOptions = "Epic Game Store";
                bDetected = true;
            }

            // Check if uplay_r1_loader.dll present
            if (PE.isLibraryPresent("uplay_r1_loader.dll")) {
                sOptions = "uPlay";
                bDetected = true;
            }

        }
    }

    if (!bDetected) {
        if (PE.isLibraryPresent("dbdata.dll")) {
            // Override additional info
            sOptions = "FIFA23 series";
            bDetected = true;
        }

        // Check if uplay_r1_loader64.dll present
        if (PE.isLibraryPresent("uplay_r1_loader64.dll")) {
            sOptions = "uPlay";
            bDetected = true;
        }

        // Check if Core/Activation64.dll present
        if (PE.isLibraryPresentExp(/^Core\/Activation(64)?.dll$/)) {
            sOptions = "Origin";
            bDetected = true;
        }

        if (PE.isExportFunctionPresent("GetDenuvoTicketLocation")) {
            bDetected = true;
        }

        if (PE.isExportFunctionPresent("GetDenuvoTimeTicketRequest")) {
            bDetected = true;
        }

    }

    if (PE.isExportFunctionPresentExp(/^ANTICHEAT_OBFUSCATE_.+_CODEMARKER$/)) {
        _setResult("marker", "Denuvo", String(), String());
    }

    return result();
}

================================================
FILE: db/PE/protector_DotFix_Nice_Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DotFix NiceProtect");

function detect() {
    if (PE.compareEP("E9FF000000608B7424248B7C2428FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8")) {
        sVersion = "2.1-2.5";
        bDetected = true;
    } else if (PE.compareEP("60E8550000008DBD........68........033C248BF79068........9BDBE355DB04248BC7DB442404DEC1DB1C248B1C2466AD51DB04249090DA8D........DB1C24D1E129")) {
        bDetected = true;
    } else if (PE.compareEP("60be........8dbe........5783cd..eb$$619090505174..83c8..eb")) {
        bDetected = true;
    } else if (PE.compareEP("e8$$$$$$$$eb$$5aeb$$524aeb$$eb$$b9........eb$$eb$$dd..eb$$803411..eb$$eb$$e2")) {
        sVersion = "1.0-2.X";
        bDetected = true;
    } else if (PE.compareEP("60BE") && PE.section["."]) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Dotfuscator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Dotfuscator");

function detect() {
    if (_getNumberOfResults("protector") <= 2 && PE.isNetObjectPresent("DotfuscatorAttribute")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_DragonArmor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "DragonArmor");

function detect() {
    if (PE.compareEP("BF........83C9FF33C068........F2AEF7D1495168........E8110A000083C40C68")) {
        sVersion = "0.0.4.1";
        bDetected = true;
    }

    if (bDetected && !PE.isSectionNamePresentExp(/^(\.)?DAStub$/)) {
        sOptions = "modified";
    }

    return result();
}


================================================
FILE: db/PE/protector_ENIGMA.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// 07.12.2014 detect x64, build date added //ajax

meta("protector", "Enigma");

function getEnigmaVersion() {
    var nSection = PE.nLastSection,
        nOffset = PE.section[nSection].FileOffset,
        nSize = PE.section[nSection].FileSize;

    if (nSize == 0) {
        nOffset = PE.section[nSection - 1].FileOffset;
        nSize = PE.section[nSection - 1].FileSize;
    }

    var nVersionOffset = PE.findSignature(nOffset, nSize, "000000'ENIGMA'");
    if (nVersionOffset != -1) {

        var sMajor = PE.readByte(nVersionOffset + 9),
            sMinor = PE.readByte(nVersionOffset + 10),
            bYear = PE.readWord(nVersionOffset + 11),
            bMonth = PE.readWord(nVersionOffset + 13),
            bDay = PE.readWord(nVersionOffset + 15),
            bHour = PE.readWord(nVersionOffset + 17),
            bMin = PE.readWord(nVersionOffset + 19),
            bSec = PE.readWord(nVersionOffset + 21);

        sVersion = sMajor + "." + sMinor + " build " + bYear + "." + bMonth + "." + bDay + " " + bHour + ":" + bMin + ":" + bSec;
        return true;
    }
    nVersionOffset = PE.findSignature(nOffset, nSize, "'Enigma Protector'");
    if (nVersionOffset != -1) {
        sVersion = "5.X";
        return true;
    }

    return false;
}

function getEnigmaVersion4x() {
    var nSection = PE.nLastSection,
        nOffset = PE.section[nSection - 1].FileOffset,
        nSize = PE.section[nSection - 1].FileSize;

    var nVersionOffset = PE.findSignature(nOffset, nSize, "000000'ENIGMA'");

    if (nVersionOffset != -1) {

        var sMajor = PE.readByte(nVersionOffset + 9),
            sMinor = PE.readByte(nVersionOffset + 10),
            bYear = PE.readWord(nVersionOffset + 11),
            bMonth = PE.readWord(nVersionOffset + 13),
            bDay = PE.readWord(nVersionOffset + 15),
            bHour = PE.readWord(nVersionOffset + 17),
            bMin = PE.readWord(nVersionOffset + 19),
            bSec = PE.readWord(nVersionOffset + 21);

        sVersion = sMajor + "." + sMinor + " build " + bYear + "." + bMonth + "." + bDay + " " + bHour + ":" + bMin + ":" + bSec;
        return true;
    }

    return false;
}

function getEnigmaVersion_old1x() {
    var nSection = PE.nLastSection;

    var nVersionOffset = PE.findSignature(PE.section[nSection].FileOffset, PE.section[nSection].FileSize, "'ENIGMA'07' PROT'");

    if (nVersionOffset != -1) {
        sVersion = 'v1.14';
        return true;
    }

    return false;
}

function getEnigmaVersion_old() {
    var dataSection = PE.section[".data"];

    if (dataSection) {

        var nOffset = dataSection.FileOffset,
            nOffset = PE.findString(nOffset, dataSection.FileSize, "Enigma protector v");

        if (nOffset != -1) {
            sVersion = PE.getString(nOffset + 18, 4);
            return true;
        }
    }

    return false;
}

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "000000'ENIGMA'")) {
            bDetected = true;
        }
    } else {
        if (!PE.is64()) {
            if (PE.compareEP("558bec83c4..b8........e8........9a............e9$$$$$$$$60e8000000005d..ed")) {
                getEnigmaVersion();
                bDetected = true;
            } else if (PE.compareEP("60e8000000005d81ed........81ed........e9")) {
                getEnigmaVersion();
                bDetected = true;
            } else if (PE.compareEP("68........e8$$$$$$$$eb$$83c4..e9$$$$$$$$60e8000000005d81ed")) {
                getEnigmaVersion();
                bDetected = true;
            } else if (PE.compareEP("eb$$e9$$$$$$$$60e8000000005d81ed........81ed........e9")) {
                getEnigmaVersion();
                bDetected = true;
            } else if (PE.compareEP("e8$$$$$$$$83c4..e9$$$$$$$$60e8000000005d81ed........81ed........e9")) {
                getEnigmaVersion();
                bDetected = true;
            } else if (PE.compareEP("60e8000000005d83....81ed")) { // first versions
                getEnigmaVersion_old();
                bDetected = true;
            } else if (PE.compareEP("eb$$e9$$$$$$$$60e8000000005d83....81ed")) {  // 1.14
                getEnigmaVersion_old1x();
                getEnigmaVersion_old();
                bDetected = true;
            }
        } else if (PE.compareEP("5051525355565741504151415241534154415541564157489C4881EC080000000FAE1C24E8000000005D")) {
            getEnigmaVersion();
            bDetected = true;
        } else if (PE.compareEP("eb$$60e8000000005d81ed........81ed........e9")) {
            getEnigmaVersion();
            bDetected = true;
        }

        if (!bDetected) {
            if (PE.getNumberOfImports() > 1 &&
                PE.getNumberOfImportThunks(1) == 1 &&
                PE.getImportFunctionName(1, 0) == "MessageBoxA" &&
                PE.getSectionCharacteristics(0) == 0xe0000040 &&
                getEnigmaVersion()) {
                bDetected = true;
            } else if (PE.getSectionNameCollision("1", "2") == "enigma") {
                bDetected = true;
            }
        }

        if (PE.compareEP("60648b2d........3e8b6d..3e8b6d..e8........bb........c3")) {
            getEnigmaVersion4x();
            bDetected = true;
        }

    }
    return result();
}


================================================
FILE: db/PE/protector_EXEFog.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ExeFog");

function detect() {
    if (PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3") ||
        PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5") ||
        PE.findSignature(PE.getEntryPointOffset(), 0x1000, "6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e") != -1) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_EXE_Password_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Eliseu Filipi

// https://exe-password-protector.soft112.com/
meta("protector", "EXE Password Protector");

function detect() {
    if (PE.compareEP("6A606810B54000E82E020000BF940000008BC7E822F4FFFF8965E88BF4893E56FF1510B040008B4E10890D00ED40008B4604")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Eazfuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.gapotchenko.com/eazfuscator.net
meta("protector", "EazFuscator");

function detect() {
    bDetected =
        PE.isNet() &&
        PE.isSignaturePresent(PE.section[0].FileOffset, 1024, "'fefef'") &&
        PE.isSignatureInSectionPresent(0, "00 E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 **");

    return result();
}

================================================
FILE: db/PE/protector_Elan_License_Manager.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Elan License Manager");

function detect() {
    if (PE.compareEP("8b4424..83f8..0f85........ff15........8b0d........a3........85c975..3c..75..a9")) {
        sVersion = "4.1.3";
        sOptions = "1995 by Elan Computer Group, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_ElecKey.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// 2022.04.16 2.00.X version Thanks: A.S.L. <asl@onet.eu>

meta("protector", "ElecKey");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "83c42068........68........c744240800000000ff15........50ff15........85c0a3")) {
            sOptions = "AnyCPU";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "488b0dd2be01006641b83200488d917b070000ff15a040010033c9ff15b8400100488b")) {
            sOptions = "x64";
            bDetected = true;
        }
    }

    if (!bDetected) {
        // 2.00.X
        if (PE.is64()) {
            if (PE.compareEP("41504151515257535556E8000000005B48B8................482BD8488BEB")) {
                sVersion = "2.00.X";
                bDetected = true;
            }
        } else {
            if (PE.compareEP("515257535556E8000000005BB8........2BD8")) {
                sVersion = "2.00.X";
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Escargot.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Escargot");

function detect() {
    if (PE.compareEP("EB08'(esc0.1)'6068")) {
        sVersion = "0.1";
        bDetected = true;
    } else if (PE.compareEP("EB04'@0.1'6068")) {
        sVersion = "0.1 final";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Excalibur.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Excalibur");

function detect() {
    if (PE.compareEP("e9$$$$$$$$60e8$$$$$$$$5861eb$$609c9c6a..73..eb")) {
        sVersion = "1.03";
        sOptions = "by forgot/uS/DFCG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_ExeShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.softpedia.com/get/Security/Encrypting/ExeShield.shtml
meta("protector", "ExeShield");

function detect() {
    if (PE.compareEP("E8040000008360EB0C5DEB05") && PE.compareOverlay("85c0") && PE.isRichSignaturePresent() && !PE.getNumberOfImports()) {
        bDetected = true;

        if (!PE.isSectionNamePresent(".shield")) {
            sOptions = "modified";
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_ExeStealth.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://unprotect.it/technique/exestealth/
meta("protector", "ExeStealth");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........B97B0900008BF7AC")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("6090EB22'ExeStealth'")) {
        sVersion = "2.5";
        bDetected = true;
    } else if (PE.compareEP("EB0060EB00E8000000005D81ED")) {
        sVersion = "2.70-2.71";
        bDetected = true;
    } else if (PE.compareEP("EB00EB2F'Shareware - ExeStealth'00")) {
        sVersion = "2.72-2.73";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("EB00EB17'Shareware - ExeStealth'00")) {
        sVersion = "2.74";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("906090E8000000005D81ED........B915000000")) {
        sVersion = "2.75";
        bDetected = true;
    } else if (PE.compareEP("EB58'Shareware-Version ExeStealth'")) {
        sVersion = "2.75a";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("EB..'ExeStealth V2 Shareware '")) {
        sVersion = "2.76";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("EB65'ExeStealth V2 - www'")) {
        sVersion = "2.76";
        bDetected = true;
    }

    var tnResource = PE.resource["TN"];
    if (!bDetected && tnResource) {
        if (PE.compare("'MZ'", tnResource.FileOffset) || PE.isSectionNamePresent("ExeS")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Exe_Guarder.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.exeicon.com/exeguarder/
meta("protector", "Exe Guarder");

function detect() {
    if (PE.compareEP("558BEC83C4D05356578D75FC8B442430250000FFFF81384D5A900074072D00100000EBF18945FCE8C8FFFFFF2DB2040000")) {
        sVersion = "1.8";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Exe_Shield.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Exe Shield");

function detect() {
    if (PE.compareEP("EB0668....0600C39C60E8020000")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 3)) {
            case 0x1f90: sVersion = "1.7"; break;
            case 0x86f4: sVersion = "2.7"; break;
            case 0x8540: sVersion = "2.7b"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED........B9EB0800008DBD........8BF7AC......F8")) {
        sVersion = "2.9";
        bDetected = true;
    } else if (PE.compareEP("558BEC53565760E8000000005D81ED........B9........81E9........8BD581C2")) {
        sVersion = "1.3RC";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_FISH_.NET.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "FISH .NET");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "0800'FISH_NET'")) {
            sVersion = "1.X";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'FISH.NET'")) {
            sVersion = "1.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_FishPE_Shield.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://huaidan.org/archives/983.html
meta("protector", "FishPE Shield");

function detect() {
    if (PE.compareEP("558BEC83C4D05356578B451083C00C8B008945DC")) {
        sVersion = "1.12/1.16";
        bDetected = true;
    } else if (PE.compareEP("60E8EAFDFFFFFFD0C38D4000..0000002C000000")) {
        sVersion = "1.12/1.16";
        bDetected = true;
    } else if (PE.compareEP("60E8........C390090000002C000000........C4030000BCA0000000400100")) {
        sVersion = "1.0X";
        bDetected = true;
    } else if (PE.compareEP("60e8........61c3") && PE.compareEP("60e8$$$$$$$$558bec81c470ffffff535657")) {
        sVersion = "2.0.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Fish_PE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Fish PE");

function detect() {
    if (PE.getNumberOfSections() == 2) {
        if (PE.section[0].FileSize == 0) {
            if (PE.compareEP("60e8070000006168........c35e56")) {
                sVersion = "1.2";
                bDetected = true;
            } else if (PE.compareEP("60e821000000eb$$6168........c35e56")) {
                sVersion = "1.3";
                bDetected = true;
            } else if (PE.compareEP("60b8........ffd05a")) {
                sVersion = "1.4";
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_FlashBack_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "FlashBack");

function detect() {
    if (PE.compareEP("60609c8cc932c9e3$$9d6190609061eb$$558bec83c4..b8........e8")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_G!X_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "G!X Protector");

function detect() {
    if (PE.compareEP("60EB05E8EB044000EBFAE80A000000")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_GameGuard.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://gameguard.nprotect.com/en/index.html
meta("protector", "GameGuard");

function detect() {
    if (PE.compareEP("31FF740661E9'JMP0'")) {
        sVersion = "2006.5.X.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Goats_PE_Mutilator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Goat's PE Mutilator");

function detect() {
    if (PE.compareEP("E8EA0B0000......8B1C79F663D88D22B0BFF64908C302BD3B6C294613285D")) {
        sVersion = "1.6";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Goliath.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Goliath");

function detect() {
    if (PE.isSectionNamePresent(".GOLIATH")) {
        if (PE.isNetObjectPresent("ObfuscatedByGoliath")) {
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'.Goliath.NET.CodeShield.'")) {
            bDetected = true;
        }
    }

    if (bDetected && PE.isSignatureInSectionPresent(0, "20006500760061006C007500610074006500")) {
        sOptions = "demo";
    }

    return result();
}


================================================
FILE: db/PE/protector_HASP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "HASP Protection");

function detect() {
    if (PE.compareEP("6a..602eff35........2eff35........68........e8........6683c4..2eff35........2eff35........b8........83c0..50")) {
        sOptions = "1997 by Aladdin Knowledge Systems Ltd.";
        bDetected = true;
    }

    if (PE.section[0].FileOffset == 0 && PE.section[0].FileSize == 0) {
        if (PE.getResourceSection() == 1) {
            if (/manager/im.test(PE.getVersionStringInfo("ProductName"))) {
                sVersion = PE.getVersionStringInfo("ProductVersion");
                sOptions = PE.getVersionStringInfo("ProductName");
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_HackShield.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "HackShield");

function detect() {
    var impSection = PE.section[PE.getImportSection()];
    if (impSection) {
        var nOffset = impSection.FileOffset,
            nSize = impSection.FileSize;

        nSize = Math.min(nSize, 0x2048);
        if (PE.findString(nOffset, nSize, "TerminateHackShield") != -1) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Hide&Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://download.cnet.com/hide-protect/3000-2092_4-10380452.html
meta("protector", "Hide&Protect");

function detect() {
    if (PE.compareEP("909090E9D8..050095..5300954A5000") ||
        PE.compareEP("909090E9........0000000000000000")) {
        sVersion = "1.016";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_HidePE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "HidePE by BGCorp");

function detect() {
    if (PE.compareEP("6006FC1E07BE909090906A04689010909068")) {
        sVersion = "0.1";
        sOptions = "32Lite 0.03";
    } else if (PE.compareEP("6090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090EB02000090909004909090909090909090909090909090909090909090")) {
        sVersion = "0.1";
        sOptions = "ACProtect 1.09";
    } else if (PE.compareEP("60E82A0000005D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB85")) {
        sVersion = "0.1";
        sOptions = "Armadillo 3.00";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F190909090A8030000617508B801000000C20C006800000000C38B85260400008D8D3B0400005150FF95")) {
        sVersion = "0.1";
        sOptions = "ASPack 2.XX";
    } else if (PE.compareEP("609090909090905D909090909090909090909003DD")) {
        sVersion = "0.1";
        sOptions = "ASProtect";
    } else if (PE.compareEP("68########6f4067485e68........67494e68........50466f")) {
        sVersion = "1.2";
        sOptions = "ASProtect";
    } else if (PE.compareEP("558BEC83C49090909068........9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090")) {
        sVersion = "0.1";
        sOptions = "Borland Delphi 3.0";
    } else if (PE.compareEP("558BEC9090909068........9090909090909090909090909090909090909090909090909090909000FF90909090909090900001909090909090909090EB0400000001909090909090900001909090909090909090")) {
        sVersion = "0.1";
        sOptions = "Borland Delphi 5.0 KOL/MCK";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F190909090538BD833C0A3090909006A00E8090900FFA309090900A109090900A30909090033C0A30909090033C0A309090900E8")) {
        sVersion = "0.1";
        sOptions = "Borland Delphi 6.0-7.0";
    } else if (PE.compareEP("5360BD909090908D45908D5D90E8000000008D01")) {
        sVersion = "0.1";
        sOptions = "CD-Cops II";
    } else if (PE.compareEP("90909090909090909090909090909090909090909090EB0B83EC10535657E8C4010085")) {
        sVersion = "0.1";
        sOptions = "CodeSafe 2.0";
    } else if (PE.compareEP("55E80E0000005D83ED068BC5556089AD........2B8500000000")) {
        sVersion = "0.1";
        sOptions = "Crunch";
    } else if (PE.compareEP("BE000140006A0559807E070074118B46909090909090909090909090909090909083C101")) {
        sVersion = "0.1";
        sOptions = "DEF 1.0";
    } else if (PE.compareEP("60E8000000005D8BFD81ED909090902BB90000000081EF9090909083BD90909090900F8400000000")) {
        sVersion = "0.1";
        sOptions = "DxPack 1.0";
    } else if (PE.compareEP("9CFE039060BE909041908DBE9010FFFF5783CDFFEB1090909090909090909090909090909090FE0B")) {
        sVersion = "0.1";
        sOptions = "ExeSmasher";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F190909090BBD0014000BF00104000BE9090909053E80A00000002D275058A164612D2C3FCB280A46A025B")) {
        sVersion = "0.1";
        sOptions = "FSG 1.0";
    } else if (PE.compareEP("BE90909000BF90909000BB9090900053BB90909000B280")) {
        sVersion = "0.1";
        sOptions = "FSG 1.31";
    } else if (PE.compareEP("90909090909090909090909090909090909090909090EB0B83EC0C535657E8240200FF")) {
        sVersion = "0.1";
        sOptions = "Gleam 1.00";
    } else if (PE.compareEP("60E8220000005D8BD581ED909090902B959090909081EA0690909089959090909083BD4500010001")) {
        sVersion = "0.1";
        sOptions = "JDPack 1.X/JDProtect 0.9";
    } else if (PE.compareEP("64A1010000005589E56AFF68........689A10409050")) {
        sVersion = "0.1";
        sOptions = "LCC Win32 1.X";
    } else if (PE.compareEP("5589E5535657837D0C017505E817909090FF7510FF750CFF7508A1")) {
        sVersion = "0.1";
        sOptions = "LCC Win32 DLL";
    } else if (PE.compareEP("2CE8EB1A90905D8BC581EDF67390902B859090909083E8068985FF01ECAD")) {
        sVersion = "0.1";
        sOptions = "Lockless Intro Pack";
    } else if (PE.compareEP("54E8000000005D8BC581EDF67340002B858775400083E806")) {
        sVersion = "0.1";
        sOptions = "LTC 1.3";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F19090909083EC4456FF15248149008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0C")) {
        sVersion = "0.1";
        sOptions = "Macromedia Flash Projector 6.0";
    } else if (PE.compareEP("E909000000000000020000000C90")) {
        sVersion = "0.1";
        sOptions = "MEW 11 SE 1.0";
    } else if (PE.compareEP("68........E80A00000000000000000030000000")) {
        sVersion = "0.1";
        sOptions = "Microsoft Visual Basic 5.0-6.0";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F1909090905A6890909090689090909052E99090FF")) {
        sVersion = "0.1";
        sOptions = "Microsoft Visual Basic 6.0 DLL";
    } else if (PE.compareEP("558BEC6AFF68........68........64A10000000050E9")) {
        sVersion = "0.1";
        sOptions = "Microsoft Visual C++ 5.0+/MFC";
    } else if (PE.compareEP("558BEC5190909001019090909068........90909090909090909090909000019090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909000019090909090")) {
        sVersion = "0.1";
        sOptions = "Microsoft Visual C++ 6.0/Debug Version";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F190909090558BEC83EC50535657BE909090908D7DF4A5A566A58B")) {
        sVersion = "0.1";
        sOptions = "Microsoft Visual C++ 6.20";
    } else if (PE.compareEP("558D6C010081EC000000008B459083F801560F840000000085C00F84")) {
        sVersion = "0.1";
        sOptions = "Microsoft Visual C++ 7.0 DLL";
    } else if (PE.compareEP("5589E5E802000000C9C39090455845")) {
        sVersion = "0.1";
        sOptions = "MinGW GCC 2.X";
    } else if (PE.compareEP("E9A60000009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090")) {
        sVersion = "0.1";
        sOptions = "Neolite 2.0";
    } else if (PE.compareEP("9C60E8000000005DB8B38540002DAC8540002BE88DB500000000")) {
        sVersion = "0.1";
        sOptions = "NorthStar PE Shrinker 1.3";
    } else if (PE.compareEP("60E801010000E883C404E801909090E95D81EDD3224090E804029090E8EB08EB02CD20FF24249A66BE4746909090909090909090909090909090909090909090909090909090909090909090909090909090909090")) {
        sVersion = "0.1";
        sOptions = "Pack Master 1.0/PEX Clone";
    } else if (PE.compareEP("8B04249C60E8140000005D81ED0A45409080BD67444090900F8548FFED0A")) {
        sVersion = "0.1";
        sOptions = "PE Intro 1.0";
    } else if (PE.compareEP("60E8110000005D83ED0680BDE0049090010F84F2FFCC0A")) {
        sVersion = "0.1";
        sOptions = "PE Pack 0.99";
    } else if (PE.compareEP("525155576467A1300085C0780DE8070000005883C007C690C3")) {
        sVersion = "0.1";
        sOptions = "PE Protect 0.9";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F190909090EB066890909090C39C60E80290909033C08BC483C004938BE38B5BFC81")) {
        sVersion = "0.1";
        sOptions = "PECompact 1.4+";
    } else if (PE.compareEP("60E910000000EF4003A7078F071C375D43A704B92C3A")) {
        sVersion = "0.1";
        sOptions = "PENightMare 2 Beta";
    }
    /* else if (PE.compareEP("909090909090909090909090909090909090909090909090909090909090909090909090")) { // TODO Check
        sVersion = "0.1";
        sOptions = "PENinja 1.31";
    } */
    else if (PE.compareEP("60E82B0000009090909090909090909090909090909090909090909090909090909090909090909090909090909090CCCC")) {
        sVersion = "0.1";
        sOptions = "PESHiELD 0.25";
    } else if (PE.compareEP("9090909068........6764FF360000676489260000F190909090B8009090006A00689090900064FF350000000064892500000000669C60508BD8030068")) {
        sVersion = "0.1";
        sOptions = "PEtite 2.X/level 0";
    } else if (PE.compareEP("60E8010000005583C404E801000000905D81FFFFFF0001")) {
        sVersion = "0.1";
        sOptions = "PEX 0.99";
    } else if (PE.compareEP("5589E5909090909090909090905090909090900001")) {
        sVersion = "0.1";
        sOptions = "REALBasic";
    } else if (PE.compareEP("0BC00BC00BC00BC00BC00BC00BC00BC0BA........FFE2BAE0104000B868241A40890283C203B84000E8EE890283C2FDFFE22D3D5B20486964655045205D3D2D90000000")) {
        sVersion = "0.1";
        sOptions = "Ste@lth PE 1.01";
    } else if (PE.compareEP("60E8000000005883E83D508DB8000000FF578DB0E8000000")) {
        sVersion = "0.1";
        sOptions = "UPX 0.6";
    } else if (PE.compareEP("0BC00BC00BC00BC00BC00BC00BC00BC0")) {
        sVersion = "0.1";
        sOptions = "VBOX 4.3 MTE";
    } else if (PE.compareEP("5589E583EC08909090909090909090909090909001FFFF0101010001909090909090909090909090909000010001000190900001")) {
        sVersion = "0.1";
        sOptions = "Video-Lan-Client";
    } else if (PE.compareEP("363E268AC060E800000000")) {
        sVersion = "0.1";
        sOptions = "VOB ProtectCD 5";
    } else if (PE.compareEP("E900000000909090905741")) {
        sVersion = "0.1";
        sOptions = "WATCOM C/C++ EXE";
    } else if (PE.compareEP("608BF033DB83C30183C001")) {
        sVersion = "0.1";
        sOptions = "XCR 0.11";
    } else if (PE.compareEP("E803000000EB019090")) {
        sVersion = "0.1";
        sOptions = "Yoda's Protector 1.02";
    } else if (PE.compareEP("90909090909090909090909090909090EB06009090909090909090EB08E8900000006690909090909090909090909090909090909090909090909090909090905166909090599090909090909090909090909090909090909090EB0200009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090EB02E2909090EB088290909090909090909090909090909090909090909090909090909090EB020001")) {
        sVersion = "0.1";
        sOptions = "Morphine 1.2";
    } else if (PE.compareEP("EB01EA9CEB01EA53EB01EA51EB01EA52EB01EA5690")) {
        sVersion = "0.2";
        sOptions = "BJFNT 1.1b";
    } else if (PE.compareEP("EB0269B183EC04EB03CD20EBEB01EB9CEB01EBEB00")) {
        sVersion = "0.2";
        sOptions = "BJFNT 1.2";
    } else if (PE.compareEP("EB1066623A432B2B484F4F4B90E990909090")) {
        sVersion = "0.2";
        sOptions = "Borland C++";
    } else if (PE.compareEP("558BEC83C4B4B890909090E800000000E8000000008D4000")) {
        sVersion = "0.2";
        sOptions = "Borland Delphi DLL";
    } else if (PE.compareEP("558BEC83C49053565733C08945F08945D48945D0E800000000")) {
        sVersion = "0.2";
        sOptions = "Borland Delphi Setup Module";
    } else if (PE.compareEP("E912000000000000000000000000000000E9FBFFFFFFC3680000000064FF3500000000")) {
        sVersion = "0.2";
        sOptions = "ZCode 1.01";
    } else if (PE.compareEP("..BA........B8........890283C204B8........890283C204B8........890283C2F8FFE2'\r\n-=[ HidePE by BHCorp ]=-'")) {
        sVersion = "1.01";
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}


================================================
FILE: db/PE/protector_HyperTech_Crackproof.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "HyperTech Crackproof");

function detect() {
    if (PE.getNumberOfImports() > 0 && PE.getImportLibraryName(0) === "KeRnEl32.dLl") {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_ILProtector.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// http://www.vgrsoft.net/Products/ILProtector
meta("protector", "ILProtector");

function detect() {
    bDetected = PE.isNet() && PE.isNetGlobalCctorPresent() && PE.isNetObjectPresent("Protect32.dll") && PE.isNetObjectPresent("Protect64.dll");

    return result();
}

================================================
FILE: db/PE/protector_ILUCRYPT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ILUCRYPT");

function detect() {
    if (PE.compareEP("8BECFAC746F7....4281FA....75F9FF66F7")) {
        sVersion = "4.015";
        bDetected = true;
    } else if (PE.compareEP("8BECFAC7........4C4CC3FBBF....B8....2E....D1C84F81")) {
        sVersion = "4.018";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_IProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "IProtect");

function detect() {
    if (PE.compareEP("EB33'.FUXLoadLibraryA'00")) {
        sVersion = "1.0";
        if (PE.compareEP("'FxLib.dll'00", 19)) {
            sOptions = "FxLib.dll mode";
        } else if (PE.compareEP("'FxSub.dll'00", 19)) {
            sOptions = "FxSub.dll mode";
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Inquartos_Obfuscator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Inquartos Obfuscator");

function detect() {
    if (PE.compareEP("e8$$$$$$$$bb........e8$$$$$$$$e8$$$$$$$$33c064ff306489204bccc3") && PE.isSectionNamePresent(".inq")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_IntelliProtector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "IntelliProtector");

function detect() {
    var nLastSectionOffset = PE.section[PE.nLastSection].FileOffset;
    if (PE.compare("E9........CC", nLastSectionOffset)) {
        var nVersionOffset = PE.findString(nLastSectionOffset, PE.section[PE.nLastSection].FileSize, "Protected by IntelliProtector");
        if (nVersionOffset != -1) {
            sVersion = PE.getString(nVersionOffset + 30);
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_InxObfuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "Inx Obfuscator");

function detect() {
    if (PE.isNet() && PE.findSignature(0x00, PE.getSize() - PE.getOverlaySize(), "0013'Inx .NET Obfuscator'0000") != -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Jar2exe.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://www.jar2exe.com/
meta("protector", "Jar2Exe");

function detect() {
    if (PE.compareOverlay("efbbbf")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(255, PE.getOverlaySize()), "504B0304") != -1) {
            if (PE.compareEP("558BEC6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc881e1........890d")) {
                sOptions = "x86";
                bDetected = true;
            } else if (PE.compareEP("4883ec..48895c24..48897c24..ff15........488bc833d241b8........ff15........488bd84885c075..b8........e9")) {
                sOptions = "x64";
                bDetected = true;
            } else if (PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")) {
                bDetected = true;
            }
        }
    } else if (PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")) {
        if (PE.compareOverlay("504b0304")) {
            bDetected = true;
        }
    }

    sLang = "Java";

    return result();
}

================================================
FILE: db/PE/protector_KoiVM.2.sg
================================================
// Detect It Easy: detection rule file
// Author: r0da https://github.com/whereisr0da
// Edited: DosX

meta("protector", "KoiVM");

function detect() {

    if (PE.isNet() && _getNumberOfResults("protector") <= 1) {
        if (PE.isSignatureInSectionPresent(0, "'KoiVM'") ||
            PE.isSignatureInSectionPresent(0, "'VMEntryRun'")) {
            bDetected = true;
        }

        sVersion = "2.0+";
    }

    return result();
}

================================================
FILE: db/PE/protector_Konekt_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Konekt Protector");

function detect() {
    if (PE.compareEP("fc5550e8$$$$$$$$5d50e8$$$$$$$$eb$$58eb$$40eb$$ffe0")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Krypton.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Krypton");

function detect() {
    if (PE.compareEP("8B0C24E90A7C01..AD4240BDBE9D7A04")) {
        sVersion = "0.2";
        bDetected = true;
    } else if (PE.compareEP("8B0C24E9C08D01..C13A6ECA5D7E796DB3645A71EA")) {
        sVersion = "0.3";
        bDetected = true;
    } else if (PE.compareEP("54E8........5D8BC581ED........2B85")) {
        switch (PE.getEntryPointSignature(21, 3)) {
            case "83E806": sVersion = "0.4"; break;
            case "EB43DF": sVersion = "0.5"; break;
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_LARP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "LARP");

function detect() {
    if (PE.compareEP("e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$5d81ed........830424..83c4..ff6424")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_LDK.2.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("protector", "SafeNet Sentinel LDK");

function detect() {
    if (PE.getNumberOfSections() == 4 &&
        PE.isSectionNamePresent(".AKS1") &&
        PE.isSectionNamePresent(".AKS2") &&
        PE.isSectionNamePresent(".AKS3") &&
        PE.isSectionNamePresent(".rsrc")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_LDK_.NET.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SafeNet Sentinel LDK .NET");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent(".protect") && PE.isNetObjectPresent("haspdnert.dll")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_LameCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.sac.sk/download/security/lamecryp.zip
meta("protector", "LameCrypt");

function detect() {
    if (PE.compareEP("60669CBB........80B3........904B83FBFF75F3669D61")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Laserlok.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Laserlok");

function detect() {
    if (PE.compareEP("eb$$eb$$5055e8$$$$$$$$5d508bc581ed........2d........3e2b85........3E8985........608d85........508d9d........2bd853")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_MSLRH.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "MSLRH");

function detect() {
    if (PE.compareEP("EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060EB02C705EB02CD20E803000000E9EB04584050C3619D1FEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150")) {
        sVersion = "0.32a";
        sOptions = "fake .BJFNT 1.3";
    } else if (PE.compareEP("60E802000000EB095D5581ED39394400C361EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458740475")) {
        sVersion = "0.32a";
        sOptions = "fake ASPack 2.11d";
    } else if (PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00A002EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003")) {
        sVersion = "0.32a";
        sOptions = "fake ASPack 2.12";
    } else if (PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB0073000061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586B")) {
        sVersion = "0.32a";
        sOptions = "fake ASPack 2.12";
    } else if (PE.compareEP("3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB74019083C414EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")) {
        sVersion = "0.32a";
        sOptions = "fake EXE32Pack 1.3X";
    } else if (PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000648F050000000083C40C5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")) {
        sVersion = "0.32a";
        sOptions = "fake Microsoft Visual C++";
    } else if (PE.compareEP("558BEC538B5D08568B750C578B7D1085F65F5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458")) {
        sVersion = "0.32a";
        sOptions = "fake MSVC++ 6.0 DLL";
    } else if (PE.compareEP("558BEC538B5D08568B750C5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB")) {
        sVersion = "0.32a";
        sOptions = "fake MSVC++ 7.0 DLL Method 3";
    } else if (PE.compareEP("558BEC5657BF010000008B750C85F65F5E5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458740475")) {
        sVersion = "0.32a";
        sOptions = "fake MSVC++ DLL Method 4";
    } else if (PE.compareEP("E9A6000000B07B4000786040007C60400000000000B03F000012624000'NeoLite Executable File Compressor\r\nCopyright (c) 1998'2C31")) {
        sVersion = "0.32a";
        sOptions = "fake Neolite 2.0";
    } else if (PE.compareEP("9C60E8000000005DB8B38540002DAC8540002BE88DB5D3FEFFFF8B0683F80074118DB5DFFEFFFF8B0683F8010F84F1010000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874")) {
        sVersion = "0.32a";
        sOptions = "fake nSPack 1.3";
    } else if (PE.compareEP("FC5550E8000000005DEB01E360E803000000D2EB0B58EB014840EB0135FFE0E761585DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A58")) {
        sVersion = "0.32a";
        sOptions = "fake PC-Guard 4.XX";
    } else if (PE.compareEP("E8000000005B83EB05EB04'RND!'85C07302F70550E808000000EAFF58EB18EB010FEB02CD20EB03EACD205858EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB")) {
        sVersion = "0.32a";
        sOptions = "fake PE Crypt 1.02";
    } else if (PE.compareEP("EB03CD20C71EEB03CD20EA9CEB02EB01EB01EB60EB03CD20EBEB01EBE803000000E9EB04584050C3EB03CD20EBEB03CD2003619D83C404EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83")) {
        sVersion = "0.32a";
        sOptions = "fake PE Lock NT 2.04";
    } else if (PE.compareEP("9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802")) {
        sVersion = "0.32a";
        sOptions = "fake PEBundle 0.2-3.X";
    } else if (PE.compareEP("9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD83BD9C38400001619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200000029")) {
        sVersion = "0.32a";
        sOptions = "fake PEBundle 2.0X-2.4X";
    } else if (PE.compareEP("EB06682EA80000C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F904000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A")) {
        sVersion = "0.32a";
        sOptions = "fake PECompact 1.4X";
    } else if (PE.compareEP("60E82B000000'\r\n\r\n\r\nRegistAred to: NON-COMMERCIAL!!\r\n\r\n\r'005861EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4087404")) {
        sVersion = "0.32a";
        sOptions = "fake PESHiELD 0.25";
    } else if (PE.compareEP("B8........6A0068........64FF350000000064892500000000669C605083C40461669D648F050000000083C408EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB")) {
        sVersion = "0.32a";
        sOptions = "fake PEtite 2.1";
    } else if (PE.compareEP("60E801000000E883C404E801000000E95D81EDFF22400061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83")) {
        sVersion = "0.32a";
        sOptions = "fake PEX 0.99";
    } else if (PE.compareEP("60E8000000005D81ED0600000064A02300000083C50661EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4")) {
        sVersion = "0.32a";
        sOptions = "fake SVKP 1.11";
    } else if (PE.compareEP("60BE00908B008DBE0080B4FF5783CDFFEB3A9090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB730B75198B1E83EEFC11DB7210586190EB05E8EB0440")) {
        sVersion = "0.32a";
        sOptions = "fake UPX 0.89.6-1.02/1.05-1.24";
    } else if (PE.compareEP("53558be833dbeb$$e800000000582d........506033c9505850508be851fd2e2b84..........8bf02e03b4..........8bf8")) {
        sVersion = "0.32a";
        sOptions = "fake WWPack32 1.X";
    } else if (PE.compareEP("60E8000000005D81EDF31D4000B97B0900008DBD3B1E40008BF7AC902C8AC0C078900462EB010061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")) {
        sVersion = "0.32a";
        sOptions = "fake Yoda's Cryptor 1.2";
    } else if (PE.compareEP("60EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8")) {
        sVersion = "0.1-0.2";
    } else if (PE.compareEP("60D1CB0FCAC1CAE0D1CA0FC8EB01F1")) {
        sVersion = "0.31";
    } else if (PE.compareEP("EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003")) {
        sVersion = "0.32a";
    } else if (PE.compareEP("558bec5657bf........8b75..85f65f5e5deb$$eb$$eb$$e8$$$$$$$$e8$$$$$$$$eb$$83c4")) {
        sVersion = "0.31a";
    }

    bDetected = bDetected || Boolean(sVersion);

    return result();
}


================================================
FILE: db/PE/protector_MZ0oPE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "MZ0oPE");

function detect() {
    if (PE.compareEP("EBCA890383C30487FE32C0AE75FD87FE803EFF75E2465B83C304538B1B803FFF75C98BE56168")) {
        sVersion = "1.0.6b";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_MaskPE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MaskPE");

function detect() {
    if (PE.isSectionNamePresent(".MaskPE") && PE.compareEP("60")) {
        if (PE.isSignaturePresent(PE.getEntryPointOffset(), 0x100, "6160e8........8bc33e8b..40e8")) {
            sVersion = "2.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_Maxtocode.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Maxtocode");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("Attick.dll") && PE.isNetObjectPresent("CheckRuntime")) {
            sVersion = "1.X";
            sOptions = "Runtime";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "00'InfaceMax 'ffffff005f175920ffff00'toCode_interface'00")) {
            sVersion = "1.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("MRuntime3.dll")) {
            sVersion = "3.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Metrowerks_CodeWarrior.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Metrowerks CodeWarrior");

function detect() {
    if (PE.compareEP("5589E55356578B750C8B5D1083FE01740583FE0275125356FF7508E86EFFFFFF09C0750431C0EB215356FF7508E8")) {
        // DLL
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("5589E5535683EC4455B8FFFFFFFF505068........64FF35000000006489250000000068")) {
        // Console
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Morphnah.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Morphnah");

function detect() {
    if (PE.compareEP("558bec87e55de9$$$$$$$$558bec83ec..5356576064a1........8b40..8945..64a1........c740")) {
        sVersion = "1.0.7";
        bDetected = true;
    } else if (PE.section[".nah"]) {
        if (PE.compareEP("60e8$$$$$$$$5d81ed........8bbd........8b8d........b8........01e88030..83f9..74..817f..........75..8b57")) {
            sVersion = "1.0.2";
            bDetected = true;
        } else if (PE.compareEP("60e8$$$$$$$$5d81ed........31c04083f0..403d........75..be........eb..eb..8b85........83f8..75..31c001ee3d")) {
            sVersion = "1.0.3";
            bDetected = true;
        } else if (PE.compareEP("eb$$608b4c....87d187d18b093bed")) {
            sVersion = "beta 2";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_N-Code.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "N-Code");

function detect() {
    if (PE.compareEP("9066be....6683fe..74..66b8....66be....6683fe..74..6683e8..66bb....6683c3..66436681fb....74..6683f8")) {
        sVersion = "0.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_N-Joy.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "N-Joy");

function detect() {
    if (PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 33)) {
            case 0xf5ef: sVersion = "1.0"; break;
            case 0xf57f: sVersion = "1.1"; break;
            case 0xeac7: sVersion = "1.2"; break;
            case 0xe723: sVersion = "1.3"; break;
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_NET_Spider.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", ".NET Spider");

function detect() {
    if (PE.isNet() && PE.isSignatureInSectionPresent(0, "'Protected_By_Attribute'00'NETSpider.Attribute'")) {
        sVersion = "0.5-1.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_NTkrnl_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "NTkrnl Protector");

function detect() {
    if (PE.compareEP("68........e8") && PE.nLastSection >= 1) {
        if (PE.getNumberOfImports() == 1 && PE.getNumberOfImportThunks(0) == 2) {
            if (PE.getImportFunctionName(0, 0) == "LoadLibraryA" && PE.getImportFunctionName(0, 1) == "GetProcAddress") {
                if (PE.isSignatureInSectionPresent(1, "'http://www.ntcore.com  '")) {
                    sVersion = "0.1";
                    bDetected = true;
                } else if (PE.isSignatureInSectionPresent(1, "'http://www.ntkrnl.com'")) {
                    sVersion = "0.15";
                    bDetected = true;
                }
                /* if (bDetected) {
                    var nFind = PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "Version ");
                    if (nFind !== -1) {
                        sVersion = PE.getString(nFind, 20);
                        sVersion = sVersion.match(/Version ?(.*?) /)[1];
                    }
                } */
            }
        }
    }

    if (PE.compareEP("68........e8........c3") && PE.compareEP("68########60e8$$$$$$$$5d4555c3")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_NetReactor.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev
// ----------------
// First version of detect made by ajax

// https://www.eziriz.com/dotnet_reactor.htm
meta("protector", ".NET Reactor");

function detect() {
    if (PE.section[".reacto"]) {
        if (PE.section[1].FileSize == 0 && PE.section[2].FileSize == 0 && PE.section[3].FileSize == 0) {
            sVersion = "2.0-2.1";
            bDetected = true;
        }
    } else if (PE.compareEP("558becb90f0000006a006a004975f951535657b8........e8")) {
        sVersion = "2.X-3.X";
        bDetected = true;
    } else if (PE.resource["__"] && PE.compareEP("e8$$$$$$$$8bff558bec83ec10")) {
        if (PE.compareEP("e8........e9........6a0c68")) {
            sVersion = "4.2";
            bDetected = true;
        } else if (PE.compareEP("e8........e9........8bff558bec83ec208b45085657")) {
            sVersion = "4.5-4.7";
            bDetected = true;
        }
    } else if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "558becb90f0000006a006a004975f951535657b8........e8")) {
            sVersion = "3.X";
            bDetected = true;
        } else if (PE.section.length >= 2) {
            if (PE.section[1].Characteristics == 0xc0000040) { // .sdata
                if (PE.isSignatureInSectionPresent(1, "5266686E204D182276B5331112330C6D0A204D18229EA129611C76B505190158")) {
                    sVersion = "4.8-4.9";
                    bDetected = true;
                }
            }
        }

        if (PE.isNetObjectPresent("NecroVM.Runtime")) return;

        if (PE.isSignatureInSectionPresent(0, "6D5F6973526561644F6E6C790B636F6D70617265496E666F0874657874496E666F076E756D496E666F0C6461746554696D65496E666F0863616C656E6461720A6D5F646174614974656D0963756C747572654944066D5F6E616D65116D5F757365557365724F76657272696465")) {
            sVersion = "6.X";
        }

        var signatureToScan = String();
        for (var i = 0; i < 5; i++) {
            signatureToScan += "'m_'%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%00";
        }

        if (PE.isSignatureInSectionPresent(0, signatureToScan)) {
            sOptions = sOptions.append("Control Flow");
            sVersion = "6.X";
            bDetected = true;
        }

        if (PE.isSignatureInSectionPresent(0, "'$$method0x'363030303331372D310024246D6574686F643078363030303333322D310024246D6574686F643078363030303333322D320024246D6574686F643078363030303334302D310024246D6574686F643078363030303334302D320024246D6574686F643078363030303335332D310024246D6574686F64")) {
            sVersion = "6.5";
            bDetected = true;
        }

        if (PE.isNetGlobalCctorPresent()) {
            if (PE.isNetObjectPresent("BinaryReader") && PE.isNetObjectPresent("RSACryptoServiceProvider") && PE.isSignatureInSectionPresent(0, "2000690073002000740061006D00700065007200650064002E00")) {
                sOptions = sOptions.append("Anti-tamper");
                bDetected = true;
            } else if (PE.isNetObjectPresent("kernel32") && PE.isSignatureInSectionPresent(0, "6B00650072006E0065006C002000")) {
                bDetected = true;
            }
        }

        if (PE.isNetObjectPresent("SuppressIldasmAttribute"))
            sOptions = sOptions.append("Anti-ILDASM");

        if (PE.isSignatureInSectionPresent(0, "45007A006900720069007A0027007300200022002E004E00450054002000520065006100630074006F0072002200210020005400680069007300200061") && PE.isNetObjectPresent("DateTime")) {
            sOptions = sOptions.append("Demo");
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_NetShield.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/AdvDebug/NetShield_Protector
meta("protector", "NetShield");

function detect() {
    if (PE.isNet()) {
        if (PE.isSectionNamePresent("!Sugar") && PE.isNetGlobalCctorPresent()) {
            bDetected = true;

            if (PE.isNetObjectPresent("ConfusedByAttribute")) {
                sOptions = "Fake signs";
            }

            if (PE.isNetObjectPresent("SuppressIldasmAttribute")) {
                sOptions = sOptions.append("Anti-ILDASM");
            }

            if (PE.isNetObjectPresent("Form200")) {
                sOptions = sOptions.append("Anti-de4dot");
            }
        }

    }

    return result();
}

================================================
FILE: db/PE/protector_Ningishzida.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Ningishzida");

function detect() {
    if (PE.compareEP("9C6096E8000000005D81ED........B9041B00008DBD........8BF7AC")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_NoobyProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "NoobyProtect");

function detect() {
    var impSection = PE.section[PE.getImportSection()];
    if (impSection && impSection.Name == "SE") {
        sVersion = "Safengine";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_North_Star_PE_Shrinker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "North Star PE Shrinker");

function detect() {
    if (PE.compareEP("9C60E8000000005DB8........2D........2BE88DB5") && !PE.isSectionNamePresent("nsp0")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_ORiEN.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ORiEN");

function detect() {
    if (PE.compareEP("E95D010000CED1CE..'\r\n--------------------------------------------\r\n- ORiEN executable files protection system -\r\n------ Created by A. Fisun, 1994-2003 ------\r\n------- WWW: http://zalexf.narod.ru/ -------\r\n-------- e-mail: zalexf@hotmail.ru ---------\r\n--------------'")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 8)) {
            case 0xCE: sVersion = "2.11"; break;
            case 0xCD: sVersion = "2.12"; break;
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Obfuscar.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Obfuscar");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "0691066120AA00000061D29C0617580A")) {
            sVersion = "1.0";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Obfuscator_NET_2009.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Obfuscator.NET 2009");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetUStringPresent("Macrobject.Obfuscator")) {
            bDetected = true;
        } else if (PE.isNetUStringPresent("Obfuscated by Macrobject Obfuscator.NET UNREGISTRED")) {
            sOptions = "Unregistered";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Obsidium.2.sg
================================================
// Detect It Easy: detection rule file
// Author: ajax
// History:
// 22:54 17.01.2013 add generic
// 22:30 14.07.2013 improved generic

meta("protector", "Obsidium");

function detect() {
    if (PE.isNet()) return;

    if (PE.compareEP("E8AB1C")) {
        sVersion = "1.0.0.59";
        bDetected = true;
    } else if (PE.compareEP("E8AF1C0000")) {
        sVersion = "1.0.0.61";
        bDetected = true;
    } else if (PE.compareEP("EB02....E8E71C0000")) {
        sVersion = "1.1.1.1";
        bDetected = true;
    } else if (PE.compareEP("EB02....E8771E0000")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("EB02....E83F1E0000")) {
        sVersion = "1.2.0.0";
        bDetected = true;
    } else if (PE.compareEP("E80E0000008B54240C8382B8000000")) {
        sVersion = "1.2.5.0";
        bDetected = true;
    } else if (PE.compareEP("EB01..E829000000EB02....EB01..8B54240CEB04")) {
        sVersion = "1.2.5.8";
        bDetected = true;
    } else if (PE.compareEP("E80E00000033C08B54240C8382B80000000DC36467FF36")) {
        sVersion = "1.2.X";
        bDetected = true;
    } else if (PE.compareEP("EB04........E829000000EB02....EB01..8B54240CEB02")) {
        sVersion = "1.3.0.0";
        bDetected = true;
    } else if (PE.compareEP("EB02....E825000000EB04........EB01..8B54240CEB01")) {
        sVersion = "1.3.0.4";
        bDetected = true;
    } else if (PE.compareEP("EB01..E826000000EB02....EB02....8B54240CEB01")) {
        sVersion = "1.3.0.13";
        bDetected = true;
    } else if (PE.compareEP("EB02....E828000000EB04........EB01..8B54240CEB")) {
        sVersion = "1.3.0.17";
        bDetected = true;
    } else if (PE.compareEP("EB03......E82E000000EB04........EB04........8B")) {
        sVersion = "1.3.0.21";
        bDetected = true;
    } else if (PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB04")) {
        sVersion = "1.3.0.37";
        bDetected = true;
    } else if (PE.compareEP("EB02....E827000000EB02....EB03......8B54240CEB01")) {
        sVersion = "1.3.1.1";
        bDetected = true;
    } else if (PE.compareEP("EB04........E82A000000EB03......EB04........8B54")) {
        sVersion = "1.3.2.2";
        bDetected = true;
    } else if (PE.compareEP("EB01..E829000000EB02....EB03......8B54240CEB02")) {
        sVersion = "1.3.3.1";
        bDetected = true;
    } else if (PE.compareEP("EB01..E82B000000EB02....EB02....8B54240CEB03")) {
        sVersion = "1.3.3.2";
        bDetected = true;
    } else if (PE.compareEP("EB02....E829000000EB03......EB03......8B..240CEB")) {
        sVersion = "1.3.3.3";
        bDetected = true;
    } else if (PE.compareEP("EB02....E829000000EB03......EB02....8B54240CEB03")) {
        sVersion = "1.3.3.4";
        bDetected = true;
    } else if (PE.compareEP("EB04........E828000000EB01..............8B54240")) {
        sVersion = "1.3.3.6";
        bDetected = true;
    } else if (PE.compareEP("EB02....E827000000EB03......EB01..8B54240CEB03")) {
        sVersion = "1.3.3.7";
        bDetected = true;
    } else if (PE.compareEP("EB02....E82C000000EB04........EB04........8B5424")) {
        sVersion = "1.3.3.7";
        bDetected = true;
    } else if (PE.compareEP("EB04........E828000000EB01..EB01..8B54240CEB04")) {
        sVersion = "1.3.3.8";
        bDetected = true;
    } else if (PE.compareEP("EB02....E829000000EB03......EB01..8B54240CEB04")) {
        sVersion = "1.3.3.9";
        bDetected = true;
    } else if (PE.compareEP("EB01..E82A000000EB04........EB02....8B54240CEB03")) {
        sVersion = "1.3.4.1";
        bDetected = true;
    } else if (PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB02")) {
        sVersion = "1.3.4.2";
        bDetected = true;
    } else if (PE.compareEP("EB03......E8........EB02....EB04........8B54240C")) {
        sVersion = "1.3.5.0";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB04........E8........EB02....EB04........33C0")) {
        sVersion = "1.4.2.0";
        bDetected = true;
    } else if (PE.compareEP("EB02....50EB04........E8........EB01..EB01..8B54240C")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB02....EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB04........E8........EB02....EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB05..........EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB04........EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB04........E8........EB03......EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB01..EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB05..........EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB02....E8........EB02....EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB04........E8........EB04........EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB04........E8........EB04........EB03......8B54240C")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB02....E8........EB03......EB02....8B54240C")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB05..........E8........EB01..EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........E8........EB01..EB01..8B54240C")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......E8........EB04........EB01..8B54240C")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB01..EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB02....EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB03......E8........EB04........EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB03......EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB04........EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB01..E8........EB03......EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB02....50EB02....E8........EB04........EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB02....E8........EB03......EB05..........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB02....EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB04........E8........EB04........EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB03......EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB02....E8........EB03......EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB04........EB04........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB02....50EB01..E8........EB05..........EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB04........E8........EB04........EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB01..E8........EB01..EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB05..........E8........EB05..........EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB04........EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB03......EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB04........E8........EB01..EB05..........33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB01..E8........EB01..EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB04........E8........EB01..EB02....33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB03......E8........EB04........EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB03......E8........EB01..EB01..33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB03......E8........EB05..........EB03......33C0")) {
        bDetected = true;
    } else if (PE.compareEP("EB$$EB$$50EB$$E8$$$$$$$$EB$$B8........eb$$eb$$05........eb$$75..eb$$64ff30")) {
        bDetected = true;
    } else if (PE.compareEP("EB")) {
        var ep = PE.OffsetToVA(PE.getEntryPointOffset());
        var byte = PE.readByte(PE.VAToOffset(ep) + 1);
        if (byte < 6) {
            ep = PE.getDisasmNextAddress(ep);
            byte = PE.readByte(PE.VAToOffset(ep));
            if (byte == 0x50) {
                ep = PE.getDisasmNextAddress(ep);
                byte = PE.readByte(PE.VAToOffset(ep));
                if (byte == 0xEB) {
                    byte = PE.readByte(PE.VAToOffset(ep) + 1);
                    if (byte < 6) {
                        ep = PE.getDisasmNextAddress(ep);
                        byte = PE.readByte(PE.VAToOffset(ep));
                        if (byte == 0xE8) {
                            ep = PE.getDisasmNextAddress(ep + 5);
                            byte = PE.readByte(PE.VAToOffset(ep));
                            if (byte == 0xEB) {
                                byte = PE.readByte(PE.VAToOffset(ep) + 1);
                                if (byte < 6) {
                                    ep = PE.getDisasmNextAddress(ep);
                                    if (PE.compare('8B54240C', PE.VAToOffset(ep)) || PE.compare('33C0', PE.VAToOffset(ep))) {
                                        sVersion = "1.4.X.X";
                                        bDetected = true;
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    } else if (PE.compareEP("eb08................eb03......50eb02")) {
        sVersion = "1.6b43";
        bDetected = true;
    } else if (PE.compareEP("E84719")) {
        bDetected = true;
    } else if (PE.compareEP("EB$$E8....0000EB$$EB$$8B54240CEB")) {
        bDetected = true;
    }
    // Generic
    else if (PE.getEntryPointSection() == PE.nLastSection) {
        if (PE.compareEP("EB") && PE.getImportSection() >= 0 && PE.isOverlayPresent()) {
            bDetected = true;
        }
    } else if (PE.compareEP("EB")) {
        if (PE.compare("'ANTS'", PE.getEntryPointOffset() - 4)) {
            sOptions = "heuristic detection";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_OneVM.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ZermangoLove/OneVM-Source-Code
meta("protector", "OneVM");

function detect() {
    if (PE.isNet() &&
        PE.isNetObjectPresent("Koi") &&
        PE.isNetObjectPresent("OneVM.Runtime") &&
        PE.isSignatureInSectionPresent(0, "72 .. .. .. .. 73 .. .. .. .. 7A") && // throw
        PE.isSignatureInSectionPresent(0, "%% 00 %% %% %% %% %% %% %% %% 00 %%")) {
        bDetected = true;

        if (PE.isNetUStringPresent("OneVM V2 BETA")) {
            sVersion = "2.0, beta";
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_Oreans_CodeVirtualizer.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Oreans CodeVirtualizer");

function detect() {
    if (PE.compareEP("eb$$e9$$$$$$$$e9$$$$$$$$565053e8$$$$$$$$584889c348ffc0482d........482d........4805........803b..75..c603..bb........68........68........5350e8")) {
        bDetected = true;
    } else if (PE.isSectionNamePresent(".vlizer")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_PACE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://www.ilok.com/#!license-manager
meta("protector", "PACE");

function detect() {
    if (PE.compareEP("833d..........75..E8........a3........e8$$$$$$$$56578b3d........8bc7e8........8bf085f674..5668........68........ff15")) {
        sVersion = "Eden wrapper";
        bDetected = true;
    }
    if (PE.compareEP("558bec81ec........5356578d45..6a..5068........ff15........85c074..8b45..eb..8b75..6a..56ff15........85c075..66813e")) {
        sVersion = "InterLok";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_PCShrink.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PCShrink");

function detect() {
    if (PE.compareEP("01AD........FFB5........6A40FF95")) {
        sVersion = "0.71 beta";
        bDetected = true;
    } else if (PE.compareEP("9C60BD........01AD........FF..........6A..FF..........50502D........89..........5F8D")) {
        sVersion = "0.71";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PC_Guard.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PC Guard");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "00000000000000000000000000000000fc5550e8000000005d60e80300000083")) {
            sVersion = "5.X";
            bDetected = true;
        }
    } else if (PE.compareEP("fc5550e8000000005d60e8$$$$$$$$eb$$58eb$$40eb$$ffe0")) {
        sVersion = "5.04-5.05";
        bDetected = true;
    } else if (PE.compareEP("fc5550e8$$$$$$$$5deb$$60e8")) {
        sVersion = "4.06";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE-Armor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE-Armor");

function detect() {
    if (PE.compareEP("E8$$$$$$$$5D81ED050000008D753D56FF55318DB5860000005650FF552D898593000000")) {
        sVersion = "0.46";
        bDetected = true;
    } else if (PE.compareEP("5652515355E81501000032....0000000000")) {
        sVersion = "0.49";
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED........8DB5........555681C5........55C3")) {
        sVersion = "0.7X";
        bDetected = true;
    } else if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$5883ec..5de9$$$$$$$$60e8000000005d81ed........8db5........5556")) {
        sVersion = "0.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE-Shield.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// Updated: DosX

meta("protector", "PE-SHiELD");

function detect() {
    if (PE.compareEP("E9$$$$$$$$60E8$$$$$$$$5D83ED..EB$$8DB5........BA........8A3C1632FA80....80....88....4AEB")) {
        sVersion = "0.25";
        bDetected = true;
    } else if (PE.compareEP("60E8$$$$$$$$5D83ED..EB$$8D....................8A....32..80....80....88......EB")) {
        sVersion = "0.25-0.26";
        bDetected = true;
    } else if (PE.compareEP("60E8$$$$$$$$414e414b494e5d83ed..eb$$8d....................8a....32")) {
        sVersion = "0.2";
        bDetected = true;
    }

    var peShieldSection = PE.section["PESHiELD"];

    if (!bDetected) {
        if (PE.isImportPositionHashPresent(0, 0x3651f68d) && peShieldSection) {
            bDetected = true;
        }
    } else if (!peShieldSection) {
        sOptions = "modified";
    }

    return result();
}

================================================
FILE: db/PE/protector_PEBundle.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PEBundle");

function detect() {
    if (PE.compareEP("9C60E802......33C08BC483C004938BE38B5BFC81EB........87DD")) {
        switch (PE.getEntryPointSignature(28, 2)) {
            case "6A04": sVersion = "0.2-2.0X"; break;
            case "01AD": sVersion = "2.0b5-2.3"; break;
            case "83BD": sVersion = "2.44"; break;
            case "80BD": sVersion = "3.XX"; break;
        }
        bDetected = true;

        if (!PE.isSectionNamePresentExp(/^(peb|PEB)undle$/)) {
            sOptions = "modified";
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_PECRYPT32.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PECRYPT32");

function detect() {
    if (PE.compareEP("e8000000005b83eb..eb$$85c073..f705................58eb$$56575550e8")) {
        sVersion = "1.02";
        sOptions = "by random & killa";
        bDetected = true;
    } else if (PE.compareEP("e8000000005b83eb..eb$$eb$$eb$$eb$$eb$$eb$$eb$$eb$$80bb..........74..83bb..........74..be........03f38bbb........eb")) {
        sVersion = "1.02";
        sOptions = "by random & acpizer";
        bDetected = true;
    } else if (PE.compareEP("e8000000005b83eb..8b83........538beb2bd82b9d........899d........5bbe........03f38b93........52ad0bc00f84........8983")) {
        sVersion = "0.0193c";
        sOptions = "by random & acp";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_PELock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// Enhanced by: DosX

meta("protector", "PELock");

function detect() {
    if (PE.isNet() || PE.is64()) return; // Doesn't support .NET or AMD64 files

    var bEnableNewEngine = true; // Need more researches

    if (bEnableNewEngine) {
        var da = "",
            clc = 0,
            stc = 0,
            movsx = 0,
            movzx = 0,
            sub = 0,
            imul = 0,
            bt = 0,
            bsf = 0;

        var ep = PE.OffsetToVA(PE.getEntryPointOffset()),
            count = 0;

        while (count < 1000) {
            count++;
            var da = PE.getDisasmString(ep);
            if (da.indexOf(' ') != -1) {
                da = da.slice(0, da.indexOf(' '));
            }
            if (da == "CLC") { clc++; }
            if (da == "STC") { stc++; }
            if (da == "MOVSX") { movsx++; }
            if (da == "MOVZX") { movzx++; }
            if (da == "SUB") { sub++; }
            if (da == "IMUL") { imul++; }
            if (da == "BT" || da == "BTR" || da == "BTS" || da == "BTC") { bt++; }
            if (da == "BSF" || da == "BSR" || da == "BSWAP") { bsf++; }
            ep = PE.getDisasmNextAddress(ep);
        }

        if (clc > 0 && stc > 0 && movzx != 0 && (sub > imul || sub == 0 && imul == 0) && bt == 0 && bsf == 0) {
            bDetected = true;
        }
    }

    if (!bDetected) {
        if (PE.compareEP("6A6068........E8........BF94") || PE.isImportPositionHashPresent(0, 0xe1689d7c)) {
            sVersion = "2.X";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_PENinja.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Ninja");

function detect() {
    if (PE.compareEP("5D8BC581ED........2B85........2D710200008985........0FB6B5........8BFD")) {
        sOptions = "modified";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PESpin.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PESpin");

function detect() {
    if (!PE.is64()) {
        if (PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24")) {
            switch (PE.readByte(PE.getEntryPointOffset() + 27)) {
                case 0x5C: sVersion = "0.1"; break;
                case 0xB7: sVersion = "0.3"; break;
                case 0x73: sVersion = "0.4"; break;
                case 0x83: sVersion = "0.7"; break;
                case 0xC8: sVersion = "1.0"; break;
                case 0x7D: sVersion = "1.1"; break;
                case 0x71: sVersion = "1.3, beta"; break;
                case 0xAC: sVersion = "1.3"; break;
                case 0x88: sVersion = "1.3X"; break;
                case 0x17: sVersion = "1.32"; break;
                case 0x77: sVersion = "1.33"; break;
            }

            bDetected = true;
        }
    } else if (PE.compareEP("554881EC900000008D6C2428488975..48897D..48895D..4C8945..4C894D..4C8955..4C895D..4C8965..4C896D..4C8975..4C897D..48894D..488955")) {
        sVersion = "1.2X";
        bDetected = true;
    } else if (PE.compareEP("554881EC90000000488d6c24284889751848897d2048895d004c8945284c894d304c8955384c895d404c8965484c896d504c8975584c897d6048894d0848895510482bc94c8d05")) {
        sVersion = "1.23";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PETetris.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("protector", "PETetris");

function detect() {
    if (PE.isSectionNamePresent("PETETRIS")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_PE_Diminisher.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Diminisher");

function detect() {
    if (PE.compareEP("535152565755E8000000005D8BD581ED........2B95........81EA0B0000008995........80BD")) {
        sVersion = "0.1";
        bDetected = true;
    } else if (PE.compareEP("5D8BD581ED........2B95........81EA0B......8995........80BD")) {
        sVersion = "0.1";
        sOptions = "Alt";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE_Encrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Encrypt");

function detect() {
    if (PE.compareEP("558BEC83C4D05356578D75FC8B442430250000FFFF8138'MZ'900074072D00100000EBF18945FC")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE_Intro.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Intro");

function detect() {
    if (PE.compareEP("8B04249C60E8........5D81ED........80BD..........0F8548")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE_Lock_NT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PELOCKnt");

function detect() {
    if (PE.compareEP("EB03CD20EBEB01EB1EEB01EBEB02CD209CEB03CD")) {
        sVersion = "2.01";
        bDetected = true;
    } else if (PE.compareEP("EB02C7851EEB03CD20EBEB01EB9CEB01EBEB02CD")) {
        sVersion = "2.02c";
        bDetected = true;
    } else if (PE.compareEP("EB02C7851EEB03CD20C79CEB0269B160EB02EB01")) {
        sVersion = "2.03";
        bDetected = true;
    } else if (PE.compareEP("EB$$1EEB$$9CEB$$EB$$60EB$$EB$$E8$$$$$$$$584050C3")) {
        sVersion = "2.04";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE_Lock_Phantasm_by_Ding_Boy.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Lock Phantasm by Ding Boy");

function detect() {
    if (PE.compareEP("555756525153E8000000005D8BD581ED")) {
        sVersion = "0.07/0.8";
        bDetected = true;
    } else if (PE.compareEP("5557565251536681C3EB02EBFC6681C3EB02EBFC")) {
        sVersion = "1.0/1.1";
        bDetected = true;
    } else if (PE.compareEP("9C5557565251539CFAE8000000005D81ED")) {
        sVersion = "1.5b3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE_Password.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Password");

function detect() {
    if (PE.compareEP("E804......8BEC5DC333C05D8BFD81ED........81EF........83EF0589AD........8D9D........8DB5........4680")) {
        sVersion = "0.2";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PE_Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PE Protect");

function detect() {
    if (PE.compareEP("'\r\nPE-PROTECT 0.9 (C)o'", 64)) {
        sVersion = "0.9";
        bDetected = true;
    } else if (PE.compareEP("525155576467A1300085C0780DE8........5883C007C6..C3")) {
        sVersion = "0.9";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PEncrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PEncrypt");

function detect() {
    if (PE.compareEP("609CBE........8BFEB9........BB78563412AD33C3ABE2FA9D61E9......FF")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("EB$$E8000000005D81ED........8DB5........E8330000008985")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("E8000000005D81ED........8DB5........8BFEB90F000000BB")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (PE.compareEP("E9......00F00FC6")) {
        sVersion = "3.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PEnguinCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PEnguinCrypt");

function detect() {
    if (PE.compareEP("B8........55506764FF360000676489260000BD4B484342B804000000CC")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_PUNiSHER.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PUNiSHER");

function detect() {
    if (PE.compareEP("EB0483A4BCCE60EB0480BC0411E800000000")) {
        sVersion = "1.5 demo";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Phoenix.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Phoenix");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "0000010b160c..........0208..........0d0906085961d21304091e630861d21305070811051e62110460d19d081758")) {
            sVersion = "1.7-1.8";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'?.resources'")) {
            sVersion = "1.X";
            bDetected = true;
        } else if (PE.compareEP_NET("1b3002001c00000000000000280100000a280200000add01000000dc28070000")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Photo_Compiler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L. <asl@onet.eu> 2019.10.20

meta("protector", "Photo Compiler");

function detect() {
    if (PE.compareEP("558bEC83C4F0B8") && PE.compareOverlay("'PK'")) {
        if (PE.isSignatureInSectionPresent(0, "'PhotoCompiler.Runtime'")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_PolyCrypt_PE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "JLabSoftware PolyCrypt PE");

function detect() {
    if (PE.compareEP("60e8$$$$$$$$918bf4adfec9803408..e2..c3")) {
        sVersion = "2004-2005";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Private_EXE_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Updated: DosX

// https://github.com/NIKJOO/PEP
meta("protector", "Private EXE Protector");

function detect() {
    if (PE.compareEP("558BEC83C4F4FC5357568B7424208B7C242466813E4A430F85A502000083C60A33DB")) {
        sVersion = "1.9.7";
        bDetected = true;
    } else if (PE.compareEP("B8........B9..9001..BE........68........6801......C3")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (PE.compareEP("89....380000008B..0000000081..........89..0000000081..0400000081..0400000081..000000000F85D6FFFFFF")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("52ba........c702########....50....53....51....52....56..57....55....81ee")) {
        sVersion = "3.04";
        bDetected = true;
    } else if (PE.compareEP("EB08....0000000000007.009C")) {
        sVersion = "4.0-4.12";
        bDetected = true;
    } else if (PE.compareEP("EB08....0000000000007.0068")) {
        sVersion = "4.0-4.12";
        bDetected = true;
    } else if (PE.compareEP("6064ff35........b9........89ce81c6........ba........bd........8b0683c6..8b1e89dffcf829c333dd31c3891e")) {
        sVersion = "4.X";
        bDetected = true;
    } else if (PE.compareEP("51b9........c701........59ff35........c3")) {
        sVersion = "3.4.0";
        bDetected = true;
    } else if (PE.compareEP("53bb........c703........5bff35........c3")) {
        sVersion = "3.4.0";
        bDetected = true;
    } else if (PE.findSignature(PE.getEntryPointOffset(), 0xB00, "b900000000f3ae") != -1) {
        sVersion = "3.0.0-3.3.5";
        bDetected = true;
    } else if (PE.findSignature(PE.getEntryPointOffset(), 0xB00, "b900000000f366") != -1) {
        sVersion = "3.0.0-3.3.5";
        bDetected = true;
    } else if (PE.getNumberOfImports() == 1 &&
        PE.getImportLibraryName(0) == "KERNEL32.DLL" && PE.getNumberOfImportThunks(0) == 1 &&
        (PE.section[0].Characteristics == 0xc0000020 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000020 && PE.getEntryPointOffset() == 0x200 ||
            PE.section[0].Characteristics == 0xe0000020 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0x60000020 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000080 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xc0000040 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000060 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000040 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xf0000040 && PE.getEntryPointOffset() == 0x400)) {
        sVersion = "2.00-2.25";
        bDetected = true;
    } else if (PE.section.length >= 3) {
        if (PE.getNumberOfImports() == 1 &&
            PE.getImportLibraryName(0) == "KERNEL32.DLL" &&
            PE.getImportFunctionName(0, 0) == "ExitProcess") {
            if (PE.getAddressOfEntryPoint() == 0x1000 &&
                PE.section[0].FileSize != 0x200 &&
                PE.section[0].FileSize != 0x400 &&
                PE.section[0].Characteristics == 0xe0000020) {
                bDetected = true;
                sVersion = "1.X";
            } else if (PE.section[0].Characteristics == 0xe4000000 &&
                PE.section[1].Characteristics == 0xC0000000 &&
                PE.section[2].Characteristics == 0x50000040) {
                bDetected = true;
                sVersion = "1.7";
            }
        } else if (PE.getNumberOfImports() == 1 || PE.getNumberOfImports() == 2) {
            if (PE.getImportLibraryName(0) == "KERNEL32.DLL") {
                if (PE.getNumberOfImportThunks(0) == 1) {
                    var nSection = PE.nLastSection;
                    if (PE.section[nSection].Name == ".rsrc") {
                        nSection--;
                    }
                    if (PE.section[nSection].Characteristics == 0xE0000000 &&
                        PE.section[nSection - 1].Characteristics == 0xE0000000) {
                        bDetected = true;
                        sVersion = "2.X";
                    }
                }
            }
        }
    }

    if (!bDetected) {
        if (PE.isImportPositionHashPresent(0, 0xd89af68d)) {
            if (PE.isSectionNamePresent(".TRIAL!")) {
                sOptions = "demo";
                bDetected = true;
            } else if (PE.isSectionNamePresent(".-PEP-")) {
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Protect_Disc.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Protect Disc");

function detect() {
    if (PE.compareEP("363e268ac060e8$$$$$$$$558bec83ec..b8........8b7d..2bf8e8")) {
        sVersion = "9.11.0";
        sOptions = "Build " + getBuild();
        bDetected = true;
    } else if (PE.compareEP("363e268ac060e8$$$$$$$$5f81ef........be........8b87........03c657568ca7")) {
        sVersion = "7.5.3";
        sOptions = "Build " + getBuild();
        bDetected = true;
    }

    return result();
}

function getBuild() {
    return PE.readDword(PE.getEntryPointOffset() + 0x3e);
}

================================================
FILE: db/PE/protector_Protection_Plus.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://www.softwarekey.com/blog/softwarekey-system-releases/protection-plus-4-6-0-8-and-instant-plus-3-2-0-4-released/
meta("protector", "Protection Plus");

function detect() {
    if (PE.compareEP("506029c064ff30e8........5d83ed..89e889a5........2b85........8985........8d85........508b0085c00f85")) {
        sVersion = "4.X";
        bDetected = true;
    } else if (PE.isImportPositionHashPresent(0, 0x174efb84) && PE.compare("'{4A6E2EB8-0392-4258-9C91-65BB5FF8F1F9}'", PE.getEntryPointOffset() - 0x27)) {
        sName += " Wrapper";
        sVersion = "4.6+";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_QrYPt0r.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "QrYPt0r");

function detect() {
    if (PE.compareEP("EB$$E8$$$$$$$$64FF3500000000")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_QuickBFC.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.abyssmedia.com/quickbfc/
meta("protector", "Quick Batch File Compiler");

function detect() {
    var textSection = PE.section[".text"];

    if (PE.isSectionNamePresent(".didata") && textSection && PE.isResourceNamePresent("SRC") && PE.isSignaturePresent(textSection.FileOffset, textSection.FileSize, "'batfilerecord'")) {
        bDetected = true;
    }

    sLang = "Batch";

    return result();
}

================================================
FILE: db/PE/protector_QuickPack_NT.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "QuickPack NT");

function detect() {
    if (PE.compareEP("4d5a90eb$$52e9$$$$$$$$e8$$$$$$$$5d8dad........8d9d........8d......506a..68........55ff53")) {
        sVersion = "0.1a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_REVProt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "REVProt");

function detect() {
    if (PE.compareEP("e8$$$$$$$$31c064ff30648920648f05........83c4..60e8$$$$$$$$83c4..e8$$$$$$$$5d81ed........60b9")) {
        sVersion = "0.1a";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_RLP.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "RLP");

function detect() {
    if (PE.isSectionNamePresent(".rlp")) {
        sVersion = "0.7.3b";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_ReNET-pack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ReNET-pack");

function detect() {
    if (PE.isNet() && PE.isSignatureInSectionPresent(0, "'Protected/Packed with ReNET-Pack by stx'")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_RobustObfuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://robustify.xyz/
meta("protector", "Robust Obfuscator");

function detect() {
    if (PE.isNet() && PE.isNetGlobalCctorPresent() && PE.isSignatureInSectionPresent(0, "00 20 .. .. .. .. FE 0E .. .. 20 .. .. .. .. 20 .. .. .. .. 20 .. .. .. .. 61 20 .. .. .. .. 20 .. .. .. .. 5F 20 .. .. .. ..")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_SC_Obfuscator.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "SC Obfuscator");

function detect() {
    if (PE.compareEP("6033c98b1d........031d........8a041984c074..3c..74..34..880419413b0d........75..a1........0105........61ff25")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_SDProtector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SDProtector");

function detect() {
    if (PE.compareEP("558BEC6AFF68........688888880864A1")) {
        if (PE.compareEP("5083EC08", 42)) {
            sVersion = "1.10";
        } else if (PE.compareEP("1833C0", 77)) {
            sVersion = "1.16";
        } else {
            sVersion = "1.1X";
        }

        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_SLVc0deProtector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SLVc0deProtector");

function detect() {
    var nLastSection = PE.nLastSection;
    if (PE.section[nLastSection].Characteristics == 0xA0000020) {
        if ((PE.section[nLastSection].VirtualSize & 0xFF) &&
            (PE.section[nLastSection].FileSize & 0xFF)) {
            if (PE.section[nLastSection].VirtualAddress == PE.getAddressOfEntryPoint()) {
                sVersion = "0.61";
                bDetected = true;
            }
        }
    } else if (PE.compareEP("E80000000058C600EBC6400108FFE0E952")) {
        sVersion = "1.12";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_SVK_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SVK Protector");

function detect() {
    if (PE.compareEP("60EB03C784E8EB03C7849AE8000000005D81ED10000000EB03C784E964A023000000EB")) {
        sVersion = "1.051";
        bDetected = true;
    } else if (PE.compareEP("60E8........5D81ED06......64A023")) {
        sVersion = "1.11";
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED06000000EB05B8........64A023")) {
        sVersion = "1.3X-1.4X";
        bDetected = true;
    } else if (PE.compareEP("E8000000005D81ED06000000EB05B8........64A023")) {
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED0600000074..75........64a023")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Safedisc.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://ru.wikipedia.org/wiki/SafeDisc
meta("protector", "SafeDisc");

function detect() {
    if (PE.compareEP("558bec60bb........33c98a0d........85c974..b8........2bc383e8..eb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Safenet_RMS.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Safenet RMS (Sentinel)");

function detect() {
    if (PE.compareEP("558bec81ec........535657c785................c745..........c745..........c745..........c785................c745..........8b45..a3........833d..........74..e9")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Safengine_Shielden.2.sg
================================================
// Detect It Easy: detection rule file
// Authors: hors, sendersu
// If errors pls contact sendersu on cracklab.team

meta("protector", "Safengine Shielden");

function detect() {
    if (PE.compareEP("E8........5361")) {
        if (PE.section[PE.nLastSection].FileSize == 0x1000 &&
            PE.section[PE.nLastSection].VirtualSize == 0x1000) {
            sVersion = "2.X";
            bDetected = true;
        } else if (PE.section[PE.nLastSection].FileSize == 0x2000 &&
            PE.section[PE.nLastSection].VirtualSize == 0x2000) {
            bDetected = true;
        }
    }

    if (PE.compareEP("EB$$E9$$$$$$$$E8........'Safengine Shielden'")) {
        sVersion = "2.X";
        bDetected = true;
    }

    if (PE.compareEP("E8........'Shielden'")) {
        var nOffset = PE.findString(PE.getEntryPointOffset(), 0x50, "Shielden v");
        if (nOffset != -1) {
            sName = "Shielden"
            sVersion = PE.getString(nOffset + 10);
            bDetected = true;
        }
    }

    if (bDetected == 1) {
        // try to deduce specific version from payload (if present)
        var nOffset = PE.findString(0, PE.getSize(), "Safengine Shielden v")
        if (nOffset != -1) {
            sVersion = PE.getString(nOffset + 19)
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_SecuROM.2.sg
================================================
// Detect It Easy: detection rule file
// Authors: ELF_7719116, DosX

meta("protector", "SecuROM");

function detect() {
    if (PE.section[PE.nLastSection].Name === ".securom") {
        sVersion = "pre-8.03.03";
        bDetected = true;
    } else if (PE.section[".dsstext"]) {
        sVersion = "8.03.03+";
        bDetected = true;
    } else if (PE.compareOverlay("'AddD'03")) {
        var nOffset = PE.getOverlayOffset();
        sVersion = PE.getString(nOffset + 8);
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Secure_Shade.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Secure Shade");

function detect() {
    if (PE.compareEP("558bec81ec........535657be........8d7d..8d45..a5a5a5a56a..50a4e8........8b1d........595968........ffd3")) {
        sVersion = "1.8";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Shrink_Wrap.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Shrink Wrap");

function detect() {
    if (PE.compareEP("58608BE85533F6684801....E84901....EB")) {
        sVersion = "1.4";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Shrinker.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Shrinker");

function detect() {
    if (PE.compareEP("558BEC565775656800010000E8F1E6FFFF83C404")) {
        sVersion = "3.2";
        bDetected = true;
    } else if (PE.compareEP("558BEC565775656800010000E8")) {
        sVersion = "3.3";
        bDetected = true;
    } else if (PE.compareEP("558BEC5657756B6800010000E8110B000083C404")) {
        sVersion = "3.4";
        bDetected = true;
    } else if (PE.compareEP("833D..........558BEC565775..68........e8........83....8b....a3........85F674..68")) {
        sVersion = "3.2";
        bDetected = true;
    } else if (PE.compareEP("833D..........558BEC565775..68........e8........83....8b....a3........85F674..83")) {
        sVersion = "3.5";
        bDetected = true;
    } else if (PE.compareEP("833DB4........558BEC5657756B6800010000E8..0B000083C4048B7508A3B4......85F67423837D0C03771D68FF")) {
        sVersion = "3.4";
        bDetected = true;
    } else if (PE.compareEP("803D..........53568b7424..575575..85f674..68........8b3d........68........56ffd7")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_SimbiOZ.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SimbiOZ");

function detect() {
    if (PE.compareEP("5060E8000000005D81ED0710400068800B00008D851F10400050E8840B0000")) {
        bDetected = true;
    } else if (PE.compareEP("57578D7C240450B800......AB585FC3")) {
        sVersion = "1.3";
        bDetected = true;
    } else if (PE.compareEP("55508BC483C004C700........58C390")) {
        sVersion = "2.1";
        bDetected = true;
    } else if (PE.compareEP("5560E8000000005D81ED........8D85........68........50E8")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Sixxpack.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Sixxpack");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "00'actmp.dll'00'stub'00'Sixxpack'00")) {
            sVersion = "2.2";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "0021......'xpack!'00................'xpack'00")) {
            sVersion = "2.4";
            bDetected = true;
        } else if (PE.isNetObjectPresent("Sixxpack")) {
            sVersion = "2.X";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Skater.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Skater");

function detect() {
    if (PE.isNet()) {
        if (PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9")) {
            sVersion = "2.X";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'RustemSoft.Skater'")) {
            bDetected = true;
        }
    }

    if (bDetected && PE.isSignatureInSectionPresent(0, "4F0062006600750073006300610074006F0072002000440065006D006F00")) {
        sOptions = "demo";
    }

    return result();
}


================================================
FILE: db/PE/protector_Smart_Assembly.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Smart Assembly");

function detect() {
    if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "20ffffff005f175920ffff0000")) {
            sVersion = "3.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("Powered by {smartassembly}")) {
            sVersion = "1.X-4.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("Powered by SmartAssembly")) {
            sVersion = "5.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("SmartAssembly.Attributes")) {
            bDetected = true;
        } else if ((nOffset = PE.findString(PE.section[0].FileOffset,
                PE.section[0].FileSize,
                "Powered by SmartAssembly ")) != -1) {
            sVersion = PE.getString(nOffset + 25);
            bDetected = true;
        } else {
            var nEPSection = PE.getEntryPointSection();
            if (nEPSection != -1) {
                if ((nOffset = PE.findString(PE.section[nEPSection].FileOffset,
                        PE.section[nEPSection].FileSize,
                        "Powered by {smartassembly}")) != -1) {
                    bDetected = true;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_SmokesCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SmokesCrypt");

function detect() {
    if (PE.compareEP("60B8........B8........8A140880F2..8814084183F9..75F1")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_SoftProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SoftProtect");

function detect() {
    if (PE.compareEP("E8....00008D85....0000C70000000000E8....0000E8....00008D85....000050E8....000083")) {
        bDetected = true;
    } else if (PE.compareEP("EB01E360E803......D2EB0B58EB014840EB0135FFE0E76160E803")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_SoftSentry.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "SoftSentry");

function detect() {
    if (PE.compareEP("558BEC83EC..535657E9")) {
        if (PE.compareEP("50", 10)) {
            sVersion = "2.11";
        } else if (PE.compareEP("B006", 10)) {
            sVersion = "3.0";
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Special_EXE_Password_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Special EXE Password Protector");

function detect() {
    if (PE.compareEP("60E8000000005D81ED0600000089AD8C0100008BC52B85FE75000089853E")) {
        sVersion = "1.0X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_SpicesNet.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// 25.11.2018 added 5.X Version -  A.S.L - asl@onet.eu

meta("protector", "Spices.Net");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("NineRays.Obfuscator")) {
            if (PE.isSignaturePresent(PE.section[1].FileOffset - 512, 512, "'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'")) {
                sOptions = "demo";
            }

            bDetected = true;
        }

        if (!bDetected) {
            var spicesSignature = "'9Rays.Net Spices.Net Obfuscator'";
            if (PE.isDll()) {
                if (PE.isSignatureInSectionPresent(1, spicesSignature) || PE.isSignatureInSectionPresent(0, spicesSignature)) {
                    sVersion = "5.X";
                    sOptions = "DLL";
                    bDetected = true;
                }
            }
        } else {
            if (PE.isSignatureInSectionPresent(0, spicesSignature)) {
                sVersion = "5.X";
                bDetected = true;
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_StarForce.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "StarForce");

function detect() {
    if (PE.compareEP("68........FF25....63")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (PE.compareEP("68........FF25....57")) {
        sVersion = "1.1";
        sOptions = "ProActive";
        bDetected = true;
    } else if (PE.compareEP("5768..0D01006800....00E850..FFFF68......0068......0068......0068......0068......00")) {
        sOptions = "Protection Driver";
        bDetected = true;
    } else if (PE.compareEP("E8........000000000000")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (PE.compareEP("60e8000000005883c008") && PE.isSectionNamePresent(".brick")) {
        sVersion = "3.4";
        bDetected = true;
    } else if (PE.compareEP("68........FF25........0000000000")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (PE.isLibraryPresent("protect.dll")) {
        sVersion = PE.getPEFileVersion(PE.getFileDirectory() + "/protect.dll");
        if (!sVersion) {
            if (PE.isSectionNamePresent(".ps4")) {
                sVersion = "4.X-5.X";
                bDetected = true;
            } else if (PE.isSectionNamePresent(".sforce3")) {
                sVersion = "3.X";
                bDetected = true;
            }
        }
    } else {
        if (PE.isSectionNamePresent(".ps4")) {
            for (var i = 0; i < PE.getNumberOfImports(); i++) {
                if (PE.getNumberOfImportThunks(i) == 1 &&
                    (!PE.getImportFunctionName(i, 0) || PE.getImportFunctionName(i, 0) == "1")) {
                    var sLibraryName = PE.getImportLibraryName(i);

                    sVersion = PE.getPEFileVersion(PE.getFileDirectory() + "/" + sLibraryName);

                    if (!sVersion) {
                        sVersion = "4.X-5.X";
                    }

                    sOptions = sLibraryName;
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_Ste@lth_PE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Ste@lth PE");

function detect() {
    if (PE.findSignature(PE.getSize() - 0x40, 0x40, "ba........b8........8902424242b8........89024a4a4affd2") != -1) {
        sVersion = "2.X";
        bDetected = true;
    } else if (PE.findSignature(PE.getSize() - 0x40, 0x40, "b8........ba........8910404040ba........891048484850c3") != -1) {
        sVersion = "2.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Tages.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// http://www.tagesprotection.com/main.htm
meta("protector", "TAGES");

function detect() {
    if (PE.compareEP("8925........e8$$$$$$$$6a..6a..c705................e8$$$$$$$$8b4424..0faf4424..506a..ff15........50ff15........c3")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Themida.2.sg
================================================
// Detect It Easy: detection rule file
// Author: ajax
// History:
// 21:54 17.01.2013 add 1.X and 2.x
//       20.09.2013 add 2.X for x64

meta("protector", "Themida/Winlicense");

function detectThemida() {
    var sResult = "";

    if (PE.section.length >= 4) {
        var nEntryPointSection = PE.getEntryPointSection();

        if (PE.getResourceSection() == 1 && PE.getImportSection() == 2) {
            if (PE.getAddressOfEntryPoint() == PE.section[nEntryPointSection].VirtualAddress) {
                if (PE.calculateEntropy(PE.section[0].FileOffset, PE.section[0].FileSize) >= 7.5) {
                    if (nEntryPointSection == 3) {
                        sResult = "1.X";
                    } else if (nEntryPointSection > 3) {
                        sResult = "2.X";
                    }
                }
            }
        }
    }

    return sResult;
}

function detect() {
    if (PE.is64() && PE.compareEP("4883EC085053E801000000CC584889C348FFC0482D........482D........4805........803BCC75..C60300")) {
        sVersion = "2.X";
    } else if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "b8000000006011c0")) {
            sVersion = "1.9";
        } else if (PE.isSignatureInSectionPresent(0, "83ec048053e80100")) {
            sVersion = "2.X";
        }
    } else if (PE.compareEP("B8........600BC074..E8000000005805..0000008038E975")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 9)) {
            case 0x58: sVersion = "1.0.X.X-1.8.0.0"; break;
            case 0x68: sVersion = "1.8.X-1.9.X"; break;
        }
        sOptions = "Compressed";
    } else if (PE.compareEP("558BEC83C4D860E8000000005A81EA........8BDAC745D8000000008B45D8408945D8817DD880000000")) {
        sVersion = "1.0.X.X-1.8.X.X";
        sOptions = "NoCompression";
    } else if (PE.compareEP("8BC58BD460E8000000005D81ED........8995........89B5........8985........83BD")) {
        sVersion = "1.X";
        sOptions = "NoCompression SecureEngine";
    } else if (PE.compareEP("83EC045053E801000000CC588BD840")) {
        sVersion = "2.0.1.0-2.1.8.0";
    } else if (PE.compareEP("51b9........85c974$$59e9$$$$$$$$83ec..5053............5889c3402d........2d........05........803b..75..c603..bb........68........68........5350")) {
        sVersion = "2.0.1.0-2.1.8.0";
    } else if (PE.compareEP("83EC045053E801000000CC5889C3402D........2D........05........803BCC75..C60300")) {
        sVersion = "2.X";
    } else if (PE.compareEP("E9$$$$$$$$8bc58bd460e8")) {
        sVersion = "1.1.X-1.2.X";
    } else if (PE.compareEP("eb$$e9$$$$$$$$e9$$$$$$$$565053e8$$$$$$$$5889c3402d")) {
        bDetected = true;
    } else if (PE.isImportPositionHashPresent(0, 0x3ffccc8a) && PE.isImportPositionHashPresent(1, 0x4b2fc056)) {
        sVersion = "1.XX-2.XX";
    } else if (PE.isSectionNamePresent(".themida")) {
        sVersion = "3.XX";
    } else if (PE.isSectionNamePresent(".winlice")) {
        sVersion = "3.XX, Winlicense";
    } else if (PE.section[0].Name == "   " && PE.isImportPositionHashPresent(0, 0x3ffccc8a)) {
        sVersion = "~2.XX";
    } else if (PE.section[0].Name == "        " && PE.isImportPositionHashPresent(0, 0x3651f68d)) {
        bDetected = true;
    } else {
        var sThemidaVersion = detectThemida();
        if (sThemidaVersion) {
            sVersion = sThemidaVersion;
        }
    }


    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    if (bDetected && PE.isFunctionPresent("_CorExeMain")) sOptions = "DotNET";

    return result();
}

================================================
FILE: db/PE/protector_Thinstall.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Thinstall(VMware ThinApp)");

function detect() {
    if (PE.compareEP("6A00FF1520504000E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C741")) {
        sVersion = "2.403";
        bDetected = true;
    } else if (PE.compareEP("558BECB8........BB........50E800000000582D..1A0000B9..1A0000BA..1B0000BE00100000BF..530000BD..1A000003E8817500..........7504........817508........81750C........817510")) {
        sVersion = "2.5XX";
        bDetected = true;
    } else if (PE.compareEP("558BEC515356576A006A00FF15........50E887FCFFFF5959A1........8B40100305........8945FC8B45FCFFE05F5E5BC9C3000000")) {
        sVersion = "1.9X";
        bDetected = true;
    } else if (PE.compareEP("B8EFBEADDE506A00FF15........E9..FFFFFF")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 15)) {
            case 0xAD: sVersion = "2.0X"; break;
            case 0xB9: sVersion = "2.2X-2.308"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("E8F2FFFFFF5068........68401B0000E842FFFFFFE99DFFFFFF000000000000")) {
        sVersion = "2.545";
        bDetected = true;
    } else if (PE.compareEP("E80000000058BB....00002BC35068........68....000068")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 7)) {
            case 0x80C1: sVersion = "2.547-2.600"; break;
            case 0x19AD: sVersion = "2.609"; break;
            case 0x1EAC: sVersion = "2.620-2.623"; break;
            case 0x1D34: sVersion = "2.628"; break;
            default: sVersion = "2.6XX";
        }
        bDetected = true;
    } else if (PE.compareEP("9C60E80000000058BB........2BC35068........68........68........E8........E9")) {
        sVersion = "2.7XX";
        bDetected = true;
    } else if (PE.compareEP("9C6068'StAl'68'ThIn'E80000000058BB........2BC35068")) {
        if (PE.compareEP("0028", 32)) {
            sVersion = "3.035-3.043";
        } else if (PE.compareEP("002C", 32)) {
            sVersion = "3.049-3.080";
        } else if (PE.compareEP("BAFE", 42)) {
            sVersion = "3.0XX";
        } else if (PE.compareEP("2CFF", 42)) {
            sVersion = "3.10X";
        }
        bDetected = true;
    } else if (PE.compareEP("b8........e8........482be08d50..4533c033c9e8........85c075..b9........ff15")) {
        sVersion = "5.0";
        bDetected = true;
    } else if (PE.isOverlayPresent()) {
        if (PE.nLastSection >= 1 && PE.section[1].Name == ".res") {
            sVersion = "4.7.X";
            bDetected = true;
        }
    }
    if (PE.compareEP("6a..6a..6a..e8$$$$$$$$8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365")) {
        if (PE.compareOverlay("09050000")) {
            sVersion = "5.2.2";
            bDetected = true;
        }
    }
    if (PE.compareEP("6a..6a..6a..e8$$$$$$$$558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1")) {
        if (PE.compareOverlay("09050000")) {
            sVersion = "5.2.4";
            bDetected = true;
        }
    }
    if (bDetected) {
        var _sVersion = PE.getVersionStringInfo("ThinAppVersion");
        if (_sVersion) {
            sVersion = _sVersion;
        }
    }

    return result();
}


================================================
FILE: db/PE/protector_UG2002_Cruncher.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "UG2002 Cruncher");

function detect() {
    if (PE.compareEP("60E8........5D81ED........E80D................................58")) {
        sVersion = "0.3b3";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_UPX_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "UPX Protector");

function detect() {
    if (PE.compareEP("EB..........8A064688074701DB75078B1E83EEFC11DB")) {
        sVersion = "1.0X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_UPolyX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "UPolyX");

function detect() {
    if (PE.compareEP("81FD00FBFFFF83D1..8D142F83FDFC76..8A02428807474975")) {
        sVersion = "0.X";
        bDetected = true;
    } else if (PE.compareEP("E2..FF..0000000000000000000000000000")) {
        sVersion = "0.1";
        bDetected = true;
    } else if (PE.compareEP("558BEC..00BD46008B..B9..00000080....51")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (PE.compareEP("BB........83EC04891C24..B9..0000008033")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (PE.compareEP("E8000000005983C10751C3C3")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (PE.compareEP("EB01C3")) {
        sVersion = "0.5";
        bDetected = true;
    } else if (PE.compareEP("83EC0489..2459....000000")) {
        sVersion = "0.5";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_UltraPro.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "UltraPro");

function detect() {
    if (PE.compareEP("A1........85C00F853B0600005556C705........01000000FF15")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("60E8070000006168....4000C383042418C32083B8ED2037EFC6B979379E61")) {
        sVersion = "0.75";
        bDetected = true;
    } else if (PE.compareEP("83EC04C7042400......C300....000000000000000000000000....001000000002000001")) {
        sVersion = "1.03-1.10";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_VBox.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "VBox");

function detect() {
    if (PE.compareEP("ff7424..ff7424..ff7424..68........68........68........68........ff15")) {
        if (PE.isLibraryPresent("vboxp410.dll")) {
            sVersion = "4.10";
            bDetected = true;
        }
    }

    if (PE.findSignature(PE.getEntryPointOffset(), 0x1000, "558bec83c4..5657be........8b45..8946..ff75..8f46..8b45..8946..56") !== -1) {
        sVersion = "4.20";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_VCasm-Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "VCasm-Protector");

function detect() {
    if (PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000E803000000")) {
        sVersion = "1.0X";
        bDetected = true;
    } else if (PE.compareEP("EB..'[VProtect]'")) {
        if (PE.compareEP("..0A")) {
            sVersion = "1.0e";
        } else if (PE.compareEP("..0B")) {
            sVersion = "1.1-1.2";
        } else {
            sVersion = "1.X";
        }
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_VMProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Authors: ajax, hypn0, DosX

// https://vmpsoft.com/
meta("protector", "VMProtect");

function detect() {
    if (PE.isNet()) return; // Native files only

    var nNumberOfSections = PE.getNumberOfSections();

    var sVMPSectionName;

    for (var i = nNumberOfSections - 1; i >= 0; i--) {
        if (i == PE.getRelocsSection() || i == PE.getResourceSection()) {
            continue;
        }

        if (PE.getSectionName(i)) {
            sVMPSectionName = PE.getSectionName(i);

            if (i > 0 &&
                sVMPSectionName == ".vmp0") {
                bDetected = true;

                break;
            } else if (i > 1 &&
                (sVMPSectionName.substr(sVMPSectionName.length - 1) == "1")) {
                var sCollision = PE.getSectionNameCollision("0", "1");

                if (PE.isSectionNamePresent(sCollision + "1")) {
                    bDetected = true;

                    break;
                }
            } else if (i > 2 &&
                (sVMPSectionName.substr(sVMPSectionName.length - 1) == "2")) {
                var sCollision = PE.getSectionNameCollision("1", "2");

                if (PE.isSectionNamePresent(sCollision + "1") &&
                    PE.isSectionNamePresent(sCollision + "0")) {
                    bDetected = true;

                    break;
                }
            } else if (i > 3 &&
                (sVMPSectionName.substr(sVMPSectionName.length - 1) == "3")) {
                var sCollision = PE.getSectionNameCollision("2", "3");

                if (PE.isSectionNamePresent(sCollision + "2") &&
                    PE.isSectionNamePresent(sCollision + "1") &&
                    PE.isSectionNamePresent(sCollision + "0")) {
                    bDetected = true;

                    break;
                }
            }
        }

        break;
    }

    if (bDetected) {
        if (PE.is64()) {
            sVersion = "2.XX-3.XX";
        }

        if (sVMPSectionName) {
            if (sVMPSectionName.substr(sVMPSectionName.length - 1) == "0") {
                sOptions = "min protection";
            }
        }

        if (PE.isImportPositionHashPresent(-1, 0x1ff3103f)) {
            sVersion = "1.70";
        } else if (PE.isImportPositionHashPresent(-1, 0x0c16df2d)) {
            sVersion = "1.70";
            sOptions = "max protection";
        } else if (PE.isImportPositionHashPresent(-1, 0x9d12b153)) {
            sVersion = "2.0.3-2.13";
        } else if (PE.isImportPositionHashPresent(-1, 0x1e5500c1)) {
            sVersion = "3.0.0";
        } else if (PE.isImportPositionHashPresent(-1, 0xc5fb6a4b)) {
            sVersion = "3.0.9";
        } else if (PE.isImportPositionHashPresent(-1, 0x5caa99c7)) {
            sVersion = "3.2.0-3.5.0";
        }
    }

    var bEnableNewEngine = true; // Need more researches

    if (bEnableNewEngine && !bDetected && PE.isDeepScan()) {
        var da = "",
            das = "",
            res = 0,
            jmp = 0;

        var ep = PE.OffsetToVA(PE.getEntryPointOffset()),
            count = 0;

        while (das.substr(0, das.indexOf('+')) != "MOV EDX, DWORD PTR [EAX*4 " &&
            das.substr(0, das.indexOf('+')) != "MOV EBX, DWORD PTR [EAX*4 " &&
            das.substr(0, das.indexOf('+')) != "MOV ECX, DWORD PTR [EAX*4 " && count < 1000) {
            count++;

            var byte = PE.readByte(PE.VAToOffset(ep)),
                da = PE.getDisasmString(ep),
                das = da;

            if (da.indexOf(' ') != -1) {
                da = da.substr(0, da.indexOf(' '));
            }

            var fresh = 0;
            if ((byte == 0xFF && da == "JMP") || ((byte == 0xC3 || byte == 0xC2) && da == "RET")) {
                fresh = 1;
                break;
            }

            if (byte == 0xFF && da == "CALL") break;

            if (da.indexOf(' ') != -1)
                da = da.substr(0, da.indexOf(' '));


            if (da == "CLC" || da == "CMC") { res++; }
            if (da == "PUSHFD") { res++; }
            if (da == "PUSHAL") { res++; }
            if (da == "XOR") { res++; }
            if (da == "NEG" || da == "NOT") { res++; }
            if (da == "SAR" || da == "SAL") { res++; }
            if (da == "JMP" || da == "CALL") { jmp++; }
            if (da == "BT" || da == "BTR" || da == "BTS" || da == "BTC") { res++; }
            if (da == "BSF" || da == "BSR" || da == "BSWAP") { res++; }
            if (da == "ROL" || da == "ROR" || da == "RCL" || da == "RCR") { res++; }

            ep = PE.getDisasmNextAddress(ep);
        }

        if (res > 10 && count < 200) {
            if (fresh == 1) { sVersion = "new"; } else { sVersion = "old"; }
            sOptions = "DS";
            bDetected = true;
        }
    }


    // packer detection
    var kernel32Count = 0;
    for (var i = 0; i < PE.getNumberOfImports(); i++) {
        if (PE.getImportLibraryName(i) === "KERNEL32.dll") {
            kernel32Count++;
        }

        if (kernel32Count >= 2) {
            if (PE.is64() && PE.compare("4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 ?? ?? ?? 0E ?? B4 09 CD 21 B8 01 4C CD")) {
                bDetected = true;
                sOptions = sOptions.append("packed");
            }

            break;
        }
    }

    return result();
}

function detectVmp(sSectionName) {
    if (PE.section[sSectionName]) {
        var nCharacteristics = PE.section[sSectionName].Characteristics;
        if (nCharacteristics == 0x60000060 ||
            nCharacteristics == 0xE0000060 ||
            nCharacteristics == 0xE0000040 ||
            nCharacteristics == 0x68000060 ||
            nCharacteristics == 0xe2000060)
            return true;
    }

    return false;
}

function detectVmp2() {
    if (PE.section.length > 7) {
        var nCount = 5,
            nResource = PE.getResourceSection(),
            nRelocs = PE.getRelocsSection();

        if (nResource > PE.section.length - nCount)
            nCount++;

        if (nRelocs > PE.section.length - nCount)
            nCount++;


        var nDetectCount = 0,
            nLastVMPSection = 0;

        for (var nSection = PE.section.length - nCount; nSection < PE.section.length; nSection++) {
            if (nSection == nResource || nSection == nRelocs)
                continue;

            if (PE.section[nSection].FileSize == 0 && PE.section[nSection].FileOffset == 0)
                nDetectCount++;

            if (PE.section[nSection].FileSize != 0 && PE.section[nSection].FileOffset != 0)
                nLastVMPSection = nSection;
        }

        if (nDetectCount >= 3) {
            if (PE.getEntryPointSection() == nLastVMPSection) {
                if (PE.section[nLastVMPSection].Characteristics == 0xE0000060) {
                    if (PE.calculateEntropy(PE.section[nLastVMPSection].FileOffset, PE.section[nLastVMPSection].FileSize) > 7.6) {
                        return true;
                    }
                } else if (PE.section[nLastVMPSection].Characteristics & 0x20000000) { // Fix sent Deniskore
                    var nSectionOffset = PE.section[nLastVMPSection].FileOffset,
                        nSectionSize = PE.section[nLastVMPSection].FileSize,
                        nOffset = nSectionOffset,
                        nSize = nSectionSize,
                        nCount = 0,
                        nSignatureOffset = 0;

                    while (nSize > 0) {
                        nSignatureOffset = PE.findSignature(nOffset, nSize, "9c8d64");
                        if (nSignatureOffset == -1)
                            break;
                        nCount++;
                        nOffset = nSignatureOffset + 3;
                        nSize = nSectionSize - (nSignatureOffset - nSectionOffset);
                        if (nCount >= 2) {
                            return true;
                        }
                    }
                }
            }
        }
    }

    return false;
}

/* function detect_old() {
    if (PE.section[".vmp0"] && (PE.compareEP("68........E9") || PE.compareEP("68........E8"))) {
        sVersion = "1.60-2.05";
        bDetected = true;
    } else if (detectVmp(".vmp0") || detectVmp(".vmp1") || detectVmp(".vmp2")) {
        bDetected = true;
    } else if (PE.compareEP("54c70424........9c60c74424..........c64424....887424..60")) {
        sVersion = "2.06";
        bDetected = true;
    } else if (PE.compareEP("e8$$$$$$$$e9$$$$$$$$880424881c24c70424........9ce8")) {
        sVersion = "2.07";
        bDetected = true;
    } else if (PE.compareEP("9ce8$$$$$$$$e8$$$$$$$$c74424..........e9$$$$$$$$e8$$$$$$$$c74424..........526068")) {
        sVersion = "2.12-13";
        bDetected = true;
    } else if (PE.compareEP("9c9cc74424..........9cc74424..........9c528d6424..e9")) {
        sVersion = "2.12-13";
        bDetected = true;
    } else if (PE.compareEP("68........e8$$$$$$$$41574150448ac350410f96c057415148c7c7")) {
        sVersion = "3.0X";
        bDetected = true;
    } else {
        var collision = PE.getSectionNameCollision("0", "1");

        if (collision) {
            if (PE.compareEP("68........E9") || PE.compareEP("68........E8")) {
                sVersion = "1.X";
                bDetected = true;
            } else if (PE.compareEP("9cE9") || PE.compareEP("9cFF")) {
                sVersion = "2.X";
                bDetected = true;
            } else if (detectVmp(collision + "0") && detectVmp(collision + "1")) {
                bDetected = true;
            }
        }
        if (!bDetected && detectVmp2()) {
            sVersion = "2.X";
            bDetected = true;
        }
    }

    if (bDetected) {
        if (PE.section.length < 3 || (PE.section.length == 3 && PE.section[0].FileSize == 0)) {
            bDetected = false;
        }
    }
} */


================================================
FILE: db/PE/protector_VMProtect_NET.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://vmpsoft.com/
meta("protector", "VMProtect");

function detect() {

    if (PE.isNet() &&
        PE.isNetGlobalCctorPresent() &&
        PE.getNumberOfSections() >= 3 &&
        PE.isNetObjectPresent("SuppressIldasmAttribute") &&
        PE.isNetObjectPresent("kernel32") &&
        PE.isNetObjectPresent("get_IsAttached") &&
        PE.isNetObjectPresent("OpCodes")) {

        const
            chunk = "%% %% %% %% %% %% %% %% 00", // chunk size is 8 bytes
            scanBytes = PE.getSize() - PE.getOverlaySize();

        var globalBigPattern = "00";

        for (var i = 0; i < 12; i++) {
            globalBigPattern += chunk;
        }

        var firstSection = PE.section[0];

        if (PE.isSignaturePresent(firstSection.FileOffset, scanBytes, "'<Module>' 00" + chunk) &&
            PE.isSignaturePresent(firstSection.FileOffset, scanBytes, globalBigPattern)) {
            sVersion = "3.X";
            bDetected = true;
        }


        if (bDetected) {
            if (PE.isSignaturePresent(firstSection.FileOffset, scanBytes, generateUnicodeSignatureMask("Program will be terminated."))) { // Unicode [global] string
                sOptions = "Resources protection";
            }

            var sectionNameCollision = PE.getSectionNameCollision("0", "1");

            if (sectionNameCollision === ".vmp") {
                sVersion = "2.X-3.X";
            } else if (sectionNameCollision) {
                sOptions += (sOptions.length != 0 ? " + " : "") + "Custom sections";
            }

            bDetected = bDetected && !PE.isNetObjectPresent("VMProtect"); // fake signature
        }
    }

    return result();
}

function generateUnicodeSignatureMask(inputString) {
    var output = "";
    for (var c = 0; c < inputString.length; c++) { output += (c != 0 ? "00" : "") + "'" + inputString[c] + "'"; }
    return output;
}

// Hello Ivan Permyakov and thanks for your contribution to Open Source!

================================================
FILE: db/PE/protector_VaySoft_PDF2EXE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L  <asl@onet.eu>

meta("protector", "VaySoft PDF to EXE Converter");

function detect() {
    if (PE.compareEP("558BECB9")) {
        if (PE.compareOverlay("255B484220322A")) {
            sOptions = "PDF Adv.Xor Ovl.";
            sVersion = "6.82";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_VbsToExe.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// sign by A.S.L  - asl@onet.eu
// fixed by adoxa

meta("protector", "Vbs To Exe");

function detect() {
    if (PE.resource["D"]) {
        if (PE.compare("'2edecompile'", PE.resource["D"].Offset + 2)) {
            sVersion = "2.0.2.0";
            bDetected = true;
        } else if (PE.resource["D"].Size == 14 &&
            PE.isResourceNamePresent("B") &&
            PE.isResourceNamePresent("F") &&
            PE.isResourceNamePresent("I") &&
            PE.isResourceNamePresent("N") &&
            PE.isResourceNamePresent("O")) {
            sVersion = "2.0.2.0";
            bDetected = true;
        }
        if (bDetected) {
            if (PE.isResourceNamePresent("P")) {
                sOptions = "Protected";
            }
        }
    }

    sLang = "VBScript";

    return result();
}


================================================
FILE: db/PE/protector_Virbox.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Vito <@ScalletaZ>

meta("protector", "Virbox");

function detect() {
    if (PE.compare("'SENS'", 40)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_XCR.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "XCR");

function detect() {
    if (PE.compareEP("9371..EB$$EB$$8BD878$$EB$$9C33C0EB$$74$$EB$$6079..EB$$E8$$$$$$$$83C4..E8$$$$$$$$8D05........EB$$5D85ED75")) {
        sVersion = "0.13";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Xenocode_Postbuild.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Xenocode Postbuild");

function detect() {
    if (PE.isNetObjectPresent("Xenocode.Client.Attributes.AssemblyAttributes")) {
        sVersion = "2.X-3.X";
        bDetected = true;
    } else if (PE.isSectionNamePresent(".xcpad") && PE.compareOverlay("'xvm'0001")) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_XerinFuscator.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("protector", "XerinFuscator");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("XerinAtrribute")) { // At[rr]ibute <- developer mistake
            const
                sectionToCheck = PE.section[0].Name === ".text" ? PE.section[0] : PE.section[1],
                versionStringOffset = PE.findString(sectionToCheck.FileOffset, sectionToCheck.FileSize, "XerinFuscator v");

            if (versionStringOffset != -1) {
                sVersion = PE.getString(versionStringOffset + 15, 0x15);
                bDetected = true;

                if (PE.isNetObjectPresent("Xerin.Runtime")) sOptions = "XVM";
            }
        } else {
            if (PE.isNetUStringPresent("C# version only supports level 1 and 3") && PE.getNumberOfSections() > 1 && PE.section[0].Name !== ".text") {
                bDetected = true;
            }

            if (!bDetected && PE.isSectionNamePresent(".Xerin")) {
                sVersion = "Legacy";
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/protector_Xtreamlok.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "Xtreamlok (SoftWrap)");

function detect() {
    if (PE.compareEP("9090eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")) {
        sVersion = "1.X-3.X";
        bDetected = true;
    } else if (PE.compareEP("90eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")) {
        sVersion = "1.X-3.X";
        bDetected = true;
    } else if (PE.compareEP("909090eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")) {
        sVersion = "1.X-3.X";
        bDetected = true;
    } else if (PE.compareEP("eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")) {
        sVersion = "1.X-3.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Yano.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://yano.informer.com/
meta("protector", "Yano");

function detect() {
    if (PE.isNetObjectPresent("YanoAttribute")) {
        sVersion = "1.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Yodas_Protector.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Yoda's Protector");

function detect() {
    if (PE.compareEP("558BEC535657E8$$$$$$$$E8$$$$$$$$33C064FF30648920CCC3")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$BB........E8$$$$$$$$E8$$$$$$$$33c064ff306489204bccc3") && PE.section[PE.nLastSection].Name !== ".inq") {
        sVersion = "1.02-1.03";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_Yummy_Game_SoftwareShield.2.sg
================================================
// Detect It Easy: detection rule file
// Author: Levis <levintaeyeon@live.com>

meta("protector", "Yummy Game SoftwareShield");

function detect() {
    if (PE.compareEP("31C0E9B9FFFFFFC3")) {
        sVersion = "5.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_Zprotect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Zprotect");

function detect() {
    if (PE.section.length > 3) {
        if (PE.section[0].FileOffset == 0 && PE.section[0].FileSize == 0) {
            if (!PE.isDosStubPresent()) {
                if (PE.compare("6B65726E656C33322E646C6C000000005669727475616C416C6C6F6300000000", PE.section[1].FileOffset)) {
                    sVersion = "1.X";
                    bDetected = true;
                } else if ((PE.getEntryPointSection() == 1) && (PE.calculateEntropy(PE.section[2].FileOffset, PE.section[2].FileSize) > 7.6)) {
                    sVersion = "1.X";
                    bDetected = true;
                }
            }
        }
    }
    if (PE.compareEP("e8$$$$$$$$87..248d..........87..24e9$$$$$$$$60e9$$$$$$$$54e9")) {
        bDetected = true;
    }

    // TODO EP NFD

    return result();
}


================================================
FILE: db/PE/protector_bambam.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "bambam");

function detect() {
    if (PE.compareEP("6A14E89A050000....5368........E86CFDFFFF")) {
        sVersion = "0.01";
        bDetected = true;
    } else if (PE.compareEP("4d5a90eb$$52e9$$$$$$$$eb$$64a1........eb$$8b48......eb$$05........eb$$668138")) {
        sVersion = "0.1";
        bDetected = true;
    } else if (PE.getNumberOfImports() === 0 && PE.isImportPositionHashPresent(0, 0xb5b153cd)) {
        bDetected = true;
    }

    if (bDetected && !PE.isSectionNamePresent(".bedrock")) {
        sOptions = "modified";
    }

    return result();
}


================================================
FILE: db/PE/protector_beria.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Beria");

function detect() {
    if (PE.compareEP("83EC18538B1D0030....555657683007000033ED55FFD38BF03BF5740D89AE20070000E8880F0000EB0233F66A105589353040....FFD38BF03BF57409892EE83CFEFFFFEB0233F66A18558935D843....FFD38BF0")) {
        sVersion = "0.07";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_eXPressor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.cgsoftlabs.ro/express.html
meta("protector", "eXPressor");

function detect() {
    if (PE.compareEP("E935140000E931130000E998120000E9EF0C0000E94213")) {
        sVersion = "1.0";
    } else if (PE.compareEP("E915130000E9F0120000E958120000E9AF0C0000E9AE02")) {
        sVersion = "1.1";
    } else if (PE.compareEP("558BEC81EC....0000535657EB0C'ExPr-v.1.2.'")) {
        sVersion = "1.2";
    } else if (PE.compareEP("558BEC83EC..535657EB0C'ExPr-v.1.3.'")) {
        sVersion = "1.3";
    } else if (PE.compareEP("558BEC83EC..535657EB0C'ExPr-v.1.4.'")) {
        sVersion = "1.4";
    } else if (PE.compareEP("8BEC83EC..5356578365....F3EB0C'eXPr-v.1.4.'")) {
        sVersion = "1.4";
    } else if (PE.compareEP("558BEC83EC..5356578365..00F3EB0C'eXPr-v.1.4.'00")) {
        sVersion = "1.4.5.X";
    } else if (PE.compareEP("558BEC81EC........53565783A5..........F3EB0C'eXPr-v.1.5.'00")) {
        sVersion = "1.5.0.X";
    } else if (PE.compareEP("558BEC81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
    } else if (PE.compareEP("..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
    } else if (PE.compareEP("6a..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
    } else if (PE.compareEP("6a..6a..6a..6a..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
    } else if (PE.compareEP("EB0168EB01........83EC0C535657EB01..833D........007408EB01E9E956010000EB02")) {
        bDetected = true;
    } else if (PE.compareEP("68########eb$$eb$$558bec83ec..535657eb$$833d..........74")) {
        sVersion = "1.6.1";
    } else if (PE.compareEP("68........C3")) {
        if (PE.section.length >= 3 && PE.section[0].FileSize == 0 && PE.section[2].Name == ".code") {
            sVersion = "1.5-1.6";
        }
    }

    bDetected = bDetected || Boolean(sVersion);

    return result();
}


================================================
FILE: db/PE/protector_hmimys_Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "hmimys Protect");

function detect() {
    if (PE.compareEP("5E83C664AD50AD5083EE6CAD50AD50AD50AD50AD50E8")) {
        sVersion = "0.1";
        bDetected = true;
    } else if (PE.compareEP("E8BA000000..00000000....00..............00......0000....00......00......00......00......00......00..00000000000000......000000000000000000......00......000000000000000000")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("ba........ffe2ba........b8........890283c2..b8........890283c2..ffe2")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_iPB_Protect.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "iPB Protect");

function detect() {
    if (PE.compareEP("558BEC6AFF68'KCUF'68'TIHS'64A100000000")) {
        sVersion = "0.1.3-0.1.7";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/protector_kkryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "k.kryptor");

function detect() {
    if (PE.compareEP("eb$$60e8........5e8d....b9........4933c05102....d3c04979..33....5900")) {
        sVersion = "3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/protector_tElock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "tElock");

function detect() {
    if (PE.compareEP("668BC08D2424EB01EB60EB01EB9CE8000000005E83C6508BFE68")) {
        sVersion = "0.41X";
        bDetected = true;
    } else if (PE.compareEP("C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C6")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 22)) {
            case 0x52: sVersion = "0.4X"; break;
            case 0x5E: sVersion = "0.5X"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("E90000000060E8000000005883C008")) {
        sVersion = "0.60";
        bDetected = true;
    } else if (PE.compareEP("60E8....0000C383")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 2)) {
            case 0x10BD: sVersion = "0.70"; break;
            case 0x10ED: sVersion = "0.71"; break;
            case 0x1144: sVersion = "0.71b2"; break;
            case 0x1148: sVersion = "0.71b7"; break;
            case 0x11F9: sVersion = "0.80"; break;
            default: sVersion = "0.7X-0.84";
        }
        bDetected = true;
    } else if (PE.compareEP("60E802000000CD20E8000000005E2BC9587402")) {
        sVersion = "0.85f";
        bDetected = true;
    } else if (PE.compareEP("....E802000000E800E8000000005E2B")) {
        sVersion = "0.90";
        bDetected = true;
    } else if (PE.compareEP("E9....FFFF")) {
        if (PE.compareEP("E97EE9")) {
            sVersion = "0.92a";
            bDetected = true;
        } else if (PE.compareEP("E9D5E4")) {
            sVersion = "0.95";
            bDetected = true;
        } else if (PE.compareEP("E959E4")) {
            sVersion = "0.96";
            bDetected = true;
        } else if (PE.compareEP("E925E4")) {
            sVersion = "0.98b1";
            bDetected = true;
        } else if (PE.compareEP("E91BE4")) {
            sVersion = "0.98b2";
            bDetected = true;
        } else if (PE.compareEP("E999D7")) {
            sVersion = "0.98 Special Build";
            bDetected = true;
        } else if (PE.compareEP("E95EDF")) {
            sVersion = "0.99";
            bDetected = true;
        } else if (PE.compareEP("E93FDF")) {
            sVersion = "0.99c";
            bDetected = true;
        } else if (PE.compareEP("E9E5E2")) {
            sVersion = "1.00";
            bDetected = true;
        }
    } else if (PE.compareEP("668bc08d2424609ce8000000005dd14d")) {
        sVersion = "0.35";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/rar.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("rar-file");

function detect() {
    detect_RAR(0);

    return result();
}


================================================
FILE: db/PE/sfx_12Ghosts_Zip2.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

// https://12ghosts-zip.apponic.com/
meta("sfx", "12Ghosts Zip2");

function detect() {
    if (PE.compareEP("E8$$$$$$$$558BEC83EC..A1........8365....8365....5357BF........3BC7BB........74")) {
        if (PE.isSignaturePresent(PE.getOverlayOffset(), 0x1000, "'BZh91'")) {
            sOptions = "BZIP2";
            sVersion = "8.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_7z.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "7-Zip");

function detect() {
    if (PE.compareOverlay("';!@Install@!UTF-8!'")) {
        sType = "installer";
        var sManifest = PE.getManifest();
        var aVersion = sManifest.match(/(\n?)version="(.*?)"/);
        if (aVersion) {
            sVersion = aVersion[2];
            if (aVersion[1]) {
                sOptions = "new";
            }
        } else if (aVersion = sManifest.match(/Archive v(\d.*?)<\/desc/)) {
            sVersion = aVersion[1];
        }
        bDetected = true;
    } else if (PE.compareOverlay("'7z'BCAF271C")) {
        bDetected = true;
    } else if (PE.compareOverlay("efbbbf';!@Install@!UTF-8!'")) {
        sType = "installer";
        bDetected = true;
    }

    if (bDetected) {
        if (PE.getVersionStringInfo("InternalName") == "7z.sfx" || PE.getVersionStringInfo("InternalName") == "7zS2.sfx") {
            sVersion = PE.getVersionStringInfo("FileVersion");
            if (!sVersion) {
                sVersion = PE.getFileVersion().replace(/\.0\.0$/, "");
            }
        }

        if (!sVersion && PE.section[".rdata"]) {
            var nVersionOffset = PE.findString(PE.section[".rdata"].FileOffset, PE.section[".rdata"].FileSize, "7-Zip version:");
            if (nVersionOffset != -1) {
                sVersion = PE.getString(nVersionOffset + 16, 4);
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/sfx_ARJSFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "ARJSFX");

function detect() {
    if (PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f64678b16....8b42..a3")) {
        if (PE.compareOverlay("c0ab........60ea")) {
            sName += "32";
            bDetected = true;
        }
    } else if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("60ea")) {
            bDetected = true;
        } else {
            for (var i = 0; i < PE.resource.length; i++) {
                if (PE.resource[i].Type == 730) { // ARJDATA
                    bDetected = true;
                    break;
                }
            }
        }
    } else if (PE.compareEP("558bec83c4..e8$$$$$$$$e8........6a..e8........8905........e8........8905")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.resource[i].Type == 1001) {
                if (PE.compare("60ea", PE.getResourceOffsetByNumber(i))) {
                    bDetected = true;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/sfx_ARQ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "ARQ");

function detect() {
    if (PE.compareOverlay("67570402")) {
        if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")) {
            bDetected = true;
        } else if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_Abbyy_Lingvo.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Abbyy Lingvo");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")) {
        if (PE.compare("'ArcUpdateABBYY'00", PE.getSize() - 15)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_Active_Delivery.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Active Delivery");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec605356578965..ff15") &&
        PE.section["actdlvry"] && PE.compare("'AD01'", PE.section["actdlvry"].FileOffset)) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_Cab.1.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("sfx", "Microsoft Cabinet");

function detect() {
    var overlayOffset = PE.getOverlayOffset();

    if (PE.compareOverlay("'wextract'", 16)) {
        // The version is probably for what's being installed, not what's doing
        // the installing; it does seem, though, the raw product version is for
        // the installer itself. Take a punt, anyway.
        overlayOffset = PE.findSignature(overlayOffset - 0xE00, 0xE00, "BD04EFFE00000100");

        if (overlayOffset !== -1) {
            overlayOffset += 16;
            sVersion = PE.readWord(overlayOffset + 2) + "." + PE.readWord(overlayOffset) + "." +
                PE.readWord(overlayOffset + 6) + "." + PE.readWord(overlayOffset + 4);
        }
        bDetected = true;
    } else if (/sfxcab/.test(PE.getManifest())) {
        var rsrcSection = PE.section[".rsrc"];

        // There's two version resources, locate the second.
        if (rsrcSection) {
            var overlayOffset = rsrcSection.FileOffset + rsrcSection.VirtualSize;

            overlayOffset = PE.findSignature(overlayOffset - 0x600, 0x600, "BD04EFFE00000100");
            if (overlayOffset !== -1) {
                overlayOffset += 8;
                sVersion = PE.readWord(overlayOffset + 2) + "." + PE.readWord(overlayOffset) + "." +
                    PE.readWord(overlayOffset + 6) + "." + PE.readWord(overlayOffset + 4);
            }
        }
        bDetected = true;
    } else if (/wextract/i.test(PE.getVersionStringInfo("InternalName"))) {
        sVersion = PE.getFileVersion().trim();
        bDetected = true;
    } else if (PE.compareEP("558bec81ec........535657ff15........a3........ff15........a1........6625....3d") && PE.compare("'MSCF'00000000", 0x5000)) {
        bDetected = true;
    } else if (PE.compareEP("6a..68........e8........66813d............75..a1........81b8................75..") && PE.compareOverlay("'MSCF'00000000")) {
        bDetected = true;
    } else if (PE.compareEP("e9$$$$$$$$558bec81ec........830d..........5356576a..33dbbf........68........895d..881d")) {
        bDetected = true;
    }

    if (PE.getNumberOfResources() > 0) {
        if (PE.compare("'MSCF'00000000", PE.getResourceNameOffset("CABINET"))) {
            bDetected = true;
        }

        if (PE.compare("'MSCF'00000000", PE.getResourceNameOffset("IDR_CABFILE"))) {
            bDetected = true;
        }

    }

    return result();
}

================================================
FILE: db/PE/sfx_Chilkat_ZIP_Self-Extractor.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Chilkat ZIP Self-Extractor");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15") && PE.compareOverlay("07d26cbf2159abaa0100000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_CoffeeCup_SFX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "CoffeeCup");

function detect() {
    if (PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a") && PE.compareOverlay("'MPU'00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_DelZip_SFX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "DelZip");

function detect() {
    if (PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a") && PE.compareOverlay("'MPV'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_Dimd_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Dimd");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("........'DIMDMSCF'")) {
            sOptions = "CAB SFX";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_Envoy_Packager.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Envoy Packager");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15") && PE.compareOverlay("b297e169")) {
        sOptions = "1994 by Novell, Inc.";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_GZip.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "GZip");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.compare("1f8b08", PE.resource[i].Offset)) {
                bDetected = true;
            }
        }
    } else if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("1f8b08")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_GkSetup.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "GkSetup SFX");

function detect() {
    if (PE.findString(PE.getOverlayOffset(), Math.min(0x300, PE.getOverlaySize()), "/SFX") != -1) {
        if (PE.compareEP("e9$$$$$$$$5351525589e583ec..b8........e8........a1........83c0..24..31d229c489e18b1d")) {
            sOptions = "1998 by Gero Kuehn";
            bDetected = true;
        } else if (PE.compareEP("5668........33f668........56ff15........56ff15........a3........e8........85c074..a1")) {
            sOptions = "1999 by Gero Kuehn";
            bDetected = true;
        }
    } else if (PE.compareOverlay("'2.00'")) {
        if (PE.compareEP("5633f656ff15........a3........e8........85c074..a1........8b40..48")) {
            sVersion = "2.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_INFTool.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "INFTool");

function detect() {
    if (PE.compareEP("558bec83c4..e8$$$$$$$$e8........6a..e8........8905........e8........8905........c705")) {
        if (PE.findString(0, PE.getOverlayOffset(), "INFTool.pkg") !== -1) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_KRZIP_SFX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "KRZIP");

function detect() {
    if (PE.compareEP("558bec83c4..53565733c08945..b8........e8........33c05568........64ff30648920a1........8378")) {
        if (PE.compareOverlay("'<KRZIP FILE BEGINS HERE>'")) {
            sOptions = "by Kryloff Technologies, Inc.";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_LZH_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "LZH SFX");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d") &&
        (PE.compareOverlay("....'-lh5-'") || PE.compareOverlay("........'-lh7-'"))) {
        sVersion = "2.60.w32.0031";
        sOptions = "by Yoshi 1991 / mH 1995 / Micco 1997-99";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_Lyme_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Lyme SFX");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15") && PE.compareOverlay("789c")) {
        sOptions = "zlib";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_MP-ZipTool.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "MP-ZipTool SFX32");

function detect() {
    if (PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a")) {
        if (PE.compareOverlay("'MPU'0d")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_MPQ.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Blizzard MPQ");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")) {
        if (PE.compareOverlay("'MPQ'1a20")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_NanoZip.1.sg
================================================
// Detect It Easy: detection rule file
// Author: LinXP

meta("sfx", "NanoZip");

function detect() {
    if (PE.compareEP("60be........8dbe........5789e58d9c24........31c05039dc75") && PE.compareOverlay("AE01'NanoZip 0.09 alpha'")) {
        sVersion = "0.09a";
        sOptions = "nz_w32c.sfx";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/sfx_PKSFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "PKSFX");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")) {
        if (PE.compareOverlay("'PK'090a")) {
            sVersion = "2.50";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/sfx_Paquet.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Paquet");

function detect() {
    if (PE.compareEP("558bec81c4........53565733c08985........8985........e8........e8")) {
        if (PE.compareOverlay("04'PBG'")) {
            sVersion = "1.5, 1998 by Guillaume Di Giusto";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_Quantum.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Quantum");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.compare("'DS'00", PE.resource[i].Offset)) {
                bDetected = true;
                break;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_SZDD.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "SZDD");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == 2128) { // FILE
                if (PE.compare("'SZDD'", PE.resource[i].Offset)) {
                    bDetected = true;
                    break;
                }
            }
        }
    } else if (PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                if (PE.compare("'SZDD'", PE.resource[i].Offset)) {
                    sOptions = "1997 by Khaled Mardam-Bey";
                    bDetected = true;
                    break;
                }
            }
        }
    } else if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                if (PE.compare("'SZDD'", PE.resource[i].Offset)) {
                    sOptions = "1997 by Klever Co.";
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_Squeez_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Squeez SFX");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")) {
        if (PE.compareOverlay("'SQ5SFX'")) {
            sVersion = "6.0.0.0";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_WinACE.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "WinACE");

function detect() {
    if (/WinACE|UNACE/i.test(PE.getVersionStringInfo("InternalName"))) {
        sVersion = PE.getVersionStringInfo("FileVersion");
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/sfx_WinIMP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "WinIMP");

function detect() {
    if (PE.compareEP("51526a..2eff15........506a..6a..2eff15........50e8........502eff15........5a59c3")) {
        if (PE.compareOverlay("'IMP'0a")) {
            sOptions = "1999 by Technelysium Pty Ltd";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_WinImage.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "WinImage");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d........83ec..89018b15")) {
        if (PE.compareOverlay("'RsDl'")) {
            sOptions = "1998 by Gilles Vollant";
            bDetected = true;
        } else if (PE.compare("'WSfxPK'0304", PE.getOverlayOffset() + 0xC)) {
            sVersion = "0.90";
            sOptions = "1993-97 by Gilles Vollant";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_WinPatch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "WinPatch Apply Program by Artistry, Inc.");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....535657")) {
        if (PE.compareOverlay("'@Daisy@Lucy@xyzzy@'................1f8b08")) {
            sOptions = "1996-1998 (gzip)";
            bDetected = true;
        } else if (PE.compareOverlay("'@Daisy@Lucy@xyzzy@'1f8b08")) {
            sOptions = "1996-1998 (gzip)";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_WinRAR.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "WinRAR");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    var isPkOverlay = PE.compareOverlay("'PK'");

    if (isPkOverlay || PE.compareOverlay("'Rar!'")) {
        if (PE.resource["STARTDLG"] && PE.resource["LICENSEDLG"] || PE.resource["INSTALL"] && PE.resource["SETUP"]) {
            if (isPkOverlay) {
                sOptions = "ZIP";
            }

            bDetected = true;
        }
    }
    if (PE.compareEP("e8$$$$$$$$53bb........e8........85c074..33d28a1083fa..75..40eb")) {
        if (PE.compareOverlay("'Rar!'1a")) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/sfx_WinZip.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("sfx", "WinZip");

function detect() {
    if (PE.compareEP("ff15........b1..380874..b1..4080....74..380874..4080....75..80....74..4033")) {
        sVersion = "6.X";
        bDetected = true;
    } else if (PE.compareEP("53ff15........b3..38..74..80c3..4033d28a083aca74..3acb74..408a083aca75")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(255, PE.getOverlaySize()), "504b0304") != -1) {
            sVersion = "2.2";
        } else if (PE.compareEP("8A48014033D23ACA740A3ACB74068A4801", 16)) {
            sVersion = "8.X";
        }
        bDetected = true;
    } else if (PE.compareEP("53ff15........b3..38..74..80c3..8a48..4033d23aca74..3acb74..8a48..40")) {
        sVersion = "8.X";
        bDetected = true;
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.resource[i].Type != "RT_DIALOG") {
                if (PE.findSignature(PE.resource[i].Offset, Math.min(PE.resource[i].Size, 0x1100), "'PK'0304") != -1) {
                    bDetected = true;
                }
            }
        }
        if (PE.isSectionNamePresent("_winzip_")) {
            bDetected = true;
        }
    }
    if (PE.isSectionNamePresent("_winzip_")) {
        if (PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber("_winzip_")), 0x1000, "'PK'0304") != -1) {
            sVersion = "3.1";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/PE/sfx_ZipCentral_SFX.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "ZipCentral SFX-32");

function detect() {
    if (PE.compareEP("558BEC83C4..33C089....B8........e8........33c05568........64....64....6a")) {
        if (PE.compareOverlay("'MPV*'")) {
            sVersion = "2.0";
            sOptions = PE.getGeneralOptions();
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_Zip_SFX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Zip SFX");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(255, PE.getOverlaySize()), "'PK'0304") != -1) {
            bDetected = true;
        }
    } else if (PE.compareEP("558bec83c4..b8........e8........33c05568........64ff30648920e8")) {
        if (PE.resource.length) {
            if (PE.resource[0].Type == 784) { // ZIP
                bDetected = true;
            }
        }
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb")) {
        if (PE.compareOverlay("'PK'0304")) {
            sOptions = "by Intel";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec83c4..5356e8$$$$$$$$e8........6a..e8........8905........e8........8905")) {
        if (PE.compareOverlay("'PK'0304")) {
            sOptions = "by C.Ghisler & Co.";
            bDetected = true;
        }
    }
    if (PE.compareEP("558becb8........e8........5356be........578d45..5633db5053ff15........85c00f84")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "'PK'0304") != -1) {
            sOptions = "by Symantec";
            bDetected = true;
        }
    }
    if (PE.compareEP("83ec..5657ff15........8bf08d4424..50c74424..........ff15........8a068b3d........3c..75..56ffd7")) {
        if (PE.compareOverlay("'PK'0304")) {
            sName = "SymW32SFX";
            sOptions = "by Symantec";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec83ec..565733ffff15........8bf0897d..8d45..50ff15........8a063c..75..56ff15")) {
        if (PE.compareOverlay("'PK'0304")) {
            sName = "Symantec EasyZIP SFX";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec83ec..56ff15........8bf08a003c..75..84c074..803e..74..46803e..75..803e..75..46eb")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x2000, "'PK'0304") != -1) {
            sOptions = "Squeez SFX by SpeedProject 1995-1998";
            bDetected = true;
        }
    }
    if (PE.compareEP("6a..33c0505050ff15........50e8$$$$$$$$55b8........8bece8........53b9........5657be")) {
        if (PE.compareOverlay("'PK'0304")) {
            sOptions = "EasyZIP SFX by AKSoft 1995-1996";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db/PE/sfx_rar.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "RAR");

function detect() {
    if (PE.compareEP("558bec83c4..535657e8........e8........33c05568........64ff30648920e8")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.compare("'rar!'", PE.resource[i].Offset)) {
                bDetected = true;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/sign_tool_Windows_Authenticode.7.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Rewritten by: DosX

meta("sign tool", "Windows Authenticode");

function detect() {
    if (PE.isSigned()) {
        sVersion = "2.0";
        sOptions = "PKCS #7";
        bDetected = true;

        if (!PE.compareOverlay("00020200", 0x04)) {
            sOptions = sOptions.append("after overlay");
        }
    }

    return result();
}


================================================
FILE: db/PE/tool_AHTeam_UPX_Mutanter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research <koffidev365supp@gmail.com>

meta("tool", "AHTeam UPX Mutanter");

function detect() {
    if (PE.compareEP("94 bc 61 62 4d 00 b9 .. 00 00 00 80 34 0c .. e2")) {
        sOptions = "Method 2";
        bDetected = true;
    }
    if (PE.compareEP("94 bc .. b9 4d 00 b9 .. 00 00 00 80 34 0c .. e2")) {
        sOptions = "Method 1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/tool_Microsoft_VisualStudio_NET.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("tool", "Microsoft Visual Studio");

function detect() {
    if (PE.isNet() && PE.isSignatureInSectionPresent(0, "590100'KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/tool_UPX-Patcher.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/UPX-Patcher
meta("tool", "UPX-Patcher");

function detect() {
    var dosxSection = PE.section[".dosx"],
        fishSectionByIndex = dosxSection ? PE.section[dosxSection + 1] : undefined;

    if (PE.getNumberOfSections() > 2 &&
        fishSectionByIndex && dosxSection &&
        fishSectionByIndex.Name === ".fish") {
        bDetected = true;

        var is64 = PE.is64();

        if (!PE.isDll()) {
            if (PE.compareEP(is64 ?
                "53" : // push rbx (x64)
                "55"   // push ebp (x86)
            )) {
                sOptions = (is64 ? "x64" : "x86") + " mode"; // Custom EP
            } else {
                bDetected = false;
            }
        }
    }

    return result();
}

================================================
FILE: db/PE/tool_UPXFreak.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "UPXFreak");

function detect() {
    if (PE.compareEP("BE........83C601FFE60000")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/tool_UPX_Inliner.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "UPX Inliner");

function detect() {
    if (PE.compareEP("9C60E8000000005DB8........2D........2BE88DB5D5FEFFFF8B0683F8007411")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/tool_UPX_Modifier.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "UPX Modifier");

function detect() {
    if (PE.compareEP("50BE........8DBE........5783CD")) {
        sVersion = "0.1X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/tool_UPX_lock.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "UPX lock");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........60E82B030000")) {
        sVersion = "1.0-1.2";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/tool_UPX_scrambler.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "UPX Scrambler");

function detect() {
    if (PE.compareEP("E8000000005983C10751C3C3BE........83EC04893424B9800000008136........50B80400000050033424585883E903E2E9EBD6")) {
        sVersion = "3.06";
        bDetected = true;
    } else if (PE.compareEP("66C705........7507E9..FEFFFF00")) {
        bDetected = true;
    } else if (PE.compareEP("9061BE........8DBE........5783CDFF")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (PE.compareEP("9061BE........8DBE........c787................5783CDFF")) {
        sVersion = "1.X";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PE/tool_UnoPiX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("tool", "UnoPiX");

function detect() {
    if (PE.compareEP("60E8070000006168........C383042418C3")) {
        sVersion = "0.75";
        bDetected = true;
    }

    if (PE.nLastSection >= 2) {
        var nVirtualSize = PE.section[PE.nLastSection].VirtualSize;
        if (nVirtualSize == 0x1000) {
            if (nVirtualSize == PE.section[PE.nLastSection].FileSize) {
                var nFlags = PE.section[PE.nLastSection].Characteristics;
                if (nFlags == 0xe0000040 && !PE.section[PE.nLastSection].Name && PE.getMajorLinkerVersion() == 0 && PE.getMinorLinkerVersion() == 0) {
                    sVersion = "0.94";
                    bDetected = true;
                }
            }
        }
    }

    return result();
}


================================================
FILE: db/PE/tool_XVolkolak.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://n10info.blogspot.com/2018/03/xvolkolak-010.html
meta("tool", "XVolkolak");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    var xvlkSectionsCounter = 0,
        resourceSectionsCounter = 0,
        isRwxSectionPresent = false;

    for (var i = 0; i < PE.getNumberOfSections(); i++) {
        var sectionToCheck = PE.section[i];

        if (sectionToCheck.Name === ".xvlk") {
            xvlkSectionsCounter++;

            if (sectionToCheck.Characteristics & 0xe0000020) {
                isRwxSectionPresent = true;
            }
        } else if (/rsrc/i.test(sectionToCheck.Name)) {
            resourceSectionsCounter++;
        }
    }

    if (isRwxSectionPresent && xvlkSectionsCounter >= 2 && PE.getNumberOfSections() === (xvlkSectionsCounter + resourceSectionsCounter)) {
        sOptions = "unpacked";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db/PE/tool_de4dot.6.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

meta("tool", "de4dot");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("smethod_0") && (
            PE.isNetObjectPresent("GClass0") || (
                PE.isNetObjectPresent("Class0") && PE.isNetObjectPresent("Class1")
            )
        )) {
            bDetected = true;
            sOptions = "deobfuscated";
        }
    }

    return result();
}

================================================
FILE: db/PE/zip.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("zip-file");

function detect() {
    detect_Zip(0);

    return result();
}

================================================
FILE: db/PNG/_PNG.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "PNG");

function detect() {
    sName = PNG.getFileFormatName();
    sVersion = PNG.getFileFormatVersion();
    sOptions = PNG.getFileFormatOptions();
    
    if (sName) {
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/PNG/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = PNG;
var X = PNG;

================================================
FILE: db/PYC/_PYC.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "PYC");

function detect() {
    sName = PYC.getFileFormatName();
    sVersion = PYC.getFileFormatVersion();
    sOptions = PYC.getFileFormatOptions();

    bDetected = true;

    return result();
}


================================================
FILE: db/PYC/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = PYC;
var X = PYC;

================================================
FILE: db/PYC/packer_UPP.1.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/KatzenTechnologies/UPP
init("packer", "UPP");

function detect() {
    if (PYC.isConstPresent("UPP!1.10")) {
        sVersion = "1.10";
        bDetected = true;
    }

    return result();
}


================================================
FILE: db/QtFramework
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Qt is tested twice - as a library and as a compiler (to distinguish C from C++). Detect it once here.
// Coauthor: sendersu

var aQt, ownName;

if (typeof aQt === "undefined" && typeof PE !== "undefined") {
    ownName = PE.getFileBaseName() + "." + PE.getFileCompleteSuffix();
    aQt = PE.isLibraryPresentExp(/^Qt(\d)?Core(d?)(\d)?/i);
    //special case - check own name
    if (!aQt) {
        aQt = ownName.match(/^Qt(\d)?Core(d?)(\d)?/i)
        if (aQt)
            aQt[0] = ownName;
    }
}

================================================
FILE: db/RAR/_RAR.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "RAR");

function detect() {
    if (RAR.isVerbose()) {
        sName = RAR.getFileFormatName();
        sVersion = RAR.getFileFormatVersion();
        sOptions = RAR.getFileFormatOptions();
        
        if (sName) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/RAR/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = RAR;
var X = RAR;

================================================
FILE: db/RosASM
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// RosASM's PE DOS stub is tested twice - once to detect RosASM as a compiler and again
// to prevent being detected as a linker (RosASM has no linker). Detect it once here.

var bRosASM;
if (typeof bRosASM === "undefined") {
    bRosASM = false;
    if (PE.compare("'RosAsm Assembler'", 0xb0)) {
        bRosASM = true;
    } else if (PE.compare("'MZ'90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000000000000000........800000000e1fba0e00b409cd21b8014ccd21'This program cannot be run in DOS mode\r\n$'000000000000000000")) {
        bRosASM = true;
    }
}

================================================
FILE: db/SpASM
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// SpASM's PE DOS stub is tested twice - once to detect SpASM as a compiler and
// again to prevent being detected as a linker (SpASM has no linker).  Detect it
// once here.

var bSpASM;
if (typeof bSpASM === "undefined") {
    bSpASM = PE.compare("'MZ'80000000000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000007786c16800000000e1fba0e00b409cd21b8014ccd21'Spindoz 32 spit PEfile made wizz SpAsm Assembler.$'");
}

================================================
FILE: db/TASM32
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// TASM32 uses TLINK32 (Turbo Linker), which is the same linker used by
// Borland C++ and Delphi. The TASM32 script runs after the Borland script
// so that bBorlandC is available for exclusion.

var bTASM32;
if (typeof bTASM32 === "undefined") {
    bTASM32 = false;

    if (PE) {
        // TLINK32 leaves a characteristic DOS stub:
        // "This program must be run under Win32\r\n$" at file offset 0x50.
        // The four wildcard bytes cover the version-specific field.
        if (PE.compare("'This program must be run under Win'....0D0A24..00", 0x50)) {
            // Exclude Borland C++ (same linker, but has a distinct runtime stub
            // or C++-hook marker at the entry point detected by bBorlandC).
            if (!bBorlandC) {
                // Exclude Delphi / C++ Builder: both embed PACKAGEINFO and/or
                // DVCLAL resources, and Delphi uses a TLS directory.
                if (!PE.resource["PACKAGEINFO"] && !PE.resource["DVCLAL"]) {
                    bTASM32 = true;
                }
            }
        }
    }
}


================================================
FILE: db/ZIP/_ZIP.0.sg
================================================
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("format", "ZIP");

function detect() {
    if (ZIP.isVerbose()) {
        sName = ZIP.getFileFormatName();
        sVersion = ZIP.getFileFormatVersion();
        sOptions = ZIP.getFileFormatOptions();
        
        if (sName) {
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db/ZIP/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

var File = ZIP;
var X = ZIP;

================================================
FILE: db/_db_caching
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function _forceCaching(fn) {
    var cacheStore = {};

    return function () {
        var args = Array.prototype.slice.call(arguments),
            key = JSON.stringify(args);

        if (cacheStore.hasOwnProperty(key)) {
            return cacheStore[key];
        }

        return cacheStore[key] = fn.apply(this, arguments);
    };
}


var useBetaDieEngineCachingTechology = true;

if (useBetaDieEngineCachingTechology) {
    var classNames = [
        "Amiga", "APK", "Archive", "Binary", "COM", "DEX", "DOS4G", "DOS16M",
        "ELF", "IPA", "JAR", "LE", "LX", "MACH", "MACHOFAT", "MSDOS", "NE", "NPM", "PDF", "PE", "ZIP"
    ];

    var methodsToWrap = [
        "isSignaturePresent",
        "isSignatureInSectionPresent",
        "findSignature",
        "compare",
        "findString"
    ];

    for (var i = 0; i < classNames.length; i++) {
        var className = classNames[i];

        try {
            if (typeof this[className] === "object" || typeof this[className] === "function") {
                var cls = this[className];

                for (var j = 0; j < methodsToWrap.length; j++) {
                    var methodName = methodsToWrap[j];
                    if (typeof cls[methodName] === "function") {
                        cls[methodName] = _forceCaching(cls[methodName]);
                    }
                }
            }
        } catch (e) {
            _error(e.message);
        }
    }

    try {
        if (typeof this.PE !== "undefined" && typeof this.PE.isNetObjectPresent === "function") {
            this.PE.isNetObjectPresent = _forceCaching(this.PE.isNetObjectPresent);
        }
    } catch (e) {
        _error(e.message);
    }
}

================================================
FILE: db/_debug
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Debugging functions to help with development

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// Just a debug function
function _debug(messageText) {
    messageText = "-> " + messageText;
    _log("Debug: " + messageText);
    _setResult("dev-output", messageText, "", "");
}

// Handle exceptions and log them
function _error(exceptionText) {
    var exceptionText = "Error: " + exceptionText;

    if (sName) {
        exceptionText += ", last define() is '" + sName + "' with type '" + sType + "'";
    }

    _log("Exception: " + exceptionText);
    throw exceptionText;
}

================================================
FILE: db/_init
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

includeScript("_debug");
includeScript("_runtime_helpers");
includeScript("language");

var bDetected,
    sType,
    sName,
    sVersion,
    sOptions,
    sLang,
    sLangVersion;

/**
 * Initializes the detection process with the given parameters.
 *
 * @param {string} sType - The type of the item to detect.
 * @param {string} sName - The name of the item to detect.
 * @param {string} [sVersion] - The version of the item to detect. Optional.
 * @param {string} [sOptions] - Additional options for detection. Optional.
 * @param {string} [sLang] - The programming language of the item to detect. Optional.
 * @param {string} [sLangVersion] - The version of the programming language. Optional.
 */
function meta(
    sTypeInput,       // (*) type
    sNameInput,       // (*) name
    sVersionInput,    //     version
    sOptionsInput,    //     options
    sLangInput,       //     language
    sLangVersionInput //     language version
) {
    if (!sTypeInput) _error("No input detection type.");

    sType = sTypeInput;
    sName = sNameInput ? sNameInput : String();

    sVersion = sVersionInput ? sVersionInput : String();
    sOptions = sOptionsInput ? sOptionsInput : String();
    sLang = sLangInput ? sLangInput : String();
    sLangVersion = sLangVersionInput ? sLangVersionInput : String();

    bDetected = false;
}

function init() { meta.apply(null, arguments); }


/**
 * Processes the detection result and resets the detection variables.
 *
 * If a detection has been made (bDetected is true), this function sets the result
 * using the _setResult function with the provided type, name, version, and options.
 * After setting the result, it resets the detection flag (bDetected) to false.
 *
 * Regardless of whether a detection was made, it resets the sName, sVersion, and sOptions
 * variables to empty strings.
 */
function result() {
    if (bDetected) {
        sVersion = sVersion ? sVersion : String();
        sOptions = sOptions ? sOptions : String();

        if (sName) {
            _setResult(sType, sName, sVersion, sOptions);

            if (sLang) {
                if (sLangVersion) {
                    _setLang(sLang, sLangVersion);
                } else {
                    _setLang(sLang);
                }
            }
        } else {
            _error("No input detection name.");
        }
    }

    sName = sVersion = sOptions = sLang = sLangVersion = '';

    var resultValue = bDetected;

    bDetected = false;

    return resultValue;
}

================================================
FILE: db/_runtime_helpers
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

/**
 * Attaches new strings to `this`, separating everything with a comma and no space.
 * @param {String...} the open list of strings to append.
 */
String.prototype.append = function () {
    var str = String(this);
    var separator = ", ";

    if (arguments.length > 0) {
        if (str.length > 0) {
            str += separator;
        }
        str += Array.prototype.join.call(arguments, separator);
    }

    return str;
}


/**
 * Append a string with a custom separator.
 * @param {String} stringToAppend - String to append.
 * @param {String} [separator=", "] - Separator string.
 * @returns {String} The new string.
 * @global
 * @example
 * sOptions = sOptions.appendS("debug","::");
 */
String.prototype.appendS = function (stringToAppend, separator) {
    var str = String(this);
    var sep = (typeof separator === "string") ? separator : ", ";

    if (stringToAppend) {
        if (str.length > 0) {
            str += sep;
        }
        str += stringToAppend;
    }

    return str;
}


String.prototype.addIfNone = function (substring) {
    var str = String(this);

    if (substring && str.indexOf(substring) < 0) {
        str += substring;
    }

    return str;
}


// Some ECMA6 functions that should be removed if DIE transitions to it
if(!String.prototype.startsWith) String.prototype.startsWith = function (s, min) {
    // the default case-sensitive version of startsWith
    var m = (typeof min == "number") ? Math.min(s.length, min) : 0;
    if (s.length > this.length - m) return false;
    return this.slice(m, s.length) == s;
}

String.prototype.startsWithCI = function (s, min) {
    // case-insensitive version of startsWith
    // the built-in clearly just checks for arguments length instead of max being undefined, so we copy that...
    if(arguments.length < 2) return this.toLowerCase().startsWith(s.toLowerCase());
    else return this.toLowerCase().startsWith(s.toLowerCase(), min);
}

if(!String.prototype.endsWith) String.prototype.endsWith = function (s, max) {
    // the default case-sensitive version of endsWith
    var m = (typeof max == "number") ? Math.min(this.length, max) : this.length;
    if (s.length > m) return false; if(!s.length) return true;
    return this.slice(m - s.length, m) == s;
}

String.prototype.endsWithCI = function (s, max) {
    // the case-insensitive version of endsWith
    // the built-in clearly just checks for arguments length instead of max being undefined, so we copy that...
    if(arguments.length < 2) return this.toLowerCase().endsWith(s.toLowerCase());
    else return this.toLowerCase().endsWith(s.toLowerCase(), max);
}

if (!String.prototype.repeat) String.prototype.repeat = function (num) {
    if (typeof num !== "number") return this;
    var s = this; for (var i = 1; i < num; i++) s += this; return s;
}

/**
 * Pad the start of a line with spaces or the character given.
 * @param {String or Number} The width desired.
 * @param {Number} [nPad=" "] The padding string. Loops.
 * @returns {String} The new string.
 * @global
 * @example
 * var a = 12; ...; if("aba12" === a.padStart(5,"ab")) ...
 */
if (!String.prototype.padStart) String.prototype.padStart = function (targetLength, padString) {
    var s = this.valueOf();

    targetLength >>= 0; // truncate if number or convert non-number to 0;
    padString = String(padString || ' ');

    if (s.length >= targetLength) {
        return String(s);
    }

    targetLength -= s.length;
    if (targetLength > padString.length) {
        padString += padString.repeat(Math.ceil(targetLength / padString.length));
        // append to original to ensure we are longer than needed
    }

    return padString.slice(0, targetLength) + String(s);
}

if (!Number.prototype.padStart) Number.prototype.padStart = function (targetLength, padString) {
    var s = this.valueOf().toString();

    targetLength >>= 0; // truncate if number or convert non-number to 0;
    padString = String(padString || ' ');

    if (s.length >= targetLength) return s;

    targetLength -= s.length;
    if (targetLength > padString.length) {
        padString += padString.repeat(Math.ceil(targetLength / padString.length));
        // append to original to ensure we are longer than needed
    }

    return padString.slice(0, targetLength) + s;
}

if(!Number.prototype.clamp) Number.prototype.clamp = function (min, max) { return Math.min(Math.max(this, min), max) }

if(!String.prototype.replaceAll) String.prototype.replaceAll = function (s, r) {
    if (typeof s != 'string' || typeof r != 'string') return '?' + s;
    var o = '';
    for (var i = 0; i < this.length; i++) {
        if (this.slice(i, i + s.length) == s) { o += r; i += s.length - 1 } else o += this[i];
    }
    return o;
}

if (!Array.prototype.includes) { Array.prototype.includes = function (searchElement, fromIndex) {
    if (this == null) throw new TypeError('"this" is null or not defined');
    var o = Object(this);
    var len = o.length >>> 0;
    if (len === 0) return false;

    var n = fromIndex | 0;
    var k = Math.max(n >= 0 ? n : len - Math.abs(n), 0);

    while (k < len) {
      var element = o[k];
      if (element === searchElement || (typeof element === 'number' && typeof searchElement === 'number' && isNaN(element) && isNaN(searchElement))) {
        return true;
      }
      k++;
    }
    return false;
  };
}

if (!String.prototype.includes) String.prototype.includes = function (search, start) {
    if (typeof start !== 'number') start = 0;
    if (start + search.length > this.length) return false;
    return this.indexOf(search, start) !== -1;
  };


================================================
FILE: db/archive-file
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Common routines for handling archives.

meta("archive");

var Archive = {
    nFiles: 0, // number of files in archive
    nDirs: 0, // number of directories in archive
    nSize: 0, // total unpacked size of all files
    nPacked: 0, // total packed size of all files

    // Add an entry, updating the counts and sizes.
    add: function(nSize, nPacked, bDir) {
        if (bDir) {
            this.nDirs++;
        } else {
            this.nFiles++;
            this.nSize += nSize;
            this.nPacked += nPacked;
        }
    },

    // Return the contents according to what was found - "P%,F files,D dirs".
    contents: function() {
        var sContents = "";
        if (this.nSize != 0) {
            sContents = (this.nPacked / this.nSize * 100).toFixed(1) + "%";
        }
        if (this.nFiles != 0) {
            sContents = sContents.append(this.nFiles + (this.nFiles == 1 ? " file" : " files"));
        }
        if (this.nDirs != 0) {
            sContents = sContents.append(this.nDirs + (this.nDirs == 1 ? " dir" : " dirs"));
        }
        return sContents;
    }
}

================================================
FILE: db/arj
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Detect an ARJ archive.
// Info from http://www.fileformat.info/format/arj/corion.htm
includeScript("archive-file");
sName = "ARJ";

function detect_ARJ(bFile, bShowOptions) {
    var nOffset, nSize;
    if (bFile) {
        nOffset = 0;
        nSize = File.getSize();
    } else {
        nOffset = File.getOverlayOffset() + 8;
        nSize = File.getOverlaySize();
    }
    if (nSize >= 64) {
        if (File.compare("60EA", nOffset)) {
            sVersion = File.readByte(nOffset + 5);
            bDetected = true;
        }
        if (bDetected && bShowOptions) {
            // Options
            switch (File.readByte(nOffset + 7)) // Host OS
            {
                case (0):
                    sOptions = sOptions.append("MS-DOS");
                    break;
                case (1):
                    sOptions = sOptions.append("PRIMOS");
                    break;
                case (2):
                    sOptions = sOptions.append("UNIX");
                    break;
                case (3):
                    sOptions = sOptions.append("AMIGA");
                    break;
                case (4):
                    sOptions = sOptions.append("MAC-OS");
                    break;
                case (5):
                    sOptions = sOptions.append("OS/2");
                    break;
                case (6):
                    sOptions = sOptions.append("APPLE GS");
                    break;
                case (7):
                    sOptions = sOptions.append("ATARI ST");
                    break;
                case (8):
                    sOptions = sOptions.append("NeXT");
                    break;
                case (9):
                    sOptions = sOptions.append("VAX VMS");
                    break;
            }
            if (File.readByte(nOffset + 8) & 0x01) // password
            {
                sOptions = sOptions.append("encrypted");
            }

            switch (File.readByte(nOffset + 9)) // Compression method
            {
                case (0):
                    sOptions = sOptions.append("stored");
                    break;
                case (1):
                    sOptions = sOptions.append("compressed most");
                    break;
                case (2):
                    sOptions = sOptions.append("compressed");
                    break;
                case (3):
                    sOptions = sOptions.append("compressed faster");
                    break;
                case (4):
                    sOptions = sOptions.append("compressed fastest");
                    break;
            }
        }
    }
}

================================================
FILE: db/bytecodeparsers
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Author: Kae <TG@kaens>

/* A collection of binary (bytecodes, disassemblers) parsers intended for sanity checks.
Each parser must have these parameters (len optional):
    {UInt} [p=0] - pointer (file offset) from where to begin
    {Int} [len=BCParseUntilReasonable] - either the block length or one of the constants above. Not all parsers will support all constants (EoF is implied anyway, and there may not be end markers in a format) but the ToReasonable must be present.
It must return a list [n, e, 0, ...] where:
    - n: BCInvalidFormat, or the first value is the number of commands parsed,or the number of notes read. If n is BCInvalidFormat, the other return list values may be absent;
    - e: -1 or the position after the end marker;
    - 0: [reserved]
    - any custom useful data, such as tags, may be added as well (values [3...]).
*/
/* beautify ignore:start */

//Put these in the length parameter when you're unsure how long the tested block is
BCParseToReasonable = 0; // the default idea of the parser
BCParseToEoF = -1; // physical file end
BCParseToEndMarker = -2; // logical block end (like an end-block bytecode, RET in disassembly...)
BCInvalidFormat = -1;

const debug = 0;


// -= PC98xx MUAP parsing =-

    function MUAP98CmdStr(ch, o, recurse) {
    if (typeof recurse != 'number') recurse = 0; if (recurse > 2) return '…';
    const
        C = [/*0~2: FM:*/'FM1: ', 'FM2: ', 'FM3: ', /*3~5:*/'SSGA: ', 'SSGB: ', 'SSGC: ',
        /*6~8,11~17: FM:*/'FM4: ', 'FM5: ', 'FM6: ', /*9,10:*/'RHY: ', 'PCM: ',
            'FM7: ',/*12~14: either YM3438 or YM2203*/'FM8: ', 'FM9: ', 'FM10: ', 'FM11: ', 'FM12: '],
        notes = ['C#', 'D', 'D#', 'E', 'F', 'F#', 'G', 'G#', 'A', 'A#', 'B', 'C'],
        c = X.U8(o), cht = ch == 9 ? 'rhy' : ch == 10 ? 'pcm' : 3 <= ch && ch <= 5 ? 'ssg' : 'fm',
        ifop = ['=', '>', '<', '!=' /*the rest always denote FP*/];
    var t;
    if (cht == 'fm' && c < 0x40)
        return C[ch] + 'note "' + Hex(c) + '" ' + notes[c % 12] + (1 + Util.divu64(c, 12)) + ' ~' + X.U8(o + 1);
    else if (cht == 'ssg' && c < 0x10)
        return C[ch] + 'key-on "' + Hex(c) + '" ' + ' ~' + X.U8(o + 1);
    else switch (c) {
        case 0xFF: return C[ch] + 'rest'; case 0xFE: return C[ch] + 'reset & play'; case 0xFD: return C[ch] + 'reset & stop';
        case 0xFC: return '-= ' + C[ch] + 'End. =-';
        case 0xFB: return C[ch] + "wait on '";
        case 0xFA: return C[ch] + (ch == 9 || ch == 10 ? 'x9 nop' : '3ch 4harm play ' + outArray(X.readBytes(o + 1, 8), 16));
        case 0xF9: return C[ch] + (ch == 9 || ch == 10 ? 'rhy cmd end' : 'same freq play');
        case 0xF8: return C[ch] + 'add freq ' + outArray(X.readBytes(o + 1, 3), 16);
        case 0xF7: return C[ch] + 'loop @' + Hex(o - X.I16(o + 1)) + ' x' + Hex(X.U8(o + 3));
        case 0xF6: return C[ch] + (cht == 'ssg' ? 'noise freq ' : 'pan ') + Hex(X.U8(o + 1));
        case 0xF5: return C[ch] + 'Timer-A tempo ' + Hex(X.U16(o + 1));
        case 0xF4: return C[ch] + 'set length ' + Hex(X.U8(o + 1)) + ', ratio ' + Hex(X.U8(o + 2));
        case 0xF3: return 'wait all channels';
        case 0xF2: return C[ch] + (ch == 9 || ch == 10 ? 'DSP mode, level, delay' + outArray(X.readBytes(o + 1, 3), 16) :
            cht == 'ssg' ? 'set start decay data' + outArray(X.readBytes(o + 1, 3), 16) : 'nop');
        case 0xF1: return C[ch] + 'R' + Hex(X.U8(o + 1)) + ' = ' + Hex(X.U8(o + 2));
        case 0xF0: return C[ch] + (ch == 9 || ch == 10 ? 'Rhythm Key On ' : 'set system detune ') + Hex(X.U8(o + 1));
        case 0xEF: return C[ch] + (ch == 9 || ch == 10 ? 'Rhythm Dump ' : 'hard LFO speed ') + Hex(X.U8(o + 1));
        case 0xEE: return C[ch] + (ch == 9 || ch == 10 ? 'Rhythm pan/vol ' : 'hard LFO AMD,PMD,AMon') + outArray(X.readBytes(o + 1, 2), 16);
        case 0xED: return C[ch] + (ch == 9 || ch == 10 ? 'x2 nop' : '3ch 4harm mode ' + outArray(X.readBytes(o + 1, 2), 16));
        case 0xEC: return C[ch] + 'key display mask on/off & colour ' + Hex(X.U8(o + 1));
        case 0xEB: return C[ch] + (ch == 9 || ch == 10 ? 'PCM Tone ' : cht == 'ssg' ? 'mixer mode ' : 'tone ') + Hex(X.U8(o));
        case 0xEA: return C[ch] + '@jump ' + Hex(o + X.I16(o + 1));
        case 0xE9: return C[ch] + '@call ' + Hex(o + X.I16(o + 1)) + ' ("' + MUAP98CmdStr(ch, o + X.I16(o + 1), recurse + 1) + '"...)';
        case 0xE8: return C[ch] + '@ret';
        case 0xE7: return C[ch] + 'Source Line symbolic info ' + Hex(X.U16(o + 1));
        case 0xE6: return C[ch] + (ch == 9 || ch == 10 || cht == 'ssg' ? 'x27 nop' : 'USR Tone');
        case 0xE5: return C[ch] + 'Play Stack init';
        case 0xE4: return C[ch] + '@if x' + ((X.U8(o + 1) & 0xF) - 6) + ' ' + ifop[X.U8(o + 1) >> 4] + ' ' + X.U8(o + 2)
            + ' jump ' + Hex(t = o + 2 + X.I16(o + 3)) + ' ("' + MUAP98CmdStr(ch, t, recurse + 1) + '"...)';
        case 0xE3: return C[ch] + '@if x' + ((X.U8(o + 1) & 0xF) - 6) + ' ' + ifop[X.U8(o + 1) >> 4] + ' ' + X.U8(o + 2)
            + ' call ' + Hex(t = o + 2 + X.I16(o + 3)) + ' ("' + MUAP98CmdStr(ch, t, recurse + 1) + '")...';
        case 0xE2: return C[ch] + 'change vol data ' + Hex(X.U8(o + 1));
        case 0xE1: return C[ch] + 'tie';
        case 0xE0: return C[ch] + 'loopcnt clear';
        case 0xDF: return C[ch] + 'slur';
        case 0xDE: return C[ch] + 'set ratio ' + Hex(X.U8(o + 1));
        case 0xDD: return C[ch] + 'cmt len ' + Hex(X.U8(o + 1));
        case 0xDC: return C[ch] + 'init Skip_data ' + outArray(X.readBytes(o + 1, 3), 16);
        case 0xDB: return C[ch] + 'cmt: ' + Hex(X.U8(o + 1)) + ' ' + Hex(X.U8(o + 2)) + ': "' + X.SC(o + 4, X.U8(o + 3), 'SJIS') + '"';
        case 0xDA: return C[ch] + 'set X: ' + outArray(X.readBytes(o + 1, 3), 16);
        case 0xD9: return C[ch] + 'set LFO pars. ' + outArray(X.readBytes(o + 1, 6), 16);
        case 0xD8: return C[ch] + 'LFO start(p,a)/stop ' + Hex(X.U8(o + 1)); //LFO start(pmd,amd)/stop
        case 0xD7: return C[ch] + 'vol += ' + Hex(X.U8(o + 1));
        case 0xD6: return C[ch] + 'vol -= ' + Hex(X.U8(o + 1));
        case 0xD5: return C[ch] + (ch == 9 || ch == 10 ? 'PCM play ' : cht == 'ssg' ? 'Start vol/Attack rate ' : 'x3 nop ') + X.U16(o);
        case 0xD4: return C[ch] + (ch == 9 || ch == 10 ? 'PCM addr ' + X.U32(o + 1) : 'x5 nop');
        case 0xD3: var t = (X.U8(o + 1) & 0xF) - 6; return C[ch] + '@if ' + (t >= 0 ? 'x' + t : 'lpcnt') + ' ' + ifop[X.U8(o + 1) >> 4] + ' ' + X.U8(o + 2)
            + ' exit ' + Hex(o + 5 + X.U16(o + 3));
        case 0xD2: return C[ch] + 'Play Stack +1';
        case 0xD1: return C[ch] + 'fade out';
        case 0xD0: return C[ch] + 'ssg||pcm ' + Hex(X.U8(o + 1));
        case 0xCF: return C[ch] + 'channel change ' + Hex(X.U8(o + 1));
        case 0xCE: return C[ch] + (ch == 9 || ch == 10 ? 'set last tone,vol,pan' : cht == 'ssg' ? 'set last tone,vol' : '?? FM: CEh ??');
        default: return C[ch] + 'unk. cmd ' + Hex(c);
    }
}

/** Packen/ぱっくん Software MUAP98/みゅあっぷ Object bytecode detector. If < 0, consider invalid.
 * The custom data returned is the comment field or "".
 */
function parseMUAP98(p, len, ch) {
    len = len || BCParseToReasonable; p = p || 0;
    const p0 = p,
        max = (len == BCParseToReasonable) ? Math.min(0x10000, X.Sz(), p + 0x400) :
            (len == BCParseToEoF || len == BCParseToEndMarker) ? Math.min(0x10000, X.Sz()) : p + len;
    var cht = (ch == 9) ? 'rhy' : ch == 10 ? 'pcm' : 3 <= ch && ch <= 5 ? 'ssg' : 'fm',
        c, notes = 0, stop = false, cmtlen = -1, cmt = "", /*stack depths:*/ lpd = 1, calld = ifd = mp = ic = 0;
    var visited = [];
    for (var i = p0; i < max; i++) visited[i] = false;
    function re(p, t) { if (debug > 1) _l2r('muap98', p, 'ch' + ch + ': ' + t); return [BCInvalidFormat, p, 0]; }
    while (p0 <= p && p < max && !stop) {
        if (ifd < 0) sus++;
        visited[p] = true; if (p > mp) mp = p;
        //_log(Hex(p,4)+': '+MUAP98CmdStr(ch,p));
        c = X.U8(p);
        if (c < 0x40) {
            if (c > 15 && cht == 'ssg') return re(p, '!badSSGnote');
            if (!X.U8(p + 1)) ic++; //actually happens...
            notes++; p += 2;
        }
        else if (c < 0xCE) return re(p, '!badcmd' + Hex(c));
        else switch (c) {
            case 0xFF: p++; break; //keyoff and rest for note length
            case 0xFE: lpd = 0; p++; break; //reset & restart
            case 0xFD: p++; stop = true; break; //reset & stop playback
            case 0xFC: stop = true; p++; if (mp < p) mp = p; break; //channel end playback
            case 0xFB: p++; break; /*wait on '*/
            case 0xF9: if (ch != 9) notes++; p++; break; //FM/SSG: same frequency play; RHY/PCM: rhythm cmd end
            case 0xF8: p += 4; break; //add frequency
            case 0xF7: t = p - X.I16(p + 1); if (!isWithin(t, 0x18, max) || Math.abs(t - p) < 2) return re(p, 'loop@' + Hex(t));
                if (!isWithin(t, p0, max)) sus++; p += 4; break; //loop N times
            case 0xF6: p += 2; break; //pan
            case 0xF5: if (!isWithin(X.U16(p + 1), 0x10, 0xFFF/*dox: C18 max*/)) return re(p, '!badtempo'); //Timer-A tempo
                p += 3; break;
            case 0xF4: p += 3; break; //length/ratio change
            case 0xF3: p++; break; //wait all channels: 小節位置を調整する。演奏しているチャネル全てにこのデータが来るまで待機する。
            case 0xF2: p += 4; break; //RHY/PCM: DSP mode, level, delay; FM/SSG: a 4-byte nop
            case 0xF1: p += 3; break; //set reg data
            case 0xF0: //set system detune; RHY/PCM: Rhythm Key on
                if (ch == 9 || ch == 10) { notes++; if (!X.U8(p + 1)) re(p, 'RHY F0: 0') }
                p += 2; break;
            case 0xDF/*slur*/: case 0xD2/*Play Stack +1*/: case 0xD1/*fade out*/: p++; break;
            case 0xFA: p += 9; break; // 3ch 4harm play; RHY/PCM: a 9-byte nop
            case 0xEF: p += 2; break; //hard LFO speed; RHY/PCM: Rhythm Dump
            case 0xEE: p += 3; break; //hard LFO AMD, PMD, AMon; RHY/PCM: set Rhythm pan/vol
            case 0xED: p += 2; break; //3ch 4harm mode; RHY/PCM: a 2-byte nop
            case 0xEC: p += 2; break; //key display mask on/off & colour
            case 0xEB: p += 2; break; //tone number change
            case 0xEA: //@jump, @call
                t = p + X.I16(p + 1); if (!isWithin(t, 0x18, max) || Math.abs(t - p) < 2) return re(p, '!' + MUAP98CmdStr(ch, p, 1));
                if (t < p0) ic++; if (visited[t]) stop = true; p = t; break;
            case 0xE9:
                t = p + X.I16(p + 1); if (!isWithin(t, 0x18, max) || Math.abs(t - p) < 2) return re(p, '!' + MUAP98CmdStr(ch, p, 1));
                if (t < p0) ic++; calld++; p += 3; break;
            case 0xE8: calld--; if (calld < 0) return re(p, '!RetW/oSub'); p++; break; //@ret
            case 0xE7: p += 3; break; //Source Line symbolic information
            case 0xE6:
            /* if(cht == 'fm') { TODO } */ p += 27; break; //FM: set USR Tone parameter; SSG, RHY, PCM: a 27-byte nop
            case 0xE5: p++; break; //Play Stack init
            case 0xE4: case 0xE3: //if @jump, if @call
                t = p + 2 + X.I16(p + 3); if (!isWithin(t, 0x18, max) || Math.abs(t - p) < 2 || (X.U8(p + 1) >> 4) > 3) return re(p, '!' + MUAP98CmdStr(ch, p, 1));
                if (t < p0) ic++;
                if (c == 0xE3) calld++; if (c == 0xE4) { if (visited[t]) stop = true; p = t } else p += 5; break;
            case 0xE2: p += 2; break; //change vol data
            case 0xE1: p++; break; //tie
            case 0xE0: lpd = 0; p++; break; //loop ctr clear
            case 0xDE: p += 2; break; //change ratio only
            case 0xDD: cmtlen = X.U8(p + 1); p += 2; break; //doesn't seem to be of any use...
            case 0xDC: p += 4; break; //init Skip_data
            case 0xDB: cmt = cmt.appendS(X.SC(p + 4, X.U8(p + 3), 'SJIS'), ' / '); p += X.U8(p + 3) + 4; break;
            case 0xDA: p += 4; break; //set X Value
            case 0xD9: p += 7; break; //set LFO parameters
            case 0xD8: p += 2; break; //LFO start(pmd,amd)/stop
            case 0xD7: case 0xD6: p += 2; break; //increase/decrease vol
            case 0xD5: p += 3; if (ch == 9 || ch == 10) notes++; break; //SSG: Start vol/Attack rate; RHY/PCM: PCM play; FM: a 3-byte nop
            case 0xD4: p += 5; break; //RHY/PCM: set PCM address; FM/SSG: a 5-byte nop
            case 0xD3: p += 5; break; //@if... exit current loop
            case 0xD0: re(p, 'ssg/pcm:' + Hex(X.U8(p + 1))); p += 2; break; //SSG||PCM mode
            case 0xCF:
                ch = X.U8(p + 1); cht = (ch == 9) ? 'rhy' : ch == 10 ? 'pcm' : 3 <= ch && ch <= 5 ? 'ssg' : 'fm';
                p += 2; break; //send channel change
            case 0xCE: p++; break; //SSG:set last mixer mode, vol, env; RHY/PCM:set last tone/vol/pan (from before sfx)
        }
    }
    return [notes, p, 0, cmt, mp, ic];
}


// -= MDX/MXDRV command explainer, useful for loggers =-

function MDXCmdStr(ch, o) {
    const C = ['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W'];
    const notes = ['D#', 'E', 'F', 'F#', 'G', 'G#', 'A', 'A#', 'B', 'B#', 'C', 'C#', 'D']; var c = X.U8(o);
    if (c < 0x80) return C[ch] + ': rest ' + (c + 1);
    else if (c <= 0xDF) {
        c -= 0x80;
        if (ch > 8) return C[ch] + ': smp#' + c;
        else return C[ch] + ': ' + notes[c % 12] + (Util.divu64(c, 12)) + ' ~' + (X.U8(o + 1) + 1);
    }
    else switch (c) {
        case 0xFF: return C[ch] + ': bpm ' + X.U8(o + 1); case 0xFE: return C[ch] + ': R ' + YM2151RegStr(X.U8(o + 1), X.U8(o + 2));
        case 0xFD: return C[ch] + ': voicedata ' + X.U8(o + 1); case 0xFC: return C[ch] + ': pan ' + X.U8(o + 1);
        case 0xFB: if (X.U8(o + 1) & 0x80) return C[ch] + ': @vol ' + (X.U8(o + 1) & 0x7F); else return C[ch] + ': vol ' + X.U8(o + 1);
        case 0xFA: return C[ch] + ': vol-'; case 0xF9: return C[ch] + ': vol+';
        case 0xF8: return C[ch] + ': staccato ' + X.U8(o + 1); case 0xF7: return C[ch] + ': legato';
        case 0xF6: return C[ch] + ': rep.' + X.U8(o + 1) + ' [' + (X.U8(o + 2) ? '/' + X.U8(o + 2) : '') + '...';
        case 0xF5: return C[ch] + ': ...]rep.,ret→' + Hex(o + X.I16(o + 1, _BE));
        case 0xF4: return C[ch] + ': .../rep.esc→' + Hex(o + X.I16(o + 1, _BE));
        case 0xF3: return C[ch] + ': detune ' + X.I16(o + 1, _BE) / 0x40;
        case 0xF2: return C[ch] + ': portamento ' + X.I16(o + 1, _BE) / 0x4000 + ' ↓';
        case 0xF1: if (X.U8(o + 1)) return C[ch] + ': loop from ' + Hex(o + 3 + X.I16(o + 1, _BE)) + '.'; else return C[ch] + ' ends.';
        case 0xF0: return C[ch] + ': delay key-on ' + X.U8(o + 1); case 0xEF: return C[ch] + ': sync send on ch' + X.U8(o + 1);
        case 0xEE: return C[ch] + ': sync wait on ch' + X.U8(o + 1); case 0xED: return C[ch] + ': noise/smp freq ' + X.U8(o + 1);
        case 0xEC: if (X.U8(o + 1) == 0x80) return C[ch] + ': pitch LFO off';
        else if (X.U8(o + 1) == 0x81) return C[ch] + ': pitch LFO on';
        else return C[ch] + ': LFO pitch wf ' + X.U8(o + 1) + ' freq ' + X.U16(o + 2, _BE) + ' amp ' + X.U16(o + 4, _BE);
        case 0xEB: if (X.U8(o + 1) == 0x80) return C[ch] + ': vol LFO off';
        else if (X.U8(o + 1) == 0x81) return C[ch] + ': vol LFO on';
        else return C[ch] + ': LFO vol wf ' + X.U8(o + 1) + ' freq ' + X.U16(o + 2, _BE) + ' amp ' + X.U16(o + 4, _BE);
        case 0xEA: if (X.U8(o + 1) == 0x80) return C[ch] + ': OPM LFO off';
        else if (X.U8(o + 1) == 0x81) return C[ch] + ': OPM LFO on';
        else return C[ch] + ': LFO OPM syn/wf ' + X.U8(o + 1) + ' lfrq ' + X.U8(o + 2) + ' PMD ' + X.U8(o + 3) + ' AMD ' + X.U8(o + 4) + ' P/AMS ' + X.U8(o + 5);
        case 0xE9: return C[ch] + ': LFO key-on dly ' + X.U8(o + 1); case 0xE8: return C[ch] + ': PCM8 on';
        case 0xE7: return C[ch] + ': Fadeout' + (X.U8(o + 1) == 1 ? '' : Hex(X.U8(o + 1))) + ' spd ' + X.U8(o + 2);
        default: return C[ch] + ': unknown command ' + Hex(X.U8(o));
    }
}


// -= Yamaha YM2151 FM Operator Type-M (OPM) related functionality =-

function isYM2151Reg(a) {
//The OPM doesn't use these registers so we break off if we hit one:
    return [0, 2, 3, 4, 5, 6, 7, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0x10,
        0x13, 0x15, 0x16, 0x17, 0x1A, 0x1C, 0x1D, 0x1E, 0x1F].indexOf(a) < 0;
}

function YM2151RegStr(a, b) {
    //from https://retrocdn.net/images/9/9c/YM2151_Application_Manual.pdf
    // & https://cx5m.file-hunter.com/fmunit.htm - this one contains errors!
    if (!isYM2151Reg(a)) return '!bad#' + Hex(a);
    if (a == 1) if ((b & 2) == b) return 'LFOR'; else return 'TEST' + Bin(b);
    if (a == 8) return 'keyon ch' + (b & 7) + ' slot' + Bin((b >> 3) & 0xF);
    if (a == 0xF) return 'noise' + ['off', 'on'][b >> 7] + ' freq' + Hex(b >> 0x1F);
    if (a == 0x11) return 'CLKA MSB freq' + Hex(b);
    if (a == 0x12) return 'CLKA LSB freq' + Hex(b & 3);
    if (a == 0x13) return 'CLKB freq' + Hex(b);
    if (a == 0x14) return 'Clk CSM' + (b >> 7) + ' FResetBA' + Bin((b >> 4) & 3, 2)
        + ' IRQEnBA' + Bin((b >> 2) & 3, 2) + ' LoadBA' + Bin(b & 3, 2);
    if (a == 0x18) return 'LowOscFreq ' + Hex(b);
    if (a == 0x19) return ['Amp', 'Phase'][b >> 7] + 'Mod depth' + Hex(b & 0x7F);
    if (a == 0x1B) return 'LFOWave ctl' + (b >> 6) + ' ' + ['saw', 'sqr', 'tri', 'noise'][b & 3];
    if (a <= 0x27) return 'Ch ' + (a & 0x7) + ' ctl ' + (b & 0x80 ? 'R' : '') + (b & 0x40 ? 'L' : '') + ' FB' + ((b >> 3) & 7) + ' con' + (b & 7);
    if (a <= 0x2F) {
        o = ((b >> 4) & 7);
        return 'KC/prep note-on ch' + (a & 0x7) + ' '
            + (o ? ['C#', 'D', 'D#', '', 'E', 'F', 'F#', '', 'G', 'G#', 'A', '', 'A#', 'B', 'C', ''][b & 0xF] + o : '--');
    }
    if (a <= 0x37) return 'KF/prep p.bend ch' + (a & 0x7) + ' kf' + (b >> 2);
    if (a <= 0x3F) return 'ModSensy. ch' + (a & 0x7) + ' phase' + ((b >> 4) & 7) + ' amp' + (b & 3);
    if (a <= 0x47) return 'OP1 ch' + (a & 0x7) + ' dt1:' + ((b >> 4) & 7) + ' mul' + (b & 0xF);
    if (a <= 0x4F) return 'OP3 ch' + (a & 0x7) + ' dt1:' + ((b >> 4) & 7) + ' mul' + (b & 0xF);
    if (a <= 0x57) return 'OP2 ch' + (a & 0x7) + ' dt1:' + ((b >> 4) & 7) + ' mul' + (b & 0xF);
    if (a <= 0x5F) return 'OP4 ch' + (a & 0x7) + ' dt1:' + ((b >> 4) & 7) + ' mul' + (b & 0xF);
    if (a <= 0x67) return 'OP1 ch' + (a & 0x7) + ' TL' + (b & 0x7F);
    if (a <= 0x6F) return 'OP3 ch' + (a & 0x7) + ' TL' + (b & 0x7F);
    if (a <= 0x77) return 'OP2 ch' + (a & 0x7) + ' TL' + (b & 0x7F);
    if (a <= 0x7F) return 'OP4 ch' + (a & 0x7) + ' TL' + (b & 0x7F);
    if (a <= 0x87) return 'OP1 ch' + (a & 0x7) + ' KeyScl' + (b >> 6) + ' atk' + (b & 0x1F);
    if (a <= 0x8F) return 'OP3 ch' + (a & 0x7) + ' KeyScl' + (b >> 6) + ' atk' + (b & 0x1F);
    if (a <= 0x97) return 'OP2 ch' + (a & 0x7) + ' KeyScl' + (b >> 6) + ' atk' + (b & 0x1F);
    if (a <= 0x9F) return 'OP4 ch' + (a & 0x7) + ' KeyScl' + (b >> 6) + ' atk' + (b & 0x1F);
    if (a <= 0xA7) return 'OP1 ch' + (a & 0x7) + ' AMS' + ['off', 'on'][b >> 7] + ' dcy1R:' + (b & 0x1F);
    if (a <= 0xAF) return 'OP3 ch' + (a & 0x7) + ' AMS' + ['off', 'on'][b >> 7] + ' dcy1R:' + (b & 0x1F);
    if (a <= 0xB7) return 'OP2 ch' + (a & 0x7) + ' AMS' + ['off', 'on'][b >> 7] + ' dcy1R:' + (b & 0x1F);
    if (a <= 0xBF) return 'OP4 ch' + (a & 0x7) + ' AMS' + ['off', 'on'][b >> 7] + ' dcy1R:' + (b & 0x1F);
    if (a <= 0xC7) return 'OP1 ch' + (a & 0x7) + ' dt2:' + (b >> 6) + ' dcy2R:' + (b & 0x1F);
    if (a <= 0xCF) return 'OP3 ch' + (a & 0x7) + ' dt2:' + (b >> 6) + ' dcy2R:' + (b & 0x1F);
    if (a <= 0xD7) return 'OP2 ch' + (a & 0x7) + ' dt2:' + (b >> 6) + ' dcy2R:' + (b & 0x1F);
    if (a <= 0xDF) return 'OP4 ch' + (a & 0x7) + ' dt2:' + (b >> 6) + ' dcy2R:' + (b & 0x1F);
    if (a <= 0xE7) return 'OP1 ch' + (a & 0x7) + ' dcy2L:' + (b >> 4) + ' rel:' + (b & 0xF);
    if (a <= 0xEF) return 'OP3 ch' + (a & 0x7) + ' dcy2L:' + (b >> 4) + ' rel:' + (b & 0xF);
    if (a <= 0xF7) return 'OP2 ch' + (a & 0x7) + ' dcy2L:' + (b >> 4) + ' rel:' + (b & 0xF);
    return 'OP4 ch' + (a & 0x7) + ' dcy2L:' + (b >> 4) + ' rel:' + (b & 0xF);
}

/** OPM/YM2151 register log detector. If <= 0, consider invalid.
 * no custom data or end marker to be expected.
 */
function parseYM2151RegLog(p, len) {
    //ref https://retrocdn.net/images/9/9c/YM2151_Application_Manual.pdf
    len = len || BCParseToReasonable; p = p || 0;
    var max = (len == BCParseToEoF) ? X.Sz() : Math.min(X.Sz(), p + 0x2000),
        notes = 0, ic = 0, confirmed = false,
        v = [0, 0, 0, 0, 0], chinits = [],
        r, x;
    for(var i=0; i < 8; chinits[i++]=0);
    function re(p, t) { if(debug>1)_l2r('opm', p, t);  return [BCInvalidFormat,p,0]; }
    function iC() { if(debug>0)_l2r('opm', p-2, Hex(r)+' - '+Hex(x)+': invalid value');  ic++; }
    while(!X.U8(p) && p < 0x800) p++; //skip zeroes unless too many
    if(!X.U8(p)) return [BCInvalidFormat,p,0]; //sanity, heuristics, just reasonable they'd cut off the meaningless zeroes
    while (p < max && ic < 10) {
        r = X.U8(p++); if (!r) continue; x = X.U8(p++);
        if (!isYM2151Reg(r)) iC();
        if(debug>1)_logIt(YM2151RegStr(r,x));
/* The working YM2151 regs are:
    01: TEST    |    08: x111 1222: (SM)KON, CH №    |    0F: 1xx2 2222: NE, NFRQ
    10: CLKA1    |    11: xxxx xx11: CLKA2    |    12: CLKAB
    14: 1x22 3344: CSM, FLAG RESET B&A, IRQ-EN B&A, LOAD B&A
    18: LFRQ    |    19: PMD/AMD    |    1B: 11xx xx22: CT, W    |    20~27: 1122 23333: RL, FB, CONECT
    28~2F: x111 2222: KC { OCT, NOTE }    |    30~37: 1111 11xx: KF    |    38~3F: x111 xx22: PMS, AMS
    40~5F: x111 2222: DT1, MUL    |    60~7F: x111 1111: TL    |    80~9F: 11x2 2222: KS, AR
    A0~BF: 1xx2 2222: AMS-EN, D1R    |    C0~DF: 11x2 2222:  DT2, D2R    |    E0~FF: 1111 2222: D1L, RR
*/
        if (r <= 0x27) {
            if (r == 1) { if (x & 0xFD) break; }
            else if (r == 8) {
                if (x & 0x78) { notes += bitCount((x >> 3) & 0xF); v[0]++; }
                else if (x & 0x80) iC();
                // TODO check if the notes played are initialised properly. It won't sound right if not so expect goodness!
                // if(chinits[r & 7] > 5) chok[r & 7]++ // adapt to bitCount!
            }
            else if (r == 0xF) { if (x & 0x60) iC(); }
            else if (r == 0x11) { if (x > 3) iC(); }
            else if (r == 0x14) { if (x & 0x40) iC(); }
            else if (r == 0x1B) { if (x & 0x3C) iC(); }
        }
        else if (r <= 0x2F) { if ((x & 0x80) || [3,7,0xB,0xF].indexOf(x&0xF) >= 0) iC(); }
        else if (r <= 0x37) {} //{ if (x & 3) iC(); } // should be a filter but some tunes want it that way
        else if (r <= 0x3F) { if (x & 0x8C) iC(); }
        else if (r <= 0x7F) { if (x & 0x80) iC(); v[1]++; chinits[r & 7]++; } // TL set
        else if (r <= 0x9F) { if (x & 0x20) iC(); v[2]++; chinits[r & 7]++; } // KS/AR set
        else if (r <= 0xBF) { if (x & 0x60) iC(); v[3]++; chinits[r & 7]++; } // AMS/D1R set
        else if (r <= 0xDF) { if (x & 0x20) iC(); v[4]++; chinits[r & 7]++; } // DT2/D2R set
        else { v[4]++; chinits[r & 7]++; } // D1L/RR set

        if(!confirmed) 
            if(p > 0x1000)
                if (ic >= 40 || notes < 20 || v[0] < 24 || v[1] < 24 || v[2] < 24 || v[3] < 24 || v[4] < 24)
                    return [BCInvalidFormat]; // false positives can be pretty long!
                else confirmed = true
    }
    var chok = 0; for (var i=0; i < 8; i++) if (chinits[i] > 5) chok++;
if(debug>0)_logIt(outArray([notes, v, chok, p], 16))
    if (confirmed && chok > 0) return [notes, p, chok];
    return [BCInvalidFormat, p, chok];
}



// -= Yamaha YM2612(OPN2) related functionality =-

function isYM2612Reg(a) {
//The OPN2 doesn't have these registers:
    return !( a < 0x22 || a == 0x23 || a > 0xB7/*B6*/ || isWithin(a, 0x2C,0x2F)
//        || (isWithin(a, 0x30, 0xAF) && (a & 3) == 3) // per-op registers from 3x to Ax must not have x3,x7, xB, xF. Some files do tho'.
    );
}

/** Mega Drive GYM bytecode detector. Returns BCInvalidFormat in resut[0] if invalid;
 * no custom data or end marker to be expected.
 */
function parseMDGYM(p, len) {
    //ref https://plutiedev.com/ym2612-registers
    //& https://github.com/ValleyBell/libvgm/blob/master/player/gymplayer.cpp
    len = len || BCParseToReasonable; p = p || 0;
    var tmr; if(debug>0){ tmr = new CheckpointTimer(); tmr.init(300); }
    var max = (len == BCParseToEoF) ? X.Sz() : Math.min(X.Sz(), p+0x2000),
        notes = 0, v = [0, 0, 0, 0, 0], ir  = 0, //notes, validation, invalid registers
        c, r, x, doPSGFreq2nd = false;
    function re(p, t) { if (debug>0)_l2r('gym', p, t); return [BCInvalidFormat, p, 0]; }
    while(!X.U8(p) && p < 0x800) p++; //skip zeroes unless too many
    while (p < max && ir < 10) switch (c = X.U8(p++)) {
        case 0: doPSGFreq2nd = false; break;
        case 1: case 2: r = X.U8(p++); if(c == 2 && r < 0x21) return;
            x = X.U8(p++); if (!isYM2612Reg(r)) { ir++; if(debug>0)_l2r('gym',p-2,c + ': R ' + Hex(r)) }
            if (r == 0x28 && (x >> 4)) { notes += bitCount(x >> 4); if(debug>0)_l2r('gym',p-2,'#') }
            else if (r == 0x2A) v[4]++; //PCM
            else if ((r & 0xF0) == 0x30) { v[0]++; if(debug>0)_l2r('gym',p-2,'ML/DT') } // MUL/DT set
            else if ((r & 0xF0) == 0x40 && X.U8(p) > 0) { v[1]++; if(debug>0)_l2r('gym',p-2,'TL') } // TL set
            else if ((r & 0xF0) == 0x50) { v[2]++;  if(debug>0)_l2r('gym',p-2,'AR/RS') } // AR/RS set
            else if ((r & 0xF0) == 0x60) { v[3]++;  if(debug>0)_l2r('gym',p-2,'DR/AM') }// DR/AM set
            else if(debug>0)_l2r('gym',p-2,c+': R '+Hex(r))
            // can't check other reg pushes for validity
            break;
        case 3: r = X.U8(p++); if(debug>0)_l2r('gym',p-2,'PSG');
            if(r & 0x80) doPSGFreq2nd = (!(r&0x10) && r < 0xE0);
            else if(doPSGFreq2nd && r < 0x40) doPSGFreq2nd = false;
            else return [BCInvalidFormat, p, 0];
            break;
        default: return re(p-1, '!cmd' + Hex(c));
    }
if(debug>0)tmr.next('GYM: end of tested area @'+Hex(p)+' ir='+ir)
if(debug>0)_l2r('gym',p,outArray([notes, v], 16));
    if ((!notes || v[0] < 8 || v[1] < 8 || v[2] < 8 || v[3] < 8) && v[0]+v[1]+v[2]+v[3]+v[4] < 100) return [BCInvalidFormat, p, 0];
    return [notes, p, 0];
}


// -= AdLib/Sound Blaster YM3812/OPL2 related functionality =-

//ref https://web.archive.org/web/20050205055453/http://www.gamedev.net/reference/articles/article446.asp

//The AdLib/OPL2 uses these registers:
function isYM3812Reg(a) {
    return isWithinRanges(a, [1,2,3,4,8,0xBD, [0x20,0x35]])
      || ( isWithinRanges(a, [[0x40,0x55], [0x60,0x75], [0x80,0x95], [0xE0,0xF5]] ) && [6,7,14,15].indexOf(a & 0x1F) < 0
      || isWithinRanges(a, [[0xA0,0xA8], [0xB0,0xB8], [0xC0,0xC8]]));
}

var __adlibnote = []; for(var _0=0; _0 < 9; _0++) __adlibnote.push([-1,-1,-1]); //channel: key-on, octave, F-num

function YM3812CmdStr(o, recurse) {
    const
        C = ['1.1:','2.1:','3.1:', '1.2:','2.2:','3.2:','!6:','!7:', '4.1:','5.1:','6.1:', '4.2:','5.2:','6.2:','!E:','!F:',
          '7.1:','8.1:','9.1:', '7.2:','8.2:','9.2:'],
        wf = ['sine', '/￣\\_', '/￣\\/￣\\', '/|_/|_'],
        //notes = ['C#', 'D', 'D#', 'E', 'F', 'F#', 'G', 'G#', 'A', 'A#', 'B', 'C'], //TODO? parse the F-number
        c = X.U8(o);
    var t;
    if (c >= 0xE0) return C[c & 0x1F] + 'wf ' + wf[X.U8(o + 1)];
    else if (c >= 0xC0) return ((c & 0xF) + 1) + ':fb/conn'  + Hex(X.U8(o + 1));
    else if (c == 0xBD) return 'AMdepth/VD/Rhy ' + Hex(X.U8(o + 1));
    else if (c >= 0xB0) return ((c & 0xF) + 1) + 'oct/F_msb/key-on ' + Hex(X.U8(o + 1));
    else if (c >= 0xA0) return ((c & 0xF) + 1) + 'F_lsb ' + Hex(X.U8(o + 1));
    else if (c >= 0x80) return C[c & 0x1F] + 'S/R ' + Hex(X.U8(o + 1));
    else if (c >= 0x60) return C[c & 0x1F] + 'A/D ' + Hex(X.U8(o + 1));
    else if (c >= 0x40) return C[c & 0x1F] + 'level ' + Hex(X.U8(o + 1));
    else if (c >= 0x20) return C[c & 0x1F] + 'AM/vib/envgen/keyscale/MFmul ' + Hex(X.U8(o + 1));
    else if (c == 8) return 'CSM/keysplit ' + Hex(X.U8(o + 1));
    else if (c == 4) return 'tmrctl ' + Hex(X.U8(o + 1));
    else if (c == 3) return 'tmr2 ' + Hex(X.U8(o + 1));
    else if (c == 2) return 'tmr1 ' + Hex(X.U8(o + 1));
    else if (c == 4) return 'test/wfctl ' + Hex(X.U8(o + 1));
}

/** AdLib/OPL2 bytecode detector. If <= 0, consider invalid.
 * no custom data or end marker to be expected.
 */
function parseYM3812RegLog(p, len) {
    len = len || BCParseToReasonable; p = p || 0;
    var max = (len == BCParseToEoF) ? X.Sz() - 2 : Math.min(X.Sz() - 2, p + 0x2000),
        notes = 0, v = [0, 0, 0, 0],
        c, r, x, tmr;
    if(debug>0){ tmr = new CheckpointTimer(); tmr.init(300); }
    function re(p, t) { if(debug>1)_l2r('adlib',p,t); return [BCInvalidFormat, p, 0]; }
    while(!X.U8(p) && p < 0x800) p++; //skip zeroes unless too many
    if(!X.U8(p)) return [BCInvalidFormat,p,0]; //sanity, heuristics, just reasonable they'd cut off the meaningless zeroes
    while (p < max) {
        r = X.U8(p++); x = X.U8(p++); if (!isYM3812Reg(r)) return re(p - 2, 'R ' + Hex(r) + ' : '+Hex(x));
        if (r == 0x28 && (x >> 4)) notes += bitCount(x >> 4);
        if ((r & 0xF0) == 0x30) v[0]++; // MUL/DT set
        if ((r & 0xF0) == 0x40 && X.U8(p) > 0) v[1]++; // TL set
        if ((r & 0xF0) == 0x50) v[2]++; // AR/RS set
        if ((r & 0xF0) == 0x60) v[3]++; // DR/AM set
    }
    if(debug>0) tmr.next('OPM chiptune: end of parsed data');
    if(debug>0)_logIt(outArray([notes, v, p], 16))
    if (!notes || v[0] < 24 || v[1] < 24 || v[2] < 24 || v[3] < 24) return [BCInvalidFormat, p, 0];
    return [notes, p, 0];
}

/* beautify ignore:end */

================================================
FILE: db/cab
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Detect a Cab archive.
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("archive-file");
sName = "Microsoft Cabinet File";

function detect_Cab(nOffset, nSize) {
    if (nSize > 48) {
        if (File.compare("'MSCF'00000000", nOffset)) {
            bDetected = true;
            sVersion = File.readByte(nOffset + 0x19) + ".0" + File.readByte(nOffset + 0x18);
            var nFilesOffset = nOffset + File.readDword(nOffset + 0x10);
            var nFiles = File.readWord(nOffset + 0x1C);
            var nPacked = File.readDword(nOffset + 8);
            if (File.readByte(nOffset + 0x1E) & 4) {
                nOffset += File.readDword(nOffset + 0x24) + 4;
            }
            switch (File.readByte(nOffset + 0x2A) & 15) {
                case 1:
                    sOptions = sOptions.append("MSZip");
                    break;
                case 2:
                    sOptions = sOptions.append("Quantum");
                    break;
                case 3:
                    sOptions = sOptions.append("LZX");
                    break;
            }
            // Packed size is not stored directly, so assume the first
            // folder's data is first and just skip the names.
            nPacked -= File.readDword(nOffset + 0x24);
            while (nFiles--) {
                Archive.add(File.readDword(nFilesOffset), nPacked,
                    File.readByte(nFilesOffset + 14) & 16);
                nFilesOffset = File.findByte(nFilesOffset + 16, 256, 0) + 1;
                nPacked = 0;
            }
            sOptions = sOptions.append(Archive.contents());

            return 1;
        }
    }

    return 0;
}

================================================
FILE: db/chunkparsers
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Various systems' DOS chunk format parser functions.
// They return info or the number -1 if it's not the right format.
// Author: Kaens (TG @kaens)
/* beautify ignore:start */

includeScript("read");

/**
 * If it's an Amiga hunk file, parses it and tries to be strict in case of garbage past EoF.
 * @param {Int} baseofs - base offset from which to start parsing
 * @returns {Array} [nTotalSize,aBlockInfo,c] where:
 *  - nTotalSize: -1 if the file is not an Atari DOS "binary save", otherwise the total expected size (including baseofs);
 *  - aBlockInfo: an Array with separate block types, offsets, and sizes, its length reflecting the number of hunks
 */
function parseAmigaHunks(baseofs) {
    //TODO check types, check reslibs, break off if invalid
    if (typeof baseofs === "undefined") baseofs = 0;
    if (!X.c("000003F3", baseofs)) return [-1, []]; //is it an Amiga hunk file?
    var p = baseofs + 4, x = sz = i = reslibs = 0, info = [], load = true;
    //library strings:
    while (p < X.Sz()) {
        x = X.U32(4, _BE); p += 4; if (!reslibs && x) load = false; if (x) reslibs++; else break; p += 4 * x;
    }
    var hunks = X.U32(p + 8, _BE) - X.U32(p + 4, _BE) + 1; p += 12;
    //sOption(hunks+' hunks')
    for (i = 0; i < hunks && p < X.Sz(); i++, p += 4) {
        //traverse hunks:
        var t = X.U32(p, _BE), add = (t >> 30) == 3 ? 4 : 0; t &= 0x3FFFFFFF; t <<= 2; t += add;
        //_log('@'+Hex(p)+' hunk#'+i+' = '+Hex(t));
        info.push([0/*TODO*/, sz, t]); sz += t;
    }
    sz += p;
    if (!info.length) return [-1, []]; else return [sz, info];
}

/**
 * If it's an Atari DOS block file, parses it and tries to be strict in case of garbage past EoF.
 * @param {Int} [baseofs] - base offset from which to start parsing
 * @returns {Array} [nTotalSize,aBlockInfo] where:
 *  - nTotalSize: -1 if the file is not an Atari DOS "binary save", otherwise the total expected size (including baseofs);
 *  - aBlockInfo: an Array of arrays with each block's offsets and sizes, its length reflecting the number of blocks
*/
function parseAtariBinary(baseofs) {
    if (typeof baseofs !== "number") baseofs = 0;
    if (!X.c("FFFF", baseofs) || X.Sz() < baseofs + 6) return [-1, []];
    var hksz = 0,
        RAM = [],
        hkinfo = [],
        p = 2 + baseofs;
    while (p + 4 <= X.Sz() && p < 65520) {
        var ptr = X.U16(p);
        if (!hkinfo.length && ptr == 0xFFFF) { p += 2; ptr = X.U16(p); } // the subsequent blocks don't have to have a sig
        var eptr = X.U16(p + 2); if (eptr < ptr || (ptr <= 0xD7FF && eptr >= 0xD000)) break;
//_l2r('atrbin',p,'@'+Hex(ptr)+':'+outArray(hkinfo,16))
        hksz = eptr + 1 - ptr; if (p + hksz > X.Sz()) if (!hkinfo.length) break;
        if (!hksz) break;
        RAM.push(ptr, hksz); if (findIntersections(RAM, true).length) break;
        p += 4; hkinfo.push([p, hksz]); p += hksz;
    }
    if (!hkinfo.length) return [-1, []]; else return [p, hkinfo];
}

================================================
FILE: db/duration
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Convert a time in seconds to a string:
//    less than 10 seconds: N.NNs
//    less than a minute: NN.Ns
//    otherwise: NmNNs
// Author: Jason Hood <jadoxa@yahoo.com.au>

function duration(nSeconds) {
    if (nSeconds < 60) {
        return nSeconds.toFixed(nSeconds < 10 ? 2 : 1) + "s";
    }
    nSeconds = Math.round(nSeconds);
    return Math.floor(nSeconds / 60) + "m" +
        ("0" + Math.floor(nSeconds % 60)).slice(-2) + "s";
}

================================================
FILE: db/language
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function _isLangPresent(languageName) {
    return _isResultPresent("language", languageName) || _isResultPresent("~language", languageName);
}

function _isLangDetected() {
    return _getNumberOfResults("language") || _getNumberOfResults("~language");
}

function _setLang(languageName, version) {
    // if "C/C++" already detected
    if (_isLangPresent("C/C++") && (languageName == "C" || languageName == "C++")) {
        _removeResult("language", "C/C++");
    }

    // if "C" or "C++"" detected
    if (languageName == "C/C++" && (_isLangPresent("C") || _isLangPresent("C++"))) {
        return null;
    }

    // False-positive detection of C
    if (_isLangPresent("C") && languageName !== "C") {
        _removeResult("language", "C");
    }

    // False-positive detection of C++
    if (_isLangPresent("C++") && languageName !== "C++") {
        _removeResult("language", "C++");
    }

    // If the language already detected
    if (_isLangDetected() && (languageName == "C/C++" || languageName == "C++" || languageName == "C")) {
        return null;
    }

    if (File.isVerbose() && !_isLangPresent(languageName)) {
        var isHeurResult = (version == "HEUR");

        _setResult((isHeurResult ? "~" : "") + "language", languageName, (version && !isHeurResult ? version : ""), "");
    }

}

================================================
FILE: db/python
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function getPythonVersionByDll(dllFileName) { // python = 💩
    var version = "";

    var startIndex = dllFileName.indexOf("python");
    if (startIndex !== -1) {
        startIndex += 6;
        var endIndex = dllFileName.indexOf(".", startIndex);
        if (endIndex === -1) {
            endIndex = dllFileName.length;
        }
        version = dllFileName.substring(startIndex, endIndex);
    }

    if (version !== "") {
        if (version.length === 1) {
            return version + ".0";
        } else if (version.length === 2) {
            return version[0] + "." + version[1];
        } else {
            return version[0] + "." + version.substring(1);
        }
    } else {
        return null;
    }
}

================================================
FILE: db/rar-file
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Detect a RAR archive.
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("archive-file");
sName = "RAR";

function detect_RAR(bFile) {
    var nOffset, nSize;

    if (bFile) {
        nOffset = 0;
        nSize = File.getSize();
    } else {
        nOffset = File.getOverlayOffset();
        nSize = File.getOverlaySize();
    }

    if (nSize >= 64) {
        if (File.compare("'Rar!'1A07", nOffset)) {
            switch (File.readByte(nOffset + 6)) {
                case 0:
                    sVersion = "4";
                    break;
                case 1:
                    sVersion = "5";
                    break;
            }

            bDetected = true;
        } else if (File.compare("'RE~^'", nOffset)) {
            sVersion = "1.4";
            bDetected = true;
        }

        if (sVersion == "4") {

            var nOptions = File.readByte(nOffset + 10);

            if (nOptions & 8) {
                sOptions = "solid";
            }

            if (nOptions & 0x80) {
                sOptions += (sOptions !== String() ? ", " : "") + "encrypted";
            } else {
                var nDelta = 0;

                nOffset += 7 + File.readWord(nOffset + 12);
                while (File.readByte(nOffset + 2) != 0x74) {
                    nDelta = File.readWord(nOffset + 5) + File.readDword(nOffset + 7);

                    if (!nDelta) {
                        break;
                    }

                    nOffset += nDelta;
                }

                while (File.readByte(nOffset + 2) == 0x74) {
                    var nLen = File.readDword(nOffset + 7);
                    Archive.add(File.readDword(nOffset + 11), nLen,
                        (File.readByte(nOffset + 3) & 0xE0) == 0xE0);
                    nDelta = File.readWord(nOffset + 5) + nLen;
                    if (!nDelta) {
                        break;
                    }

                    nOffset += nDelta;
                }

                sOptions = sOptions.append(Archive.contents());
            }
        }
    }
}

================================================
FILE: db/read
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing
// If you want to change the style, please consider yourself unsure!

// Supplemental read functions. Also common wrappers for info output, array processors, comparers, search algos, logging.
// Author: Kaens (TG @kaens)

/* beautify ignore:start */

// don't make the following var or const; they need to be global constants
_BE = true; _LE = false; // endianness for read_int16+
// little-endian = reversed notation (Intel, ZX Spectrum),
// big-endian = direct notation (TCP/IP, Motorola, Amiga)
// For the BitReader Object, BE is MSB and LE is LSB (intuitively)
CS_ALL = true; CS_BEST = false; // charStat needall
FINT_QUICK = FINT_FAST = FINT_1 = FXSEC1 = true; // findIntersections: find just one for the speed's sake
TOEOF = -1; // use for the size parameter in findSignature

// The encoding tables start with 7F, not 80! 7F is undefined in many charsets but it's good to have something
// The N(on)B(reakable)SP(ace) and S(oft)HY(phen) are kept as actual A0 and AD characters in this file 
CP437 = "⌂"+
	"ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥₧ƒ"+
	"áíóúñѪº¿⌐¬½¼¡«»░▒▓│┤╡╢╖╕╣║╗╝╜╛┐"+
	"└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀"+
	"αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ ";
CP866 = "⌂"+ //DOS Cyrillic
	'АБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯ'+
	'абвгдежзийклмноп░▒▓│┤╡╢╖╕╣║╗╝╜╛┐'+
	'└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀'+
	'рстуфхцчшщъыьэюяЁёЄєЇїЎў°∙·√№¤■ ';
CP1251 = "⌂"+
	"ЂЃ‚ѓ„…†‡€‰Љ‹ЊЌЋЏђ‘’“”•–—・™љ›њќћџ"+
	" ЎўЈ¤Ґ¦§Ё©Є«¬­®Ї°±Ііґµ¶·ё№є»јЅѕї"+
	"АБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯ"+
	"абвгдежзийклмнопрстуфхцчшщъыьэюя";
CP1252 = "⌂"+ //aka. Western aka. ISO-8859-1
	"€・‚ƒ„…†‡ˆ‰Š‹Œ・Ž・・‘’“”•–—˜™š›œ・žŸ"+
	" ¡¢£¤¥¦§¨©ª«¬・®¯°±²³´µ¶·¸¹º»¼½¾¿"+
	"ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞß"+
	"àáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ";
KOI8R = "⌂"+ //aka. RFC 1489, Morse code based
	'─│┌┐└┘├┤┬┴┼▀▄█▌▐░▒▓⌠■∙√≈≤≥ ⌡°²·÷'+
	'═║╒ё╓╔╕╖╗╘╙╚╛╜╝╞╟╠╡Ё╢╣╤╥╦╧╨╩╪╫╬©'+
	'юабцдефгхийклмнопярстужвьызшэщчъ'+
	'ЮАБЦДЕФГХИЙКЛМНОПЯРСТУЖВЬЫЗШЭЩЧЪ';
JISX0201 = "⌂"+
	"→-‚ƒ„…†‡ˆ‰Š‹Œ↑Ž³™‘’“”•–—˜™š›œ¢žŸ"+ //decided to mix it with cp1252
	"→｡｢｣､･ｦｧｨｩｪｫｬｭｮｯｰｱｲｳｴｶｷｸｹｺｻｼｽｾｿﾀ"+
	"ﾁﾂﾃﾄﾅﾆﾇﾈﾉﾊﾋﾌﾍﾎﾏﾐﾑﾒﾓﾔﾕﾖﾗﾘﾙﾚﾛﾜﾝﾞﾟ"+
	"àáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ";
CPAmiga = "⫽"+ // alternatively, "▒"
	"абвгдежзийклмнопрстуфхцчшщъыьэюя"+ //0x80~0x9F display Cyrillics, just to fill the void
	" ¡¢£¤¥¦§¨©ª«¬–®¯°±²³´µ¶·¸¹º»¼½¾¿"+ // Filling the void is important because we still want to see
	"ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞß"+ // differences in neighbouring values, for non-reading purposes
	"àáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ";
CPRISCOS = "⌂"+
	"€Ŵŵ◰﯀Ŷŷ�⇦⇨⇩⇧…™‰•‘’‹›“”„–—−Œœ†‡fifl"+
	" ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿"+
	"ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞß"+
	"àáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ";
CPATASCII = ['▶',
	'🖤','├','▊','┘','┤','┐','╱','╲','◤','▛','◥','▙','▟','▆','￣',
	'▜','♣','┌','─','┼','◘','▀','▐','┬','┴','▐','└','\n','↑','↓','←','→',
	'█','！','”','＃','＄','％','＆','’','（','）','＊','＋','，','ー','．',
	'/','𝟶','𝟷','𝟸','𝟹','𝟺','𝟻','𝟼','𝟽','𝟾','𝟿','：','；','＜','＝','＞','？',
	'＠','𝙰','𝙱','𝙲','𝙳','𝙴','𝙵','𝙶','𝙷','𝙸','𝙹','𝙺','𝙻','𝙼','𝙽','𝙾',
	'𝙿','𝚀','𝚁','𝚂','𝚃','𝚄','𝚅','𝚆','𝚇','𝚈','𝚉','【','\\','】','＾','＿',
	'♦','𝚊','𝚋','𝚌','𝚍','𝚎','𝚏','𝚐','𝚑','𝚒','𝚓','𝚔','𝚕','𝚖','𝚗','𝚘',
	'𝚙','𝚚','𝚛','𝚜','𝚝','𝚞','𝚟','𝚠','𝚡','𝚢','𝚣','♠','-','↰','◁','▷']; //arrow up then NW (🢰) not included for UTF limitations
CPAtariST = "⌂"+
	"ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥ßƒ"+
	"áíóúñѪº¿⌐¬½¼¡«»ãõØøœŒÀÃÕ¨´†¶©®™"+
	"ijIJאבגדהוזחטיכלמנסעפצקרשתןךםףץ§∧∞"+
	"αβΓπΣσµτΦΘΩδ∮φ∈∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²³¯";
CPFullCPETshifted = [ //all 256 ch. Commodore PET 2001 version. PETSCII UNSHIFTED and 8032 are different.
	// Multiple rather approximate values, until Unicode fonts catch up; ref.Wiki
	// It's an array because of unicode shenanigans representing some characters with multiple codepoints
"\x00","\x01","_","⛔️","\x04","⚪","\x06","🔔","⇪","\t","\x0A","↘","⇪","\x0D","↘️","💥",
"\x10","⬇️","↩️","⇱","⌫","🗑️","🗯️","\x17","⇆","↟","?","⎋","🟥","➡️","🟩","🟦",
" ", "!", "\"", "#", "$", "%", "&", "'", "(", ")", "*", "+", ",", "-", ".", "/",
"0", "1", "2", "3", "4", "5", "6", "7", "8", "9", ":", ";", "<", "=", ">", "?",
"@", "A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O",
"P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "[", "\\", "]", "↑", "←",
" ", "!", "\"", "#", "$", "%", "&", "'", "(", ")", "*", "+", ",", "-", ".", "/",
"0", "1", "2", "3", "4", "5", "6", "7", "8", "9", ":", ";", "<", "=", ">", "▧", 
"\x80", "🟣", "💥", "🚀", "🕶️", "[F1]", "[F3]", "[F5]",  "[F7]", "[F2]", "[F4]", "[F6]", "[F8]", "↵", "⇪", "🕶️",
"⬛️", "⬆️", "↪️", "🗑", "🗯", "🟫", "🌸","🧪" ,  "⚫️", "🟢", "🔷", "🔳", "🟪", "⬅️", "🟨", "🧪",
"\xA0", "▌", "▄", "▔", "▁", "▏", "░", "▕", "▄", "▒", "▕", "├", "▗", "└", "┐", "▂",
"┌", "┴", "┬", "┤", "▎", "▍", "▕", "▔", "▔", "▃", "✓", "▖", "▝", "┘", "▘", "▚",
"─", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o",
"p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "┼", "▏", "│", "▓", "█",
"\xA0", "▌", "▄", "▔", "▁", "▏", "░", "▕", "▄", "▒", "▕", "├", "▗", "└", "┐", "▂",
"┌", "┴", "┬", "┤", "▎", "▍", "▕", "▔", "▔", "▃", "✓", "▖", "▝", "┘", "▘", "▚"];
CPSpeccy = ['©', //too SPECIAL with all the tokens-for-characters, gotta use an array
	'  ',' ▀','▀ ','▀▀',' ▄',' █','▀▄','▄█', '▄ ','▄▀','█ ','█▀','▄▄','▄█','█▄','██', //80~F
	'𝘼','𝘽','𝘾','𝘿','𝙀','𝙁','𝙂','𝙃','𝙄','𝙅','𝙆','𝙇','𝙈','𝙉','𝙊','𝙋', //90~F
	'𝙌','𝙍','𝙎','𝚉𝚇¹²⁸','⏯︎','𝚁𝙽𝙳','𝙸𝙽𝙺𝙴𝚈$','π', '𝙵𝙽 ','𝙿𝙾𝙸𝙽𝚃 ','𝚂𝙲𝚁𝙴𝙴𝙽$ ','𝙰𝚃𝚃𝚁 ','𝙰𝚃 ','𝚃𝙰𝙱 ','𝚅𝙰𝙻$ ','𝙲𝙾𝙳𝙴' , //A0~F
	'𝚅𝙰𝙻 ','𝙻𝙴𝙽 ','𝚂𝙸𝙽 ','𝙲𝙾𝚂 ','𝚃𝙰𝙽 ','𝙰𝚂𝙽 ','𝙰𝙲𝚂 ','𝙰𝚃𝙽 ', '𝙻𝙽 ','𝙴𝚇𝙿 ','𝙸𝙽𝚃 ','𝚂𝚀𝚁 ','𝚂𝙶𝙽 ','𝙰𝙱𝚂 ','𝙿𝙴𝙴𝙺 ','𝙸𝙽 ', //B0~F
	'𝚄𝚂𝚁 ','𝚂𝚃𝚁$ ','𝙲𝙷𝚁$ ','𝙽𝙾𝚃 ','𝙱𝙸𝙽 ','𝙾𝚁 ','𝙰𝙽𝙳 ','≤', '≥','≠','𝙻𝙸𝙽𝙴 ','𝚃𝙷𝙴𝙽 ','𝚃𝙾 ','𝚂𝚃𝙴𝙿 ','𝙳𝙴𝙵 𝙵𝙽 ','𝙲𝙰𝚃 ', //C0~F
	'𝙵𝙾𝚁𝙼𝙰𝚃 ','𝙼𝙾𝚅𝙴 ','𝙴𝚁𝙰𝚂𝙴 ','𝙾𝙿𝙴𝙽 # ','𝙲𝙻𝙾𝚂𝙴 # ','𝙼𝙴𝚁𝙶𝙴 ','𝚅𝙴𝚁𝙸𝙵𝚈 ', '𝙱𝙴𝙴𝙿 ','𝙲𝙸𝚁𝙲𝙻𝙴 ','𝙸𝙽𝙺 ','𝙿𝙰𝙿𝙴𝚁 ','𝙵𝙻𝙰𝚂𝙷 ','𝙱𝚁𝙸𝙶𝙷𝚃 ','𝙸𝙽𝚅𝙴𝚁𝚂𝙴 ','𝙾𝚅𝙴𝚁 ','𝙾𝚄𝚃 ', //D0~F
	'𝙻𝙿𝚁𝙸𝙽𝚃 ','𝙻𝙻𝙸𝚂𝚃 ','𝚂𝚃𝙾𝙿 ','𝚁𝙴𝙰𝙳 ','𝙳𝙰𝚃𝙰 ','𝚁𝙴𝚂𝚃𝙾𝚁𝙴 ','𝙽𝙴𝚆 ', '𝙱𝙾𝚁𝙳𝙴𝚁 ','𝙲𝙾𝙽𝚃𝙸𝙽𝚄𝙴 ','𝙳𝙸𝙼 ','𝚁𝙴𝙼 ','𝙵𝙾𝚁 ','𝙶𝙾 𝚃𝙾 ','𝙶𝙾 𝚂𝚄𝙱 ','𝙸𝙽𝙿𝚄𝚃 ','𝙻𝙾𝙰𝙳 ', //E0~F
	'𝙻𝙸𝚂𝚃 ','𝙻𝙴𝚃 ','𝙿𝙰𝚄𝚂𝙴 ','𝙽𝙴𝚇𝚃 ','𝙿𝙾𝙺𝙴 ','𝙿𝚁𝙸𝙽𝚃 ','𝙿𝙻𝙾𝚃 ', '𝚁𝚄𝙽 ','𝚂𝙰𝚅𝙴 ','𝚁𝙰𝙽𝙳𝙾𝙼𝙸𝚉𝙴 ','𝙸𝙵 ','𝙲𝙻𝚂','𝙳𝚁𝙰𝚆 ','𝙲𝙻𝙴𝙰𝚁 ','𝚁𝙴𝚃𝚄𝚁𝙽', '𝙲𝙾𝙿𝚈']; //F0~F

Chars0to1F = "・☺☻♥♦♣♠•◘○◙♂♀♪♫☼▶◀↕‼¶§▬↨↑↓→←∟↔▲▼"; //#0 is a small dot from Japanese; could've used ␀ but readability
Chars0to1FLF = "・☺☻♥♦♣♠•◘○\x0A♂♀♪♫☼▶◀↕‼¶§▬↨↑↓→←∟↔▲▼";
Chars0to1FCRLF = "・☺☻♥♦♣♠•◘○\x0A♂♀\x0D♫☼▶◀↕‼¶§▬↨↑↓→←∟↔▲▼";
Chars0to1FSpeccy = "\x00\x01\x02\x03\x04\x05，📝︎///⬅➡⬇⬆⌫\x0A№\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F"; //not mixing...
Chars0to1FATASCII = "♥├◨┘┤┐／╲◢▗◣▝▘￣▂▖♣┌─┼•▄▎┬┴▌└␛↑↓←→";
Chars0to1FATASCII2 = "áùÑÉçôòì£ïüäöúóöÜâûîéèñêȧàȦ␛↑↓←→";
Chars0to1FATASCII_PL = "ŹąźćŚėöÖ£üߣłŃÓ√ĘśäÜĆĄŻÄż␛↑↓←→";
Chars0to1FAtariX = "áùÑÉçôòì£ïüäÖúóöÜâûîéèñêȧàȦË↑↓←→";
Chars0to1FPETSCII = "\x00\x01_⛔️\x04⚪\x06🔔⇪\t\x0A↘⇪\x0D↘️💥\x10↓🔲⇱⌫🗑️🗯️\x17⇆↟?⎋🟥→🟩🟦"; //took the ctrl codes that meant something for each char

/**
 * Decode a 1-byte-per-character encoding from a byte array using the 129-byte-long table given,
 * as well as a table to display the first 32 characters.
 * @param {number[]} ansi - an array of uint8 (returned by readBytes).
 * @param {string[]} dectbl - a decoding table[0x81], String or Array; just make a const here in db/read for that
 * @param {boolean} [zstop = true] - whether to stop reading on 0 (ASCIIZ behaviour)
 * @param {string[]} [tbl01F = Chars0to1FCRLF] - which table to use for the first 32 characters
 * @returns {String} a string value usable with js, or an empty line if the decoding table wasn't found.
 * @example
 * 𝑓([7, 0x7F, 0, 0x32], true, Chars0to1FSpeccy, CPSpeccy]) === "📝︎©" ("2" will be lost)
 * @example
 * 𝑓("\x07\x7F\x00\x32", false, Chars0to1FSpeccy, CPSpeccy]) === "📝︎© 2"
 */
function decEncoding(ansi, dectbl, zstop, tbl01F) {
	if(typeof dectbl === 'undefined') return '';
	if(typeof zstop === 'undefined') zstop = true;
	if(dectbl.length > 129) { // full 256-byte tables :) Nothing fancy, no control bytes.
		var s = ""; for(var i=0; i < ansi.length; i++) { if(!ansi[i] && zstop) break;  else s += dectbl[ansi[i]] } return s
	}

	if(typeof tbl01F === 'undefined')
		if(dectbl == CPSpeccy) tbl01F = Chars0to1FSpeccy;
		else if(dectbl == CPATASCII) tbl01F = Chars0to1FATASCII;
		else tbl01F = Chars0to1FCRLF;
	var s = "", bit8 = 0;
	for(var i=0; i < ansi.length; i++) {
		if (!ansi[i] && zstop) break;
		else if(ansi[i] < 0x80)
			switch(ansi[i]) { // 7-bit variation processing
			case 0x0E: if(dectbl == JISX0201 || dectbl == KOI8R) bit8 = 0x80;
				else s += tbl01F[0xE];  break;
			case 0x0F: if(dectbl == JISX0201 || dectbl == KOI8R) bit8 = 0;
				else s += tbl01F[0xF];  break;
			case 0x5C: if(dectbl == JISX0201) s += '¥'; else s += '\\';  break;
			case 0x5E: if(dectbl == CPSpeccy) s += '↑'; else s += '^';  break;
			case 0x60: if(dectbl == CPSpeccy) s += '£'; else if(dectbl == CPPETSCIIshifted) s += ' '; else s += '`';  break;
			case 0x7B: if(dectbl == CPATASCII)
				if(tbl01F == Chars0to1FATASCII2) s += 'Ä';
				else if(tbl01F == Chars0to1FATASCII_PL) s += ' '; //the Poles didn't need the spades without the other 3 :D
					else s += '♠';
				else s += '{'; break;
			case 0x7D: if(dectbl == CPATASCII) s += '↖'; else s += '}'; break; //arrow N-NW (🢰) not included for UTF limitations
			case 0x7E: if(dectbl == JISX0201) s += '‾'; else if(dectbl == CPATASCII) s += '◀'; else s += '~';  break;
			case 0x7F:
				if(dectbl != JISX0201) s += dectbl[0]; else s += String.fromCharCode(bit8+ansi[i]);  break;
			default:
				if(!bit8 && ansi[i] >= 0 && ansi[i] < 0x20) s += tbl01F[ansi[i]];
				else s += String.fromCharCode(bit8+ansi[i]);
			}
		else s += dectbl[ansi[i]-0x7F];
	}
	return s;
}


/**
 * Decode a 1-byte encoding from file using the 129-byte-long table given, as well as a table to display
 * the first 32 characters. Analogous to decEncoding but reads the file directly.
 * @param {number} ofs - the offset to start from.
 * @param {number} len - the amount of bytes to read.
 * @param {string[]} dectbl - a decoding table[0x81[, String or Array; just make a const here in db/read for that
 * @param {boolean} [zstop = true] - whether to stop reading on 0 (ASCIIZ behaviour)
 * @param {array} [tbl01F = Chars0to1FCRLF] - which table to use for the first 32 characters
 * @returns {string} a string value usable with js, or an empty line if the decoding table wasn't found.
 */
function decAnsi(ofs, len, dectbl, zstop, tbl01F) {
	return decEncoding(X.readBytes(ofs,len), dectbl, zstop, tbl01F);
}


/**
 * Checks for whether a value fits the limits using <=, as opposed to isInside.
 * @param {number} a - the value to check.
 * @param {number} mina
 * @param {number} maxa
 * @returns {boolean}
 * @example
 * 𝑓(20, 10, 40) === true; 𝑓(20,10,20) === true
 */
function isWithin(a, mina, maxa) {
	return mina <= a && a <= maxa;
}

/**
 * Checks for whether a value fits the limits using <, as opposed to isWithin. Useful for floats.
 * @param {number} a - the value to check.
 * @param {number} mina
 * @param {number} maxa
 * @returns {boolean}
 * @example
 * 𝑓(20.1, 10.0, 40.0) === true; 𝑓(20.1, 10.0, 20.0) === false
 */
function isInside(a, mina, maxa) {
	return mina < a && a < maxa;
}


/**
 * isWithin but for a list of ranges. Useful for heuristic byte-has-a-possible-value checks
 * @param {Array} a - Can contain either values like [min,max] or singular values to compare (strictly) against
 * @returns {boolean}
 */
function isWithinRanges(a, rr) {
	if (isNaN(a) || !Array.isArray(rr)) return;
	var i = 0, found = false;
	for (; i < rr.length; i++) {
		if (Array.isArray(rr[i])) {
			if (!rr[i].length) return;
			if (rr[i].length > 1) { if (rr[i][0] <= a && a <= rr[i][1]) { found = true; break } }
			else if (a === rr[i][0]) { found = true; break }
		}
		else if (a === rr[i]) { found = true; break}
	}
	return found
}

/**
 * Derive a string hexadecimal value, zero-padded.
 * @param {number} a - the numerical value.
 * @param {number} [padz=2] - how many characters to zero-pad to.
 * @returns {string} The hex value, capital letters A~F, ending with "h".
 */
function Hex(a, padz) {
	if(typeof a === 'undefined') return "!Hex("+a+")";
	if(typeof padz === 'undefined') padz = 2;
	var minus=""; if(a<0) { a = -a; minus = "-" }
	var r = a.toString(16).toUpperCase(); var pads="";
	if(r.length < padz) pads = Array(1 + padz - r.length).join('0');
	return minus+pads+r+"h";
}


/**
 * Derive a string binary value, zero-padded.
 * @param {number} a - the numerical value.
 * @param {number} [padz=4] - how many characters to zero-pad to.
 * @returns {string} The bin value, characters '0' or '1', ending with "b".
 */
function Bin(a, padz) {
	if(typeof a === 'undefined') return "!Bin("+a+")";
	if(typeof padz === 'undefined') padz = 4;
	var minus = ""; if(a < 0) { a = -a; minus = "-" }
	var r = a.toString(2); var pads="";
	if(r.length < padz) pads = Array(1 + padz - r.length).join('0');
	return minus+pads+r+"b";
}


/**
 * Derive a string octal value, zero-padded.
 * @param {number} a - the numerical value.
 * @param {number} [padz=3] - how many characters to zero-pad to.
 * @returns {string} The octal value, characters 0~7, ending with "o".
 */
function Oct(a, padz) {
	if(typeof a === 'undefined') return "!Oct("+a+")";
	if(typeof padz === 'undefined') padz = 3;
	var minus = ""; if(a < 0) { a = -a; minus = "-" }
	var r = a.toString(8); var pads="";
	if(r.length < padz) pads = Array(1 + padz - r.length).join('0');
	return minus+pads+r+"o";
}


/**
 * Read a variable-length quantity, an unsigned integer like in MIDI files, from the file.
 * @param {number} ofs - the offset to start from.
 * @returns {Array} [length,value] - if length (in physical bytes) = 0, the value had a problem.
 * @example
 * //For file containing '81 80 01  81 83 7F':
 * 𝑓(0) === 0x4001; 𝑓(3) === 0x41FF
**/
function readVarUInt(ofs) {
	if(ofs < 0 || ofs >= File.getSize()) return [0,0];
	var t = 0, wb = 1, r = 1, o = ofs;
	var b = X.U8(o++); t = (t << 7) | (b&0x7F);
	var b_ = b; while(b_) { b_ >>= 1; wb++ }
	for(; r < 16 && (b&0x80); r++) { b = X.U8(o++); t = (t << 7) | (b&0x7F); }
	if(wb > 64) return [0,0xFFFFFFFFFFFFFFFF]; // sizeof(target) in bits. A 64bit value should be enough, right?
	else if(b&0x80) return [0,-1]; //EOF
	else return [r,t];
}


function readFloat80(ofs, e) {
    if (e != _BE) e = _LE;

    // Normalize into little-endian order
    var b = [];
    if (e == _LE) {
        for (var i = 0; i < 10; i++) b[i] = X.U8(ofs + i);
    } else {
        for (var i = 0; i < 10; i++) b[9 - i] = X.U8(ofs + i);
    }

    // Mantissa: 8 bytes, little-endian
    var mantissa = 0;
    for (var i = 0; i < 8; i++) {
        mantissa += b[i] * Math.pow(256, i);
    }

    // Exponent+sign: 2 bytes, little-endian
    var expWord = b[8] + (b[9] << 8);
    var sign = (expWord & 0x8000) ? -1 : 1;
    var exponent = expWord & 0x7FFF;

    if (exponent === 0 && mantissa === 0) return 0.0;
    if (exponent === 0x7FFF) {
        if (mantissa === 0) return sign * Infinity;
        return NaN;
    }

    // Bias 16383
    var eVal = exponent - 16383;

    // Integer bit is explicit (bit 63 of mantissa)
    var intBit = Math.floor(mantissa / Math.pow(2, 63));
    var frac   = (mantissa % Math.pow(2, 63)) / Math.pow(2, 63);

    return sign * (intBit + frac) * Math.pow(2, eVal);
}


/**
 * This object facilitates reading a file as a sequence of bits
 * @constructor {number} [nOffset = 0] - initialise: provide the file offset
 * @param {number} nBits - bits to read, autolimits to 32 (so read little by little!)
 * @returns {number} read value as integer, -1 if EoF reached
 * @example
 * var bits = new BitReader(10); // First create an instance with the file object
 * var value = bits.read(5); // Then call the readBits method with the number of bits you want
 * bits.init(10); // Or put the reader towards a different place
 * p = bits.offset; // Receive the current bit-file offset
 * bits.seek(10); // Set the bit-file's offset, in bytes, without changing state
 * bits.bseek(14); // Set the bit-file's offset in bits
 * bits.consume(2); // Skip some bytes without changing state
**/
function BitReader(nOffset, nEndian) {
	this.n = 0; // the number of bits in the buffer
	this.buf = 0; // the bit buffer
	this.offset = nOffset ? nOffset : 0; // the file offset
	this.endian = nEndian ? nEndian : _LE; // for different mechanics of bitstreaming; ogg/flac use _BE

	// Change the pointer, which will reinit the reader, but not the logger
	this.init = function(nOffset) { this.ofs = nOffset ? nOffset : 0; this.n = this.buf = 0 }

	// Read b bits from the file
	this.read = function(nBits) {
		if(nBits > 64) nBits = 64; if(nBits < 0) return 0;
		if(this.endian === _LE) {
			while(this.n < nBits) { // while the buffer is not enough
				this.buf |= Util.shlu64(File.read_uint8(this.offset++),this.n); // read a byte and append it to the buffer
				this.n += 8; // increase the bit number by 8
			}
			var v = this.buf & (Util.shlu64(1,nBits) - 1); // extract the desired bits from the buffer
			this.buf = Util.shru64(this.buf,nBits); // shift the buffer to the right
		} else {
			while(this.n < nBits) {
				this.buf = Util.shlu64(this.buf,8) | File.read_uint8(this.offset++); // shift the buffer to the left and append a byte
				this.n += 8;
			}
			var v = Util.shru64(this.buf,this.n - nBits); // extract the desired bits from the most significant part of the buffer
			this.buf &= Util.shru64((Util.shlu64(1,this.n)-1),nBits); // clear the extracted bits from the buffer
		}
		this.n -= nBits; // decrease the bit number by b
		return v; // return the value even if the file is exhausted
	}

	// Skip some bytes without changing state:
	this.consume = function(nBytes) { this.offset += nBytes; }

	// Set the bit-file's offset, in bytes, without changing state:
	this.seek = function(nOfs) { this.offset = nOfs; }

	// Set the bit-file's offset in bits:
	this.bseek = function(nOfs) { this.offset = nOfs - (nOfs%8); this.buf = this.n = 0; this.read(nOfs%8); }
}


/**
 * Count set bits in an integer.
 * @param {number} n
 */
function bitCount(n) {
	var c = 0; n = !!n; while(n) { if(n&1) c++; n >>= 1 } return c;
}

/**
 * Check a file slice for being all one of a lineup of specified characters.
 * @param {number} ofs - the offset to start from.
 * @param {number} len - the amount of bytes to check.
 * @param {Array | number} [bl = 0x00] - the list of possible uint8 codes, or just one uint8.
 * @returns {number} - offset if a byte in the slice doesn't belong to the list. If you go beyond EoF or all good, -1.
 * @example
 * //For '00 01 02 01' at offset 6 in the file:
 * 𝑓(6, 4, [0,1]) === 8; 𝑓(6, 4, 1) === 6
 */
function firstNotOf(ofs, len, bl) {
	if(ofs+len > X.Sz()) return -1; var c = i = 0;
	if(Array.isArray(bl)) {
		for(i = 0; i < bl.length; i++) if(typeof bl[i] !== 'number' || bl[i] < 0 || bl[i] % 1 != 0) break; 
		if(i < bl.length) throw new Error('firstNotOf cannot parse: '+outArray(bl));
	}
	else if(typeof bl === 'number' && bl > 0 && (bl % 1) == 0 || typeof bl === 'string') bl = [bl]; else bl = [0];
	len = Math.min(len, X.Sz()-ofs);
	// and now test the slice
	for(i = 0; i < len; i++) if(!bl.includes(X.U8(ofs+i))) break;
	return i < len? ofs+i : -1;
}

//A subcase of firstNotOf for whether a slice is all zeroes.
function isAllZeroes(ofs, len) { return firstNotOf(ofs, len) < 0 }


/**
 * If the string was too long and has been read incompletely, adds an ellipsis after the last
 * complete word, to avoid cut-off words. If `space characters' are not detected,
 * replaces the last character with an ellipsis. Does NOT do the trim() unless the whole string fits the limit.
 * Mostly usable for lengthy multiline comments/messages.
 * @param {string} a - the original incomplete string.
 * @param {number} trim - the buffer size; if a.length == trim, we decide it was cropped.
 * @param {number} [mintrim = 78] - don't try searching for spaces below this point.
 * @returns {string} - the resulting string.
 * @example
 * // Full string fits the limits, no need to search for a good cut-off place, and it's trimmed for pretty:
 * 𝑓(" 12345 7890, 34 678. 1 3'56789", 35, 15) === "12345 7890, 34 678. 1 3'56789"
 * @example
 * // The length is a full match, but it might be trimmed right along that length, so a good cut-off place is found:
 * 𝑓(" 12345 7890, 34 678. 1 3'56789", 30, 15) === " 12345 7890, 34 678. 1 3…"
 * @example
 * // The length is a full match and last 5 characters don't have spaces, so it's treated as trimmed but it's not cut:
 * 𝑓(" 12345 7890, 34 678. 1 3'56789", 30, 25) === " 12345 7890, 34 678. 1 3'56789…"
 * @example
 * // Just another example of a well-trimmed line, in which you need a lot less info that it has to offer:
 * 𝑓(" 12345 7890, 34 678. 1 3'56789", 16, 10).trim() === "12345 7890, 34…"
 */
function addEllipsis(a, trim, mintrim) {
	if(!trim) trim = 0xA0;
	if(!mintrim) mintrim = 78; if(a.length < trim || mintrim > trim) return a.trim();
	const spaces = " .,:;!\\/'\"=&\x09\x0D\x0A\x1A\x26。、｡,，・";
	var i = trim, c = 0, ci = -1;
	while(i >= mintrim && c < 2) {
		if(spaces.indexOf(a[i]) >= 0) { c++; while(spaces.indexOf(a[i]) >= 0) i--; if(ci < 0) ci = i+1 }
		while(spaces.indexOf(a[i]) < 0 && i >= 0) i--
	}
	if((i < mintrim && c < 2) //we conclude this language doesn't really have that many spaces...
	  || !c) //...or none at all in the trimmable slice...
		return a.slice(0,trim)+'…';
	else //this language has some spaces, and we can use the last one to trim
		return a.slice(0,Math.max(ci),mintrim)+'…';
}


/**
 * sOptions.appendS a string (optionally prefixed) if the space-trimmed string is not empty.
 * @param {variant} a - the string to output (safe to accidentally drop a non-string in)
 * @param {String} [prefix=''] - what to put in front of the output string
 * @param {String} [suffix=''] - what to put after the output string
 * @param {String} [sep=', '] - what to put between the previous string and this addition
 * @example
 * //for sOptions === '  ch:2':
 * 𝑓('hello world  ', 'msg:"', '"', ', '); //sOptions === 'ch:2, msg:"hello world\"'
 */
function sOptionT(a, prefix, suffix, sep) {
  if (typeof prefix === 'undefined') prefix = ""; if (typeof suffix === 'undefined') suffix = "";
  if (typeof sep === 'undefined') sep = ', ';
  if ((""+a).trim() != "") sOptions = sOptions.appendS(prefix+(""+a).trim()+suffix, sep);
}


/**
 * sOptions.appendS a string (optionally prefixed) if the string is not empty.
 * @param {variant} a - the string to output (safe to accidentally drop a non-string in)
 * @param {string} [prefix = ''] - what to put in front of the output string
 * @param {string} [suffix = ''] - what to put after the output string
 * @param {string} [sep = ', '] - what to put between the previous string and this addition
 * @example
 * //for sOptions === '  ch:2':
 * 𝑓('hello world  ', 'msg:"', '"', ', ') === 'ch:2, msg:"hello world\"'
 */
function sOption(a, prefix, suffix) {
  if (typeof prefix === 'undefined') prefix = ""; if (typeof suffix === 'undefined') suffix = "";
  if (typeof sep === 'undefined') sep = ', ';
  if ((""+a) != "") sOptions = sOptions.appendS(prefix+(""+a)+suffix, sep);
}


/**
 * A more verbose (but still concise) way of outputting the calculated size(s), derived using different algorithms,
 * taking into account and visualising the difference from the actual file size.
 * If some of the reported sizes match, the value will only be displayed once.
 * It's still a good idea to add "/malformed!short" to the version string — it's visible without isVerbose.
 * @param {...number} sizes - numerical values
 * @example
 * // If a file is 100 bytes long:
 * outSz(90,100,105) === "90(+10)/100/105(-5!)"
 * // The "!)" thus indicates the file is too short compared to the algorithmic estimation.
 */
function outSz() { if(!arguments.length || typeof arguments[0] === 'undefined') return "?";
	var sizes = [], origs = [];
	for(i = 0; i < arguments.length; i++)
	  if(arguments[i] >= 0) if(!origs.length || origs.indexOf(arguments[i]) < 0) {
		origs.push(arguments[i]);
		sizes.push(
			arguments[i] < X.Sz() ? arguments[i]+"(+"+(X.Sz()-arguments[i])+")"
		  : arguments[i] > X.Sz() ? arguments[i]+"(-"+(arguments[i]-X.Sz())+"!)"
		  : arguments[i]
		)
	  } else; else sizes.push("?");
	return sizes.join("/");
}


/**
 * Converts an array to a better-looking line than the usual flat thing DiE's _log would output.
 * @param {Array} a - Array to process consisting of any information including arrays
 * @param {Int} [base = 10] - If an integer value is found, in which base to display it
 * @param {Int} [zeropad] - If an integer value is found, how many zeroes to pad it with (smart by default)
 * @returns {String} A beautiful output!
 * @example
 * 𝑓([ 1, [5, [10,30]], [[23],'test'] ], 2) == "[0001, [0101, [1010, 11110]], [[10111], "test"]]"
 * 𝑓([ 1, [5, [10,30]], [[23],'test'] ], 2, 8) == "[00000001, [00000101, [00001010, 00011110]], [[00010111], "test"]]"
 * 𝑓([ 1, [5, [10,30]], [[23],'test'] ], 16) == "[01, [05, [0A, 1E]], [[17], "test"]]"
 */
function outArray(a,base,pad) {
	if(typeof base !== 'number' || base % 1 !== 0) base = 10;
	if(typeof pad !== 'number' || pad % 1 !== 0) //not integer
		if(typeof pad === 'undefined') switch(base) {
			case 8: pad = 3; break; case 16: pad = 2; break; case 2: pad = 4; break; default: pad = 0
		}
	if(typeof a === 'number') return a.toString(base).toUpperCase().padStart(pad,'0');
	if(typeof a === 'string') return '"'+a+'"';
	for(var i=0, s = []; i < a.length; i++) {
		if(Array.isArray(a[i])) s.push(outArray(a[i],base,pad)); else
			if(typeof a[i] === 'number' && a[i] % 1 === 0) //integer
				s.push(a[i].toString(base).toUpperCase().padStart(pad,'0'));
			else if(typeof a[i] === 'string') s.push('"'+a[i]+'"');
			else s.push(a[i]);
	}
	return '['+s.join(', ')+']'; // put '[ ' and ' ]' for an even more spaced output
}

//_l2r('WELP','tests','A:'+outArray(X.readBytes(0,5),16)+' B:'+outArray([...Array(5)].map((_, i) => X.U8(i)),16))


/**
 * A shorthand for the situation where you compare the file suffix to what you'd expect.
 * Use as the option to Binary.isHeuristicScan().
 * @param {String} a - the expected file suffix, case-insensitive, no heading period unlike Python
 * @returns {bool} if a match is reached
 */
function extIs(a) { return File.getFileSuffix().toLowerCase() == a.toLowerCase() }


/**
 * slashTag formats a string in a way that's useful when a tag has two versions (for ex. in different languages).
 * It will either show both with "/" in between, or one of them if the other one's an empty string, or an empty string if both are empty.
 * @param {String} a - the first of the two
 * @param {String} b - the second of the two
 * @returns {String}
*/
function slashTag(a, b) {
	if(a == b) return a;
	else if(a != "" && b == "")
		return a;
	else if(a == "" && b != "")
		return b;
	else if(a != "" && b != "")
		return a+"/"+b;
	else return "";
}


/**
 * createOrderlyHuffmanTable is just for detections but it does return the table for further checks. Or it returns false.
 * @param {Array} lent - the lengths table
 * @param {string} btl - bit table length
 * @param {BitReader} br - a BitReader object pointing somewhere at the right position for this. The provided BitReader WILL change state.
 * @returns {Array | false}
*/
function createOrderlyHuffmanTable(lent, btl, br) {
	var md = 32, Md = reall = code = 0; var _t = [], fi = [], li = [], ni = [];
	for(i = 0; i < 33; i++) fi[i] = 0xFFFF;
	for(i = 0; i < btl; i++) { len = lent[i]; if(len) {
		if(len < md) md = len; if(len > Md) Md = len;
		if(fi[len] == 0xFFFF) { fi[len] = li[len] = i } else { ni[li[len]] = i; li[len] = i } reall++ } }
	if(!Md) return false;
	for(d = md; d <= Md; d++) {
		if(fi[d] != 0xFFFF) ni[li[d]] = btl;
		for(i = fi[d]; i < btl; i = ni[i]) {
			//insert HuffmanCode:
			var j = 0, le = _t.length;
			for(var cb = d; cb >= 0; cb--) {
				var cob = (cb && ( ( (code>>(Md-d)) >> (cb-1) ) & 1 ) ) ? 1 : 0;
				if(j != le) {
					if(!cb || (!_t[j][0] && !_t[j][1])) return false; //[0] is left, [1] is right, [2] is value
					if(!_t[j][cob]) _t[j][cob] = j = le; else j = _t[j][cob];
				} else {
					_t.push([ (cb&&!cob)?le+1:0, (cb&&cob)?le+1:0, cb?0:i ]);
					j++; le++
				} }
			code += 1 << (Md-d) } }
	return _t;
}


/**
 * Outputs time in seconds as short human-readable, with a "h:mm:ss" alternative when < 1 day.
 * Millenia, centuries and years as sidereal years, a "month" duration is 1/12 of such year.
 * @param {number} s - seconds
 * @returns {string}
 * @example
 * 𝑓(123456789) === "31Y10M4w21h33m9s"; 𝑓(1234567) === "2w6h56m7s"; 𝑓(12345) === "3:25:45"
 */
function secondsToTimeStr(s) {
	const mul = [/*millenia*/315581497635,/*centuries*/3155814976,/*yrs*/31558150,/*mns*/2629846,/*wks*/604800,86400,3600,60];
	var r = "", ss = s%mul[7], mm = Util.div64(s%mul[6],mul[7]), hh = Util.div64(s%mul[5],mul[6]),
	dd = Util.div64(s%mul[4],mul[5]), ww = Util.div64(s%mul[3],mul[4]), mn = Util.div64(s%mul[2],mul[3]),
	yy = Util.div64(s%mul[1],mul[2]), cc = Util.div64(s%mul[0],mul[1]), mi = Util.div64(s,mul[0]);
	if(s < 86400) { r = mm.padStart(2,'0')+":"+ss.padStart(2,'0'); if(hh) r = hh+":"+r; return r }
	if(ss) r = ss+"s"+r; if(mm) r = mm+"m"+r; if(hh) r = hh+"h"+r; if(dd) r = dd+"d"+r; if(ww) r = ww+"w"+r;
	if(mn) r = mn+"M"+r; if(yy) r = yy+"Y"+r; if(cc) r = cc+"C"+r; if(mi) r = mi+"Mil"+r; return r
}


/**
 * Examines a sequence and gives a generalised idea of what sort of characters a string is (mostly) made of.
 * Parse the result using indexOf.
 * Could be useful for validating structured files with human-filled fields.
 * @param {String/Number[]} s - your string in question, or a List of charcodes.
 * @param {Boolean} [needall=CS_BEST] - if true, you have "allascallt allnum" for a line of spaces, else just "allt ".
 * @returns {String} - at least one or a combo of these, optional prefix "all" (otherwise treat as "mostly"):
 *  '?': wrong type; 'empty': 0 length; '00': zeroes; 't ': tabs/spaces; 'ctl': 0-1Fh & 7Fh; 'num': numerical;
 *  'asc': 20h-7Eh; 'xsc': zeroes+tabs+♫+FFh+crlf+ascii; 'foreign': 00,t, ,crlf, 80h+; 'any': decision cannot be made.
 * @example
 * 𝑓("-123 456.789") === "allnum"; 𝑓("-123 456.789", CS_ALL) === "allnumallascallxscallforeign"
 */
/* beautify preserve:start */
function charStat() {
	if(!arguments.length) return "?";
	if(typeof arguments[0] === "undefined" || typeof arguments[0] === "number") return "?";
	str = arguments[0];
	if(arguments.length < 2) needall = false; else needall = !!arguments[1];
	if(str == "" || str == []) return "empty";
	var i, s = [], c = [ /*[0]00*/0, /*[1]t */0, /*[2]asc*/0, /*[3]xsc*/0, /*[4]num*/0,
	  /*[5]ctl*/0, /*[6]foreign*/0 ], o = [0,0,0,0,0,0,0,0];
	if(typeof str === "string") for(i = 0; i < str.length; i++) s.push(str.charCodeAt(i)); else s = str;
	for(i=0;i<s.length;i++) {
		if(!s[i]) { c[0]++; c[3]++; c[5]++; c[6]++ }
		else if(s[i] == 9) { c[1]++; c[3]++; c[5]++; c[6]++ }
		else if(s[i] == 0xA || s[i] == 0xD) { c[3]++; c[5]++; c[6]++ }
		else if(s[i] == 0xE) { c[3]++; c[5]++ }
		else if(s[i] <= 0x1F || s[i] == 0x7F) c[5]++;
		else if(s[i] == 0x20) { c[1]++; c[2]++; c[3]++; c[4]++; c[6]++; }
		else if(0x2B <= s[i] && s[i] <= 0x2D || 0x30 <= s[i] && s[i] <= 0x39) { c[2]++; c[3]++; c[4]++; c[6]++ }
		else if(s[i] <= 0x7E) { c[2]++; c[3]++ }
		else if(s[i] == 0xFF) { c[3]++; c[6]++ }
		else if(s[i] > 0x7F) c[6]++
	} for(i = 0; i < c.length; i++) o[i] = Util.div64(c[i]*100,s.length);
	r = "";
	//_log((typeof str)+" "+s+" {"+c+"} <"+o+">")
	if(!needall) {
		if(o[0] > 70) { if(o[0] === 100) r += "all";  r += "00" }
		else if(o[1] > 70) { if(o[1] === 100) r += "all";  r += "t " }
		else if(o[4] > 70) { if(o[4] === 100) r += "all";  r += "num"; }
		else if(o[2] > 70) { if(o[2] === 100) r += "all";  r += "asc"; }
		else if(o[3] > 70) { if(o[3] === 100) r += "all";  r += "xsc"; }
		else if(o[5] > 70) { if(o[5] === 100) r += "all";  r += "ctl"; }
		else if(o[6] > 70) { if(o[6] === 100) r += "all";  r += "foreign"; }
	} else {
		if(o[0] > 70) { if(o[0] === 100) r += "all";  r += "00"; }
		if(o[1] > 70) { if(o[1] === 100) r += "all";  r += "t "; }
		if(o[4] > 70) { if(o[4] === 100) r += "all";  r += "num"; }
		if(o[2] > 70) { if(o[2] === 100) r += "all";  r += "asc"; }
		if(o[3] > 70) { if(o[3] === 100) r += "all";  r += "xsc"; }
		if(o[5] > 70) { if(o[5] === 100) r += "all";  r += "ctl"; }
		if(o[6] > 70) { if(o[6] === 100) r += "all";  r += "foreign"; }
	} 
	if(r == "") return "any"+o; else return r;
}


// PATCHING FUNCTIONALITY; promised to become native
// May be useful in some ugly cases for quickly pre-processing the file contents which are then detected.
var patcheddata = [];
function rpU8(adr) { //read patched data or passthrough, U8
	for(var i=0; i < patcheddata.length; i++) if(patcheddata[i][0] == adr) return patcheddata[i][1];
	return X.U8(adr)
}
function rpU16be(adr) { //read patched data or passthrough, U16 BE
	return (rpU8(adr) << 8) | rpU8(adr+1)
}
function rpU32be(adr) { //read patched data or passthrough, U32 BE
	return (rpU8(adr) << 24) | (rpU8(adr+1) << 16) | (rpU8(adr+2) << 8) | rpU8(adr+3)
}
function wpU8(adr,val) { //add to patches, U8
	for(var i=0; i < patcheddata.length; i++)
		if(patcheddata[i][0] == adr) { patcheddata[i][1] = val; return }
	patcheddata.push([adr,val])
}
function wpU16be(adr,val) { //add to patches, U16 BE
	wpU8(adr,(val>>8)&0xFF); wpU8(adr+1,val&0xFF)
}
function wpU32be(adr,val) { //add to patches, U32 BE
	wpU8(adr,(val>>24)&0xFF); wpU8(adr+1,(val>>16)&0xFF);
	wpU8(adr+2,(val>>8)&0xFF); wpU8(adr+3,val&0xFF)
}
function patchLength() { return patcheddata.length }
function patchClear() { patcheddata = [] }


/**
 * Discovers gaps in an unsorted array of pairs of [offset, length], with a minimum-to-report gap as optional parameter.
 * Useful for extra checks in file resource formats, without signatures but not sparse, so you can tell whether the resource blocks have no spaces in-between and don't overlap, using this and findIntersections.
 * @param {Array of arrays[2]} lst - List to process consisting of ranges
 * @param {UInt} [mingap=1] - Minimum gap, default to at least 1 byte between the ranges. Change for aligned data
 * @returns {Array of arrays[2]} Sorted list of gap ranges in the same format
  * @example
  * // We have data defined in 10..20, 25..30, 40..50:
  * 𝑓([ [10,10], [25,5], [40,10] ]) === [ [20,5], [30,10] ] 
 */
function findGaps(lst, mingap) {
	var i, r = []; /* tests for input typing follow */ if(!Array.isArray(lst) || lst.length < 2) return r;
	for(i = 0; i < lst.length; i++) if(!Array.isArray(lst[i]) || lst[i].length != 2
		|| typeof lst[i][0] !== 'number' || typeof lst[i][1] !== 'number') return r;
	if(typeof mingap !== 'number') mingap = 1;
	function sf(a, b) { if(a[0] != b[0]) return a[0]-b[0]; else return a[1]-b[1] }
	var a = lst.sort(sf);
	for(i = 1; i < a.length; i++)
		if((t=a[i-1][0]+a[i-1][1]) < a[i][0] && a[i][0]-t-mingap >= 0) r.push([t, a[i][0]-t])
	return r;
}


/**
 * Discovers intersections in an unsorted array of pairs of [offset, length], considering all possible pairs.
 * Useful for extra checks in file resource formats, without signatures but not sparse, so you can tell whether the resource blocks don't overlap and have no spaces in-between, using this and findGaps.
 * @param {Array of arrays[2]} lst - List to process consisting of ranges defined as [offset,length]
 * @param {Boolean} [detectone=false] - Stop searching after finding even one intersection
 * @returns {Array of arrays[2]} Sorted list of intersection ranges in the same format; if length > 0, intersection present
 * @example
 * 𝑓([ [10,20], [15,10], [23,30] ]) = [[15,10], [23,2], [23,7]]
 * 𝑓([ [10,20], [15,10], [23,30] ], true) = [[15,10]]
 */
function findIntersections(lst,detectone) {
	var i, t, r = []; /* tests for input typing follow */ if(!Array.isArray(lst) || lst.length < 2) return r;
	for(i=0; i < lst.length; i++) if(!Array.isArray(lst[i]) || lst[i].length != 2
		|| typeof lst[i][0] !== 'number' || typeof lst[i][1] !== 'number') return r;
	function sf(a, b) { if(a[0] != b[0]) return a[0]-b[0]; else return a[1]-b[1] }
	var a = lst.sort(sf); var found = false;
	for(i=1; i < a.length && !found; i++)
		for(j=0; j < i && !found; j++)
			if((t=a[j][0]+a[j][1]) > a[i][0]) { if(detectone) found = true;
//_log(' item#'+j+' ['+lst[j][0]+' -> '+lst[j][1]+'] intersects with item#'+i+' ['+lst[i][0]+' -> '+lst[i][1]+']')
				r.push([a[i][0], a[i][0]+a[i][1] <= t ? a[i][1] : t-a[i][0]])
			}
	return r.sort(sf);
}


/**
 * Finds several signatures one after the other, using an array of pairs of [signature, range] and starting from a specified offset. The range to search across is in the 0-th element of aList.
 * @param {UInt} nOffset - Where to start searching from (or 0 if bad data).
 * @param {UInt} nLength - Maxlength: the same as in findSignature. (It has to be at least the length of the signature.)
 * @param {Array of arrays[2]} aList - List to process consisting of pairs of [signature, range].
 * @param {UInt} [nStep=1] - In case subsequent searches fail, skip this many bytes before searching for more (this handles alignments too). If 0, stop if not found immediately.
 * @returns -1 if not found, offset otherwise.
 * @example
 * //on your common Windows EXE file:
 * 𝑓(0, 0x400, [ ["'MZ'",0], ["'PE'0000",0x200] ])
 */
function findMultiple(nOffset, nLength, aList, nStep) {
	var r, lst = aList || [], ofs = ofs0 = nOffset || 0, max = Math.min(X.Sz(), ofs+(nLength||0)), st = nStep || 1;
	if(!lst.length) return -1;
	for(i = 0; i < lst.length && ofs <= max; i++) {
		if(ofs >= max) return -1;
		r = X.fSig(ofs, lst[i][1], lst[i][0]);
//_l2r('FMP',ofs,'['+i+'] st:'+st+' max:'+Hex(max)+'    r '+lst[i][0]+' ~ '+Hex(lst[i][1])+' = '+Hex(r));
		if(r < 0) { if(!st) return -1; ofs0 += st; ofs = ofs0; i = -1; }
		else { ofs = r+lst[i][1]; if(!i) ofs0 = r; }
	}
	return ofs0;
}

// Heuristic considerations for whether the sample name will be interesting enough to an average user.
//
// The optional "ctx" is context, an array of other sample names (or other tokens) known so far.
//   For example, if the file's just starting and you're on the fence whether "loop" is good to know or not,
// it'll give you the chance to put it there just in case, but not if the other names are "boring" or "useless".)
//   Try not to use it but also feel free to use it! Fun takes priority.
//
// Please add conditions liberally!
function funSampleName(n, ctx) {
	var fun = 1, bore = 0; //by default, we're curious about the new line just a little
	n = n.toString();
	if(n.trim() == '') return false;
	if(n.endsWithCI('.wav') || n.endsWithCI('.smp') || n.endsWithCI('.ins') || n.endsWithCI('.iff')) bore++;
	if(n.startsWithCI('ST-') || n.startsWithCI('df0:')) bore++;
	if(/^\d+$/.test(n)) bore++;
	if(n.startsWith('#')) fun += 5;
	if(/^\s*(unnamed|dr[u]?m\d*|loop\s*\d*|strings?\s*\d*|bass\s*\d*|guitar\s*\d*|snare\s*\d*|piano)\s*$/i.test(n)
	|| /^\s*(trumpet\s*\d*|bells\s*|synth\s*[0-9iv]*|shaker|banjo|lead|syn\d+|\w*\s*hihat|organ\s*\d*)\s*$/i.test(n)
	|| /^\s*(voice\s*\d+|crash|cymbal\s*\d*|wonderpad\s*[0-9iv]+|tambourine\s*[0-9iv]*|tamb\d+)\s*$/i.test(n)
	|| /^\s*((hard|echo)\s?tom|splash|cymbhit|orchm(in|aj)|orch\s?hit|chimes?|kick|scratch)\s*$/i.test(n)
	|| /^\s*((ghost\s?|brass\s?)pad\s*(min|maj|\(sus4\))?|blip|bleep|hhc|hho|clv|bd|sd|pad)\s*$/i.test(n)
	|| /^\s*(m(aj|in)or\s*[0-9iv]*|sawsynth|synbrass|hihat\sclosed)\s*$/i.test(n))
		bore++;
//_setResult('fsn',n,'fun='+fun+' bore='+bore,'')
	return fun > bore;
}


const b64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

function toBase64(buf) {
	var r = '', i = 0, indexOfLastCompleteTriple = buf.length - (buf.length%3);
	for (i = 0; i < indexOfLastCompleteTriple; i += 3) {
		r += b64Chars[buf[i] >> 2];
		r += b64Chars[((buf[i] & 3) << 4) | ((buf[i+1] & 0xF0) >> 4)];
		r += b64Chars[((buf[i+1] & 0xF) << 2) | ((buf[i+2] & 0xC0) >> 6)];
		r += b64Chars[buf[i+2] & 0x3F]
	}
	if (i < buf.length) {
		var i1 = buf[i],  i2 = (i+1 < buf.length) ? buf[i+1] : 0;
		r += b64Chars[i1 >> 2];
		r += b64Chars[((i1 & 0x03) << 4) | ((i2 & 0xF0) >> 4)];
		if (i+1 < buf.length) {
			r += b64Chars[((i2 & 0x0F) << 2)];
		}
		else r += '=';
		r += '=';
	}
	return r
}


// A simple array1's contents == array2's contents? kinda thing, goes deep
function compareArrays(arr1, arr2) {
	var l = Math.min(arr1.length, arr2.length);
	if (arr1.length+arr2.length == 0) return true; 
	if (l == 0 || arr1.length != arr2.length) return false;
	for (var i = 0; i < l; ++i) {
		if (Array.isArray(arr1[i])) { // an element of arr1 is an Array too?
			if (!Array.isArray(arr2[i])) return false;
			if (!compareArrays(arr1[i], arr2[i])) return false; // go deeper
		}
		else if (Array.isArray(arr2[i])) return false;
		else if (arr1[i] !== arr2[i]) return false;
	}
	return true
}


// Simply plops the buffer contents into the log stream with a suitable MIME header
function _logBase64(buf) {
	var fn = File.getFileBaseName()+'.'+File.getFileCompleteSuffix();
	_log('MIME-Version: 1.0\nContent-Type: application/octet-stream; name="'+fn+'.dec"\n'+
	'Content-Transfer-Encoding: base64\nContent-Disposition: attachment; filename="'+fn+'.dec"\n');
	_log(buf);
}

// Same but no header and in hex
function _logHex(buf) {
	var o = ''; for(i=0; i < buf.length; i++) {
		if(!(i % 16)) o += (i? '  |\n': '')+i.toString(16).padStart(6,'0')+' |'; if(!(i % 8)) o += ' ';
		o += ' '+buf[i].toString(16).padStart(2,'0');
	}
	_log('-8<---'); _log(o); _log('--->8-')
}

// Same but as text put through CP866 for clarity of eyeballing.
// That is, the zeros are spaces, and the control characters and i18n are mapped to an old DOS encoding that has all the characters.
function _logText(buf) {
	_log('-8<---['+(typeof buf)+' '+(buf.length)+' bytes]---');
	if(typeof buf === 'object') {
		var bf = buf, i = 0; for(; i < buf.length; i++) if(bf[i] == 0) bf[i] = 0x20
	}
	_log(decEncoding((typeof buf === 'undefined'? X.readBytes(0,X.Sz(),true): bf), CP866, Chars0to1F));
	_log('--->8-')
}


// Debug logger to results.
function _l2r(name, pos, issue) { _setResult('debug', issue, '@'+Hex(pos), name) }


// Returns the current line of the callee (ie. where you call this function from)
function _currentLine() {
	const e = new Error();
	const stackLine = e.stack.split("\n")[1];
	const match = stackLine.match(/:(\d+)?$/);
	return match ? parseInt(match[1], 10) : null;
}

// Simply logs the calling function and the current line. All hail the printf debugging!
function _logIt(msg) {
	if (typeof msg === "undefined") msg = "";
	const callerLine = new Error().stack.split("\n")[1] || "",
		fnmatch = callerLine.match(/^(\w+)@/), // extract function name
		fnName = fnmatch ? fnmatch[1] : "<anon>",
		lineMatch = callerLine.match(/:(\d+)(?!.*:)/),
		lineNum = lineMatch ? lineMatch[1] : "?";
	_log(fnName + (lineNum == "?" ? "" : ": " + lineNum) + (!msg.length ? "" : ": " + msg));
}

/** A class that'll help profile overly long scripts until Qt offers better tools!
 * Counts timings between the timer.next calls, outputs if too many milliseconds passed.
 * @example
 * var timer = new CheckpointTimer();
 * timer.init(100);
 * heavycode1();
 * timer.next('after heavycode1:');
 * heavycode2();
 * timer.next('after heavycode2:')
*/
function CheckpointTimer() {
	this.last = 0;
	this.min = 100; // milliseconds

	this.init = function(min) {
		this.last = new Date().getTime();
		if (typeof min == 'number' && min >= 0) this.min = min;
	}

	this.next = function(msg) {
		var now = new Date().getTime();
		var delta = now - this.last;
		if (delta >= this.min) _setResult('prof', msg, '', delta + " ms passed. "
			+(X.isOverlay()?' overlay':'')+(X.isResource()?' resource':'')+(X.isFilePart()?' file_part':'')+" Hex at [0]: "
			+X.getSignature(0,32));
		this.last = now;
	}
}

/* beautify ignore:end */

================================================
FILE: db/shell-script
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Retrieve the interpreter from a #! script.

var sInterpreter;
if (typeof sInterpreter === "undefined") {
    sInterpreter = "";
    var sLine = Binary.getString(0);
    // Make the expression a little easier to deal with by translating
    // something like "/usr/bin/env perl" to just "/usr/bin/perl".
    sLine = sLine.replace(/\/env\s+/, "/");
    var aMatch = sLine.match(/#!.*\/(.+?)(?:\.exe)?\s/);
    if (aMatch) {
        sInterpreter = aMatch[1];
    }
}

// Check for a particular interpreter.
function isInterpreter(sString) {
    if (sInterpreter == sString) {
        // Found it, so blank it out to stop "script.2" picking it up again.
        sInterpreter = "";
        return 1;
    }
    return 0;
}

================================================
FILE: db/soundchips
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Author: Kae <TG@kaens>
// Provides user-readable lists, aid for logging, info useful for statistical/sanity-based detection I guess?

// The following is a list of popular sound chips and their aliases in single strings separated by ", "
SoundChips = [
    'AY-3-8910, AY8910, PSG',
    'AY8930',
    'AY-3-8912',
    'AY-3-8913',
    'YM2149, SSG',
    'YM6630, Sunsoft 5B',
    'YM3439, SSGC',
    'YMZ284, SSGL',
    'YMZ294, SSGLP',
    'YMZ705, SSGS',
    'YM2151, OPM, IC101, #IT-21-51-00', //FM-chip
    'YM3012, IC102, #IT-30-12-00', //stereo DAC
    'YM2148, IC103, #IT-21-46-00', //MIDI handling
    'YM22702, IC104, #IT-22-70-20', //ROM
    'YM2164, OPP',
    'SN76489, DCSG',
    'SN76489A',
    'SN76496',
    'YM3526, OPL',
    'YM3812, OPL2',
    'YMF262, OPL3',
    'YMF278, OPL4',
    'YM2413, OPLL',
    'Konami VRC7', //only used for audio in "Lagrange Point"
    'Y8950, MSX-AUDIO',
    'YM2203, OPN',
    'YM2608, OPNA',
    'YM2612, OPN2',
    'YM2610, OPNB',
    'YM2610B',
    'NEC D7759, uPD7759',
    'NEC D7759C',
    'Sharp LR35902, DMG-CPU, GameBoy DMG',
    'Hudson Soft HuC6280',
    'Ricoh 2A03, RP2A03, NES APU',
    'Namco C140',
    'Namco C219',
    'Ensoniq ES5506',
    'Ensoniq ES5505'
];


================================================
FILE: db/vgmcodingutils
================================================
// Detect-It-Easy signature file
// Various parser helpers from vgmstream, modified for DiE.
// Author: Kaens (TG @kaens)
/* beautify ignore:start */

includeScript("read");

/** Read values from an 'old' XMA2 RIFF "XMA2" chunk (XMA2WAVEFORMAT), starting from an offset *after* chunk type+size.
 * Useful as custom X360 headers commonly have it lurking inside.
 * @param Int p  - offset
 * @return [channels, sample rate, loop flag, raw samples, start loop sample, end loop sample]
 */

function xma2_parse_xma2_chunk(p) {
    //ref vgmstream coding_utils.c
    var hkver = X.U8(p), strm = X.U8(p+1), lpst = X.U32(p+4, _BE), lped = X.U32(p+8, _BE),
        lp = X.U8(p+3) > 0 || lped, sr = X.U32(p+0xC, _BE),
        smp = X.U32(p+(hkver == 3 ? 0x14 : 0x1C), _BE),
        ch = 0, ofs = hkver == 3? 0x20 : 0x28;
        for(var i=0; i < strm; i++) ch += X.U8(p+ofs+i*4);
        return [ch, sr, lp, smp, lpst, lped]
}

/** Read values from a 'new' XMA2 RIFF "fmt" chunk (XMA2WAVEFORMATEX), starting from an offset *after* chunk type+size.
 * Useful as custom X360 headers commonly have it lurking inside. Only parses the extra data (before is a normal WAVEFORMATEX).
 * @param Int p - offset
 * @param Int e - endianness
 * @return [loop flag, samples, start loop sample, end loop sample]
 */
function xma2_parse_fmt_chunk_extra(p, e) {
    var smp = X.U32(p+0x18, e), lpst = X.U32(p+0x28, e), lped = X.U32(p+0x2C, e), lp = X.U8(p+0x30) || lped;
    //source bugfix:
    if(lpst+128-512 == 0 && lped+128-512+256 >= smp+128-512) lp = false;
    return [lp, smp, lpst, lped]
}

/* beautify ignore:end */


================================================
FILE: db/wxWidgets
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// wxWidgets is tested twice - as a library and as a compiler (to distinguish C
// from C++).  Detect it once here.

var aWx;
if (typeof aWx === "undefined") {
    aWx = PE.isLibraryPresentExp(/^wx.*?(univ)?(\d+)(u)?(d)?/i);
    if (!aWx) {
        if (PE.isResourceNamePresent("WXWINDOWMENU")) {
            aWx = 1;
        }
    }
}

================================================
FILE: db/zip-file
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Detect a zip archive.
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("archive-file");
sName = "Zip";

function detect_Zip(bFile) {
    var nOffset = 0;
    if (bFile) {
        // Don't know what this is, but I happened to have a file that started
        // with it.
        if (File.compare("'PK00'")) {
            nOffset = 4;
        }
        if (Binary.compare("'PK'0708", nOffset)) {
            sOptions = "extended";
            bDetected = true;
            return;
        }
    } else {
        if (File.compareOverlay("'PK'0304")) {
            nOffset = File.getOverlayOffset();
        } else {
            var nSize = File.getSize();
            if (nSize < 64) {
                return;
            }
            nSize -= 11;
            nOffset = nSize;
            if (!File.compare("'PK'0506'", nOffset)) {
                if (nSize < 4096) {
                    nOffset = 0;
                } else {
                    nOffset -= 4096;
                    nSize = 4096;
                }
                nOffset = File.findSignature(nOffset, nSize, "'PK'0506");
                if (nOffset == -1) {
                    return;
                }
                var nBase = File.readDword(nOffset + 16);
                nOffset -= File.readDword(nOffset + 12);
                if (!File.compare("'PK'0102", nOffset)) {
                    return;
                }
                nOffset += File.readDword(nOffset + 0x2a) - nBase;
            }
        }
    }

    if (File.compare("'PK'0304", nOffset)) {
        bDetected = true;

        if (File.findString(nOffset, 0x40, "META-INF/MANIFEST.MF") != -1) {
            sOptions = sOptions.append("JAR"); // Java archive
        }

        if (File.findString(nOffset, 0x40, "classes.dex") != -1) {
            sOptions = sOptions.append("APK"); // Android application package file
        }

        var nVer = 0;

        var bEncrypted = 0;
        do {
            var v = File.readByte(nOffset + 4);
            if (v > nVer) {
                nVer = v;
            }
            if (!bEncrypted && (File.readByte(nOffset + 6) & 1)) {
                bEncrypted = 1;
            }
            var nPacked = File.readDword(nOffset + 0x12);
            var nName = File.readWord(nOffset + 0x1A);
            Archive.add(File.readDword(nOffset + 0x16), nPacked,
                nPacked == 0 && File.readByte(nOffset + 0x1E + nName - 1) == 0x2F);
            nOffset += 0x1E + nName + File.readWord(nOffset + 0x1C) + nPacked;
        } while (File.compare("'PK'0304", nOffset));

        if (bEncrypted) {
            sOptions = "encrypted";
        }
        sOptions = sOptions.append(Archive.contents());

        sVersion = (nVer / 10).toFixed(1);
    }
}

================================================
FILE: db/zlib
================================================
// Detect It Easy: DiE-JS framework file
// Don't change anything unless you're sure about what you're doing

// Detect a ZLIB.
// Author: LinXP

function detect_zlib(bFile, nOffset) {
    var sInfo = "ZLIB compression";
    if (bFile.compare("7801", nOffset)) {
        if (bFile.isVerbose()) { sInfo += " fastest" }
        sOptions = sOptions.append(sInfo);
        return true;
    } else if (bFile.compare("785E", nOffset)) {
        if (bFile.isVerbose()) { sInfo += " fast" }
        sOptions = sOptions.append(sInfo);
        return true;
    } else if (bFile.compare("789C", nOffset)) {
        if (bFile.isVerbose()) { sInfo += " normal" }
        sOptions = sOptions.append(sInfo);
        return true;
    } else if (bFile.compare("78DA", nOffset)) {
        if (bFile.isVerbose()) { sInfo += " best" }
        sOptions = sOptions.append(sInfo);
        return true;
    }
}

================================================
FILE: db_compress.cmd
================================================
:: Detect It Easy databases compressor for Windows (NTFS)
:: Coded by DosX, https://github.com/DosX-dev

@echo off

call :compact_it "db"
call :compact_it "db_extra"
call :compact_it "db_custom"
call :compact_it "dbs_min"

exit /b 0

:compact_it
set "path_to_dir=%~1"
if not exist "%path_to_dir%" (
    echo "%path_to_dir%" not found!
    exit /b 1
)
pushd "%path_to_dir%"
"%windir%\system32\compact.exe" "*" /C /S /F /I /A /Q /EXE:LZX >nul
if "%errorlevel%" == "0" (
    echo [V] "%path_to_dir%" compressed!
) else (
    echo [X] "%path_to_dir%" unable to compress!
)
popd
set "path_to_dir="

exit /b 0

================================================
FILE: db_custom/.vscode/about.txt
================================================
This directory is responsible for correct recognition of *.sg files by Visual Studio Code. You can delete it if you don't need it.

================================================
FILE: db_custom/.vscode/settings.json
================================================
{
    "files.associations": {
        "*.sg": "javascript"
    }
}

================================================
FILE: db_extra/.vscode/about.txt
================================================
This directory is responsible for correct recognition of *.sg files by Visual Studio Code. You can delete it if you don't need it.

================================================
FILE: db_extra/.vscode/settings.json
================================================
{
    "files.associations": {
        "*.sg": "javascript"
    }
}

================================================
FILE: db_extra/COM/packer_packers.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Packer");

function detect() {
    if (Binary.compare("bf....be....b9....fdf3a5fceb$$8bf7bf....adad8be8b2..e9")) {
        sOptions = "by B. Vorontsov";
        bDetected = true;
    } else if (Binary.compare("565056fd8bfc83ef..b9....be....f3a447ffe7")) {
        sOptions = "1997 by CyberWare";
        bDetected = true;
    } else if (Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf9bf....c3")) {
        sOptions = "1997 by JES //CORE";
        bDetected = true;
    } else if (Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3")) {
        sVersion = "1.2b";
        sOptions = "1997 by JES //CORE";
        bDetected = true;
    } else if (Binary.compare("508cc890ba....05....3b06....72..b4..ba....cd21b8....cd21")) {
        sOptions = "1996 by LostSoul";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/COM/patcher_patchers.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "Patcher");

function detect() {
    if (Binary.compare("bc....8cc88ec08ed8fcbe....b9....8ae180e4..ac32c48844..e2")) {
        sName = "Patch engine";
        sOptions = "by SoNiC //UTG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b80300cd10b409ba....cd21e8$$$$1eb8....8ed833c98a0e....fec95133d2fec68916....b4..b2..cd21")) {
        sName = "ByteHunter patch engine";
        sOptions = "by nOP & THE_q //Phrozen Crew";
        bDetected = true;
    } else if (Binary.compare("e9$$$$0e588ec08ed88d16....68....9d9c582d....72..33dbb9")) {
        sName = "GPatch";
        sVersion = "1.2b"
        sOptions = "by JES //C.O.R.E. team";
        bDetected = true;
    } else if (Binary.compare("e9$$$$0e588ec08ed8e8$$$$68....9d9c582d....73..8d3e....fbc3")) {
        sName = "GPatch";
        sVersion = "1.0c"
        sOptions = "by JES //C.O.R.E. team";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$50558becc746......5d0733ffb9....fcb8....f3abc3")) {
        sName = "Cracker";
        sOptions = "by NightIce //ByTe Enf0rcerZ";
        bDetected = true;
    } else if (Binary.compare("eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99e8....f7d0f7d2b9")) {
        sName = "AutoCRK";
        sVersion = "1.2x (uncrypted)";
        sOptions = "1995 by MACHiNE GUNgsTeR //BANG!";
        bDetected = true;
    } else if (Binary.compare("eb$$8bfc83ef..83ec..be....b9....57f3a45fffe7")) {
        sName = "AutoCRK";
        sVersion = "1.2x (crypted)";
        sOptions = "1995 by MACHiNE GUNgsTeR //BANG!";
        bDetected = true;
    } else if (Binary.compare("c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99")) {
        sName = "AutoCRK";
        sVersion = "1.15";
        sOptions = "1995 by MACHiNE GUNgsTeR //BANG!";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....8bda438a2780fc..75..e8....3c..74..2e8b1e....83fb..75..e9")) {
        sName = "CRK2COM";
        sVersion = "1.10b";
        sOptions = "1993";
        bDetected = true;
    } else if (Binary.compare("'/MG/'eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99")) {
        sName = "AutoCRK";
        sVersion = "1.20";
        sOptions = "by MACHiNE GUNgsTeR //BANG!";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$bb....b9....8a0734..880743e2..c3")) {
        sName = "Crack Engine";
        sVersion = "0.2";
        sOptions = "by Prizna //PSP";
        bDetected = true;
    } else if (Binary.compare("'SNT'1af8b409ba....cd2133f6bd....b8....ba....cd21a3....72..33c933d28bd8")) {
        sName = "SNT patch";
        sOptions = "//SNT";
        bDetected = true;
    } else if (Binary.compare("eb$$0e1fb409ba....cd21be....e8....803e......74..b4..ba....cd21eb..b4..ba....cd21b8....cd21")) {
        sOptions = "by WOLVERiNE";
        bDetected = true;
    } else if (Binary.compare("bc....5406b8....cd21891e....8c06....b8....ba....cd21b8....ba....cd21071eb9....ba....b7..b8....cd10")) {
        sOptions = "by Randall Flagg of Razor 1911";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b8....cd10ba....e8....ba....b8....cd2173..ba....e8....ba....e8....b44ccd2193ba....e8")) {
        sOptions = "by Nostromo";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....b409cd21c706........c706........c706........c706........be....33c98a0e....80f9..74..5651")) {
        sName += " #1";
        sOptions = "by Drink Or Die (Dark Knight)";
        bDetected = true;
    } else if (Binary.compare("e9$$$$ba....b409cd2133c0cd16b4..33dbcd10feccb2..cd10c706........c706........c706........c706")) {
        sName += " #2";
        sOptions = "by Dark Knight";
        bDetected = true;
    } else if (Binary.compare("b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb")) {
        sOptions = "by Mr. KIM";
        bDetected = true;
    } else if (Binary.compare("9090ba....8bfab409cd21c606......ba....b8....cd2172..93b8....33c933d2cd2172")) {
        sOptions = "by SkorpyoN Team";
        bDetected = true;
    } else if (Binary.compare("9090ba....b409cd21b401cd1674..33c0cd1633c0cd163c..0f84")) {
        sOptions = "by +DzA kRAker";
        bDetected = true;
    } else if (Binary.compare("9090ba....8bfab409cd21b401cd1674..33c0cd1633c0cd163c..75")) {
        sOptions = "by +DzA kRAker";
        bDetected = true;
    } else if (Binary.compare("ba....b409cd21ba....b409cd21ba....b8....cd21ba....0f82....a3....ba....b409cd218b1e")) {
        sName = "MkPatch";
        sVersion = "1.0";
        sOptions = "by eGIS!";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/ELF/protector_ELFCrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ELFCrypt");

function detect() {
    if (ELF.compareEP("eb0206c6609cbe")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/MSDOS/cryptor_Cryptors.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Cryptor");

function detect() {
    if (MSDOS.compareEP("b2..33f6b9....2e30144649e3..eb..b8....ffe0")) {
        sOptions = "by Rainor'99";
        bDetected = true;
    } else if (MSDOS.compareEP("1e8ccb8edbbb....8177......8177......8177......8177......8177......1f0eeb")) {
        sOptions = "by Papaev V.V., Moscow";
        bDetected = true;
    } else if (MSDOS.compareEP("50e8$$$$5b9c5825....509d8ccb81c3....81eb....53bb....53cb")) {
        sOptions = "1990-92 by Sergdesign";
        bDetected = true;
    } else if (MSDOS.compareEP("81c3....eb$$85fa85e8eb$$81c3....eb$$bb....81eb....81c3....f981e9....39f5ba....81ea....85de")) {
        sOptions = "by eGIS! //CORE";
        bDetected = true;
    } else if (MSDOS.compareEP("bd....8cdb83c3..8cd805....8ed88ec033ffbe....b9....ba....0bc975..0bd274..4ae8....eb..561e")) {
        sOptions = "1994 by FalCoN";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e8$$$$bf....e9$$$$31d2eb$$eb$$e9$$$$8edae9$$$$e8$$$$8715e9$$$$52eb$$31f6e8$$bb....eb$$8737e9$$$$56e9$$$$e9$$$$e8$$$$bf....bb....2e8a1789d8")) {
        sOptions = "by Matrix Technologies";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$eb$$bf....e9$$$$29f6e8$$$$e9$$$$8edee8$$$$8735e8$$$$56e9$$$$e9$$$$31ede9$$$$bb....e9$$$$e8$$$$e9$$$$e8$$$$e9$$$$e9$$$$e8$$$$e8$$$$e8$$$$872f")) {
        sOptions = "by Matrix Technologies";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35")) {
        sOptions = "by DREAMMASTER";
        bDetected = true;
    } else if (MSDOS.compareEP("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d")) {
        sOptions = "by RaZoR 1911";
        bDetected = true;
    } else if (MSDOS.compareEP("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2")) {
        sName += ' N1';
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    } else if (MSDOS.compareEP("3beb81c5....fc23eb13ec85fd1e0e33e985ee01ed23ee1f0e81d1....84e931dd073efe0e....e9")) {
        sOptions = "1996 by RAM Scanner //CiD";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....15....72..d4..8ac4..c3....8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f")) {
        sOptions = "by Thunderbyte";
        bDetected = true;
    } else if (MSDOS.compareEP("b8....15....72..d4..8ac4..c3..8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f")) {
        sOptions = "by Thunderbyte";
        bDetected = true;
    } else if (MSDOS.compareEP("2e8c1e....2e8e06....33ff33f6b9....0e1f030e....f3a406b8....500e07cb")) {
        sOptions = "1994 by Paragon Technology Systems";
        bDetected = true;
    } else if (MSDOS.compareEP("87dbb8....15....72$$8cd315....72..d4..8ac483c3..8ed8b9....f7d32e87")) {
        sOptions = "1997 by Thunderbyte";
        bDetected = true;
    } else if (MSDOS.compareEP("50e8$$$$5b83c3..1e06530e1f83c3..90b0..b9....2e3007fec043e2")) {
        sOptions = "by Dr. Motorhead";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/MSDOS/packer_FCP_IV.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "protector");

function detect() {
    if (MSDOS.compareEP("bc....c3") && MSDOS.compare("'FCP/IV'", MSDOS.getEntryPointOffset() - 6)) {
        sOptions = "by FCP/IV";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/archive_Resources.6.sg
================================================
// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>, based on an idea by hypn0

meta("archive", "Resources");

function detect() {
    if (PE.getAddressOfEntryPoint() == 0) {
        bDetected = true;
        for (var i = 0; i <= PE.nLastSection && !bDetected; i++) {
            // IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_CNT_CODE
            if (PE.section[i].Characteristics & 0x20000020) {
                bDetected = false;
            }
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/compiler_EP.MSC.4.sg
================================================
// Detect It Easy: detection rule file

meta("compiler", "EP:Microsoft C/C++");

function detect() {
    if (PE.compareEP("64a100000000558bec6aff68........68........506489250000000083ec..5356578965")) {
        sVersion = "3.0-5.0";
        bDetected = true;
    } else if (PE.compareEP("64a100000000558bec6aff68........68........508b45..6489250000000083ec..85c05356578965")) {
        sVersion = "3.10";
        bDetected = true;
    } else if (PE.compareEP("535657bb........8b7c....553bfb75..011d")) {
        sVersion = "3.0-3.10";
        bDetected = true;
    } else if (PE.compareEP("53b8........8b5c....565785db5575..833d..........75..33c0")) {
        sVersion = "3.0-5.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/compiler_EP.MSVC.4.sg
================================================
// Detect It Easy: detection rule file

meta("compiler", "Microsoft Visual C/C++");

function detect() {
    if (PE.compareEP("8bff558bec837d....75..e8........ff75..8b4d..8b55..e8")) {
        sVersion = "2008-2010";
    } else if (PE.compareEP("8bff558bec83ec..538b5d..83fb..75..5657e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")) {
        sVersion = "2010, 10";
    } else if (PE.compareEP("8bff558bec837d....0f84........ff75..ff75..e8........59595d")) {
        sVersion = "2010, 10 (30319, 40219)";
    } else if (PE.compareEP("837c24....8b4424..a3........75..68........6a")) {
        sVersion = "2010, 10 (40219)";
    } else if (PE.compareEP("558bec8b45..83f8..75..68........ff15")) {
        sVersion = "2010, 10 (40219)";
    } else if (PE.compareEP("8bff558bece8$$$$$$$$8bff558bec83ec..c745..........c745..........813d")) {
        sVersion = "2008, 9.0";
    } else if (PE.compareEP("8bff558bec83ec..837d....75..5657e8........b8........be........8bf8")) {
        sVersion = "2008 SP1";
    } else if (PE.compareEP("8bff558bece8........5de9")) {
        sVersion = "2008 SP1";
    } else if (PE.compareEP("8bff558bec837d....75..e8........8b45..508b4d..518b55..52e8")) {
        sVersion = "2008";
        sOptions = "MSVCRTD";
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")) {
        sVersion = "2008-2010";
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....57bf........3bc7")) {
        sVersion = "2005-2010";
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5657bf........be........3bc7")) {
        sVersion = "2010, 10.10";
    } else if (PE.compareEP("8bff558bec837d....75..e8........5de9........8bff55")) {
        sOptions = "Patched"; // ~~~~
    } else if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")) {
        sVersion = "6.0 (1720-9782)";
    } else if (PE.compareEP("558bec538b5d..568b75..85f6578b7d")) {
        sVersion = "2002 (2148)";
    } else if (PE.compareEP("558bec538b5d..568b75..578b7d..85f675")) {
        sVersion = "6.0 (1720-8966)";
    } else if (PE.compareEP("8b4424..83e8..74..4875..8b4424..50a3........ff15")) {
        sVersion = "2003, 7.1 (3077)";
    } else if (PE.compareEP("558bec8b45..83f8..56570f84........33ff3bc7")) {
        sVersion = "2003, 7.1 (3052)";
    } else if (PE.compareEP("558bec518b45..8945..837d....74..837d")) {
        sVersion = "2002";
    } else if (PE.compareEP("558bec568b75..83fe..74..83fe..75..a1")) {
        sVersion = "2002";
    } else if (PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff")) {
        sVersion = "2003, 7.1 (3052-9782)";
    } else if (PE.compareEP("6a..68........e8........66813d............75..a1")) {
        sVersion = "2002";
    } else if (PE.compareEP("6a..68........e8........33c0408945..8b75..33ff")) {
        sVersion = "2003";
    } else if (PE.compareEP("8bff558bec538b5d..568b75..85f6578b7d")) {
        sVersion = "2003";
    } else if (PE.compareEP("fff589e566f7c6....80c3..80eb..81ec........66c1eb..6689ed")) {
        sVersion = "2003";
        sOptions = "Driver";
    } else if (PE.compareEP("6689ff5589e581ec........814d..........0f82........538d45")) {
        sVersion = "2003";
        sOptions = "Driver";
    } else if (PE.compareEP("8bff558bec837d....75..e8........5de9")) {
        sVersion = "2005";
    } else if (PE.compareEP("8bff558bec8b45..83e8..566a..5e0f84")) {
        sVersion = "2003-2005";
    } else if (PE.compareEP("8bff558bec8b45..5633f64685c0")) {
        sVersion = "2005";
    } else if (PE.compareEP("8bff558beca1........85c0b9........74..3bc175..a1")) {
        sVersion = "2005";
        sOptions = "Driver";
    } else if (PE.compareEP("8bff558bec83ec..53568b75..8b46..5733ff897d")) {
        sVersion = "2005";
        sOptions = "Driver";
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357")) {
        sVersion = "2005";
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........85c074..3d........75..568d")) {
        sVersion = "2005";
    } else if (PE.compareEP("5355568b74....85f657b8........75..8b0d")) {
        sVersion = "5.0";
    } else if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")) {
        sVersion = "5.0-6.0 (1720-9049)";
    } else if (PE.compareEP("535657bb........8b7c....553bfb74..85ff")) {
        sVersion = "3.10";
    } else if (PE.compareEP("558bec837d....0f84........ff75..ff75..ff75..e8........83c4")) {
        sVersion = "2012";
    } else if (PE.compareEP("8bff558bec837d....74..8b55..51e8$$$$$$$$8bff558bec83ec..a1........33c58945..5633f657")) {
        sVersion = "2013, 12.1 (40116)";
    } else if (PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
        sVersion = "2013";
    } else if (PE.compareEP("8bff558bec83ec..a1........33c58945..568b75..5783fe")) {
        sVersion = "2013";
    } else if (PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb")) {
        sVersion = "2005";
    } else if (PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc7")) {
        sVersion = "2012, update 4";
    } else if (PE.compareEP("8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365....8365....57bf........3bc7")) {
        sVersion = "2005 (50727)";
    } else if (PE.compareEP("8b4424..83e8..74..4875..568b7424..56ff15")) {
        sVersion = "2005 (50727.1)";
    } else if (PE.compareEP("837c24....75..e8$$$$$$$$8bff558bec83ec..a1........85c0")) {
        sVersion = "2005 (50727)";
    } else if (PE.compareEP("8bff56e8........85c07c..e8$$$$$$$$e8$$$$$$$$8bff558bec83ec..a1........8365....8365....57bf........3bc7")) {
        sVersion = "2005 (50727)";
    } else if (PE.compareEP("558bece8$$$$$$$$558bec83ec..c745..........c745..........813d")) {
        sVersion = "2005 (50727)";
    } else if (PE.compareEP("558bec81ec........8b45..89..........83............0f84........83")) {
        sVersion = "6.0";
    } else if (PE.compareEP("558bec51c745..........837d....75..833d..........75..33c0e9")) {
        sVersion = "6.0 (1720-8799)";
    } else if (PE.compareEP("558bec83ec..8365....5356578b3d........6a..5933c0")) {
        sVersion = "6.0 (8168)";
        sOptions = "Driver";
    } else if (PE.compareEP("558bec83ec..5356578b3d........8d45..33db")) {
        sVersion = "6.0 (1720)";
        sOptions = "Driver";
    } else if (PE.compareEP("558bec81ec........837d....75..8d85........c785")) {
        sVersion = "6.0 (1735)";
    } else if (PE.compareEP("8b4424..5383f8..5674..33c93bc10f84........83f8..0f84........6a..585e5b")) {
        sVersion = "6.0 (8168-8797)";
    } else if (PE.compareEP("837c24....8b4424..a3........c705................75..e8........b8........c2")) {
        sVersion = "2008, SP1";
    } else if (PE.compareEP("8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")) {
        sVersion = "2008, SP1 (21022, 30729)";
    } else if (PE.compareEP("8bff558bec837d....0f84........ff75..8b4d..8b55..e8........595d")) {
        sVersion = "2008 (21022)";
    } else if (PE.compareEP("837c24....0f84$$$$$$$$e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7")) {
        sVersion = "2005";
    } else if (PE.compareEP("837c24....75..e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7")) {
        sVersion = "2005";
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
        sVersion = "2013-2017";
    } else if (PE.compareEP("8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
        sVersion = "2017, 15.0 (24610)";
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
        sVersion = "2017, 15.0";
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8")) {
        sVersion = "2017, 15.5-6";
    } else if (PE.compareEP("5355568b7424..85f657b8........74..8b7c24..8b5c24..83fe..74")) {
        sVersion = "1997, 5.XX";
    } else if (PE.compareEP("535657bb........8b7c24..553bfb0f85........011d")) {
        sVersion = "3.1";
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    if (sVersion) sVersion += ", by EP";

    return result();
}

================================================
FILE: db_extra/PE/cryptor_3dcrypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "3dCrypter");

function detect() {
    if (PE.compareEP("684c124000e8eeffffff0000000000003000000038000000000000003848ee54")) {
        sVersion = "mod Zion-92";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_404crypter.1.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "404Crypter");

function detect() {
    if (PE.isNET()) {
        if (PE.isNetObjectPresent("Z.resources") && PE.isNetObjectPresent("First")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_ABC_Cryptor.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "ABC Cryptor");

function detect() {
    if (PE.compareEP("68FF6424F0685858585890FFD4508B40F205B095F6950F850181BBFF")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_AR_Crypt_Private.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "AR Crypt Private");

function detect() {
    if (PE.compareEP("b8........5033c0c3") && PE.compareEP("b8########6033db33c9b8........3d........74")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Aase_Crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Aase Crypter");

function detect() {
    if (PE.compareEP("558BEC83C4F053B8A03E0010E893DEFFFF68F8420010E879DFFFFF6800430010")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_AcidCrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "AcidCrypt");

function detect() {
    if (PE.compareEP("60B9........BA........BE........0238404E75FA8BC28A1832DFC0CB")) {
        bDetected = true;
    } else if (PE.compareEP("BE........0238404E75FA8BC28A1832DFC0CB")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_AlmafuerteCrypter.1.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "AlmafuerteCrypter");

function detect() {
    if (PE.compareEP("649068f4134000e8ecffffff000000003000000040000000000000003b2d72e4")) {
        sVersion = "mod Zion-92";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Anslym_Crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Anslym Crypter");

function detect() {
    if (PE.compareEP("558BEC83C4F05356B838170510E85A45FBFF33C05568211C051064FF30648920")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_App_Encryptor.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "App Encryptor");

function detect() {
    if (PE.compareEP("60E8000000005D81ED1F1F4000B97B0900008DBD671F40008BF7AC")) {
        bDetected = true;
    } else if (PE.compareEP("E997000000'\r\nSilent Team App Protector'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_BasicCrypt1.1.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "BasicCrypt");

function detect() {
    if (PE.compareEP("68b0114000e88bfbffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4010000641b400000000000308c4000408c4000980b000000904000b41040")) {
        sOptions = "sudo";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_BopCrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "BopCrypt");

function detect() {
    if (PE.compareEP("60BD........E8....0000")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_ChainskiCrypter.1.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "ChainskiCrypter");

function detect() {
    if (PE.isNetObjectPresent("Chainski")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_CodeCrypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "CodeCrypter"); // ???????????

function detect() {
    if (PE.compareEP("5058535B90BB........FFE390CCCCCC558BEC5DC3")) {
        sVersion = "0.31";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Crypter"); // ????????????

function detect() {
    if (PE.compareEP("68FF6424F06858585858FFD4508B40F205B095F6950F850181BBFF68")) {
        sVersion = "3.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Cryptic.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Cryptic");

function detect() {
    if (PE.compareEP("B8........BB........B900100000BA........03D803C803D13BCA74068031..41EBF6FFE3")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_DCrypt_Private.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "DCrypt Private");

function detect() {
    if (PE.compareEP("B9........E8000000005868........83E80B0F1800D00048E2FBC3")) {
        sVersion = "0.9b";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_DataAnubis.1.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "DataAnubis");

function detect() {
    if (PE.isNetObjectPresent("_Lambda$__R20-1") && PE.isNetObjectPresent("_Lambda$__R97-1")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Fly-Crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Fly-Crypter");

function detect() {
    if (PE.compareEP("53565755BB2C....44BE00304444BF20....44807B28007516833F0074118B1789D033D289178B")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4F053B818224444E87FF7FFFFE80AF1FFFFB809000000E85CF1FFFF8BD885DB7505")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_FreeCryptor.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "FreeCryptor");

function detect() {
    if (PE.compareEP("8B0424409083C007803890907402EBFF")) {
        if (PE.compareEP("68", 16)) {
            sVersion = "0.1 build 001";
        } else if (PE.compareEP("9068", 16)) {
            sVersion = "0.1 build 002";
        }
        bDetected = true;
    } else if (PE.compareEP("33D2901E68........0FA01F8B029050548F0290908E642408FFE2585033D25283F8019B408A10891424")) {
        sVersion = "0.2 build 002";
        bDetected = true;
    } else if (PE.compareEP("90909b591e909b9033d29b68........9b9b0fa01f8b0a9b51548f0290909b")) {
        sVersion = "0.3 build 3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_INCrypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "INCrypter");

function detect() {
    if (PE.compareEP("6064A1300000008B400C8B400C8D5820C70300000000E8000000005D81ED")) {
        sVersion = "0.3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Open_Source_Code_Crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Open Source Code Crypter"); // ????????

function detect() {
    if (PE.compareEP("558BECB9090000006A006A004975F9535657B8........E828F8FFFF33C05568")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_STUD.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "ScanTime UnDetectable");

function detect() {
    if (PE.compareEP("682C114000E8F0FFFFFF00000000000030000000380000000000000037BB71ECA4E1984C9BFE8F0FFA6A07F6")) {
        sVersion = "RC4 1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_SexCrypt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev

meta("cryptor", "sex");

function detect() {
    if (PE.isSignatureInSectionPresent(0, "'SexCrypt'....324485..4202....3842849322100493..7726374558429100005400000000002900390045....049003200539......44..000000219840"))
        bDetected = true;

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Sexe_Crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Sexe Crypter");

function detect() {
    if (PE.compareEP("558BEC83C4EC53565733C08945ECB8........E830FAFFFF33C05568........64FF306489")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_Simple_UPX_Cryptor.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Simple UPX Cryptor");

function detect() {
    if (PE.compareEP("60B8........B9....0000803408..E2FA6168........C3")) {
        if (PE.compareEP("1800", 7)) {
            sOptions = "multi layer encryption";
        } else if (PE.compareEP("01", 8)) {
            sOptions = "single layer encryption";
        }
        sVersion = "30.4.2005";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_The_Best_Cryptor.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "The Best Cryptor by FsK");

function detect() {
    if (PE.findSignature(PE.getSize() - 0x100, 0x100, "8b042483e8..68........ffd0b8........3d..............30..40eb..b8........3d..............30..40eb") != -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_ass-crypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "ass-crypter");

function detect() {
    if (PE.compareEP("558BEC83C4EC53........8945ECB898400010E8ACEAFFFF33C055687851001064........206A0A6888510010A1E097001050E8D8EAFFFF8BD853A1E097001050E812EBFFFF8BF853A1E097001050E8DCEAFFFF8B")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_darkeye.1.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "DarkEye");

function detect() {
    if (PE.isNetObjectPresent("BasicCryptorFromDebil")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptor_njCrypter.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research & ILK
// i like coffee

meta("cryptor", "njCrypter");

function detect() {
    if (PE.isNET()) {
        bDetected = true;
        if (validateReferences(
            isPositive = true,
            references = [
                "System.IO",
                "System.Security.Cryptography",
                "System.Text",
                "System.Reflection",
                "Stub",
                "cMain",
                "Decrypt",
                "bSalt"
            ]
        )) {
            bDetected = false;
            return null; // end
        }
    }

    return result();
}


// validateReferences by DosX
function validateReferences(isPositive, references) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive == true) {
            if (!PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        }
    }
    return false;
}

================================================
FILE: db_extra/PE/cryptor_unknown_malware_cryptor.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "Unknown malware cryptor");

function detect() {
    if (PE.compareEP("51578bcf47fc5f5955eb")) {
        sVersion = "AA";
        bDetected = true;
    } else if (PE.compareEP("558bec81c4........565753508d8424........ff15")) {
        sVersion = "AB";
        bDetected = true;
    } else if (PE.compareEP("833d..........e9$$$$$$$$0f85........5058807c")) {
        sVersion = "AC";
        bDetected = true;
    } else if (PE.compareEP("833d..........75$$ff35........e8$$$$$$$$558bec81ec")) {
        sVersion = "AC";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptors_1.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Unknown cryptor");

function detect() {
    if (PE.compareEP("bb........8b338b4b..b8........eb$$31064975..83c3..833b..75..eb$$9b")) {
        sName = "Cryptor by Merix //UCF";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/cryptors_2.2.sg
================================================
// Detect It Easy: detection rule file

meta("cryptor", "unknwown cryptor"); // ????????????

function detect() {
    if (PE.compareEP("909090909090609ce8000000005dd14d..816d..........d709d8ab")) {
        sOptions = "by TMG";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/insatller_Avast_installer.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Avast installer");

function detect() {
    bDetected = PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7") && PE.compareOverlay("'ASWsetupFPkgFil3'");

    return result();
}

================================================
FILE: db_extra/PE/installer_Adobe_Flash_Player_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Adobe Flash Player");

function detect() {
    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")) {
        for (var i = 0; i < PE.getNumberOfResources() && !bDetected; i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                if (PE.compare("02010000", PE.resource[i].Offset)) {
                    bDetected = true;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_Blizzard_PrePatch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Blizzard PrePatch");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")) {
        if (PE.compareOverlay("'MPQ'1a")) {
            sVersion = "2.XX";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$e8$$$$$$$$a1........85c075..538b1d........5657be........bf........8d6424")) {
        if (PE.compareOverlay("'MPQ'1a")) {
            sVersion = "2.70";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_Box_Stub.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Box Stub");

function detect() {
    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x110, PE.getOverlaySize()), "'7z'bcaf") !== -1) {
            sOptions = "7zip";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_BulletProofSoft_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "BulletProofSoft");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")) {
        if (PE.compareOverlay("1f8b08", 0x3000)) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_DockerDesktopInstaller.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L. <asl@onet.eu> 2022.01.30
// Exeinfo Pe - don't detect this big file over 500 MB

meta("installer", "Docker Desktop Installer .NET sfx 7zip");

function detect() {
    if (PE.isNET()) {
        if ((PE.isNetObjectPresent("Docker Desktop Installer")) &&
            (PE.getAddressOfEntryPoint() == 0x400000) // EP=0000
            && (PE.section[".rsrc"].FileSize > 0x01000000)) // over 400 MB
        {
            sVersion = "4.x";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_Enigma_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// sign by A.S.L  - asl@onet.eu  - 21.06.2015
meta("installer", "Enigma");

function detect() {
    for (var i = 0; i < PE.resource.length; i++) {
        if (PE.resource[i].Name == '/CFG/CONFIG') {
            if (PE.resource[i + 1].Name == '/CFG/PRIVACY_POLICY') {
                bDetected = 2;
                break;
            }
        }
    }

    // MS C++ v9.0 stub  and Resources found
    if (PE.compareEP("E8....0100E9") && (bDetected == 2)) {
        bDetected = true;
        sVersion = "v1.0";
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_Hamrick_Software_installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L  <asl@onet.eu>

meta("installer", "Hamrick Software - VueScan Installer");

function detect() {
    if (PE.compareOverlay("BDA6EEE9F9EDEFEDE5ED")) {
        if (PE.compareEP("E8....0000")) {
            bDetected = true;
        } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..33c0")) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_Kingsoft_Installer.1.sg
================================================
// Detect It Easy: detection rule file
// Author: A.S.L <asl@onet.eu>   2024.10.28

meta("installer", "Kingsoft");

function detect() {
    if (PE.compareEP("E8") || PE.compareEP("60")) { // MSV C++ or UPX
        if (PE.compareOverlay("'zzd.'")) {
            sOptions = "7z archive";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_QT_installer.1.sg
================================================
// Detect It Easy: detection rule file

meta("installer", "QT installer");

function detect() {
    if (PE.compareOverlay("'qres'")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/installer_SHIROUZU_Hiroaki_installer.1.sg
================================================
// Detect It Easy: detection rule file format
// Author: A.S.L. <asl@onet.eu> 2025.06.15
// Exeinfo Pe - don't detect this installer

meta("installer", "SHIROUZU Hiroaki and FastCopy Lab Installer 1996-2024");

function detect() {
    if (PE.compareEP("E8....0000E9")) {
        if (PE.compareOverlay("0A'======================================================================'0A'IP2:'")) {
            sVersion = "5.X - .zlib ovl";
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db_extra/PE/installer_Store_Installer.1.sg
================================================
// Detect It Easy: detection rule file

meta("installer", "Store Installer");

function detect() {
    if (PE.isNET()) {
        if (PE.getVersionStringInfo("InternalName") == "StoreInstaller.exe") {
            sVersion = PE.getVersionStringInfo("FileVersion");
            bDetected = true;
        }
    }

    return result();
}


================================================
FILE: db_extra/PE/installer_TrueCrypt-VeraCrypt_installer.1.sg
================================================
// Detect It Easy: detection rule file format
// Author: A.S.L. <asl@onet.eu> 2019.05 updated 2025.01.31

meta("installer", "TrueCrypt or VeraCrypt installer");

function detect() {
    if (PE.compareEP("E8....0000E9") && PE.compareOverlay("..'CINSTRT'")) {
        sVersion = "1.X-7.X";
        bDetected = true;
    } else {
        // VeraCrypt only, TrueCrypt closed
        if (PE.compareEP("558BEC83EC0C56") && PE.compareOverlay("'VCINSTRT'")) {
            sVersion = "1.26 2025";
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/joiner_Anskya_Binder.2.sg
================================================
// Detect It Easy: detection rule file

meta("joiner", "Anskya Binder");

function detect() {
    if (PE.compareEP("BE........BB........33ED83EE04392E7411")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/joiner_Blade_Joiner.1.sg
================================================
// Detect It Easy: detection rule file

meta("joiner", "Blade Joiner");

function detect() {
    if (PE.compareEP("558BEC81C4E4FEFFFF53565733C08945F08985")) {
        sVersion = "1.5";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/joiner_DJoin.1.sg
================================================
// Detect It Easy: detection rule file

meta("joiner", "DJoin");

function detect() {
    if (PE.compareEP("C605........00C605........00................00........00..........00")) {
        sVersion = "0.7 public";
        sOptions = "RC4 encryption";
        bDetected = true;
    } else if (PE.compareEP("C605........00................00........00..........00")) {
        sVersion = "0.7 public";
        sOptions = "xor encryption";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/joiner_ExeJoiner.1.sg
================================================
// Detect It Easy: detection rule file

meta("joiner", "ExeJoiner");

function detect() {
    if (PE.compareEP("68........6804010000E83903000005........C6005C680401000068")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/keygen_keygens.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("keygen", "Keygen");

function detect() {
    if (PE.compareEP("6a..e8........a3........c705................c705................c705................c705................c705................a1........a3........6a..ff35........e8........a3........a3........68")) {
        sOptions = "by Dimedrol //CORE";
        bDetected = true;
    } else if (PE.compareEP("606a..e8........a3........6a..6a..6a..e8........506a..e8........50")) {
        sOptions = "by promethee //ECLIPSE";
        bDetected = true;
    } else if (PE.compareEP("6a..e8........a3........68........6a..6a..6a..6a..68........6a..6a..6a..68........6a..6a..6a..6a..e8........a3........6a")) {
        sOptions = "by Duelist //CORE";
        bDetected = true;
    } else if (PE.compareEP("6a..e8........a3........6a..68........6a..6a..50e8........50e8........c3")) {
        sOptions = "2000 by Duelist //CORE";
        bDetected = true;
    } else if (PE.compareEP("6a..e8........a3........33c066b8....6a..68........6a..50ff35........e8........e8........c8......53575633c0668b45..663d....75..eb")) {
        sOptions = "by //oDDiTy";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/library_DS.Flexlm.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library");

function detect() {
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    var nOffset = PE.findSignature(0, nSize, "'@(#) F'");
    if (nOffset != -1) {
        sName = File.cleanString(PE.getString(nOffset, 200).match(/\w\S*/i));
        sVersion = File.cleanString(PE.getString(nOffset, 200).match(/\d\S*/i));

        if (sVersion && sVersion.length < 32) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/library_DS.RLM.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("library", "Reprise License Manager (RLM)");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    var nOffset = PE.findString(0, nSize, "Reprise License Manager (RLM)");
    if (nOffset !== -1) {
        sVersion = PE.getString(nOffset, 200).match(/\d\S*\w/i);
        bDetected = true;
        nOffset = PE.findSignature(0, nSize, "44894c24..4c894424..48895424..48894c24..b8........e8........482be0488b05........4833c448898424........48c78424................48c78424................48c78424................c74424..........c74424..........488b8424........4805........48894424..c74424..........c74424..........c74424..........c78424................4883bc24..........74..488b8424........c7");
        //v8.0-9.1 x64
        if (nOffset !== -1) {
            sOptions = "rlm_pubkey at " + nOffset;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/packer_BobPack.2.sg
================================================
// Detect It Easy: detection rule file

meta("packer", "BobPack");

function detect() {
    if (PE.compareEP("60E8000000008B0C2489CD83E90681ED........E83D0000008985........89C2B85D0A00008D0408E8E40000008B700401D6E876000000E851010000E80101")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/packer_Feokt.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("packer", "Feokt run-time");

function detect() {
    if (PE.compareEP("8925........bf........31c0b9........29f9fcf3aa9bdbe350669bd93c249b")) {
        sOptions = "by Max Feoktistov";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/packer_IMPostor_Pack.2.sg
================================================
// Detect It Easy: detection rule file

meta("packer", "IMPostor Pack");

function detect() {
    if (PE.compareEP("BE........83C601FFE600000000....000000000000000000......00..02....00100000000200")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/packer_Native_UD_Packer.2.sg
================================================
// Detect It Easy: detection rule file

meta("packer", "Native UD Packer");

function detect() {
    if (PE.compareEP("31C031DB31C9EB0E6A006A006A006A00FF15........FF15........89C768")) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/packer_TomatoX.2.sg
================================================
// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("packer", "TomatoX");

function detect() {
    if (PE.isSectionNamePresent(".tomato")) {
        bDetected = true;
    }
    return result();
}

================================================
FILE: db_extra/PE/packer_bbfb.2.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
/*
If errors pls contact sendersu on cracklab.team
*/

// https://www.flashbackrecorder.com/

meta("packer", "Blueberry/FLASHBACK");

function detect() {
    if (PE.findString(0, PE.getSize(), "BB FlashBack Movie") != -1) {
        if (PE.compare("'FBPE'", PE.getSize() - 4)) {
            bDetected = true;
        }

        sVersion = PE.getFileVersion();
    }

    return result();
}

================================================
FILE: db_extra/PE/patcher_Patch.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("patcher", "Patch");

function detect() {
    if (PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68........6a..e8")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                if (PE.compare("a28ff4c4", PE.resource[i].Offset)) {
                    sVersion = "2.0";
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protection_DS.Key-Lok_II_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Key-Lok II dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nOffset = 0;
    var endOffset = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
    while (true) {
        nOffset = PE.findString(nOffset, endOffset - nOffset, "\\.\\");
        if (nOffset == -1) break;
        nOffset += 4;
        if (PE.compare("'KeyDongle_0'", nOffset)) {
            bDetected = true;
            break;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protection_DS.Novex_dongle.4.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Novex/Guardant dongle reference");

function detect() {
    // I'm (adoxa) guessing this don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    if (PE.findString(0, PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize(), "\\\\.\\NVKEY") != -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protection_DS.Rockey4_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Rockey4 dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nOffset = 0;
    var endOffset = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
    while (true) {
        nOffset = PE.findString(nOffset, endOffset - nOffset, "\\.\\");
        if (nOffset == -1) break;
        nOffset += 4;
        if (PE.compare("'ROCKEY'", nOffset) ||
            PE.compare("'rockey'", nOffset)) {
            bDetected = true;
            break;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protection_DS.Wizzkey_dongle.5.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Wizzkey dongle reference");

function detect() {
    // I'm (adoxa) guessing this doesn't occur in the overlay, so don't search it (avoid wasting time on big installers).
    if (PE.findString(0, PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize(), "\\\\.\\WIZZKEYRL") != -1) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_ARM_Protector.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ARM Protector");

function detect() {
    if (PE.compareEP("E8040000008360EB0C5DEB05")) {
        switch (PE.readDword(PE.nEP + 42)) {
            case 0xAB3: sVersion = "0.5"; break;
            case 0xBA1: sVersion = "0.6"; break;
            default:
                sVersion = "0.1b-0.3b";
        }
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_ASPR_Stripper.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ASPR Stripper");

function detect() {
    if (PE.compareEP("BB........E9........609CFCBF........B9........F3AA9D61C3558BEC")) {
        sVersion = "2.X";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Adept_Protector.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Adept Protector");

function detect() {
    if (PE.isNET()) {
        var nOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "ByAdeptProtector");
        if (nOffset != -1) {
            if (PE.compare("'Smashed'", nOffset - 7)) {
                sOptions = "Evaluation";
            } else if (PE.compare("'STAThreadAttribute'", nOffset + 17)) {
                sVersion = "2.1";
            }

            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Alex_Protector.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Alex Protector");

function detect() {
    if (PE.compareEP("60E8000000005D81ED06104000E824000000")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("60E801000000C783C40433C9E8010000006883C404E8010000006883C404")) {
        sVersion = "0.4 beta 1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Alloy.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Alloy");

function detect() {
    if (PE.compareEP("9C60E802......33C08BC483C004938BE38B5BFC81EB........87DD6A0468001000006800..00006A00FF95........0B")) {
        sVersion = "4.x";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Apex-c.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Apex-c");

function detect() {
    if (PE.compareEP("68........B9FFFFFF0001D0F7E2720148E2F7B9FF0000008B34248036FD46E2FAC3")) {
        sVersion = "BLT Apex 4.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_BitShape_PE_Crypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "BitShape PE Crypt");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........B97B0900008DBD........8BF7AC")) {
        sVersion = "1.5";
        bDetected = true;
    } else if (PE.compareEP("E8000000005B83EB05EB04'RND!'EB02CD20EB")) {
        sVersion = "1.0-1.02";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_BlindSpot.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "BlindSpot");

function detect() {
    if (PE.compareEP("558BEC81EC500200008D85B0FEFFFF5356A3........578D85B0FDFFFF680001000033F65056FF15........5668800000006A0356568D85B0FDFFFF680000008050FF15........56566800080000508945FCFF15")) {
        sVersion = "1.00";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Break_Into_Pattern.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Break-Into-Pattern");

function detect() {
    if (PE.compareEP("E9$$$$$$$$EB14")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_CDS_SS.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "CDS SS");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........FF742420E8D30300000BC00F84130300008985........668CD8A804740CC785")) {
        sVersion = "1.0 beta1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_CodeSafe.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "CodeSafe");

function detect() {
    if (PE.compareEP("83EC10535657E8C40100", 23)) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_DEF.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "DEF");

function detect() {
    if (PE.compareEP("BE........6A..59807E070074118B460C05........8B56103010404A75FA83C628E2E4")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_DirTy_CrYpt0r.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "DirTy CrYpt0r");

function detect() {
    if (PE.compareEP("b8........32dbfec33018403d........7e..68........e8")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_EP.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "EP"); // ?????????????

function detect() {
    if (PE.compareEP("5083C0178BF09733C033C9B124AC86C4ACAA86C4AAE2F600B8400003003C40D2338B661450708B8D3402448B1810487003BA")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("6A..60E90101")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_EXECrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "EXECrypt");

function detect() {
    if (PE.compareEP("909060E8000000005D81ED........B91500000083C10483C101EB05EBFE83C756EB00EB00")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_EXERefactor.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "EXERefactor");

function detect() {
    if (PE.compareEP("558BEC81EC900B0000535657E9588C0100'USCATION'")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Embed_PE.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Embed PE");

function detect() {
    if (PE.compareEP("83EC506068........E8....0000")) {
        switch (PE.readWord(PE.nEP + 10)) {
            case 0x992F:
                sVersion = "1.13";
                break;
            case 0xFFCB:
                sVersion = "1.24";
                break;
            default:
                sVersion = "1.X";
                break;
        }
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_EncryptPE.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "EncryptPE");

function detect() {
    if (PE.compareEP("609C64FF3500000000E8")) {
        switch (PE.readDword(PE.nEP + 10)) {
            case 0x179:
                sVersion = "1.2003.3.18-1.2003.5.18";
                break;
            case 0x17a:
                sVersion = "2.2004.6.16-2.2006.6.30";
                break;
            case 0x173:
                sVersion = "2.2006.7.10-2.2006.10.25";
                break;
            case 0x21b:
                sVersion = "2.2007.04.11";
                break;
        }

        bDetected = true;
    }
    //    else if (PE.compareEP("807c24....0f85........60be........8dbe........5783cd..eb")) {
    //        sOptions = "Delphi file protected";
    //        bDetected = true;
    //    }

    return result();
}

================================================
FILE: db_extra/PE/protector_ExeSafeguard.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ExeSafeguard");

function detect() {
    if (PE.isSignatureInSectionPresent(PE.nLastSection, "C05DEB4EEB47DF694E58DF5974F3EB01DF75EE9A599C81C1E2FFFFFFEB01DF9DFFE1E851E8EBFFFFFF")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_ExeSmasher.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ExeSmasher");

function detect() {
    if (PE.compareEP("9CFE03..60BE........8DBE..10FFFF5783CDFFEB10")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Exe_Locker.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Exe Locker");

function detect() {
    if (PE.compareEP("E800000000608B6C242081ED05000000")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_FakeNinja.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "FakeNinja");

function detect() {
    if (PE.compareEP("64A118000000EB02C3118B4030EB010F0FB6400283F80174FEEB01E890C0FFFFEB03BDF4B564A1300000000")) {
        sVersion = "2.8";
        sOptions = "Anti-Debug";
        bDetected = true;
    } else if (PE.compareEP("BA........FFE2........FF35........E840")) {
        sVersion = "2.8";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_FixupPak.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "FixupPak");

function detect() {
    if (PE.compareEP("55E8000000005D81ED....0000BE00..000003F5BA0000....2BD58BDD33C0AC3C00743D3C01740E")) {
        sVersion = "1.20";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Fuck_n_Joy.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Fuck n Joy");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........FF742420E88C0200000BC00F842C0100008985")) {
        sVersion = "1.0c";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Fusion.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Fusion");

function detect() {
    if (PE.compareEP("68........68........E80903000068........E8C7020000")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_GuardantStealth.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Guardant Stealth");

function detect() {
    if (PE.getNumberOfImports() == 1) {
        if (PE.getImportLibraryName(0) == "NOVEX32.dll") {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_ICrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ICrypt");

function detect() {
    if (PE.compareEP("558BEC83C4EC53565733C08945ECB8703B0010E83CFAFFFF33C055686C3C00")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_ID_Application_Protector_NoNamePacker.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "ID Application Protector (NoNamePacker)");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........B9........81E9........89EA81C2........8D3A89FE31C0E9D3020000CCCCCCCCE9CA020000'C:\\Windows\\SoftWareProtector\\'")) {
        sVersion = "1.2";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_KGCrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "KGCrypt");

function detect() {
    if (PE.compareEP("E8........5D81ED........64A1........84C074..64A1........0BC074")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_MZ-Crypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "MZ-Crypt");

function detect() {
    if (PE.compareEP("60E8000000005D81ED251440008BBD771440008B8D7F144000EB28837F1C07751E8B770C03B57B14")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Minke.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Minke");

function detect() {
    if (PE.compareEP("558BEC83C4F053..........10E87AF6FFFFBE........33C05568........64FF30648920E8FAF8FFFFBA")) {
        sVersion = "1.0.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Morphine.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Morphine");

function detect() {
    if (PE.compareEP("FF25........8BC0FF25........8BC0")) {
        sVersion = "1.2-1.3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_NecroVM.Virt.2.sg
================================================
// Detect It Easy: detection rule file
// NecroVM by DosX

function detect() {
    if (PE.isNet()) {
        if (PE.getString(0x2e, 13) == "It's NecroVM!" &&
            PE.isSignatureInSectionPresent(0, "5F00'VmLoad'00'mscorlib'")) {

            var nOffset = PE.findString(0x1f0, 16, "v"),
                version = "";

            if (nOffset != -1) {
                version = PE.getString(nOffset + 1, 0x1ff - nOffset);
            }
            _setResult("packer", "NecroVM Compressor", version, "LZMAT");
            return ""; // There is no point in analyzing anything further
        }

        const references = ["System.Reflection", "System.Security.Cryptography", "System.Runtime.InteropServices"];
        for (var i = 0; i < references.length; i++)
            if (!PE.isSignatureInSectionPresent(0, "00'" + references[i] + "'00")) // 00'keyValue'00
                return "";

        const vmCore = "NecroVM.Runtime"; // Virtual machine namespace

        if (PE.isSignatureInSectionPresent(0, "50??'" + vmCore + "'") && PE.isNetObjectPresent(vmCore) && // check for core
            PE.isSignatureInSectionPresent(0, "'info'00'flags'00'nativeEntry'00'nativeSizeOfCode'")) {

            if (PE.isSignatureInSectionPresent(0, "0005'_'00'_'00")) // code isolation
                _setResult("protection", "NecroVM Code Container", "", "");

            if (PE.isSignatureInSectionPresent(0, "2000690073002000740061006d00700065007200650064002e00")) // check for anti-tamper
                _setResult("protection", "NecroVM Anti-Tamper", "", "");

            var options = "Virtualization"

            if (PE.isSignatureInSectionPresent(0, "00'm_1'")) {
                options += " + Obfuscation"
            }

            _setResult("protector", "NecroVM", "2.X", options);
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_NoodleCrypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "NoodleCrypt");

function detect() {
    if (PE.compareEP("EB019AE8..000000EB019AE8....0000EB019AE8....0000EB01")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_PE-Admin.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "PE-Admin");

function detect() {
    if (PE.compareEP("609C64FF3500000000E879010000900000000000000000000000................0000000000000000000000000000000000000000")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_PENightMare.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "PENightMare");

function detect() {
    if (PE.compareEP("60E9........EF4003A7078F071C375D43A704B92C3A")) {
        sVersion = "2 Beta";
        bDetected = true;
    } else if (PE.compareEP("60E8000000005DB9........8031154181F9")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_PE_Quake.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PE Quake");

function detect() {
    if (PE.compareEP("e8$$$$$$$$5d81ed........8d75..56ff55..8db5........5650ff55..8985........6a..68")) {
        sVersion = "0.06";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Pe123.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Pe123");

function detect() {
    if (PE.compareEP("8BC0609CE801000000C353E87200000050E81C0300008BD8FFD35BC3")) {
        sVersion = "2006.4.12";
        bDetected = true;
    } else if (PE.compareEP("8BC0EB013460EB012A9CEB02EAC8E80F000000EB033D2323EB014AEB015BC3")) {
        sVersion = "2006.4.4";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_PolyEnE.2.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PolyEnE");

function detect() {
    if (PE.compareEP("6083ec..c70424........5868........8b0c2483c4..fff051ff15........50eb")) {
        bDetected = true;
    } else if (PE.compareEP("6068........8b04..83c4..83ec..c70424........595051ff15........eb")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_PwdProtect.2.sg
================================================
// Detect It Easy: detection rule file
// Made by KDSS-Research

meta("protector", "PwdProtect");

function detect() {
    if (PE.isSectionNamePresent(".pwdprot")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_QQProtect.2.sg
================================================
// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

init("protector", "QQProtect");

function detect() {
    if (PE.isResourceNamePresent("QQPROTECT")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Sepanta.2.sg
================================================
// Detect It Easy: detection rule file
// Author: sendersu
// If errors pls contact sendersu on cracklab.team

meta("protector", "Sepanta");

function detect() {
    if (PE.isOverlayPresent()) {
        if (PE.findString(PE.getOverlayOffset(), 4096, "<Sepanta>") != -1 ||
            PE.findString(PE.getOverlayOffset(), 4096, "</Sepanta>") != -1) {
            bDetected = true;
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Soft_Defender.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Soft Defender");

function detect() {
    if (PE.compareEP("74$$74$$78$$68A2AF470159E8")) { // 07  1F  0F
        bDetected = true;

        if (PE.compareEP("BA010000", 72)) {
            sVersion = "1.0-1.1";
        } else if (PE.compareEP("BE010000", 73)) {
            sVersion = "1.12";
        } else {
            sVersion = "1.X";
        }
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_TheHypers.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "TheHypers");

function detect() {
    if (PE.compareEP("558BEC83EC148BFCE8$$$$$$$$5EE80D000000'kernel32.dll'00")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_WinKript.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "WinKript");

function detect() {
    if (PE.compareEP("33C08BB8........8B90........85FF74..33C950EB..8A0439C0C8..34..880439413BCA72..58")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Wind_of_Crypt.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Wind of Crypt");

function detect() {
    if (PE.compareEP("558BEC83C4EC53........8945ECB8........E828EAFFFF33C05568")) {
        sVersion = "1.0";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_Xtreme-Protector.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "Xtreme-Protector");

function detect() {
    if (PE.compareEP("B8........B9........5051E805000000E94A010000608B7424248B7C2428FCB2808A0646880747BB0200000")) {
        sVersion = "1.06";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/protector_muckis_protector.2.sg
================================================
// Detect It Easy: detection rule file

meta("protector", "mucki's protector");

function detect() {
    if (PE.compareEP("BE........B9........8A06F6D0880646E2F7E9")) {
        bDetected = true;
    } else if (PE.compareEP("E8240000008B4C240CC70117000100C781B80000000000000031C0894114894118806A00")) {
        sVersion = "II";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/sfx_ADS_Self_Extractor.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "ADS Self-Extractor");

function detect() {
    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774")) {
        bDetected = PE.compareOverlay("7b00320030003700320036003300370037002d00");
    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        bDetected = PE.findSignature(PE.getOverlayOffset(), Math.min(0x100, PE.getOverlaySize()), "7b00320030003700320036003300370037002d00") !== -1;
    }

    return result();
}

================================================
FILE: db_extra/PE/sfx_CipherWall.1.sg
================================================
// Detect It Easy: detection rule file

meta("sfx", "CipherWall");

function detect() {
    if (PE.compareEP("9061BE........8DBE0000FEFFC787C0200200")) {
        sVersion = "1.5";
        switch (PE.getEPSignature(19, 14)) {
            case "0B6E5B9B5783CDFFEB0E90909090":
                sOptions = "Decryptor Console";
                break;
            case "F989C76A5783CDFFEB0E90909090":
                sOptions = "Decryptor GUI";
                break;
        }

        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/tool_UPX_shit.2.sg
================================================
// Detect It Easy: detection rule file

meta("tool", "UPX shit");

function detect() {
    if (PE.compareEP("E2FA94FFE06100000000000000")) {
        sVersion = "0.0.1";
        bDetected = true;
    } else if (PE.compareEP("94BC......00B9..00000080340C..E2FA94FFE061")) {
        sVersion = "0.0.1";
        bDetected = true;
    } else if (PE.compareEP("B8....4300B915000000803408..E2FAE9D6FFFFFF")) {
        sVersion = "0.06";
        bDetected = true;
    } else if (PE.compareEP("E8000000005E83C614AD89C7AD89C1AD300747E2FBADFFE0C3")) {
        sVersion = "0.1";
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/tool_UPXcrypter.2.sg
================================================
// Detect It Easy: detection rule file

meta("tool", "UPXcrypter");

function detect() {
    if (PE.compareEP("BF......0081FF......007410812F..00000083C704BB05....00FFE3BE......00FFE600000000")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/PE/virus_Win9x_CIH.1.sg
================================================
// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("virus", "Win9x.CIH");

function detect() {
    if (PE.compareEP("558d4424f833db648703e8000000005b8d4b425150500f014c24fe5b83c31cfa")) {
        bDetected = true;
    }

    return result();
}

================================================
FILE: db_extra/about.txt
================================================
"db_extra" contains detection rules and scripts that were not approved for inclusion in the main database.
Some of these rules may trigger only a few positive detections across the entire internet.

Using this default database is NOT RECOMMENDED as it is not optimized or actively maintained.

================================================
FILE: dbs_min/db/.vscode/about.txt
================================================
This directory is responsible for correct recognition of *.sg files by Visual Studio Code. You can delete it if you don't need it.

================================================
FILE: dbs_min/db/.vscode/settings.json
================================================
{
    "files.associations": {
        "*.sg": "javascript"
    }
}

================================================
FILE: dbs_min/db/ACE
================================================
function detect_ACE(e){var i,e=e?(i=0,File.getSize()):(i=File.getOverlayOffset(),File.getOverlaySize())
if(48<e&&(File.compare("'**ACE**'",i+7)&&(bDetected=1,sVersion="2",128&File.readByte(i+6)&&(sOptions="solid"),File.compare("'UNREGISTERED'",i+32)&&(sOptions=sOptions.append("unregistered")),-1!=(i=File.findSignature(i+32,128,"000101"))))){for(i-=3;i<File.getSize();){var r=File.readDword(i+7)
Archive.add(File.readDword(i+11),r,16&File.readByte(i+19)),i+=35+File.readWord(i+33)+r}sOptions=sOptions.append(Archive.contents())}}includeScript("archive-file"),sName="ACE"

================================================
FILE: dbs_min/db/APK/_APK.0.sg
================================================
function detect(){return APK.isVerbose()&&(sName=APK.getOperationSystemName(),sVersion=APK.getOperationSystemVersion(),sOptions=APK.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","Android")

================================================
FILE: dbs_min/db/APK/_init
================================================
var File=APK,X=APK

================================================
FILE: dbs_min/db/APK/library_IL2CPP.4.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libil2cpp.so"),sLang="C#",result()}meta("library","IL2CPP")

================================================
FILE: dbs_min/db/APK/library_SandHook.4.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/arm64-v8a/libsandhook-native.so")||APK.isArchiveRecordPresent("lib/arm64-v8a/libsandhook.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libsandhook-native.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libsandhook.so"),result()}meta("library","SandHook")

================================================
FILE: dbs_min/db/APK/library_UnicomSDK.4.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/arm64-v8a/libunicomSimplesdk.dat")||APK.isArchiveRecordPresent("assets/arm64-v8a/libunicomsdk.jar")||APK.isArchiveRecordPresent("assets/armeabi-v7a/libdecrypt.jar")||APK.isArchiveRecordPresent("assets/x86/libunicomSimplesdk.dat")||APK.isArchiveRecordPresent("assets/arm64-v8a/libdecrypt.jar")||APK.isArchiveRecordPresent("assets/x86/libunicomsdk.jar")||APK.isArchiveRecordPresent("assets/unicom_resource.dat")||APK.isArchiveRecordPresent("assets/x86/libdecrypt.jar")||APK.isArchiveRecordPresent("assets/classes.jar"),result()}meta("library","UnicomSDK")

================================================
FILE: dbs_min/db/APK/library_Unity.4.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libunity.so"),result()}meta("library","Unity")

================================================
FILE: dbs_min/db/APK/package_PackageName.1.sg
================================================
function detect(){var e=APK.getAndroidManifestRecord("package")
return e&&(sName=e,sVersion=APK.getAndroidManifestRecord("android:versionName"),bDetected=1),result()}meta("package","")

================================================
FILE: dbs_min/db/APK/packer_Kony.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("libkonyjsvm.so"),result()}meta("packer","Kony")

================================================
FILE: dbs_min/db/APK/protector_APKProtect.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("apkprotect.com/key.dat")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libAPKProtect.so")||APK.isArchiveRecordPresent("lib/armeabi/libAPKProtect.so"),result()}meta("protector","APKProtect")

================================================
FILE: dbs_min/db/APK/protector_APKProtector.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/ap.others/apkprotect.bin")||APK.isArchiveRecordPresent("assets/ap.src/apkprotect-v1.bin")||APK.isArchiveRecordPresent("assets/ap.src/apkprotect-v2.bin")||APK.isArchiveRecordPresent("assets/ap.src/apkprotect-v3.bin")||APK.isArchiveRecordPresent("lib/arm64-v8a/libapkprotect.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libapkprotect.so")||APK.isArchiveRecordPresent("lib/x86/libapkprotect.so")||APK.isArchiveRecordPresent("lib/x86_64/libapkprotect.so"),result()}meta("protector","APKProtector")

================================================
FILE: dbs_min/db/APK/protector_AlibabaProtection.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libmobisec.so")||APK.isArchiveRecordPresent("lib/armeabi/libmobisec.so")||APK.isArchiveRecordPresent("lib/x86/libmobisec.so"),result()}meta("protector","AlibabaProtection")

================================================
FILE: dbs_min/db/APK/protector_AndroidRepublic.2.sg
================================================
function detect(){return APK.isArchiveRecordPresentExp(APK.isArchiveRecordPresent(/assets\/androidrepublic\.org\/(.*)\.png/))?(sVersion="VIP",bDetected=1):APK.isArchiveRecordPresentExp("assets/emt.androidrepublic/config.png")&&(bDetected=1),result()}meta("protector","AndroidRepublic")

================================================
FILE: dbs_min/db/APK/protector_AppGuard.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/AppGuard.dgc")||APK.isArchiveRecordPresent("assets/AppGuard0.jar")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libAppGuard.so")||APK.isArchiveRecordPresent("lib/armeabi/libAppGuard-x86.so")||APK.isArchiveRecordPresent("lib/armeabi/libAppGuard.so"),result()}meta("protector","AppGuard")

================================================
FILE: dbs_min/db/APK/protector_AppSolid.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/high_resolution.png"),result()}meta("protector","AppSolid")

================================================
FILE: dbs_min/db/APK/protector_BaiduProtection.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/baiduprotect.jar")||APK.isArchiveRecordPresent("assets/libbaiduprotect_x86.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libbaiduprotect.so")||APK.isArchiveRecordPresent("lib/armeabi/libbaiduprotect.so")||APK.isArchiveRecordPresent("lib/mips/libbaiduprotect.so")||APK.isArchiveRecordPresent("lib/x86/libbaiduprotect.so"),result()}meta("protector","BaiduProtection")

================================================
FILE: dbs_min/db/APK/protector_BangBangReinforcement.2.sg
================================================
function detect(){return(bDetected=APK.isArchiveRecordPresent("assets/autostreets.com_cert_chain.cer")||APK.isArchiveRecordPresent("assets/da.js")||APK.isArchiveRecordPresent("assets/img.autostreetscdn.com_cert.cer")||APK.isArchiveRecordPresent("assets/QMUIWebviewBridge.js")||APK.isArchiveRecordPresent("assets/info.y")||APK.isArchiveRecordPresent("assets/main.js")||APK.isArchiveRecordPresent("assets/weex-main-jsfm.js")||APK.isArchiveRecordPresent("assets/weex-rax-api.js")||APK.isArchiveRecordPresent("assets/weex-rax-extra-api.js")||APK.isArchiveRecordPresent("lib/arm/libDexHelper.so")||APK.isArchiveRecordPresent("lib/arm/libdexjni.so")||APK.isArchiveRecordPresent("lib/arm/libDexHelper-x86.so")||APK.isArchiveRecordPresent("com/secneo/apkwrapper"))&&(sVersion="Enterprise"),result()}meta("protector","BangBang Reinforcement")

================================================
FILE: dbs_min/db/APK/protector_BangcleProtection.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi/libsecexe.so")||APK.isArchiveRecordPresent("lib/x86/libsecexe.so"),result()}meta("protector","BangcleProtection")

================================================
FILE: dbs_min/db/APK/protector_DXShield.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi/libdxbase.so"),result()}meta("protector","DXShield")

================================================
FILE: dbs_min/db/APK/protector_DexProtector.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/classes.dex.dat")||APK.isArchiveRecordPresent("assets/dp.arm-v7.so.dat")||APK.isArchiveRecordPresent("assets/dp.arm-v8.so.dat")||APK.isArchiveRecordPresent("assets/dp.arm.so.dat")||APK.isArchiveRecordPresent("assets/dp.mp3")||APK.isArchiveRecordPresent("assets/dp.x86.so.dat")||APK.isArchiveRecordPresent("assets/dp.x86_64.so.dat")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libdexprotector.so")||APK.isArchiveRecordPresent("lib/armeabi/libdexprotector.so")||APK.isArchiveRecordPresent("assets/dp-lib/dp.kotlin-v1.lua.mph")||APK.isArchiveRecordPresent("assets/dexprotect/classes.dex.dat"),result()}meta("protector","DexProtector")

================================================
FILE: dbs_min/db/APK/protector_DingXiangReinforcement.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("com/security/shell/AppStub1")||APK.isArchiveRecordPresent("com/security/inner/stub000"),result()}meta("protector","DingXiang Reinforcement")

================================================
FILE: dbs_min/db/APK/protector_EasyShield.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/nedata.db")||APK.isArchiveRecordPresent("assets/nedig.properties")||APK.isArchiveRecordPresent("lib/arm/libnesec.so")||APK.isArchiveRecordPresent("lib/arm/libnesec-x86.so")||APK.isArchiveRecordPresent("lib/arm/libnshelper.so")||APK.isArchiveRecordPresent("com/netease/nis/wrapper")||APK.isArchiveRecordPresent("com/netease/nis/wrapper/MyApplication"),result()}meta("protector","NetEase EasyShield")

================================================
FILE: dbs_min/db/APK/protector_ExTrus_AppDefence.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/appdefence_xml"),result()}meta("protector","ExTrus AppDefence")

================================================
FILE: dbs_min/db/APK/protector_Gemalto.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/arm64-v8a/libmedl.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libmedl.so")||APK.isArchiveRecordPresent("lib/armeabi/libmedl.so")||APK.isArchiveRecordPresent("lib/mips/libmedl.so")||APK.isArchiveRecordPresent("lib/mips64/libmedl.so")||APK.isArchiveRecordPresent("lib/x86/libmedl.so")||APK.isArchiveRecordPresent("lib/x86_64/libmedl.so"),result()}meta("protector","Gemalto")

================================================
FILE: dbs_min/db/APK/protector_Hdus-Wjus.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi/libhdus.so")||APK.isArchiveRecordPresent("lib/armeabi/libwjus.so"),result()}meta("protector","Hdus-Wjus")

================================================
FILE: dbs_min/db/APK/protector_Ijiami.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/ijiami.ajm")||APK.isArchiveRecordPresent("assets/ijm_lib/armeabi/libexec.so")||APK.isArchiveRecordPresent("assets/ijm_lib/armeabi/libexecmain.so")||APK.isArchiveRecordPresent("assets/ijm_lib/x86/libexec.so")||APK.isArchiveRecordPresent("assets/ijm_lib/x86/libexecmain.so")||APK.isArchiveRecordPresent("assets/ijiami.dat")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libexec.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libexecmain.so")||APK.isArchiveRecordPresent("lib/armeabi/libexec.so")||APK.isArchiveRecordPresent("lib/armeabi/libexecmain.so")||APK.isArchiveRecordPresent("lib/x86/libexec.so")||APK.isArchiveRecordPresent("lib/x86/libexecmain.so"),result()}meta("protector","Ijiami")

================================================
FILE: dbs_min/db/APK/protector_Jiagu.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/libjiagu.so")||APK.isArchiveRecordPresent("assets/libjiagu_a64.so")||APK.isArchiveRecordPresent("assets/libjiagu_ls.so")||APK.isArchiveRecordPresent("assets/libjiagu_x64.so")||APK.isArchiveRecordPresent("assets/libjiagu_x86.so"),result()}meta("protector","Jiagu")

================================================
FILE: dbs_min/db/APK/protector_Kiro.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi/libkiroro.so"),result()}meta("protector","Kiro")

================================================
FILE: dbs_min/db/APK/protector_Kiwi.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/crash")||APK.isArchiveRecordPresent("assets/ec_dt.lic")||APK.isArchiveRecordPresent("assets/kwpt.lincense")||APK.isArchiveRecordPresent("lib/arm/libkiwi_dumper.so")||APK.isArchiveRecordPresent("lib/arm/libkiwicrash.so")||APK.isArchiveRecordPresent("lib/arm/libKwProtectSDK.so")||APK.isArchiveRecordPresent("lib/arm/libkwsdataenc.so")||APK.isArchiveRecordPresent("lib/arm/libkadp.so")||APK.isArchiveRecordPresent("com/kiwisec/crash")||APK.isArchiveRecordPresent("com/kiwivm/security")||APK.isArchiveRecordPresent("com/kiwivm/security/StubApplication"),result()}meta("protector","KiwiSecurity")

================================================
FILE: dbs_min/db/APK/protector_LIAPP.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/LIAPPClient.sc")||APK.isArchiveRecordPresent("assets/LIAPPClient_x86.sc")||APK.isArchiveRecordPresent("assets/LIAPPEgg.sc")||APK.isArchiveRecordPresent("assets/LIAPPEgg_x86.sc"),result()}meta("protector","LIAPP")

================================================
FILE: dbs_min/db/APK/protector_MedusaH.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libmd.so"),result()}meta("protector","MedusaH")

================================================
FILE: dbs_min/db/APK/protector_MobileTencentProtect.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/mix.dex")||APK.isArchiveRecordPresent("lib/armeabi/mix.dex"),result()}meta("protector","MobileTencentProtect")

================================================
FILE: dbs_min/db/APK/protector_NQShield.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/libnqshieldx86.so")||APK.isArchiveRecordPresent("assets/nqdata")||APK.isArchiveRecordPresent("lib/armeabi/libnqshield.so"),result()}meta("protector","NQShield")

================================================
FILE: dbs_min/db/APK/protector_NagaPTProtection.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi/libddog.so")||APK.isArchiveRecordPresent("lib/armeabi/libfdog.so"),result()}meta("protector","NagaPTProtection")

================================================
FILE: dbs_min/db/APK/protector_OLLVM-TTL.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libmtprotect.so")||APK.isArchiveRecordPresent("lib/x86/libmtprotect.so"),result()}meta("protector","OLLVM-TLL")

================================================
FILE: dbs_min/db/APK/protector_Obfuscapk.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresentExp(/assets\/lib\.arm(eabi|64)-v[0-9a-zA-Z]{2}\.[!-~]+\.so/)||APK.isArchiveRecordPresentExp(/assets\/lib\.x86(_64)?\.[!-~]+\.so/),result()}meta("protector","Obfuscapk")

================================================
FILE: dbs_min/db/APK/protector_PangXie.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libnsecure.so")||APK.isArchiveRecordPresent("lib/armeabi/libnsecure.so"),result()}meta("protector","PangXie")

================================================
FILE: dbs_min/db/APK/protector_ProGuard.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("META-INF/proguard/androidx-annotations.pro"),result()}meta("protector","ProGuard")

================================================
FILE: dbs_min/db/APK/protector_QDBH.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/qdbh"),result()}meta("protector","QDBH")

================================================
FILE: dbs_min/db/APK/protector_Qihoo360Protection.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libprotectClass.so")||APK.isArchiveRecordPresent("lib/armeabi/libprotectClass.so")||APK.isArchiveRecordPresent("lib/x86/libprotectClass.so"),result()}meta("protector","Qihoo360Protection")

================================================
FILE: dbs_min/db/APK/protector_SecNeo.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/arm64-v8a/libDexHelper-x86_64.so")||APK.isArchiveRecordPresent("lib/arm64-v8a/libDexHelper.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libDexHelper-x86.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libDexHelper.so")||APK.isArchiveRecordPresent("lib/armeabi/libDexHelper-x86.so")||APK.isArchiveRecordPresent("lib/armeabi/libDexHelper.so")||APK.isArchiveRecordPresent("lib/x86/libDexHelper.so"),result()}meta("protector","SecNeo")

================================================
FILE: dbs_min/db/APK/protector_SecShell.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/secData0.jar")||APK.isArchiveRecordPresent("lib/armeabi/libSecShell-x86.so")||APK.isArchiveRecordPresent("lib/armeabi/libSecShell.so"),result()}meta("protector","SecShell")

================================================
FILE: dbs_min/db/APK/protector_TencentLegu.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/0OO00l111l1l")||APK.isArchiveRecordPresent("assets/0OO00oo01l1l")||APK.isArchiveRecordPresent("assets/libshellx-super.2019.so")||APK.isArchiveRecordPresent("assets/o0oooOO0ooOo.dat")||APK.isArchiveRecordPresent("lib/arm64-v8a/libshell-super.2019.so")||APK.isArchiveRecordPresent("lib/armeabi/libshell-super.2019.so"),result()}meta("protector","TencentLegu")

================================================
FILE: dbs_min/db/APK/protector_TencentProtection.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/tosversion")||APK.isArchiveRecordPresent("tencent_stub"),result()}meta("protector","TencentProtection")

================================================
FILE: dbs_min/db/APK/protector_TencentSecurity.2.sg
================================================
function detect(){return(bDetected=APK.isArchiveRecordPresent("assets/dexMethod_00oo1l1l.dat")||APK.isArchiveRecordPresent("lib/arm/libshell-supervbasic.2019.so")||APK.isArchiveRecordPresent("lib/arm/libshell-superv.2019.so"))&&(sVersion="Enterprise"),result()}meta("protector","Tencent Security")

================================================
FILE: dbs_min/db/APK/protector_TongfuShield.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/mode")||APK.isArchiveRecordPresent("assets/PK")||APK.isArchiveRecordPresent("assets/virtual")||APK.isArchiveRecordPresent("assets/libegis.a")||APK.isArchiveRecordPresent("lib/arm/libegis.so")||APK.isArchiveRecordPresent("com/payegis/FirstApplication")||APK.isArchiveRecordPresent("com.payegis.entry")||APK.isArchiveRecordPresent("egis")||APK.isArchiveRecordPresent("egis-x86"),result()}meta("protector","Tongfu Shield")

================================================
FILE: dbs_min/db/APK/protector_VDog.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("assets/main000/libhdog-x86.so")||APK.isArchiveRecordPresent("assets/main000/libhdog.so")||APK.isArchiveRecordPresent("assets/main000/libvdog-x86.so")||APK.isArchiveRecordPresent("assets/main000/libvdog.so"),result()}meta("protector","VDog")

================================================
FILE: dbs_min/db/APK/protector_Virbox.2.sg
================================================
function detect(){return bDetected=(APK.isArchiveRecordPresent("libsandhook.so")||APK.isArchiveRecordPresent("libsandhook-native.so"))&&(APK.isArchiveRecordPresent("libv++_64.so")||APK.isArchiveRecordPresent("libv++.so")),result()}meta("protector","Virbox")

================================================
FILE: dbs_min/db/APK/protector_Yidun.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/arm64-v8a/libnesec.so")||APK.isArchiveRecordPresent("lib/armeabi-v7a/libnesec.so")||APK.isArchiveRecordPresent("lib/armeabi/libnesec.so")||APK.isArchiveRecordPresent("lib/x86/libnesec.so"),result()}meta("protector","Yidun")

================================================
FILE: dbs_min/db/APK/protector_build38.2.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("__license.tak")||APK.isArchiveRecordPresent("license.tak"),result()}meta("protector","build38")

================================================
FILE: dbs_min/db/APK/protector_iCrypt.2.sg
================================================
function detect(){return(bDetected=APK.isArchiveRecordPresent("assets/af.bin")||APK.isArchiveRecordPresent("assets/ijiami.ajm")||APK.isArchiveRecordPresent("assets/ijiami.dat")||APK.isArchiveRecordPresent("assets/IJMDal.Data")||APK.isArchiveRecordPresent("assets/signed.bin")||APK.isArchiveRecordPresent("assets/InteGration_4.5.1.ttf")||APK.isArchiveRecordPresent("assets/libijmDataEncryption.so")||APK.isArchiveRecordPresent("assets/libijmDataEncryption_arm64.so")||APK.isArchiveRecordPresent("assets/libijmDataEncryption_x86.so")||APK.isArchiveRecordPresent("lib/arm/libijm-emulator.so"))&&(sVersion="Enterprise"),result()}meta("protector","iCrypt")

================================================
FILE: dbs_min/db/APK/tool_ApktoolPlus.6.sg
================================================
function detect(){return bDetected=APK.isArchiveRecordPresent("lib/armeabi-v7a/libapktoolplus_jiagu.so"),result()}meta("tool","ApktoolPlus")

================================================
FILE: dbs_min/db/APK/tool_SingleJar.3.sg
================================================
function detect(){return bDetected="singlejar"==APK.getManifestRecord("Created-By"),result()}meta("tool","SingleJar")

================================================
FILE: dbs_min/db/Amiga/AMOS_Basic.4.sg
================================================
function detect(){return Amiga.compareEP("60$$49fa....397a........b07c....65..303c....3940....43ec....53..6b")?(sVersion="1.0",bDetected=1):Amiga.compareEP("243c........263c........49fa....294c....294f....48e7808078..7a..7c..2c78....0802")&&(bDetected=1),sLang="BASIC",result()}meta("compiler","AMOS Basic")

================================================
FILE: dbs_min/db/Amiga/AMOS_Compiler_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("60$$49fa....294c....2c78....294f....48e7808070..103a....b03c....64")&&(bDetected=1),result()}meta("cruncher","AMOS Compiler Cruncher")

================================================
FILE: dbs_min/db/Amiga/Absoft_AC_Basic.4.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$48e780802c78....78..43fa....61..6700....2f002a0043fa")&&(bDetected=1),sLang="BASIC",result()}meta("compiler","Absoft AC/BASIC")

================================================
FILE: dbs_min/db/Amiga/Absoft_Fortran.4.sg
================================================
function detect(){return Amiga.compareEP("43fa....2449d3fc........d5fc........223c........243c........2f0226482a002449203c")&&(sVersion="2.3",bDetected=1),sLang="FORTRAN",result()}meta("compiler","Absoft Fortran")

================================================
FILE: dbs_min/db/Amiga/Amiga_E.4.sg
================================================
function detect(){return Amiga.compareEP("23cf........6100$$$$23c0........23c8........2c78....43fa....70..4eae....23c0")?(sOptions="type 1",bDetected=1):Amiga.compareEP("23cf........6100$$$$33fc............23c0........23c8........2c78....33ee............43f9")?(sOptions="type 2",bDetected=1):Amiga.compareEP("2c78....2a482e00203c........223c........24004eae....4a8066")&&(sOptions="type 3",bDetected=1),result()}meta("compiler","Amiga E")

================================================
FILE: dbs_min/db/Amiga/Amiga_font.1.sg
================================================
function detect(){return Amiga.compareEP("70..4e75............................0f80")&&(bDetected=1),result()}meta("font","Amiga font")

================================================
FILE: dbs_min/db/Amiga/Aztec_C.4.sg
================================================
function detect(){return Amiga.compareEP("4ef9########2a4f61..43ec....45ec....b5c966..323c....6b..74..22c251c9")?(sVersion="5.0a",sOptions="type 1",bDetected=1):Amiga.compareEP("4ef9########61..43ec....45ec....b5c966..323c....6b..74..22c251c9")?(sVersion="5.0d-5.2a",sOptions="type 1",bDetected=1):Amiga.compareEP("4efa$$$$61..43ec....45ec....b5c966..323c....6b..74..22c251c9")?(sVersion="5.0d-5.2a",sOptions="type 2",bDetected=1):Amiga.compareEP("4efa$$$$2a4f61..43ec....45ec....b5c966..323c....6b..74..22c251c9")?(sVersion="5.0a",sOptions="type 2",bDetected=1):Amiga.compareEP("4efa$$$$43f9........2851d9ccd9ccd9fc........43ec....45ec....b5c966..323c....6b")?(sOptions="type 1",bDetected=1):Amiga.compareEP("4efa$$$$61..43f9........45f9........b5c966..323c....6b..74..22c251c9")?(sOptions="type 2",bDetected=1):Amiga.compareEP("4efa$$$$2a4f61..43f9........45f9........b5c966..323c....6b..74..22c251c9")&&(sOptions="type 3",bDetected=1),sLang="C",result()}meta("compiler","Aztec C")

================================================
FILE: dbs_min/db/Amiga/BHC3_Relocatable.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....2028....0680........223c........2c78....4eae....2240")&&(bDetected=1),result()}meta("cruncher","BHC3 Relocatable")

================================================
FILE: dbs_min/db/Amiga/BPack_SFX.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$3a002a486100....6100....6100....6100....41fa....217c")&&(bDetected=1),result()}meta("sfx","BPack SFX")

================================================
FILE: dbs_min/db/Amiga/Blitz_BASIC.4.sg
================================================
function detect(){return Amiga.compareEP("4eb9........60$$207c........227c........4eb9........2c7c........23ce")&&(bDetected=1),sLang="BASIC",result()}meta("compiler","Blitz BASIC")

================================================
FILE: dbs_min/db/Amiga/ByteKiller_Clone.1.sg
================================================
function detect(){return Amiga.compareEP("61$$41f9........43f9........24609bcdd5c920204bed....72..61")?(sName+=" 8",bDetected=1):Amiga.compareEP("6100................41f9........43f9........2460d5c9202072..61")?(sName+=" 9",bDetected=1):Amiga.compareEP("61$$41f9........43f9........2460d5c9202072..61..4a0267..0c42")?(sName+=" A",bDetected=1):Amiga.compareEP("41fa....d1fa....227c........2460d5c94aa0202013f9................72")&&(sName+=" FLT",bDetected=1),result()}meta("cruncher","ByteKiller Clone")

================================================
FILE: dbs_min/db/Amiga/Chryseis_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$2f0841fa....208f205f4eba....2e7a....58..4e75")&&(sVersion="0.9",bDetected=1),result()}meta("cruncher","Chryseis Cruncher")

================================================
FILE: dbs_min/db/Amiga/Crunch_Master.1.sg
================================================
function detect(){return Amiga.compareEP("428445fa....41fa....49fa....d1d291fc........43f9........0484")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","Crunch Master")

================================================
FILE: dbs_min/db/Amiga/DICE_C.4.sg
================================================
function detect(){return Amiga.compareEP("48e73f3e2c79........244f2f082f00303c")&&(bDetected=1),sLang="C",result()}meta("compiler","DICE C")

================================================
FILE: dbs_min/db/Amiga/DMS_FMS-Masher.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$48e77efe2448240049fa....47fa....303c....421b51c8....47f9")&&(bDetected=1),result()}meta("sfx","DMS/FMS-Masher by ParCon Software")

================================================
FILE: dbs_min/db/Amiga/Deluxe_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("47fa....41fa....247c........227c........0c10....6700")&&(sVersion="1.0-2.0",bDetected=1),result()}meta("cruncher","Deluxe Cruncher")

================================================
FILE: dbs_min/db/Amiga/Free_Pascal.4.sg
================================================
function detect(){return Amiga.compareEP("23cf........23c8........6700$$$$4eb9........2e79........4e75")?(sVersion="0.99",bDetected=1):Amiga.compareEP("4e55....48ed........23f8............95ca2c79........93c94eae....2040")&&(sVersion="1.0.12",bDetected=1),sLang="Pascal",result()}meta("compiler","Free Pascal")

================================================
FILE: dbs_min/db/Amiga/GNU_C.4.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$48e73c2228082600428249f9........240c2c78....43fa....70..4eae....2c40")?(sVersion="3.3.3-3.4.0",sOptions="type 1",bDetected=1):Amiga.compareEP("6000$$$$48e72022244824002c78....43f9........70..4eae....4a8067..23c0........23c0")?(sVersion="3.3.3-3.4.0",sOptions="type 2",bDetected=1):Amiga.compareEP("6000$$$$48e7382228082600428249f9........240c2c78....43fa....70..4eae....2c40")?(sVersion="2.95.3",bDetected=1):Amiga.compareEP("6000$$$$48e72022240824402c78....43f9........70..4eae....4a8067..23c0........2f39")?(sVersion="2.95.2",bDetected=1):Amiga.compareEP("6000$$$$4e55fffc48e73c3a28082a000c85........57c04880340048c2448295ca")?(sVersion="2.90.xx",bDetected=1):Amiga.compareEP("6000$$$$4e55fffc48e73c3a24482a000c85........57c04880340048c24482")?(sVersion="2.7.2.1",sOptions="type 1",bDetected=1):Amiga.compareEP("23c8........23c0........23cf........2c78....23ce........93c94eae....26404aab....6600")?(sVersion="2.7.2.1",sOptions="type 2",bDetected=1):Amiga.compareEP("6000$$$$48e730222408244023cf........2c78....43f9........70..4eae....204023c8")?(sVersion="2.7.0",bDetected=1):Amiga.compareEP("6000$$$$4e55....48e73f322c082b40....0c80........57c01400")?(sOptions="type 1",bDetected=1):Amiga.compareEP("6000$$$$4e55....48e73f322c082e000c87........57c01400")&&(sOptions="type 2",bDetected=1),sLang="C",result()}meta("compiler","GNU C")

================================================
FILE: dbs_min/db/Amiga/HQC_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("2c79........4eae....43fa....4eae....4a806700")&&(sOptions="by High Quality Crackings",sVersion="2.0",bDetected=1),result()}meta("cruncher","HQC Cruncher")

================================================
FILE: dbs_min/db/Amiga/HiSoft_Basic.4.sg
================================================
function detect(){return Amiga.compareEP("267c........6000$$$$7a..383c....263c........3e3c....243c")?(sOptions="1988-94",bDetected=1):Amiga.compareEP("267c........6000$$$$7a..383c....363c....3e3c....343c")&&(bDetected=1,sOptions="1988"),sLang="BASIC",result()}meta("compiler","HiSoft BASIC")

================================================
FILE: dbs_min/db/Amiga/High_Pressure_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("6100$$$$41fa....d1fc........227c........2460d5c92a202020b185")&&(bDetected=1),result()}meta("cruncher","High Pressure Cruncher")

================================================
FILE: dbs_min/db/Amiga/Jan_Heweliusz_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$48e7fff643fa....70..2c79........4eae....2a406700")&&(sVersion="1.1",bDetected=1),result()}meta("cruncher","Jan Heweliusz Cruncher")

================================================
FILE: dbs_min/db/Amiga/Lattice_C.4.sg
================================================
function detect(){return Amiga.compareEP("48e77efe2448240049f9........2c78....2f0248e7....266e....222b....67")?(sVersion="5.10",bDetected=1):Amiga.compareEP("48e77efe2448240049f9........2c78....47f9........72..203c")?(sVersion="5.04",bDetected=1):Amiga.compareEP("2448240049f9........47f9........72..203c........60..26c151c8....2c78")?(sVersion="5.02",bDetected=1):Amiga.compareEP("48e77efe4bef....2448240049f9........2c78....294e....294f....42ac")?(sVersion="4.0",bDetected=1):Amiga.compareEP("48e77efe4bef....2448240049f9........47f9........72..203c")&&(sVersion="1.0",bDetected=1),sLang="C",result()}meta("compiler","Lattice C (SAS C)")

================================================
FILE: dbs_min/db/Amiga/LhPak_SFX.1.sg
================================================
function detect(){return Amiga.compareEP("60$$2c79........246e....4aaa....6600....41ea....4eae....41ea....4eae")&&(sVersion="1.3",bDetected=1),result()}meta("sfx","LhPak SFX")

================================================
FILE: dbs_min/db/Amiga/Master_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe4bfa....41fa....2250d3c9d3c9245158..2b49....d5cad5ca58")?(sVersion="3.0-3.1",bDetected=1):Amiga.compareEP("........4bfa....41fa....2250d3c9d3c958..2b49....2b7c")&&(sVersion="3.0-3.1",sOptions="Address",bDetected=1),result()}meta("cruncher","Master Cruncher")

================================================
FILE: dbs_min/db/Amiga/Maxon_C++.4.sg
================================================
function detect(){return Amiga.compareEP("48e780804eb9........4eb9........70..4eb9")&&(bDetected=1),sLang="C++",result()}meta("compiler","Maxon C++")

================================================
FILE: dbs_min/db/Amiga/RexxMasher_(jrms).1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe60$$4230....284870..43fa....2c78")?bDetected=1:Amiga.compareEP("6000$$$$4a80....53..67..11bc........43fa....228893c9")?(sVersion="1.5-1.6",bDetected=1):Amiga.compareEP("6000$$$$48e7808043fa....d3fc........228f4bfa....dbfc")?(sVersion="1.3",bDetected=1):Amiga.compareEP("6100$$$$48e7808033fc............41fa....6100....203a")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","RexxMasher (jrms) by Joerg Riemer")

================================================
FILE: dbs_min/db/Amiga/Sound-Tracker_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("61$$4bfa....2c78....203a....90ba....0680........2b40....43fa....d3e9")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","Sound-Tracker Cruncher")

================================================
FILE: dbs_min/db/Amiga/Storm_C.4.sg
================================================
function detect(){return Amiga.compareEP("2c78....23ce........23cf........226e....4aa9....6600....41e9....2f084eae")&&(sVersion="3.0",bDetected=1),sLang="C",result()}meta("compiler","Storm C")

================================================
FILE: dbs_min/db/Amiga/TNM_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("61$$48e7fffe2c78....4bfa....41fa....2050d1c8d1c82250")?(sVersion="1.1",sOptions="type 1",bDetected=1):Amiga.compareEP("2c78....61$$48e7fffe4bfa....41fa....2050d1c8d1c82250")&&(sVersion="1.1",sOptions="type 2",bDetected=1),result()}meta("cruncher","TNM Cruncher")

================================================
FILE: dbs_min/db/Amiga/TSK_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe4bf9........204d23ed............d1ed....52..225552..dbfc")&&(bDetected=1),result()}meta("cruncher","TSK Cruncher")

================================================
FILE: dbs_min/db/Amiga/Time_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....d1fc........43f9........2460d5c9202072..6100")?(sVersion="1.7-2.2",bDetected=1):Amiga.compareEP("48e7fffe2c79........43fa....4eae....2c404eae....2200243c")&&(sVersion="4.2",sOptions="by RAZOR and NETWORK's",bDetected=1),result()}meta("cruncher","Time Cruncher")

================================================
FILE: dbs_min/db/Amiga/Titanics_Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$48e7fff643fa....70..2c78....4e")?(sVersion="1.1",bDetected=1):Amiga.compareEP("6000$$$$48e7fff693c92c78....4eae....28404aac....66..41ec....43fa....2288")&&(sVersion="1.2",bDetected=1),result()}meta("cruncher","Titanics Cruncher")

================================================
FILE: dbs_min/db/Amiga/Turtle_Smasher.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....225845fa....24982449d5d8d1d041e8....201072..6100")?(sVersion="1.3-1.41",bDetected=1):Amiga.compareEP("43fa....2459204a323c....429851c9....204a45ea....214a....217c")&&(sVersion="2.00",bDetected=1),result()}meta("cruncher","Turtle Smasher")

================================================
FILE: dbs_min/db/Amiga/Ultimate_Packer.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$598f48e7fffe41fa....20af....41fa....2f48....2c78....203c")&&(sVersion="1.1",bDetected=1),result()}meta("cruncher","Ultimate Packer")

================================================
FILE: dbs_min/db/Amiga/_Amiga.0.sg
================================================
function detect(){return Amiga.isVerbose()&&(sName=Amiga.getOperationSystemName(),sVersion=Amiga.getOperationSystemVersion(),sOptions=Amiga.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","AmigaOS")

================================================
FILE: dbs_min/db/Amiga/_init
================================================
var File=Amiga,X=Amiga

================================================
FILE: dbs_min/db/Amiga/compiler_ABasic.4.sg
================================================
function detect(){return Amiga.compareEP("23cf........23c0........23c8........42b9........2c79........23ce........93c94eae....28404aac")?(sOptions="1985 type 1",bDetected=1):Amiga.compareEP("23cf........23c0........23c8........42b9........42b9........2c79........23ce........93c94eae....28404aac")?(sOptions="1985 type 2",bDetected=1):Amiga.compareEP("48e77ffe43fa....22b9........43fa....228843fa....22802c7a....93c9")&&(bDetected=1),sLang="BASIC",result()}meta("compiler","ABasiC by MetaComCo")

================================================
FILE: dbs_min/db/Amiga/compiler_AmigaBasic.4.sg
================================================
function detect(){return Amiga.compareEP("23c0........23c8........200f48e77efe2a402c79........23ce........23cf")&&(bDetected=1),sLang="BASIC",result()}meta("compiler","AmigaBasic")

================================================
FILE: dbs_min/db/Amiga/compiler_GFA-Basic.4.sg
================================================
function detect(){return Amiga.compareEP("4eb9........203c........4eac....45f9........4eac....4eb9........6100....4eb9")?(sOptions="type 1",bDetected=1):Amiga.compareEP("4eb9........7a..383c....363c....70..74..72..7c..6100....383c....363c....70")?(sOptions="type 2",bDetected=1):Amiga.compareEP("4eb9........203c........6100....4eb9........4e966100....4e964eb9........4e96203c")?(sOptions="type 3",bDetected=1):Amiga.compareEP("4eb9........4eac....4eb9........4e9651ed....4e9645f9........6100....4e96426d")?(sOptions="type 4",bDetected=1):Amiga.compareEP("4eb9........203c........4eac....45f9........70..41ed....6100....70..2b40....4eb9")?(sOptions="type 5",bDetected=1):Amiga.compareEP("4eb9........4eb9........0cad............6f..45f9........70..4eac....4eac....67")?(sOptions="type 6",bDetected=1):Amiga.compareEP("4eb9........50ed....70..4a2d....67..70..52..6600....70..4eac....2b40....202d")?(sOptions="type 7",bDetected=1):Amiga.compareEP("4eb9........2a3c........283c........263c........203c........74..72..7c..4eac")?(sOptions="type 8",bDetected=1):Amiga.compareEP("4eb9........41ed....4eac....41ed....20104eac....2b40....226d....70..4eac")?(sOptions="type 9",bDetected=1):Amiga.compareEP("4eb9........203c........6100....70..223c........6100....2b40....202d....66")?(sOptions="type 10",bDetected=1):Amiga.compareEP("4eb9........45f9........200a2b40....4eac....3f0041ed....2f08206d....4e90")?(sOptions="type 11",bDetected=1):Amiga.compareEP("4eb9........4eb9........4eb9........4eac....426d....203c........72..343c")&&(sOptions="type 12",bDetected=1),sLang="BASIC",result()}meta("compiler","GFA-Basic")

================================================
FILE: dbs_min/db/Amiga/compiler_JForth.4.sg
================================================
function detect(){return Amiga.compareEP("2238....43fa....228143fa....228143fa....228f283a....2f082f0041fa")?(sVersion="3.1",bDetected=1):Amiga.compareEP("49fa....264cd7fc........2c4f9dfc........91cc2d082e006100....2d07")?(sVersion="3.0",bDetected=1):Amiga.compareEP("49fa....264cd7fc........2c4f9dfc........91cc2d082e004eac....2d07")?(sVersion="2.0",bDetected=1):Amiga.compareEP("49fa....264cd7fc........2c4f9dfc........91cc2d082e006100")?(sVersion="2.x-3.x",bDetected=1):Amiga.compareEP("2238....43fa....228143fa....228143fa....228f283a....d8ba....2f082f00")&&(sVersion="1.2",bDetected=1),sLang="Forth",result()}meta("compiler","JForth")

================================================
FILE: dbs_min/db/Amiga/compiler_Multi-Forth.4.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$43fa....22b9........49fa....294c....294c....294f....42672948....2940....41fa")?(sOptions="type 1",bDetected=1):Amiga.compareEP("6000$$$$43fa....22b9........49fa....294f....42672948....2940....41fa....2948")&&(sOptions="type 2",bDetected=1),sLang="Forth",result()}meta("compiler","Multi-Forth")

================================================
FILE: dbs_min/db/Amiga/compiler_Oberon-A.4.sg
================================================
function detect(){return Amiga.compareEP("2c4f4eb9........6100....42b9........4ef9........70..4eb9........70..6000")?(sOptions="type 1",bDetected=1):Amiga.compareEP("48e7f0c0203c........52..e5..260072..48412c78....4eae")?(sOptions="type 2",bDetected=1):Amiga.compareEP("49f9........487a....72..6100$$$$4a2c....6600....50ec")?(sOptions="type 3",bDetected=1):Amiga.compareEP("487a....72..4eb9........4a0166..6100....70..91")&&(sOptions="type 4",bDetected=1),sLang="Oberon",result()}meta("compiler","Oberon-A")

================================================
FILE: dbs_min/db/Amiga/compiler_PureBasic.4.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe203c........6100....2840294e....43fa....70..4eae")?(sOptions="type 1",bDetected=1):Amiga.compareEP("48e7fffe70..6100$$$$223c........2c78....4eee....2c78....4eee")&&(sOptions="type 2",bDetected=1),sLang="BASIC",result()}meta("compiler","PureBasic")

================================================
FILE: dbs_min/db/Amiga/compiler_VBCC.4.sg
================================================
function detect(){return Amiga.compareEP("60..'VBCC '")&&Amiga.compareEP("60$$2400244849f90000....294f....2c78....294e")&&(sVersion=Amiga.getString(Amiga.getEntryPointOffset()+7,3),bDetected=1),sLang="C",result()}meta("compiler","VBCC")

================================================
FILE: dbs_min/db/Amiga/cruncher_AddressHead.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....20080680........43fa....2340....43f9........203c")&&(bDetected=1),result()}meta("cruncher","AddressHead")

================================================
FILE: dbs_min/db/Amiga/cruncher_ByteKiller.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....43f9........201822182a182449d1c0d5c12020b185")?(sVersion="1.2-1.3",bDetected=1):Amiga.compareEP("48e7fffe............41fa....43f9........201822182a182449d1c0d5c12020b185")?(sVersion="2.0",bDetected=1):Amiga.compareEP("48e7fffe41fa....43f9........4df9........20182218d1c020102449d5c17a")?(sVersion="3.0",sOptions="type 1",bDetected=1):Amiga.compareEP("48e7fffe41fa....d1fc........4ed0")?(sVersion="3.0",sOptions="type 2",bDetected=1):Amiga.compareEP("48e7fffe1c3c....4bf9........41fa....2c78")?(sName+=" Pro",sVersion="1.0",bDetected=1):Amiga.compareEP("48e7fffe1c3c....4bf9........13fc............4e714e7150f9........303c")&&(sName+=" Pro",sVersion="1.0",sOptions="Killer",bDetected=1),result()}meta("cruncher","ByteKiller")

================================================
FILE: dbs_min/db/Amiga/cruncher_CopyCat.1.sg
================================================
function detect(){return Amiga.compareEP("487a....48e7fffe61$$2c78....43fa....70..4eae....41fa....43fa....2280")&&(sVersion="1.01",bDetected=1),result()}meta("cruncher","CopyCat")

================================================
FILE: dbs_min/db/Amiga/cruncher_Cranker.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$48e780929efc....303c....426751c8....2a4f2c78....227a")&&(bDetected=1),result()}meta("cruncher","Cranker")

================================================
FILE: dbs_min/db/Amiga/cruncher_Crunch-Mania.1.sg
================================================
function detect(){return Amiga.compareEP("48e7ffff43fa....2c78....4eae....2c40")?(sVersion="1.8t-1.91",sOptions="Library/Huffman",bDetected=1):Amiga.compareEP("48e7ff..3c3c....49fa....4e..4e..4e")?(sVersion="1.8t-1.91",sOptions="Huffman (type 1)",bDetected=1):Amiga.compareEP("49fa....7c..4e944e914e942449")?(sVersion="1.8t-1.91",sOptions="Huffman (type 2)",bDetected=1):Amiga.compareEP("48e7ffff7c..49fa....4e94....4e")?(sVersion="1.8t-1.91",sOptions="Huffman (type 3)",bDetected=1):Amiga.compareEP("7c..49fa....4e944e914e942449")?(sVersion="1.8t-1.91",sOptions="Huffman (type 4)",bDetected=1):Amiga.compareEP("4e7148e7ffff3c3c....49fa....4e944e914e942449")?(sVersion="1.8t-1.91",sOptions="Huffman (type 5)",bDetected=1):Amiga.compareEP("48e7fffe45fa....43f9........221a241a47ea")?(sVersion="1.9t-1.91",sOptions="Address/Huffman",bDetected=1):Amiga.compareEP("48e77fff33fc............33fc............33fc............33fc............45fa....49f9........204c")?(sVersion="1.9t-1.91",sOptions="Address/Pro",bDetected=1):Amiga.compareEP("4ff9........48e7fffe4bf9........1abc....1abc....1abc")?(sVersion="1.9t",sOptions="Address/Pro/Huffman",bDetected=1):Amiga.compareEP("48e77fff45fa....43f9........221a241a47ea....b7c96f")?(sVersion="1.4-1.91",sOptions="Address",bDetected=1):Amiga.compareEP("48e7ffff45fa....221a241a224a287a....d9ccd9cc")?(sVersion="1.4-1.91",sOptions="Simple",bDetected=1):Amiga.compareEP("........3c3c....49fa....4e944e914e94244952")?(sVersion="1.4-1.91",sOptions="type 1",bDetected=1):Amiga.compareEP("48e7fffe41fa....d1fc........4ed04e94244952")?(sVersion="1.4-1.91",sOptions="type 2",bDetected=1):Amiga.compareEP("48e7ffff7c..4e7149fa....4e944e914e94244952")?(sVersion="1.4-1.91",sOptions="type 3",bDetected=1):Amiga.compareEP("4ff9........48e77fff45fa....49f9........204c47fa....7e..28db")?(sVersion="1.4-1.8t",sOptions="Address/Pro",bDetected=1):Amiga.compareEP("48e7ffff43fa....2c78....4eba....2c40200e67..4eae")&&(sOptions="type 1",bDetected=1),result()}meta("cruncher","Crunch-Mania by Thomas Schwarz")

================================================
FILE: dbs_min/db/Amiga/cruncher_Crunch-O-Matic.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe267a....d7cbd7cb588b2c78....224b")?(sVersion="1.0",sOptions="Execute",bDetected=1):Amiga.compareEP("287a....d9ccd9cc5c..20140680........41fa....2080")&&(sVersion="1.0",sOptions="Picture",bDetected=1),result()}meta("cruncher","Crunch-O-Matic")

================================================
FILE: dbs_min/db/Amiga/cruncher_Crunch.1.sg
================================================
function detect(){return Amiga.compareEP("48e7ffff4bfa....4dfa....70..4e962f4c")&&(sVersion="1.3-1.4b",bDetected=1),result()}meta("cruncher","Crunch")

================================================
FILE: dbs_min/db/Amiga/cruncher_CrunchyDat.1.sg
================================================
function detect(){return Amiga.compareEP("60$$487a....48e7fffe487a....203c........72")&&(bDetected=1),result()}meta("cruncher","CrunchyDat")

================================================
FILE: dbs_min/db/Amiga/cruncher_Defjam.1.sg
================================================
function detect(){return Amiga.compareEP("..f9........7e..303c....3d40....3d40")?(sVersion="3.2-3.6 Pro",sOptions="type 1",bDetected=1):Amiga.compareEP("..f9........7e..303c....4e714e713d40....4e714e71")?(sVersion="3.2-3.6 Pro",sOptions="type 2",bDetected=1):Amiga.compareEP("48e7fffe41fa....d1fc........4ed03d40....3d40....3d40")?(sVersion="3.2-3.6 Pro",sOptions="type 3",bDetected=1):Amiga.compareEP("....43fa....4bf9........287a....204c")?(sVersion="3.6",sOptions="type 1",bDetected=1):Amiga.compareEP("....3e3c....43fa....4bf9........287a....204c")?(sVersion="3.6",sOptions="type 2",bDetected=1):Amiga.compareEP("............43fa....4bf9........287a....204c")?(sVersion="3.6",sOptions="type 3",bDetected=1):Amiga.compareEP("21fc............4df9........7e..303c....3d40....3d40....3d40")&&(sOptions="type 1",bDetected=1),result()}meta("cruncher","Defjam")

================================================
FILE: dbs_min/db/Amiga/cruncher_DoubleAction.1.sg
================================================
function detect(){return Amiga.compareEP("47f9........4e714e714e714e714e714e7143f9........4e714e714e714e714e714e71")?(sVersion="1.0",sOptions="type 1",bDetected=1):Amiga.compareEP("47f9........377c........377c........43f9........12bc....12bc....12bc")&&(sVersion="1.0",sOptions="type 2",bDetected=1),result()}meta("cruncher","DoubleAction")

================================================
FILE: dbs_min/db/Amiga/cruncher_DragPack.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe41f9........43f9........20182218")?(sVersion="1.0",bDetected=1):Amiga.compareEP("487a....48e7fffe49fa....28fc........41fa....24482248")&&(sVersion="2.52",bDetected=1),result()}meta("cruncher","DragPack")

================================================
FILE: dbs_min/db/Amiga/cruncher_FileShield.1.sg
================================================
function detect(){return Amiga.compareEP("4879000000004e754e7500000000")&&(sVersion="1.x",bDetected=1),result()}meta("cruncher","FileShield")

================================================
FILE: dbs_min/db/Amiga/cruncher_FlashSpeed.1.sg
================================================
function detect(){return Amiga.compareEP("48e7c0e041fa....43f9........264970..72..12d00c18....66")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","FlashSpeed")

================================================
FILE: dbs_min/db/Amiga/cruncher_GnuPacker.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe4bfa....4dfa....206d....2248d3ed....30deb1c9")&&(sVersion="1.1-1.2",sOptions="One Segment",bDetected=1),result()}meta("cruncher","GnuPacker")

================================================
FILE: dbs_min/db/Amiga/cruncher_House.1.sg
================================================
function detect(){return Amiga.compareEP("................................13fc............41fa....43f9........47fa....49f9")&&(sVersion="1.4",bDetected=1),result()}meta("cruncher","House (RSI Packer)")

================================================
FILE: dbs_min/db/Amiga/cruncher_ISC.1.sg
================================================
function detect(){return Amiga.compareEP("47fa....d7d3247c........60$$33fc............33fc............41f9")?(sVersion="1.5",sOptions="Pass 3. Bitstream Pass (Huffman-Algorythm) (type 1)",bDetected=1):Amiga.compareEP("47fa....d7d3247c........4cdf000e200f4ff9........48e7")?(sVersion="1.5",sOptions="Pass 3. Bitstream Pass (Huffman-Algorythm) (type 2)",bDetected=1):Amiga.compareEP("247c........4cdf000e200f4ff9........48e7f0004879")?(sVersion="1.5",sOptions="Pass 1. Normal Compressor type 1",bDetected=1):Amiga.compareEP("247c........60$$41fa....227c........287c........47fa")?(sVersion="1.5",sOptions="Pass 1. Normal Compressor type 2",bDetected=1):Amiga.compareEP("247c........60$$41fa....287c........47fa....323c....28db")&&(sVersion="1.5",sOptions="Pass 2. Comparing Compressor",bDetected=1),result()}meta("cruncher","ISC")

================================================
FILE: dbs_min/db/Amiga/cruncher_Imploder.1.sg
================================================
function detect(){return Amiga.compareEP("48e7ffff49fa....3c3c....4e944e913c3c")?(sVersion="1.0",sOptions="Protected",bDetected=1):Amiga.compareEP("48e7ffff49fa....3c3c....61..4e913c3c")?(sVersion="1.0-3.1",bDetected=1):Amiga.compareEP("6000$$$$48e7fff693c92c78....4eae....28404aac....66..41ec....2c78....4eae....4eae....43fa")?(sVersion="1.0-3.1",sOptions="Overlayed Protected type 1",bDetected=1):Amiga.compareEP("6000$$$$48e7ffff49fa....3c3c....4e944e913c3c....61..51..20112c78....4eae....53")?(sVersion="1.0-3.1",sOptions="Overlayed Protected type 2",bDetected=1):Amiga.compareEP("48e7ffff70..43fa....2c78....4eae....4a8067..2c40")?(sVersion="1.0-3.1",sOptions="Library",bDetected=1):Amiga.compareEP("48e7ffff49fa....3c3c....61..4e917c..61..2f49")?(sVersion="4.0",bDetected=1):Amiga.compareEP("48e7ffff70..60..70..43fa....4eae....4a8067")&&(sVersion="4.0",sOptions="Library",bDetected=1),result()}meta("cruncher","Imploder")

================================================
FILE: dbs_min/db/Amiga/cruncher_MOPacker.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe4eb9........4cdf7fff4ef9........000003ec")&&(sOptions="temp detect",bDetected=1),result()}meta("cruncher","MOPacker")

================================================
FILE: dbs_min/db/Amiga/cruncher_MaxPacker.1.sg
================================================
function detect(){return Amiga.compareEP("283c........267a....41fa....d1fa....d7fa....49fa....341c121c101c")&&(sVersion="1.2",bDetected=1),result()}meta("cruncher","MaxPacker")

================================================
FILE: dbs_min/db/Amiga/cruncher_MegaCruncher.1.sg
================================================
function detect(){return Amiga.compareEP("47fa....200b222b....41fa....d1c1226b")?(sVersion="1.0-1.2",sOptions="Address",bDetected=1):Amiga.compareEP("48e7fffe2c78....4bfa....4cdd00034eae....4a8067")&&(sVersion="1.2",bDetected=1),result()}meta("cruncher","MegaCruncher")

================================================
FILE: dbs_min/db/Amiga/cruncher_PackIt.1.sg
================================================
function detect(){return Amiga.compareEP("48e7....2c78....2e0e286e....4bfa....42954aac....66..41ec")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","PackIt")

================================================
FILE: dbs_min/db/Amiga/cruncher_Pak.1.sg
================================================
function detect(){return Amiga.compareEP("60$$48e77ffe43fa....2c78....4eae....2c4045fa....202a")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","Pak")

================================================
FILE: dbs_min/db/Amiga/cruncher_PowerPacker.1.sg
================================================
function detect(){return Amiga.compareEP("487a....48e7fffe49fa....2054d1c8d1c8")?(sVersion="3.0",sOptions="type 1",bDetected=1):Amiga.compareEP("48e7fffe41fa....2050d1c8d1c84a982248")?(sVersion="2.1-3",bDetected=1):Amiga.compareEP("6000$$$$2f0e4dfa....48d6ffff4dee....2d5f")?(sVersion="3.0",sOptions="type 2",bDetected=1):Amiga.compareEP("4e714e71487a....48e7fffe49fa....2054d1c8d1c858")?(sVersion="3.0",sOptions="type 3",bDetected=1):Amiga.compareEP("487a....48e7fffe2c78....43fa....45fa....2489")?(sVersion="4.0",sOptions="Encrypted (type 1)",bDetected=1):Amiga.compareEP("487a....48e7fffe2c78....203c........4eae....6000")?(sVersion="4.0",sOptions="Encrypted (type 2)",bDetected=1):Amiga.compareEP("487a....48e7fffe2c78....60$$4e714e71283c........4844")?(sVersion="4.0",sOptions="Encrypted (type 3)",bDetected=1):Amiga.compareEP("487a....48e7fffe70..43fa....2c78....4e......4a80")?(sVersion="4.0",sOptions="Library",bDetected=1):Amiga.compareEP("487a....48e7fffe2c78....283c........4e714e71")?(sVersion="3.0",sOptions="Encrypted",bDetected=1):Amiga.compareEP("48e7fffe41fa....d1fc........4ed0d1c858")?(sVersion="4.0",sOptions="type 1",bDetected=1):Amiga.compareEP("6100$$$$2a572b7a........59..2c78....4eae....2f17487a....2f57")&&(sVersion="4.0",sOptions="type 2",bDetected=1),result()}meta("cruncher","PowerPacker")

================================================
FILE: dbs_min/db/Amiga/cruncher_ProPack.1.sg
================================================
function detect(){return Amiga.compareEP("487a....48e7fffe487a....203c........72..2c78....4eae")?(sOptions="Mode 1",bDetected=1):Amiga.compareEP("487a....48e7fffe487a....2a574a956700....2a55dbcddbcd")&&(sOptions="Key Mode 2",bDetected=1),result()}meta("cruncher","ProPack (RNC)")

================================================
FILE: dbs_min/db/Amiga/cruncher_ReXXMaSHeR.1.sg
================================================
function detect(){return Amiga.compareEP("6100$$$$48e7808041fa....6100....203a....41f9")&&(sOptions="by DCS",bDetected=1),result()}meta("cruncher","ReXXMaSHeR")

================================================
FILE: dbs_min/db/Amiga/cruncher_Relokit.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe41fa....70..3028....23c0........23e8............2028")&&(sVersion="1.0",bDetected=1),result()}meta("cruncher","Relokit")

================================================
FILE: dbs_min/db/Amiga/cruncher_S-Exec.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe207a....d1c8d1c858..2f0854..4e55....20080680")&&(sVersion="1.1",sOptions="by Chas Wyndham",bDetected=1),result()}meta("cruncher","S-Exec")

================================================
FILE: dbs_min/db/Amiga/cruncher_Shrinkler.1.sg
================================================
function detect(){return Amiga.compareEP("284b241c48e78088e58a2a4c2842241c66")?(sOptions="type 1",bDetected=1):Amiga.compareEP("49fafffe2f0c2424264c263c........e58a")?(sOptions="type 2",bDetected=1):Amiga.compareEP("49fa....2f0c2424264ce58a2a4c28422414")?(sOptions="type 3",bDetected=1):Amiga.compareEP("2413e5..26422c78....48e7....263c........43fa....4eae")?(sOptions="type 4",bDetected=1):Amiga.compareEP("243a....e5..26422c78....48e7....43fa....4eae")&&(sOptions="type 5",bDetected=1),result()}meta("cruncher","Shrinkler")

================================================
FILE: dbs_min/db/Amiga/cruncher_Spike.1.sg
================================================
function detect(){return Amiga.compareEP("60$$48e7fffe267a....d7cbd7cb588b2c78")&&(sVersion="1.1-1.6",bDetected=1),result()}meta("cruncher","Spike")

================================================
FILE: dbs_min/db/Amiga/cruncher_StoneCracker.1.sg
================================================
function detect(){return Amiga.compareEP("4df9........47f9........41fa....3d58....3d58")?(sVersion="3.10-11b",bDetected=1):Amiga.compareEP("41f9........30bc....59..30bc....41f9........47f9")?(sVersion="4.01",sOptions="type 1",bDetected=1):Amiga.compareEP("48e7ffff4bfa....49fa....70..4e944e91")?(sVersion="4.01",sOptions="type 2",bDetected=1):Amiga.compareEP("487a....48e7fffe49fa....2254d3c9d3c9")?(sVersion="4.02a",bDetected=1):Amiga.compareEP("45f9........43fa....280ad5d9d3d93c113e217a")?(sVersion="4.02a",sOptions="Address",bDetected=1):Amiga.compareEP("4e7145f9........43fa....2a4ad5d9d3d1")?(sVersion="4.10.2-3",sOptions="Address",bDetected=1):Amiga.compareEP("2c78....4bfa....4eee....33fc............33fc")?(sVersion="4.10.2-3",sOptions="Address/Pro",bDetected=1):Amiga.compareEP("487a....48e7fffe49fa....2654d7cbd7cb")?(sVersion="4.10.2-3",sOptions="type 1",bDetected=1):Amiga.compareEP("4e714e71487a....48e7fffe49fa....2654d7cbd7cb")?(sVersion="4.10.2-3",sOptions="type 2",bDetected=1):Amiga.compareEP("48e7fffe4df9........7e..7c..7a..1e3a....1a3a....1c3a....41fa")?(sVersion="2.70-2.71",bDetected=1):Amiga.compareEP("4df9........303c....3d40....3d40....3d40....3d40....4bf9")?(sVersion="2.70-2.71",sOptions="Kill",bDetected=1):Amiga.compareEP("4df9........4bfa....49f9........47fa....3d5b....18bc")?(sVersion="2.92",bDetected=1):Amiga.compareEP("............4bfa....49f9........45fa....3d5a....18bc....3d5a")?(sVersion="2.99c-d",bDetected=1):Amiga.compareEP("4df9........4bfa....49f9........45fa....3d5a....18bc....3c9a18bc")?(sVersion="3.00",bDetected=1):Amiga.compareEP("48e7fffe41fa....d1fc........4ed03d58....3d58....16bc....45fa")&&(sVersion="3.10",bDetected=1),result()}meta("cruncher","StoneCracker")

================================================
FILE: dbs_min/db/Amiga/cruncher_Super-Cruncher.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe2c79........4eae....41fa....2268....42a8....d3c9d3c959")&&(sVersion="2.7",bDetected=1),result()}meta("cruncher","Super-Cruncher")

================================================
FILE: dbs_min/db/Amiga/cruncher_SyncroPacker.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....225820182648d1c01e201c2045fa....14a0")?(sVersion="4.6",bDetected=1):Amiga.compareEP("4df9........3cbc....3d7c........13fc............41fa....21c8....46fc")&&(sVersion="4.6 Pro",bDetected=1),result()}meta("cruncher","SyncroPacker")

================================================
FILE: dbs_min/db/Amiga/cruncher_TUC.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fff62a7c........7e..1e1d48471e1d")?(sVersion="1.16d",sOptions="type 1",bDetected=1):Amiga.compareEP("60......2a7c........7e..1e1d48471e1d263c")&&(sVersion="1.16d",sOptions="type 2",bDetected=1),result()}meta("cruncher","TUC (The Ultimate Cruncher)")

================================================
FILE: dbs_min/db/Amiga/cruncher_TetraCrunch.1.sg
================================================
function detect(){return Amiga.compareEP("41fa....d1fc........227c........2460d5c92020e2..66..61..65..72..76..e2")&&(sVersion="1.02",bDetected=1),result()}meta("cruncher","TetraCrunch")

================================================
FILE: dbs_min/db/Amiga/cruncher_TetraPack.1.sg
================================================
function detect(){return Amiga.compareEP("7e..41fa................d1fc....................2460d5c92020e2..66")?(sVersion="2.1",bDetected=1):Amiga.compareEP("4df9........7e..6000....3d40....3d40....3d40....13fc............41fa")?(sVersion="2.1",sOptions="Pro",bDetected=1):Amiga.compareEP("................................204cd1fc........b3cc6e..2049d1fa")?(sVersion="2.2",bDetected=1):Amiga.compareEP("4df9........7e..303c....4e714e713d40....3d40....13fc............41fa")&&(sVersion="2.2",sOptions="Pro",bDetected=1),result()}meta("cruncher","TetraPack")

================================================
FILE: dbs_min/db/Amiga/cruncher_TryIt.1.sg
================================================
function detect(){return Amiga.compareEP("43fa....4e714e714e714e71264a4e714e714e714e714e714e714e714e714e714bfa")?(sVersion="1.01",sOptions="type 1",bDetected=1):Amiga.compareEP("43fa....2e29....45fa....47f9........284b303c....16da51c8")?(sVersion="1.01",sOptions="type 2",bDetected=1):Amiga.compareEP("43fa....2e29....45fa....264a4e714e71284b")?(sVersion="1.01",sOptions="type 3",bDetected=1):Amiga.compareEP("43fa....4e714e714e714e714e710005....4e714e714e714e714e714e714e714bfa")&&(sVersion="1.01",sOptions="type 4",bDetected=1),result()}meta("cruncher","TryIt")

================================================
FILE: dbs_min/db/Amiga/cruncher_TurboSqueezer.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe2c79........207a....d1c8d1c822582848d3c9d3c958")?(sVersion="6.0-8.0",bDetected=1):Amiga.compareEP("6000$$$$48e7fffe2c79........207a....d1c8d1c822582848d3c9d3c958")&&(bDetected=1),result()}meta("cruncher","TurboSqueezer")

================================================
FILE: dbs_min/db/Amiga/cruncher_xpkmaster.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$2c78....43fa....4eae....2c4041fa....4eae....2c78")&&(bDetected=1),result()}meta("cruncher","xpkmaster")

================================================
FILE: dbs_min/db/Amiga/joiner_ETA.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe41fa....59..2010e5..58..43fa....2340....2c78....43fa")?(sVersion="0.91-0.99",bDetected=1):Amiga.compareEP("48e7fffe41fa....59..2010e5..58..43fa....2340....203a....53..43fa")&&(sVersion="1.00",bDetected=1),result()}meta("joiner","ETA Text Linker")

================================================
FILE: dbs_min/db/Amiga/joiner_EXP.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffe4e7143fa....2c78....4eae....2c404eae....220067..41fa")&&(sVersion="1.1",sOptions="1992 by Dr. Gassu //Elysion",bDetected=1),result()}meta("joiner","EXP ASCII Linker")

================================================
FILE: dbs_min/db/Amiga/joiner_Glue.1.sg
================================================
function detect(){return Amiga.compareEP("48e7fffc2c78....93c94eae....2a407a..4aad....66..41ed")&&(sVersion="2.3",sOptions="1994 by Bigmama Of Focus Design",bDetected=1),result()}meta("joiner","Glue (ANSI Linker)")

================================================
FILE: dbs_min/db/Amiga/library_library.1.sg
================================================
function detect(){return Amiga.compareEP("70..4e754afc")&&(bDetected=1),result()}meta("library","library")

================================================
FILE: dbs_min/db/Amiga/module_DeliTracker.1.sg
================================================
function detect(){return Amiga.compareEP("70FF4E75'DELIRIUM'")?bDetected=1:Amiga.compareEP("........'DELIRIUM'")&&(bDetected=1,sOptions="Startup code"),result()}meta("module","DeliTracker player")

================================================
FILE: dbs_min/db/Amiga/other_other.1.sg
================================================
function detect(){return Amiga.compareEP("70..4e75'WHDLOADS'")?(sName="WHDLOAD object",bDetected=1):Amiga.compareEP("70..4e75'AUTOSCPP'")&&(sName="SCPP object",bDetected=1),result()}meta("other","other")

================================================
FILE: dbs_min/db/Amiga/self-displayer_DPS.1.sg
================================================
function detect(){return Amiga.compareEP("43fa....70..2c78....4eae....26406700....43fa....70")&&(sVersion="1.0",sOptions="by Foster Hall",bDetected=1),result()}meta("self-displayer","DPS (IFF images self-displayer)")

================================================
FILE: dbs_min/db/Amiga/self-displayer_Iff2ex.1.sg
================================================
function detect(){return Amiga.compareEP("43f9........203c........2c79........4eae....4a806700....23c0........43f9........203c")&&(sVersion="1.0",sOptions="by Pieter van Leuven",bDetected=1),result()}meta("self-displayer","Iff2ex")

================================================
FILE: dbs_min/db/Amiga/self-displayer_S-Anim.1.sg
================================================
function detect(){return Amiga.compareEP("4e55....48e7808042ad....93c92c78....4eae....28404aac")&&(sVersion="1.1-1.3",sOptions="by Chas Wyndham",bDetected=1),result()}meta("self-displayer","S-Anim")

================================================
FILE: dbs_min/db/Amiga/self-displayer_S-Pic.1.sg
================================================
function detect(){return Amiga.compareEP("4e55....48e7808042ad....93c92c79........4eae....28404aac")&&(sVersion="1.2",sOptions="by Chas Wyndham",bDetected=1),result()}meta("self-displayer","S-Pic")

================================================
FILE: dbs_min/db/Amiga/sfx_DIMP.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$327c....48e780c02c78....42a7203c........72..48414eae")&&(sOptions="DMS disks packer",bDetected=1),result()}meta("sfx","DIMP")

================================================
FILE: dbs_min/db/Amiga/sfx_DMSSFX.1.sg
================================================
function detect(){return Amiga.compareEP("49f9........2c78....43f9........70..4eae....23c0........2c404eae")&&(bDetected=1),result()}meta("sfx","DMS-SFX by SDS Software")

================================================
FILE: dbs_min/db/Amiga/sfx_LHASFX.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$2a484230....49fa....2854d9ccd9cc294f....2c78....43fa")&&(bDetected=1),result()}meta("sfx","LHASFX")

================================================
FILE: dbs_min/db/Amiga/sfx_LHSFX.1.sg
================================================
function detect(){return Amiga.compareEP("43f9........23c9........43f9........2c79........4eae....23c0........6700....2c404eae")&&(sOptions="1991",bDetected=1),result()}meta("sfx","LHSFX by Mike Kennedy")

================================================
FILE: dbs_min/db/Amiga/tool_EFFECT-loader.1.sg
================================================
function detect(){return Amiga.compareEP("60$$487a....4879........48e7fffe48e780804bfa....43fa....2c78....4eae")&&(sVersion="1.5-1.6",bDetected=1),result()}meta("tool","EFFECT-loader")

================================================
FILE: dbs_min/db/Amiga/tool_VideoTracker.1.sg
================================================
function detect(){return Amiga.compareEP("6000$$$$93c92c78....4eae....284070..4aac....66..41ec....2c78")&&(bDetected=1),result()}meta("tool","VideoTracker")

================================================
FILE: dbs_min/db/Archive/_Archive.0.sg
================================================
function detect(){return Archive.isVerbose()&&(sName=Archive.getFileFormatName(),sVersion=Archive.getFileFormatVersion(),sOptions=Archive.getFileFormatOptions(),sName)&&(bDetected=1),result()}meta("format","Archive")

================================================
FILE: dbs_min/db/Archive/_init
================================================
var File=Archive,X=Archive

================================================
FILE: dbs_min/db/AtariST/_AtariST.0.sg
================================================
function detect(){return AtariST.isVerbose()&&(sName=AtariST.getOperationSystemName(),sVersion=AtariST.getOperationSystemVersion(),sOptions=AtariST.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","Atari ST")

================================================
FILE: dbs_min/db/AtariST/_init
================================================
var File=AtariST,X=AtariST

================================================
FILE: dbs_min/db/Binary/Amiga_loadable.1.sg
================================================
function detect(){return Binary.compare("000003F300")?(bDetected=1,sName="Amiga loadable file"):Binary.compare("000003E700")&&(bDetected=1,sName="Amiga object/library file"),result()}meta("format","")

================================================
FILE: dbs_min/db/Binary/Certificate_cert.WinAuth.1.sg
================================================
function detect(){return Binary.compare("........00020200")&&(sVersion="2.0",sOptions="PKCS #7",bDetected=1),result()}meta("Certificate","WinAuth")

================================================
FILE: dbs_min/db/Binary/RIFF.1.sg
================================================
function detect(){return Binary.compare("'RIFF'........'CDR'")?(sName="CorelDraw graphics (.CDR)",bDetected=1):Binary.compare("'RIFF'........'AVI '")?(sName="AVI",bDetected=1):Binary.compare("'RIFF'........'WEBPVP8'")&&(sName="WebP",bDetected=1),result()}meta("format")

================================================
FILE: dbs_min/db/Binary/ROM_1.sg
================================================
function detect(){var d=0,f=0,u=0,e=0,p=0,a=0,A=0,S=-1,r=-1,i=-1,t=-1,c="",n="",l="",U="",o="",C=[]
if(X.c("'A2R1'FF0A0D0A ................'DATA'")||X.c("'A2R'..FF0A0D0A 'INFO'")&&isWithin(X.U8(3),50,51)){for(sName="Apple II Applesauce disk archival image (.A2R)",sVersion="v"+X.SA(3,1),d=(v1=X.c("'1'",3))?(bDetected=1,16):8,meta=o="";d<X.Sz();){var k=X.SA(d,4),h=X.U32(d+4,v1?_BE:_LE)
switch(d+=8,k){case"INFO":if(v1)meta=X.SC(d,h,"UTF8").replace(/\x0A/g,",").replace(/\x09/g,":")
else{switch(iV=X.U8(d),bDetected=1,X.U8(d+33)){case 1:dim='5¼" SS 40trk 0.25 step'
break
case 2:dim='3½" DS 80trk Apple CLV'
break
case 3:dim='5¼" DS 40trk'
break
case 4:dim='5¼" DS 80trk'
break
case 5:dim='3½" DS 80trk'
break
case 6:dim='8" DS'
break
case 7:dim='3" DS 80trk'
break
case 8:dim='3" DS 40trk'
break
default:dim="?"}sOption("disk:"+dim),1==X.U8(d+34)&&sOption("write-protected"),2<=iV&&((u=X.U8(d+42))&&sOption(u,"min.RAM:","k"),u="",(r=X.U16(d+40))||(u="?"),1&r&&(u=u.append("][")),2&r&&(u=u.append("][ Plus")),4&r&&(u=u.append("//e")),8&r&&(u=u.append("//c")),16&r&&(u=u.append("//e Enhanced")),32&r&&(u=u.append("IIgs")),64&r&&(u=u.append("//c Plus")),128&r&&(u=u.append("///")),256&r&&(u=u.append("/// Plus")),sOption(u,"for Apple "))}break
case"DATA":case"STRM":case"RWCP":case"SLVD":break
case"META":meta=X.SC(d,h,"UTF8").replace(/\x0A/g,",").replace(/\x09/g,":")}d+=h}""!=(o=d>X.Sz()?o.addIfNone("!short"):o)&&(sVersion=sVersion.appendS("/malformed"+o,"/")),X.isVerbose()&&(sOptionT(addEllipsis(meta),'info:"','"'),sOption(outSz(d),"sz:"))}else if(X.c("'AT8X'")&&isWithin(t0p=X.U32(28),36,64)&&X.c("0000",t0p+4)&&isWithin(t0sz=X.U32(t0p),(t0hdsz=X.U32(t0p+20))+X.U32(t0p+t0hdsz),4096)&&isWithin(t0sec=X.U16(t0p+10),1,40)&&X.U32(t0p+t0hdsz)==8+8*t0sec){if(sName="Atari VAPI/ATX disk image (.ATX)",sVersion="v"+X.U16(4),bDetected=1,X.isVerbose()){for(a=0,d=t0p,sec=0;a<40&&d<X.Sz();a++,d+=X.U32(d))sec+=X.U16(d+10)
sOption("trk:"+a+" sec.total:"+sec+" sz:"+outSz(d))}}else if(X.c("'<BALLY format=1>'")&&X.c("'</BALLY>'",(S=X.U16(17,_LE))-8))sName="Bally Arcade/Astrocade BASIC tape (.BIN)",bDetected=1,X.isVerbose()&&sOption(outSz(S),"sz:")
else if(X.c("0E0000800E..FFFE........FFFFFFFF020000000200..FFFFFFFFFE")&&0<=[31,47].indexOf(X.U8(5))&&0<=[31,127].indexOf(X.U8(353)))sName="Casio Loopy (big-endian) cartridge (.BIN)",bDetected=1
else if(X.c("4C....4C....01'CBM::::::::'")&&X.c("FF",13118)&&X.c("FF",14720))sName="Commodore Plus/4 cartridge (.BIN)",bDetected=1
else if(X.c("000003",8)&&X.c("'DMC '",256)&&X.c("'                                GM 00000000-00'",352))sName="AtGames/中娛/愛勝 Firecore digital media cartridge (.BIN)",bDetected=1
else if(X.c("F50400")&&X.c("04",2048)&&X.c("8383",2056)&&4096==F.Sz())sName="Entex Adventure Vision cartridge (.BIN)",bDetected=1
else if(!X.c("55..40..40....00")&&!X.c("5512521252B0")||X.U8(1)!=X.U8(3)||8192!=X.Sz()&&16384!=X.Sz())if(X.c("BBA56EB3E9C5A7A4CCB3D7B2CFA8CEA5CCAAA3A46FB1EFB9BBA56EB3E9C569B6E6A6F4A5F3A6CFA456A675A47BB5'r(vereese gnniee)rB'A1CFA4D5B2B6C442A1CFA473BDB6C4CEA9F3A7EFA7BBA56EB3E9C5ECAD6CA97BB5A1A65DB370AD57A4EFB96EB3E9C5BAAAEAC277A950BBD1B8A3B0EAC277A9'rTdamera kybU inet diMrceoeltcorinscC ro.pa dnF nuethcE tnreatniemtnC ro.pA llr gith seresvrde .iLecsn esip reimttde'002E",8192)||X.c("1E00E32AE401E501 E601E7011B48E801 E901EAC401300EEB 01B426ECEED26401 EF26F00108604E30 F201F301F4010128"))sName="Funtech Super Acan cartridge (.BIN)",bDetected=1
else if(!(X.c("AA04FFFF68FF")||X.c("AA4E840D196900")||X.c("AA544E85706A90")||X.c("AA54E9A7640202")||X.c("AAC0BA69004DCC")||X.c("AA694169146914"))||!isWithin(X.Sz(),8192,32768)||4095&X.Sz())if(X.c("'ZPJ'")&&X.c("0003....0003",24)&&"allnum"==charStat(X.SA(3,3))&&charStat(X.SA(6,13),!0).indexOf(!1)){if(sName="Konami Picno image (.BIN)",bDetected=1,sOption(charStat(X.SA(3,3))),X.isVerbose()){for(u=X.SA(3,13);u.length&&"+"==u[u.length-1];)u=u.slice(0,u.length-1)
sOption(u)}}else if(X.c("'Copyright LeapFrog     '00..01010000000080",256))sName="Leapfrog Leapster Learning Game System image (.BIN)",bDetected=1,sVersion=X.fSig(1,4096,"'Lil ducked.  The jet zipped past her head.  Dust flew, Lil sneezed, and Leap turned red.  Then Lil got up, about to yell.  Leap gasped, \"Look, Lil!  Your tooth!  It fell!\"'")?"Approved Content":"unapproved content"
else if(7&X.Sz()||!(0<=(u=X.fSig(0,4096,"1FA6DEBACC137D74")))||7&u){if(X.c("00000000'Root-CPCA00000108-CP00000110'00000000000000000000000000000000000000000000000000000000000000000000000000",10324))sName="iQue (N64 for China) CMD (.CMD)",bDetected=1
else if(X.c("803712400000000F80....00000014")&&X.c("AD0000",4112)&&X.c("FF",4126))sName="iQue (N64 for China) Z64 image (.Z64)",bDetected=1
else if(X.c("'C64 CARTRIDGE   '")&&64<=(d=X.U32(16,_BE))&&X.c("'CHIP'",d)){for(bDetected=1,sName="Commodore 64 cartridge (.CRT)",sVersion="v"+X.U8(20)+"."+X.U8(21).padStart(2,"0"),o="";d<X.Sz()&&X.c("'CHIP'",d);){var h=X.U32(d+4,_BE),D=X.U16(14,_BE)
if(h-16<D&&(o=o.addIfNone("!badchipsz")),d+h>X.Sz()){if(d+16+D<=X.Sz()){d+=D+16,o=o.addIfNone("!badchunk")
continue}!X.isVerbose()&&d+h>X.Sz()&&(o=o.addIfNone("!short"))}d+=h}if(""!=o&&(sVersion=sVersion.appendS("malformed"+o,"/")),X.isVerbose()){switch(sOption(X.SC(32,32,"Shift_JIS")),X.U16(22,_BE)){case 0:U="normal cartridge"
break
case 1:U="Action Replay"
break
case 2:U="KCS Power Cartridge"
break
case 3:U="Final Cartridge III"
break
case 4:U="Simons Basic"
break
case 5:U="Ocean type 1"
break
case 6:U="Expert Cartridge"
break
case 7:U="Fun Play, Power Play"
break
case 8:U="Super Games"
break
case 9:U="Atomic Power"
break
case 10:U="Epyx Fastload"
break
case 11:U="Westermann Learning"
break
case 12:U="Rex Utility"
break
case 13:U="Final Cartridge I"
break
case 14:U="Magic Formel"
break
case 15:U="C64 Game System/System 3"
break
case 16:U="WarpSpeed"
break
case 17:U="Dinamic"
break
case 18:U="Zaxxon, Super Zaxxon (SEGA)"
break
case 19:U="Magic Desk/Domark/HES Australia"
break
case 20:U="Super Snapshot 5"
break
case 21:U="Comal-80"
break
case 22:U="Structured Basic"
break
case 23:U="Ross"
break
case 24:U="Dela EP64"
break
case 25:U="Dela EP7x8"
break
case 26:U="Dela EP256"
break
case 27:U="Rex EP256"
break
case 28:U="Mikro Assembler"
break
case 29:U="reserved"
break
case 30:U="Action Replay 4"
break
case 31:U="StarDOS"
break
case 32:U="EasyFlash"
break
default:U="?"}sOption("hw.type: "+U+" /EXROM:"+(X.U8(24)?"inactive":"active")+" /GAME:"+(X.U8(25)?"inactive":"active")+" sz:"+outSz(d))}}}else sName="Microsoft MSX tape image (.CAS)",bDetected=1
else sName="Hartung Game Master cartridge (.BIN)",bDetected=1
else sName="Epoch ゲームポケコン/Game Pocket Computer cartridge (.BIN)",bDetected=1
if(!bDetected&&(function(){if(!(X.Sz()<204800)&&X.c("0100",82)&&isWithin(n=X.U8(0),1,63)){c=X.SC(1,n,"CP1252")
var e=charStat(c,!0)
if(!(e.indexOf("allxsc")<0)&&n==X.U8(1144)&&c==X.SC(1145,X.U8(1144),"CP1252")){var e=X.U32(64,_BE),a=X.U32(68,_BE)
if(isWithin(e,204800,2097152)&&(!a||12*e/512==a)&&(a||!X.U32(76,_BE))){switch(S=84+e+X.U32(68,_BE),discszt=Util.divu64(e,1024)+"k",X.U8(80)){case 0:discszt+=" GCR CLV ssdd"
break
case 1:discszt+=" GCR CLV dsdd"
break
case 2:discszt+=" MFM CAV dsdd"
break
case 3:discszt+=" MFM CAV dshd"
break
default:discszt+=" unk.type"}return 1}}}})()&&(sName="Apple DiskCopy 4.2 disk image (.DC42)",sVersion=discszt,bDetected=1,X.isVerbose())&&(sOption(c),sOption(outSz(S),"sz:")),!bDetected)if(X.c("'ACT Apricot disk image'1A04")&&isAllZeroes(24,88)){sName="Jonathan Marsters's ACT/Apricot PC ApriDisk image (.DSK)",bDetected=1
var g=sec=0,E=!1,O=by=""
for(d=128;d<X.Sz();){var k=X.U32(d),z=X.U16(d+6),h=X.U32(d+8)
switch(k){case 3810328576:break
case 3810328577:(u=X.U8(d+13))>sec&&(sec=u),(u=X.U16(d+14)+1)>g&&(g=u)
break
case 3810328578:O=X.SA(d+z,h)
break
case 3810328579:by=X.SA(d+z,h)
break
default:E=!0}if(E)break
if(d+=z+h,3810328578==k)break}X.isVerbose()?(sOption(O),sOption(by,"by: "),sOption("cyl:"+g+" sec:"+sec+" sz:"+outSz(d))):d>X.Sz()&&(sVersion="malformed!short")}else(X.c("'EXTENDED CPC DSK File'0D0A'Disk-Info'0D0A")||X.c("'MV - CPCEMU Disk-File'0D0A'Disk-Info'0D0A")||X.c("'MV - CPC'"))&&isWithin(a=X.U8(48),20,84)&&isWithin(sd=X.U8(49),1,2)&&X.c("'Track-Info'0D0A000000",256)&&(sName="Amstrad CPC disk image (.DSK)",bDetected=1,X.c("'E'")?(trksz=0,sVersion="extended"):trksz=X.U16(50)+1,X.isVerbose())&&(sOption(X.SA(34,14)),sOption("trk:"+a+(trksz?" trksz:"+trksz:"")+" sides:"+sd))
if(!bDetected&&(function(){if(X.c("'EALIB'")){p=X.U16(5)
d=7
for(var e=0;e<p&&d<X.Sz();e++){d+=13
var a=X.U8(d++),s=X.U32(d)
if(d+=4,4<a||!isWithin(s,d,X.Sz()))return}return 1}})()&&(sName="Electronic Arts Library resource pack",bDetected=1,X.isVerbose())&&sOption(p,"files:"),bDetected||X.c("'FCSX'")&&X.U32(4)>X.U32(8)&&X.U32(8)<=X.Sz()&&(sName="FCSX zlib format (.FCS)",bDetected=1,X.isVerbose())&&(sOptions="Zlib @10h, unp.sz:"+X.U32(4)+" sz:"+outSz(X.U32(8))),(function(){var e,a,s,r,i,t,c
return!X.c("00000000")||(e=X.U32(4),a=X.U32(8),s=X.U32(12),r=X.U32(16),i=X.U32(20),t=X.U32(24),c=X.U32(28),[16,48,144].indexOf(e)<0)||r*i*t*c!=s||(S=a+s)>X.Sz()||a<32?void 0:!(16==e&&!isWithin(s,524288,745472)||48==e&&!isWithin(s,1441792,3145728)||144==e&&!isWithin(s,1179648,1310720))&&(info=(info="disc:"+(16==e?"640/720k":48==e?"1.44M":144==e?"1.2M":"?")+" ("+(s/1024).toFixed(1)+"k)").append("hd:"+t+" cyl:"+c+" sec:"+i+" sz:"+outSz(S)),1)})()&&(sName="EPSON's PC-98 disk image (.FDI)",bDetected=1,X.isVerbose())&&sOption(info),bDetected||(X.c("EB0A9090'IPL1'0000001EA08405B48ECD1BA8",4096)&&X.c("E9D102'                                                                                NEC 'CADFB0BFC5D9BADDCBDFADB0C08CC592E8836683428358834E8B4E93AE8381836A8385815B8376838D834F8389838020CADEB0BCDEAEDD' 2.'....' Copyright (C) NEC Corporation 1985,'",5120)?(sName="NEC PS-98 hard disk image (.HDI)",bDetected=1):((X.c("EB1C904E")||X.c("EB2790B1")||X.c("EB279028")||X.c("EB3C9027")||X.c("EB3C904E"))&&X.c("000401010002C000D004FE0200080002000000",11)||X.c("EB..90")&&1261568==X.Sz())&&(sName="NEC PC-98 disk image (.HDM)",bDetected=1)),(function(){if(!(X.Sz()<273)){for(var e=0,a=0;a<15;++a){if(a<9&&X.U8(a)<32)return
e+=X.U8(a)}if((e=105+257*e&65535)==X.U16(15))if(S=X.U16(11),addr=X.U16(9),alsz=X.U16(13),!(!isWithin(alsz,256,65280)||!isWithin(S,256,65280)||addr<16384||65536<addr+S))if(S+(S%256?256-S%256:0)==alsz)return X.U8(8),1}})()&&(sName="ZX Spectrum HOBETA wrapper (.HOB)",bDetected=1,sOptions=decAnsi(0,8,CPSpeccy).trim()+"."+X.SA(8,1),X.isVerbose()?sOption("data @11h["+Hex(S)+"] RAM$"+addr.toString(16)+" sz:"+outSz(17+alsz)):17+alsz>X.Sz()&&(sVersion="malformed!short")),!bDetected)if(X.c("'HXCPICFE'")&&isWithin(i=X.U8(10),1,2)&&isWithin(baud=1e3*X.U16(12),15e4,3e6)&&(t=X.U8(17))<=1){if(sName="HxC PIC/HFE disk image (.HFE)",sVersion="rev."+X.U8(8),bDetected=1,X.isVerbose()){var B=["ISO IBM MFM","Amiga MFM","ISO IBM FM","emulated FM","unk."],L=["IBM PC DD","IBM PC HD","Atari ST DD","Atari ST HD","Amiga DD","Amiga HD","Amstrad CPC DD","generic Shugart DD","IBM PC ED","MSX2 DD","Commodore 64 DD","emulated Shugart"],a=X.U8(9),v=X.U8(16),u=X.U8(11),S=512,W=0
for(d=512,trkenc=3<u?B[4]:3&B[u],v=v<=11?L[v]:"unk.",f=0;f<a&&d<X.Sz();f++,d+=4)W+=u=X.U16(d+2)
u=511&u?512+(4294966784&u):u,S=512*X.U16(d-4)+u,sOption("trk:"+a+(2==i?" DS":" SS")),sOption(trkenc,"trkenc:"),sOption(v,"floppy mode:"),sOption(t?"write-protected":""),sOption(baud+" baud = "+(baud/8192).toFixed(1)+"k/s"),sOption("datasz:"+W+" sz:"+outSz(S))}}else if(X.c("'CHKH'........00000000")&&X.c("'CHKH'........01000000",X.U32(4))&&12<X.Sz())sName="HxC Stream Loader disk track (.hxcstream)",bDetected=1
else if(X.c("'CAPS'0000000C1CD573BA'INFO'00000060")&&X.c("'IMGE'",108)){switch(sName="SPS's KryoFlux Interchangeable Preservation Format disk image (.IPF)",bDetected=1,X.U32(72,_BE)){case 0:sVersion="no-platform"
break
case 1:sVersion="Amiga"
break
case 2:sVersion="Atari ST"
break
case 3:sVersion="PC"
break
case 4:sVersion="Amstrad CPC"
break
case 5:sVersion="ZX Spectrum"
break
case 6:sVersion="SAM Coupe"
break
case 7:sVersion="Acorn Archimedes"
break
case 8:sVersion="C64"
break
case 9:sVersion="Atari 8-bit"
break
default:sVersion="unk."}if(sVersion+=1==X.U32(24,_BE)?" floppy":" unk.media",X.isVerbose()){for(d=108,density="",densities=[];d<X.Sz()&&(k=X.SA(d,4),/[A-Z]{4}/.test(k)&&X.c("0000",d+4));){if(h=X.U32(d+4,_BE),"IMGE"===k){switch(X.U32(d+20)){case 3:density="Copylock Amiga"
break
case 4:density="Copylock Amiga new"
break
case 5:density="Copylock ST"
break
case 6:density="Speedlock Amiga"
break
case 7:density="Speedlock Amiga old"
break
case 8:density="Adam Brierley Amiga"
break
case 9:density="Adam Brierley & density key Amiga"}densities.indexOf(density)<0&&densities.push(density)}else"DATA"===k&&(d+=X.U32(d+12,_BE))
d+=h}sOption(X.U32(40,_BE),"rev."),sOption("tracks:"+X.U32(48,_BE)+"-"+X.U32(52,_BE)+" sides:"+(1+X.U32(60,_BE))),sOption(1==X.U32(28,_BE)?"CAPS":2==X.U32(28,_BE)?"SPS":"unk.","encoder:"," rev."+X.U32(32,_BE)),sOption(Hex(X.U32(36,_BE),8),"cat.ID:"),sOption(densities.join(" + "),"copy protection:"),sOption("sz:"+outSz(d))}}else!(X.c("'JFDI'")&&isWithin(tt=X.U32(24),304,X.Sz())&&isWithin(st=X.U32(28),tt,X.Sz())&&isWithin(dt=X.U32(32),st,X.Sz())&&X.c("FFFFFFFF",st-4)&&X.c("FFFFFFFF",dt-8))||(dtt=X.U32(36))&&!isWithin(dtt,dt,X.Sz())||(dst=X.U32(40))&&!isWithin(dst,dt,X.Sz())||(ddt=X.U32(44))&&!isWithin(ddt,dt,X.Sz())||(sName="Acorn Archimedes ADFFS JFD disk image (.JFD)",bDetected=1,nV=Util.divu64(nv=X.U32(4,_LE),100),nv%=100,sVersion="v"+nV+"."+nv,iv=X.U8(20),X.isVerbose()&&(sOption("tt:"+Hex(tt)+" st:"+Hex(st)+" dt:"+Hex(dt)),sOption(addEllipsis(decAnsi(48,256,CPRISCOS).trim(),192,160)),1<(ds=X.U16(14))&&(sOptions+=" ("+X.U16(12)+"/"+ds+")"),sOption("trk:"+Util.divu64(st-tt,4)+" sec:"+Util.divu64(dt-st-4*tt,8)),204<=X.U32(4))&&(1&(r=X.U32(304))&&sOption("write-protected"),4&r&&sOption("Protect CMOS req."),8&r&&sOption("Protect Modules req."),32&r&&sOption("Shift+Break to load"),sOption("for:"),256&r&&sOption("ARM3"),512&r&&sOption("ARM250"),1024&r&&sOption("ARM610/710"),2048&r&&sOption("ARM7500"),4096&r&&sOption("StrongArm"),8192&r&&sOption("ARMv5/v6/v7"),65536&r&&sOption("RiscOS 2"),r&1<<17&&sOption("RiscOS 3.1"),r&1<<18&&sOption("RiscOS 3.5"),r&1<<19&&sOption("RiscOS 3.7"),r&1<<20&&sOption("RiscOS 3.8/4.x"),r&1<<21&&sOption("RiscOS 5.x"),r&1<<22&&sOption("RiscOS 6.x"),X.U8(308)&&sOption("fps:"+X.U8(308)/2),X.U32(312)&&sOption("Obey file sz:"+X.U32(312)),sOption("datasz:"+X.U32(8)),ddt)&&sOption("delta data"))
if((u=X.Sz()<4096||!X.c("'SEGA '",256)||(sus=0,["  ","RA"].includes(X.SA(432,2))||sus++,"-"!=(sn=X.SA(384,14))[11]&&sus++,["GM ","AI ","OS ","BR "].includes(sn.slice(0,3))||sus++,!(ar=[[X.U32(416,_BE),X.U32(420,_BE)+1],[X.U32(424,_BE),X.U32(428,_BE)+1]])&ar[0][1]&&sus++,!1&ar[1][1]&&sus++,isWithin(ar[0][1],4096,2147483647)||sus++,isWithin(ar[1][0],16711680,2147483647)||sus++,3<sus)?[!1]:X.c("'MEGA DRIVE'",256)||X.c("'GENESIS'",256)?[!0,"Sega Mega Drive/Genesis (.MD)"]:X.c("'32X '",261)?[!0,"Sega Mega Drive + 32X (.32X)"]:X.c("'EVERDRIVE '",261)?[!0,"Sega Mega Drive (Everdrive ext.)"]:X.c("'SSF '",261)?[!0,"Sega Mega Drive (Mega Everdrive ext.)"]:X.c("'MEGAWIFI'",261)?[!0,"Sega Mega Drive (Mega Wifi ext.)"]:X.c("'PICO '",261)?[!0,"Sega PICO"]:X.c("'TERA68k",261)||X.c("'TERA286'",261)?[!0,"Sega Tera Drive (.TD)"]:[!1])[0]){switch(sName=u[1],bDetected=1,sVersion=(u=sn.slice(12,14))==[0]||"00"==u?"initial":"v"+u[0]+"."+u[1],sn.slice(0,2)){case"GM":sVersion+="/Game"
break
case"AI":sVersion+="/Aid"
break
case"OS":sVersion+="/Boot ROM (TMSS)"
break
case"BR":sVersion+="/Boot ROM (Sega CD)"}if(X.isVerbose()){for(c=X.SC(288,48,"SJIS").trim(),u=X.SC(288,48,"SJIS").trim(),c!=u?sOption(c+" / "+u):sOption(c),sOption("ROM@"+Hex(ar[0][0])),"RA"===X.SA(432,2)&&sOption("extra RAM"),ft="",f=400;f<416&&" "!=(l=X.SA(f++,1));)"J"===l?"6"==X.SA(f++,1)?ft+="#6-button pad":ft+="#3-button pad":"0"===l?ft+="#Master System pad":"A"===l?ft+="#Analog stick":"4"===l?ft+="#Multitap":"A"===l&&(ft+="#Lightgun")
sOptionT("devices:"+ft),sOption("sz:"+outSz(ar[0][1]))}}function _(){if(X.c("01 ?? 00 00")){blk=0
var r,e=m=X.U8(1)
if(e){X.isDeepScan()||(m=Math.min(e,5))
for(var a=0;a<m&&543*a<X.Sz();a++)if(!(function(e){var a,s
if(r=543*e,!(2&X.U8(r+15))||X.U16(r+17)){for(s=a=0;a<14;a++)s=(s+X.U8(r++))%255
if(s==X.U8(r++)){for(s=a=0;a<14;a++)s=(s+X.U8(r++))%255
if(s==X.U8(r++)){if(!X.U16(r-13))return r+=514,1
for(s=a=0;a<512;a++)s=(s+X.U8(r++))%255
return s==X.U8(r)?(blk++,1):void 0}}}})(a))return
return blk<2?void 0:(name=decAnsi(4,10,CPSpeccy),S=X.isDeepScan()?r:543*e,1)}}}function G(){if(!([204800,409600,819200].indexOf(X.Sz())<0)){subdir=0,erased=0
var e=A=0,a=409600<X.Sz(),r=(Math.min(X.Sz(),819200),X.U8(255))
if(!(35<r)){var i=[0,"ZX Spectrum"],t=[0,"SAM Coupé"],c=[0,"DISCiPLE/+D"],n=[0,"HDD"],o=X.c("'BOOT'",256),k=(o&&(t[0]+=20),[])
for(f=0;f<195;f++)k.push(0)
C=[],label="",sus=0,extIs("mgt")||sus++,819200!=X.Sz()&&sus++
var b=["erased","ZXBASIC","ZXnum.array","ZXstr.array","ZXcode","ZX48ksnap","ZXMD","ZXscr","special","ZX128ksnap","Opentype","ZXexec","UNI-DOSdir","UNI-DOScreate","14?","15?","SAMBASIC","SAMnum.array","SAMstr.array","SAMcode","SAMscr","MasterDOSdir","SAMDriverapp","SAMDriverbootstrap","EDOSNOMEN","EDOSsys","EDOSovl","27?","HDOSHdos","HDOSHdir","HDOSHdisk","HDOSHfree/Htmp"]
for(19!=(63&X.U8(0))&&0<=charStat(X.readBytes(210,10),1).indexOf("allasc")&&(t[0]+=10,label=X.SA(210,10).trim()),e=_sec=_side=_trk=0,end=!1;_trk<4+r&&e<X.Sz();){for(s=0;s<2;s++)if(o&&1==A)A++
else if(X.U8(e+1)){end&&sus++,A++
var d=X.readBytes(e+2,9)
if(charStat(d,1).indexOf("allasc")<0)return
d=63&X.U8(e)
if(31<d)return
if(d?isWithin(d,1,11)?i[0]++:isWithin(d,12,13)?c[0]++:isWithin(d,16,23)?t[0]++:n[0]++:erased++,!X.U16(e+11,_BE))return
var p=X.U8(e+13),S=p>>7
if(p&=127,!isWithin(p,0,79))return
var l=X.U8(e+14)
if(!isWithin(l,1,10))return
for(a=a||S,A||(0==d&&sus++,128&X.U8(e)&&sus++),f=0;f<195;f++){if(u=X.U8(e+15+f),k[f]&u)return
k[f]|=u}firstNotOf(e+220,11,[32,255])<0&&(t[0]+=10),firstNotOf(e+232,4,[255])<0&&(t[0]+=4),255==X.U8(e+250)&&t[0]++,255==X.U8(e+251)&&t[0]++,C.push(X.SA(e+1,10).trim()+":"+b[d]),21==d&&(subdir++,u=512*(l+10*(S+2*p))+1,X.U8(u))&&C.push("/"+X.SA(u,10)+"..."),s||(e+=256)}else end=!0
9<++_sec&&(_sec=0,1==++_side)&&(_side=0,_trk++),e=512*(_sec+10*(_side+2*_trk))}return 5<sus||!A?void 0:(sv=function(e){if(!arguments.length)return""
for(var a=e,s=1;s<arguments.length;s++)arguments[s][0]>a[0]&&(a=arguments[s])
return a}(i,t,c,n)[1]+"/"+(a?"DS":"SS"),1)}}}if(!bDetected&&_()&&(sName="ZX Microdrive cartridge image (.MDR)",bDetected=1,X.isVerbose())&&(sOption(name),sOption((X.isDeepScan()?"blks:"+blk+" ":"")+"sz:"+outSz(S))),!bDetected&&G()&&(sName="Miles Gordon Technology floppy image (.MGT,.SAD)",sVersion=sv,bDetected=1,X.isVerbose())&&(sOption((subdir?"≈":"")+(A-erased-subdir)+(erased?"+"+erased+" erased":"")+(subdir?"+"+subdir+"subdirs":""),"files:"),A&&sOption("("+addEllipsis(C.join("; "))+")"),sus)&&sOption("possibly malformed (level "+sus+")"),!bDetected)if(X.c("'NES'1A")&&15<X.Sz()){if(sName="NES ROM image (.nes)",bDetected=1,malformed=!1,szprg=16384*X.U8(4),szchr=8192*X.U8(5),flg9=X.U8(9),flg6=X.U8(6),fstorage=0<(2&flg6),trainer=128*(4&flg6),f4scrvram=0<(8&flg6),flg7=X.U8(7),mapper=((240&flg6)>>4)+(240&flg7),fvsunisystem=0<(1&flg7),fplaychoice10=0<(2&flg7),fv20_=8==(12&flg7),fv20=!1,szprgmsb=16384*((15&flg9)<<8),szchrmsb=8192*((240&flg9)<<4),ex=region=tv="",S=16+trainer+szprg+szprgmsb+szchr+szchrmsb,fv20=fv20_?S<X.Sz():fv20){switch(szprg+=szprgmsb,szchr+=szchrmsb,flg8=X.U8(8),flg11=X.U8(11),flg12=X.U8(12),flg13=X.U8(13),flg14=X.U8(14),flg15=X.U8(15),sVersion="NES v2.0",mapper+=(15&flg8)<<8,submapper=(240&flg8)>>4,2&flg7){case 0:sVersion+=" #NES/Famicom/Dendy"
break
case 1:switch(sVersion+=" #Nintendo Vs. System (",15&flg13){case 0:sVersion+="RP2C03B)"
break
case 1:sVersion+="RP2C03G)"
break
case 2:sVersion+="RP2C04-0001)"
break
case 3:sVersion+="RP2C04-0002)"
break
case 4:sVersion+="RP2C04-0003)"
break
case 5:sVersion+="RP2C04-0004)"
break
case 6:sVersion+="RC2C03B)"
break
case 7:sVersion+="RC2C03C)"
break
case 8:sVersion+="RC2C05-01)"
break
case 9:sVersion+="RC2C05-02)"
break
case 10:sVersion+="RC2C05-03)"
break
case 11:sVersion+="RC2C05-04)"
break
case 12:sVersion+="RC2C05-05)"
break
default:sVersion+="unk.PPU)"}break
case 2:sVersion+=" #Nintendo Playchoice 10"
break
default:switch(15&flg13){case 0:sVersion+=" #NES/Famicom/Dendy"
break
case 1:sVersion+=" #Nintendo Vs. System"
break
case 2:sVersion+=" #Nintendo Playchoice 10"
break
case 3:sVersion+=" #Famiclone+DecimalMode"
break
case 4:sVersion+=" #NES/Famicom+EPSM/plug-through"
break
case 5:sVersion+=" #V.R. VT01 red/cyan"
break
case 6:sVersion+=" #V.R. Technology VT02"
break
case 7:sVersion+=" #V.R. Technology VT03"
break
case 8:sVersion+=" #V.R. Technology VT09"
break
case 9:sVersion+=" #V.R. Technology VT32"
break
case 10:sVersion+=" #V.R. Technology VT369"
break
case 11:sVersion+=" #UMC UM6578"
break
case 12:sVersion+=" #Famicom Network System"
break
default:sVersion+=" #(reserved)"}}switch(3&flg12){case 0:region="NA/JP/SK/TW: NTSC NES"
break
case 1:region="WE/AU: Licenced PAL NES"
break
case 2:region="Multiple"
break
default:region="EU/RU/ZH/IN/AF: Dendy"}switch(63&flg15){case 0:break
case 1:ex="Std. Sontrollers"
break
case 2:ex="NES Four Score/Satellite + 2 Std. Controllers"
break
case 3:ex="Famicom 4P Adapter"
break
case 4:ex="Vs. System (1P via $4016)"
break
case 5:ex="Vs. System (1P via $4017)"
break
case 6:ex="(obsolete MAME behaviour)"
break
case 7:ex="Vs. Zapper"
break
case 8:ex="Zapper ($4017)"
break
case 9:ex="2 Zappers"
break
case 10:ex="Bandai Hyper Shot Lightgun"
break
case 11:ex="Power Pad Side A"
break
case 12:ex="Power Pad Side B"
break
case 13:ex="Family Trainer Side A"
break
case 14:ex="Family Trainer Side B"
break
case 15:ex="Arkanoid Vaus Controller (NES)"
break
case 16:ex="Arkanoid Vaus Controller (Famicom)"
break
case 17:ex="2 Vaus Controllers + Famicom Data Recorder"
break
case 18:ex="Konami Hyper Shot Controller"
break
case 19:ex="Coconuts Pachinko Controller"
break
case 20:ex="Exciting Boxing Punching Bag (Blowup Doll)"
break
case 21:ex="Jissen Mahjong Controller"
break
case 22:ex="Party Tap"
break
case 23:ex="Oeka Kids Tablet"
break
case 24:ex="Sunsoft Barcode Battler"
break
case 25:ex="Miracle Piano Keyboard"
break
case 26:ex="Pokkun Moguraa (Whack-a-Mole Mat & Mallet)"
break
case 27:ex="Top Rider (Inflatable Bicycle)"
break
case 28:ex="Double-Fisted"
break
case 29:ex="Famicom 3D System"
break
case 30:ex="Doremikko Keyboard"
break
case 31:ex="R.O.B. Gyro Set"
break
case 32:ex='Famicom Data Recorder ("silent" keyboard)'
break
case 33:ex="ASCII Turbo File"
break
case 34:ex="IGS Storage Battle Box"
break
case 35:ex="Family BASIC Keyboard + Famicom Data Recorder"
break
case 36:ex="Dongda PEC-586 Keyboard"
break
case 37:ex="Bit Corp. Bit-79 Keyboard"
break
case 38:ex="Subor Keyboard"
break
case 39:ex="Subor Keyboard + Mouse (3x8-bit)"
break
case 40:ex="Subor Keyboard + Mouse (24-bit)"
break
case 41:ex="SNES Mouse ($4017.d0)"
break
case 42:ex="Multicart"
break
case 43:ex="2 SNES Controllers"
break
case 44:ex="RacerMate Bicycle"
break
case 45:ex="U-Force"
break
case 46:ex="R.O.B. Stack-Up"
break
case 47:ex="City Patrolman Lightgun"
break
case 48:ex="Sharp C1 Cassette Interface"
break
case 49:ex="Std. Controller w/swapped ←→/↑↓/BA"
break
case 50:ex="Excalibor Sudoku Pad"
break
case 51:ex="ABL Pinball"
break
case 52:ex="Golden Nugget Casino extra buttons"
break
default:ex="(unknown)"}S=16+trainer+szprg+szprgmsb+szchr+szchrmsb}else{switch(sVersion=12&flg7||!X.c("0000 0000",12)?4==(12&flg7)?"archaic iNES":"iNES v0.7 or archaic":"iNES",szprgram=(szprgram=8192*X.U8(8))||8192,3&(flg10=X.U8(10))){case 0:tv="NTSC"
break
case 2:tv="PAL"
break
default:tv="NTSC/PAL"}fbusconflicts=X.c("0000 0000",X.Sz()-4)?(fprgram=0<(16&flg10),0<(32&flg10)):fprgram=!1,region="n/a"}X.isVerbose()&&(sOption(tv,"tv: "),sOption(region,"region: "),sOption(mapper,"mapper: "),sOption(ex,"expansion: "),fplaychoice10&&sOption("PlayChoice-10"),trainer&&sOption("trainer"),fstorage&&sOption("battery-backed RAM"),sOption(outSz(S),"sz:"))}else if(X.c("'MNIB-1541-RAW'..000002..04..06..08..0A"))bDetected=1,sVersion="v"+X.U8(13),sName="Markus Brenner's MNIB/Peter Rittwage's C64PP NIBTools disk image (.NIB)"
else if(X.c("01'CD001'01''",339968))p=X.c("'NERO'",X.Sz()-8)?1:X.c("'NER5'",X.Sz()-12)?2:0,sName=(p?"Nero AG's ":"")+"optical disc image (.NRG)",p&&(sVersion="Nero AG/v"+p),X.isVerbose()&&(sOptions=X.SA(340008,32).trim()),bDetected=1
else if(X.c("0D04..00'host_date='")&&X.fSig(0,128,"'KryoFlux DiskSystem'"))sName="SPS's KryoFlux DiskSystem disk sector (.RAW)",bDetected=1
else if(X.c("'CAPS'0000000C1CD573BA'DATA'")&&X.c("'PACK'",X.U32(16,_BE)+20)&&(sName="SPS's KryoFlux CT Raw disk image (.RAW)",bDetected=1,X.isVerbose())){for(d=12,a=unpsz=0;d<X.Sz()&&(k=X.SA(d,4),/[A-Z]{4}/.test(k)&&X.c("0000",d+4));){switch(h=X.U32(d+4,_BE),k){case"DATA":h+=X.U32(d+12,_BE)
break
case"PACK":unpsz+=h,h=X.U32(d+12,_BE)+24
break
case"TRCK":a++}d+=h}sOption("trk:"+a+" sz:"+outSz(d))}if(!bDetected&&(function(){if(X.c("'SINCLAIR'")&&isWithin(p=X.U8(8),1,128)&&!(X.Sz()<9+14*p)){for(C=[],f=l=0,S=(d=9)+14*p,sec=0,o="";f<p&&S<X.Sz();f++,d+=14){var e=decAnsi(d,8,CPSpeccy)
if(e.length<8)return
"
"===(e=e.trim())[0]&&(e[0]="*")
var a=decAnsi(d+8,1,CPSpeccy)
if(!a.length)return
C.push(e+".$"+a),u=X.U8(d+13),sec+=u,S+=u<<8}if(!(S>X.Sz()||655364<S)){if(X.Sz()>=S+4){for(f=0;f<S;l+=X.U8(f++));S+=4,l!=X.U32(f)&&(o="!badcrc")}else o="!nocrc"
return C=C.join(";"),1}}})()&&(sName="ZX Spectrum floppy disk image (.SCL)",bDetected=1,o.length&&(sVersion="malformed"+o),X.isVerbose())&&(sOption(addEllipsis(C,160)),sOption("sec:"+sec+" sz:"+outSz(S))),!bDetected&&(function(){if(!(!X.c("'SCP'")||165<X.U8(6)||165<X.U8(7)||2<X.U8(10))){var e,a=mtdsz=0,s=X.U8(5),r=X.U8(9)
for(S=688,r?r>>=3:r=2,e=16;e<688;e+=4){var i=X.U32(e)
if(i){if(!X.c("'TRK'",i))return
var t=0
for(q=i+4;t<s;t++){var c=X.U32(q+4)*r,n=X.U32(q+8)+i
a<n&&(a=n,mtdsz=c),q+=12}}}if(a){if(a>X.Sz())return
S=a+mtdsz}return 1}})()){sName="SuperCard Pro disk image (.SCP)",bDetected=1
var M,y,I=(I=X.U8(3))?"v"+(I>>4)+" rev."+(15&I):"v.?",P=X.U8(4),B=(X.U8(5),X.U8(6)),L=X.U8(7),i=(r=X.U8(8),1&r?4&r?"360":"300":"300/360"),v=8&r?"normalised":"preservation",t=16&r?"read/write":"read-only",H=32&r,K=X.U8(10)?1==X.U8(10)?"bottom":"top":"double"
if(H&&(I="app v"+(X.U8(S+40)>>4)+"."+(15&X.U8(S+40))+"h/w v"+(X.U8(S+41)>>4)+"."+(15&X.U8(S+41)),X.c("'FPCS'",S+44)||(I+="/malformed!noendtag"),S+=48),sVersion=I,X.isVerbose()){switch(15&P){case 0:y="CBM"
break
case 1:y="Amiga"
break
case 2:y="Apple ]["
break
case 3:y="Atari ST"
break
case 4:y="Atari 800"
break
case 5:y="Mac 800"
break
case 6:y="360k/720k"
break
case 7:y="1.44M"
break
default:y="unk."}switch(P>>4){case 0:M="Commodore"
break
case 1:M="Atari"
break
case 2:M="Apple"
break
case 3:M="PC"
break
case 4:M="Tandy"
break
case 5:M="Texas Inst."
break
case 6:M="Roland"
break
case 8:M="(other)"
break
default:M="unk."}sOption("type "+y+" by "+M),sOption("trk:"+B+"-"+L+" side:"+K),sOption(t),sOption(v,"quality:"),sOption(i,""," rpm"),sOption(outSz(S),"sz:")}}if(!bDetected)if(X.c("EC..A50000")&&X.c("EC00",256)&&X.c("55AA55AA55AA55AAFFFFFFFFFFFFFFFF0000",272)&&X.c("FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF",1024)&&X.c("4199015564F0FFFF 201B0C824118EA61 F00107F60301EE1B 0C834118EA617001 07760301EE15140500",17968))sName="GamePark GP32 SmartMedia card (.SMC)",bDetected=1
else if(X.c("'RSY'000300")){if(sName="Jorge 'Ijor' Cwik's Pasti disk image (.STX)",bDetected=1,sVersion="v3"+(2==X.U8(11)?" new":0==X.U8(11)?" old":""),X.isVerbose()){for(sOption(X.U8(10),"trk.total:"),f=0,d=16;f<X.U8(10)&&d<X.Sz();f++,d+=X.U32(d));sOption(outSz(d),"sz:")}}else if(X.c("'ZXST'")&&0<=charStat(X.readBytes(16+X.U32(12),4),1).indexOf("allxsc")&&0<X.fSig(8,512,"'Z80R'")&&0<X.fSig(32,512,"'SPCR'")&&isWithin(V=X.U8(4),1,1)&&(I=X.U8(5))<=5&&(U=X.U8(6))<=16&&(r=X.U8(7))<=1){switch(sName="Spectaculator zx-state file (.SZX)",sVersion="v"+V+"."+I,bDetected=1,U){case 0:U="ZX Spectrum 16k"
break
case 1:U="ZX Spectrum 48k/+"
break
case 2:U="ZX Spectrum 128k"
break
case 3:U="ZX Spectrum +2"
break
case 4:U="ZX Spectrum +2A/B"
break
case 5:U="ZX Spectrum +3"
break
case 6:U="ZX Spectrum +3e"
break
case 7:U="Pentagon 128"
break
case 8:U="Timex Sinclair TC-2048"
break
case 9:U="Timex Sinclair TC-2068"
break
case 10:U="Scorpion ZS-256"
break
case 11:U="ZX Spectrum SE"
break
case 12:U="Timex Sinclair TS-2068"
break
case 13:U="Pentagon 512"
break
case 14:U="Pentagon 1024"
break
case 15:U="ZX Spectrum 48k (NTSC)"
break
case 16:U="ZX Spectrum 128Ke"
break
default:U="(unk.)"}if(sOption(U,"h/w:"),X.isVerbose()){for(d=8;d<X.Sz();){k=X.SA(d,4)
if(!(h=X.U32(d+4))||h+d>X.Sz()||charStat(X.readBytes(d,4),1).indexOf("allxsc")<0||k.length<2||k.toUpperCase()!=k)break
d+=8,"CRTR"===k&&sOption(X.SA(d,32),"in:"),d+=h}S=d,sOption(outSz(S),"sz:")}}else if(/^C64S?\s*tape.*file/.test(X.SA(0,32))){if(sName="C64 cassette tape (.T64)",bDetected=1,sVersion="v"+X.U8(32)+"."+X.U8(33).padStart(2,"0"),X.isVerbose()){for(var A=[],j=X.U16(34,_LE),J=X.U16(36,_LE),f=0;f<j;f++)f<J&&(A[f]=X.SA(80+32*f,32).trim())
for(sOption(J," entries:"),f=0;f<A.length;f++)sOptions=sOptions.appendS(A[f]," ")}}else if(X.c("'XM7 TAPE IMAGE 0'"))sName="Fujitsu FM-7 emulator XM7 tape (.T77)",bDetected=1
else if(X.c("'C64-TAPE-RAW'")&&X.U8(12)<2){bDetected=1,sName="C64 cassette tape (.TAP)",sVersion="v"+X.U8(12)
S=X.U32(16)+20
X.isVerbose()?sOptions="sz:"+outSz(S):S>X.Sz()&&(sVersion+="/malformed!short")}else if(X.c("'ZXTape!'1A")){sVersion="v"+X.U8(8)+"."+X.U8(9).padStart(2,"0"),bDetected=1
var Y=end=!1,e=0,o="",c="",x="",$="",Q="",ee="",ae="",se="",re="",ie="",O="",U="",te="",C=[],ce=["B","N","S","C"]
for(d=10;!end&&d<X.Sz();)switch(X.U8(d++)){case 16:X.U8(d+4)||(charStat(u=X.readBytes(d+6,10),1).indexOf("allasc")<0&&(o=o.addIfNone("!nonASCIIfn")),u=decEncoding(u,CPSpeccy).trim(),P=X.U8(d+5),!u&&P<3&&(o=o.addIfNone("!emptyfn")),C.push(u+"."+ce[P])),d+=4+X.U16(d+2)
break
case 17:d+=18+X.U24(d+15)
break
case 18:d+=4
break
case 19:d+=1+2*X.U8(d)
break
case 20:8<!X.U8(d+4)?(end=!0,o=o.addIfNone("!badnbitsin14")):d+=10+X.U24(d+7)
break
case 21:isWithin(X.U8(d+4),1,8)?d+=8+X.U24(d+5):(end=!0,o=o.addIfNone("!badnbitsin15"))
break
case 24:isWithin(X.U8(d+9),1,2)?d+=4+X.U32(d):(end=!0,o=o.addIfNone("!badcomptypein18"))
break
case 25:case 42:d+=4+X.U32(d)
break
case 32:case 35:case 36:d+=2
break
case 33:d+=1+X.U8(d)
break
case 34:case 37:case 39:break
case 38:d+=2+2*X.U16(d)
break
case 40:var N=d+2+X.U16(d),p=X.U8(d+2)
for(d+=3,f=0;f<p;f++){n=X.U8(d+2)
d+=3,te=te.appendS(decAnsi(d,n,CPSpeccy,1,Chars0to1FSpeccy),"/"),d+=n}d=N
break
case 43:1<X.U8(d+4)?(end=!0,o=o.addIfNone("!badsignalin2B")):d+=4+X.U32(d)
break
case 48:O=O.append("-"+decAnsi(d+1,X.U8(d),CPSpeccy,1,Chars0to1FSpeccy).trim()+"-"),d+=1+X.U8(d)
break
case 49:d+=2+X.U8(d+1)
break
case 50:N=d+2+X.U16(d),p=X.U8(d+2)
for(d+=3,f=0;f<p;f++){P=X.U8(d++)
switch(u=X.SC(d+1,Math.min(X.U8(d),N-d),"CP1252").trim(),P){case 0:c=c.append(u)
break
case 1:x=x.append(u)
break
case 2:$=$.append(u)
break
case 3:Q=Q.append(u)
break
case 4:ee=ee.append(u)
break
case 5:ae=ae.append(u)
break
case 6:se=se.append(u)
break
case 7:re=re.append(u)
break
case 8:ie=ie.append(u)
break
case 255:O=O.appendS(u," / ")
break
default:O=O.append(u,"\ninfo#"+P.toString(16)+":")}d+=1+X.U8(d)}d=N
break
case 51:var ne=X.U8(d++)
for(f=0;f<ne;f++){var T=X.U8(d++),R=X.U8(d++)
switch(T){case 0:switch(T="[PC]",R){case 0:R="ZX Spectrum 16k"
break
case 1:R="ZX Spectrum 48k/+"
break
case 2:R="ZX Spectrum 48k ISSUE 1"
break
case 3:R="ZX Spectrum 128k +(Sinclair)"
break
case 4:R="ZX Spectrum 128k +2 (grey case)"
break
case 5:R="ZX Spectrum 128k +2A/+3"
break
case 6:R="Timex Sinclair TC-2048"
break
case 7:R="Timex Sinclair TS-2068"
break
case 8:R="Pentagon 128"
break
case 9:R="SAM Coupe"
break
case 10:R="Didaktik M"
break
case 11:R="Didaktik Gama"
break
case 12:R="ZX-80"
break
case 13:R="ZX-81"
break
case 14:R="ZX Spectrum 128k Spanish version"
break
case 15:R="ZX Spectrum Arabic version"
break
case 16:R="Microdigital TK 90-X"
break
case 17:R="MicrodigitalTK 95"
break
case 18:R="Byte"
break
case 19:R="Elwro 800-3"
break
case 20:R="ZS Scorpion 256"
break
case 21:R="Amstrad CPC 464"
break
case 22:R="Amstrad CPC 664"
break
case 23:R="Amstrad CPC 6128"
break
case 24:R="Amstrad CPC 464+"
break
case 25:R="Amstrad CPC 6128+"
break
case 26:R="Jupiter ACE"
break
case 27:R="Enterprise"
break
case 30:R="Inves Spectrum+"
break
case 31:R="Profi"
break
case 32:R="GrandRomMax"
break
case 33:R="Kay 1024"
break
case 34:R="Ice Felix HC 91"
break
case 35:R="Ice Felix HC 2000"
break
case 36:R="Amaterske RADIO Mistrum"
break
case 37:R="Quorum 128"
break
case 38:R="MicroART ATM"
break
case 39:R="MicroART ATM Turbo 2"
break
case 40:R="Chrome"
break
case 41:R="ZX Badaloc"
break
case 42:R="TS-1500"
break
case 43:R="Lambda"
break
case 44:R="TK-65"
break
case 45:R="ZX-97"
break
default:R="(unk.)"}break
case 1:switch(T="[ext.storage]",R){case 0:R="ZX Microdrive"
break
case 1:R="Opus Discovery"
break
case 2:R="MGT DISCiPLE"
break
case 3:R="MGT +D"
break
case 4:R="Rotronics Wafadrive"
break
case 5:R="TR-DOS (BetaDisk)"
break
case 6:R="Byte Drive"
break
case 7:R="Watsford"
break
case 8:R="FIZ"
break
case 9:R="Radofin"
break
case 10:R="Didaktik disk drives"
break
case 11:R="BS-DOS (MB-02)"
break
case 12:R="ZX Spectrum +3 disk drive"
break
case 13:R="JLO (Oliger) disk interface"
break
case 14:R="Timex FDD3000"
break
case 15:R="Zebra disk drive"
break
case 16:R="Ramex Millenia"
break
case 17:R="Larken"
break
case 18:R="Kempston disk interface"
break
case 19:R="Sandy"
break
case 20:R="ZX Spectrum +3e hard disk"
break
case 21:R="ZXATASP"
break
case 22:R="DivIDE"
break
case 23:R="ZXCF"
break
default:R="(unk.)"}break
case 2:switch(T="[memory addon]",R){case 0:R="Sam Ram"
break
case 1:R="Multiface ONE"
break
case 2:R="Multiface 128k"
break
case 3:R="Multiface +3"
break
case 4:R="MultiPrint"
break
case 5:R="MB-02 ROM/RAM exp."
break
case 6:R="SoftROM"
break
case 7:R="1k"
break
case 8:R="16k"
break
case 9:R="48k"
break
case 10:R="memory in 8-16k used"
break
default:R="(unk.)"}break
case 3:switch(T="[sound device]",R){case 0:R="classic 128k ZX-compatible AY hw"
break
case 1:R="Fuller Box AY hw"
break
case 2:R="Currah microSpeech"
break
case 3:R="SpecDrum"
break
case 4:R="AY ACB (L:A+C R:B+C) stereo/Melodik"
break
case 5:R="AY ABC (L:A+B R:B+C) stereo/Melodik"
break
case 6:R="RAM Music Machine"
break
case 7:R="Covox"
break
case 8:R="General Sound"
break
case 9:R="Intec Electronic Digital Interface B8001"
break
case 10:R="Zon-X AY"
break
case 11:R="QuickSilva AY"
break
case 12:R="Jupiter ACE"
break
default:R="(unk.)"}break
case 4:switch(T="[joystick]",R){case 0:R="Kempston"
break
case 1:R="Cursor/Protek/AGF"
break
case 2:R="Sinclair 2 Left (12345)"
break
case 3:R="Sinclair 1 Right (67890)"
break
case 4:R="Fuller"
break
default:R="(unk.)"}break
case 5:switch(T="[mouse]",R){case 0:R="AMX mouse"
break
case 1:R="Kempston mouse"
break
default:R="(unk.)"}break
case 6:switch(T="[controller]",R){case 0:R="Trickstick"
break
case 1:R="ZX Light Gun"
break
case 2:R="Zebra Graphics Tablet"
break
case 3:R="Defender Light Gun"
break
default:R="(unk.)"}break
case 7:switch(T="[serial port]",R){case 0:R="ZX Interface I"
break
case 1:R="ZX Spectrum 128k"
break
default:R="(unk.)"}break
case 8:switch(T="[parallel port]",R){case 0:R="Kempston S"
break
case 1:R="Kempston E"
break
case 2:R="ZX Spectrum +3"
break
case 3:R="Tasman"
break
case 4:R="DK'Tronics"
break
case 5:R="Hilderbay"
break
case 6:R="INES Printerface"
break
case 7:R="Z LPrint Interface 3"
break
case 8:R="MultiPrint"
break
case 9:R="Opus Discovery"
break
case 10:R="Standard 8255 chip with ports 31+63+95"
break
default:R="(unk.)"}break
case 9:switch(T="[printer]",R){case 0:R="ZX Printer/Alphacom 32 & compat."
break
case 1:R="Generic printer"
break
case 2:R="EPSON compat."
break
default:R="(unk.)"}break
case 10:switch(T="[modem]",R){case 0:R="Prism VTX 5000"
break
case 1:R="T/S 2050/Westridge 2050"
break
default:R="(unk.)"}break
case 11:switch(T="[digitizer]",R){case 0:R="RD Digital Tracer"
break
case 1:R="DK'Tronics Light Pen"
break
case 2:R="British MicroGraph Pad"
break
case 3:R="Romantic Robot Videoface"
break
default:R="(unk.)"}break
case 12:T="[network adapter]",R=0==R?"ZX Interface I":"(unk.)"
break
case 13:T="[keyboard]",R=0==R?"Keypad for ZX Spectrum 128k":"(unk.)"
break
case 14:switch(T="[AD/DA converter]",R){case 0:R="Harley Systems ADC 8.2"
break
case 1:R="Blackboard Electronics"
break
default:R="(unk.)"}break
case 15:switch(T="[EEPROM programmer]",R){case 0:R="Orme Electronics"
break
case 1:R="Blackboard Electronics"
break
default:R="(unk.)"}break
case 16:switch(T="[GPU]",R){case 0:R="WRX Hi-Res"
break
case 1:R="G007"
break
case 2:R="Memotech"
break
case 3:R="Lambda Colour"
break
default:R="(unk.)"}}switch(X.U8(d++)){case 0:U=U.append("runs on "+T+" "+R)
break
case 1:U=U.append("uses "+T+" "+R)
break
case 2:U=U.append("runs w/o specifics of "+T+" "+R)
break
case 3:U=U.append("won't run on "+T+" "+R)}}break
case 53:d+=20+X.U32(d+16)
break
case 90:X.c("'XTape!'1A",d)?(e++,d+=9):(end=!0,d--)
break
case 22:case 23:d+=X.U32(d)
break
case 52:d+=8
break
case 64:sOption("snapshot"),d+=4+X.U24(d+1)
break
case 75:Y=!0,d+=4+X.U32(d)
break
default:end=!0,d--}sName=Y?"ZX Spectrum/MSX tape (.TSX)":"ZX Spectrum tape (.TZX)",o.length&&(sVersion=sVersion.appendS("malformed"+o,"/")),X.isVerbose()&&(sOptionT(c),1<e&&sOption(e,"x"),sOptionT($,"by:"),sOptionT(Q,"'"),sOptionT(x,"(c) "),sOptionT(ee,"in:"),sOptionT(ae,"apptype:"),sOptionT(se,"price:"),sOptionT(ie,"origin:"),sOptionT(re,"prot/ldr:"),sOption(U),sOptionT(addEllipsis(O,160)),sOptionT(addEllipsis(C.join(","),160),"files:"),sOptionT(te,"choices:"),sOption(outSz(d),"sz:"))}else if(X.c("'UEF File!'00")&&X.U8(11)<=2){sName="Acorn PC Unified Emulator Format data (.UEF)",bDetected=1,sVersion="v"+X.U8(11)+"."+X.U8(10)
c=info=man=gear=kb=P="",E=!1
for(d=12;d<X.Sz();){k=X.U16(d),h=X.U32(d+2)
if([0,1,2,3,4,255].indexOf(k>>8)<0)break
switch(d+=6,k){case 0:info=info.appendS(X.SA(d,h),"/")
break
case 1:man=man.appendS(X.SA(d,h)," ")
break
case 5:switch(gear="Acorn ",X.U8(d)>>4){case 0:gear+="BBC Model A"
break
case 1:gear+="Electron"
break
case 2:gear+="BBC Model B"
break
case 3:gear+="BBC Master"
break
case 4:gear+="Atom"}switch(15&X.U8(d)){case 0:kb="any"
break
case 1:kb="target PC"
break
case 2:kb="host PC"}break
case 9:c=X.SA(d,h)
break
case 257:case 258:case 259:case 260:case 272:case 273:case 274:case 275:case 276:case 277:case 278:case 279:case 288:case 305:P=P.addIfNone("#tape")
break
case 304:switch(X.U8(d)){case 0:u="unit"
break
case 1:u="tape"
break
case 2:u="disc"
break
case 3:u="vtape"
break
case 4:u="cartridge"}1<X.U8(d+1)&&(u+=" ×"+X.U8(d+1)),1<X.U8(d+2)&&(u+=1==X.U8(d)||3==X.U8(d)?" ch:":2==X.U8(d)?" "+X.U8(d+2)+" audiotracks":"..?"),info+=" #"+u
break
case 512:case 513:case 514:P=P.addIfNone("#disc")
break
case 768:switch(P=P.addIfNone("#ROM"),u="content:",X.U8(d)){case 0:u+="generic"
break
case 1:u+="OS"
break
case 2:u+="BASIC"
break
case 3:u+="language"
break
case 4:u+="utility"
break
case 5:u+="filing system"
break
case 6:u+="h/w driver"
break
case 7:u+="game"
break
default:u+="unk"}info+=" #"+u
break
case 769:P=P.addIfNone("#ROM")
break
case 1024:case 1025:case 1026:case 1027:case 1040:case 1041:case 1042:case 1056:P=P.addIfNone("#snapshot")
break
case 65280:info+="#emu:"+X.SA(d,h)
break
case 256:break
default:65280<k?P=P.addIfNone("#customdata"):E=!0}if(E){d-=6
break}d+=h}sVersion+=P,X.isVerbose()&&(sOption(c),sOptionT(info,"info:"),sOptionT(man,"manual:"),sOptionT(gear,"gear:"),sOptionT(kb,"layout:"),sOption(outSz(d),"sz:"))}else if(X.c("'UNIF'???????? 0000 0000 0000 0000 0000 0000 0000")&&32<X.Sz()){if(sName="UNIF NES cartridge (.UNF)",sVersion="v"+X.U32(4,_LE),bDetected=1,X.isVerbose()){for(mapr=u="",tv="",ex="",fstorage=lastchunk=!(d=8);d<X.Sz()&&!lastchunk;){k=X.SA(d,4),h=X.U32(d+4)
switch(d+=8,k){case"MAPR":mapr=X.SA(d,h)
break
case"NAME":u=X.SA(d,h)
break
case"TCVI":switch(X.U8(d)){case 0:tv="NTSC"
break
case 1:tv="PAL"
break
case 2:tv="NTSC/PAL"}break
case"CTRL":var Z=[],w=X.U8(d)
1&w&&Z.push("Std. Controller"),2&w&&Z.push("Zapper"),4&w&&Z.push("R.O.B."),8&w&&Z.push("Arkanoid Controller"),16&w&&Z.push("Power Pad"),32&w&&Z.push("Four Score"),w&&(ex="#"+Z.join("+"))
break
case"BATR":fstorage=!0
break
case"MIRR":lastchunk=!0}d+=h}sOptionT(u),sOption(tv),sOption(ex,"expansion: "),fstorage&&sOption("battery-backed RAM"),lastchunk?sOption(outSz(d),"sz:"):sVersion+="/malformed!short"}}else if(X.c("'g GCE 198'..80"))sName="GCE Vectrex cartridge (.VEC)",bDetected=1,X.isVerbose()&&0<(d=X.fSig(17,32,"80"))&&sOption(X.SA(17,d-17))
else if(X.c("'VICE Snapshot File'1A")){for(sName="C64 VICE emulator snapshot (.VSF)",bDetected=1,sVersion="v"+X.U8(19)+"."+X.U8(20).padStart(2,"0"),d=37,o="";d<X.Sz();){k=X.SA(d,16),h=X.U32(d+18,_BE)
if(!/([A-Z0-9-]{3,}|Acia1)/.test(k)||!isAllZeroes(d+k.length,16-k.length)){o=o.addIfNone("badchunk")
break}d+=h}X.isVerbose()?sOptions=X.SA(21,15)+" sz:"+outSz(S):d>X.Sz()&&(o=o.addIfNone("!short")),""!=o&&(sVersion=sVersion.appendS("/malformed"+o,"/"))}if(!bDetected&&(function(){if(X.c("'IWAD'")||X.c("'PWAD'")){var e=0,a=_LE
if((lumpn=X.I32(4,a))<0||lumpn>X.I32(4,_BE)){if(!(0<(lumpn=X.I32(4,_BE))))return
e++,a=_BE}var s=0,r=X.I32(8,a),i=r
if(isWithin(r,12,X.Sz())){e++
for(var t=[],c=Math.min(lumpn,64);s<c;s++,i+=16){if(i+16>X.Sz())return
var n=X.I32(i,a),o=X.I32(i+4,a)
if(n<0||o<0||!isWithin(n,12,X.Sz()))return
X.c("'ENDOFWAD'",i+8)&&e++,t.push([n,o,X.readBytes(i+8,8)])}for(t=t.sort(function(e,a){return e[0]-a[0]}),s=0;s<c;s++){var k=0<(128&t[s][2][0])
if(t[s][2][0]=127&t[s][2][0],charStat(t[s][2],!0).indexOf("allxsc")<0)return
if(!k&&s<c-2&&t[s][0]+t[s][1]>t[s+1][0])return}return I=2<=e?"Atari Jaguar":"PC",1}}})()&&(sName="iD Software's Where's All the Data resource pack (.WAD)",bDetected=1,sVersion=X.c("'I'")?"initial":"patch",sVersion+="#"+I),!bDetected&&X.c("'WOZ'..FF0A0D0A ........ 'INFO'")&&isWithin(X.U8(3),49,50)){for(sName="Apple II Applesauce disk image (.WOZ)",sVersion="v"+X.SA(3,1),d=12,meta=o="";d<X.Sz();){k=X.SA(d,4),h=X.U32(d+4)
switch(d+=8,k){case"INFO":iV=X.U8(d),bDetected=1,dim=1==X.U8(d+1)?'5¼"':2==X.U8(d+1)?'3½"':"?",ds=2<=iV?1==X.U8(d+37)?" SS":2==X.U8(d+37)?" DS":" ?":"",sOption("disk:"+dim+ds),1==X.U8(d+2)&&sOption("write-protected"),2<=iV&&((u=X.U8(d+42))&&sOption(u,"min.RAM:","k"),u="",(r=X.U16(d+40))||(u="?"),1&r&&(u=u.append("][")),2&r&&(u=u.append("][ Plus")),4&r&&(u=u.append("//e")),8&r&&(u=u.append("//c")),16&r&&(u=u.append("//e Enhanced")),32&r&&(u=u.append("IIgs")),64&r&&(u=u.append("//c Plus")),128&r&&(u=u.append("///")),256&r&&(u=u.append("/// Plus")),sOption(u,"for Apple "))
break
case"TMAP":case"TRKS":case"FLUX":case"WRIT":break
case"META":meta=X.SC(d,h,"UTF8").replace(/\x0A/g,",").replace(/\x09/g,":")}d+=h}""!=(o=d>X.Sz()?o.addIfNone("!short"):o)&&(sVersion=sVersion.appendS("/malformed"+o,"/")),X.isVerbose()&&(sOptionT(addEllipsis(meta),'info:"','"'),sOption(outSz(d),"sz:"))}return!bDetected&&(function(){if((extIs("z80")||extIs("slt"))&&!(X.Sz()<1380)){nv=0,co=!0,joystick=U=""
const k=X.U8(12)
255==k&&(k=1)
var e=X.U16(6),a=128&X.U8(37),s=30
if(e)switch(nv=1,U="ZX Spectrum 48k",co=0<(32&k),X.U8(29)>>6&&3){case 0:joystick="cursor"
break
case 1:joystick="Kempston"
break
case 2:joystick="SinclairI2-L"
break
case 3:joystick="SinclairI2-R"}else{switch(xblk=X.U16(30)){case 23:nv=2
break
case 54:case 55:nv=3
break
default:return}switch(s+=xblk+2,nv){case 2:switch(X.U8(29)>>6&&3){case 0:joystick="cursor"
break
case 1:joystick="Kempston"
break
case 2:joystick="SinclairI2-L"
break
case 3:joystick="SinclairI2-R"}break
case 3:switch(X.U8(29)>>6&&3){case 0:joystick="cursor"
break
case 1:joystick="Kempston"
break
case 3:joystick="SinclairI2-R"
break
case 2:joystick=X.c("030F0308 03040302 0301",64)?"Sinclair2-L":"custom"}break
default:return}var r=X.U8(34),i=X.U8(83)
if(r<7)switch(nv){case 2:switch(r){case 0:U="ZX Spectrum "+(a?"16k":"48k")
break
case 1:U="ZX Spectrum "+(a?"16":"48")+"k & Interface1"
break
case 2:U="ZX Spectrum "+(a?"16":"48")+"k & SamRam"
break
case 3:U="ZX Spectrum "+(a?"+2":"128k")
break
case 4:U="ZX Spectrum "+(a?"+2":"128k")+" & Interface1"
break
default:return}break
case 3:var t=["MGT EPSON DISCiPLE","MGT HP DISCiPLE","MGT +D"],i=[0,1,16].indexOf(i)
switch(r){case 0:U="ZX Spectrum "+(a?"16k":"48k")
break
case 1:U="ZX Spectrum "+(a?"16":"48")+"k & Interface1"
break
case 2:U="ZX Spectrum "+(a?"16":"48")+"k & SamRam"
break
case 3:if(i<0)return
U="ZX Spectrum "+(a?"16":"48")+"k & "+t[i]+" MGT"
break
case 4:U="ZX Spectrum "+(a?"+2":"128k")
break
case 5:U="ZX Spectrum "+(a?"+2":"128k")+" & Interface1"
break
case 6:if(i<0)return
U="ZX Spectrum "+(a?"+2":"128k")+" & "+t[i]+" MGT"
break
default:return}break
default:return}else switch(r){case 7:case 8:U="ZX Spectrum "+(a?"+2A":"+3")
break
case 9:U="Pentagon 128+"
break
case 10:U="Scorpion ZS-256"
break
case 11:U="Didaktik-Kompakt"
break
case 12:U="ZX Spectrum +2"
break
case 13:U="ZX Spectrum +2A"
break
case 14:U="Timex Sinclair TC-2048"
break
case 15:U="Timex Sinclair TC-2068"
case 128:U="Timex Sinclair TS-2068"
break
default:return}68&X.U8(37)?U+=" + Fuller Box":4&X.U8(37)&&(U+=" + Melodik")}if(pgs=[],co){var c=1==nv?49152:16384
for(d=s,f=unpsz=0;d<X.Sz()&&f<64&&!X.c("000000'SLT'",d);f++){var n=1==nv?65536:X.U16(d),o=1==nv?3:X.U8(d+2)
if(0<=pgs.indexOf(o)){if(f<3)return
break}if(pgs.push(o),1<nv&&(d+=3),0<f)q=d+n
else for(bsz=b=l=0,q=d;q<d+n&&bsz<c&&q<X.Sz();){if(X.c("EDED",q)){if(q+=2,l=X.U8(q++),b=X.U8(q++),l<5&&237!=b)return
bsz+=l}else q++,bsz++
if(1==nv&&X.c("00EDED00",q)){q+=4
break}}if(bsz!=c||1<p&&q!=d+n)return
if(d=q,unpsz+=bsz,1==nv||10<o||10<pgs.length)break}if(d>X.Sz()||1<nv&&!f)return
S=d}else S=d=s+49152
if(slt=X.c("000000'SLT'",d))e:for(sltsz=0,sltlv=[],d+=6;d<X.Sz();d+=8)switch(X.U16(d)){case 0:S+=14+sltsz,sltinfo="SLT levels:"+sltlv.join(",")
break e
case 1:sltlv.push(X.U16(d+2)),sltsz+=8+X.U32(d+4)
break
default:sltsz+=8+X.U32(d+4),_l2r("z80",d,"Unknown block! Please send this file to the author of rom.1.sg")}else sltinfo=""
return 1}})()&&(sName=slt?"ZX Spectrum state snapshot + levels (.SLT)":"ZX Spectrum state snapshot (.Z80)",bDetected=1,sVersion="v"+nv,3==nv&&55==X.U16(30)&&(sVersion+="x"),co&&(sVersion+="/compressed"),X.isVerbose())&&(sOption(U,"on:"),sOption(joystick,"joystick:"),co&&sOption("pages:"+pgs.join("+")+" unp.sz:"+Util.divu64(unpsz,1024)+"k"),slt&&sOption(sltinfo),sOption(outSz(S),"sz:")),!bDetected&&X.isHeuristicScan()&&((function(){if(!(X.Sz()<17||X.Sz()<X.U16(0)+2)){d=blk=sus=0,C=o=""
for(var e=["B","N","S","C"];d<X.Sz();){if(!(h=X.U16(d)))return
if(d+=2,X.Sz()<d+h)break
var a=0,s=X.U8(d)
if([0,255].indexOf(s)<0)break
if(d<49152&&blk<5){for(f=d;f<d+h-1;f++)a^=X.U8(f)
if(a!=X.U8(f))return}if(0==s){if(charStat(u=X.readBytes(d+2,10),1).indexOf("allasc")<0&&(sus++,o=o.addIfNone("!nonASCII:"+decEncoding(u,CPSpeccy))),!(u=decEncoding(u,CPSpeccy).trim())){if(X.U8(d+1)<3)return
sus++,o=o.addIfNone("!emptyname")}C=C.appendS(u+"."+e[X.U8(d+1)],",")}else C=C.appendS(h-3,":")
if(2<sus)return
blk++,d+=h}if(!C.length&&blk&&(sus++,o=o.addIfNone("!nonameblk0")),blk<2&&o.indexOf("!nonASCII")&&sus++,!(2<sus||!blk||!C.length||d<17))return 1
o=void 0}})()&&(sName="ZX Spectrum tape (.TAP)",bDetected=1,o.length&&(sVersion="malformed#"+sus+o),X.isVerbose())&&(sOptionT(addEllipsis(C,160),"blocks:"+blk+" (",")"),sOption(outSz(d),"sz:")),extIs("rom")&&(X.c("4142")||X.c("4142",16384)||X.c("41421040",245760)||X.c("0002204810A8D08055E0A8B088800280",32752))&&0<=[8192,16384,32768,49152,65536,131072,262144,393216,524288,1048576].indexOf(X.Sz())&&_setResult("ROM","Microsoft MSX/MSX 2 cartridge (.ROM)","",""),extIs("sna"))&&49179==X.Sz()&&_setResult("ROM","ZX Spectrum 48k state snapshot file (.SNA)","",""),result()}meta("ROM","")

================================================
FILE: dbs_min/db/Binary/U-Boot.1.sg
================================================
function detect(){if(64<=Binary.getSize()){if(Binary.compare("27051956"))switch(bDetected=1,sName="U-Boot ",Binary.readByte(30)){case 0:sName+="Invalid Image"
break
case 1:sName+="Standalone Program"
break
case 2:sName+="OS Kernel Image"
break
case 3:sName+="RAMDisk Image"
break
case 4:sName+="Multi-File Image"
break
case 5:sName+="Firmware Image"
break
case 6:sName+="Script file"
break
case 7:sName+="Filesystem Image"
break
case 8:sName+="Binary Flat Device Tree Blob"
break
case 9:sName+="Kirkwood Boot Image"
break
case 10:sName+="Freescale IMXBoot Image"
break
case 11:sName+="Davinci UBL Image"
break
case 12:sName+="TI OMAP Config Header Image"
break
case 22:sName+="A list of typeless images"
break
case 23:sName+="Rockchip Boot Image"
break
case 24:sName+="Rockchip SD card"
break
case 25:sName+="Rockchip SPI image"
break
case 26:sName+="Xilinx Zynq Boot Image"
break
case 27:sName+="Xilinx ZynqMP Boot Image"
break
case 28:sName+="FPGA Image"
break
case 29:sName+="VYBRID .vyb Image"
break
case 30:sName+="Trusted Execution Environment OS Image"
break
case 31:sName+="Firmware Image with HABv4 IVT"
break
default:return}if(bDetected){switch(sVersion='"'+Binary.getString(32,32)+'"',Binary.readByte(28)){case 0:sOptions="Invalid OS"
break
case 1:sOptions="OpenBSD"
break
case 2:sOptions="NetBSD"
break
case 3:sOptions="FreeBSD"
break
case 4:sOptions="4.4BSD"
break
case 5:sOptions="Linux"
break
case 6:sOptions="SVR4"
break
case 7:sOptions="Esix"
break
case 8:sOptions="Solaris"
break
case 9:sOptions="Irix"
break
case 10:sOptions="SCO"
break
case 11:sOptions="Dell"
break
case 12:sOptions="NCR"
break
case 13:sOptions="LynxOS"
break
case 14:sOptions="VxWorks"
break
case 15:sOptions="pSOS"
break
case 16:sOptions="QNX"
break
case 17:sOptions="Firmware"
break
case 18:sOptions="RTEMS"
break
case 19:sOptions="ARTOS"
break
case 20:sOptions="Unity OS"
break
case 21:sOptions="INTEGRITY"
break
case 22:sOptions="OSE"
break
case 23:sOptions="Plan 9"
break
case 24:sOptions="OpenRTOS"
break
case 25:sOptions="ARM Trusted Firmware"
break
case 26:sOptions="Trusted Execution Environment"
break
case 27:sOptions="RISC-V OpenSBI"
break
case 28:sOptions="EFI Firmware"}switch(Binary.readByte(29)){case 0:sOptions=sOptions.append("Invalid CPU")
break
case 1:sOptions=sOptions.append("Alpha")
break
case 2:sOptions=sOptions.append("ARM")
break
case 3:sOptions=sOptions.append("Intel x86")
break
case 4:sOptions=sOptions.append("IA64")
break
case 5:sOptions=sOptions.append("MIPS")
break
case 6:sOptions=sOptions.append("MIPS64")
break
case 7:sOptions=sOptions.append("PowerPC")
break
case 8:sOptions=sOptions.append("IBM S390")
break
case 9:sOptions=sOptions.append("SuperH")
break
case 10:sOptions=sOptions.append("Sparc")
break
case 11:sOptions=sOptions.append("Sparc64")
break
case 12:sOptions=sOptions.append("M68K")
break
case 13:sOptions=sOptions.append("Nios-32")
break
case 14:sOptions=sOptions.append("MicroBlaze")
break
case 15:sOptions=sOptions.append("Nios-II")
break
case 16:sOptions=sOptions.append("Blackfin")
break
case 17:sOptions=sOptions.append("AVR32")
break
case 18:sOptions=sOptions.append("STM ST200")
break
case 19:sOptions=sOptions.append("Sandbox")
break
case 20:sOptions=sOptions.append("NDS32")
break
case 21:sOptions=sOptions.append("OpenRISC")
break
case 22:sOptions=sOptions.append("ARM64")
break
case 23:sOptions=sOptions.append("ARC")
break
case 24:sOptions=sOptions.append("AMD x86_64")
break
case 25:sOptions=sOptions.append("Xtensa")
break
case 26:sOptions=sOptions.append("RISC-V")}switch(Binary.readByte(31)){case 0:sOptions=sOptions.append("no compression")
break
case 1:sOptions=sOptions.append("gzip")
break
case 2:sOptions=sOptions.append("bzip2")
break
case 3:sOptions=sOptions.append("lzma")
break
case 4:sOptions=sOptions.append("lzo")
break
case 5:sOptions=sOptions.append("lz4")
break
case 6:sOptions=sOptions.append("zstd")}}}return result()}meta("format")

================================================
FILE: dbs_min/db/Binary/__MiniExtensionsHeuristic_By_DosX.7.sg
================================================
var detect=main
function main(){if(Binary.isHeuristicScan())for(var e=Binary.getFileSuffix().toLowerCase(),t=!Binary.isPlainText(),a=[{ext:["cmd","bat"],type:"language",name:"Batch",bin:!1},{ext:["html","htm"],type:"language",name:"HTM",bin:!1},{ext:["css"],type:"language",name:"Cascading Style Sheets",bin:!1},{ext:["c","h"],type:"language",name:"C",bin:!1},{ext:["cpp","hpp"],type:"language",name:"C++",bin:!1},{ext:["cs"],type:"language",name:"C#",bin:!1},{ext:["java"],type:"language",name:"Java",bin:!1},{ext:["py"],type:"language",name:"Python 🐓",bin:!1},{ext:["json"],type:"language",name:"JavaScript Object Notation",bin:!1},{ext:["xml"],type:"language",name:"Extensible Markup",bin:!1},{ext:["ini"],type:"format",name:"Configuration File",bin:!1},{ext:["yml","yaml"],type:"language",name:"YAML",bin:!1},{ext:["php"],type:"language",name:"PHP",bin:!1},{ext:["rb"],type:"language",name:"Ruby",bin:!1},{ext:["pl"],type:"language",name:"Perl",bin:!1},{ext:["swift"],type:"language",name:"Swift",bin:!1},{ext:["rs"],type:"language",name:"Rust",bin:!1},{ext:["go"],type:"language",name:"Go",bin:!1},{ext:["ts"],type:"language",name:"TypeScript",bin:!1},{ext:["kt"],type:"language",name:"Kotlin",bin:!1},{ext:["dart"],type:"language",name:"Dart",bin:!1},{ext:["lua"],type:"language",name:"Lua",bin:!1},{ext:["sh"],type:"language",name:"Bash",bin:!1},{ext:["r"],type:"language",name:"R",bin:!1},{ext:["scala"],type:"language",name:"Scala",bin:!1},{ext:["lisp"],type:"language",name:"Lisp",bin:!1},{ext:["clj"],type:"language",name:"Clojure",bin:!1},{ext:["asm"],type:"language",name:"Assembly",bin:!1},{ext:["vb"],type:"language",name:"VB.NET",bin:!1},{ext:["fs"],type:"language",name:"F#",bin:!1},{ext:["ps1"],type:"language",name:"PowerShell Script",bin:!1},{ext:["ml"],type:"language",name:"OCaml",bin:!1},{ext:["hs"],type:"language",name:"Haskell",bin:!1},{ext:["vhd"],type:"language",name:"VHDL",bin:!1},{ext:["verilog"],type:"language",name:"Verilog",bin:!1},{ext:["ada"],type:"language",name:"Ada",bin:!1},{ext:["for"],type:"language",name:"Fortran",bin:!1},{ext:["pas"],type:"language",name:"Pascal",bin:!1},{ext:["m"],type:"language",name:"Objective-C",bin:!1},{ext:["v"],type:"language",name:"V",bin:!1},{ext:["img","iso"],type:"format",name:"Disk Image",bin:!0},{ext:["dmg"],type:"format",name:"Apple Disk Image",bin:!0},{ext:["cab"],type:"format",name:"Cabinet Archive",bin:!0},{ext:["dat"],type:"format",name:"Data File",bin:!0},{ext:["vmdk"],type:"format",name:"VMware Virtual Disk",bin:!0},{ext:["vhd","vhdx"],type:"format",name:"Virtual Hard Disk",bin:!0},{ext:["apk"],type:"format",name:"Android Package",bin:!0},{ext:["so"],type:"format",name:"Shared Object Library",bin:!0},{ext:["obj"],type:"format",name:"Object File",bin:!0},{ext:["a"],type:"format",name:"Static Library",bin:!0},{ext:["lib"],type:"format",name:"Library File",bin:!0},{ext:["o"],type:"format",name:"Compiled Object File",bin:!0},{ext:["pdb"],type:"format",name:"Program Database",bin:!0},{ext:["nso"],type:"format",name:"Nintendo Switch Object",bin:!0},{ext:["iso"],type:"format",name:"ISO Disk Image",bin:!0},{ext:["img"],type:"format",name:"Raw Disk Image",bin:!0},{ext:["dylib"],type:"format",name:"Dynamic Library (macOS)",bin:!0},{ext:["xex"],type:"format",name:"Xbox Executable File",bin:!0},{ext:["rom"],type:"format",name:"ROM Image",bin:!0},{ext:["pe"],type:"format",name:"Portable Executable",bin:!0},{ext:["bpl"],type:"format",name:"Borland Package Library",bin:!0},{ext:["vbx"],type:"format",name:"Visual Basic",bin:!0},{ext:["ocx"],type:"format",name:"ActiveX Control",bin:!0},{ext:["psd"],type:"format",name:"Photoshop Document",bin:!0},{ext:["ai"],type:"format",name:"Adobe Illustrator",bin:!0},{ext:["indd"],type:"format",name:"InDesign Document",bin:!0},{ext:["xd"],type:"format",name:"Adobe XD",bin:!0},{ext:["svg"],type:"format",name:"Scalable Vector Graphics",bin:!1},{ext:["blend"],type:"format",name:"Blender Project",bin:!0},{ext:["obj"],type:"format",name:"3D Object",bin:!0},{ext:["fbx"],type:"format",name:"Autodesk FBX",bin:!0},{ext:["stl"],type:"format",name:"STL Model",bin:!0},{ext:["gltf","glb"],type:"format",name:"GLTF/GLB Model",bin:!0},{ext:["png"],type:"format",name:"Portable Network Graphics",bin:!0},{ext:["jpg","jpeg"],type:"format",name:"JPEG Image",bin:!0},{ext:["bmp"],type:"format",name:"Bitmap Image",bin:!0},{ext:["tiff"],type:"format",name:"Tagged Image File Format",bin:!0},{ext:["tga"],type:"format",name:"Targa Image",bin:!0},{ext:["heic"],type:"format",name:"High Efficiency Image Format",bin:!0},{ext:["raw","cr2","nef","orf"],type:"format",name:"RAW Image",bin:!0},{ext:["eps"],type:"format",name:"Encapsulated PostScript",bin:!0},{ext:["3ds"],type:"format",name:"3D Studio Max",bin:!0},{ext:["max"],type:"format",name:"3ds Max Project",bin:!0},{ext:["c4d"],type:"format",name:"Cinema 4D Project",bin:!0},{ext:["dae"],type:"format",name:"Collada",bin:!0},{ext:["skp"],type:"format",name:"SketchUp",bin:!0},{ext:["dxf"],type:"format",name:"Drawing Exchange Format",bin:!0},{ext:["dwg"],type:"format",name:"AutoCAD Drawing",bin:!0},{ext:["iges","igs"],type:"format",name:"IGES Model",bin:!0},{ext:["step","stp"],type:"format",name:"STEP Model",bin:!0},{ext:["vrml","wrl"],type:"format",name:"VRML Model",bin:!0},{ext:["x3d"],type:"format",name:"X3D Model",bin:!0},{ext:["mp4"],type:"format",name:"MPEG-4 Video",bin:!0},{ext:["bik"],type:"format",name:"Bink Video",bin:!0},{ext:["mkv"],type:"format",name:"Matroska Video",bin:!0},{ext:["avi"],type:"format",name:"AVI Video",bin:!0},{ext:["mov"],type:"format",name:"QuickTime Movie",bin:!0},{ext:["flv"],type:"format",name:"Flash Video",bin:!0},{ext:["webm"],type:"format",name:"WebM Video",bin:!0},{ext:["mp3"],type:"format",name:"MP3 Audio",bin:!0},{ext:["wav"],type:"format",name:"Waveform Audio",bin:!0},{ext:["aac"],type:"format",name:"Advanced Audio Coding",bin:!0},{ext:["ogg"],type:"format",name:"Ogg Vorbis",bin:!0},{ext:["m4a"],type:"format",name:"MPEG-4 Audio",bin:!0},{ext:["wma"],type:"format",name:"Windows Media Audio",bin:!0},{ext:["prproj"],type:"format",name:"Premiere Pro Project",bin:!0},{ext:["aep"],type:"format",name:"After Effects Project",bin:!0},{ext:["psb"],type:"format",name:"Photoshop Big Document",bin:!0},{ext:["cdr"],type:"format",name:"CorelDRAW Image",bin:!0},{ext:["afdesign"],type:"format",name:"Affinity Designer",bin:!0},{ext:["afphoto"],type:"format",name:"Affinity Photo",bin:!0},{ext:["afpub"],type:"format",name:"Affinity Publisher",bin:!0},{ext:["sketch"],type:"format",name:"Sketch Project",bin:!0},{ext:["xcf"],type:"format",name:"GIMP Image",bin:!0},{ext:["kra"],type:"format",name:"Krita Image",bin:!0},{ext:["vproj"],type:"format",name:"Vegas Pro Project",bin:!0},{ext:["wpd"],type:"format",name:"WordPerfect Document",bin:!0},{ext:["vpj"],type:"format",name:"VideoPad Project",bin:!0},{ext:["prtl"],type:"format",name:"Premiere Title",bin:!0},{ext:["pdn"],type:"format",name:"Paint.NET Image",bin:!0},{ext:["tmp","temp"],type:"format",name:"Temporary file",bin:!0},{ext:["tmp","temp"],type:"format",name:"Temporary file",bin:!1},{ext:["mb"],type:"format",name:"Maya Binary Project",bin:!0},{ext:["ma"],type:"format",name:"Maya ASCII Project",bin:!0},{ext:["lwo"],type:"format",name:"LightWave Object",bin:!0},{ext:["lws"],type:"format",name:"LightWave Scene",bin:!0},{ext:["obj"],type:"format",name:"Wavefront OBJ",bin:!0},{ext:["abc"],type:"format",name:"Alembic",bin:!0},{ext:["bgeo"],type:"format",name:"Houdini Geometry",bin:!0},{ext:["vdb"],type:"format",name:"OpenVDB",bin:!0},{ext:["usd"],type:"format",name:"Universal Scene Description",bin:!0},{ext:["usdz"],type:"format",name:"Universal Scene Description (zipped)",bin:!0},{ext:["vox"],type:"format",name:"MagicaVoxel",bin:!0},{ext:["cob"],type:"format",name:"Caligari Object",bin:!0},{ext:["scn"],type:"format",name:"3D Scene",bin:!0},{ext:["3dm"],type:"format",name:"Rhinoceros 3D Model",bin:!0},{ext:["ztl"],type:"format",name:"ZBrush Tool",bin:!0},{ext:["zpr"],type:"format",name:"ZBrush Project",bin:!0},{ext:["bip"],type:"format",name:"Character Studio Biped",bin:!0},{ext:["3mf"],type:"format",name:"3D Manufacturing Format",bin:!0},{ext:["ply"],type:"format",name:"Polygon File Format",bin:!0},{ext:["x"],type:"format",name:"DirectX Model",bin:!0},{ext:["ms3d"],type:"format",name:"MilkShape 3D Model",bin:!0},{ext:["nif"],type:"format",name:"Gamebryo Model Format",bin:!0},{ext:["mdl"],type:"format",name:"3D Model",bin:!0},{ext:["wrl"],type:"format",name:"VRML World",bin:!0},{ext:["fac"],type:"format",name:"Autodesk Face",bin:!0},{ext:["xsi"],type:"format",name:"Softimage XSI",bin:!0},{ext:["pov"],type:"format",name:"POV-Ray File",bin:!0},{ext:["sldprt"],type:"format",name:"SolidWorks Part",bin:!0},{ext:["sldasm"],type:"format",name:"SolidWorks Assembly",bin:!0},{ext:["slddrw"],type:"format",name:"SolidWorks Drawing",bin:!0},{ext:["prt"],type:"format",name:"Creo Parametric Part",bin:!0},{ext:["asm"],type:"format",name:"Creo Parametric Assembly",bin:!0},{ext:["nds"],type:"format",name:"Nintendo DS ROM",bin:!0},{ext:["z64"],type:"format",name:"Nintendo 64 ROM",bin:!0},{ext:["n64"],type:"format",name:"Nintendo 64 ROM image (V64)",bin:!0},{ext:["pcx"],type:"format",name:"PiCture eXchange",bin:!0},{ext:["wbfs"],type:"format",name:"Wii Backup File System",bin:!0},{ext:["si"],type:"format",name:"Interleaf File",bin:!0},{ext:["wdb"],type:"format",name:"World DataBase",bin:!0},{ext:["asp"],type:"format",name:"Active Server Pages",bin:!1},{ext:["vmd"],type:"format",name:"Video and Media Data",bin:!0},{ext:["mesh"],type:"format",name:"3D Collide Data",bin:!0},{ext:["tot"],type:"format",name:"Script file",bin:!0},{ext:["ext"],type:"format",name:"Script resource file",bin:!0},{ext:["ide"],type:"format",name:"Script function name offset",bin:!0},{ext:["stk","itk","jtk","ltk"],type:"format",name:"STK1.0",bin:!0},{ext:["var"],type:"format",name:"Variable file",bin:!0},{ext:["cmp"],type:"format",name:"Sprite file",bin:!0},{ext:["tts"],type:"format",name:"Text to Speech file",bin:!1},{ext:["pag"],type:"format",name:"Update file",bin:!1},{ext:["bcd"],type:"format",name:"BCD (Information for new Application)",bin:!1},{ext:["bcd1"],type:"format",name:"BCD (Information for Environment)",bin:!1},{ext:["cd1"],type:"format",name:"CD1 (Setup Information)",bin:!1},{ext:["rxy"],type:"format",name:"Relative Sprite Coordinates",bin:!0},{ext:["fra"],type:"format",name:"French text (Francais)",bin:!0},{ext:["all"],type:"format",name:"German text (Allemand)",bin:!0},{ext:["ang"],type:"format",name:"English text (Anglais)",bin:!0},{ext:["esp"],type:"format",name:"Spanish text (Espagnol)",bin:!0},{ext:["ita"],type:"format",name:"Italian text",bin:!0},{ext:["fnt","let"],type:"format",name:"Font",bin:!0},{ext:["snd"],type:"format",name:"Sound file",bin:!0},{ext:["ani"],type:"format",name:"Animation file",bin:!0},{ext:["dec"],type:"format",name:"Decal (Background) file",bin:!0},{ext:["tbr"],type:"format",name:"Instrument parameters",bin:!0},{ext:["mdy"],type:"format",name:"Music score",bin:!0},{ext:["err"],type:"format",name:"Error File",bin:!1},{ext:["adi"],type:"format",name:"Debug (Adi) File",bin:!0},{ext:["bou"],type:"format",name:"Debug (Adibou) File",bin:!0},{ext:["pla"],type:"format",name:"Debug (Playtoons) File",bin:!0},{ext:["ask"],type:"format",name:"Installation help",bin:!1},{ext:["dag"],type:"format",name:"Dialog Text",bin:!0},{ext:["seq"],type:"format",name:"Animation Sequence",bin:!0},{ext:["scn"],type:"format",name:"Scene File",bin:!1},{ext:["rec"],type:"format",name:"Record File",bin:!0},{ext:["gam"],type:"format",name:"Savegame File",bin:!0},{ext:["lvl"],type:"format",name:"Level File",bin:!0},{ext:["stb"],type:"format",name:"STB (OGG)",bin:!0},{ext:["adbx"],type:"format",name:"AdibouX",bin:!0},{ext:["sav"],type:"format",name:"Save",bin:!0},{ext:["flx","flc"],type:"format",name:"FLIC",bin:!0},{ext:["md"],type:"format",name:"Markdown",bin:!1},{ext:["map"],type:"format",name:"Mapfile",bin:!1},{ext:["def"],type:"format",name:"Definition file",bin:!1},{ext:["dbt"],type:"format",name:"Database Text File",bin:!0},{ext:["cfg"],type:"format",name:"Config File",bin:!0},{ext:["inf"],type:"format",name:"INF file (setup Information file)",bin:!0},{ext:["icns"],type:"format",name:"Apple Icon Image format",bin:!0},{ext:["mdx"],type:"format",name:"Multidimensional Expressions",bin:!0},{ext:["qdat"],type:"format",name:"QuickTime data",bin:!0},{ext:["pup"],type:"format",name:"Playstation Update Package",bin:!0},{ext:["mps"],type:"format",name:"Mathematical Programming System",bin:!0},{ext:["gzf"],type:"format",name:"Ghidra Zip File",bin:!0},{ext:["cue"],type:"format",name:"CUE sheet",bin:!1},{ext:["cat"],type:"format",name:"Windows Cabinet File",bin:!0},{ext:["sdb"],type:"format",name:"Shim Database",bin:!0},{ext:["mof"],type:"format",name:"Managed Object Format",bin:!1},{ext:["nls"],type:"format",name:"National Language Support",bin:!0},{ext:["sse"],type:"format",name:"Streaming SIMD Extensions",bin:!0},{ext:["res"],type:"format",name:"Resource file",bin:!0},{ext:["md5"],type:"format",name:"MD5 Checksum",bin:!1},{ext:["db"],type:"format",name:"Database",bin:!0},{ext:["xa"],type:"audio",name:"XA",bin:!0},{ext:["torrent"],type:"format",name:"Torrent",bin:!0},{ext:["bms"],type:"format",name:"QuickBMS",bin:!1},{ext:["gbc"],type:"format",name:"GameBoy Color ROM",bin:!0},{ext:["tsv"],type:"format",name:"Tab-Separated Values",bin:!1},{ext:["st"],type:"format",name:"ST Disk Image",bin:!0},{ext:["str"],type:"format",name:"Streaming Data Movie",bin:!0},{ext:["rpt"],type:"format",name:"Report file",bin:!1},{ext:["iss"],type:"format",name:"Inno Setup Script",bin:!1},{ext:["plist"],type:"format",name:"Property List",bin:!1},{ext:["vcd"],type:"format",name:"Value change dump",bin:!1},{ext:["gitignore"],type:"format",name:"Git ignore file",bin:!1},{ext:["gob"],type:"format",name:"Config file (extract_gob_stk)",bin:!1},{ext:["dxr"],type:"format",name:"Protected Director Movie",bin:!0},{ext:["cxt"],type:"format",name:"Adobe Director Protected Cast file",bin:!0},{ext:["dcr"],type:"format",name:"Published Shockwave Movie",bin:!0},{ext:["cct"],type:"format",name:"Published Shockwave Cast",bin:!0},{ext:["cst"],type:"format",name:"Cast file",bin:!0},{ext:["xobj"],type:"format",name:"XObjects",bin:!0},{ext:["cia"],type:"format",name:"CTR Importable Archive",bin:!0},{ext:["adf"],type:"format",name:"Amiga Disk File",bin:!0}],n=0;n<a.length;n++)for(var m=a[n].ext,i=0;i<m.length;i++)if(m[i]===e&&a[n].bin===t)return _getNumberOfResults(a[n])<1&&_setResult("~"+a[n].type,a[n].name,"","by extension"),null}

================================================
FILE: dbs_min/db/Binary/__MiniJavaScriptHeuristic_By_DosX.7.sg
================================================
function detect(){main()}function main(){if(Binary.isHeuristicScan())switch(Binary.getFileSuffix().toLowerCase()){case"js":case"jse":case"jsc":case"sg":var e=""
if(Binary.isPlainText()){if(3e3<Binary.getSize()){for(var i=Binary.getString(0,Binary.getSize()),t=[],a="",n=!1,r="",s=!1,g=0;g<i.length;g++){var l=i[g]
if(n)if(s)s=!1
else if("\\"===l)s=!0
else if("`"===r&&"$"===l&&g+1<i.length&&"{"===i[g+1]){g++
for(var f=1;g+1<i.length&&0<f;){var c=i[++g]
if("\\"===c)a+=c,g+1<i.length&&(a+=i[++g])
else{if("{"===c)f++
else if("}"===c&&0===--f)break
a+=c}}}else l===r&&(n=!1,r="")
else'"'===l||"'"===l||"`"===l?(0<a.length&&(t.push(a),a=""),n=!0,r=l):a+=l}0<a.length&&t.push(a)
for(var S=0;S<t.length;S++){var o=t[S]
if(!/(  |\t)/.test(o)&&(/(((var|let|const)[\t ]|\())\b[a-zA-Z](?:,[a-zA-Z]){3,}\b/.test(o)||/[a-zA-Z][!=]?=?=![01][;,})]/.test(o))){e="minified/compiled"
break}}}}else e="bytecode"
_setResult("~language","JavaScript","",Binary.isVerbose()?e:"")}}

================================================
FILE: dbs_min/db/Binary/_init
================================================
var File=Binary,X=Binary
includeScript("read")

================================================
FILE: dbs_min/db/Binary/archive.ACE.1.sg
================================================
function detect(){return detect_ACE(1),result()}includeScript("ACE")

================================================
FILE: dbs_min/db/Binary/archive.ARJ.1.sg
================================================
function detect(){return detect_ARJ(1),result()}includeScript("arj")

================================================
FILE: dbs_min/db/Binary/archive.DEFLATE.1.sg
================================================
function checkDeflate(e){var s=new BitReader(e),a=0,r=Math.min(X.Sz(),256)
do{var f,c=s.read(1),n=s.read(2)
if(n){if(1!=n&&2!=n)return!1
if(1==n)a=1
else{var b=s.read(5)+257
if(286<b)return!1
var d=s.read(5)+1,o=s.read(4)+4,u=[],l=[16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]
for(i=0;i<o&&s.offset<r;i++)u[l[i]]=s.read(3)
if(!(f=createOrderlyHuffmanTable(u,19,s)))return!1
for(i=0;i<b+d;){if(!f.length)return!1
for(j=0;f[j][0]||f[j][1];)if(!(j=s.read(1)?f[j][1]:f[j][0]))return!1
if(f[j][2]<16){if(i>=b+d)return!1
i++}else switch(f[j][2]){case 16:if(!i)return!1
s.read(2)
break
case 17:for(t=s.read(3)+3;t;t--);break
case 18:for(t=s.read(7)+11;t;t--);break
default:return!1}if(s.offset>X.Sz())return!1}a=2,c=!0}}else{s.init(e)
var n=s.read(8),p=(n|=s.read(8)<<8,s.read(8))
if(n!=(65535^(p|=s.read(8)<<8)))return 0
if(s.consume(n),s.offset>X.Sz())return!1
c&&(a=1)}}while(!c)
return!(1==a&&s.offset>=X.Sz())&&a}function checkZlib(e){if(e+6>X.Sz())return!1
var s=X.U8(e++)
if(8!=(15&s)||112<(240&s))return!1
var a=2,r=X.U8(e++)
if(32&r){if(e+8<X.Sz())return!1
a+=4}return!((s<<8|r)%31||!checkDeflate(a)||(cmprlvl=["fastest","fast","default","max"][r>>6],0))}function detect(){if(bad="",10<=X.Sz()&&X.c("1FA1")&&checkDeflate(2)&&(sName="Gzip hack: Quasijarus Strong Compression (Z.)",bDetected=1),!bDetected&&X.c("1F8B")){switch(method=X.U8(2)){case 0:sVersion="store",bad=bad.addIfNone("!badalgo")
break
case 1:sVersion="compress",bad=bad.addIfNone("!badalgo")
break
case 2:sVersion="pack",bad=bad.addIfNone("!badalgo")
break
case 3:sVersion="lz",bad=bad.addIfNone("!badalgo")
break
case 8:sVersion="deflate"
break
default:return!1}if(f=X.U8(3),fs=[],1&f&&fs.push("ASCII_FLAG"),2&f&&fs.push("HEADER_CRC"),4&f&&fs.push("EXTRA_FIELD"),8&f&&fs.push("ORIG_NAME"),16&f&&fs.push("COMMENT"),32&f&&fs.push("ENCRYPTED"),192&f&&fs.push("RESERVED"),(ts=X.I32(5,_LE))<=0)return!1
if(X.isVerbose()){switch(X.U8(8)){case 2:sOption("best")
break
case 4:sOption("fast")}switch(X.U8(9)){case 0:s="FAT FS (MS-DOS, OS/2, NT/Win32"
break
case 1:s="Amiga"
break
case 2:s="(Open)VMS"
break
case 3:s="Unix"
break
case 4:s="VM/CMS"
break
case 5:s="Atari TOS"
break
case 6:s="HPFS (OS/2, NT)"
break
case 7:s="Macintosh"
break
case 8:s="Z-System"
break
case 9:s="CP/M"
break
case 10:s="TOPS-20"
break
case 11:s="NTFS (NT)"
break
case 12:s="QDOS"
break
case 13:s="Acorn RISCOS"
break
case 255:s="unknown OS"
break
default:s="?"}sOption(s,"OS code:")}p=10,4&f&&(p+=4+X.U16(p+2,_LE)),8&f&&(s=X.SA(p,1024),p+=s.length+1,X.isVerbose())&&sOption(s,'filename:"','"'),16&f&&(s=X.SA(p,1024),p+=s.length+1,X.isVerbose())&&sOptionT(s,"cmt:"),2&f&&(p+=2),checkDeflate(p)?(sName="GZIP (.gz)",bDetected=1,X.isVerbose()&&sOption(X.U32(X.Sz()-4,_LE),"unp.sz:")):X.isHeuristicScan()&&(sName="GZIP (.gz)",bDetected=1)}if(!bDetected&&X.isDeepScan()&&X.isHeuristicScan()&&7<X.calculateEntropy(64,256))for(s=1;s<64&&!bDetected;s++)!bDetected&&checkZlib(s)&&(sName="Zlib stream (.zlib)",sOption("@"+Hex(s)),sOption(cmprlvl,"lv:"),bDetected=1),!bDetected&&1<checkDeflate(s)&&(sName="Raw Deflate stream",sOptions="@"+Hex(s),bDetected=1)
return result()}meta("archive")

================================================
FILE: dbs_min/db/Binary/archive.LZ4.1.sg
================================================
function detect(){if(9<=Binary.getSize()){switch(bDetected=1,Binary.read_uint32(0,_BE)){case 35736600:sName="LZ4 compressed data, legacy (.LZ4)"
break
case 69356824:sName="LZ4 compressed data (.LZ4)"
break
case 86134040:sName="LZ5 compressed data (.LZ5)"
break
case 102911256:sName="Lizard compressed data (.LIZ)"
break
default:bDetected=0}var e
bDetected&&(64&(e=Binary.read_uint8(4))&&(sVersion="1.0"),128&e&&(sVersion="2.0"),64&e&&128&e&&(sVersion="3.0"),Binary.isVerbose())&&(1&e&&sOption("PresetDictionary"),4&e&&sOption("ContentChecksum"),8&e&&sOption("ContentSize"),16&e&&sOption("BlockChecksum"),32&e)&&sOption("BlockIndependence")}return result()}meta("archive")

================================================
FILE: dbs_min/db/Binary/archive.MS_Compound.1.sg
================================================
function detect(){var e,r
return Binary.compare("D0CF11E0A1B11AE1")&&(e=Binary.readWord(512),r=Binary.readWord(4096),0==e&&65533==r?(sType="installer",sName="Microsoft Installer (MSI)"):sVersion=42476==e?(sType="format",sName="Microsoft Office","1997-2003"):"Office, 1997-2003",bDetected=1),result()}meta("archive","Microsoft Compound")

================================================
FILE: dbs_min/db/Binary/archive.PC_Secure.sg
================================================
function detect(){return(Binary.compare("'PCT7'22")||Binary.compare("'PCT'..20284b"))&&(bDetected=1),result()}meta("archive","PC Secure")

================================================
FILE: dbs_min/db/Binary/archive.RAR.1.sg
================================================
function detect(){return detect_RAR(1),result()}includeScript("rar-file")

================================================
FILE: dbs_min/db/Binary/archive.ZIP.1.sg
================================================
function detect(){return detect_Zip(1),result()}includeScript("zip-file")

================================================
FILE: dbs_min/db/Binary/archive.ZLIB.1.sg
================================================
function detect(){return detect_zlib(Binary,0)&&(sName="ZLIB data",bDetected=1),result()}meta("data"),includeScript("zlib")

================================================
FILE: dbs_min/db/Binary/archive_7z.1.sg
================================================
function detect(){return 64<=Binary.getSize()&&Binary.compare("'7z'BCAF271C")&&(sVersion=Binary.readByte(6)+"."+Binary.readByte(7),bDetected=1),result()}meta("archive","7-Zip")

================================================
FILE: dbs_min/db/Binary/archive_ANC-Cruncher.1.sg
================================================
function detect(){return Binary.compare("'FVL0'")&&(sOptions="use ANC-Cruncher's CRLoad for unpack and run",bDetected=1),result()}meta("archive","ANC-Cruncher")

================================================
FILE: dbs_min/db/Binary/archive_AR.1.sg
================================================
function detect(){if(Binary.compare("'!<arch>'0A")){bDetected=1
for(var e=8;e<Binary.getSize();){switch(sFileName=Binary.getString(e,16).trim(),e=(e=(e+=16)+12+6)+6+8,nFileSize=parseInt(Binary.getString(e,10)),e=e+10+2,sFileName){case"/":i=void 0,sType="format",sName="COFF Library (.LIB)"
var i=Binary.read_uint32(72,_BE)+60
switch(i=Binary.compare("0000FFFF",i)?Binary.read_uint16(i+6):Binary.read_uint16(i)){case 332:sVersion="I386"
break
case 354:sVersion="R3000"
break
case 448:sVersion="ARM"
break
case 34404:sVersion="AMD64"
break
case 43620:sVersion="ARM64"
break
case 452:sVersion="ARMNT"
break
default:sVersion="Unknown"}break
case"debian-binary":sName="Debian Software package (.DEB)",sVersion=Binary.getString(e,nFileSize-1)
break
case"//":break
default:Archive.add(nFileSize,nFileSize)}e+=nFileSize,1&nFileSize&&(e+=1),0}Binary.isVerbose()&&sOption(Archive.contents())}return result()}includeScript("archive-file"),meta("archive","The archiver (.AR)")

================================================
FILE: dbs_min/db/Binary/archive_ARC.1.sg
================================================
function detect(){return 9<=Binary.getSize()&&Binary.compare("417243010000")&&(bDetected=1),result()}meta("archive","FreeARC Archive (.ARC)")

================================================
FILE: dbs_min/db/Binary/archive_ASAR.1.sg
================================================
function detect(){return 28<=Binary.getSize()&&Binary.compare("04..............................'{\"files\":{'")&&(bDetected=1),result()}meta("archive","Asar Archive (Electron)")

================================================
FILE: dbs_min/db/Binary/archive_BCSAR.1.sg
================================================
function detect(){if(!(!X.c("'CSAR'FE")&&!X.c("'CSAR'FF")||X.U8(5)==X.U8(6)||X.U8(5)<254)){var e=254==X.U8(5)?_LE:_BE
if(8192==X.U32(20,e)&&8193==X.U32(32,e)&&8194==X.U32(44,e)&&X.c("'STRG'",sp=X.U32(24,e))&&X.c("'INFO'",ip=X.U32(36,e))&&X.c("'FILE'",fp=X.U32(48,e)))return bDetected=1,sVersion="v"+X.U32(8,e).toString(16)+"_"+(e==_LE?"le":"be"),X.isVerbose()&&sOption("filenames:"+X.U32(sp+24,e)+" sz:"+outSz(X.U32(12,e))),result()}}meta("archive","Nintendo Binary CTR Sound ARchive (.BCSAR)")

================================================
FILE: dbs_min/db/Binary/archive_BZip.1.sg
================================================
function detect(){return 9<=Binary.getSize()&&(Binary.compare("'BZ0'")?(sVersion="1.0",sOptions="compressed data (.BZ)",bDetected=1):Binary.compare("'BZh'")&&Binary.compare("314159265359",4)&&(sName="BZip2 compressed data (.BZ2)",bDetected=1),bDetected)&&Binary.isVerbose()&&(sOptions="block-size:"+Binary.getString(3,1)+"00 kb"),result()}meta("archive","BZip")

================================================
FILE: dbs_min/db/Binary/archive_CCA.1.sg
================================================
function detect(){return Binary.compare("'PAME'0702")&&(bDetected=1),result()}meta("archive","Click & Create Archive (.CCA)")

================================================
FILE: dbs_min/db/Binary/archive_CFL3.1.sg
================================================
function detect(){var e=t=0
if(!X.c("'CFL3")&&X.c("'3CFL'",X.Sz()-4)){if(!X.c("'CFL3'",t=X.Sz()-X.U32(X.Sz()-8)))return!1
e=t}var r=X.U32(e+4)
return r+=12+X.U32(r+4),!!X.c("'3CFL'",r)&&(bDetected=1,X.isVerbose()&&(e&&sOption("begins @"+Hex(e)),sOption(outSz(r+4-e),"sz:")),result())}meta("archive","Jari Comppa's Compressed File Library 3 file (.CFL)")

================================================
FILE: dbs_min/db/Binary/archive_CKP.1.sg
================================================
function detect(){return Binary.compare("'.CKP'0001")&&(bDetected=1),result()}meta("archive","CKP")

================================================
FILE: dbs_min/db/Binary/archive_Cab.1.sg
================================================
function detect(){if(!detect_Cab(0,Binary.getSize())&&Binary.compare("'ISc('")){sName="InstallShield Cabinet File"
var e=Binary.readWord(4)
switch(Binary.readByte(7)){case 1:sVersion=e>>12&15
break
case 2:case 4:sVersion=(e/100).toFixed(2)}bDetected=1}return result()}includeScript("cab"),meta("archive","CAB")

================================================
FILE: dbs_min/db/Binary/archive_DAA.1.sg
================================================
function detect(){return Binary.compare("'DAA'0000000000000000000000004C")&&(bDetected=1),result()}meta("archive","Direct Access Archive (.DAA)")

================================================
FILE: dbs_min/db/Binary/archive_DCP.1.sg
================================================
function detect(){var e
return Binary.compare("DE AD C0 DE 4A 55 4E 4B")&&(e=Binary.getString(58,5).trim(),/^[12]\d{3}$/.test(e))&&(sVersion=e,bDetected=1),result()}meta("archive","DCP")

================================================
FILE: dbs_min/db/Binary/archive_DXA.1.sg
================================================
function detect(){return Binary.compare("f70ee9a")?(sOptions="Arcanum Knights",sVersion="xored",bDetected=1):Binary.compare("e94c..69")&&(sOptions="Labyrinth of Touhou 2",sVersion="xored",bDetected=1),result()}meta("archive","DXA")

================================================
FILE: dbs_min/db/Binary/archive_DatPack.1.sg
================================================
function detect(){return Binary.compare("07'DatPack'f75b3500e701")&&(bDetected=1),result()}meta("archive","DatPack")

================================================
FILE: dbs_min/db/Binary/archive_DotBundle.sg
================================================
function detect(){return Binary.compare("3C70726F6A6563743E0D0A20203C6D61696E65786520706174683D")&&(bDetected=1),result()}meta("archive","DotBundle Project")

================================================
FILE: dbs_min/db/Binary/archive_EdgeDataPak.1.sg
================================================
function detect(){return Binary.compare("'.EDP'0001")&&(bDetected=1),result()}meta("archive","EdgeDataPak (.EDP)")

================================================
FILE: dbs_min/db/Binary/archive_Flatpak.1.sg
================================================
function detect(){var e
return Binary.compare("66 6C 61 74 70 61 6B")&&(e=Binary.getString(24,33).trim(),/^[a-zA-Z0-9\/._-]{33}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("archive","Flatpak")

================================================
FILE: dbs_min/db/Binary/archive_GhidraZipFile.1.sg
================================================
function detect(){return Binary.compare("aced000577..2e30212634e92c200000000100")&&(sOptions=File.cleanString(Binary.getString(20)),bDetected=1),result()}meta("archive","Ghidra Zip File")

================================================
FILE: dbs_min/db/Binary/archive_GodotPCK.1.sg
================================================
function detect(){return Binary.compare("'GDPC'0100000003000000..000000")&&(bDetected=1),result()}meta("archive","Godot Pack")

================================================
FILE: dbs_min/db/Binary/archive_HIP.1.sg
================================================
function detect(){return Binary.compare("'HIPA'00000000'PACK'00000090")&&(sVersion=Binary.getString(88)).match(/^[A-Za-z]{3}\s[A-Za-z]{3}\s\d{1,2}\s\d{2}:\d{2}:\d{2}\s\d{4}$/)&&(sVersion="Build date: "+sVersion,bDetected=1),result()}meta("archive","HIP archive")

================================================
FILE: dbs_min/db/Binary/archive_IFP.1.sg
================================================
function detect(){var e
return Binary.compare("'ANP3'")&&(e=Binary.getString(3,1).trim(),/^[0-9]{1}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("archive","Animation file")

================================================
FILE: dbs_min/db/Binary/archive_IPW.1.sg
================================================
function detect(){return Binary.compare("'DT1'00c3030000")&&(bDetected=1),result()}meta("archive","Peril WAD")

================================================
FILE: dbs_min/db/Binary/archive_InnoSetup.1.sg
================================================
function detect(){return Binary.compare("'idska32'1a")&&(bDetected=1),result()}meta("archive","Inno Setup")

================================================
FILE: dbs_min/db/Binary/archive_JAM.1.sg
================================================
function detect(){return bDetected=Binary.compare("'LJAM'0000000002000000"),result()}meta("archive","JAM")

================================================
FILE: dbs_min/db/Binary/archive_LAB.1.sg
================================================
function detect(){return Binary.compare("'LABN'00000100")&&(bDetected=1),result()}meta("archive","LucasArts Binary Archive")

================================================
FILE: dbs_min/db/Binary/archive_LRZ.1.sg
================================================
function detect(){if(9<=Binary.getSize()&&Binary.compare("'LRZI'")){switch(bDetected=1,sVersion=Binary.read_uint8(4)+"."+Binary.read_uint8(5),Binary.read_uint8(49)){case 3:break
case 4:sOption("BZIP2")
break
case 5:sOption("LZO")
break
case 6:sOption("LZMA")
break
case 7:sOption("GZIP")
break
case 8:sOption("ZPAQ")
break
default:bDetected=0}switch(Binary.read_uint8(22)){case 0:break
case 1:sOption("encrypted")
break
default:bDetected=0}switch(Binary.read_uint8(21)){case 0:break
case 1:sOption("md5")
break
default:bDetected=0}}return result()}meta("archive","Long Range ZIP (.LRZ)")

================================================
FILE: dbs_min/db/Binary/archive_LZOP.1.sg
================================================
function detect(){return 9<=Binary.getSize()&&(bDetected=Binary.compare("89'LZO'000D0A1A0A")),result()}meta("archive","LZOP compressed data")

================================================
FILE: dbs_min/db/Binary/archive_MCS.1.sg
================================================
function detect(){var e
return Binary.compare("'AHFFMACS0200'")&&(e=Binary.getString(15,12).trim(),/^[A-Z/!]{12}/.test(e))&&(X.isVerbose()&&(sOptions=e),bDetected=!0),result()}meta("archive","MCS")

================================================
FILE: dbs_min/db/Binary/archive_MS-WIM.1.sg
================================================
function detect(){if(9<=Binary.getSize())if(Binary.compare("'MSWIM'000000")){switch(Binary.isVerbose()&&(sOptions="{"+Binary.read_UUID(24)+"}"),bDetected=1,Binary.read_uint16(18)){case 0:sOption("No compression")
break
case 2:sOption("XPRESS compression")
break
case 4:sOption("LZX compression")
break
case 8:sOption("LZMS compression")
break
default:bDetected=0}sOption("Part Number:"+Binary.read_uint16(40)+"/"+Binary.read_uint16(42))}else Binary.compare("'WLPWM'000000")&&(sName+=", wimlib",bDetected=1)
return result()}meta("archive","Windows Imaging Format (.WIM)")

================================================
FILE: dbs_min/db/Binary/archive_MWD.1.sg
================================================
function detect(){var t
return Binary.compare("44 41 57 4D")&&(t=Binary.getString(24,29).trim(),/^[A-Z][a-z]+, \d{1,2}(?:st|nd|rd|th) [A-Z][a-z]+ \d{4}$/.test(t))&&(sOptions="Creation date: "+t,bDetected=1),result()}meta("archive","Medievil WAD")

================================================
FILE: dbs_min/db/Binary/archive_P2L.1.sg
================================================
function detect(){var e
return Binary.compare("'PSMLST PSM'")&&(e=Binary.getString(11,4).trim(),/^[0-9\.]{4}$/.test(e))&&(sVersion=e,bDetected=1),result()}meta("archive","PSM Soundsystem (.P2L)")

================================================
FILE: dbs_min/db/Binary/archive_PAK.1.sg
================================================
function detect(){var e
return Binary.compare("'DPAK'0000010018000000")?(sVersion="Lego Creator",bDetected=1):Binary.compare("'PACK'7faf000080")?bDetected=1:Binary.compare("'RWPACK'0000000080")?(sOptions="PAK Compiler (Raymond Wilson 2008)",bDetected=1):Binary.compare("'MUDGE4'2e30")&&(e=(sVersion=Binary.getString(8)).match(/(\d{2})\/(\d{2})\/(\d{4}).*Copyright\s+(.+?)(?:\x00|$)/i))&&(sVersion=e[1]+"/"+e[2]+"/"+e[3]+", "+e[4].trim(),bDetected=1),result()}meta("archive","PAK")

================================================
FILE: dbs_min/db/Binary/archive_PBP.1.sg
================================================
function detect(){var t
return Binary.compare("00 50 42 50")&&(t=Binary.getString(41,3).trim(),/^[A-Z]{3}/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("archive","PlayStation Update Package")

================================================
FILE: dbs_min/db/Binary/archive_PEA.1.sg
================================================
function detect(){if(10<=Binary.getSize()&&Binary.compare("EA")&&Binary.compare("0000'POD'00",10)&&(sVersion="v"+Binary.read_uint8(1)+"."+Binary.read_uint8(2),bDetected=1)&&Binary.isVerbose())switch(Binary.read_uint8(3)){case 0:sOption("NOALGO")
break
case 1:sOption("ADLER32")
break
case 2:sOption("CRC32")
break
case 3:sOption("CRC64")
break
case 16:sOption("MD5")
break
case 17:sOption("RIPEMD160")
break
case 18:sOption("SHA1")
break
case 19:sOption("SHA256")
break
case 20:sOption("SHA512")
break
case 21:sOption("WHIRLPOOL")
break
case 22:sOption("SHA3_256")
break
case 23:sOption("SHA3_512")
break
case 24:sOption("BLAKE2S")
break
case 25:sOption("BLAKE2B")
break
default:bDetected=0}return result()}meta("archive","PeaZip (.PEA)")

================================================
FILE: dbs_min/db/Binary/archive_PKG.1.sg
================================================
function detect(){var e
return Binary.compare("7F 50 4B 47")&&(e=Binary.getString(48,48).trim(),/^[A-Z0-9]{6,7}-[A-Z0-9]{9}_00-[A-Z0-9]{16,18}$/.test(e))&&(X.isVerbose()&&(sOptions="ContentID: "+e),bDetected=1),result()}meta("archive","System Software Update Packages")

================================================
FILE: dbs_min/db/Binary/archive_PSARC.1.sg
================================================
function detect(){return Binary.compare("50534152000100037a6c6962")&&(sVersion="1.3",sOptions="zlib",bDetected=1),result()}meta("archive","PSARC")

================================================
FILE: dbs_min/db/Binary/archive_PUP.1.sg
================================================
function detect(){return Binary.compare("'SCEUF'0000....000000")?(sVersion="PS3/PS Vita",bDetected=1):Binary.compare("'SLB2'..0000000000....02")&&(sVersion="PS4/PS5",bDetected=1),result()}meta("archive","PlayStation Update Package")

================================================
FILE: dbs_min/db/Binary/archive_RVZ.1.sg
================================================
function detect(){var e
return Binary.compare("'RVZ'")&&(e=Binary.getString(88,6).trim(),/^[A-Z0-9]{6}$/.test(e))&&(X.isVerbose()&&(sOptions="GameID: "+e),bDetected=1),result()}meta("archive","RVZ")

================================================
FILE: dbs_min/db/Binary/archive_STK.1.sg
================================================
function detect(){var e
return 64<Binary.getSize()&&Binary.compare("'STK2.' %%")&&(e=Binary.getString(6,32).trim(),/^[0-9]{10,}[A-Za-z0-9]{5,}/.test(e))&&(X.isVerbose()&&(sOptions="Magic signature: "+e),sVersion=Binary.getString(3,3).trim(),/^2\.[0-9]$/.test(sVersion))&&(bDetected=1),result()}meta("archive","STK")

================================================
FILE: dbs_min/db/Binary/archive_Shaped.1.sg
================================================
function detect(){var e
return Binary.compare("'Shaped'")&&(e=Binary.getString(28,4).trim(),/^[12]\d{3}$/.test(e))&&(sOptions=e,bDetected=1),result()}meta("archive","Shaped (.SHP)")

================================================
FILE: dbs_min/db/Binary/archive_TRE.1.sg
================================================
function detect(){return Binary.compare("'EERT5000'....0000")&&(bDetected=1),result()}meta("archive","TRE")

================================================
FILE: dbs_min/db/Binary/archive_Unity.1.sg
================================================
function detect(){var e,n,i
if(7<=Binary.getSize())if(Binary.compare("'UnityFS'00"))sName+="/UnityFS",e=Binary.read_uint32(8,_BE),n=Binary.getString(18),i=Binary.getString(12),n&&i&&(sVersion=(sVersion=(sVersion=sVersion.append("FileVer:"+e)).append("EngineVer:"+n)).append("MinPlayerVer:"+i),bDetected=1)
else if(Binary.compare("'UnityRaw'00"))sName+="/UnityRaw",e=Binary.read_uint32(9,_BE),n=Binary.getString(19),i=Binary.getString(13),n&&i&&(sVersion=(sVersion=(sVersion=sVersion.append("FileVer:"+e)).append("EngineVer:"+n)).append("MinPlayerVer:"+i),bDetected=1)
else if(Binary.compare("'UnityWeb'00"))sName+="/UnityWeb",e=Binary.read_uint32(9,_BE),n=Binary.getString(19),i=Binary.getString(13),n&&i&&(sVersion=(sVersion=(sVersion=sVersion.append("FileVer:"+e)).append("EngineVer:"+n)).append("MinPlayerVer:"+i),bDetected=1)
else if(0==Binary.read_uint32(16,_BE)){switch(sName+="/Unity Asset",e=Binary.read_uint32(8,_BE)){case 9:case 15:case 17:case 20:case 21:n=Binary.getString(20)
break
case 22:n=Binary.getString(48)}n&&e<=22&&8<=e&&(sVersion=(sVersion=sVersion.append("FileVer:"+e)).append("EngineVer:"+n),bDetected=1)}return result()}meta("archive","Unity")

================================================
FILE: dbs_min/db/Binary/archive_UnrealEngine.1.sg
================================================
function detect(){if(1024<=Binary.getSize())if(Binary.compare("C1832A9E")){bDetected=1,sName+="\\Unreal Package"
var e=Binary.read_uint16(4),a=Binary.read_uint16(6)
sVersion=sVersion.append(e,a)}else if(Binary.compare("E1126F5A",Binary.getSize()-204)){switch(bDetected=1,sName+="\\UE4 package (.PAK)",sVersion=Binary.read_uint32(Binary.getSize()-200),Binary.read_uint8(Binary.getSize()-206)){case 0:break
case 1:sOptions=sOptions.append("Index Is Encrypted")
break
default:bDetected=0}sOptions=sOptions.append(Binary.getString(Binary.getSize()-160))}return result()}meta("archive","UnrealEngine")

================================================
FILE: dbs_min/db/Binary/archive_ViseInstaller.1.sg
================================================
function detect(){return Binary.compare("'ESIV'abbc19")&&(sOptions="Big endian",bDetected=1),result()}meta("archive","Vise Installer")

================================================
FILE: dbs_min/db/Binary/archive_XZP.1.sg
================================================
function detect(){return Binary.compare("'BDES'00000001")&&(bDetected=1),result()}meta("archive","XBox Zip File (.XZP)")

================================================
FILE: dbs_min/db/Binary/archive_ZPAQ.1.sg
================================================
function detect(){return 9<=Binary.getSize()&&Binary.compare("'7kSt'")&&Binary.compare("'zPQ'",13)&&(bDetected=1),result()}meta("archive","ZPAQ Compressed Archive (.ZPAQ)")

================================================
FILE: dbs_min/db/Binary/archive_archives.1.sg
================================================
function detect(){if(Binary.compare("a596fdff"))bDetected=1,sName="FTCOMP"
else if(Binary.compare("a596..0a"))bDetected=1,sName="IBMPACK1"
else if(Binary.compare("a596feff"))bDetected=1,sName="IBMPACK2"
else if(Binary.compare("aced00057704"))bDetected=1,sName="IzPack"
else if(Binary.compare("'bvxn'"))bDetected=1,sName="LZFSE"
else if(Binary.compare("'SIT!'"))bDetected=1,sName="SIT"
else if(Binary.compare("06'SKF3.0'"))bDetected=1,sName="SKF"
else if(Binary.compare("'Archive'00................2800000064"))bDetected=1,sName="ArcFS"
else if(Binary.compare("'ARCV'0002"))bDetected=1,sName="ARCV 2"
else if(Binary.compare("09006bea"))bDetected=1,sName="BFF"
else if(Binary.compare("00069a")||Binary.compare("0006d2"))bDetected=1,sName="DCL"
else if(Binary.compare("....'-lh'..2d")||Binary.compare("....'-lz'..2d")||Binary.compare("....'-pm'..2d"))switch(sVersion=Binary.getString(2,5),bDetected=1,Binary.getString(3,3)){case"lh0":case"lh1":case"lh2":case"lh3":case"lh4":case"lh5":case"lh6":case"lh7":case"lhd":sName="LHA (.LHA)"
break
case"lh8":case"lh9":case"lha":case"lhb":case"lhc":case"lhe":sName="LHA",sOptions="Joe Jared ext (.LHA)"
break
case"lhx":sName="LHA",sOptions="UNLHA32 ext (.LHA)"
break
case"lzs":case"lz2":case"lz3":case"lz4":case"lz5":case"lz6":case"lz7":case"lz8":sName="LHA ",sOptions="LArc ext (.LZS)"
break
case"lz7":case"pm0":case"pm2":sName="LHA archive, PMarc ext (.PMA)"
break
default:bDetected=0}else if(Binary.compare("'mflh'0100"))bDetected=1,sName="MVA"
else if(Binary.compare("'ViG'....1a"))bDetected=1,sName="PaperPort"
else if(Binary.compare("'sqsh'0000"))bDetected=1,sName="SquashFS",sOptions="big endian"
else if(Binary.compare("'hsqs'0300"))bDetected=1,sName="SquashFS",sOptions="little endian"
else if(Binary.compare("'im001V'......50....0000")){sName="SW",bDetected=1
var e=Binary.readByte(14)+15
Binary.compare("1f9d",e)?sName="Z":Binary.compare("1f1e",e)&&(sName="PACK 2")}else if(Binary.compare("0001000401000100010000000000000000000000000000000000000000000000010101"))bDetected=1,sName="VMS SaveSet"
else if(Binary.compare("'ZOO'............'Archive'"))bDetected=1,sName="ZOO"
else if(Binary.compare("602213636c00"))bDetected=1,sName="Asymetrix"
else if(Binary.compare("453dcd28........................'Compressed ROMFS'"))bDetected=1,sName="CRAMFS"
else if(Binary.compare("'IsZ!@'01"))switch(bDetected=1,sName="Zipped ISO Disk Image (.ISZ)",Binary.read_uint32(16)){case 0:sOptions="no password"
break
case 1:sOptions="password"
break
case 2:sOptions="password, aes128"
break
case 3:sOptions="password, aes182"
break
case 4:sOptions="password, aes256"}else if(Binary.compare("aa59f0000002"))bDetected=1,sName="SaveDskF"
else if(Binary.compare("'AlB'1a"))bDetected=1,sName="BeOS package"
else if(Binary.compare("'BIGF'00"))bDetected=1,sName="BIGF"
else if(Binary.compare("01ca'Copyright (c) Genus Microprogramming, Inc.'"))bDetected=1,sName="GXL"
else if(Binary.compare("0100......00ecf9"))bDetected=1,sName="INSA"
else if(Binary.compare("..0fd28ccc1f..3c0d8e830dd88f25ac"))bDetected=1,sName="InstallShield ISN"
else if(Binary.compare("135d658c3a010200"))bDetected=1,sName="InstallShield",sVersion="3.x"
else if(Binary.compare("2aab79d800010000"))bDetected=1,sName="InstallShield INST",sVersion="3.x"
else if(Binary.compare("'SZDD'88"))bDetected=1,sName="SZDD",sOptions="by Microsoft"
else if(Binary.compare("'KWAJ'88"))bDetected=1,sName="KWAJ",sOptions="by Microsoft"
else if(Binary.compare("'MDmd'"))bDetected=1,sName="MDCD"
else if(Binary.compare("'MPQ'1a"))bDetected=1,sName="MPQ",sOptions="by Blizzard"
else if(Binary.compare("'_MCT'00'KSLZ'789c"))bDetected=1,sName="MSKN 2",sOptions="zlib"
else if(Binary.compare("'PACK'............0000"))bDetected=1,sName="PACK"
else if(Binary.compare("'PACK'")&&0<File.read_uint32(4,_BE)&&File.read_uint32(4,_BE)<=3)bDetected=1,sName="Packed git objects (.pack)",sVersion="v"+File.read_uint32(4,_BE),sOptions=File.read_uint32(8,_BE)+" object(s)"
else if(Binary.compare("FF'tOc'00000002"))sName="Index of packed git objects (.idx)",sVersion="v"+File.read_uint32(4,_BE),bDetected=1
else if(Binary.compare("'RIDX'00000001")&&0<File.read_uint32(8,_BE)&&File.read_uint32(8,_BE)<=2)switch(sName="Reverse index of packed git objects (.rev)",sVersion="v1",bDetected=1,File.read_uint32(8,_BE)){case 1:sOptions="SHA-1 hashes"
break
case 2:sOptions="SHA-256 hashes"
break
default:sOptions="unknown hashes"}else Binary.compare("00000000000000000000000000007400010074000500")?(bDetected=1,sName="PCInstall"):Binary.compare("'PP20'09")?(bDetected=1,sName="PowerPack",sOptions="by Nico Francois"):Binary.compare("edabeedb0300")?(bDetected=1,sName="RPM package"):Binary.compare("bd01..00..00..000000")?(bDetected=1,sName="HUFF"):Binary.compare("'SZ '88")?(bDetected=1,sName="SZ",sOptions="by Microsoft"):Binary.compare("'BAGF'02")?(bDetected=1,sName="BAGF"):Binary.compare("'PAC - 'a9' BVRP Software 1990-2000'")?(bDetected=1,sName="PAC",sOptions="1990-2000 by BVRP Software"):Binary.compare("'Cr24'02")?(bDetected=1,sName="CRX"):Binary.compare("74c42c84e1e5d428")?(bDetected=1,sName="InstallShield INX",sVersion="7.x"):Binary.compare("5d0000....ffffffffffffffff00180ddd04")||Binary.compare("5d00008000........000000000000")?(bDetected=1,sName="LZMA"):Binary.compare("1fa0")?(bDetected=1,sName="SCO"):Binary.compare("'# PaCkAgE DaTaStReAm'")?(bDetected=1,sName="Solaris Package"):Binary.compare("'SQZE'010000")?(bDetected=1,sName="SQZE"):Binary.compare("'xar!'001c00010000")?(bDetected=1,sName="XAR"):Binary.compare("fd'7zXZ'00")&&(bDetected=1,sName="XZ")
return bDetected||(File.getSize()<3||!File.compare("1F9D")||(t=File.read_uint8(2),sversion=128&t?"new":"old",(t&=127)<9)||16<t?Binary.compare("'LZK00'000000")?(bDetected=1,sName="LZK00"):Binary.compare("032401010100")?(bDetected=1,sName="WPK"):Binary.compare("'TPWM'")?(bDetected=1,sName="TPWM (BlueByte)"):500<=Binary.getSize()&&Binary.compare("00'ustar'",256)?(bDetected=1,sName="tar"):Binary.compare("'LB'0100")?(bDetected=1,sName="XFL game resource file (.XFL)",sVersion="v1.0",sOptions=(sOptions=sOptions.append(Binary.getString(12,32))).append("& other "+(Binary.readDword(8)-1)+" files")):Binary.compare("FF060000'sNaPpY'")?(bDetected=1,sName="Snappy compressed data (.SZ)"):Binary.compare("'blkzip'00")?(bDetected=1,sName="BulkZip (.BULK)"):Binary.compare("AE01'NanoZip 0.09 alpha'")?(bDetected=1,sName="NanoZip (.NZ)",sVersion="0.09 alpha"):Binary.compare("'CM'2805060000")?(bDetected=1,sName="RAZOR (.RZ)",sOptions="by Christian Martelock"):Binary.compare("28B52FFD")?(bDetected=1,sName="Facebook Zstandard/ZSTD compressed data (.ZST)"):Binary.compare("00'APPL'",64)&&Binary.compare("00008181",120)&&(bDetected=1,sName="MacBinary"):(sName="Compress (.Z)",sVersion=sversion,bDetected=1)),result()}meta("archive","")

================================================
FILE: dbs_min/db/Binary/archive_archives.ancient.sg
================================================
function detect() {
    var u = 1073741824
    var o = "", a = sversion = soptions = ""
    var z = [0, 49345, 49537, 320, 49921, 960, 640, 49729, 50689, 1728, 1920, 51009, 1280, 50625, 50305, 1088, 52225, 3264, 3456, 52545, 3840, 53185, 52865, 3648, 2560, 51905, 52097, 2880, 51457, 2496, 2176, 51265, 55297, 6336, 6528, 55617, 6912, 56257, 55937, 6720, 7680, 57025, 57217, 8e3, 56577, 7616, 7296, 56385, 5120, 54465, 54657, 5440, 55041, 6080, 5760, 54849, 53761, 4800, 4992, 54081, 4352, 53697, 53377, 4160, 61441, 12480, 12672, 61761, 13056, 62401, 62081, 12864, 13824, 63169, 63361, 14144, 62721, 13760, 13440, 62529, 15360, 64705, 64897, 15680, 65281, 16320, 16e3, 65089, 64001, 15040, 15232, 64321, 14592, 63937, 63617, 14400, 10240, 59585, 59777, 10560, 60161, 11200, 10880, 59969, 60929, 11968, 12160, 61249, 11520, 60865, 60545, 11328, 58369, 9408, 9600, 58689, 9984, 59329, 59009, 9792, 8704, 58049, 58241, 9024, 57601, 8640, 8320, 57409, 40961, 24768, 24960, 41281, 25344, 41921, 41601, 25152, 26112, 42689, 42881, 26432, 42241, 26048, 25728, 42049, 27648, 44225, 44417, 27968, 44801, 28608, 28288, 44609, 43521, 27328, 27520, 43841, 26880, 43457, 43137, 26688, 30720, 47297, 47489, 31040, 47873, 31680, 31360, 47681, 48641, 32448, 32640, 48961, 32e3, 48577, 48257, 31808, 46081, 29888, 30080, 46401, 30464, 47041, 46721, 30272, 29184, 45761, 45953, 29504, 45313, 29120, 28800, 45121, 20480, 37057, 37249, 20800, 37633, 21440, 21120, 37441, 38401, 22208, 22400, 38721, 21760, 38337, 38017, 21568, 39937, 23744, 23936, 40257, 24320, 40897, 40577, 24128, 23040, 39617, 39809, 23360, 39169, 22976, 22656, 38977, 34817, 18624, 18816, 35137, 19200, 35777, 35457, 19008, 19968, 36545, 36737, 20288, 36097, 19904, 19584, 35905, 17408, 33985, 34177, 17728, 34561, 18368, 18048, 34369, 33281, 17088, 17280, 33601, 16640, 33217, 32897, 16448]
    function d(e, s, r) {
        if (!s || e + s > X.Sz()) return -1
        for (var n = 0; n < s; n++)r = r >> 8 ^ z[255 & r ^ X.U8(e + n)]
        return r
    } function r(e, s, r) { return void 0 === File.crc16 ? d(e, s, r) : (_log("Please remove the CRC16 implementation from archives.ancient.sg!"), File.crc16(e, s, r)) } var s = found = !1
    function e() {
        if (!(!X.c("1F1E") && !X.c("1F1F") || X.Sz() < 6)) {
            if (old = X.c("1F1F")) unpsz = X.U16(2, _LE) << 16 | X.U16(4, _LE)
            else if (unpsz = X.U32(2, _BE), !(t = X.U8(6)) || 24 < t || 6 + t > X.Sz()) return
            if (!(unpsz > u || old && !unpsz)) {
                if (old) {
                    var e = 6, o = [], c = X.U16(e, _LE)
                    if (e += 2, 1024 <= c) return
                    for (i = 0; i < c; i++)(t = X.U8(e++)) < 255 ? o[i] = t : (o[i] = X.U16(e, _LE), e += 2)
                    var a = !0
                    return function e(s, r, n) { a && (c < s ? a = !1 : o[s] ? 24 < ++r || (e(s + o[s], r, n <<= 1), c <= s + 1) ? a = !1 : e(s + o[s + 1], r, 1 | n) : r || (a = !1)) }(0, 0, 0), a
                } return 1
            }
        }
    } function n() {
        var r, s = X.U32(0, _BE), e = X.readBytes(0, 3), n = X.SA(0, 4)
        if ((function () {
            if (134810120 <= s && s <= 134810126 && 134810121 != s) return gen = 2
            if (8 <= (255 & s) && (255 & s) <= 14 && e[0] != e[1] && e[0] != e[2] && e[1] != e[2]) return gen = 1
            switch (n.slice(0, 3)) {
                case "1AM": return gen = 3, 1
                case "2AM": return gen = 6, 1
            }switch (n) {
                case "S300": return gen = 3, 1
                case "S310": return gen = 4, 1
                case "S400": return gen = 5, 1
                case "S401": return gen = 6, 1
                case "S403": case "Z&G!": case "ZULU": return gen = 7, 1
                case "S404": case "AYS!": return gen = 8, 1
                default: return
            }
        })()) return r = [], sz = unpsz = -1, 2 != gen || o() || (gen = 1), o() ? (names = [["?", "?"], ["SC", "v2.69-81"], ["SC", "v2.92-99"], ["S300", "v3.00"], ["S310", "v3.10-11b"], ["S400", "pre-v4.00"], ["S401", "v4.01"], ["S403", "v4.02a"], ["S404", "v4.10"]][gen], 1) : void 0
        function t(e) {
            for (var s = 0; s < 4; s++) {
                if (r[s] = e >> 24, r[s] < 8 || 14 < r[s]) return
                e <<= 8
            }
        } function o() {
            switch (gen) {
                case 1: if (p = 18, X.Sz() < p) return
                    for (r[0] = s, i = 1; i < 3; i++)if (r[i] = X.U8(i + 15), r[i] < 4 || 7 < r[i]) return
                    var e = X.U32(4, _BE)
                    if (!e) return
                    if (!(unpsz = X.U32(8, _BE)) || e > unpsz || 1048576 < unpsz) return
                    if (!(sz = X.U32(12, _BE)) || sz > e) return
                    break
                case 2: t(s)
                case 4: case 5: case 6: if (p = 12, X.Sz() < p) return
                    if (!(unpsz = X.U32(4, _BE))) return
                    if (sz = X.U32(8, _BE)) break
                    return
                case 3: if (p = 16, X.Sz() < p) return
                    if (t(X.U32(4, _BE)), !(unpsz = X.U32(8, _BE))) return
                    if (sz = X.U32(12, _BE)) break
                    return
                case 7: case 8: if (p = 16, X.Sz() < p + 2) return
                    if (!(unpsz = X.U32(8, _BE))) return
                    if ((sz = X.U32(12, _BE) + 2) < 2) return
                    break
                default: return
            }return !((sz += p) > X.Sz() || sz > u || unpsz > u)
        }
    } return (function (e) {
        if (found) return 1
        if (!(4 <= e || s || X.c("'XPKF'", 0) && X.Sz() < 44 || (sz = X.U32(4, _BE), type = X.SA(8, 4), unpsz = X.U32(12, _BE), !sz) || !unpsz || sz > u || unpsz > u || (flags = X.U8(32), xhdrs = 1 & flags, haspass = 2 & flags, hdrsz = 4 & flags ? 38 + X.U16(36, _BE) : 36, 0 + sz + 8 > X.Sz()))) {
            for (cccc = [[/ACCA/, "André Osterhues's Code Compression Algorithm (XPK-ACCA.)"], [/ARTM/, "Arithmetic encoding compressor (XPK-ARTM.)"], [/BLZW/, "LZW-compressor by Bryan Ford (XPK-BLZW.)"], [/BZIP/, "bzip by Julian Seward (XPK-BZIP."], [/BZP2/, "bzip2 by Julian Sadler (XPK-BZP2.)"], [/CBR[01]/, "RLE-compressor by Bilbo 1st of Hypenosis (XPK-CBR0.,XPK-CBR1.)"], [/CRM2/, "Crunch-Mania by Thomas Schwarz, LZH-mode (XPK-CRM2.)"], [/CRMS/, "Crunch-Mania by Thomas Schwarz, sampled LZH-mode (XPK-CRMS.)"], [/CYB[12]/, "XpkCybPrefs container by Alexis Nasr (XPK-CYB1.,XPK-CYB2.)"], [/GZIP/, "DEFLATE by Jean-loup Gailly (XPK-GZIP.)"], [/DLTA/, "Delta encoding by Stephan Fuhrmann (XPK-DLTA.)"], [/FAST/, "Fast LZ77 compressor by Christian von Roques (XPK-FAST.)"], [/FBR2/, "FBR2 CyberYAFA compressor (XPK-FBR2.)"], [/FRLE/, "RLE-compressor by Jorma Oksanen (XPK-FRLE.)"], [/HFMN/, "Huffman compressor (XPK-HFMN.)"], [/HUFF/, "Huffman compressor by Marc Zimmermann (XPK-HUFF.)"], [/ILZR/, "Incremental Lempel-Ziv-Renau compressor (XPK-ILZR.)"], [/IMPL/, "File Imploder by Peter Struijk (XPK-IMPL.)"], [/LHLB/, "LZRW-compressor by Gunther Nikl (XPK-LHLB.)"], [/LIN1/, "LIN1 LINO packer (XPK-LIN1.)"], [/LIN3/, "LIN3 LINO packer (XPK-LIN3.)"], [/LIN2/, "LIN2 LINO packer (XPK-LIN2.)"], [/LIN4/, "LIN4 LINO packer (XPK-LIN4.)"], [/LZBS/, "LZBS CyberYAFA compressor (XPK-LZBS.)"], [/LZCB/, ": LZ-compressor (XPK-LZCB.)"], [/LZW2/, "LZW2 CyberYAFA compressor (XPK-LZW2.)"], [/LZW3/, "LZW3 CyberYAFA compressor (XPK-LZW3.)"], [/LZW4/, "LZW4 CyberYAFA compressor (XPK-LZW4.)"], [/LZW5/, "LZW5 CyberYAFA compressor (XPK-LZW5.)"], [/ELZX/, "LZX-compressor by Piotr Kasprzyk (XPK-ELZX.)"], [/SLZX/, "LZX-compressor with delta encoding by Piotr Kasprzyk (XPK-SLZX.)"], [/MASH/, "LZRW-compressor by Zdenek Kabelac (XPK-MASH.)"], [/NONE/, "Null compressor by Dirk Stöcker (XPK-NONE.)"], [/NUKE/, "LZ77-compressor by Christian von Roques (XPK-NUKE.)"], [/DUKE/, "LZ77-compressor by Christian von Roques, with delta encoding (XPK-DUKE.)"], [/PWPK/, "Power Peak's PowerPacker by Nico François (XPK-PWPK.)"], [/PPMQ/, "PPM compressor by Charles Bloom (XPK-PPMQ.)"], [/(FRHT|RAKE)/, "LZ77-compressor (XPK-FRHT.,XPK-RAKE.)"], [/RDCN/, "Ross data compression (XPK-RDCN.)"], [/RLEN/, "RLE-compressor (XPK-RLEN.)"], [/SDHC/, "Sample delta Huffman compressor (XPK-SDHC.)"], [/SHR[I3]/, "LZ-compressor with arithmetic encoding by Matthias Meixner (XPK-SHR3.,XPK-SHRI)"], [/SLZ3/, "SLZ3 CyberYAFA compressor by Niels Fröhling (XPK-SLZ3.)"], [/SMPL/, "Huffman compressor with delta encoding (XPK-SMPL.)"], [/SQSH/, "Squash compressor for sampled sounds by John Hendrikx (XPK-SQSH.)"], [/SASC/, "LZ-compressor with arithmetic and delta encoding (XPK-SASC.)"], [/SHSC/, "Context modeling compressor by Peter Kunath (XPK-SHSC.)"], [/TDCS/, "LZ77-compressor by Niels Fröhling (XPK-TDCS.)"], [/ZENO/, "LZW-compressor (XPK-ZENO.)"], [/BLFH/, "Blowfish encryption by Bruce Schneider (XPK-BLFH.)"], [/BZIP/, "Encapsulated Bzip v1 (XPK-BZIP.)"], [/CAST/, "CAST encryption by Dirk Pauli (XPK-CAST.)"], [/ENCO/, "Unsafe encryption (XPK-ENCO.)"], [/DHUF/, "Huffman compressor (lost) (XPK-DHUF.)"], [/DMCB/, "68881/2 fp-based arithmetic compressor (XPK-DMCB.)"], [/DMCD/, "68881/2 fp-based arithmetic compressor (XPK-DMCD.)"], [/DMCI/, "Arithmetic compressor (lost) (XPK-DMCI.)"], [/DMCU/, "68881/2 fp-based arithmetic compressor (XPK-DMCU.)"], [/FEAL/, "FEAL-N encryption by Christian von Roques (XPK-FEAL.)"], [/IDEA/, "IDEA encryption (XPK-IDEA.)"], [/L2XZ/, "LZMA2 compressor (XPK-L2XZ.)"], [/LZ40/, "LZ4 compressor (XPK-LZ40.)"], [/LZMA/, "LZMA2 compressor (XPK-LZMA.)"], [/NUID/, "IDEA encryption + NUKE (XPK-NUID.)"], [/SHID/, "IDEA encryption + SHRI (XPK-SHID.)"], [/TLTA/, "TLTA encoder (lost) (XPK-TLTA.)"]], found = -1, i = 0; i < cccc.length && found < 0; i++)cccc[i][0].test(type) && (found = i)
            if (!(found < 0)) {
                if (a = a.appendS(cccc[found][1], "/n"), X.Sz() < 36) o = o.addIfNone("!short")
                else {
                    for (c = 0, i = 0; i < 36; i++)c ^= X.U8(0 + i)
                    c && (o = o.addIfNone("!badhdr"))
                } return sz += 8, 1
            }
        } s = !0
    })() ? (sName = X.isVerbose() ? "Amiga eXtended PacKer Format container by Dirk Stöcker et al. (XPKF.)" : "XPK container (XPKF.)", sVersion = sversion + ("" != o ? "malformed" + o : ""), bDetected = 1, X.isVerbose() && (sOptions = a + "; payload at:" + Hex(hdrsz) + " unp.sz:" + unpsz + " sz:" + outSz())) : 4 < X.Sz() && X.c("'ACCA'") ? _setResult("archive", "André Osterhues's Code Compression Algorithm (ACCA.)", "", "") : 2 < X.Sz() && X.c("FF1F") && _setResult("archive", "Compact by Colin L. McMaster (.C)", "", ""), X.Sz() < 3 || !X.c("1F9D") || (t = X.U8(2), sversion = 128 & t ? "new" : "old", (t &= 127) < 9) || 16 < t || _setResult("archive", "Compress by Spencer Thomas (.Z)", sversion, ""), !bDetected && (function () {
        if (!(X.Sz() < 20) && (X.c("'CrM!'") || X.c("'CrM2'") || X.c("'Crm!'") || X.c("'Crm2'") || X.c("18051973") || X.c("'CD'B3B9") || X.c("'DCS!'") || X.c("'Iron'") || X.c("'MSS!'") || X.c("'mss!'")) && (unpsz = X.U32(6, _BE)) && !(unpsz > u) && !((sz = X.U32(10, _BE) + 14) < 15 || sz > X.Sz() || sz > u)) {
            switch (hdr = X.SA(0, 4)) {
                case "s": case "CD³¹": case "Iron": case "MSS!": hdr = "CrM2"
                    break
                case "mss!": hdr = "Crm2"
                    break
                case "DCS!": hdr = "CrM!"
            }var e = "m" == hdr[2], s = "2" == hdr[3]
            return sversion = ["std", "std sampled", "LZH", "LZH sampled"][(s ? 2 : 0) + (e ? 1 : 0)], 1
        }
    })() && (sName = "Crunch-Mania by Thomas Schwarz (CRM.)", sVersion = sversion, X.isVerbose() && (sOptions = "unp.sz:" + unpsz + " sz:" + outSz()), bDetected = 1), !bDetected && (function () {
        if (X.c("'DMS!'") && !(X.Sz() < 56) && !(6 < X.U16(50, _BE))) {
            o = "", d(4, 50, 0) != X.U16(54, _BE) && (o = o.addIfNone("!badhdr"))
            var e = X.U16(10, _BE)
            if (!(32 & e)) {
                sversion = "", 2 & e && (sversion = "obfuscated"), p = 56
                for (var s = tsz = acsz = lasttrksz = trks = mintrk = prevtrk = 0, r = [0, 0, 256, 16384, 16384, 4096, 8192]; p + 20 < X.Sz();) {
                    if (!X.c("'TR'", p)) return
                    if ((ctrk = X.U16(p + 2, _BE)) < prevtrk) break
                    if (X.isDeepScan() && d(p, 18, 0) != X.U16(p + 18, _BE)) {
                        o = o.addIfNone("!badtrkhdr")
                        break
                    } var n = X.U8(p + 13)
                    if (6 < n) return
                    var s = Math.max(s, r[n]), t = X.U8(p, 12), n = ((2 <= n && n <= 4 || 5 <= n && 4 & t) && (tsz = Math.max(tsz, X.U16(p + 8, _BE))), X.U16(p + 6, _BE))
                    if (p + 20 + n > X.Sz()) return
                    if (X.isAggressiveScan() && d(p + 20, n, 0) != X.U16(p + 16, _BE)) {
                        o = o.addIfNone("!badtrkcrc")
                        break
                    } if (ctrk < 80 && (ctrk >= trks && (lasttrksz = X.U16(p + 10, _BE)), mintrk > ctrk && (mintrk = ctrk), ctrk > trks && (trks = ctrk), prevtrk = ctrk), p += n + 20, acsz += n, p > X.Sz()) {
                        o = o.addIfNone("!short")
                        break
                    } if (79 <= ctrk && ctrk < 32768) break
                    if (o) break
                } e = 16 & e ? 22528 : 11264
                return mintrk >= trks && (o = o.addIfNone("!badtrknum")), unpsz = (trks - mintrk) * e + lasttrksz, sz = p, (o = sz > u ? o.addIfNone("!badcalcsize") : o) && (sversion += "/malformed" + o), 1
            }
        }
    })() && (sName = "Disk Masher System (DMS.)", sVersion = sversion, X.isVerbose() && (sOptions = "unp.sz:" + unpsz + " sz:" + outSz(sz)), bDetected = 1), !bDetected && (function () {
        if (X.c("1F9E") || X.c("1F9F")) {
            var e = X.c("1F9E")
            if (a = sversion = "", e) {
                if (2 < X.Sz()) {
                    for (var s = [0, 0, 1, 3, 8, 12, 42, 16], r = [], n = btl = k = 0, e = new BitReader(2); n < 8; n++)for (; k < s[n]; k++)r[btl++] = n + 1
                    if (!(s = createOrderlyHuffmanTable(r, btl, e))) return
                } sversion = "v1.x = gzip v0.5"
            } else {
                if (X.Sz() < 5) return
                if (32768 & (t = X.U16(2, _LE))) return
                if (192 & (t2 = X.U8(4))) return
                for (var s = [1 & t, t >> 1 & 3, t >> 3 & 7, t >> 6 & 15, t >> 10, t2], i = 62, n = 0; n < 6; n++)i -= s[n]
                var o = 256, c = 7
                for (n = 0; n < 6; n++)o -= s[n] << c--
                if (o < i || 2 * i < o) return
                createOrderlyHuffmanTable() || (sversion = "v2.x")
            } return 1
        }
    })() && (sName = "Freeze/Melt by Leonid A. Broukhis (.F,.lzc)", sVersion = sversion, bDetected = 1), !bDetected && (function () {
        switch (hdr = X.SA(0, 4)) {
            case "ATN!": case "EDAM": case "IMP!": case "M.H.": add = 7
                break
            case "BDPI": add = 1768
                break
            case "CHFI": add = 4068
                break
            case "RDC9": case "Dupa": case "FLT!": case "PARA": add = 0
                break
            default: return
        }if (unpsz = X.U32(4, _BE), sz = X.U32(8, _BE), sversion = "", !(!unpsz || !sz || 1 & sz || sz < 12 || sz + 50 > X.Sz() || unpsz > u || sz > u)) { if (X.isDeepScan()) { for (crc = X.U32(sz + 46, _BE), i = 0; i < sz + 46; i += 2)add += X.U16(i, _BE); (4294967295 & add) != crc && (sversion = "malformed!CRC") } return sz += 50, 1 }
    })() && (sName = "File Imploder by Peter Struijk (FImp.)", sVersion = sversion, X.isVerbose() && (sOptions = "unp.sz:" + unpsz + " sz:" + outSz()), bDetected = 1), !bDetected && (function () {
        if (!(X.Sz() < 12) && /[\x01\x02\x03]LOB/.test(X.SA(0, 4))) {
            var e = X.U8(0)
            if ((method = X.U8(4)) && !(6 < method) && (unpsz = 0, 1 !== e || (unpsz = File.read_uint24(5, _BE)) && !(unpsz > u))) {
                if (sz = 12 + X.U32(8, _BE), 2 === method) {
                    var s = 2
                    for (i = 0; i < s; i += 2) {
                        if (sz + s > X.Sz()) return
                        if (t1 = X.U8(sz + i), t2 = X.U8(sz + i + 1), t1 != t2 && 1024 < (s = s < (t1 = t1 < t2 ? t2 : t1) + i + 4 ? t1 + i + 4 : s)) return
                    } sz += s
                } return sversion = ["BMC: RLE", "HUF: Huffman", "LZW: 12-bit fixed code", "LZB: 9 to 12-bit fixed LZW", "MSP: LZ variant", "MSS: LZSS variant"][method - 1] + ["", "/double", "/triple"][e - 1] + (sz > X.Sz() ? "/malformed!short" : ""), 1
            }
        }
    })() && (sName = "LOB's File Compressor aka. Multipak (LOB.)", sVersion = sversion, X.isVerbose() && (sOptions = (unpsz ? "unp.sz:" + unpsz + " " : "") + "sz:" + outSz()), bDetected = 1), bDetected || ((function () {
        if (X.c("'ziRCONia'0E00") && !(X.Sz() < 24)) {
            var e = X.U16(12, _LE), s = X.U32(18, _LE)
            if (!((unpsz = X.U32(14, _LE)) > u || s + 4 * e > X.Sz())) {
                for (o = "", sz = 0, i = 0; i < e; i++) {
                    var r = X.U32(s + 4 * i, _LE)
                    if (r + 20 > X.Sz()) return
                    r = r + X.U32(r + 4, _LE) + 8 * X.U16(r + 12, _LE) + 20
                    sz < r && (sz = r)
                } return 1
            }
        }
    })() ? (sName = "Music Module Compressor by Emmanuel 'Zirconia' Giasson (MMCMP.)", nV = X.U16(10, _LE).toString(16).toUpperCase(), sVersion = "v" + nV[0] + "." + nV.slice(1, 3), X.isVerbose() && (sOptions = "unp.sz:" + unpsz + " sz:" + outSz()), bDetected = 1) : X.c("'MMS '00") && (sName = "C(ompression)KIT by Mad Man Software (C4-,C4A,C`A)", bDetected = 1)), !bDetected && e() && (sName = "Pack (.z)", old && (sVersion = "old"), X.isVerbose() && (sOptions = "unp.sz:" + unpsz), bDetected = 1), !bDetected && (function () {
        if (!(X.Sz() < 16) && (X.c("'PP11'") || X.c("'PP20'") || X.c("'PX20'") || X.c("'CHFC'") || X.c("'DEN!'") || X.c("'DXS9'") || X.c("'H.D.'") || X.c("'RVV!'"))) {
            var e = !1
            if (sversion = "", X.c("'PX20'")) {
                if (X.Sz() < 18) return
                e = !0, sversion = "obfuscated"
            } e = X.U32(e ? 6 : 4, _BE)
            return 151587081 == e || 151652874 == e || 151653131 == e || 151653388 == e || 151653389 == e ? !(X.isDeepScan() && (t = X.U32(X.Sz() - 4, _BE), !(unpsz = t >> 8) || unpsz > u || 32 <= (255 & t))) : void 0
        }
    })() ? (sName = "Power Peak's PowerPacker by Nico François (PP.)", sVersion = sversion, X.isDeepScan() && X.isVerbose() && (sOptions = "unp.sz:" + unpsz), bDetected = 1) : !bDetected && X.c("'SFHD'") ? _setResult("archive", "PowerPlayer Music Cruncher by Stephan Fuhrmann (PMC.)", "v1.0", "lh.library-based, unp.sz:" + X.U32(4, _BE) + " sz:" + outSz(X.U32(8, _BE) + 12)) : !bDetected && X.c("'SFCD'") && _setResult("archive", "PowerPlayer Music Cruncher by Stephan Fuhrmann (PMC.)", "v2.x", "LZRW-compressor, unp.sz:" + X.U32(4, _BE) + " sz:" + outSz(X.U32(8, _BE) + 12)), !bDetected && (function () {
        var e, s
        return !(!(X.c("'RNC'01") || X.c("'RNC'02") || X.c("'...'01")) || (unpsz = X.U32(4, _BE), sz = X.U32(8, _BE), !unpsz) || !sz || unpsz > u || sz > u) && (e = !1, sversion = "", X.c("'RNC'01") ? X.Sz() <= 18 ? sversion = "old" : (s = X.U8(18), 128 & X.U8(sz + 11) ? !(3 & s) && 124 & s && X.Sz() >= sz + 18 && (File.isHeuristicScan() || X.isDeepScan() && r(18, sz, 0) == X.U16(14, _BE)) ? (sversion = "new", e = !0) : sversion = "old" : sversion = "new") : X.c("'RNC'02") ? X.Sz() <= 18 ? sversion = "old" : (s = X.U8(18), 128 & X.U8(sz + 10) ? 48 != (48 & s) && X.Sz() >= sz + 18 && (File.isHeuristicScan() || X.isDeepScan() && r(18, sz, 0) == X.U16(14, _BE)) ? (sversion = "new", e = !0) : sversion = "old" : sversion = "new") : X.c("'...'01") && (version = "new"), s = "o" == sversion[0] ? 12 : 18, o = "", s + sz > X.Sz() && (o = "!short"), X.isDeepScan() && "n" == sversion[0] && !e && r(18, sz, 0) != X.U16(14, _BE) && (o = o.addIfNone("!badcrc")), sz += s, o && (sversion += "/malformed" + o), 1)
    })() ? (sName = "Rob Northen Compressor (RNC" + X.U8(3) + ".)", sVersion = sversion, X.isDeepScan() && X.isVerbose() && (sOptions = "unp.sz:" + unpsz + " sz:" + sz), bDetected = 1) : !bDetected && File.isHeuristicScan() && 4 <= X.Sz() && X.c("1FA0") && _setResult("archive", "SCO Compress LZH (SCO.)", "", ""), !bDetected && X.c("'SQSH'") && (sName = "Squash compressor by John Hendrikx (SQSH.)", sOption = "12-bit LZW", bDetected = 1), !bDetected && n() && (sName = "StoneCracker by Jouni 'Mr. Spiv' Korhonen (" + names[0] + ".)", sVersion = names[1], bDetected = 1, X.isVerbose()) && (sOptions = (0 <= unpsz ? "unp.sz:" + unpsz + " " : "") + (0 <= sz ? "sz:" + outSz() : "")), bDetected || X.Sz() < 12 || !X.c("'TPWM'") || !(unpsz = X.U32(4, _BE)) || unpsz > u || (sName = "Turbo Packer by Wolfgang Meyerle (TPWM.)", X.isVerbose() && (sOptions = "unp.sz:" + unpsz), bDetected = 1), bDetected || !X.c("'Vice'") && (!X.c("'Vic2'") || (unpsz = X.U32(4), sz = 12 + X.U32(8, _BE), !unpsz) || unpsz > u || sz < 1036 || sz > u) || (sName = "Huffman compressor with RLE (" + X.SA(0, 4) + ".)", bDetected = 1, X.isVerbose() && 50 == X.U8(3) && (sOptions = "unp.sz:" + unpsz + " sz:" + sz)), result()
} meta("archive", ""), debug = 0

================================================
FILE: dbs_min/db/Binary/archive_btoa.1.sg
================================================
function detect(){return"'xbtoa Begin'"==Binary.getString(0,11)&&(bDetected=1),result()}meta("archive","btoa")

================================================
FILE: dbs_min/db/Binary/archive_cad.DWG.1.sg
================================================
function detect(){if(9<=Binary.getSize())switch(bDetected=1,Binary.getString(0,6)){case"AC1001":sVersion="R2.22"
break
case"AC1002":sVersion="R2.50"
break
case"AC1003":sVersion="R2.60"
break
case"AC1004":sVersion="R9"
break
case"AC1006":sVersion="R10"
break
case"AC1009":sVersion="R11/12"
break
case"AC1012":sVersion="R13"
break
case"AC1014":sVersion="R14"
break
case"AC1015":sVersion="R2000"
break
case"AC1018":sVersion="R2004"
break
case"AC1021":sVersion="R2007"
break
case"AC1024":sVersion="R2010"
break
case"AC1027":sVersion="R2013"
break
case"AC1032":sVersion="R2018"
break
default:return}return result()}meta("archive","AutoCAD Drawing (.DWG)")

================================================
FILE: dbs_min/db/Binary/archive_gp7bank.1.sg
================================================
function detect(){return!!(X.c("'AMARCHIVE'..000000")&&X.c("'Samples.xml'00",37)&&X.c("'<?xml'",X.U32(25))&&X.U32(25)+X.U32(33)==X.U32(49))&&(bDetected=1,sVersion="v"+X.U8(9),X.isVerbose()&&(sOptions=X.U16(13)+" samples"),result())}meta("archive","Arobas Music Guitar Pro 7+ soundbank (.gp7bank)")

================================================
FILE: dbs_min/db/Binary/audio.1.sg
================================================
meta("audio",""),includeScript("chunkparsers"),includeScript("soundchips"),includeScript("bytecodeparsers")
var debug=0
function isWinCert(){if(X.Sz()>=(_wcsz=X.U32(0,_LE))&&X.c("00 02 02 00 30",4)){if(_wcp=9,!((_wca=X.U8(_wcp++))<128))if(128<_wca)for(_wcc=128^_wca,_wci=_wca=0;_wci<_wcc;_wci++)_wca=(_wca<<8)+X.U8(_wcp++)
else _wca=-1
if(0<_wca&&_wca+_wcp<=_wcsz&&X.c("06 09 2A 86 48 86 F7 0D 01 07 02",_wcp))return!0}return!1}function detect(){if(!isWinCert()){var e,t,es,rs,G=0,Y=0,l=0,U=0,j=0,i=0,E=0,k=0,K=-1,F="",p="",_="",r="",a="",c="",O=""
if(X.c("'[1tracker module]'0D0A"))sName="Shiru's 1tracker module (.1TM)",bDetected=1,0<=(j=X.fStr(1,64,"Engine="))&&(i=X.fStr(j+7,64,"."),sVersion="for "+X.SA(j+7,i-j-7)),X.isVerbose()&&(0<=(j=X.fStr(i,128,"Title="))&&(i=X.fSig(j+6,64,"0D0A"),sOption(X.SA(j+6,i-j-6))),0<=(j=X.fStr(i,128,"Author="))&&(i=X.fSig(j+7,64,"0D0A"),sOption(X.SA(j+7,i-j-7),"by: ")),0<=(j=X.fStr(i,128,"Speed=")))&&(i=X.fSig(j+7,64,"0D0A"),sOption(X.SA(j+7,i-j-7),"spd:"))
else if(X.c("'_A2module_'")&&isWithin(nV=X.U8(14),1,14))bDetected=1,bad=!1,sName="subz3ro's AdLib Tracker II module (.A2M)",sVersion="/┤DLiB TR/┤CK3R ][ v"+nV,ptn=X.U8(15),(bad=!ptn||64<ptn?"!badptn":bad)?sVersion+="/malformed"+bad:X.isVerbose()&&sOption("ptn:"+ptn)
else if(X.c("'_A2tiny_module_'")&&isWithin(nV=X.U8(19),1,14))sName="subz3ro's AdLib Tracker II module (.A2T)",bDetected=1,bad=!1,sVersion="/┤DLiB TR/┤CK3R ][ v"+nV+" tiny",(!(ptn=X.U8(20))||64<ptn)&&(bad="!badptn"),tmp=X.U8(21),spd=X.U8(22),rows=X.U16(24),trk=X.U8(26),bad?sVersion+="/malformed"+bad:X.isVerbose()&&sOption("tempo:"+tmp+" spd:"+tmp+" trk:"+trk+" ptn:"+ptn)
else if(X.c("'EXITgB'2018201820182F18201024C94AA80004660A558006A80000000200042200D28924C1D0A8000424C0D1DF2018D1D82018D1D82018201812D804800000000166F660B4610000'H|'017E01610000'Z|'027E02610000'R|'037E03610000'JL'DF7FFF'NuH'E7FFFE7E01610000AC7E02610000A67E03610000A04CDF7FFF'Nu`'0A602260000092600000'~A'FA....4BF900DFF000'p0;|'000000AA0440001064F4'NuK'F900DFF0003007C0FC",26))bDetected=1,sName="Franck Sauer and Yves Grolet's Art & Magic module (.AAM)",X.isVerbose()&&(0<=(E=X.fSig(32768,Math.min(65535,X.Sz()),"'EXIT'"))?sOption(outSz(E+4),"sz:"):sVersion="malformed!short")
else if(X.c("'ADLIB'01"))sName="Martin Fernandez's Adlib module (.ADLIB)",bDetected=1,X.isVerbose()&&(E=X.SA(6,256),g=X.SA(6+E.length+1,256),sOption(E),sOption(g,"for: "))
else if(X.c("'AERO'00000001")&&202==X.U8(15)&&202==X.U8(31)&&202==X.U8(47))sName="ioNeo's Aero Studio module (.AERO)",bDetected=1,X.isVerbose()&&sOption("sz:"+outSz(X.U32(8)+12))
else if(0<X.fSig(20,256,'\'<aks:song xmlns:aks="http://www.julien-nevo.com/ArkosTrackerSong"'))sName="Julien Névo's Arkos Tracker 2 module (.AKS)",sVersion="unpacked",bDetected=1
else if(X.c("'AM01'000000")&&X.c("'ASD1'",56)&&0<(amp=X.fSig(64,16777216,"'AMP'.. ........'ASSH'"))){for(sName="New Beat's Ace Tracker module (.AM)",bDetected=1,maxsz=Math.min(X.Sz(),16777216),F=by=bad="",ptn=ord=smp=K=0,ptns=[],G=60;G<amp&&smp<64&&(E=X.U32(G,_BE));)G+=E,smp++
for(G+=4,X.c("'AMP'.. ........'ASSH'",G)||(G=amp,bad=bad.addIfNone("!badsmp"),smp=Math.max(1,smp)),3<(ampv=X.U8(G+3)-48)&&(bad=bad.addIfNone("!unkver")),sVersion="v"+ampv,ins=X.U32(G+4,_BE),G+=12,inss=[],Y=0;Y<ins;Y++,G+=1==ampv?205:2==ampv?209:3==ampv?212:0)""!=(E=X.SA(G+4,20).trim())&&"Empty"!=E&&inss.push(E)
if(X.c("'ASG1'",G)||(bad=bad.addIfNone("!badins")),asg1=X.fSig(amp,maxsz,"'ASG1'"),ord=ptn=0,asg1<0)bad=bad.addIfNone("!nosong")
else for(F=X.SC(asg1+4,20,"CP437"),by=X.SC(asg1+24,20,"CP437"),Y=asg1+44;Y<asg1+300;Y++)(E=X.U8(Y))&&(ord=Y-asg1-43,E>ptn)&&(ptn=E)
if(G=asg1+300,apn1=X.fSig(asg1,1024,"'APN1'"),ch=ptn_=-1,0<apn1){for(G!=apn1&&(bad=bad.addIfNone("!badptn")),ptn_=X.U32(apn1+4,_BE),ptn!=ptn_&&(bad=bad.addIfNone("!badptn"+ptn+"/"+ptn_)),Y=0,G=apn1+8;Y<ptn_;Y++)(E=X.SC(G+4,12,"CP437").trim()).length&&"Empty"!=E&&ptns.push(E),(ch_=X.U16(G,_BE))>ch&&(ch=ch_),G+=16+4*ch_*X.U16(G+2,_BE)
K=G}else bad=bad.addIfNone("!noptns");(bad=16<ch?bad.addIfNone("!badchn"):bad).length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(F),sOptionT(by,"by: "),sOptionT(addEllipsis(inss.filter(funSampleName).join(" ")),'ins/msg:"','"'),sOptionT(addEllipsis(ptns.join(" ")),'ptns:"','"'),sOption((0<ch?"ch:"+ch+" ":"")+"ord:"+ord+" ptn:"+(ptn!=ptn_?ptn+"/":"")+ptn_+" ins:"+ins+" smp:"+smp+" xpos:"+X.I32(52)+(K?" sz:"+outSz(K):"")))}else if(X.c("'ASG1'")&&X.c("'APN1'",300)){for(sName="New Beat's Ace Tracker module patterns (.ASG)",bDetected=1,bad="",F=X.SC(4,20,"CP437"),by=X.SC(24,20,"CP437"),ptn=ord=0,G=44;G<300;G++)(E=X.U8(G))&&(ord=G-43,E>ptn)&&(ptn=E)
for(ch=-1,ptns=[],Y=0,G=308;Y<255;Y++)(ch_=X.U16(G,_BE))>ch&&(ch=ch_),ptnsz=ch_*X.U16(G+2,_BE),G+=4,ptnsz&&((E=X.SC(G,12,"CP437").trim()).length&&"Empty"!=E&&ptns.push(E),G+=12+4*ptnsz)
K=G,(bad=16<ch?bad.addIfNone("!badchn"):bad).length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(F),sOptionT(by,"by: "),sOptionT(addEllipsis(ptns.join(" ")),'ptns:"','"'),sOption((0<ch?"ch:"+ch+" ":"")+"ord:"+ord+" ptn:"+ptn+" sz:"+outSz(K)))}else if(X.c("'AMC V1.2 REPLAY!'")&&X.c("0000003C0002\t",78)){if(sName="Marc Hawlitzeck's A.M. Composer module (.AMC)",bDetected=1,sVersion="v"+X.SA(5,3),X.isVerbose()){for(d0=X.U32(20,_BE),a3=X.U32(24,_BE),d3=_=0,G=72,special="",smp=0;G<X.Sz()&&G<a3;G+=16)d2=X.I32(G,_BE)+2*X.U16(G+4,_BE),smp++,d2>d3&&(d3=d2)
if((G=d3)<X.Sz()){for(;G+_<X.Sz()&&isWithin(X.U8(G+_),32,126);)_++
X.U8(G+_)||G+_+1!=X.Sz()||_++,special=X.SA(G,_)}sOption(special,'info:"','"'),sOption("smp:"+smp+" sz:"+outSz(G+_))}}else if(X.c("'<o'EF'QU'EE'RoR'",1062)||X.c("'MaDoKaN96'",1062)){if(sName="Elyssis AMUSiC module (.AMD)",bDetected=1,sVersion="<"!=X.SA(1062,1)?"xms rip-off":"<o∩QUεRoR/ε£¥$$ì$ v101%",17==X.U8(1071)&&(sVersion=sVersion.appendS("packed","/")),X.isVerbose()){for(sOptionT(X.SA(0,24)),sOptionT(X.SA(24,24),"by: "),Y=0,smps=[];Y<26;Y++)smps.push(X.SC(48+34*Y,22,"CP437").replaceAll("ÿ"," ").trim())
if(sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),256,160),'smp/msg:"','"'),ptn=X.U8(933)+1,notes=-1,17==X.U8(1071)){for(G=1072+18*ptn,trk=X.U16(G),G+=2,Y=0;Y<trk&&G<X.Sz();Y++)for(i=0,G+=2;i<64&&G<X.Sz();)128&(_=X.U8(G++))?i+=127&_:(G+=2,i++,notes++)
K=G}else K=1072+1728*ptn
sOption("ord:"+X.U8(932)+" ptn:"+ptn+(0<K?" sz:"+outSz(K):""))}}else if(X.c("'ASYLUM Music Format V1.0'00000000 00000000")&&X.U8(34)<=64&&X.Sz()>=2662+2048*X.U8(35)){if(sName="Electronic Arts' ASYLUM Music Format module (.AMF)",bDetected=1,sVersion="v"+X.SA(21,3),X.isVerbose()){spd0=X.U8(32),bpm0=X.U8(33),smp=X.U8(34),ptn=X.U8(35),ord=X.U8(36)
var G=294,B=0
for(smps=[],Y=0;Y<smp;Y++)smps.push(decAnsi(294+37*Y,22,CP437,!0,Chars0to1F).trim()),B+=X.U32(294+37*Y+25)
K=2662+2048*ptn+B,sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),256,160),'smp/msg:"','"'),sOption("spd0:"+spd0+" bpm0:"+bpm0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" smpsz:"+Hex(B)+" sz:"+outSz(K))}}else if(X.c("'Extreme0'01")&&X.U8(15)<=32){if(sName="Extreme's Tracker Advanced Module System track (.AMS)",bDetected=1,X.isVerbose()){for(cmd=X.U8(9)>>5,sch=1+(31&X.U8(9)),smp=X.U8(10),ptn=X.U16(11),ord=X.U16(13),vmch=X.U8(15),xtra=X.U16(16),G=xtra+18,S=[],Y=B=0;Y<smp;Y++,G+=17){var A=X.U32(G)
B+=A,co=3&X.U8(G+16),b16=128&X.U8(G+16)?2:1,S.push([co,A,b16])}for(sOptionT(X.SC(G+1,X.U8(G),"CP437")),G+=1+X.U8(G),smps=[],Y=0;Y<smp;Y++)smps.push(X.SC(G+1,X.U8(G),"CP437")),G+=1+X.U8(G)
for(schs=[],Y=0;Y<sch;Y++)schs.push(X.SC(G+1,X.U8(G),"CP437")),G+=1+X.U8(G)
for(Y=0;Y<ptn;Y++)G+=1+X.U8(G)
var r=X.readBytes(G+2,X.U16(G),!0),D=[]
for(G+=2+X.U16(G),Y=0;Y<r.length;Y++)r[Y]<128?D.push(r[Y]):r[Y]<=160?D.push(32):D.push(10)
for(r=decEncoding(D,"CP437"),D=void 0,mptn=-1,Y=0;Y<ord;Y++)(E=X.U16(G+2*Y))>mptn&&(mptn=E)
for(mptn++,G+=2*ord,Y=0;Y<ptn;Y++)G+=4+X.U32(G)
for(allsmpcsz=0,Y=0;Y<smp;Y++)S[Y][0]?S[Y][1]&&(G+=4,scosz=X.U32(G),cc=X.U8(G+4),G+=5+scosz,allsmpcsz+=scosz):G+=8+S[Y][1]*S[Y][2]
S=void 0,sOption(addEllipsis(schs.join(" "),160,128),'chns:"','"'),sOption(addEllipsis(r.trim(),256,128),'msg:"','"'),sOption("ord:"+ord+" ptn:"+ptn+(mptn!=ptn?"/"+mptn:"")+" smp:"+smp+" cmd:"+cmd+" strk:"+sch+(vmch?" mtrk:"+vmch:"")+" co.smpsz:"+(100*allsmpcsz/B).toFixed(1)+"% sz:"+outSz(G))}}else if(X.c("'AMShdr'1A")&&X.U8(7)<=30&&2==X.U8(9+X.U8(7))&&X.U8(8+X.U8(7))<=2){if(bDetected=1,G=8+X.U8(7),nv=X.U8(G),sName="Velvet Studio Advanced Module System track (.AMS)",sVersion="v"+X.U8(G+1)+"."+nv,bad="",1024<(ptn=X.U16(G+3))&&(bad=bad.addIfNone("!badptn")),ord=X.U16(G+5),X.isVerbose()){for(F=X.SC(8,G-8,"CP437"),ins=X.U8(G+2),G+=7,X.Sz()<47+2*ins+2*ord+4*ptn&&(bad=bad.addIfNone("!short")),2==nv?(bpm0=Math.max(8192,X.U16(G)),G+=2,bpm0=(bpm0>>8)+"."+(255&bpm0),spd0=Math.max(1,X.U8(G++)),G+=3,flg=X.U16(G),G+=2):(bpm0=Math.max(32,X.U8(G++)),spd0=Math.max(1,X.U8(G++)),flg=X.U8(G++)),ch=flg>>6&1?"2":"1",linfreqtbl=64&flg?" lnr.freq.tbl.":"",midiused=128&flg?" MIDI used":"",sOptionT(F),inss=[],smps=[],S=[],B=allsmpcsz=smp=shd=0,Y=0;Y<ins;Y++)if(30<(t_=X.U8(G++))&&(bad=bad.addIfNone("!badins")),E=X.SC(G,t_,"CP437").trim(),G+=t_,""!=E&&inss.push(E),inssmp=X.U8(G++))for(0==nv?G+=100:G+=124,63<(E=X.U8(G++))&&(bad=bad.addIfNone("!badenv")),G+=3*E+4,63<(E=X.U8(G++))&&(bad=bad.addIfNone("!badpan")),G+=3*E+4,63<(E=X.U8(G++))&&(bad=bad.addIfNone("!badvibenv")),G+=3*E,E=X.U8(G),(shdins=0<E)&&shd++,G+=5,s=0;s<inssmp;s++)22<(t_=X.U8(G++))&&(bad=bad.addIfNone("!badsmp")),E=X.SC(G,t_,"CP437").trim(),G+=t_,A=X.U32(G),G+=4,shdins||smp++,A&&(shdins||(B+=A,sfl=X.U8(G+15),co=3&sfl,b16=4&sfl?2:1,S.push([co,A,b16])),G+=16)
for(t_=X.U8(G++),sOptionT(X.SC(G,t_,"CP437"),"by:"),G+=t_,schs=[],Y=0;Y<32;Y++)schs.push(X.SC(G+1,X.U8(G),"CP437")),G+=1+X.U8(G)
if(r=X.readBytes(G+11,X.U32(G)-11),D=[],co=X.U8(G+10),G+=X.U32(G),co){for(Y=0;Y<r.length;)if(255==(_=r[Y++])&&2<=r.length-Y)if(_=r[Y++],n=r[Y++],32!=_)for(l=0;l<n;l++)D.push(_)
else n<=32?D.push(32):D.push(10)
else D.push(_)
r=decEncoding(D,"CP437")}else r=decEncoding(r,"CP437")
for(D=void 0,G+=ord<<1,Y=0;Y<ptn;Y++)G+=4+X.U32(G)
for(G>X.Sz()&&(bad=bad.addIfNone("!short")),Y=0;Y<smp;Y++)S[Y][0]?S[Y][1]&&(scosz=X.U32(G+4),cc=X.U8(G+9),G+=9+scosz,allsmpcsz+=scosz):G+=S[Y][1]*S[Y][2]
K=G,sOption(addEllipsis(schs.join(" "),160,128),'chns:"','"'),sOption(addEllipsis(inss.filter(funSampleName).join(" "),160,128),'insts/msg:"','"'),sOption(addEllipsis(r.trim(),160),'msg:"','"'),sOption("ch:"+ch+" ins:"+ins+(shd?"+"+shd+"sh":"")+" ord:"+ord+" ptn:"+ptn+" bpm0:"+bpm0+" spd0:"+spd0+linfreqtbl+midiused+" co.smpsz:"+(100*allsmpcsz/B).toFixed(1)+"% sz:"+outSz(K))}bad&&(sVersion=sVersion.appendS("malformed"+bad,"/"))}else if(X.c("'AMX "))sName="Dmitry 'AND' Andreev's XSynth module (.AMX)",bDetected=1
else if(X.c("'AON4'")||X.c("'AON8'")){if(sName="Bastian 'Twice' Spiegel's Art of Noise/Chorus module (.AON)",bDetected=1,ch=X.U8(3)-48,X.isVerbose()){for(id=X.SA(4,42),G=46,E=p=d=_="",ord=ptn=ins=0;G<X.Sz();){if(63==X.U8(G)){G+=4-G&3
break}if(hkhd=X.readBytes(G,4),charStat(hkhd,1).indexOf("allasc")<0)break
switch(hkhd=decEncoding(hkhd,CP437),hksz=X.U32(G+4,_BE),G+=8,hkhd){case"NAME":E=X.SC(G,hksz,"CP1252")
break
case"AUTH":p=X.SC(G,hksz,"CP1252")
break
case"DATE":d=X.SC(G,hksz,"CP1252")
break
case"RMRK":_=X.SC(G,hksz,"CP1252")
break
case"PLST":for(ord=hksz,Y=0;Y<ord;Y++)(o=X.U8(G+Y)+1)>ptn&&(ptn=o)
break
case"WLEN":for(Y=0;Y<hksz>>2;Y+=4)X.U32(G+Y,_BE)&&ins++}G+=hksz}sOptionT(E),sOptionT(p,"by: "),sOptionT(d,"on: "),sOption(id,"in: "),sOption(addEllipsis(_.trim(),160)),sOption("ch:"+ch+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" sz:"+outSz(G))}}else if(X.c("'ADRVPACK'"))sName="Petter A. Urkedal's AProSys module (.APS)",bDetected=1
else if(X.c("'ARP.'"))sName="Major Tom's Player 2 module (.ARP)",bDetected=1
else if(X.c("'ACTIONAMICS SOUND TOOL'",62))sName="Michael Kleps's Actionamics Sound Tool module (.AST)",bDetected=1,sVersion="v"+X.SA(86,3)
else if(X.c("08'AST '")&&isWithin(X.U8(9),4,8)&&X.U16(10)<=1001){if(sName="Patrice 'Cagliostro' Bouchand's All Sound Tracker module (.AST)",sVersion="v"+X.SA(5,4),bDetected=1,X.isVerbose()){for(L=X.U16(10),a=X.SC(12,L+1,"CP850"),G=13+L,s="",Y=0;Y<L;Y+=38)(E=a.slice(Y,Y+38).trim()).length&&(s=s.appendS(E,"\n"))
for(sOption(addEllipsis(s,512)),ord=X.U8(G++),Y=ptn=K=0;Y<=ord;Y++)ptn=Math.max(ptn,X.U8(G++)+1)
for(fmp=X.I32(G),awp=X.I32(G+4),ptnp=X.I32(G+8),awesonp=X.I32(G+12),wavep=X.I32(G+16),G+=20,K=Math.max(K,G),G=fmp,fmi=0,n=X.U8(G++);n<255&&G<X.Sz();fmi++)G+=20,n=X.U8(G++)
for(K=Math.max(K,G),G=awp,awes=0,n=X.U8(G++);n<255&&G<X.Sz();awes++)G+=51,n=X.U8(G++)
for(awei=0,n=X.U8(G++);n<255&&G<X.Sz();awei++)G+=39,n=X.U8(G++)
for(awed=0,n=X.U8(G++);n<255&&G<X.Sz();awed++)G+=3,n=X.U8(G++)
for(G=G+2+793,K=Math.max(K,G),G=ptnp,ptn_=0,n=X.U8(G++);n<255&&G<X.Sz();ptn_++)G+=2+X.U16(G),n=X.U8(G++)
for(K=Math.max(K,G),G=wavep,wf=0,n=X.U8(G++);n<255&&G<X.Sz();wf++)G+=36,n=X.U8(G++)
K=Math.max(K,G),"v0001"===sVersion&&K--,sOption("def:"+X.U8(9)+" ord:"+ord+" ptn:"+ptn+(ptn_!=ptn?"/"+ptn_:"")+" wavep:"+Hex(wavep)+(fmi?" FMins:"+fmi:"")+(awes?" AWEsmp:"+awes:"")+(awei?" AWEins:"+awei:"")+(wf?" wf:"+wf:"")+" sz:"+outSz(K))}}else if(X.c("'AudioSculpture10'00180018"))sName="Synchron Assembly's Audio Sculpture synth file (.AS)",bDetected=1
else if(X.c("'##synth'0D0A"))sName="Athaudia's Athtune module (.ATHTUNE)",bDetected=1
else if(X.c("'FORM'.... ....'AXSFUSER'")&&X.c("'SHDR'",E=X.U32(16,_BE)+20)&&X.c("'SONG'",X.U32(E+4,_BE)+E+8)){if(sName="Resolution's AXS module (.AXS)",bDetected=1,X.isVerbose()){for(ord=ptn=ins=smp=0,K=X.U32(4,_BE)+8,G=12,maxsz=Math.min(K,X.Sz());G<maxsz&&(hkhd=X.readBytes(G,4),!(charStat(hkhd,1).indexOf("allasc")<0));){switch(hkhd=decEncoding(hkhd,CP437),hksz=X.U32(G+4,_BE),G+=8,hkhd){case"SONG":ord=hksz>>3
break
case"BLOK":ptn++
break
case"INST":ins++
break
case"SAMP":smp++}G+=hksz}sOption("ord:"+ord+" ptn:"+ptn+(ins?" syn:"+ins:"")+(smp?" smp:"+smp:"")+" sz:"+outSz(K))}}else if(X.c("'BBSONG'00'0001'00")){sName="Shiru's Beepola module (.BBSONG)",bDetected=1
var is=!(G=12)
for(ord=orn=ptn=svgptn=svgwarp=phains=0,bad=F=auth=engine="";G<X.Sz()&&!(G>=X.Sz());){if(58!=X.U8(G++)){G--
break}switch(E=X.SA(G,254),G+=E.length+1,E){case"INFO":for(;G<X.Sz()&&(E=X.SC(G,TOEOF,"CP1251"),G+=E.length+1,":END"!==E);)switch((xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0]){case"Title":F=xx[1]
break
case"Author":auth=xx[1]
break
case"Engine":engine=xx[1]}break
case"LAYOUT":for(is=!0;G<X.Sz()&&(E=X.SC(G,TOEOF,"CP1251"),G+=E.length+1,":END"!==E);)switch((xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0]){case"LoopStart":lp=+xx[1]
break
case"Length":for(ord=+xx[1],ptn=0,Y=0;Y<ord;Y++)ptn<=(E=X.U8(G++))&&(ptn=E+1)}break
case"PATTERNDATA":for(;G<X.Sz()&&(E=X.SC(G,1024,"CP1251"),G+=E.length+1,":END"!==E);)if("PatternCount"===(xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0])for(ptns=+xx[1],Y=0;Y<ptns&&G<X.Sz()&&(E=X.SC(G,1280,"CP1251"),G+=E.length+1,":END"!==E);Y++)"PatternName"===(xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0]&&(G+=8+5*X.U32(G))
break
case"SVGPATTERNDATA":for(;G<X.Sz()&&(E=X.SC(G,1024,"CP1251"),G+=E.length+1,":END"!==E);)if("PatternCount"===(xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0])for(svgptn=+xx[1],Y=0;Y<svgptn&&G<X.Sz();Y++)G+=4+16*X.U32(G)
break
case"SVGWARPDATA":for(;G<X.Sz()&&(E=X.SC(G,1024,"CP1251"),G+=E.length+1,":END"!==E);)if("PatternCount"===(xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0])for(svgwarp=+xx[1],Y=0;Y<svgwarp&&G<X.Sz();Y++)G+=4+2*X.U32(G)
break
case"P1INSTR":for(;G<X.Sz()&&(E=X.SC(G,1024,"CP1251"),G+=E.length+1,":END"!==E);)"Length"===(xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0]&&(phains=+xx[1],G+=phains)
break
case"SVGORNAMENTS":for(;G<X.Sz()&&(E=X.SC(G,1024,"CP1251"),G+=E.length+1,":END"!==E);)if("OrnamentCount"===(xx=2<(xx=E.split("=")).length?[xx[0],xx.slice(1,xx.length).join("=")]:xx)[0])for(orn=+xx[1],Y=0;Y<orn&&G<X.Sz();Y++)G+=4+X.U32(G)
break
default:bad=bad.addIfNone("!badchunk")}}is||(bad=bad.addIfNone("!corrupt")),sVersion="engine:"+engine,""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(F),sOptionT(auth,"by: "),sOption("ord:"+ord+(lp?" lp:"+lp:"")+" ptn:"+ptn+(svgptn?"+svg":"")+(svgwarp?" warp":"")+(orn?" orn":"")+(phains?" phasers":"")+" sz:"+outSz(G)))}else if(X.c("000003F3")&&X.U8(20)&&X.c("70FF4E75'DAGLISH!'",32)&&X.U32(44,_BE)&&X.U32(48,_BE)&&X.U32(52,_BE)&&X.U32(56,_BE))bDetected=1,sName="Ben Daglish's SID (.BDS)",sVersion="v1.1",X.isVerbose()&&(F=X.SA(32+X.U32(60,_BE),256),auth=X.SA(32+X.U32(64,_BE),256),misc=X.SA(32+X.U32(68,_BE),256),sOptionT(F),1<(k=X.U32(56,_BE))&&sOption(k,"×"),sOptionT(auth,"by: "),sOptionT(misc))
else if(/BMF1\.[012]/.test(X.SA(0,6))&&8<X.Sz()&&6<X.fSig(6,42,"00")){if(sName="The Brain's Easy Adlib module (.BMF)",sV=X.SA(5,1),sVersion="v1."+sV,bDetected=1,X.isVerbose()&&"0"<sV){if(G=6,bad=F=author="",f=X.fSig(G,-1,"00"),F=X.SA(G,f-G),G+=F.length+1,0<(f=X.fSig(G,-1,"00"))){if(author=X.SA(G,f-G),G+=author.length+1,spd=X.U8(G++),X.isDeepScan()){for(fl=X.U32(G),G+=4,ins=0,Y=0;Y<32;Y++)1&fl&&(G+=24)>X.Sz()&&(bad=bad.addIfNone("!short")),fl>>=1,ins++
fl=X.U32(G),G+=4
for(trk=0,trkend=!1,Y=0;Y<32;Y++){if(1&fl)for(trk++,trkend=!1,q=0;G<X.Sz()&&!trkend&&q<=1023;q<1023&&q++)switch(E=X.U8(G++)){case 254:trkend=!0
break
case 252:case 125:break
default:evnote=127&E,128&E&&(128&(E=X.U8(G))&&(evdly=63&E,G++,!(64&E))||(64<=(E=X.U8(G++))?evvol=E+1-64:32<=E&&E<=63?evins=E+1-32:"2"==sV&&1<=E&&E<=6&&G++))}fl>>=1}trkend||(bad=bad.addIfNone("!short"),G=-1)}}else bad=bad.addIfNone("!badtags")
""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),sOptionT(F),sOptionT(author,"by: "),sOption("spd:"+spd+(X.isDeepScan()?" trk:"+trk+" ins:"+ins+" sz:"+outSz(G):""))}}else if(384<X.Sz()&&X.c("'Buzz'")&&isWithin(X.U32(4),1,12)&&X.c("7C010000",12)&&0<X.fSig(8,64,"'MACH'"))sName="Oskari Tammelin's Jeskola Buzz module (.BMX)",bDetected=1
else if(28252<=X.Sz()&&X.c("0100'ADLIB'9D02A0021C000000")&&502458809==X.adler32(0,28252))sName="Instrument bank for Adlib Visual Composer (STANDARD.BNK)",bDetected=1,X.isVerbose()&&sOption(outSz(28252),"sz:")
else if(X.c("'BRTF'")&&["NAME","INFO"].includes(X.SA(8,4))){if(sName="Benjamin 'BeRo' Rousseaux's BeRoTracker module (.BRT)",bDetected=1,X.isVerbose()){for(E=_=q="",instmsg=[],sainmsg=[],ins=smp=ptn=ord=0,bpm0=spd0=st0=mvol=rowsperbeat=hltu=hltd=0,end=!(G=8);!end&&G<X.Sz();){switch(hkhd=X.SA(G,4),hksz=X.U32(G+4,_LE),G+=8,hkhd){case"NAME":E=X.UCSD(G)
break
case"MESS":_=X.SC(G+2,X.U32(G,_LE),"CP1252")
break
case"BPMI":rpb=X.U8(G)
break
case"INFO":spd0=X.U8(G+4),bpm0=X.U8(G+5),st0=X.U8(G+6),mvol=X.U8(G+10)
break
case"PORD":ord=X.U8(G)
break
case"PATT":ptn++
break
case"PAIN":hltu=X.U8(G+1),hltd=X.U8(G+2)
break
case"SAIN":smp++,(q=X.UCSD(G+2)).trim().length&&sainmsg.push(q)
break
case"INST":X.U8(G)&&ins++,(q=X.UCSD(G+1)).trim().length&&instmsg.push(q)
break
case"DONE":end=!0}G+=hksz}sOption(E),sOption(_),sOption(instmsg.filter(funSampleName).join("\n"),"ins/msg:\n"),sOption(sainmsg.filter(funSampleName).join("\n"),"smp/msg:\n"),sOption("bpm0:"+bpm0+" spd0:"+spd0+" ord:"+ord+" ins:"+ins+" smp:"+smp+" hlt:"+hltu+"/"+hltd+" RPB:"+rpb+" st.sep0:"+st0+" mixvol:"+mvol+" sz:"+outSz(X.U32(4)+8))}}else if(X.c("01000000")&&isWithin(X.U8(4),1,15)&&X.c("FFFFFFFF",52)&&X.c("1027",348)&&X.c("1027",356)&&X.c("1027",364))sName="Christer Andersson's BoyScout module (.BSF)",bDetected=1
else if(X.c("'FUCO'")&&X.c("'DIGI'",17412)&&X.c("'DIGP'",18424)){for(sName="Anthony J. 'Slates' Bybell's BSI Future Composer module (.BSI)",bDetected=1,bad="",smp=smpsz=Y=0;Y<63;Y++)(E=X.U32(17420+16*Y,_BE))&&smp++,smpsz+=E,131072<E&&(bad=bad.addIfNone("!badsmpsz"))
""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&sOption("smp:"+smp+" sz:"+outSz(18428+smpsz))}else if(X.c("'NuBEATHOVEN'",34))bDetected=1,sName="Thomas 'Dr.Nobody' Lopatic's Beathoven Synthesizer (.BSS)",sVersion="v"+X.SA(45,3),X.isVerbose()&&(F=X.SA(108,256),auth=X.SA(108+F.length+1,256),misc=X.SA(108+F.length+auth.length+2,256),sOptionT(F),sOptionT(auth,"by: "),sOptionT(misc))
else if(X.c("'CBA'F9")&&26==X.U8(36)&&332+X.U16(37)+48*X.U8(41)<=X.Sz()&&isWithin(X.U8(39),1,32)&&X.U8(43)&&32<=X.U8(44)){if(sName="Chuck Biscuits & Zenic/Heretics' module (.CBA)",bDetected=1,X.isVerbose()){for(msglen=X.U16(37),ch=X.U8(39),ptn=X.U8(40)+1,ord=X.U8(41),smp=X.U8(42),spd0=X.U8(43),tmp0=X.U8(44),Y=smpsz=0;Y<smp;Y++)smpsz+=X.U32(332+48*Y+36)
K=332+48*smp+64*ptn*5*ch+smpsz,r=X.SC(K,msglen,"CP437").trim(),K+=msglen,sOptionT(X.SA(4,32)),sOption(addEllipsis(r,192,160),'msg:"','"'),sOption("spd:"+spd0+" tempo:"+tmp0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))}}else if(X.c("'<CUD-FM-File>'1ADEE0")&&(!X.U8(19)&&X.c("'CUD-FM-File - SEND A POSTCARD -'",1537)||X.U8(19)&&X.c("'YsComp'07'CUD1997'1A04",32)))sName="Daniel Eshcbach/CUD's Boom Tracker 4 module (.CFF)",sVersion="v"+X.U8(16),bDetected=1,X.U8(19)&&(sVersion+="/LZW-packed"),X.isVerbose()&&sOption(outSz(32+X.U16(17)),"sz:")
else if(X.c("'CHIPv1.0'")){for(sName="Dmitry 'Alone Coder' Bystrov's Chip Tracker module (.CHI)",bDetected=1,sVersion="v"+X.SA(5,1),bad="",X.Sz()<=256&&(bad=bad.addIfNone("!badsz")),ptn=smp=0,tempo=X.U8(40),ord=X.U8(41)+1,lp=X.U8(48),Y=0;Y<ord;Y++)(G=X.U8(256+Y)+1)>ptn&&(ptn=G),31<G&&(bad=bad.addIfNone("!badord"))
for(K=512+512*ptn,Y=0;Y<16;Y++)(A=X.U16(45+4*Y))&&(smp++,255&(K+=A))&&(K+=256-(255&K))
bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(decAnsi(8,32,CPSpeccy,!1,Chars0to1FSpeccy)),sOption("tempo:"+tempo+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)))}else if(X.c("000003F3")&&X.c("70FF4E75'S.PHIPPS'",32)&&0<X.I32(64,_BE)<X.Sz()&&0<X.I32(68,_BE)<X.Sz())sName="Simon Phipps/Core Design module (.CORE)",bDetected=1,X.isVerbose()&&(F=X.SA(104,256),auth=X.SA(104+F.length+1,256),misc=X.SA(104+F.length+auth.length+2,256),sOptionT(F),sOptionT(auth,"by: "),sOptionT(misc))
else if(X.c("'CAT '................'FORM'"))sName="Andreas Öman's Cybertracker module (.CT)",bDetected=1
else if(X.c("0004'NNTRKMZX'")){if(sName="CyberBrain's Cybertracker C64 module (.CT)",bDetected=1,sVersion="v"+X.U8(11)+"."+X.U8(10),X.isVerbose()){for(sng=0;sng<X.U16(1209,_LE)&&0!=X.U8(1211+sng-1);sng++);sng?(sng0ord=X.U8(1211),loop0=X.U8(1725),1<sng?sOption("×"+sng+" ord0:"+sng0ord+" loop0:"+loop0):sOption(" ord:"+sng0ord+" loop:"+loop0)):sOption("empty")}}else if(X.c("0004'NNTRKINS'"))sName="CyberBrain's Cybertracker C64 instrument (.CI)",bDetected=1,sVersion="v"+X.U8(11)+"."+X.U8(10),X.isVerbose()&&sOptionT(X.SA(26,16))
else if(X.c("000003F3")&&0<X.fStr(32,256,"NuDELIRIUM"))sName="DeliTracker player addon or Amiga Custom Module (.CUST)",bDetected=1,sVersion="CustomPlay",X.isVerbose()&&sOptionT(X.SA(X.fStr(0,256,"NuDELIRIUM")+20,256))
else if(X.c("'JCH'26026601")&&X.c("'Creative Voice File'1A1A000A01291101......C300",64))sName="Jens Christian 'JCH/Vibrants' Huus's Edlib Tracker samples (.S01)",bDetected=1
else if(X.Sz()<65535&&(X.c("'JCH'26 026600")||X.c("'JCH'26 026680"))&&(X.c("FFFF",X.U16(113,_LE)-2)||X.c("FFFF",X.U16(115,_LE)-2))){for(msgp=0,Y=0;Y<4;)65535!=(E=X.U16(113+Y,_LE))&&E>msgp&&(msgp=E),Y+=2
K=X.fSig(msgp,TOEOF,"FFFF")+2,bDetected=1,bad=0,sName="Jens Christian 'JCH/Vibrants' Huus's Edlib Tracker module (.D00,.D01)",sVersion="v"+X.U8(7),(bad=1<X.U8(10)?1:bad)&&(sVersion+="/malformed"+bad),X.isVerbose()&&(k=X.U8(9),sOptionT(X.SC(11,32,"CP850")),1<k&&sOption(k,"×"),sOptionT(X.SC(43,32,"CP850"),"by: "),sOptionT(X.SC(msgp,K-msgp-2,"CP850")),sOption(outSz(K),"sz:"))}else if(X.c("'DBM0'........'NAME'0000002C")&&X.U8(4)<4&&X.c("'INFO'0000000A",60)&&X.c("'SONG'",78)&&X.U16(68,_BE)<=255&&X.U16(70,_BE)<=255&&X.U16(74,_BE)<=1024&&4<=X.U16(76,_BE)&&X.U16(76,_BE)<=254&&!(X.U16(76,_BE)%1)){for(sName="APC&TCP/Andeas Magerl's DigiBooster Pro module (.DBM)",bDetected=1,sVersion="v"+X.U8(4)+"."+X.U8(5).padStart(2,"0"),done=gotinfo=!(G=8),bad="",X.isVerbose()&&(ord=[]),insts=[],titles=[];!done&&G<X.Sz();){switch(hkhd=X.SA(G,4),hksz=X.U32(G+4,_BE),G+=8,hkhd){case"INFO":k=X.U16(G+4,_BE),ins=X.U16(G,_BE),a="ch:"+X.U16(G+8,_BE)+" ptn:"+X.U16(G+6,_BE)+" ins:"+ins+" smp:"+X.U16(G+2,_BE),gotinfo=!0
break
case"SONG":if(gotinfo){if(X.isVerbose())for(q=0;q+44<hksz;)E=X.SC(G+q,44,"CP1250").trim(),titles.push(E),q+=44,ord.push(X.U16(G+q,_BE)),q+=2+2*ord[ord.length-1]}else bad=bad.addIfNone("!badchunkorder")
break
case"INST":if(gotinfo)for(Y=0;Y<ins;Y++)""!=(E=X.SA(G+50*Y,34).trim())&&insts.push(E),((c3freq=X.U32(G+50*Y+34,_BE))<2e3||192e3<c3freq)&&(bad=bad.addIfNone("!badc3freq"))
else bad=bad.addIfNone("!badchunkorder")
break
case"SMPL":gotinfo||(bad=bad.addIfNone("!badchunkorder")),done=!0}G+=hksz}""!=(bad=!done||G>X.Sz()?bad.addIfNone("!short"):bad)&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(F=X.SA(16,44).trim(),sOption(F),sOption(titles.join("; "),F||1!=F.length?"":"songs:"),""!=F||titles.length||sOptionT(X.SA(216,28)),1<k&&sOption(k,"×"),sOptionT(addEllipsis(insts.join(" "),256,160),'smp/msg: "','"'),a="ord:"+ord.join("+")+" "+a,sOption(a+" sz:"+outSz(G)))}else if(X.c("'DSNGSEQU'00"))sName="David Hanney's module (.DH)",bDetected=1
else if(X.c("'DIGI Booster module'00")&&1572<=X.Sz()&&X.U8(25)&&X.U8(25)<=8&&X.U8(47)<=127){if(sName="APC&TCP/Andeas Magerl's DigiBooster module (.DIGI)",bDetected=1,nV=X.U8(24),sVersion="v"+(nV>>4)+"."+(15&nV),co=X.U8(26),sVersion!=X.SA(20,4).toLowerCase()&&(sVersion+='/"'+X.SA(20,4)+'"'),co&&(sVersion=sVersion.appendS("co.ptn","/")),X.isVerbose()){for(sOptionT(decAnsi(610,32,CPAmiga,!0)),r=[],ch=X.U8(25),ord=X.U8(47)+1,ptn=X.U8(46)+1,smp=A=0,Y=0;Y<31;Y++)(slen=X.U32(176+4*Y,_BE))&&(smp++,A+=slen)
for(Y=0;Y<31;Y++)r.push(decAnsi(642+30*Y,30,CPAmiga,!0).trim())
if(K=1572,co)for(Y=0;Y<ptn&&K<=X.Sz();Y++)K+=2+X.U16(K,_BE)
else K+=256*ptn*ch;(K+=A)>X.Sz()&&!X.isVerbose()&&(sVersion=sVersion.appendS("malformed!short","/")),sOptionT(addEllipsis(r.filter(funSampleName).join(" "),256,160),'by/msg: "','"'),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))}}else if(X.c("000003F3")&&X.c("70FF'NuUNCLEART'",32)&&X.U8(20)&&X.U32(44,_BE)&&X.U32(48,_BE)&&X.U32(56,_BE)){if(sName="Dave 'Uncle Tom' Lowe module (.DL)",bDetected=1,X.isVerbose()){if(smpip=32+X.U32(60,_BE),smpiep=32+X.U32(64,_BE),smp=smpiep?Math.floor((smpiep-smpip)/14):0,F=X.SA(32+X.U32(80,_BE),256),auth=X.SA(32+X.U32(84,_BE),256),cmt=X.SA(32+X.U32(88,_BE),256),loadsz=32+X.U32(92,_BE),K=32+X.U32(96,_BE),sza=Hex(X.Sz()-K),smpsz=32+X.U32(100,_BE),songsz=32+X.U32(104,_BE),sfx=32+X.U32(108,_BE),k=1,d1=32+X.U32(76,_BE))for(a1=d1;;){if(a1+=16,!(d1=X.U32(a1,_BE)))break
if(!(d1-=X.U8(a1+3)))break
k++}sOptionT(F),1<k&&sOption(k,"×"),sOptionT(auth,"by: "),sOptionT(cmt),sOption("smp:"+smp+" sfx:"+sfx)}}else if(X.c("'ALL '0000 .... 0000")&&X.U8(6)<=1&&X.U8(10)<=1)sName="Bent 'SHOGUN' Nielsen's Delta Music module (.DM)",sVersion="v1.3",bDetected=1
else if(X.c("4A00670003B40C000001670001EC0C000002670A0C000003671270004E7541FA0B680201003F11",4)&&X.c("0000'.FNL'",3012))sName="Bent 'SHOGUN' Nielsen's Delta Music 2 module (.DM2)",sVersion="v2.0",bDetected=1
else if(X.c("'DMF'0E"))sName="Webfoot Digital Sound and Music Interface Advanced Music Format hack (.DMF)",sOption("delta samples & no text"),bDetected=1
else if(X.c("'DDMF'")&&X.U8(4)&&X.U8(4)<=10&&X.U16(63)&&X.c("'CMSG'",66)){for(sName="D-Lusion X-Tracker module (.DMF)",bDetected=1,nV=X.U8(4),sVersion="v"+nV,G=66,hkhd=hksz=end=lpst=ch=ord=ptn=smp=K=ptntotallen=B=0,lped=65535;"ENDE"!=hkhd&&G<X.Sz();){switch(hkhd=X.SA(G,4),hksz=X.U32(G+4),G+=8,hkhd){case"SEQU":ord=0,3==nV?G+=2:4==nV&&(G+=4),u=G,3<=nV&&(lpst=X.U16(u),u+=2),4<=nV&&(lpst=X.U16(u),u+=2),4===nV&!lped&&(lped=65535),ord=G+hksz-u>>1
break
case"PATT":var ns=nV<3?9:8
for(u=G,ptn=X.U16(u),trk=X.U8(u+2),u+=3,32<(ch=(ch=trk)<1?1:ch)&&(ch=32),Y=0;Y<ptn;Y++){u+=ns-4
var M=X.U32(u)
ptntotallen+=M,u+=M}break
case"SMPI":for(u=G,smp=X.U8(u++),Y=0;Y<smp;Y++){var os=nV<2?30:X.U8(u++),C=X.SC(u,os,"CP437").trim(),A=(u+=os,X.U32(u)),T=(B+=A,u+=14,X.U8(u++)),I=X.U8(u++)
8<=nV&&(X.SC(u,8,"CP437"),u+=8),u+=1<nV?6:2}break
case"SMPD":if(!X.c("'ENDE'",G+hksz)){if((E=X.fSig(G,Math.min(X.Sz()-G,3*B),"'ENDE'"))<0){sVersion+="/malformed!noeof",hkhd="ENDE"
break}hksz=E-G}break
case"ENDE":G-=4+hksz}K=G,G+=hksz}if("ENDE"!=hkhd?sVersion+="/malformed!short":K=G,X.isVerbose()){sOptionT(X.SC(13,30,"CP437")),sOptionT(X.SC(43,20,"CP437"),"by: "),yy=X.U8(65),yyyy=yy<80?"20":"19",yyyy+=yy.padStart(2,"0"),sOptionT(yyyy+"-"+X.U8(64).padStart(2,"0")+"-"+X.U8(63).padStart(2,"0"),"on: "),sOptionT(X.SA(5,8),"in: "),cmt="",cnt=X.U32(70)-1
for(var ps=75;cnt;){var Xs=Math.min(cnt,40,512),ms=X.SC(ps,Xs,"CP437")
""!=ms&&(cmt=cmt.appendS(ms,"\n")),cnt-=Xs,ps+=Xs}sOption(addEllipsis(cmt,256,128)),sOption("ch:"+ch+"+1 ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))}}else if(X.c("'.DelekDefleMask.'")){if(sName="Leonardo Demartino's DeFleMask module (.DMF)",bDetected=1,sVersion="v"+X.U8(16),X.isVerbose()){switch(X.U8(17)){case 1:sVersion+="#YMU759",ch=17
break
case 2:sVersion+="#Genesis (10ch)",ch=10
break
case 3:sVersion+="#SMS (4ch)",ch=4
break
case 4:sVersion+="#GameBoy (4ch)",ch=4
break
case 5:sVersion+="#PCEngine (6ch)",ch=6
break
case 6:sVersion+="#NES (5ch)",ch=5
break
case 7:case 71:sVersion+="#C64 (3ch)",ch=3
break
case 8:sVersion+="#YM2151 (13ch)",ch=13
break
default:ch=4}sOption(X.UCSD(18)),j=X.U8(18),G=18+j+1,sOption(X.UCSD(G),"by: "),j=X.U8(G),G+=j+1+2,tbase=X.U8(G++),tick1=X.U8(G++),tick2=X.U8(G++),Hz=X.U8(G++)?"60(NTSC)":"50(PAL)",X.U8(G++)?Hz=X.U8(G++)+":"+X.U8(G++)+":"+X.U8(G++):G+=3,sOption("tbase:"+tbase+" tck:"+tick1+":"+tick2+" freq:"+Hz)}}else if(X.c("' M'........'IAN'")&&X.c("0000....0000....0000....0000",28)&&(smp=X.U32(68,_BE))<=255&&(!(smpsz=X.U32(72,_BE))||smp||smp&&smpsz)&&isWithin(ins=X.U32(60,_BE),1,255)){if(sName="Reinier 'Rhino' van Vliet's Digital Mugician module (.DMU,.MUG)","/"==(sv=X.SA(9,1))?sVersion="v1":"2"==sv&&(sVersion="v2"),bDetected=1,X.isVerbose()){for(k=ord=0,ptn=X.U16(26,_BE),wf=X.U32(64,_BE),Y=76,G=28,a2=204;Y<204&&X.U32(Y,_BE);Y+=16,G+=4){for((1!=X.U32(G,_BE)||X.U32(a2,_BE)||X.U32(a2+4,_BE))&&k++,a2+=X.U32(G,_BE)<<3,E=X.SA(Y+4,12);E[E.length-1]<" ";)E=E.slice(0,E.length-1)
sOptionT(E)}for(Y=28;Y<60;Y+=4)ord+=X.U32(Y,_BE)
K=32*smp+16*ins+smpsz+460+256*ptn+128*wf+8*ord,1<k&&sOption(k,"×"),sOption("ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp/syn:"+smp+"+"+wf+" sz:"+outSz(K))}}else if(X.c("'DSM'10")&&X.c("1A",36)&&X.U16(178)-X.U16(176)==4&&X.c("'DSI'10",X.U16(176)<<4)&&X.c("'DSI'10",X.U16(176+2*X.U8(39)-2)<<4)){if(sName="Carlos Hasan's Digital Audio Sound Interface Kit module (.DSM)",bDetected=1,X.isVerbose()){for(Y=175;48<=Y&&255==X.U8(Y);Y--);for(rord=Y-47,mptn=0;48<=Y;Y--)(E=X.U8(Y)+1)>mptn&&(mptn=E)
for(ord=X.U8(38),ptn=X.U8(40),G=X.U16(176)<<4,inss=[],mp=0,Y=ins=0;Y<X.U8(39);Y++,G+=64)X.c("'DSI'10",G)||(bad=bad.addIfNone("!badins")),inss.push(X.SC(G+4,32,"CP437").trim()),(Q=X.U16(G+36)<<4)&&ins++,Q>mp&&(mp=Q+X.U16(G+38))
G=176+2*X.U8(39)+2*ptn-2,G=X.U16(G)<<4,G+=2+X.U16(X.U16(G)),K=Math.max(mp,G),sOptionT(X.SC(4,32,"CP437")),sOption(addEllipsis(inss.filter(funSampleName).join(" "),160),'ins/msg:"','"'),sOption("ord:"+(rord==ord?"":rord+"/")+ord+" ptn:"+(mptn==ptn?"":mptn+"/")+ptn+" ins:"+ins+" sz:"+outSz(K))}}else if(X.c("'RIFF'........'DSMFSONG'")&&X.U16(54)<=128&&X.U16(56)<=128&&X.U16(60)<=256&&X.U16(62)<=16){if(sName="Carlos Hasan's Digital Sound Interface Kit module (.DSM)",bDetected=1,sVersion="RIFF",X.isVerbose()){for(sOptionT(X.SC(20,28,"CP437")),K=X.U32(4)+8,G=12,smp=0;G<K;)hkhd=X.SA(G,4),hksz=X.U32(G+4),G+=8,"INST"==hkhd&&smp++,G+=hksz
G>X.Sz()&&(sVersion+="/malformed!badchunk"),sOption("ch:"+Math.max(1,X.U16(62))+" spd0:"+X.U8(66)+" bpm0:"+X.U8(67)+" ord:"+X.U16(56)+"("+X.U16(52)+"-"+X.U16(54)+") ptn:"+X.U16(60)+" smp:"+X.U16(58)+"/"+smp+" sz:"+outSz(K))}}else if(X.c("'DSm'1A20"))sName="The Loom Syndicate's Dynamic Studio module (.DSM)",bDetected=1,X.isVerbose()&&(sOptionT(X.SA(5,20)),sOptionT(X.SA(25,20),"by: "))
else if(X.c("'DSFmt1'0D0A"))sName="Audio Simulation's DreamStation module (.DSS)",bDetected=1,sVersion="v1.0",X.isVerbose()&&4<=(pt=(pt=X.fSig(0,TOEOF,"F0E40001")+4)<4?X.fSig(0,TOEOF,"F0E40000")+4:pt)&&(pa=X.fSig(pt,TOEOF,"0D0A"),E=X.SA(pt,pa-pt),pa+=2,pc=X.fSig(pa,TOEOF,"0D0A"),p=X.SA(pa,pc-pa),pc+=2,_=X.SA(pc,X.Sz()-pc),sOption(E),sOption(p,"by: "),sOption(_))
else if(X.c("'DS2F0'....'Default'"))sName="Audio Simulation's DreamStation II module (.DS2)",bDetected=1,sVersion="v2",X.isVerbose()&&(ts=X.U8(98),E=X.SA(99,ts),pa=98+ts+1,as=X.U8(pa),p=X.SA(pa+1,as),pc=pa+as+1,cs=X.U8(pc),_=X.SA(pc+1,cs),sOption(E),sOption(p,"by: "),sOption(_))
else if(X.c("'MMU2'00"))sName="Great Valley Products' Digital Sound Studio module (.DSS)",bDetected=1,sVersion="v1-3.0",X.isVerbose()&&(sOptionT(X.SA(10,32)),sOption("ord:"+X.I16(1436,_BE)))
else if(X.c("'DTL'00")&&X.c("0000001000",22))sName="Larry Tipton's Drum Traker module (.DTL)",bDetected=1,X.isVerbose()&&sOptionT(X.SA(4,20))
else if(X.c("'D.T.'00"))0<=(sv=["S.Q.","VERS"].indexOf(X.SA(42,4)))&&(sName="Softjee's Digital Tracker module (.DTM)",bDetected=1,X.isVerbose())&&(0==sv?sOptionT(X.SA(22,20)):sOptionT(X.SA(22,24)))
else if(X.c("'DeFy DTM'"))sName="DeFy AdLib Tracker module (.DTM)",bDetected=1,sVersion="v"+X.SA(9,3),X.isVerbose()&&(sOptionT(X.SA(13,20)),sOptionT(X.SA(33,20),"by: "))
else if(X.c("'SONG'........'NAME'"))sName="Horst Beham Jr.'s DigiTrekker module (.DTM)",bDetected=1,X.isVerbose()&&sOptionT(X.SA(16,20))
else if(X.c("48E7F1FE610000964CDF7F8F'NuH'E70010610000'$L'DF0800'NuH'E7F1FE610001844CDF7F8F'NuH'E70010610000'NL'DF0800'NuG'FAFFC651EB05',Q'EB05'PQ'EB05'tQ'EB059833FC000F00DFF09633FC00FF00DFF09E33FC000000DFF0A833FC000000DFF0B833FC000000DFF0C833FC000000DFF0D8'NuG'FAFF80177C00010524177C00010548177C0001056C177C00010590'NuG'FAFF'bJ+'00BA670E'S+'00B96608177C000600B9'Nu`'0003180006"))sName="David Whittaker's SFX module (.DW)",bDetected=1
else if(X.c("' PWD'03")&&X.c("'Master'",14))sName="Daniel Werner/ExperimentalScene's DarkWave Studio module (.DWP)",bDetected=1
else if(X.c("'EASO'"))sName="Morten Grouleff's EarAche module (.EA,.EAS)",bDetected=1
else if(X.c("'FORM'.... ....'EMODEMIC'")&&X.c("'PATT'",pt=20+X.U32(16,_BE))&&X.c("'8SMP'",q=pt+8+X.U32(pt+4,_BE))){for(sName="Bo Lincoln's Quadra Composer module (.EMOD)",bDetected=1,sVersion="v"+X.U16(20,_BE),(smp=X.U8(63))&&(smps=[]),K=X.U32(4,_BE)+8,Y=A=0,G=64;Y<smp;Y++,G+=34)""!=(E=X.SC(G+4,20,"CP1252").trim())&&smps.push(E),A+=X.U16(G+2,_BE)<<1
bad="",A!=X.U32(q+4,_BE)&&(bad=bad.addIfNone("!badsmplen:"+X.U32(q+4,_BE)+" vs "+A)),ptn=X.U8(++G),G++,G+=26*ptn,X.c("'MDIN'",q1=q+8+X.U32(q+4,_BE))&&(q=q1),1<Math.abs(K-(sz1=q+8+X.U32(q+4,_BE)))&&(bad=bad.addIfNone("!badlen:"+K+" vs "+sz1)),K<sz1&&(K=sz1),ord=X.U8(G++),""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT("<sans titre>"===(E=X.SA(22,20))?"":E),smp&&sOptionT(addEllipsis(smps.join(" "),192,160),'smp/msg: "','"'),smps=void 0,sOption("bpm:"+X.U8(62)+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)))}else if(X.c("'E.M.S. V6.0'..00010000")&&isWithin(X.U8(11),49,54))sName="Sean 'Odie' Connolly's Electronic Music System module (.EMS)",bDetected=1,sVersion="v6."+X.SA(10,2),X.isVerbose()&&(a1=X.U32(14,_BE),a2=X.U32(18,_BE),a3=X.U32(22,_BE),G=lb0=34,G+=a1,lb4=G,G+=a2,lb8=G,G+=a3,insp=G,K=G+X.U32(30,_BE),sOption("sz:"+outSz(K)))
else if(X.c("'ENF '....'scor'")){for(sName="Musitek SmartScore Extended Notation Format sheet music (.ENF)",bDetected=1,G=6,staf=brln=0,hkhd="dumm";G<X.Sz()&&(hkhd=X.SA(G,4),/[a-z\[\]\-0-9]{4}/.test(hkhd));)hksz=X.U16(G+4,_BE),"staf"===hkhd?staf++:"brln"===hkhd&&brln++,G+=hksz
sOption("staves:"+staf+" bars:"+brln+" sz:"+outSz(G))}else if(36<X.Sz()&&X.c("'ETracker (C) BY ESI.'",10)||1236<X.Sz()&&(X.c("21B384")||X.c("21B304"))&&X.c("'ETracker (C) BY ESI.'",1213)){for(sName=" Maciej J. Wołoszyk & Andrzej Siuda's E-Tracker file (.ETC,.SAA)",bDetected=1,ofs=X.c("21B384")||X.c("21B304")?(sVersion="&player",1203):0,G=ofs,k=mp=K=0,ords=[],ptns=[];G<X.Sz()-36&&X.c("'ETracker (C) BY ESI.'",G+10);){if(k++,(ordp=G+X.U16(G))>mp&&(mp=ordp),(ptnp=G+X.U16(G+2))>mp&&(mp=ptnp),(smpp=G+X.U16(G+4))>mp&&(mp=smpp),(ornp=G+X.U16(G+6))>mp&&(mp=ornp),(svd=ofs+X.U16(G+6))>mp&&(mp=svd),K<mp&&(K=mp),1==k&&K>X.Sz())return!1
ord=lp=xpos=ptn=0
for(G=ordp;G<X.Sz();G++){if(255==(o=X.U8(G))){G++
break}if(254==o)lp=ord
else if(96<=o)xpos=o-96
else{if(1==k&&o%3)return _log("SAAFault @"+Hex(G)+": trk "+k+" pos not divisible by 3"),!1
if(o=Util.div64(o,3),1==k&&31<o)return _log("SAAFault: trk "+k+" pos over 1Fh"),!1
o>ptn&&(ptn=o),ord++}if(254<ord)return _log("SAAFault: trk "+k+" pos not divisible by 3"),!1}if(!ord)return!1
for(ords.push(++ord),ptns.push(++ptn),K<G&&(K=G),G=ptnp+12*ptn,Y=ptnp;Y<G;Y+=2)if((E=X.U16(Y))>mp-ofs&&(mp=ofs+E),E<30)return!1
if(1==k&&mp>X.Sz())return!1
if(notes=-1,G<E)for(G=E+64,G=ptnp,notes=0,chncnt=[64,64,64,64,64,64],j=0;j<64;j++)for(_=0;_<6;_++)if(chncnt[_])chncnt[_]--
else for(;G<X.Sz();){if(210<=(cmd=X.U8(G++))){chncnt[_]-=cmd-210
break}if(114<=cmd)notes++
else if(!(82<=cmd)&&81<=cmd)break}K<G&&(K=G),ornp==mp&&K<mp&&(K=mp),smpp==mp&&K<mp&&(K=mp),svd==mp&&K<mp&&(K=mp)}X.isVerbose()&&(1<k&&sOption(k,"×"),sOption("ord:"+ords.join("+")+(lp?" looped":"")+" ptn:"+ptns.join("+")+(xpos?" xpos:"+xpos:"")+(-1<notes?" notes:"+notes:"")+" sz:"+outSz(K)))}else if(2060<X.Sz()&&X.c("00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",993)&&X.c("......00 ......00 ......00 ......00 ......00 ......00 ......00",1236))sName="EUPHONY module (.EUP)",bDetected=1,X.isVerbose()&&sOption(X.SC(0,32,"CP932"))
else if(X.c("'EuGH'")&&X.c("'EuSH'",E=8+X.U32(4,_BE))&&X.c("'MThd'",E=E+8+X.U32(E+4,_BE))&&X.c("'MTrk'",G=E+8+X.U32(E+4,_BE))){for(sName="Fujitsu EUPHONY II/MTR module (.EUX)",bDetected=1,trk=X.U16(E+10,_BE),K=G,txt=by=F=lyr="",Y=0;Y<trk;Y++){var N=20
if(!X.c("'MTrk'",G)||Y&&!X.c("FF2F00",G-3)){bad+="!badtrk"+Y
break}for(len=X.U32(G+4,_BE),K=G+=8;N&&G<K+len&&G<X.Sz();){switch(N--,dt=readVarUInt(G),G+=dt[0],X.U8(G++)){case 240:case 247:E=readVarUInt(G),G+=E[0]+E[1]
break
case 255:switch(p=X.U8(G++)){case 0:2!=X.U8(G++)?N=0:G+=4
break
case 3:E=readVarUInt(G),G+=E[0],F=F.append(X.SC(G,E[1],"SJIS")),G+=E[1]
break
case 2:E=readVarUInt(G),G+=E[0],by=by.append(X.SC(G,E[1],"SJIS")),G+=E[1]
break
case 1:E=readVarUInt(G),G+=E[0],txt=txt.append(X.SC(G,E[1],"SJIS")),G+=E[1]
break
case 5:E=readVarUInt(G),G+=E[0],lyr=lyr.append(X.SC(G,E[1],"SJIS"),"-"),G+=E[1]
break
case 4:case 6:case 7:E=readVarUInt(G),G+=E[0]+E[1]
break
case 32:E=readVarUInt(G),G+=E[0]+E[1],1!=E[1]&&(N=0,bad+="!badprefix@"+(G-E[0]-E[1]))
break
case 47:E=readVarUInt(G),G+=E[0]+E[1],E[1]&&(bad+="!badEoTtag@"+(G-E[0]-E[1])),N=0
break
case 81:E=readVarUInt(G),G+=E[0]+E[1],3!=E[1]&&(N=0,bad+="!badtempo@"+(G-E[0]-E[1]))
break
case 84:E=readVarUInt(G),G+=E[0]+E[1],5!=E[1]&&(N=0,bad+="!badSMPTE@"+(G-E[0]-E[1]))
break
case 88:E=readVarUInt(G),G+=E[0]+E[1],(E[1]<2||4<E[1])&&(N=0,bad+="!badtime@"+(G-E[0]-E[1]))
break
case 89:E=readVarUInt(G),G+=E[0]+E[1],2!=E[1]&&(N=0,bad+="!badkey@"+(G-E[0]-E[1]))
break
default:E=readVarUInt(G),G+=E[0]+E[1]}}(""!=txt&&""!=by&&""!=F||512<G-K)&&(N=0)}if(K+=len,(G=K)>X.Sz()&&!X.isVerbose()){bad+="!short"
break}}bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(F),sOptionT(by,"by: "),sOptionT(txt),sOption((1<trk?"trk:"+trk+" ":"")+"sz:"+outSz(K)))}else if(X.c("'FAR'FE")&&X.c("0D0A1A",44)&&X.Sz()>X.U16(47)){if(bDetected=1,nV=X.U8(49),sName="Daniel Potter/Digital Infinity's Farandole Composer module (.FAR)",sVersion="v"+(nV>>4)+"."+(15&nV),ch=X.readBytes(50,16).filter(function(s){return 1==s}).length,X.isVerbose()){for(sOptionT(X.SC(4,40,"CP437")),msgsz=X.U16(96),r=[],Y=0,G=98;Y<msgsz&&G<X.Sz();Y+=132,G+=Math.max(0,Math.min(132,msgsz-Y)))r.push(X.SC(G,Math.max(0,Math.min(132,msgsz-Y)),"CP437").trim())
for(sOptionT(addEllipsis(r.join(" "),256),'msg:"','"'),G=98+msgsz+256,ptn=X.U8(G++),ord=X.U8(G++),lp=X.U8(G++),Y=psz=0;Y<256;Y++,G+=2)psz+=X.U16(G)
for(G=X.U16(47)+psz,smp=0,smpm=X.readBytes(G,8),smps=[],G+=8,Y=0;Y<64;Y++)smpm[Y>>3]&1<<(7&Y)&&smp++
for(Y=0;Y<smp;Y++)smps.push(X.SC(G,32,"CP437")),G+=48+X.U32(G+32)
sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),256),'smp/msg:"','"'),sOption("ch:"+ch+" ord:"+(lp?lp+"~":"")+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(G))}}else if(X.c("'FPT'FE")&&X.c("0D0A1A",36))sName="Daniel Potter/Digital Infinity's Farandole Composer pattern (.FPT)",bDetected=1,X.isVerbose()&&sOptionT(X.SC(4,32,"CP850"))
else if(X.c("'FSM'FE")&&X.c("0A0D1A",36))sName="Daniel Potter/Digital Infinity's Farandole Composer sample (.FSM)",bDetected=1,X.isVerbose()&&(sOptionT(X.SC(4,32,"CP850")),type=X.U8(53)?"16bit":"8bit",looped=4&X.U8(54)?" looped":"",sVersion=type+looped,sOption(outSz(X.U32(39)),"sz:"))
else if(X.c("'SMOD'")&&112<X.Sz()&&isWithin(X.U32(8,_BE),112,X.Sz())&&isWithin(X.U32(16,_BE),112,X.Sz())&&isWithin(X.U32(24,_BE),112,X.Sz())&&isWithin(X.U32(32,_BE),112,X.Sz())){if(sName="Superions' Future Composer module (.FC,.FC13,.SMOD)",sVersion="v1.0~3",bDetected=1,X.isVerbose()){for(ordsz=X.U32(4,_BE),ordsz+=ordsz%2,ord=(ord=Util.divu64(ordsz,13))||1,ptnp=X.U32(8,_BE),ptnsz=X.U32(12,_BE),ptn=ptnsz>>6,smpp=X.U32(32,_BE),smpsz=X.U32(36,_BE),smp=wf=0,sszs=[],G=40,Y=0;Y<10;Y++,G+=6)(E=X.U16(G,_BE)<<1)&&smp++,sszs.push(E)
for(Y=10;Y<90;Y++)sszs.push(X.U8(G++)<<1)
for(Y=89;10<=Y&&!sszs[Y];Y--);wf=Y-9,sszs=void 0,sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" wf:"+wf+" sz:"+outSz(smpp+smpsz))}}else if(X.c("'FC14'")&&192<X.Sz()&&isWithin(X.U32(8,_BE),192,X.Sz())&&isWithin(X.U32(16,_BE),192,X.Sz())&&isWithin(X.U32(32,_BE),192,X.Sz())&&isWithin(X.U32(36,_BE),192,X.Sz())){if(sName="Superions' Future Composer module (.FC,.FC14)",sVersion="v1.4",bDetected=1,X.isVerbose()){for(ordsz=X.U32(4,_BE),ord=(ord=Util.divu64(ordsz,13))||1,ptnp=X.U32(8,_BE),ptnsz=X.U32(12,_BE),ptn=ptnsz>>6,smpp=X.U32(32,_BE),wfp=X.U32(36,_BE),smp=10,rsmp=msmp=wf=0,sszs=[],G=40,Y=0;Y<10;Y++,G+=6)sszs.push(X.U16(G,_BE)<<1)
for(K=0,Y=10;Y<90;Y++)K+=E=X.U8(G++)<<1,sszs.push(E)
for(Y=89;10<=Y&&!sszs[Y];Y--);for(wf=Y-9,K+=X.U32(36,_BE),G=smpp,Y=0;Y<10;Y++)if(rsmp++,sszs[Y]&&X.c("'SSMP'")){for(mszs=[],G+=4,msmp++,smp--,rsmp--,l=0;l<20;l++,G+=20)mszs.push(X.U16(G+4,_BE)<<1)
for(l=0;l<20;l++)mszs[l]&&rsmp++
smp++}sszs=void 0,mszs=void 0,sOption("ord:"+ord+" ptn:"+ptn+" smp:"+rsmp+(smp!=rsmp?"("+smp+")":"")+(msmp?" ssmp:"+msmp:"")+" wf:"+wf+" sz:"+outSz(K))}}else if(X.c("'FMK!'")&&244==X.U8(60)&&isWithin(X.U8(61),1,2)){if(sName="Sami Wilenius's FM-Kingtracker module (.FMK)",sVersion=[,"v1.00~03","v1.06+"][X.U8(61)],bDetected=1,X.isVerbose()){for(text=!0,Y=0;Y<56;Y++)if(X.U8(Y+4)<32){text=!1
break}text&&(sOptionT(X.SA(4,28)),sOptionT(X.SA(32,28),"by: ")),sOption("ord:"+X.U8(74)+" ptn:"+X.U8(76)+" ins:"+X.U8(75))}}else if(X.c("'FMTracker'....'The FM Tracker!'"))sName="Davey W. Taylor's FM Tracker module (.FMT)",bDetected=1,sVersion="v"+X.U8(9)+"."+X.U8(10),X.isVerbose()&&sOptionT(X.SA(31,32))
else if(X.c("'JSR_FMT~"))sName="Jean-Sebastien 'XorJS' Royer's FM-Tracker module (.FMT)",bDetected=1
else if(X.c("'FMTRK'1A"))sName="Morten Stenshorne/Sagitta Software's FM Tracker module (.FMT)",bDetected=1,X.isVerbose()&&sOptionT(X.SA(16,32))
else if(X.c("000003F3")&&X.U8(20)&&X.c("70FF4E75'F.PLAYER'",32)&&X.I32(64,_BE)){if(sName="Paul van der Valk's Future Player module (.FP)",bDetected=1,X.isVerbose()){for(sOptionT(X.SA(X.I32(44,_BE)+32,256)),k=1,G=72;(E=X.U32(G,_BE))&&k++,G+=8,E;);1<k&&sOption(k,"×"),sOptionT(X.SA(X.I32(48,_BE)+32,256),"by:"),sOptionT(outSz(X.I32(56,_BE)+32),"sz:")}}else if(X.c("'Fred Editor '0000")&&X.U16(14,_BE)<=10){for(G=16+1025*(k=X.U16(14,_BE)),spds=[],Y=16;Y<16+k;Y++)spds.indexOf(E=X.U8(Y))<0&&spds.push(E)
if(G<X.Sz())for(Y=0;Y<128&&G<X.Sz();Y++)trksz=X.U32(G,_BE),G+=trksz+4
if(G<X.Sz())for(ins=X.U16(G,_BE),G+=2,Y=syn=un=0;Y<ins&&G<X.Sz();Y++)255===X.U8(G+83)?un++:syn++,G+=96
for(smp=X.U16(G,_BE),syn-=smp,G+=2,Y=0;Y<smp&&G<X.Sz();Y++)G+=4+X.U16(G+2,_BE)
X.c("12345678",G)&&(bDetected=1,K=G+4),bDetected&&(sName="Fred & Julien Clermonte's Fred Editor module (.FRED,.MOD)",sVersion="project",X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("tempos:"+spds.sort().join("-")+" ins:"+(ins-un)+(un?"("+ins+")":"")+(smp?" smp:"+smp:"")+(syn?" syn:"+syn:"")+" sz:"+outSz(K)))}if(!bDetected)if(X.c("'FTMN'03")&&X.U8(5)<64&&4096<=X.U16(8,_BE)&&X.U16(8,_BE)<20480&&X.U8(10)<12&&X.U8(12)<64&&!(252&X.U8(13))&&X.U8(14)&&X.U8(14)<=24&&4<=X.U8(15)&&X.U8(15)<=96&&X.U8(15)==Util.div64(96,X.U8(14))&&X.U8(80)<=64&&!X.U8(81)&&X.Sz()>=82+32*X.U8(5)+4*X.U8(80)){if(sName="Jörg W.Schmidt/MAXON's Face the Music module (.FTM)",sVersion="v"+X.U8(4),bDetected=1,X.isVerbose()){for(smp=X.U8(5),msr=X.U16(6,_BE),bpm0=(1766278.163/X.U16(8,_BE)).toFixed(0),fl=X.U8(13),fx=X.U8(80),gvol0=X.U8(12),G=82+32*smp,realsmp=0,Y=0;Y<smp;Y++)X.U8(82+32*Y)&&realsmp++
for(fxln=0,ticksper=X.U8(14),rowsper=X.U8(15),Y=0;Y<fx;Y++)E=X.U16(G,_BE),fxln+=E,G+=4+4*E
if(msr)for(Y=0;Y<8;Y++)G+=6+X.U32(G+2,_BE)
if(1&fl)for(Y=0;Y<realsmp;Y++)G+=4+2*(X.U16(G,_BE)+X.U16(G+2,_BE))
sOptionT(decAnsi(16,32,CPAmiga)),sOptionT(decAnsi(48,32,CPAmiga),"by: "),sOption("bpm0:"+bpm0+" ptn:"+msr+" smp:"+realsmp+"/"+smp+" fx:"+fx+"/"+fxln+" msr:"+ticksper+"/"+rowsper+(1&fl?"":" ext.smps")+" gvol0:"+gvol0+" sz:"+outSz(G))}}else if(X.c("'FMS!'..000000"))sName="BleuBleu's FamiStudio module (.FMS)",bDetected=1,sVersion="v"+X.U8(4)
else if(X.c("'FamiTracker Module'")&&0<X.fSig(18,16,"00'PARAMS'")&&0<X.fSig(24,256,"00'INFO'"))sName="Jonathan Liss's FamiTracker module (.FTM)",bDetected=1,X.isVerbose()&&(itag=X.fStr(24,256,"INFO"),sOptionT(X.SA(itag+24,32)),sOptionT(X.SA(itag+56,32),"by: "),sOptionT(X.SA(itag+88,32)))
else if(X.c("'-Furnace '")){switch(X.SA(9,7)){case"module-":cV="m",bDetected=1,sName="tildearrow et al.'s Furnace Tracker module (.FUR)"
break
case"instr.-":cV="i",bDetected=1,sName="tildearrow et al.'s Furnace Tracker instrument (.FUI)"
break
case"waveta-":cV="w",bDetected=1,sName="tildearrow et al.'s Furnace Tracker wavetable (.FUW)"
break
default:cv="?",bDetected=1,sName="unknown tildearrow et al.'s Furnace Tracker file"}if(nV=X.U16(16,_LE),sVersion=nV<12?"["+nV+"]":nV<=14?"v0.2.x":nV<=16?"v0.3.x":nV<=27?"v0.4.x":nV<35?"["+nV+"]":nV<=54?"v0.5.x":nV<57?"["+nV+"]":75==nV?"v.dev75/April Fools' 0.6pre0":nV<=99?"v.dev"+nV:100==nV?"v0.6pre1":101==nV?"v0.6pre1 (dev101)":102==nV?"v0.6pre1 (dev102)":nV<=115?"v.dev"+nV:116==nV?"v.0.6pre1.5":nV<=131?"v.dev"+nV:132==nV?"v.0.6pre2":133==nV?"v.0.6pre3":nV<=140?"v.dev"+nV:141==nV?"Tournament Edition":142==nV?"v.dev"+nV:143==nV?"v.0.6pre4":nV<=145?"v.dev"+nV:146==nV?"v.Pro (joke edition)":nV<=157?"v.dev"+nV:158==nV?"v.0.6pre5":nV<=160?"v.dev"+nV:161==nV?"v.0.6pre6":162==nV?"v.0.6pre7":nV<=165?"v.dev"+nV:166==nV?"v.0.6pre8":nV<=168?"v.dev"+nV:169==nV?"v.0.6pre9":nV<=170?"v.dev"+nV:171==nV?"v.0.6pre10":172==nV?"v.0.6pre11":173==nV?"v.0.6pre12":174==nV?"v.0.6pre13":175==nV?"v.0.6pre14":nV<=176?"v.dev"+nV:177==nV?"v.0.6pre15":178==nV?"v.0.6pre16":179==nV?"v.0.6pre17":180==nV?"v.0.6pre18":181==nV?"v.0.6":nV<=191?"v.dev"+nV:192==nV?"v.0.6.1":nV<=196?"v.dev"+nV:197==nV?"v.0.6.2":nV<=200?"v.dev"+nV:201==nV?"v.0.6.3":nV<=211?"v.dev"+nV:212==nV?"v.0.6.4":nV<=213?"v.dev"+nV:214==nV?"v.0.6.5":nV<=217?"v.dev"+nV:218==nV?"v.0.6.6":219==nV?"v.0.6.7":nV<=224?"v.dev"+nV:225==nV?"v.0.6.8pre1":226==nV?"v.0.6.8pre2":227==nV?"v.0.6.8":228==nV?"v.0.6.8.1":"["+nV+"]","i"===cV&&0<(G=X.U32(20,_LE))&&X.c("'INST'",G)){switch(ity=X.U16(16,_LE)){case 0:sVersion+="/std"
break
case 1:sVersion+="/FM (OPM/OPN)"
break
case 2:sVersion+="/Game Boy"
break
case 3:sVersion+="/C64"
break
case 4:sVersion+="/Amiga|smp"
break
case 5:sVersion+="/PC Engine"
break
case 6:sVersion+="/AY-3-8910"
break
case 7:sVersion+="/AY8930"
break
case 8:sVersion+="/TIA"
break
case 9:sVersion+="/SAA1099"
break
case 10:sVersion+="/VIC"
break
case 11:sVersion+="/PET"
break
case 12:sVersion+="/VRC6"
break
case 13:sVersion+="/OPLL"
break
case 14:sVersion+="/OPL"
break
case 15:sVersion+="/FDS"
break
case 16:sVersion+="/Vritual Boy"
break
case 17:sVersion+="/Namco 163"
break
case 18:sVersion+="/SCC"
break
case 19:sVersion+="/OPZ"
break
case 20:sVersion+="/POKEY"
break
case 21:sVersion+="/PC Speaker"
break
case 22:sVersion+="/WonderSwan"
break
case 23:sVersion+="/Lynx"
break
case 24:sVersion+="/VERA"
break
case 25:sVersion+="/X1-010"
break
case 26:sVersion+="/VRC6(saw)"
break
case 27:sVersion+="/ESS5506"
break
case 28:sVersion+="/MultiPCM"
break
case 29:sVersion+="/SNES"
break
case 30:sVersion+="/Sound Unit"
break
case 31:sVersion+="/Namco WSG"
break
default:sVersion+="/unk"}X.isVerbose()&&(wvt=X.U16(G+24,_LE),smp=X.U16(G+26,_LE),sOptionT(X.SC(G+12,512,"UTF8")),sOption(" wvt:"+wvt+" smp:"+smp))}if("m"===cV&&X.isVerbose()&&0<(G=X.U32(20,_LE))&&X.c("'INFO'",G)){for(E=X.SC(G+256,512,"UTF8"),p1=X.fSig(G+256,512,"00")+1,p=X.SC(p1,512,"UTF8"),p1=X.fSig(p1,512,"00")+1,ins=X.U16(G+22,_LE),wvt=X.U16(G+24,_LE),smp=X.U16(G+26,_LE),ptng=X.U32(G+28,_LE),freq=X.F32(G+12,_LE),A4freq=X.F32(p1,_LE),s1spd=X.U8(G+9)+"/"+X.U8(G+10),s1ptn=X.U16(G+16),s1ord=X.U16(G+18),sOptionT(E),sOptionT(p,"by: "),chips=[],el=!1,Y=0;!el&&Y<32;){switch(X.U8(G+32+Y)){case 0:el=!0
break
case 1:chips[Y]="YMU759 (17ch)"
break
case 2:chips[Y]="Genesis (10ch comp.)"
break
case 3:chips[Y]="SN76489 (SMS) (4ch)"
break
case 4:chips[Y]="Game Boy (4ch)"
break
case 5:chips[Y]="PC Engine (6ch)"
break
case 6:chips[Y]="NES (5ch)"
break
case 7:chips[Y]="C64 (8580) (3ch)"
break
case 8:chips[Y]="Arcade (YM2151+SegaPCM) (13ch)"
break
case 9:chips[Y]="Neo Geo CD (YM2610) (13ch)"
break
case 66:chips[Y]="Genesis extended (13ch)"
break
case 67:chips[Y]="SN76489 (SMS) + YM2413 (OPLL) (13ch comp.)"
break
case 70:chips[Y]="NES+VRC7 (11ch)"
break
case 71:chips[Y]="C64 (6581) (3ch)"
break
case 73:chips[Y]="Neo Geo CD extended (16ch)"
break
case 128:chips[Y]="AY-3-8910 (3ch)"
break
case 129:chips[Y]="Amiga (4ch)"
break
case 130:chips[Y]="YM2151 (8ch)"
break
case 131:chips[Y]="YM2612 (6ch)"
break
case 132:chips[Y]="TIA (2ch)"
break
case 133:chips[Y]="VIC-20 (4ch)"
break
case 134:chips[Y]="PET (1ch)"
break
case 135:chips[Y]="SNES (8ch)"
break
case 136:chips[Y]="VRC6 (3ch)"
break
case 137:chips[Y]="YM2413 (OPLL) (9ch)"
break
case 138:chips[Y]="FDS (1ch)"
break
case 139:chips[Y]="MMC5 (3ch)"
break
case 140:chips[Y]="Namco 163 (8ch)"
break
case 141:chips[Y]="YM2203 (6ch)"
break
case 142:chips[Y]="YM2608 (16ch)"
break
case 143:chips[Y]="YM3526 (OPL) (9ch)"
break
case 144:chips[Y]="YM3812 (OPL2) (9ch)"
break
case 145:chips[Y]="YMF262 (OPL3) (18ch)"
break
case 146:chips[Y]="MultiPCM (28ch)"
break
case 147:chips[Y]="Intel 8253 (beeper) (1ch)"
break
case 148:chips[Y]="POKEY (4ch)"
break
case 149:chips[Y]="RF5C68 (8ch)"
break
case 150:chips[Y]="WonderSwan (4ch)"
break
case 151:chips[Y]="Philips SAA1099 (6ch)"
break
case 152:chips[Y]="OPZ (YM2414) (8ch)"
break
case 153:chips[Y]="Pokémon Mini (1ch)"
break
case 154:chips[Y]="AY8930 (3ch)"
break
case 155:chips[Y]="SegaPCM (16ch)"
break
case 156:chips[Y]="Virtual Boy (6ch)"
break
case 157:chips[Y]="VRC7 (6ch)"
break
case 158:chips[Y]="YM2610B (16ch)"
break
case 159:chips[Y]="ZX Spectrum (beeper) (6ch)"
break
case 160:chips[Y]="YM2612 extended (9ch)"
break
case 161:chips[Y]="Konami SCC (5ch)"
break
case 162:chips[Y]="OPL drums (YM3526) (11ch)"
break
case 163:chips[Y]="OPL2 drums (YM3812) (11ch)"
break
case 164:chips[Y]="OPL3 drums (YMF262) (20ch)"
break
case 165:chips[Y]="Neo Geo (YM2610) (14ch)"
break
case 166:chips[Y]="Neo Geo extended (YM2610) (17ch)"
break
case 167:chips[Y]="OPLL drums (YM2413) (11ch)"
break
case 168:chips[Y]="Atari Lynx (4ch)"
break
case 169:chips[Y]="SegaPCM (DefleMask compat.) (5ch)"
break
case 170:chips[Y]="MSM6295 (4ch)"
break
case 171:chips[Y]="MSM6258 (1ch)"
break
case 172:chips[Y]="Commander X16 (VERA) (17ch)"
break
case 173:chips[Y]="Bubble System WSG (2ch)"
break
case 174:chips[Y]="OPL4 (YMF278B) (42ch)"
break
case 175:chips[Y]="OPL4 drums (YMF278B) (44ch)"
break
case 176:chips[Y]="Seta/Allumer X1-010 (16ch)"
break
case 177:chips[Y]="Ensoniq ES5506 (32ch)"
break
case 178:chips[Y]="Yamaha Y8950 (10ch)"
break
case 179:chips[Y]="Yamaha Y8950 drums (12ch)"
break
case 180:chips[Y]="Konami SCC+ (5ch)"
break
case 181:chips[Y]="tildearrow Sound Unit (8ch)"
break
case 182:chips[Y]="YM2203 extended (9ch)"
break
case 183:chips[Y]="YM2608 extended (19ch)"
break
case 184:chips[Y]="YMZ280B (8ch)"
break
case 185:chips[Y]="Namco WSG (3ch)"
break
case 186:chips[Y]="Namco 15xx (8ch)"
break
case 187:chips[Y]="Namco CUS30 (8ch)"
break
case 188:chips[Y]="MSM5232 (8ch)"
break
case 189:chips[Y]="YM2612 extra features extended (11ch)"
break
case 190:chips[Y]="YM2612 extra features (7ch)"
break
case 191:chips[Y]="T6W28 (4ch)"
break
case 192:chips[Y]="PCM DAC (1ch)"
break
case 193:chips[Y]="YM2612 CSM (10ch)"
break
case 194:chips[Y]="Neo Geo CSM (YM2610) (18ch)"
break
case 195:chips[Y]="YM2203 CSM (10ch)"
break
case 196:chips[Y]="YM2608 CSM (20ch)"
break
case 197:chips[Y]="YM2610B CSM (20ch)"
break
case 198:chips[Y]="K007232 (2ch)"
break
case 199:chips[Y]="GA20 (4ch)"
break
case 200:chips[Y]="SM8521 (4ch)"
break
case 201:chips[Y]="M114S (16ch)"
break
case 202:chips[Y]="ZX Spectrum (beeper/QuadTone) (5ch)"
break
case 203:chips[Y]="Casio PV-1000 (3ch)"
break
case 204:chips[Y]="K053260 (4ch)"
break
case 205:chips[Y]="TED (2ch)"
break
case 206:chips[Y]="Namco C140 (24ch)"
break
case 207:chips[Y]="Namco C219 (16ch)"
break
case 208:chips[Y]="Namco C352 (32ch)"
break
case 209:chips[Y]="ESFM (18ch)"
break
case 210:chips[Y]="Ensoniq ESS503 (32ch)"
break
case 212:chips[Y]="PowerNoise (4ch)"
break
case 213:chips[Y]="Dave (4ch)"
break
case 214:chips[Y]="NDS (16ch)"
break
case 215:chips[Y]="GBA (direct) (2ch)"
break
case 216:chips[Y]="GBA (MinMod) (16ch)"
break
case 217:chips[Y]="Bifurcator (4ch)"
break
case 218:chips[Y]="SCSP (32ch)"
break
case 219:chips[Y]="YMF271 (OPX) (48ch)"
break
case 220:chips[Y]="RF5C400 (32ch)"
break
case 221:chips[Y]="YM2612 XGM (9ch)"
break
case 222:chips[Y]="YM2610B extended (19ch)"
break
case 223:chips[Y]="YM2612 XGM extended (13ch)"
break
case 224:chips[Y]="QSound (19ch)"
break
case 225:chips[Y]="PS1 (24ch)"
break
case 226:chips[Y]="C64 (6581)+PCM (4ch)"
break
case 227:chips[Y]="Watara Supervision (4ch)"
break
case 229:chips[Y]="µPD1771C-017 (4ch)"
break
case 240:chips[Y]="SID2 (3ch)"
break
case 241:chips[Y]="5E01 (5ch)"
break
case 245:chips[Y]="SID3 (7ch)"
break
case 252:chips[Y]="Pong (1ch)"
break
case 253:chips[Y]="Dummy System (8ch)"
break
case 254:case 255:chips[Y]="reserved for development"
break
default:chips[Y]="unk."}el||Y++}sOption("chips: "+chips.join("+")),sOption("ticks="+freq.toFixed(2)+"Hz, A4="+A4freq+"Hz"),sOption("ins:"+ins+" wvt:"+wvt+" smp:"+smp+" glob.ptn:"+ptng),sOption("1st song's spd:"+s1spd+" ptn:"+s1ptn+" ord:"+s1ord)}}else if(X.c("'FWMP'00"))sName="Capcom/ARC Developments' Forgotten Worlds BGM module (.FW)",bDetected=1
else if(X.c("'FXSM'"))sName="František Fuka's Fuxoft AY Language module (.FXM)",bDetected=1
else if(X.c("'GBRF'..00")&&isWithin(X.U8(4),1,48)&&isWithin(X.U8(6),0,3)&&isWithin(X.U8(7),1,3))sName="Gameboy Ripped Format chiptune (.GBR)",bDetected=1,""!=(E=X.SA(340,19))&&/^([a-zA-Z0-9_ -]{4,})/.test(E)&&(sOptions=sOptions.append(E))
else if(112<X.Sz()&&X.c("'GBS'01")&&X.U8(4)&&167<=X.U8(13))bDetected=1,sName="Gameboy Sound chiptune (.GBS)",X.isVerbose()&&sOptionT(X.SA(16,32)),1<(tc=X.U8(4))&&sOption(tc,"×"),X.isVerbose()&&(sOptionT(X.SA(48,32),"by: "),sOptionT(X.SA(80,32)))
else if(X.c("'GDM'FE")&&X.c("0D0A1A'GMFS'",68)&&X.U16(116)<=9&&isWithin(ordp=X.U32(118),157,X.Sz())&&isWithin(ptnp=X.U32(123),157,X.Sz())&&isWithin(smptp=X.U32(128),157,X.Sz())&&isWithin(smpp=X.U32(132),157,X.Sz())){if(sName="BWSB General Digital Music module (.GDM)",bDetected=1,trkr="",0==X.U16(77,_BE)&&(trkr="2gdm"),sVersion="v"+X.U8(75)+"."+X.U8(76),""!=trkr&&(sVersion+="/"+trkr+" v"+X.U8(79)+"."+X.U8(80)),X.isVerbose()){for(ord=X.U8(122)+1,ptn=X.U8(127)+1,smp=X.U8(136)+1,ch=0,Y=81;Y<113;ch+=255!=X.U8(Y++));for(smps=[],Y=B=0,G=smptp;Y++<smp;G+=62)smps.push(X.SC(G,32,"CP437").trim()),B+=X.U32(G+45)
switch(Math.max(ordp,ptnp,smptp,smpp)){case ordp:K=ordp+ord
break
case ptnp:for(G=ptnp,Y=0;Y++<ptn&&G<X.Sz();G+=X.U16(G));K=G
break
case smptp:K=smptp+62*smp
break
case smpp:K=smpp+B}sOptionT(X.SC(4,32,"CP437")),sOptionT(X.SC(36,32,"CP437"),"by: "),sOption(["","ProTracker MOD","Multitracker","Scream Tracker 3","Composer 669 / UNIS 669","Farandole Composer","UltraTracker","Scream Tracker 2","OctaMED","Epic Megagames MASI"][X.U16(116)],"orig:"),sOptionT(X.SC(X.U32(137),X.U32(141),"CP437")),sOptionT(addEllipsis(smps.filter(funSampleName).join("\n"),176),'smp/msg:"\n','"'),sOption("ch:"+ch+" tmp0:"+X.U8(114)+" bpm0:"+X.U8(115)+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))}}else if(X.c("'GLUE'B8B3AABA")){if(sName="Lars 'GlueMaster' Malmborg's GlueMon module (.GLUE)",bDetected=1,X.isVerbose()){for(sOptionT(X.SA(8,8)),ins=X.U8(127),ord=X.U8(158),ptn=0,Y=0;Y<ord;Y++)255!=(E=X.U8(159+Y))&&ptn<E&&(ptn=E)
ptn++,sOption("ord:"+ord+" ptn:"+ptn+" ins:"+ins)}}else if(X.c("'NuFREDGRAY'",34))sName="Fred Gray's module (.GRAY)",bDetected=1,X.isVerbose()&&(E=X.SA(80,256),pn=80+E.length+1,p=X.SA(pn,256),pn+=p.length+1,_=X.SA(pn,256),sOptionT(E),sOptionT(p,"by: "),sOptionT(_))
else if(X.c("'GTK'")&&isWithin(X.U8(3),1,4)&&X.U16(196,_BE)<=255&&isWithin(X.U16(198,_BE),1,256)&&isWithin(X.U16(200,_BE),1,32)&&(ord=X.U16(202,_BE))<=256&&X.U16(204,_BE)<=ord||X.c("'GT2'")&&(5<X.U8(3)&&228==X.U32(4,_BE)||X.U32(4,_BE)==236+2*X.U16(234,_BE))&&isWithin(X.U16(202,_BE),1994,9999)){switch(bDetected=1,sigv=0,bad="",X.U8(2)){case 75:sName="Laurent 'Dumbo' de Soras's Graoumf Tracker module (.GTK)",sVersion="Amiga ",sigv=1
break
case 50:sName="Laurent 'Dumbo' de Soras's Graoumf Tracker 2 module (.GT2)",sVersion="PC ",sigv=2}if(v=X.U8(3),sVersion+="v"+v,1==sigv&&v<6)switch(v){case 1:sVersion+="/GT v0.7"
break
case 2:sVersion+="/GT v0.726"
break
case 3:sVersion+="/GT v0.731"}else 9==v&&(sVersion+="/GT r27")
if(tracker=statln="",1==sigv){for(E=X.SC(4,32,"ISO8859-1").trim(),d=xc="",_=X.SC(36,160,"ISO8859-1").trim(),trk=X.U16(200,_BE),ord=X.U16(202,_BE),smp=0,smprecs=X.U16(196,_BE),rows=X.U16(198,_BE),lp=X.U16(204,_BE),smpinfosz=v<=2?48:64,sszofs=1==v?32:28,3<=v&&(sszofs+=16),2<=v&&(sszofs+=4),smp=smpsz=0,G=206,Y=0;Y<smprecs;Y++)(A=X.U32(G+sszofs,_BE))&&(smpsz+=A,smp++),G+=smpinfosz,A%2&&(bad=bad.addIfNone("!oddsmpsz"))
for(ptn=0,Y=0;Y<ord;Y++)(pt=X.U16(G,_BE))>ptn&&(ptn=pt),G+=2
ptn++,nn=4==v?5:4,songsz=718+smprecs*smpinfosz+ptn*rows*trk*nn,K=songsz+smpsz,statln="trk:"+trk+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+(lp?" lp:"+lp:"")+" sz:"+outSz(K)}else{for(E=X.SA(8,32).trim(),d=X.U16(202,_BE)+"-"+X.U8(201).padStart(2,"0")+"-"+X.U8(200).padStart(2,"0"),_=X.SA(40,160).trim(),tracker=X.SA(204,24),pn=songhk=spd=bpm=ord=lp=mptn=ptn=ins=smp=trk=0,K=-1,xc=[],v<6&&(spd=X.U16(228,_BE),bpm=X.U16(230,_BE));pn<X.Sz();){switch(hkhd=X.SA(pn,4),hksz=X.U32(pn+4,_BE),pn+=8,hkhd){case"SONG":for(ord=X.U16(pn,_BE),lp=X.U16(pn+2,_BE),mptn=0,G=pn+4,Y=0;Y<ord;Y++,G+=2)mptn=Math.max(mptn,X.U16(G,_BE))
mptn++,songhk++
break
case"PATD":case"PAIN":case"PAFX":case"PAMI":ptn++,trk=Math.max(trk,X.U16(pn+22,_BE))
break
case"INST":ins++
break
case"SAMP":case"SAM1":case"SAM2":smp++
break
case"XCOM":xcc=X.U16(pn,_BE),xc=xc.push(X.SA(pn+2,xcc).trim())
break
case"TCN2":bpm=X.U16(pn+2,_BE)+(X.U16(pn+4,_BE)?"."+X.U16(pn+4,_BE):"")
case"ENDC":K=pn+hksz-8}if(pn+=0<hksz-8?hksz-8:0,0<=K)break
if(charStat(next=X.SA(pn,4)).indexOf("allasc")<0||next.toUpperCase()!=next)break}songhk||(bad=bad.addIfNone("!noSONG")),K<=0&&(K=pn,bad=bad.addIfNone("!noendtag")),ptn!=mptn&&(ptn=mptn+"/"+ptn),statln=statln.appendS((bpm?"bpm0:"+bpm+" ":"")+(spd?"spd0:"+spd+" ":"")+"trk:"+trk+" ord:"+ord+(lp?" lp:"+lp:"")+" ptn:"+ptn+" ins:"+ins+" smp:"+smp+" sz:"+outSz(K)," ")}X.isVerbose()&&(sOption(E),sOption(d,"on:"),sOption(tracker,"in:"),sOption(_),xc.length&&sOption(addEllipsis(xc.join("\n"),256,160),'msg: "','"'),sOption(statln)),""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/"))}else if(X.c("'NuH.DAVIES'",34))sName="Howie Davies's module (.HD)",bDetected=1,X.isVerbose()&&(E=X.SA(100,256),pn=100+E.length+1,p=X.SA(pn,256),pn+=p.length+1,_=X.SA(pn,256),sOptionT(E),sOptionT(p,"by: "),sOptionT(_))
else if(X.c("'HESM'00")&&isWithin(X.U8(7),125,254)&&X.c("FFF8",8)&&isWithin(X.I8(10),-8,32)&&isWithin(X.I8(11),-8,32)&&isWithin(X.I8(12),-8,32)&&isWithin(X.I8(13),-8,32)&&isWithin(X.I8(14),-8,32)&&X.c("'DATA'",16)&&0<=[0,224].indexOf(X.U8(20))&&X.c("002000000000000000",23)&&256<=X.Sz()){function fs(){var s,e,t
return!X.U8(G)||(s=32,X.U8(G+31)&&!X.U8(G+47)&&(s=48),(t=(e=X.readBytes(G,s)).indexOf(0))<0)||charStat(e.slice(0,t),1).indexOf("asc")<0||(G+=s,"<?>"==(e=decEncoding(e,CP437,!0,Chars0to1F)))?"":e}sName="Hudson Entertainment System multitrack tune (.HES)",bDetected=1,sVersion="v"+X.U8(4),startsong=X.U8(5),reqaddr=X.U16(6),dtsz=X.U32(20),dtaddr=X.U32(24),X.isVerbose()&&(E=p=_="",G=64,32<=X.U8(G)&&(sOptionT(fs()),sOptionT(fs(),"by:"),sOptionT(fs())),sOption("from:"+startsong+" sz:"+outSz(dtaddr+dtsz)))}else if(X.c("'GTI5'"))sName="Lasse 'Faust' Öörni's GoatTracker 2 Instrument (.INS)",bDetected=1
else if(X.c("'ISM!V1.2'"))sName="Hans Bergstedt's Sound Invasion Music System/In Stereo! module (.IS)",bDetected=1,sVersion="v"+X.SA(5,3),X.isVerbose()&&sOptionT(X.SA(36,25))
else if(X.c("'IS20DF10STBL'"))sName="Hans Bergstedt's Sound Invasion Music System/In Stereo! module (.IS20)",bDetected=1,sVersion="v2.0"
else if(X.c("'IXS!'"))sName="Sahara Surfers' iXalance module (.IXS)",bDetected=1,sVersion="compressed",X.isVerbose()&&(sOptionT(X.SA(24,32)),sOption(outSz(56+X.U32(16)),"sz:"))
else if((X.c("'MUSE'DEADBEAF")||X.c("'MUSE'DEADBABE"))&&X.U32(16)+24==X.U32(8))sName="Jazz Jackrabbit 2 container (.J2B)/Galaxy Sound System module",sVersion="compressed",bDetected=1,X.isVerbose()&&sOption("sz:"+X.U32(8))
else if(X.c("'NuJ.FLOGEL'",34))sName="Janko Mrsic-Flogel's module (.JMF)",bDetected=1,X.isVerbose()&&(E=X.SA(84,256),pn=84+E.length+1,p=X.SA(pn,256),pn+=p.length+1,_=X.SA(pn,256),sOptionT(E),sOptionT(p,"by: "),sOptionT(_))
else if(X.c("2B7C.... ........ 2B7C.... ........ 2B7C.... ........ 2B7C.... ........ 303C00FF 32004EB9 ........ 4E75")&&46<=X.I32(2,_BE)){if(sName="Steve Turner's module (.JPO)",bDetected=1,X.isVerbose()){for(ofs=X.U32(2,_BE),p1=G=X.U32(18,_BE)-ofs+46,d1=10;G<=Math.min(X.Sz(),1048576)&&61695!=(E=X.U16(G,_BE));)G+=2,(d0=E)>d1&&(d1=d0)
for(0<(K=X.fSig(p1+d1,TOEOF,"FF"))&&K++,G=X.U32(10,_BE)-ofs+46,k=0;G<X.Sz()&&!(d0=65520&X.U16(G,_BE));)G+=12,k++
X.c("2b7c0004449c0faa2b7c000479840fa22b7c00047ab40fa62b7c000458980fae")&&(k=5),d0=20+X.U32(26,_BE)-ofs,smp=(X.U32(d0,_BE)>>2)-1,smpsz=X.U32(d0+4,_BE),1<k&&sOption(k,"×"),sOption("smp:"+smp+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K))}}else if(X.c("'KSCC'")&&!X.U8(14)&&!(224&X.U8(15))||X.c("'KSSX'")&&!X.U32(20))sName="Konami's KSS chiptune (.KSS)",bDetected=1,X.c("'KSSX'")?(nv=1,sVersion="extended"):nv=0,bnk=127&X.U8(13),bnk16=128&X.U8(13)?1:2,bnk&&(sVersion=sVersion.appendS("banks"+(1==bnk16?"8k":"16k"),",")),chip=X.U8(15),X.isVerbose()&&X.c("'MBM'",32)&&sOptionT(X.SA(36,52)),K=16+X.U8(14)+X.U16(6)+8192*bnk*bnk16,hnmmode=rammode=!1,scc=!0,ch=1,scc=2&chip?(sVersion+="#SEGA-MkIII(SMS)",4&chip?(sVersion+="/GameGear-Stereo",ch=2):sVersion+="/SMS-SNG(SN76489)",1&chip&&(sVersion+="/FM-UNIT(YM2413)"),136&chip&&(rammode=!0),!1):(16&chip?8&chip?(sVersion+="#MSX-AUDIO-STEREO",ch=2):(sVersion+="#MSX-AUDIO",hnmmode=!0):sVersion+="#MSX-AUDIO",1&chip&&(sVersion+="/MSX-MUSIC"),128&chip?!(rammode=!0):!(rammode=0!=(4&chip))),rammode&&(sVersion+="/RAM"),scc&&(sVersion+="/SCC"),hnmmode&&(sVersion+="/牌の魔術師DAC"),nv&&11<=X.U8(14)&&X.isVerbose()&&(x1=X.U16(24),1<(x2=X.U16(26))-x1)&&sOption("subsongs "+x1+"-"+x2),X.isVerbose()&&sOption("ch:"+ch+(bnk?" ex.bnk:"+bnk:"")+" sz:"+outSz(K))
else if(X.c("'cyd!song'")&&X.U8(8)<30){if(sName="Tero 'kometbomb' Lindeman's Klystrack/Klystron module (.KT)",bDetected=1,v=X.U8(8),sVersion="v"+v,X.isVerbose()){for(G=9,ch=6<=v?X.U8(G++):3<v?4:3,timesig=X.U8(G++)+"/"+X.U8(G++),17<=v&&(G+=2),ins=X.U8(G++),ptn=X.U16(G),G+=2,nseq=[],Y=0;Y<ch;Y++,G+=2)nseq[Y]=X.U16(G)
if(len=X.U16(G),G=G+2+2,12<=v&&G++,spd=X.U8(G++),spd2=X.U8(G++),rate=X.U8(G++),2<v?(fl=X.U32(G),G+=4):fl=0,9<=v&&G++,16<=v&&G++,tlen=17,11<=v&&(tlen=X.U8(G++)),5<=v&&(tlen=Math.min(tlen,65)),sOptionT(X.SC(G,tlen,"CP1250")),G+=tlen,10<=v?fx=X.U8(G++):1&fl&&(fx=1),fx)if(10<=v)for(Y=0;Y<fx;Y++)22<=v&&(nsz=X.U8(G++))&&(G+=Math.min(nsz,32)),G+=9,v<27&&G++,v<21&&G++,27<=v?G+=96:G+=32,G++,19<=v&&G++
else G+=64*fx
for(13<=v&&(G+=2*ch),insn=[],Y=0;Y<ins;Y++)G=(G+=17)+(2*X.U8(G)+1)+7,20<=v&&G++,nsz=v<11?16:Math.min(X.U8(G++),33),insn.push(X.SC(G,nsz,"CP1250").trim()),G+=nsz,1<=v&&(G+=4),7<=v&&(G+=3),10<=v&&G++,11<=v&&(G+=3),18<=v&&G++,wt_entry=12<=v?X.U8(G++):0,23<=v&&(G+=11),25<=v&&G++,fm_wave=23<=v?X.U8(G++):0
for(ord=0,Y=0;Y<ch;Y++)ord=Math.max(nseq[Y],ord),v<8?G+=6*nseq[Y]:G+=5*nseq[Y]
for(notes=0,Y=0;Y<ptn;Y++)if(steps=X.U16(G),G+=2,24<=v&&G++,v<8)s=v<2?3:6,G+=steps*s
else for(slen=(steps>>1)+(1&steps),packed=X.readBytes(G,slen),G+=slen,s=_=0;s<steps;s++)1&(bits=1&s||s==steps-1?15&packed[_]:packed[_]>>4)&&(G++,notes++),2&bits&&G++,4&bits&&(ctl=X.U8(G++),14<=v)&&(bits|=-8&ctl),8&bits&&(G+=2),128&bits&&G++,1&s&&_++
if(maxwt=0,12<=v)for(maxwt=X.U8(G++),Y=0;Y<maxwt;Y++)sn=X.U32(G+8),G+=22,sn&&(v<15?G+=2*sn:(dtsz=X.U32(G),G+=4+Util.divu64(dtsz+7,8)))
if(wts=[],26<=v)for(Y=0;Y<maxwt;Y++)E=X.U8(G++),wts.push(X.SC(G,E,"CP1250").trim()),G+=E
sOptionT(addEllipsis(insn.filter(funSampleName).join(",")),'ins/msg:"','"'),sOption("ch:"+ch+" tsig:"+timesig+" rate:"+rate+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" wt:"+maxwt+" notes:"+notes+" spd:"+spd+"-"+spd2+" fx:"+fx+" sz:"+outSz(G))}}else if(X.c("'cyd!inst'"))sName="Tero 'kometbomb' Lindeman's Klystrack instrument (.KI)",bDetected=1
else if(X.c("'cyd!efex'"))sName="Tero 'kometbomb' Lindeman's Klystrack effects (.KF?)",bDetected=1
else if(X.c("'ADL '0000....'MDhd'00000008000080..00000080'MThd'00000006000200..01E0'MTrk'0000....00FF03")||X.U32(0,_LE)==X.Sz()&&X.c("'AD'",4))sName="Lucas Arts Adlib chiptune (.LAA)",bDetected=1,sVersion="ADL "===X.SA(0,4)?"new":"old"
else if(X.c("'Liquid Module:'")||(X.isHeuristicScan()||X.c("'NO'"))&&extIs("liq")||X.c("21",470)&&X.c("21",2770)&&X.c("21",3046)&&X.c("FF",3796)&&X.c("FF",3816))sName="Nir Oren's Liquid Tracker module (.LIQ)",bDetected=1,sVersion=X.SA(65,20).trim(),X.isVerbose()&&("NO"==X.SA(0,2)?sOptionT(X.SA(5,20)):"Liq"==X.SA(0,3)&&(sOptionT(X.SA(14,50)),sOptionT(X.SA(14,15),"by: ")))
else if(56<X.Sz()&&X.c("'LME'00")&&X.fSig(4,32,"00")<0&&!X.U32(36,_BE)){if(sName="Steve 'Leggless' Hasler module (.LME)",bDetected=1,X.isVerbose()){for(a=decAnsi(4,32,CPAmiga).trim(),songsz=44+X.U32(52,_BE),d3=ins=Util.divu64(X.U32(56,_BE)-(Y=X.U32(40,_BE)),58),k=Y-16>>4,Y+=40,smp=synsmp=smpsz=0,d7=3;d3;d3--,Y+=58)(E=X.U32(Y,_BE))?E>d7&&(d7=E,smpsz+=X.U16(Y+4,_BE)<<1,smp++):synsmp++
steps=X.U32(48,_BE)-X.U32(44,_BE)>>2,K=songsz+smpsz,1<k&&sOption(k,"×"),sOption(a,'info:"','"'),sOption("steps:"+steps+" ins:"+ins+" sz:"+outSz(K))}}else if(X.c("'sa-team 89a'10610A6108610678006000",364)&&X.c("'dynamite89'",564)&&isWithin(X.U16(1290,_BE),0,15)){if(sName="Oscar Giesen & Marco Swagerman's Music Assembler module (.MA)",bDetected=1,X.isVerbose()){for(k=ptn=0,vp=[],ptns=[],ord=[],ch=[],G=1200,Y=0;Y<40;Y++,G+=2)vp[Y]=1570+X.U16(G,_BE)
for(Y=0;Y<40;Y+=4){for(ch_=ord_=0,l=Y;l<Y+4&&l<40;l++)254!=X.U8(vp[l])&&ch_++
if(ch_){for(l=Y,G=vp[l];l<Y+4&&G<X.Sz()&&254!=(E=X.U8(G));G+=2)255==E?l++:(ord_++,ptns.indexOf(E)<0&&ptns.push(E))
ord_&&(k++,ord.push(ord_)),ch.push(ch_)}}1<k&&sOption(k,"×"),insp=1570+X.U32(1462,_BE),ins=Util.divu64(vp[0]-insp,24),sOption("ch:"+ch.join("/")+" ord:"+ord.join("+")+" ptn:"+ptns.length+" ins:"+ins+" sz:"+outSz(1570+X.U32(1454,_BE)))}}else if(X.c("'MADG'"))sName="B. Birney's PlayerPro module (.MAD)",bDetected=1,X.isVerbose()&&sOption(X.SA(4,18))
else if(X.c("D040D0404EFB"))sName="Mark Cooksey's module (.MC)",sVersion="new",bDetected=1
else if(X.c("'MDC'1A 00080040")){for(sName="かるちゃん/CUL.'s music creative driver module (.MDC)",bDetected=1,a="",maxsz=Math.max(X.Sz(),65536),K=X.U32(8,_BE),G=X.U32(20,_BE),midires=X.U16(44,_BE),G&&G<maxsz&&0<(E=X.fSig(G,maxsz,"0D0A1A"))&&(a=X.SC(G,E-G,"Shift_JIS")),G=trkp=X.U32(16,_BE),32<(k=X.U16(G,_BE))&&(sVersion="!badsongcnt"),Y=ch=0,G+=2;Y<Math.min(k,32);Y++,G+=8)ch<X.U8(G+5)&&(ch=X.U8(G+5))
X.isVerbose()&&(sOptionT(a),1<k&&sOption(k,"×"),sOption("ch:"+ch+(K?" sz:"+outSz(K):"")))}else if(X.c("'DMDL'..'IN'"))sName="Digitrakker module (.MDL)",bDetected=1,X.isVerbose()&&(sOptionT(X.SA(11,32)),sOptionT(X.SA(43,20),"by: "))
else if(X.c("'MMDC'"))sName="Tony Crowther's packed MED module (.MMDC)",bDetected=1,X.isVerbose()&&sOption(outSz(X.U32(4,_BE)),"sz:")
else if(X.c("000001001100010014000000'GameBoy Music Module'"))sName="Paragon 5/Beyond Game Boy Tracker module (.MGB)",bDetected=1
else if(X.c("'MGT'11BD'MCS'"))sName="Megatracker module (.MGT)",bDetected=1,sOptionT(X.SA(58,32))
else if(X.c("'MThd'")&&X.c("'MTrk'",8+X.U32(4,_BE))&&X.U16(8,_BE)<=2){switch(sName="Standard MIDI File (.MID)",sVersion="v1.0",nV=X.U16(8,_BE),bad="",bDetected=1,nV){case 0:sVersion+=" t.0:one track"
break
case 1:sVersion+=" t.1:tracks"
break
case 2:sVersion+=" t.2:tracks+tempo"}for(bDetected=1,charset="SJIS",1<(trk=X.U16(10,_BE))&&sOption(trk,"trk:"),0==nV&&1!=trk&&(bad+="!badvertrk"),K=G=14,txt=by=F=lyr="",Y=0;Y<trk;Y++){N=20
if(!X.c("'MTrk'",G)||Y&&!X.c("FF2F00",G-3)){bad+="!badtrk"
break}for(len=X.U32(G+4,_BE),K=G+=8;N&&G<K+len&&G<X.Sz();){switch(N--,dt=readVarUInt(G),G+=dt[0],X.U8(G++)){case 240:case 247:E=readVarUInt(G),G+=E[0]+E[1]
break
case 255:switch(p=X.U8(G++)){case 0:2!=X.U8(G++)?N=0:G+=4
break
case 3:E=readVarUInt(G),G+=E[0],F=F.append(X.SC(G,E[1],charset).trim()),G+=E[1]
break
case 2:E=readVarUInt(G),G+=E[0],by=by.append(X.SC(G,E[1],charset).trim()),G+=E[1]
break
case 1:E=readVarUInt(G),G+=E[0],txt=txt.append(X.SC(G,E[1],charset).trim()),G+=E[1]
break
case 5:E=readVarUInt(G),G+=E[0],lyr=lyr.append(X.SC(G,E[1],charset,"-").trim()),G+=E[1]
break
case 4:case 6:case 7:E=readVarUInt(G),G+=E[0]+E[1]
break
case 32:E=readVarUInt(G),G+=E[0]+E[1],1!=E[1]&&(N=0,bad+="!badprefix@"+(G-E[0]-E[1]))
break
case 47:E=readVarUInt(G),G+=E[0]+E[1],E[1]&&(bad+="!badEoTtag@"+(G-E[0]-E[1])),N=0
break
case 81:E=readVarUInt(G),G+=E[0]+E[1],3!=E[1]&&(N=0,bad+="!badtempo@"+(G-E[0]-E[1]))
break
case 84:E=readVarUInt(G),G+=E[0]+E[1],5!=E[1]&&(N=0,bad+="!badSMPTE@"+(G-E[0]-E[1]))
break
case 88:E=readVarUInt(G),G+=E[0]+E[1],(E[1]<2||4<E[1])&&(N=0,bad+="!badtime@"+(G-E[0]-E[1]))
break
case 89:E=readVarUInt(G),G+=E[0]+E[1],2!=E[1]&&(N=0,bad+="!badkey@"+(G-E[0]-E[1]))
break
default:E=readVarUInt(G),G+=E[0]+E[1]}}(""!=txt&&""!=by&&""!=F||512<G-K)&&(N=0)}if(K+=len,(G=K)>X.Sz()){bad+="!short"
break}}bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(F),sOptionT(by,"by: "),sOptionT(txt),sOption(outSz(K),"sz:"))}else if(X.c("'SMF2CLIP'"))sName="MIDI Clip File (.midi2)",sVersion="v2.0",bDetected=1
else if(X.c("'MKJamz'"))sName="MK-Jamz module (.MKJ)",bDetected=1
else if(X.c("'MLEDMODL'000000")&&X.c("'VERS'",X.U32(8,_BE)+12)){for(sName="Musicline Editor module (.ML)",bDetected=1,G=4,_=E="",ch=smp=ins=ptn=k=0;G<X.Sz()&&(hkhd=X.SA(G,4),hksz=X.U32(G+4,_BE),!(charStat(hkhd).indexOf("allasc")<0));){switch(G+=8,hkhd){case"VERS":v=X.U16(G,_BE),sVersion="v"+(v>>8)+"."+((240&v)>>4)+(15&v)
break
case"TUNE":for(k++,E=E.appendS(X.SC(G,hksz,"CP1252").trim(),"; "),tmp0=X.U16(G+32,_BE),spd0=X.U8(G+34,_BE),groove=X.U8(G+35,_BE),ch=X.U8(G+39),chsz=0,hksz=40,Y=0;Y<ch;Y++)chsz+=X.U32(G+hksz,_BE),hksz+=4
hksz+=chsz
break
case"INFO":for(q=0;q<hksz;)z=X.fSig(G+q,hksz-q,"00"),j=-1<z?z-G-q:hksz,_+=X.SC(G+q,j,"CP1252")+"\n",q+=j+1
break
case"PART":ptn++
break
case"INST":ins++
break
case"SMPL":smp++,G+=6}G+=hksz}X.isVerbose()&&(1<k&&sOption(k,"×"),sOptionT(E),sOptionT(addEllipsis(_,160,128),'msg: "','"'),sOption("ch:"+ch+" ptn:"+ptn+" ins:"+ins+" smp:"+smp+" sz:"+outSz(G)))}else if(X.c("'FORM'........'MMV8SDAT'................'SE'"))sName="Thomas Winischhofer's Music Maker EXT module (.MM8,.MM4)",bDetected=1,sVersion="v8",X.isVerbose()&&(sOptionT(X.SA(26,20)),sOptionT(X.SA(54,41)),sOption(outSz(X.I32(4,_BE)+8),"sz:"))
else if(X.c("'SEI1XX'00"))sName="Music Maker STD instrument (.IP)",bDetected=1,sVersion="v8 old"
else if(X.c("'MO3'"))sName="MO3 MOD module (.MO3)",bDetected=1
else if(X.c("'RASP'",1080))sName="Generic module (.MOD)",bDetected=1,sVersion=X.SA(1080,4),X.isVerbose()&&(sOptionT(X.SC(0,20,"IBM850")),sOptionT(X.SC(20,22,"IBM850"),"by/inst: "))
else if(X.c("08'MONOTONE'")&&351<=X.Sz()){if(sName="MONOTONE module (.MON)",bDetected=1,sVersion="v"+X.U8(91),X.isVerbose()){for(sOptionT(X.UCSD(9)),sOptionT(X.UCSD(50)),ptn=X.U8(92),trk=X.U8(93),cellsz=X.U8(94),ord=0,Y=95;255!=(E=X.U8(Y++))&&ord++,Y<351&&255!=Y;);sOption("trk:"+trk+" ord:"+ord+" ptn:"+ptn+" sz:"+outSz(351+64*ptn*trk*cellsz))}}else if(/SONG[0-9.]{4}(COMP|NORM)/.test(X.SA(0,12)))sName="Megastation track (.MS)",bDetected=1,sVersion="v"+X.SA(4,5).toLowerCase()
else if(/SNGM[0-9.]{4}(COMP|NORM)/.test(X.SA(0,12)))sName="Megastation MOD module (.MSM)",bDetected=1,sVersion="v"+X.SA(4,5).toLowerCase()
else if(X.c("'MSOB'00000026")&&X.c("FFFF0000",36)&&0<(k=X.U16(40,_BE)))sName="Medley module (.MSO)",bDetected=1,X.isVerbose()&&1<k&&sOption(k,"×")
else if(X.c("'MTC1'00")&&X.U8(5)<16&&X.Sz()>=(K=X.U32(4,_BE)+8)){if(sName="Multi-track Container module (.MTC)",bDetected=1,X.isVerbose()){for(name=auth=_="",G=8,k=0;G<K;){switch(hkhd=X.SA(G,4),hksz=X.U32(G+4,_BE),G+=8,hkhd){case"NAME":name=name.addIfNone(decAnsi(G,hksz,CPSpeccy),"/")
break
case"AUTH":auth=auth.addIfNone(decAnsi(G,hksz,CPSpeccy),"/")
break
case"ANNO":_=_.addIfNone(decAnsi(G,hksz,CPSpeccy),"/")
break
case"TRCK":k++}(G+=hksz)%2&&G++}sOptionT(name),sOptionT(auth,"by:"),sOptionT(addEllipsis(_,160)),sOption("trk:"+k+" sz:"+outSz(K))}}else if(X.c("'mpu401tr'92'kk'EE'r'"))sName="MPU-401 Trakker Adlib module (.MTK)",bDetected=1,X.isVerbose()&&(E=X.UCSD(24),sOptionT(E),sOptionT(X.SA(24+E.length+2),"by: "))
else if(X.c("'MTM'")){if(sName="StarScream/Renaissance's Multitracker module (.MTM)",bDetected=1,v=X.U8(3),sVersion="v"+(v>>4)+"."+(15&v),X.isVerbose()){for(sOptionT(X.SA(4,20)),trk=X.U16(24),ptn=X.U8(26),ord=X.U8(27)+1,csz=X.U16(28),nos=X.U8(30),bpt=X.U8(32),smpsz=0,Y=88;Y<88+37*nos;Y+=37)smpsz+=X.U32(Y)
pxc=194+37*nos+192*trk+32*(ptn+1)*2,_=X.SA(pxc,csz),K=pxc+csz+smpsz,_.length<csz&&(_=_.trim()+" <...>"),sOptionT(_),sOption("trk:"+(trk+1)+" ord:"+(ord+1)+" ptn:"+(ptn+1)+" smp:"+nos+" sz:"+outSz(K))}}else if(X.c("'MT20'")&&388<=X.Sz()&&2==X.U8(9)&&X.U16(112)<64&&X.U16(106)<=256){for(sName="MadTracker 2 module (.MT2)",nV=X.U8(8),bDetected=1,sVersion="v"+X.U8(9)+"."+nV.toString(16).padStart(2,"0"),bad="",ord=X.U16(106),loop=X.U16(108),ptn=X.U16(110),trk=X.U16(112),flags=X.U32(118),ins=X.U16(122),smp=X.U16(124),hasdrums=0!=X.U16(382),dptn=hasdrums?X.U16(384):0,G=388+(hasdrums?274:0),addp=G+X.U32(G-4),r="",vst2=0,igskip=0,smpszs=[],insszs=[],inss=[],smps=[],extsmp=[];G<addp;){switch(hkhd=X.SA(G,4),hksz=X.U32(G+4),G+=8,hkhd){case"MSG":showmsg=X.U8(G),r=X.SC(G+1,hksz-1,"CP1252").replace("\r","\n").replace("\n\n","\n")
break
case"SUM":c=X.SC(G+6,hksz-6,"CP1252")
break
case"VST2":vst2=X.U32(G)}G+=hksz}if(G>addp)bad=bad.addIfNone("!badaddsz")
else if(G>X.Sz())bad=bad.addIfNone("!short")
else{for(Y=0;Y<ptn&&G<X.Sz();Y++)G+=6+(X.U32(G+2)+1&-2)
if(hasdrums)for(Y=0;Y<dptn&&G<X.Sz();Y++)G+=2+32*X.U16(G)
if(2&flags)for(env=trk+(8&flags)+(80<=nV?vst2:0)+(16&flags?1:0),q=0;q<ptn;q++)for(var x=0;x<env&&G+4<=X.Sz();x++)for(3<=nV?(fl=X.U32(G),G+=8):(fl=X.U16(G),G+=4);fl;)1&fl&&(G+=260),(fl>>=1)<0&&(fl=-fl)}if(G>X.Sz())bad=bad.addIfNone("!short")
else for(Y=0;Y<255;Y++)!r&&inss.length<3&&""!=(E=X.SC(G,32,"CP1252")).trim()&&inss.push(E),32==(dtlen=X.U32(G+32))&&(dtlen+=396),1<nV&&dtlen&&(dtlen+=4),dtlen&&(igskip+=X.U16(G+36)<<3),G+=36+dtlen
if(G>X.Sz())bad=bad.addIfNone("!short")
else{for(Y=0;Y<256;Y++)r||(E=X.SA(G,32),Y<smp&&""!=E.trim()&&smps.push(E)),dtlen=X.U32(G+32),G+=36,dtlen&&Y<smp&&(slen=X.U32(G),5&(sfl=X.U8(G+10))?smpszs.push({ext:1,slen:0}):slen&&smpszs.push({ext:0,slen:slen}),G+=dtlen)
if((G+=igskip)>X.Sz())bad=bad.addIfNone("!short")
else for(Y=0;Y<smp&&G<X.Sz();Y++)smpszs[Y].ext?(slen=X.U32(G),G+=16,iextsmp.push(X.SA(G,slen)),G+=slen):G+=smpszs[Y].slen}""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose()&&(sOptionT(X.SA(42,64)),""!=r?showmsg?sOption(addEllipsis(r,128),"msg: "):sOption("("+addEllipsis(r,128)+")","msg: "):inss.length?sOption('"'+addEllipsis(inss.join(" "),200)+'"',"ins/msg:"):smps.length&&sOption('"'+addEllipsis(smps.join(" "),200)+'"',"smp/msg:"),sOption("ord:"+ord+" loop:"+loop+" ptn:"+ptn+(hasdrums?"+"+dptn:"")+" ins:"+ins+" smp:"+smp+(0<extsmp.length?" ext.smp: ["+extsmp.join(",")+"]":"")+" trk:"+trk+(hasdrums?"+8":"")+(vst2?"vst2:"+vst2:"")+" sz:"+outSz(G)))}else if(X.c("'MTRAC'")&&26==X.U8(49))sName="Pyro-Fyre/Arkham's Master Tracker module (.MTR)",bDetected=1
else if(X.c("3C4F3123 20391E00 1FdF1F9F 0C020C05 04040407 1AF60627"))sName="Packen/ぱっくん Software MUAP98/みゅあっぷ tone data (TONES.DTA)",bDetected=1,X.isVerbose()&&sOption(outSz(6400),"sz:")
else if(X.c("'MVSM1'"))sName="Kaneda's MVSTracker Suite module (.MUS)",bDetected=1
else if(X.c("'MUS'1A")&&X.U16(4)>=X.U16(6))sName="idSoft's DOOM music module (.MUS)",bDetected=1,X.isVerbose()&&sOption(outSz(X.U16(4)),"sz:")
else if(X.c("'MXM'00")&&isWithin(X.U32(4),1,256)&&X.U32(8)<X.U32(4)&&isWithin(X.U32(12),1,255)&&X.U32(16))sName="Niklas 'pascal' Beisert's MXMplay module (.MXM)",bDetected=1,X.isVerbose()&&(ord=X.U32(4),lp=X.U32(8),ch=X.U32(12),ptn=X.U32(16),ins=X.U32(20),spd0=X.U8(24),bpm0=X.U8(25),sOption("spd0:"+spd0+" bpm0:"+bpm0+" ch:"+ch+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" ins:"+ins))
else if(X.c("'MXTX'00"))sName="David 'Talin' Joiner & Joe Pearce's MaxTrax/Music-X module (MXTX.+SMPL.)",bDetected=1
else if(X.c("'TWNNSNG1'00"))sName="J.A.A. 'Arguru' Ruis's NoiseTrekker module (.NTK)",bDetected=1,sVersion="v1.6b",X.isVerbose()&&sOption(X.SA(9,20))
else if(X.c("'TWNNSNG2'00"))sName="J.A.A. 'Arguru' Ruis's NoiseTrekker module (.NTK)",bDetected=1,sVersion="v2.0",X.isVerbose()&&sOption(X.SA(9,20))
else if(X.c("'TWNNSNG'..00")&&["6","G","I"].indexOf(0<=X.SA(7,1))||X.c("'PROTREK'"))sName="J.A.A. 'Arguru' Rius et al.'s ProTrekkr module (.PTK)",bDetected=1,sVersion="v"+X.SA(7,1),X.isVerbose()&&"v6"==sVersion&&sOption(X.SA(9,20))
else if(X.c("'NESM'1A")||X.c("'NSFE'")){if(sName="Nintendo Sound Format audio (.",bDetected=1,sig=X.SA(0,4),filever="NSFE"===sig?"NSFe":2==X.U8(5)?"NSF2":"NSF",sName+=filever+")",INFOready=!1,NEND=!1,hkhd="",pn=4,nsf2jump=palntsc=K=-1,spd="",vrc7repl=0,playtime=Number(0),g="",taut=[],tlbl=[],xc=_=p=E="","NSFe"===filever){if(X.isVerbose())for(;pn<X.Sz()&&(hksz=X.U32(pn,_BE),"INFO"!==(hkhd=X.SA(pn+4,4)));)pn+=hksz+8
nsf2jump=0}else bDetected=1,sVersion="",X.isVerbose()&&(palntsc=X.U8(122),chip=X.U8(123),tc=X.U8(6),E=X.SA(14,32),p=X.SA(46,32),_=X.SA(78,32)),INFOready=!0,nsf2jump=X.U24(125,_LE),pn+=nsf2jump
if(0<=nsf2jump&&"NSFe"===filever&&X.isVerbose())for(;pn<X.Sz()&&!NEND;){switch(hksz=X.U32(pn,_LE),hkhd=X.SA(pn+4,4),pn+=8,hkhd){case"NEND":NEND=!0
break
case"INFO":INFOready||(palntsc=X.U8(pn+6),chip=X.U8(pn+7),tc=X.U8(pn+7),INFOready=!0)
break
case"RATE":spd="rate :: NTSC: "+X.U16(pn,_LE)+" ticks",0<(palspd=X.U16(pn+2,_LE))&&(spd+=", PAL: "+palspd+" ticks"),0<(dendyspd=X.U16(pn+4,_LE))&&(spd+=", Dendy: "+dendyspd+" ticks")
break
case"VRC7":vrc7repl=X.U8(pn)
break
case"time":for(Y=0;4*Y<hksz;Y++)(curtime=4*Y>=hksz?-1:X.I32(pn+4*Y,_LE))<0&&(curtime=12e4),playtime+=curtime/1e3
break
case"auth":apn=0,g=X.SC(pn,256,"UTF8"),apn+=g.length+1,p=X.SC(pn+apn,256,"UTF8"),apn+=p.length+1,_=X.SC(pn+apn,256,"UTF8"),apn+=_.length+1,_+=", rip: "+X.SC(pn+apn,256,"UTF8")
break
case"taut":if(X.isDeepScan())for(apn=0;apn<hksz;)trkauth=X.SC(pn+apn,hksz-apn,"UTF8"),apn+=trkauth.length+1,taut.push(trkauth)
break
case"tlbl":if(X.isDeepScan())for(apn=0;apn<hksz;)trklbl=X.SC(pn+apn,hksz-apn,"UTF8"),apn+=trklbl.length+1,tlbl.push(trklbl)
break
case"text":X.isDeepScan()&&(xc=X.SC(pn,hksz,"UTF8"))}pn+=hksz,K=pn}if(X.isVerbose()&&INFOready){switch(palntsc){case 0:sVersion+=" NTSC"
break
case 1:sVersion+=" PAL"
break
case 2:sVersion+=" NTSC/PAL"}1&chip&&(sVersion+="#VRC6"),2&chip&&(1===vrc7repl?sVersion+="#YM2413":sVersion+="#VRC7"),4&chip&&(sVersion+="#FDS"),8&chip&&(sVersion+="#MMC5"),16&chip&&(sVersion+="#Namco163"),32&chip&&(sVersion+="#Sunsoft5B"),sOptionT(E),1<tc&&sOption(tc,"×"),sOptionT(p,"by: "),sOptionT(_)}if(X.isVerbose()){for(1<playtime&&sOption(new Date(Math.round(1e3*playtime)).toISOString().substr(11,8),"Playtime: "),0<Math.max(tlbl.length,taut.length)&&sOption("[Tracks]"),Y=0;Y<Math.max(tlbl.length,taut.length);Y++)ttlbl=Y<tlbl.length?tlbl[Y]:"#"+(Y+1),ttaut=Y<taut.length?" by: "+taut[Y]:"",sOption(ttlbl+ttaut)
""!=xc&&sOption(xc,"[Commentary]: "),-1<K&&sOption(outSz(K),"sz:")}}else if(X.c("'OKTASONGCMOD'00000008")&&X.c("'SAMP'00000480",24)&&X.c("'SPEE'00000002....'SLEN'00000002....'PLEN'00000002....'PATT'00000080",1184)&&X.c("'PBOD'",1350)){if(sName="Armin Sander's Oktalyzer module (.OK,.OKT,.OKTA)",bDetected=1,sVersion="v"+X.U16(20,_BE)+"."+X.U16(22,_BE).padStart(2,"0"),X.isVerbose()){for(G=32,smp=0,smps=[];G<1184;G+=32)""!=(E=decAnsi(G,20,CPAmiga).trim())&&smps.push(E),X.U32(G+20,_BE)&&smp++
for(sOption(addEllipsis(smps.join(" ")),'smp/msg:"','"'),tmp0=X.U16(1192,_BE),ptn=X.U16(1202,_BE),ord=X.U16(1212,_BE),rsmp=0,G=1350;G<X.Sz()&&rsmp<smp&&(hkhd=X.SA(G,4),!(charStat(hkhd,1).indexOf("allasc")<0));)hksz=X.U32(G+4,_BE),"SBOD"===hkhd&&rsmp++,G+=8+hksz
sOption("tmp0:"+tmp0+" ord:"+ord+" ptn:"+ptn+" smp:"+(rsmp!=smp?rsmp+"/":"")+smp+" sz:"+outSz(G))}}else if(X.c("'Onyx Music File'1A0001")&&X.c("80808080",398)){if(sName="Altar/Onyx's Onyx Music File (.OMF)",bDetected=1,X.isVerbose()){for(ch=X.U8(402)+1,ptn=X.U8(403)+1,ord=X.U8(404)/2+1,F=X.SA(405,31).trim(),sn=[],smp=smpsz=0,Y=0;Y<31;Y++)(E=X.SA(436+28*Y,21).trim()).length&&sn.push(E),(E=X.U16(460+28*Y))&&(smpsz+=E,smp++)
for(Y=0,G=1306;Y<ptn;Y++)G+=3+256*X.U8(G+2)
for(K=G+smpsz+3*smp,Y=0;Y<smp;Y++)G+=3+X.U16(G+1)
G!=K&&(sVersion="malformed!badsmpcnk"),sOptionT(F),sOptionT(addEllipsis(sn.filter(funSampleName).join(" ")),'smp/msg:"','"'),sOption("ch:"+ch+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))}}else if((X.c("'Org-02'")||X.c("'Org-03'"))&&114<=X.Sz()){if(sName="Amaya 'Pixel' Daisuke's Organya/ORG Maker module (.ORG)",bDetected=1,50===X.U8(5)?sVersion:sVersion="v2",X.isVerbose()){for(_=ins=0,Y=0;Y<16;Y++)(E=X.U16(22+6*Y))&&(ins++,_+=E)
sOption("ins:"+ins+" tempo:"+X.U16(6)+" rhythm:"+X.U8(8)+"/"+X.U8(9)+" notes:"+_+" sz:"+outSz(114+(_<<3)))}}else if(X.c("'OBISYNTHPACK'")&&1296<X.Sz()&&(X.c("0100",1292)||!X.U32(1292,_BE))){if(sName="Karsten 'Obi' Obarski's Synth Pack module (.OSP+SMP.set)",bDetected=1,X.isVerbose()){for(G=a2=12,k=ord=0,d1=64;G<X.Sz()&&d1--&&(d2=X.U32(G,_BE),G+=4,d2);)ord++,240==(d2&=65535)&&k++
for(d3=d6=0;a2<X.Sz()&&d6<64&&(d4=X.U32(a2,_BE),a2+=4,d4?(65024!=(d4&=65280)&&64512!=d4||d3++,d6++):X.U32(a2,_BE)&&d6++,!(64<=d6)););for(d3>k&&(k=d3,ord=d6),(X.c("2000",12)||X.c("FE",14))&&(k=7),d1=256,G<X.Sz()&&(G=268),ptn=0;G<X.Sz()&&d1--;)(E=X.U8(G))>ptn&&(ptn=E),G+=4
if(G<X.Sz()&&(G=1292),X.U32(1292,_BE)){for(;G<X.Sz()&&X.U16(G,_BE);G+=2);for(G+=X.U16(G-2,_BE);G<X.Sz()&&!X.c("FFFFFFFF5FFF",G);G+=2);G+=6}else G+=384*(ptn+1)
1<k&&sOption(k,"×"),sOption("ord:"+ord+" ptn:"+ptn+" sz:"+outSz(G))}}else if(X.c("'OBISYNTHPACK'")){for(G=12,Y=smp=0;G<X.Sz()&&Y<64;Y++)E=X.U32(G+4,_BE)-X.U32(G,_BE),G+=4,E&&smp++
G-=4,(K=X.U32(G,_BE))<=X.Sz()&&(sName="Karsten 'Obi' Obarski's Synth Pack's sample set (SMP.SET)",bDetected=1,X.isVerbose())&&sOption("smp:"+smp+" sz:"+outSz(K))}else if(X.c("00800404 1214191C 1FCE26D6 328E35EA 3CF23CF2")&&X.c("0C000384000000000000",128)){for(Y=smp=G=0;G<X.Sz()&&Y<64;Y++)E=X.U16(G+2,_BE)-X.U16(G,_BE),G+=2,E&&smp++
G-=2,(K=X.U16(G,_BE))<=X.Sz()&&(sName="Synth Pack's sample set (SMP.SET)",sVersion="headerless",bDetected=1,X.isVerbose())&&sOption("smp:"+smp+" sz:"+outSz(K))}else if(X.c("'PACG'........'PAIN'")&&16<(E=X.fSig(12,256,"'SOIN'")+8)&&X.U16(E+2)&&X.U8(E+4)&&X.c("4005",E+5)&&X.U32(4)+8<=X.Sz()){for(sName="Henning Hellström's SBStudio II module (.PAC)",bDetected=1,K=(G=8)+X.U32(4),F=tracker=bad="",end=trk=ord=ptn=spd0=bpm0=smp=0;G<X.Sz()&&(hkhd=X.SA(G,4),!(charStat(hkhd).indexOf("allasc")<0));){switch(hksz=X.U32(G+4),G+=8,hkhd){case"SND ":smp++
break
case"SOIN":spd0=X.U8(G),bpm0=X.U8(G+1),ptn=X.U16(G+2),trk=X.U8(G+4)
break
case"SONA":F=X.SC(G,hksz,"CP850")
break
case"SOOR":ord=hksz>>1
break
case"PAOR":tracker=X.SC(G,hksz,"CP850")
break
case"END ":end=1}if(G+=hksz,end)break}""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(F),sOption(tracker,"in: "),sOption("trk:"+trk+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(X.U32(4)+8)))}else if(X.c("'PLM'1A..10")&&isWithin(ch=X.U8(54),1,32)&&X.Sz()>=4*((smp=X.U8(92))+(ptn=X.U8(93))+(ord=X.U16(94,_LE)))&&firstNotOf(60,32,[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15])<0){for(sName="Alex 'Statix' Evans' Disorder Tracker 2 module (.PLM)",bDetected=1,G=X.U8(4),ofs=rsmp=0,rptn=[],ptns=[],smps=[],mp=[0,"unk"],bad="",Y=0;Y<ord;Y++,G+=4)rptn.indexOf(E=X.U8(G+3))<0&&rptn.push(E)
for(Y=0;Y<ptn;Y++,G+=4)(E=X.U32(G))>mp[0]&&(mp=[E,"ptn"]),(E=X.SC(E+7,25,"CP437").trim()).length&&ptns.push(E)
for(Y=0;Y<smp;Y++,G+=4)(E=X.U32(G))>mp[0]&&(mp=[E,"smp"]),E&&(X.c("'PLS'1A",E)||(bad=bad.addIfNone("!badsmpsig:"+X.SA(E,4))),isWithin(X.I8(E+50),-1,15)||(bad=bad.addIfNone("!badsmppan")),64<X.U8(E+51)&&(bad=bad.addIfNone("!badsmpvol")),smps.push(X.SC(E+6,32,"CP437").trim()),X.U32(E+67))&&rsmp++
switch(rptn=rptn.length,G>X.Sz()&&(bad=bad.addIfNone("!short")),K=Math.max(mp[0],G),mp[1]){case"ptn":K=mp[0]+X.U32(mp[0],_LE)
break
case"smp":K=mp[0]+X.U8(mp[0]+4)+X.U32(mp[0]+67,_LE)}bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(X.SC(6,48,"CP437")),sOption(addEllipsis(smps.filter(funSampleName).join(" "),224),'smp/msg:"','"'),sOption("ch:"+X.U8(54)+" bpm0:"+X.U8(58)+" spd0:"+X.U8(59)+" ord:"+ord+" ptn:"+(rptn!=ptn?rptn+"/":"")+ptn+" smp:"+(rsmp!=smp?rsmp+"/":"")+smp+" sz:"+outSz(K)))}else if(X.c("'PLX'")&&X.U8(3)<=2&&X.U8(4)&&X.U16(7)<X.Sz()&&X.U16(9)<X.Sz()&&X.U16(11)<X.Sz()){if(sName="Rainbow Arts' Palladix Sound System module (.PLX)",bDetected=1,X.isVerbose()){for(ch=0,G=7;G<17;G+=2)X.U16(G)&&ch++
sOption("ch:"+ch)}}else if(X.c("FFFFE002E102"))sName="Achim Haertel's POKEYNoise chiptune (.PN)",bDetected=1
else if(X.c("01080B08 E1079E32 30363100 000078D8 A2FF9A20 1B082000"))sName="Aleksi Eeben's Polyanna module (.PRG)",sVersion="v1.0&player",bDetected=1,X.isVerbose()&&sOption("sz:"+outSz(22529))
else if(X.c("'PSA'00")&&52<X.U32(40,_BE)<X.Sz()&&52<X.U32(44,_BE)<X.Sz()&&52<X.U32(48,_BE)<X.Sz()){if(sName="Professional Sound Artists module (.PSA)",bDetected=1,X.isVerbose()){for(sOptionT(X.SA(4,20)),d2=X.U32(40,_BE),1<(k=d2-56>>3)&&sOption(k,"×"),d3=X.U32(44,_BE),d0=X.U32(48,_BE),ins=d3-d2>>6,d3=ins,synsmp=0,smp=0,B=0,d7=3;d3;)(ts=X.U32(d2,_BE))?ts<d7&&(d7=ts,smpsz=X.U16(d2,_BE)+4<<1,B+=smpsz,smp++):synsmp++,d2+=64,d3--
K=X.U32(36,_BE),songsz=K-B,ptn=songsz-d0>>10,sOption("ptn:"+ptn+" ins:"+ins+" smp:"+smp+" syn.smp:"+synsmp+" songsz:"+songsz+" sz:"+outSz(K))}}else if(X.c("'PSF'")){if(0<(nV=X.U8(3))){switch(bDetected=1,sName="Neil Corlett's Portable Sound Format module (.",nV){case 1:sName+="PSF,.PSF1,.MINIPSF,.MINIPSF1)",sVersion="Playstation"
break
case 2:case 3:sName+="PSF2,.MINIPSF2)",sVersion="Playstation 2"
break
case 17:sName+="SSF,.MINISSF)",sVersion="Saturn"
break
case 18:sName+="DSF,.MINIDSF)",sVersion="Dreamcast"
break
case 33:sName+="USF,.MINIUSF)",sVersion="Ultra64"
break
case 34:sName+="GSF,.MINIGSF)",sVersion="Gameboy"
break
case 35:sName+="SNSF,.MINISNSF)",sVersion="Super Nintendo"
break
case 36:sName+="2SF,.MINI2SF)",sVersion="Nintendo DS"
break
case 37:sName+="NCSF,.MININCSF)",sVersion="Nintendo DS Nitro Sound"
break
case 65:sName+="QSF,.MINIQSF)",sVersion="Capcom Q-Sound"
break
default:sName+="*SF,.MINI*SF)",sVersion="unk.console"}if(sVersion="v"+Hex(nV)+" "+sVersion,X.isVerbose())if(ptags=X.U32(8,_LE)+21,sig2=!1,(sig2=21<ptags&&ptags<X.Sz()?"[TAG]"===X.SA(ptags-5,5):sig2)||21<(ptags=X.U32(4,_LE)+21)&&ptags<X.Sz()&&(sig2="[TAG]"===X.SA(ptags-5,5)),sig2){for(tags=X.SC(ptags,X.Sz()-ptags,"UTF8").trim(),g=p="",y=E="",j="",tagl=tags.split("\n"),Y=0;Y<tagl.length;Y++)switch((tag=tagl[Y].split("="))[0]){case"length":j=tag[1]
break
case"title":E=tag[1]
break
case"game":g=tag[1]
break
case"artist":p=tag[1]
break
case"copyright":""==p&&(p=tag[1])
break
case"year":y=tag[1]
break
case"ssfby":""==p&&(p=tag[1])}sOption(E),sOption(p,"by: "),sOption(y,"'"),sOption(g,"for: "),sOption(j,"len ")}else sVersion+=" library"
X.Sz()<768&&(sVersion+=" header")}}else if(X.c("'PSG'1A"))sName="Kirill Kolpakov's fMSX/x128 PSG chiptune (.PSG)",bDetected=1
else if(X.c("'EPSG'1A"))sName="Kirill Kolpakov's Extended PSG chiptune (.EPSG)",bDetected=1,0===(hw=X.U8(5))&&(sVersion="ZX Spectrum 128k"),hw<2&&!X.c("00000000 000000000000",6)&&(sVersion+="/malformed")
else if(X.c("'PSG2'"))sName="PSG2 chiptune (.PSG2)",bDetected=1
else if((X.c("'PSM '")||X.c("'PSM'FE"))&&0<=X.fStr(8,10,"FILE")&&0<=X.fStr(16,50,"MAINSONG"))sName="Epic Megagames MASI module (.PSM)",bDetected=1,X.isVerbose()&&(0<(pt=X.fStr(16,50,"MAINSONGTITL"))&&(ts=X.U32(pt+12),sOptionT(X.SA(pt+16,ts))),sOption(outSz(X.U32(4)+12),"sz:"))
else if(X.c("'PSY'..'SONG")){if(sName="J.M.A. Segura/Psycledelics' Psycle Modular Music Creation Studio module (.PSY)",bDetected=1,sV=X.SA(3,1),sVersion="v"+sV,X.isVerbose())switch(sV){case"0":case"1":sOptionT(X.SC(8,32,"CP1252")),sOptionT(X.SC(40,32,"CP1252"),"by: "),sOptionT(X.SC(72,128,"CP1252"))
break
case"2":if(sOptionT(X.SC(8,32,"CP1252")),sOptionT(X.SC(40,32,"CP1252"),"by: "),sOptionT(X.SC(72,128,"CP1252")),bpm=X.I32(200),ord=X.I32(401),trk=X.I32(405),ptn=X.I32(409),G=413,X.isDeepScan()){for(inss=[],vsts=[],macs=[],waves=mach=0,bad="",Y=0;Y<ptn;Y++)rows=X.I32(G),G+=36+160*rows
for(G+=4,inss=[],Y=0;Y<255;Y++)""!=(E=X.SC(G,32,"CP1252").trim())&&"empty"!=E&&inss.push(E),G+=32
if((G+=14284)>X.Sz())bad=bad.addIfNone("!short")
else for(Y=0;Y<255&&G<X.Sz();Y++)for(w=0;w<16&&G<X.Sz();w++){var P,E=X.U32(G)
G+=4,E&&(w||waves++,G+=45,P=X.U8(G++)+1,G+=E<<P)}if(G>X.Sz())bad=bad.addIfNone("!short")
else for(Y=0;Y<256;Y++)(E=X.U8(G++))&&(""!=(E=X.SC(G,128,"CP1252").trim())&&vsts.push(E),G+=128,E=X.I32(G),G+=4+4*E)
for(m=[],Y=0;Y<128;Y++)(E=X.U8(G++))&&mach++,m[Y]=E
E=oldt=0
for(Y=0;Y<128;Y++)if(m[Y]){for(E=X.I32(G+8),G+=12,tn=X.SA(8===E?G+256:G,16),tpn=8===E?X.SA(G,256):"",ts=tn+tpn,nonascii=!1,q=0;q<ts.length;q++)if(ts[q]<" "||"~"<ts[q]||/["+?*]/.test(ts[q])){nonascii=!0
break}if((15<E&&E<255||ts.length<2||nonascii)&&8===oldt){bad=bad.addIfNone("!pluginDefinedDataSize")
break}if(15<E&&E<255){bad=bad.addIfNone("!badMachineType")
break}switch(oldt=E){case 8:macs.push(tn),E=X.I32(G+272),G=G+(276+4*E)+385
break
case 9:case 10:vsts.push(tn),G+=407
break
default:macs.push(X.SA(G,16)),G+=401}}G>X.Sz()&&(bad=bad.addIfNone("!short")),(G+=1275)>X.Sz()&&(bad=bad.addIfNone("!noP0")),(G+=64)>X.Sz()&&(bad=bad.addIfNone("!noP1")),G<X.Sz()&&X.U8(G++)&&(G+=4+X.U32(G)),""!=bad&&(sVersion+="/malformed"+bad),inss.length&&sOption("inss: ["+inss.join(",")+"]"),vsts.length&&sOption("vsts: ["+vsts.join(",")+"]"),macs.length&&sOption("mcn: ["+macs.join(",")+"]"),sOption("ord:"+ord+" ptn:"+ptn+" trk:"+trk+" bpm:"+bpm+" mach:"+mach+" smp:"+waves+" sz:"+outSz(G))}else sOption("ord:"+ord+" ptn:"+ptn+" trk:"+trk+" bpm:"+bpm)
break
case"3":for(nV=X.I32(8),sVersion+="/"+nV,G=16+X.U32(12),hkn=X.U32(16,_LE),_=p=E="",trk=0,bpm=0,ptnlns=0,ptn=0,mac=0,ins=0,eins=0;0<hkn;){switch(hkhd=X.SA(G,4),hkn--,cV=X.U32(G+4,_LE),hksz=X.U32(G+8,_LE),G+=12,hkhd){case"INFO":p1=G,0==(65280&cV)&&(E=X.SC(p1,128,"CP1252"),p1+=E.length+1,p=X.SC(p1,64,"CP1252"),p1+=p.length+1,_=X.SC(p1,65535,"CP1252"),p1+=_.length+1,0==cV)&&(hksz=E.length+p.length+_.length+3)
break
case"SNGI":0==(65280&cV)&&(trk=X.I32(G,_LE),0==cV&&(hksz=44+2*trk),bpm=X.I16(G+4,_LE)+X.I16(G+6,_LE)/100)
break
case"SEQD":0==(65280&cV)&&(seqlen=X.I32(G+4,_LE))
break
case"PATD":0==(65280&cV)&&(_idx=X.I32(G,_LE),ptnlns=X.I32(G+4,_LE),ptnn=X.SA(G+12,32),p1=G+12+ptnn.length+1,ptnsz=X.I32(p1,_LE),ptn++,p1+=4,0==cV)&&p1+ptnsz==G+hksz+4&&(hksz+=4)
break
case"MACD":mac++
break
case"INSD":ins++
break
case"EINS":65536==(4294901760&cV)&&(eins=X.U32(G,_LE))}G+=hksz}sOptionT(E),sOptionT(p,"by: "),sOptionT(_),sOption("bpm:"+bpm+" trk:"+trk+" ptnlns:"+ptnlns+" mac:"+mac+" ptn:"+ptn+"/idx:"+_idx+" ins:"+ins+" eins:"+eins+" sz:"+outSz(G))
break
case"4":sVersion+="/future"}}else if(X.c("'PSMP'")&&0<=[0,16].indexOf(X.U8(4)))sName="Sega MegaDrive Pre-SMP chiptune (.PSZ)",bDetected=1,sVersion=X.U8(4)?"BE":"LE",X.isVerbose()&&sOption("tempo:"+X.U8(5))
else if(X.c("'PTCOLLAGE-'")||X.c("'PTTUNE--20'")){switch(bDetected=1,v1=X.SA(2,1),sName="T"===v1?(rough=10,"Amaya 'Pixel' Daisuke's pxtone tune (.PTTUNE)"):(rough=1,"Amaya 'Pixel' Daisuke's pxtone project (.PTCOP)"),(dt=X.SA(10,6))<="050227"?(sV="v.x1x",nV=1):dt<="050608"?(sV="v.x2x",nV=2):dt<="060115"?(sV="v.x3x",nV=3):dt<="060930"?(sV="v.x4x",nV=4):dt<="071119"&&(sV="v5",nV=5),d=dt.substr(0,2)+"-"+dt.substr(2,2)+"-"+dt.substr(4,2),sVersion=sV+"/20"+d,nV){case 1:case 2:G=16
break
default:G=20}for(E=_=bad="",bclock=lclock=bnum=btempo=bps=ch=0,bEnd=!1;!bEnd&&G<X.Sz();){switch(hkhd=X.SA(G,8),hksz=X.U32(G+8,_LE),hkhd){case"PROJECT=":E=X.SC(G+12,16,"Shift_JIS"),btempo=X.F32(G+28,_LE).toFixed(0),bclock=X.I16(G+32,_LE),bnum=X.I16(G+34,_LE)
break
case"evenMAST":3!=X.U16(G+12,_LE)?sVersion+="/unk":(-12<(e=X.fSig(G+3,256,"'textNAME'")-12)||-12<(e=X.fSig(G+3,256,"'textCOMM'")-12))&&(G=e-hksz)
break
case"MasterV5":15!=hksz&&(bad=bad.addIfNone("!badv5fmt")),bclock=X.I16(G+12)*rough,bnum=X.I8(G+14),btempo=X.F32(G+15).toFixed(0),lmeas=(X.I32(G+23)/(bnum*bclock)).toFixed(0)
break
case"Event V5":var ls=X.U32(G+12,_LE)
for(q=G+11,x=0;x<ls;x++){for(Y=0;Y<5&&!(X.U8(++q)<128);Y++);for(q+=2,Y=0;Y<5&&!(X.U8(++q)<128);Y++);}hksz=4+q-G-11
break
case"textNAME":E=X.SC(G+12,hksz,"Shift_JIS")
break
case"textCOMM":_=addEllipsis(X.SC(G+12,hksz,"Shift_JIS"),160)
break
case"assiWOIC":ch++
break
case"END=====":case"pxtoneND":bEnd=!0}G+=12+hksz}bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&("no name"!=E&&sOption(E),sOptionT(_),0<bclock+btempo+bnum&&sOption("ch:"+ch+" bpm:"+btempo+" bclock:"+bclock+" bnum:"+bnum),sOption(outSz(G),"sz:"))}else if(X.c("'PTNOISE-'"))sName="Amaya 'Pixel' Daisuke's pxtone Noise instrument (.PTNOISE)",bDetected=1
else if(X.c("'PTVOICE-'"))sName="Amaya 'Pixel' Daisuke's pxtone Voice instrument (.PTVOICE)",bDetected=1,X.isVerbose()&&sOption(outSz(X.U32(12)+16),"sz:")
else if(X.c("'PTMF'",44)&&26==X.U8(28)&&X.U8(30)<=2&&isWithin(ch=X.U16(38),1,32)&&(ord=X.U16(32))<256&&isWithin(ins=X.U16(34),1,255)&&isWithin(ptn=X.U16(36),1,128)){for(sName="Lone Ranger/AcmE's Poly Tracker module (.PTM)",bDetected=1,sV=Hex(X.U16(29)),sVersion="v"+sV.substr(0,1)+"."+sV.substr(1,2),bad="",sn=[],Y=mp=rsmp=0,G=608;Y<ins;Y++,G+=80)3&X.U8(G)&&(rsmp++,E=X.U32(G+18),mp<E)&&(mp=E,K=E+X.U32(G+22)),(E=X.SC(G+48,28,"CP437").trim()).length&&sn.push(E)
K=Math.max(K,G),(bad=rsmp?bad:bad.addIfNone("!badsmpavl")).length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(X.SC(0,28,"CP437")),sOption(addEllipsis(sn.join(" ")),'ins/msg:"','"'),sOption("ch:"+ch+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp:"+rsmp+" sz:"+outSz(K)))}else if(X.c("'RAD by REALiTY!!'")){if(sName="Shayde & Rogue & Void's Reality ADlib Tracker module (.RAD)",bDetected=1,sV=(nV=X.U8(16)).toString(16),sVersion="v"+sV[0]+"."+sV[1],bad="",X.isVerbose()){if(al=X.U8(17),fbpm=32<nV&&32&al,16==nV&&128&al||32<=nV){for(j=18,fbpm&&(j+=2),desc="",maxdesc=250,cutoff=!1,i=X.fSig(j,X.Sz()-32-j,"00"),G=i+1,i<0?(maxdesc=0,bad=bad.addIfNone("!baddesc")):i>j+maxdesc&&(i=j+maxdesc,cutoff=!0),tmp=X.readBytes(j,i-j),Y=0;desc.length<maxdesc&&Y<i-j;Y++)switch(tmp[Y]){case 0:Y=i-j
break
case 1:desc+="\n"
break
default:if(tmp[Y]<32)for(l=0;l<tmp[Y]&&desc.length<=maxdesc;l++)desc+=" "
else desc+=String.fromCharCode(tmp[Y])}cutoff&&(desc+="..."),sOptionT(desc)}else G=18
for(spd0=31&al,bpm=fbpm?X.U16(18):125,ins=0,insns=[];G<X.Sz()&&(insn=X.U8(G++))&&!(G>X.Sz());)ins++,16==nV?G+=11:33==nV?(nmlen=X.U8(G++),insns.push(X.SA(G,nmlen)),G+=nmlen,rm=X.U8(G),riff=128&rm,(midi=7==(7&rm))?G+=7:G+=24,riff&&(G+=X.U16(G)+2)):bad=bad.addIfNone("!badver")
if(ord=X.U8(G++),G+=ord,(!ord||128<ord)&&(bad=bad.addIfNone("!badord")),ptn=ptns=0,32<nV)for(;G<X.Sz()&&255!=(E=X.U8(G++));)ptns++,ptn<=E&&(ptn=E+1),G+=2+X.U16(G)
else{for(Y=mptn=0;Y<32;++Y,G+=2)(E=X.U16(G))&&ptn++,mptn=Math.max(mptn,E),E>X.Sz()&&(bad=bad.addIfNone("!short"))
if(mptn)for(G=mptn,end=!1;!end&&G<X.Sz();)for(128&(E=X.U8(G++))&&(end=!0);G<X.Sz()&&(E=X.U8(G),G+=2,7&X.U8(G++)&&G++,!(128&E)););}if(ptn||(bad=bad.addIfNone("!badptn")),ins||(bad=bad.addIfNone("!badins")),riff=riffs=0,32<nV){for(;G<X.Sz()&&255!=(E=X.U8(G++));)riffs++,riff<E&&(riff=E),G+=2+X.U16(G)
sOptionT(addEllipsis(insns.filter(funSampleName).join(" "),256),'ins:"','"'),sOption("spd0:"+spd0+" bpm:"+bpm+" ord:"+ord+" ptn:"+ptns+(ptn!=ptns?"/"+ptn:"")+" ins:"+ins+" riffs:"+riffs+(riff!=riffs?"/"+riff:""))}else sOption("spd0:"+spd0+" bpm:"+bpm+" ord:"+ord+" ptn:"+ptn+" ins:"+ins)
bad&&(sVersion+="/malformed"+bad),sOption("sz:"+outSz(G))}}else if(X.c("'RAWADATA'")&&10<X.Sz()){if(sName="Raw OPL Capture chiptune (.RAW)",bDetected=1,X.isVerbose()&&(X.isDeepScan()||X.Sz()<65535)){for(G=10,len=X.Sz()-10>>1,tagdata=!1,E=p=d="",next=0,Y=0;Y<len&&G<X.Sz();Y++)k=tagdata?65535:X.U16(G),G+=2,tagdata||65535!=k||(26==(tagcode=X.U8(G++))?tagdata=!0:!tagcode&&charStat(X.readBytes(G,5),!0).includes("allxsc")?(d=X.SA(G,1023),G+=1023,tagdata=!0):G--)
tagdata&&G+40<=X.Sz()&&(F=X.SA(G,40),G+=40,27!=X.U8(G++)&&(G--,32<=X.U8(G)?(p=X.SA(G,60),G+=60,d=X.SA(G,1023),G+=1023,next=2):G--,next=1),next||(p=X.SA(G,40),G+=40),1!=next||(next=0,next=28!=X.U8(G++)?2:next)||(d=X.SA(G,1023),G+=1023)),sOption(F),sOption(p,"by: "),sOption(d)}X.isVerbose()&&sOption(X.U16(8),"clkspd:")}else if(X.c("'RNS0'")&&X.c("'>>> Chunk Start <<<'00",9)){if(sName="Eduard Müller's Renoise module (.RNS)",bDetected=1,sV=X.SA(3,4),sVersion="v"+sV,sV<"05"?sVersion+="/RN<1.1.1":"05"===sV?sVersion+="/RN1.1.1":sV<"015"?sVersion+="/RN<1.2.7":"015"===sV?sVersion+="/RN1.2.7":sV<"018"?sVersion+="/RN<1.5.2":"018"===sV?sVersion+="/RN1.5.2":sVersion+="/RN>1.5.2",X.isVerbose())for(G=9;G<X.Sz()&&X.c("'>>> Chunk Start <<<'00",G);){if(G+=20,X.c("'Header V00         '00",G)){sOptionT(X.SC(G+20,20,"CP1252")),sOptionT(X.SC(G+40,20,"CP1252"),"by: "),sOptionT(X.SC(G+60,20,"CP1252"),"style: ")
break}if(X.c("'Header V01         '00",G)){G+=20,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252")),G+=K+4,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252"),"by: "),G+=K+4,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252"),"style: ")
break}if(X.c("Header V02         '00",G)){G+=20,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252")),G+=K+4,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252"),"by: "),G+=K+4,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252"),"style: "),G+=K+4+5,K=X.U32(G),sOptionT(X.SC(G+4,K,"CP1252"))
break}if(-1==(G=X.fSig(G+1,TOEOF,"''>>>  Chunk End  <<<'00")))break
G+=20}}else if(extIs("xrns")&&X.c("'PK'0304"))sName="Eduard Müller's Renoise module (.XRNS)",sType="~audio",sVersion="xml",bDetected=1
else if(extIs("xrdp")&&0<=X.fStr(0,256,"<FilterDevicePreset"))sName="Eduard Müller's Renoise filter device preset (.XRDP)",bDetected=1,G=X.fStr(20,256,"doc_version="),sVersion=G<0?"malformed":(sVp=X.SA(G,16),"v"+/doc_version=\"(\d*)\"/.exec(sVp)[1])
else if(extIs("xrni")&&X.c("'PK'0304"))sName="Eduard Müller's Renoise instrument (.XRNI)",sType="~audio",sVersion="xml",bDetected=1
else if(extIs("xrno")&&0<=X.fStr(0,256,"<SampleModulationSet"))sName="Eduard Müller's Renoise sample modulation set (.XRNO)",bDetected=1,G=X.fStr(15,256,"doc_version="),sVersion=G<0?"malformed":(sVp=X.SA(G,16),"v"+/doc_version=\"(\d*)\"/.exec(sVp)[1])
else if(extIs("xrnt")&&0<=X.fStr(0,256,"<RenoiseDeviceChain"))sName="Eduard Müller's Renoise effect chain (.XRNT)",bDetected=1,G=X.fStr(15,256,"doc_version="),sVersion=G<0?"malformed":(sVp=X.SA(G,16),"v"+/doc_version=\"(\d*)\"/.exec(sVp)[1])
else if(extIs("xrnt")&&X.c("'PK'0304"))sName="Eduard Müller's Renoise effect chain (.XRNT)",sVersion="v<3.0",bDetected=1
else if(extIs("xrnz")&&0<=X.fStr(0,256,"<InstrumentPhrase"))sName="Eduard Müller's Renoise instrument phrase (.XRNZ)",bDetected=1,G=X.fStr(15,256,"doc_version="),sVersion=G<0?"malformed":(sVp=X.SA(G,16),"v"+/doc_version=\"(\d*)\"/.exec(sVp)[1])
else if(X.c("'NuRIFFRAFF'",34))sName="Riff Raff module (.RIFF)",bDetected=1,X.isVerbose()&&(E=X.SC(100,256,"CP1252"),p=X.SC(100+E.length+1,256,"CP1252"),_=X.SC(100+E.length+p.length+2,256,"CP1252"),sOptionT(E),sOptionT(p,"by: "),sOptionT(_))
else if(X.c("'RON_KLAREN_SOUNDMODULE!'00",40))sName="Ron Klaren module (.RK)",bDetected=1
else if(X.c("'RTMM '")&&26==X.U8(37)&&X.c("'RTND'",42+X.U16(40)+X.U32(136)))sName="Arnaud Hasenfratz's Real Tracker module (.RTM)",bDetected=1,sVersion="v"+X.SA(55,7)+"/"+Hex(X.U16(38)),X.isVerbose()&&(rtmmxds=X.U32(136),sOptionT(X.SC(5,32,"CP1252")),sOptionT(X.SC(62,32,"CP1252"),"by: "),sOptionT(X.SC(140,32,"CP1252"),"orig.: "),sOption("ch:"+X.U8(96)+" spd0:"+X.U8(102)+" bpm0:"+X.U8(103)+" ord:"+X.U16(98)+" ptn:"+X.U16(100)+" ins:"+X.U8(97)))
else if(X.c("01FF..3EFF32018079FEFF2846320280B7201301FF013E1CED79053E02ED79AF320180C9")&&X.c("21A9843D280E232347237E2BB67820F6232318EF5E23567AB328D22B2224803EFE320E823E08325280C35C80",38))sName="František Fuka/Fuxoft's Samadeus module (.samadeus)",bDetected=1
else if(X.c("00000000 00000200",12)&&X.c("00")&&X.U16(24,_LE)===X.U16(64,_LE)&&X.c("00'ST-Module.'",1207)){for(sName="Oliver 'BSC' Mayer's Amstrad CPC Soundtrakker module (.STK)",bDetected=1,datasz=X.U16(24,_LE),(K=datasz+128)<X.Sz()&&(sVersion="malformed"),crc=0,Y=0;Y<67;Y++)crc+=X.U8(Y);(crc&=65535)!=X.U16(67)&&(sVersion+=""!=sVersion?"!badCRC":"/malformed!badCRC"),X.isVerbose()&&sOptionT(X.SA(1,8)),sOption(outSz(K),"sz:")}else if(X.c("00000000 00000200",12)&&X.c("00")&&X.U16(24,_LE)===X.U16(64,_LE)&&X.SA(1,8)===X.SA(2832,8)){for(sName="Oliver 'BSC' Mayer's Amstrad CPC Soundtrakker 128K module (.128)",bDetected=1,datasz=X.U16(24,_LE),(K=datasz+128)<X.Sz()&&(sVersion="malformed"),crc=0,Y=0;Y<67;Y++)crc+=X.U8(Y)
for((crc&=65535)!=X.U16(67)&&(sVersion+=""!=sVersion?"!badCRC":"/malformed!badCRC"),X.isVerbose()&&sOptionT(X.SA(1,8)),inst=[],ins=0,Y=0;Y<16;Y++)[0,32].indexOf(X.U8(2840+8*Y))||(ins++,inst.push(X.SA(2840+8*Y,8).trim()))
sOption(inst),sOption("ins:"+ins+" sz:"+outSz(K))}else if(X.c("00'ST-Module.'",1079))sName="Oliver 'BSC' Mayer's Amstrad CPC Soundtrakker module (.STK)",bDetected=1,sVersion="headerless"
else if(32<X.Sz()&&/S98[0-3]/.test(X.SA(0,4))&&X.U32(4)<=32&&!X.U32(12)&&(!X.U32(16)||isWithin(X.U32(16),32,8388608))&&X.U32(20)<131072&&(!X.U32(24)||isWithin(X.U32(24),X.U32(20),8388608))&&X.U32(28)<=64){if(sName="Ru³'s S98 chiptune (.S98)",bDetected=1,nv=X.U8(3)-48,sVersion="v"+nv,!(dev=X.U32(28))||2<=nv&&!X.U32(32))sVersion+="#OPNA(YM2608)@7.6MHz"
else for(Y=0,G=32;Y<dev&&X.U32(G);Y++,G+=16)clk=(X.U32(G+4)/1048576).toFixed(1)+"MHz",16<(dt=X.U32(G))?sVersion+="#unk@"+clk:sVersion+="#"+["","PSG(YM2149)","OPN(YM2203)","OPN2(YM2612)","OPNA(YM2608)","OPM(Y2151)","OPLL(YM2413)","OPL(YM3526)","OPL2(YM3812)","OPL3(YMF262)","unk0A","unk0B","unk0C","unk0D","unk0E","PSG(AY-3-8910)","DCSG(SN76489)"][dt]+"@"+clk
if(bad="",(X.U32(20)>X.Sz()||X.U32(24)>X.Sz())&&(bad+="!short"),X.U32(16)>X.Sz()-7&&(bad+="!badmetadata"),bad.length&&(sVersion+="/malformed"+bad),X.isVerbose())switch(p=_=s=g=ti=y="",nv){case 0:case 1:case 2:0<(G=X.U32(16))&&sOptionT(X.SC(G,64,"Shift_JIS").replace("\\","￥")),(pk=X.U32(12))&&(sVersion+=" compressed",sOption("Please send this file over Telegram to @kaens, the detection author! It's unique and needs research"))
break
case 3:if(6<(ptags=X.U32(16))&&X.c("'[S98]'",ptags)){for(ptags+=5,bUTF8=X.c("EFBBBF",ptags),tags=bUTF8?X.SC(ptags,512,"UTF8"):X.SC(ptags,512,"Shift_JIS"),tagl=tags.split("\n"),Y=0;Y<tagl.length;Y++)switch((tag=tagl[Y].split("="))[0]){case"title":case"ｔｉｔｌｅ":ti=tag[1]
break
case"game":case"ｇａｍｅ":g=tag[1]
break
case"system":case"ｓｙｓｔｅｍ":s=tag[1]
break
case"artist":case"ａｒｔｉｓｔ":p=tag[1]
break
case"year":case"ｙｅａｒ":y=tag[1]
break
case"copyright":case"ｃｏｐｙｒｉｇｈｔ":""==p&&(p=tag[1])
break
case"s98by":case"ｓ９８ｂｙ":""==p&&(p=tag[1])
break
case"comment":case"ｃｏｍｍｅｎｔ":_=tag[1]}sOption(ti),sOption(p,"by: "),sOption(y,y.length<4?"y'":"y"),sOption(g,"for: "),sOption(s,"on: "),sOption(_),6<ptags&&X.c("'[S98]'",ptags-5)&&-1<(E=X.fSig(ptags,768,"00"))&&sOption(outSz(E+1),"sz:")}else 6<ptags&&(E=X.SC(ptags,64,"Shift_JIS").replace("\\","￥"))}}else if(X.c("'SAP'0D0A")&&3<=(G=X.fSig(3,TOEOF,"0D0AFFFF"))&&X.U16(G+4)<X.U16(G+6)){if(sName="Adam Bienias's Slight Atari Player chiptune (.SAP)",bDetected=1,X.isVerbose()){if(bad=!1,dt=p=E="",tp="",tm="",5<(taghunk=X.SA(5,G)).length)for(tags=taghunk.split("\r\n"),Y=0;Y<tags.length;Y++)switch(tagdiv=tags[Y].indexOf(" "),tagl=tags[Y].substr(0,tagdiv),tagr=tags[Y].substr(tagdiv+1,tags[Y].length),tagl){case"NAME":'"<?>"'!=tagr&&(E=tagr.substr(1,tagr.length-2))
break
case"AUTHOR":'"<?>"'!=tagr&&(p=tagr.substr(1,tagr.length-2))
break
case"DATE":'"<?>"'!=tagr&&(dt=tagr.substr(1,tagr.length-2))
break
case"TYPE":sVersion="t."+tagr
break
case"TIME":tm=tagr}bad&&(sVersion+="/malformed"),sOption(E),sOption(p,"by: "),sOption(dt,"'"),sOption(tm,"len: "),E=parseAtariBinary(G+2),sOption(E[1].length,"binblks:"),sOption(outSz(E[0]),"sz:")}}else if(X.c("'SC68 Music-file / (c) (BeN)jamin Gerard / SasHipA-Dev  '00'SC68'........'SCFN'")){if(sName="SC 68000 programmatic chiptune (.SC68)",bDetected=1,X.isVerbose()){for(hdrl=X.SA(0,256).length+1,G=hdrl,cp=p=E="",P="",df=-1,k=0,ef=!1,mn=[];G<X.Sz();){switch(hkhd=X.SA(G,4),hksz=X.U32(G+4,_LE),G+=8,hkhd){case"SC68":hksz+hdrl!=X.Sz()&&(sVersion="malformed"),hksz=0
break
case"SCFN":E=X.SC(G,hksz,"CP1252")
break
case"SCDF":df=X.U32(G,_LE)+1
break
case"SCMN":mn.push(X.SC("CP1252",G,hksz)),""!=P&&df!=mn.length||(P=mn[mn.length-1])
break
case"SCAN":p=X.SC(G,hksz,"CP1252")
break
case"SCCN":cp=X.SC(G,hksz,"CP1252")
break
case"SCEF":ef=!0,G=X.Sz()}G+=hksz}sOptionT(E),1<mn.length&&sOption(mn.length,"×"),sOptionT(mn.join(";")),sOptionT(p,"by: "),sOptionT(cp,"(c)"),sOption(outSz(G),"sz:"),ef||(sVersion="malformed!short")}}else if(X.c("'shro'020000"))sName="Mario Paint's Shroom module (.SHO)",bDetected=1,X.isVerbose()&&(sOptionT(X.SA(7,32)),sOptionT(X.SA(39,32),"by: "))
else if(X.c("'PSID'")||X.c("'RSID'")){v1=X.SA(0,1),bDetected=1,sName="P"==v1?"PlaySID programmatic chiptune (.SID, .PSID)":"RealSID programmatic chiptune (.SID, .RSID)",v2=X.U16(4,_BE),sVersion="v"+Hex(v2),bad="",k=X.U16(14,_BE),isWithin(k,1,256)?1<k&&sOption(k,"×"):bad=bad.addIfNone("!badsubsongs"),(startSong=X.U16(16,_BE))>k&&(bad=bad.addIfNone("!badstartsong")),dataOfs=X.U16(6,_BE),(1==v2&&118!=dataOfs||2==v2&&124!=dataOfs)&&(bad=bad.addIfNone("!baddatap")),loadAddr=X.U16(8,_BE),"R"==v1&&isWithin(loadAddr,1,2023)&&(bad=bad.addIfNone("!badloadp")),initAddr=X.U16(10,_BE),"R"!=v1||isWithinRanges(initAddr,[[2024,40959],[49152,53247]])||(bad=bad.addIfNone("!badinitp")),flags=X.U16(118,_BE),"R"==v1&&flags>>1&1&&0<initAddr&&(bad=bad.addIfNone("!badinitp2")),sidn=1,78==v2?sidn+=dataOfs-124>>1:(!(3<=v2)||1&(a2=X.U8(122))||isWithinRanges(a2,[[0,65],[128,223]])||sidn++,!(4<=v2)||1&(a3=X.U8(123))||a2==a3||isWithinRanges(a3,[[0,65],[128,223]])||sidn++)
var W=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
switch(flags>>4&3){case 1:W[0]=1
break
case 2:W[0]=2
break
case 3:W[0]=3}if(3<=v2)switch(flags>>6&3){case 1:W[1]=1
break
case 2:W[1]=2
break
case 3:W[1]=3
break
default:W[1]=W[0]}if(78==v2)for(Y=2,q=124;Y<sidn;Y++,q+=2)switch(X.U16(q,_BE)>>4&3){case 1:W[Y]=1
break
case 2:W[Y]=2
break
case 3:W[Y]=3
break
default:W[Y]=W[0]}else if(4<=v2)switch(flags>>8&3){case 1:W[2]=1
break
case 2:W[2]=2
break
case 3:W[2]=3
break
default:W[2]=W[0]}for(1<sidn&&(sVersion+="/"+sidn+"SID"),sidtt=[0,0,0,0],Y=0;Y<sidn;Y++)sidtt[W[Y]]++
for(Y=0;Y<4;Y++)sidtt[Y]&&(sVersion+=" #"+["unk","6581","8580","6581&8580"][Y]+(1<sidtt[Y]?"×"+sidtt[Y]:""))
switch((12&flags)>>2){case 1:sVersion+="/PAL"
break
case 2:sVersion+="/NTSC"
break
case 3:sVersion+="/PAL&NTSC"}0<bad&&(sVersion+="/malformed"+bad),X.isVerbose()&&("<?>"==(E=X.SC(22,32,"CP1252"))&&(E=""),sOptionT(E),"<?>"==(p=X.SC(54,32,"CP1252"))&&(p=""),sOptionT(p,"by: "),"<?>"==(_=X.SC(86,32,"CP1252"))&&(_=""),sOptionT(_))}else if(X.c("00 FF00FF00 9100FF00 FF008000 92..00967F 01",7)&&X.c("9908",5442))sName="Tony 'Nissimo' Willams' Sound Images module (.SIG)",sVersion="gen.2",bDetected=1
else if(X.c("0100FEFF09000000'ALIM3'"))sName="Ruben Ramos 'baktery' Salvador's Skale Tracker module (.SKM)",bDetected=1,X.isVerbose()&&sOptionT(X.SA(25))
else if(X.c("'<track'")&&0<X.fStr(6,256,"rowhighliohtingminor="))sName="Benjamin 'BeRo' Rousseaux's Picatune module v1 (.SMUFI) or v2 (.PT2)",bDetected=1,X.isVerbose()&&(s=X.SC(0,256,"UTF8"),null!=(E=/.*name="([^"]*)".*/.exec(s))&&sOptionT(E[1]),null!=(p=/.*author="([^"]*)".*/.exec(s))&&sOptionT(p[1],"by: "),spd=/.*speed="([^"]*)".*/.exec(s),bpm=/.*bpm="([^"]*)".*/.exec(s),null!=spd&&(sVersion+=" spd: "+spd[1]),null!=bpm)&&(sVersion+=" bpm: "+bpm[1])
else if(X.c("'SNGs'")&&16<X.Sz()&&X.U8(10)<=X.U8(7)&&X.U8(11)<=30&&isWithin(X.U8(12),0,120)&&isWithin(X.U8(13),1,30)&&isWithin(X.U8(14),1,30))sName="BlueMoon's Sound Club for DOS module (.SN)",bDetected=1,(ord=X.U8(7))||(sVersion="malformed!0ord"),X.isVerbose()&&(sOptionT(X.SA(15,26)),lp=X.U8(10),gvol=5*X.U8(11),tx=X.U8(12),tpb=X.U8(13),bpms=X.U8(14),sOption("rhythm:"+tpb+"/"+bpms+" ord:"+X.U8(7)+" ins:"+X.U8(4)+" gvol:"+gvol+"%"))
else if(X.c("'SN2'")&&isWithin(X.U32(19),0,120)&&isWithin(X.U32(23),1,30)&&isWithin(X.U32(27),1,30)&&X.c("'NAM'",31)&&X.c("'SEQ'",38+X.U32(34))){if(sName="Bluemoon's Sound Club for Windows module (.SN2)",bDetected=1,X.isVerbose()){for(sOptionT(addEllipsis(X.SA(38,X.U32(34)))),K=X.U32(3)+7,lp=X.U32(15),tx=X.U32(19),tpb=X.U32(23),bpms=X.U32(27),tempop=Math.round(200-tx*(4.27246-tx*(.0603477+tx*(1.33871*tx/1e6-453202e-9)))),G=38+X.U32(34),ord=ptn=ins=0,end=!1;!end&&G<X.Sz();){switch(hkhd=X.SA(G,3),hksz=X.U32(G+3),G+=7,hkhd){case"PAT":ptn++
break
case"SEQ":ord=Util.divu64(hksz,4)
break
case"INS":ins++}G+=hksz}sOption("rhythm:"+tpb+"/"+bpms+" tempo: "+tempop+"% ord:"+ord+(lp?" lp:"+lp:"")+" ptn:"+ptn+" ins:"+ins+" sz:"+outSz(K))}}else if(X.c("'SNDH'",12)&&(X.isHeuristicScan()||X.c("6000............6000"))){if(sName="Atari ST Sound Header module (.SND,.SNDH)",sVersion="uncompressed",bDetected=1,X.isVerbose()){for(G=16,F=c=yr="",totaltime=Y=0,k=1;Y<10&&G<X.Sz();){if("TIME"===(E=X.SA(G,4))){for(l=0;l<k;l++)totaltime+=X.U16(G+4+2*l,_BE)
tlen=4+2*k-1,(G+tlen+1)%2&&tlen++}else E=X.SA(G,Math.min(X.Sz()-G),256),tlen=E.length
if(4<=tlen)switch(hd=E.substr(0,4),tag=E.substr(4,tlen),hd){case"TITL":"Unknown"!=tag.substr(0,7)&&(F=tag)
break
case"COMM":"Unknown"!=tag.substr(0,7)&&(c=tag)
break
case"YEAR":yr=tag
break
case"HDNS":Y=8
break
default:/##\d\d/.test(hd)?k=hd.slice(2,4):/#!\d\d/.test(hd)&&(G+tlen+1)%1&&tlen++}G+=tlen+1,Y++}sOptionT(F),"01"<k&&sOption(k,"×"),sOptionT(c,"by: "),sOptionT(yr,"'"),totaltime&&sOption(secondsToTimeStr(totaltime,"time:"))}}else if(X.c("'FMC!'"))sName="Lasse 'Faust' Öörni's Faust Music Creator module (.SNG)",bDetected=1,X.isVerbose()&&sOptionT(X.SA(4,20))
else if(/GTS[25!]/.test(X.SA(0,4))&&X.U8(100)<=32){for(sName="Lasse 'Faust' Öörni's GoatTracker module (.SNG)",bDetected=1,(nV=X.U8(3)-48)<0&&(nV=1),sVersion=2<=nV?"v2."+nV:"v1.x",k=X.U8(100),G=101,ords=[],ptn=mptn=0,bad="",ordc=0;G<X.Sz()&&(q=X.U8(G),X.c("FF",G+q));){for(Y=0,G++;Y<q;Y++)(E=X.U8(G++))<=207&&E+1>mptn&&(mptn=E+1)
ordc++,ords.push(q),G++}for(ch=3,ordc==6*k?(sVersion+=" stereo",ch=6):ordc!=3*k&&(bad=bad.addIfNone("!badordcnt")),bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),ins=2<=nV?X.U8(G++):31,inss=[],Y=0;Y<ins;Y++)(E=X.SC(G+(1<nV?9:8),16,"CP1250").trim()).length&&inss.push(E),1<nV?G+=25:G+=24+2*(X.U8(G+7)>>1)
for(Y=0;Y<(1==nV?0:2==nV?3:4);Y++)G+=1+2*X.U8(G)
for(ptn=X.U8(G++),Y=0;Y<ptn;Y++)G+=1+(1==nV?1:4)*X.U8(G)
if(1==nV&&X.Sz()!=G&&(G+=256),X.isVerbose()){for(sOptionT(X.SC(4,32,"CP1250")),1<k&&sOption(k,"×"),sOptionT(X.SC(36,32,"CP1250"),"by: "),sOptionT(X.SC(68,32,"CP1250")),sOptionT(addEllipsis(inss.join(", "),160),'ins/msg:"','"'),Y=0,ordc=[];Y<ords.length/ch;Y++){for(_=l=0;l<ch;l++)_+=ords[Y*ch+l]
ordc.push(_)}sOption("ch:"+ch+" ord:"+ordc.join("+")+" ptn:"+(ptn==mptn?mptn:"/"+ptn)+" ins:"+ins+" sz:"+outSz(G))}}else if(X.c("'ObsM'"))sName="Jonne Valtonen's SNG Player module (.SNG)",bDetected=1,X.U8(11)&&(sVersion+="compressed"),(len=X.U16(4,_LE))>X.Sz()&&(sVersion+="malformed"),X.isVerbose()&&(start=X.U16(6,_LE),loop=X.U16(8,_LE),delay=X.U16(10,_LE),sOption("len:"+Hex(len)+" start:"+Hex(start)+" loop:"+Hex(loop)+" delay:"+delay))
else if(X.c("'RJP'3.'SMOD'"))sName="Richard Joseph's module (.SNG)",bDetected=1,sVersion="v"+X.SA(3,1)
else if(X.c("'SYNC'")||X.c("'SYNB'"))sName="Synder SNG-player module (.SNG)",bDetected=1,sVersion="ver."+X.SA(3,1),X.isVerbose()&&sOption(X.SA(16,512))
else if(X.c("'SYND'....'S0'"))sName="Synder Tracker module (.SNG)",bDetected=1,sVersion="ver."+X.SA(3,1)
else if(X.c("'SYND'")||X.c("'SYNF'")||X.c("'SYNH'"))sName="Synder SNG-player Stereo module (.SNG)",bDetected=1,sVersion="ver."+X.SA(3,1),X.isVerbose()&&sOption(X.SA(16,512))
else if(isWithin(E=(X.U8(0)+1<<4)+(X.U8(1)+1<<7)+869,870,X.Sz())&&(/df\d:/.test(X.SA(E,4))||/[sS]amples/.test(X.SA(E,7)))){if(sName="AJ [Activas]'s ZoundMonitor module (.SNG + Samples/)",bDetected=1,X.isVerbose()){for(ptn=X.U8(1)+1,ord=X.U8(3)+1,spd=X.U8(4),G=5,smp=0;G<815;G+=54)X.U8(G+4)&&smp++
sOption("spd:"+spd+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" len "+secondsToTimeStr(1+Util.divu64(spd*ord*32,50))+" sz:"+outSz(E+101))}}else if(X.c("'RJP'3. 0000 0000"))sName="Richard Joseph's module instruments (.INS)",bDetected=1,sVersion="v"+X.SA(3,1)
else if(X.c("'SNES-SPC700 Sound File Data'")){if(sName="Nintendo SNES SPC chiptune (.SPC)",bDetected=1,sVersion="v0."+X.U8(36),X.isVerbose()){if(id666inhdr=26==X.U8(35),g=_=p=E="",dumper="",emu="",preferBin=!1,id666inhdr){switch(E=X.SA(46,32),g=X.SA(78,32),dumper=X.SA(110,16),dumpdate=X.SA(158,11),48<=(emu=X.U8(210))&&emu<=57&&(emu-=48),emu){case 1:emu="ZSNES"
break
case 2:emu="Snes9x"
break
case 3:emu="ZST2SPC"
break
case 4:emu="ETC"
break
case 5:emu="SNEShout"
break
case 6:emu="ZSNESW"
break
default:emu=""}_=X.SA(126,32),slen=X.SA(169,3),lp=X.SA(172,4),(slen+lp+dumpdate).length<5?(chnDis=X.U8(209),bin=1==chnDis&&""==emu||preferBin):p=/[0-9/]*/.test(slen+lp+dumpdate)?(songlen=Number(slen),X.SA(177,32)):(bin=!0,songlen=X.U8(169)<<16+X.U8(170)<<8+X.U8(171),X.SA(176,32))}else E=X.SA(48,20)
sOption(E),sOption(g,"for: "),sOption(p,"by: "),sOption(_),""!=emu&&(sVersion+=" "+emu)}}else if(X.c("'STK1.0SONG'")&&0<=[1,2,3].indexOf(X.U8(52))&&X.U8(53)<=X.U8(58)&&X.U8(54)<=X.U8(53)&&X.U8(56)<=63&&X.U8(57)<=5){switch(sName="Julien 'Targhan' Nevo's STarKos module (.SKS)",bDetected=1,bad="",X.U8(57)){case 0:hz=13
break
case 1:hz=25
break
case 2:hz=50
break
case 3:hz=100
break
case 4:hz=150
break
case 5:hz=300
break
default:hz=0,bad=bad.addIfNone("!badRepFreq")}for("-"!=(xpos=X.I8(55).toString())[0]&&(xpos="+"+xpos),spd0=X.U8(56),ord=1+X.U16(58),ptn=-1,rows=ptnxpos=0,G=60,Y=0;Y<4*ord;Y++)Y%4==3?rows+=X.U8(G)+1:(E=X.U8(G),ptn<E&&(ptn=E),X.I8(G+1)>>1&&ptnxpos++),G+=2
ptn++,insns=[]
for(ins=0;G<X.Sz()&&ins<256&&(insn=X.U16(G),G+=2,65535!=insn);ins++)if(ip=G,isz=X.U16(ip),G+=4,iend=1+X.U8(G+2),G+=5,iname=X.SA(G,8).trim(),G+=8,""!=iname&&insns.push(iname),X.isDeepScan()){for(j=0;j<iend;j++)if(k=X.U8(G++))if(128&k)y=X.U8(G++),8&k&&G++,64&y&&G++,2&k&&G++,4&k&&(G+=2),16&k&&(G+=2),32&k&&(G+=2)
else{if(16&k&&64&(y=X.U8(G++))&&(G+=2,96&k)){bad=bad.addIfNone("!badinsflags"),ins=j=65534
break}32&k&&G++,64&k&&(G+=2)}}else G=ip+isz
for(sptn=0;G<X.Sz()&&(curptn=X.U16(G),G+=2,65535!=curptn);sptn++)G+=X.U8(G)
if(X.isDeepScan()&&(notecnt=0),G<X.Sz()&&ins<65534)for(Y=0;Y<=ptn;Y++){if(curptn=X.U16(G),G+=2,255!=curptn&&65535!=curptn&&512<curptn){bad=bad.addIfNone("!badnptn")
break}if(65535==curptn)break
if(pp=G,psz=X.U16(pp),X.isDeepScan()){G+=2
pins=-1
for(var R=0;G<Math.min(X.Sz(),pp+psz);){var H=pfvol=pfpitch=!1
if(255==(k=X.U8(G++)))break
if(128&k)R+=127&k
else if(96<=k)switch(15&k){case 0:if(pfvol=!0,pfpitch=!1,15-X.U8(G++)<0){bad=bad.addIfNone("!badptnvol0"),Y=ptn,G=pp+psz
break}case 1:pfvol=!1,pfpitch=!0,X.U8(G++)
break
case 2:pfvol=pfpitch=!0,15-X.U8(G++)<0&&(bad=bad.addIfNone("!badptnvol2"),Y=ptn,G=pp+psz),X.U8(G++)
break
case 3:H=!0,pnote="rst"
break
case 4:H=!0,pnote="spl",pins=X.U8(G++)}else H=!0,y=X.U8(G++),(pfvol=!(64&y))&&y,!(pins<0)&&32&y||(pins=X.U8(G++)),(pfpitch=16&y)&&X.I8(G++)
H&&notecnt++,R++}}else G=pp+psz}""!=(bad=G>X.Sz()?bad.addIfNone("!short"):bad)&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()&&(sOptionT(X.SA(20,32)),sOptionT(X.SA(10,10),"by: "),sOption("spd0:"+spd0+("+0"!=xpos?" xpos:"+xpos:"")+" ord:"+ord+" ptn:"+ptn+"+"+sptn+" ins:"+ins+(ptnxpos?" ptn.xpos:"+ptnxpos:"")+" smp.ch:"+X.U8(52)+" rep.freq:"+hz+"Hz loop:"+(X.U8(54)?Hex(X.U8(54))+"-":"")+Hex(X.U8(53))+(X.isDeepScan()?" notes:"+notecnt:" rows:"+rows)+" sz:"+G))}else if(!X.U8(0)&&X.c("'SK10'",128)&&0<=[1,2,3].indexOf(X.U8(134))&&0<=[13,25,50,100,150,300].indexOf(X.U16(135))&&X.U16(24)==X.U16(64)){for(sName="STarKos module (.BIN)",sVersion="compiled/ofs:80h",bDetected=1,crc=0,Y=0;Y<67;Y++)crc+=X.U8(Y);(crc&=65535)!=X.U16(67)&&(sVersion+="/malformed!badCRC"),X.isVerbose()&&(sOption(X.SA(1,8).trim()+"."+X.SA(9,3).trim()),sOption(X.U16(135)+"Hz"),sOption(Hex(X.U16(132)),"base:"),sOption(outSz(X.U24(64)+188),"sz:"))}else X.c("'Nu!SOPROL!'",34)&&(sName="Holger Gehrmann's Sound Programming Language/SOPROL module (.SPL)",bDetected=1,X.isVerbose())&&(E=X.SA(88,256),p=X.SA(88+E.length+1,256),_=X.SA(88+E.length+p.length+2,256),sOptionT(E),sOptionT(p,"by: "),sOptionT(_))
if(/SPM[\x01-\x02]/.test(X.SA(0,4))&&(sName="Emmanuel Marty & Michael Lavaire's Stonetracker module (.SPM)",sVersion="v"+X.U8(3),bDetected=1,X.isVerbose())&&sOptionT(decAnsi(4,32,CPAmiga)),/SPS[\x01-\x02]{2}/.test(X.SA(0,5))&&X.c("'psn'",6+32*(smp=X.U8(5)))){if(sName="Emmanuel Marty & Michael Lavaire's Stonetracker sample bank (.SPS)",sVersion="v"+X.U8(3),bDetected=1,X.isVerbose()){for(Y=smpsz=0,smps=[];Y<smp;Y++)(E=decAnsi(32*Y+6,8,CPAmiga).trim()).length&&smps.push(E)
sOption(addEllipsis(smps.join(" ")),'smp/msg:"','"'),sOption("smp:"+smp)}}else if(X.c("'SPU'00")||X.c("'SPU1'")||-1<X.fSig(X.Sz()-6,TOEOF,"1D80FF"))bDetected=1,sName="Eternal SPU chiptune (.SPU)",sVersion=X.c("'SPU'")?X.U8(3)?"v1":"v0":"headerless",X.isVerbose()&&"headerless"!=sVersion&&(game=X.SC(4,64,"Shift_JIS"),F=X.SC(68,64,"Shift_JIS"),sOptionT(F),sOptionT(game,"game: "),c=X.SC(132,32,"Shift_JIS"),sOptionT(c,"by: "),cmt=X.SC(164,3840,"Shift_JIS"),sOptionT(cmt))
else if(X.c("'SPEEDY-SYSTEM'"))bDetected=1,sName="Speedy System module (.SS)",sVersion="v1"
else if(X.c("'ZXAYST11'"))sName="Sound Tracker module (.ST1, .ST11)",bDetected=1,sVersion="v1.1/uncompiled",X.isVerbose()&&(t_=X.U8(23),"Some SoundTracker Song"!=(E=X.SA(24,t_-1).trim()))&&sOption(E)
else if(X.c("'STP3'"))sName="Soundtracker Pro II module (.STP)",bDetected=1
else if(X.c("48E7FFFE 4DFA.... 4A2E")&&isWithin(X.I8(6),-1,6)&&0<=[97,102].indexOf(X.U8(12)))sName="SUNtronic module (.SUN)",bDetected=1
else if(X.c("'SVOX'00000000")){if(sName="SunVox module (.SUNVOX)",bDetected=1,X.isVerbose()){for(G=8,E="",bpm=0,spd=0,tme=0,ptn=0,blk=0;G<X.Sz()&&(hkhd=X.SA(G,4),!(charStat(hkhd).indexOf("allasc")<0));){switch(hksz=X.U32(G+4,_LE),G+=8,hkhd){case"VERS":for(nV=X.U32(G,_LE),aV=[],Y=0;Y<4;Y++)aV[3-Y]=nV>>8*Y&255
sVersion+="v"+aV.join(".")
break
case"BVER":if((nB=X.U32(G,_LE))!=nV){for(aV=[],Y=0;Y<4;Y++)aV[3-Y]=nB>>8*Y&255
sVersion+="/v"+aV.join(".")}break
case"NAME":E=X.SA(G,hksz)
break
case"BPM ":bpm=X.U32(G,_LE)
break
case"SPED":spd=X.U32(G,_LE)
break
case"TIME":tme=X.U32(G,_LE)
break
case"SNAM":blk++
break
case"PDTA":ptn++}G+=hksz}sOptionT(E),0<bpm&&sOption(bpm,"bpm:"),0<spd&&sOption(spd,"spd:"),0<tme&&sOption(tme,"len:"),0<ptn&&sOption(ptn,"ptn:"),0<blk&&sOption(blk,"blk:"),sOption(outSz(G),"sz:")}}else if(X.c("'SymM'")){if(sName="Patrick Meng's Symphonie module (.SYMMOD)",bDetected=1,sVersion="v"+X.U32(4,_BE),X.isVerbose()){for(F="",bpm="?",done=!(G=8),ch=0,len=0,extsmp=!1,pro=!1;G<X.Sz()&&(hkhd=X.I32(G,_BE),hkhx=Hex(X.U32(G,_BE)),hksz=4,!(done||charStat(hkhd).indexOf("allasc")<0));){switch(G+=4,hkhd){case-16:if(pklen=X.U32(G,_BE),hksz+=pklen,o=4,10<=pklen&&X.c(G+o,"'PACK'FFFF")){if(!X.isDeepScan()){G=0
break}for(o+=6,unplen=X.U32(G+o,_BE),o+=4,(maxlen=pklen-10)<=25264513.5?maxlen*=170:maxlen=4294967295,unplen>maxlen&&(unplen=maxlen),done=!1,ofs=0,left=unplen;!done&&o<hksz;)switch(tp=X.I8(G+o),o++,tp){case 0:j=X.U8(G+o),o++,left>=j?(E+=X.SA(G+o,j),o+=j,left-=j):done=!0
break
case 1:if(j=X.U8(G+o),o++,dw=X.SA(G+o,4),o+=4,left>=4*j&&o<pklen)for(left-=4*j;j--;)E+=dw
else done=!0
break
case 2:dw=X.SA(G+o,4),o+=4,left>=4*j&&o<pklen?(unp+=dw+dw,left-=8):done=!0
break
case 3:j=X.U8(G+o),o++,left>=j?left-=j:done=!0
break
case-1:done=!0
break
default:sVersion+="/malformed",done=!0}}else F=X.SC(G+o,hksz,"CP1252")
break
case-1:ch=X.I32(G,_BE)
break
case-2:1024<(len=X.I32(G,_BE))&&(len="malformed")
break
case-3:case-4:case-5:break
case-7:extsmp=!0
break
case 10:case 11:case 12:pro=!0
break
case-6:bpm=Math.round(1.24*Math.min(X.I32(G,_BE),800))
break
case-12:hksz=0
break
case-10:case-11:case-13:case-14:case-15:case-17:case-18:case-19:case-20:case-21:hksz+=X.I32(G,_BE)
break
default:_l2r("symmod",G,hkhd+"/"+hkhx+" ("+Hex(hksz,8)+"): ?!?!?!?!?!")}G+=hksz}sOption(F),sOption("ch:"+ch+" bpm:"+bpm+" len:"+len+(done?"sz:"+outSz(G):"")),extsmp&&sOption("extsmp"),pro&&(sVersion+="/Pro")}}else if(X.c("'Synth'")&&!X.c("'esi'",5))sName="C. 'Mr Soundwave' Herbst & B. MIkic/BrainTrace Design's Synthesis module (.SYN)",bDetected=1,X.c("'Synth'",7950)?(sVersion="v"+X.SA(7955,3),X.isVerbose()&&(sOptionT(X.SA(7986,27)),sOptionT(X.SA(8014,256)))):(sVersion="v"+X.SA(5,3),X.isVerbose()&&(sOptionT(X.SA(36,27)),sOptionT(X.SA(64,256))))
else if(X.c("'SYNTRACKER-SONG:'00"))sName="Bastian 'flink'/'twiCe' Spiegel's SynTracker module (.SYNMOD)",bDetected=1,X.isVerbose()&&(t1=X.SC(20,32,"CP1252"),sOptionT(t1,"title/inst: "),t2=X.SC(52,32,"CP1252"),sOptionT(t2),t3=X.SC(84,32,"CP1252"),sOptionT(t3))
else if(X.c("'T0AST'")){function a(){if(1==nV)G=474
else{if(2!=nV)return
G=842}if(drummode=X.U8(G++),chipmode=X.U8(G++),chs=X.U8(G++),ch=0,16<chs)sVersion+="/malformed"
else{for(Y=0;Y<16;Y++)X.U8(G++)&&(ch++,G+=3)
for(ins=0,Y=0;Y<16;Y++)X.U8(G++)&&(ins++,G+=25)
for(ord=X.U16(G,_LE),G+=2+ord,ptn=0,notes=0,U=0;U<=255;U++)if(X.U8(G++))for(ptn++,Y=0;Y<chs;Y++)for(l=0;l<64;)if(128&(b=X.U8(G++)))if(_=127&b)for(G++;_&&l<64;)notes++,l++,_--
else l++
else if(1&b&&G++,2&b&&G++,4&b&&G++,8&b&&G++,16&b&&G++,32&b&&G++,64&b)for(_=X.U8(G++);_&&l<64;)notes++,l++,_--
else notes++,l++
loop=X.U8(G++),t_=X.U32(G,_LE),G+=4,E=X.SC(G,t_,"CP1252"),G+=t_,a_=X.U32(G,_LE),G+=4,p=X.SC(G,a_,"CP1252"),G+=a_,c_=X.U32(G,_LE),G+=4,_=X.SC(G,c_,"CP1252"),G+=c_,sOption(E),sOption(addEllipsis(p,128),"by: "),sOption(addEllipsis(_,256),'msg:"','"'),sOption("ch:"+ch+" ins:"+ins+" ord:"+ord+" ptn:"+ptn+" notes:"+notes+" loop:"+loop+" sz:"+outSz(G))}}sName="Benjamin 'BeRo' Rousseaux's The 0ok Amazing Synth Tracker module (.T0AST)",bDetected=1,sVersion=X.c("'0OK'",5)?(nV=1,"v1"):X.c("010001",5)?(nV=2,"v2"):(nV=-1,"v.unk"),X.isVerbose()&&-1!=nV&&a()}else if(X.c("'T0ASTINS'"))sName="Benjamin 'BeRo' Rousseaux's The 0ok Amazing Synth Tracker instrument file",bDetected=1,X.isVerbose()&&sOption(outSz(33),"sz:")
else if(X.c("4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900...... 4EF900")&&X.U32(44,_BE)-X.U32(2,_BE)==160||X.c("601A")&&(X.c("1010",28)||X.c("1012",28))&&0<(E=X.I32(34,_BE))&&E==X.I32(38,_BE)&&E==X.I32(42,_BE)&&E==X.I32(46,_BE))sName="Tim Follin & Mike D.'s Follin Player II module (.TF)",sVersion="f."+(78==X.U8(0)?"0":"1"),bDetected=1
else if(X.c("'TFMD'"))sName="Shiru's TFM Music Maker tune (.TFD)",bDetected=1,X.isVerbose()&&(G=4,E=X.SA(G,512),G=X.fSig(G,512,"00")+1,p=X.SA(G,512),G=X.fSig(G,512,"00")+1,_=X.SA(G,512),sOptionT(E),sOptionT(p,"by: "),sOptionT(_))
else if(X.c("'TFMfmtV2'")){if(sName="Shiru's TFM Music Maker module (.TFE)",bDetected=1,X.isVerbose()){for(k=[],tobuf=!(G=0),b=63,n=G=0,_=X.U8(G++);n<2244057&&G<X.Sz();)if(tobuf&&786<n&&(tobuf=!1),128!=_)b=_,n++,_=X.U8(G++),tobuf&&k.push(b)
else{for(_=X.U8(G++),next=!0,reps=shl=0;next&&shl<57&&G<X.Sz();)next=!(128&_),_&=127,reps|=Util.shlu64(_,shl),shl+=7,_=X.U8(G++)
if(reps){if(--reps,n+=reps,shl=0,tobuf)for(l=0;l<reps;l++)k.push(b)}else tobuf&&k.push(128),n++}for(G--,spd1=k[8],spd2=k[9],intlv=k[10],ord=(ord=k[11])||256,lp=k[12],d1=k[13]+(k[14]<<8),d2=k[15]+(k[16]<<8),saves=k[17]+(k[18]<<8),d1="20"+(127&d1).padStart(2,"0")+"-"+(1+(d1>>7&15)).padStart(2,"0")+"-"+(d1>>11&31).padStart(2,"0"),d2="20"+(127&d2).padStart(2,"0")+"-"+(1+(d2>>7&15)).padStart(2,"0")+"-"+(d2>>11&31).padStart(2,"0"),auth=decEncoding(k.slice(19,82),CP1251),F=decEncoding(k.slice(83,148),CP1251),cmt=decEncoding(k.slice(147,532),CP1251),Y=ptn=0;Y<ord;Y++)k[Y+531]+1>ptn&&(ptn=k[Y+531]+1);(K=2244057==n?G:-1)<0&&(sVersion=sVersion.appendS("malformed:"+Hex(n),"/")),sOptionT(F),sOptionT(auth,"by: "),sOptionT(cmt),sOption("on: "+d1+(d1!=d2?" to "+d2:"")),sOption("spd:"+spd1+"/"+spd2+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" intlv:"+intlv+" saves:"+saves+(X.isDeepScan()?" sz:"+outSz(K):""))}}else if(902<=X.Sz()&&isWithin(X.U8(37),1,4)&&0<(bin=parseAtariBinary())[0]&&X.c("0E158D",6)&&X.c("8D150E",26)&&X.U16(29)==bin[1][0][1]&&(X.c("'TMC SONG FILE 2.0'",9)||X.c("D4CDC3A0 D3CFCEC7A0 C6C9CCC5A0 B2AEB0",9))){for(sName="Marcin 'Jaskier' Lewandowski's Theta Music Composer (.TM2)",sVersion="v2.0",bDetected=1,bad="",ins=0,p0=65536,G=134;G<262&&!((E=(X.U8(G+640)<<8|X.U8(G))-X.U16(2)+6)<0);G++)0<E&&(isWithin(E,896,bin[1][0][1]+6)?(p0>E&&(p0=E),255!=X.U8(E)&&ins++):bad=bad.addIfNone("!badinsp"))
for(ptn=0,G=262;G<518&&!((E=(X.U8(G+256)<<8|X.U8(G))-X.U16(2)+6)<0);G++)0<E&&(isWithin(E,896,bin[1][0][1])?(p0>E&&(p0=E),255!=X.U8(E)&&ptn++):bad=bad.addIfNone("!badptnp"))
for(ord=(p0-902)/17,G=902,pt=-1;G<p0;G+=17){for(q=G+1;q<G+17;q+=2)X.U8(q)>=pt&&(pt=X.U8(q)+1)
if(isWithin(X.U8(G+16),65,127)&&(bad=bad.addIfNone("!badord")),X.I8(G+16)<=0)break}if(bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()){for(G=38,E="";G<134;G+=32)E=E.appendS(decAnsi(G,32,CPATASCII,0,Chars0to1FATASCII).trim()," | ")
sOption(E),E=(E=X.U8(31))?isWithin(E,1,63)?"stereo":isWithin(E,64,127)?"RMT stereo":"quadro":"mono",sOption("ch:"+E+" spd0:"+X.U8(36)+" ticks:"+X.U8(37)+" ord:"+ord+" ptn:"+ptn+(pt!=ptn?"/"+pt:"")+" ins:"+ins+" sz:"+outSz(bin[0]))}}else if(X.c("0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F0000050F",20)&&X.c("FFFF001000000030000000",385))sName="N.J. Luuring Jr.'s The Musical Enlightenment module (.TME)",bDetected=1
else if(12288<=X.Sz()&&X.c("'TRK01/TV.ES.'")){if(sName="Adam Davidson & Ramjet & Toxic Volume's RamTracker module (.TRK)",bDetected=1,X.isVerbose()){for(sOptionT(X.SC(15,32,"CP850")),sOptionT(X.SC(47,32,"CP850"),"by: "),G=1107,ptn=-1,ord=0;!(254<=(E=X.U8(G++))||G>X.Sz());)ord++,ptn<E&&(ptn=E)
ptn++,sOption("ord:"+ord+" ptn:"+ptn)}}else if(X.c("'S'8F'NG.'")&&/[BW][48]/.test(X.SA(5,2))&&0<(pp=X.fSig(8,128*(ch=X.U8(6)-48),"DD48"))&&!(pp%2)){if(sName="Unique Development/BladePacker's module (UDS.+SMP.)",bDetected=1,X.isVerbose()){for(ptn=mptn=0,maxp=Math.min(X.Sz(),65536),bw="B"==X.SA(5,1)?1:2,ord=pp-8>>bw+1,G=8;G<pp;G++)(E=X.U8(G)+1)>mptn&&(mptn=E)
if(G+=2,E=0,1==bw)for(;55537!=X.U16(G,_BE)&&G<maxp;)(q=X.U8(G++))>E&&(E=q),(q=X.U8(G++))>E&&(E=q)
else for(;55537!=(q=X.U16(G,_BE))&&G<maxp;G+=2)q>E&&(E=q)
ptnp=G,ptn=G-pp-2>>bw+5,K=G+=2+(E+1<<2),G=o=k=0,a2=pp+2
s:for(;G<maxp&&(G=8+o*ch)!=pp;){a0ch=a0=G+ch,o++
e:for(;G<maxp;)for(a0=pp+2+(X.U8(G++)<<bw+5),d6=64;d6&&G<maxp;){if(1==bw?d1=X.U8(a0++):(d1=X.U16(a0,_BE),a0+=2),d1<<=2,0<=[44,32].indexOf(X.U8(ptnp+4+d1))){k++
continue s}if(!--d6){if(G!=a0ch)continue e
continue s}}}1<(k=k||1)&&sOption(k,"×"),sOption("ch:"+ch+" ord:"+ord+" ptn:"+(mptn==ptn?"":mptn+"/")+ptn+" sz:"+outSz(K))}}else if(307<X.Sz()&&X.c("'MAS_UTrack_V00'")&&isWithin(X.U8(14),49,52)&&X.Sz()>32*X.U8(47)+80){for(sName="Marc 'MAS' Schallehn's UltraTracker module (.ULT)",bDetected=1,nV=X.U8(14)-48,sVersion="v"+["<1.4","1.4","1.5","1.6"][nV-1],bad="",msgn=X.U8(47),G=48+32*msgn,smp=X.U8(G++),smpsz=0,smps=[],Y=0;Y<smp;Y++)""!=(E=X.SC(G,32,"CP437").trim())&&smps.push(E),(A=X.U32(G+56)-X.U32(G+52))<0?bad=bad.addIfNone("!badsmpsz"):smpsz+=(4&X.U8(G+61)?2:1)*A,4<=nV?G+=66:G+=64
for(Y=ord=mp=0;Y<256;Y++)(o=X.U8(G++))<254&&(ord++,mp<o)&&(mp=o)
for(ch=X.U8(G++)+1,ptn=X.U8(G++)+1,mp++,G+=ch,_=notes=0;_<ch;_++)for(E=0;E<ptn&&G<X.Sz();E++)for(row=0;row<64&&(rp=1,252==(b=X.U8(G++))&&(rp=X.U8(G++),b=X.U8(G++)),note=isWithin(b,1,96),G+=4,rp=64<rp+row?64-row:rp);)row+=rp,note&&(notes+=rp)
if(G>X.Sz()&&(bad=bad.addIfNone("!short")),K=G+smpsz,""!=bad&&(sVersion=sVersion.appendS("/malformed"+bad,"/")),X.isVerbose()){for(sOptionT(X.SC(15,32,"CP437")),specialmsg=23==msgn&&297221==K&&7==ch&&20==ord&&29==ptn&&17==smp&&1572==notes,G=48,Y=0,r=[];Y<msgn;Y++)E=decAnsi(G,32,CP437,Chars0to1F),""!=(E=specialmsg?E:E.trim())&&r.push(E),G+=32
r=addEllipsis(r.join(specialmsg?"\n":" "),specialmsg?8192:192,specialmsg?8192:160),sOption(r,"msg:"+(specialmsg?"\n":'"'),specialmsg?"\n":'"'),r.length||sOption(addEllipsis(smps.join(","),128,96),'smp/msg:"','"'),sOption("ch:"+ch+" ord:"+ord+" ptn:"+mp+(ptn!=mp?"/"+ptn:"")+" smp:"+smp+" notes:"+notes+" sz:"+outSz(K))}}else if(X.c("'VGEfmtV'")&&isWithin(nV=X.U8(7)-48,1,3)){if(sName="Shiru's VGM Music Maker module (.VGE)",bDetected=1,sVersion="v"+nV,ord=-1,X.isVerbose()){if(ptn=1,n=next=G=0,tobuf=!0,k=[],1<nV)for(_=X.U8(G++);n<7231953&&G<X.Sz();)if(tobuf&&807<n&&(tobuf=!1),128!=_)b=_,n++,_=X.U8(G++),tobuf&&k.push(b)
else if(_=X.U8(G++),1!=nV||_){for(next=!0,reps=shl=0;next&&shl<57&&G<=X.Sz();)next=!(128&_),_&=127,reps|=Util.shlu64(_,shl),shl+=7,_=X.U8(G++)
if(reps){if(reps--,n+=reps,shl=0,tobuf)for(Y=0;Y<reps;Y++)k.push(b)}else tobuf&&k.push(128),n++}else k.push(128),n++,_=X.U8(G++)
else G=1
switch(G--,nV){case 2:spd1=k[16],spd2=k[17],intlv=k[18],d1=k[20]+(k[21]<<8),d2=k[22]+(k[23]<<8),saves=k[24]+(k[25]<<8),ord=k[27],lp=k[28]
break
case 3:spd1=k[26],spd2=k[27],intlv=k[28],ord=k[37],lp=k[38],d1=k[31]+(k[32]<<8),d2=k[33]+(k[34]<<8),saves=k[35]+(k[36]<<8)}if(1!=nV){if(1<ord)for(Y=0;Y<255;Y++)(E=k[551+Y])+1>ptn&&(ptn=E+1)
d1="20"+(127&d1).padStart(2,"0")+"-"+(1+(d1>>7&15)).padStart(2,"0")+"-"+(d1>>11&31).padStart(2,"0"),d2="20"+(127&d2).padStart(2,"0")+"-"+(1+(d2>>7&15)).padStart(2,"0")+"-"+(d2>>11&31).padStart(2,"0")}else d1=d2=spd1=spd2=intlv=saves="?",lp=0
auth=decEncoding(k.slice(39,103),CP1251),F=decEncoding(k.slice(103,167),CP1251),cmt=decEncoding(k.slice(167,551),CP1251),K=7231953==n?G:-1,sOptionT(F),sOptionT(auth,"by: "),sOptionT(cmt),sOption("on: "+d1+(d1!=d2?" to "+d2:"")),sOption("spd:"+spd1+"/"+spd2+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" intlv:"+intlv+" saves:"+saves+" sz:"+outSz(K))}}else if(X.c("'Vgm '")&&X.Sz()>=(eof=X.U32(4)+4)&&(nV=X.U32(8))&&nV<768&&(!X.U32(20)||X.c("'Gd3 '",X.U32(20)+20))){if(bDetected=1,bad="",nV=1e3*(nV>>12)+100*(nV>>8&15)+10*(nV>>4&15)+(15&nV),sName="Video Game Music chiptune stream (.VGM)",eoh=X.U32(52)+52,(nV<150||52==eoh)&&(eoh=64),150<=nV&&eoh<64&&(bad="!dataofs"),sVersion="v"+(nV/100).toFixed(2),X.isVerbose()){if(tags=[],20<(gd3p=X.U32(20,_LE)+20)&&"Gd3 "===X.SA(gd3p,4)){for(sVersion+="/Gd3 v"+X.readBytes(gd3p+4,4).join("")/100,taglen=X.U32(gd3p+8,_LE),(gd3p+=12)+taglen>X.Sz()&&(bad=bad.addIfNone("!tagsz")),Y=0;Y<11&&gd3p<=X.Sz();)0<=(tpos=X.fSig(gd3p,TOEOF,"0000"))?(tags[Y]=X.SU16(gd3p,taglen),gd3p+=2*tags[Y].length+2):(tags[Y]="",gd3p+=2),Y++
Y<11?bad=bad.addIfNone("!tagnum"):tagn=Math.max(0,Y-1),sOption(slashTag(tags[0],tags[1])),sOption(slashTag(tags[6],tags[7]),"by: "),sOption(slashTag(tags[2],tags[3]),"for: "),sOption(slashTag(tags[4],tags[5]),"on: "),sOption(tags[8],"date: "),sOption(tags[9],"ripper: "),sOption(tags[10],"notes: ")}for((smp=X.U32(24))||(bad=bad.addIfNone("!badlen")),lp=X.U32(28)+28,lpsmp=X.U32(32),(lp>=eof||lpsmp>smp)&&(lp=0,bad=bad.addIfNone("!badloop")),rate=X.U32(36),100<nV&&(rate?50==rate?rate+="Hz(PAL)":60==rate?rate+="Hz(NTSC)":rate+="Hz":rate="n/a"),chips=[[12,"SN76489",0],[16,"YM2413",0],[44,"YM2612",110],[48,"YM2151",110],[56,"SegaPCM",151],[64,"RF5C68",151],[68,"YM2203",151],[72,"YM2608",151],[76,"YM2610/B",151],[80,"YM3812",151],[84,"YM3526",151],[88,"Y8950",151],[92,"YMF262",151],[96,"YM278B",151],[100,"YMF271",151],[104,"YMZ280B",151],[108,"RF5C164",151],[112,"PWM",151],[116,"AY8910",151],[128,"GameBoyDMG",161],[132,"NES_APU",161],[136,"MultiPCM",161],[140,"uPD7759",161],[144,"OKIM6258",161],[152,"OKIM6295",161],[156,"K051649/K052539",161],[160,"K054539",161],[164,"HuC6280",161],[168,"C140",161],[172,"K053260",161],[176,"Pokey",161],[180,"QSound",161],[184,"SCSP",171],[192,"WonderSwan",171],[196,"VSU",171],[200,"SAA_1099",171],[204,"ES5503",171],[208,"ES5505/ES5506",171],[216,"X1-010",171],[220,"C352",171],[224,"GA20",171],[228,"Mikey/Atari_Lynx",172]],chipn=0,xhdr=0,170<=nV&&(E=X.U32(188),xhdr=E?E+188:xhdr)&&!(xhdsz=X.U32(xhdr))&&(xhdr=0,bad=bad.addIfNone("!badxhdr")),Y=0;Y<chips.length&&!(chips[Y][0]>=eoh||xhdr&&chips[Y][0]>xhdr);Y++)if(clk=X.U32(chips[Y][0]),b30=Util.shru64(clk,30),b31=b30>>1,b30&=1,clk&=1073741823,!(nV<chips[Y][2])&&clk){switch(chipn++,chip=chips[Y][1],chips[Y][0]){case 12:b30&&b31&&(chip="T6W28"),nV<=151&&!(4&X.U8(43))&&(chip+="/GGStereo")
break
case 16:nV<=101&&5e6<clk&&(chip="YM2612")
break
case 44:151<=nV&&b31&&(chip="YM3438"),nV<=101&&5e6<(clk1=1073741823&X.U32(16))&&(clk=clk1)
break
case 48:151<=nV&&b31&&(chip="YM2164"),nV<=101&&(clk1=1073741823&X.U32(16))<5e6&&(clk=clk1)
break
case 76:chip=b31?"YM2610B":"YM2610"
break
case 116:switch(X.U8(120)){case 0:break
case 1:chip="AY8912"
break
case 2:chip="AY8913"
break
case 3:chip="AY8930"
break
case 4:chip="AY8914"
break
case 16:chip="YM2149"
break
case 17:chip="YM3439"
break
case 18:chip="YMZ284"
break
case 19:chip="YMZ294"
break
default:chip+="-ish"}break
case 132:b31&&(chip+="/FDS")
break
case 144:8&X.U8(148)?chip+="12bit":chip+="10bit"
break
case 156:chip=b31?"K052539":"K051649"
break
case 168:switch(X.U8(150)){case 0:chip="C140+NamcoSystem2"
break
case 1:chip="C140+NamcoSystem21"
break
case 2:chip="219_ASIC+NamcoNA-1/2"
break
default:chip+="-ish"}break
case 204:chip+=":"+X.U8(212)+"ch"
break
case 208:chip=b31?"ES5506":"ES5505",chip+=":"+X.U8(213)+"ch"}sVersion=sVersion.appendS(chip,"#")}volmod=-1,124<eoh&&(192<(volmod=X.U8(124))&&(volmod-=256),volmod=100*(2^(volmod=-63==volmod?-64:volmod)/32),volmod=Math.round(volmod)+"%"),2<chipn&&(bad=bad.addIfNone("!toomanychips")),eof<X.Sz()&&("Vgm "==X.SA(eof,4)?sOption("multisong"):sOption("+extra data")),sOption("rate: "+rate+" len: "+secondsToTimeStr(Util.divu64(smp+22e3,44100))+(lp?" looped":"")+(-1!==volmod&&" 100%"!==volmod?" vol: "+volmod:"")+(xhdr?" xhdr":"")+" sz:"+outSz(eof))}""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/"))}else if(2242<X.Sz()&&X.c("0033'T1'")&&[1,2].includes(X.U8(4))&&X.U8(5)<=1&&X.U8(6)<=10&&!X.U16(7)&&X.U8(9)&&X.U8(12)<=X.U8(11)){if(sName="Daniel Kahlin's VIC-TRACKER module (.VT)",bDetected=1,X.isVerbose()){for(sOptionT(X.SA(414,16)),minst=4095,maxed=k=0,G=10;G<66;G+=4)X.U8(G+1)&&(minst=Math.min(minst,X.U8(G)),maxed=Math.max(maxed,X.U8(G+1)),k++)
for(ptn=0,G=962;G<1986;G++)ptn=Math.max(X.U8(G),ptn)
ptn++,1<k&&sOption(k,"×"),sOptionT(X.SA(430,16),"by: "),sOptionT(X.SA(446,16),"'"),sOption("ptn:"+ptn+" sz:"+outSz(2242+64*ptn))}}else if(-1<X.fSig(X.Sz()-32,TOEOF,"'VSS0'00"))sName="Tomas Partl's Voodoo Supreme Synthesizer audio (.VSS)",bDetected=1
else if(X.c("6000")&&X.c("48E7FFFE610000",4)&&X.c("4CDF7FFF'Nu'",12))sName="Wally Beben's module (.WB)",bDetected=1
else if(X.c("'WSRF'",X.Sz()-32)&&X.c("EA",X.Sz()-16)){if(sName="WonderSwan R programmatic chiptune (.WSR)",bDetected=1,G=X.Sz()-32,sVersion="v"+X.U8(G+4),X.isVerbose()){switch(sOption(Hex(X.U8(G+24)),"CartID:"),pub=X.U8(G+22)){case 0:sOption("(invalid publisher)")
break
case 1:sOption("Bandai")
break
case 2:sOption("Taito")
break
case 3:sOption("Tomy")
break
case 4:sOption("Koei")
break
case 5:sOption("Data East")
break
case 6:sOption("Asmik Ace")
break
case 7:sOption("Media Entertainment")
break
case 8:sOption("Nichibutsu")
break
case 10:sOption("Coconuts Japan")
break
case 11:sOption("Sammy")
break
case 12:sOption("Sunsoft")
break
case 13:sOption("Mebius")
break
case 14:sOption("Banpresto")
break
case 16:sOption("Jaleco")
break
case 17:sOption("Imagineer")
break
case 18:sOption("Konami")
break
case 22:sOption("Kobunsha")
break
case 23:sOption("Bottom Up")
break
case 24:sOption("Kaga Tech")
break
case 25:sOption("Sunrise")
break
case 26:sOption("Cyber Front")
break
case 27:sOption("Mega House")
break
case 29:sOption("Interbec")
break
case 30:sOption("Nihon Application")
break
case 31:sOption("Bandai Visual")
break
case 32:sOption("Athena")
break
case 33:sOption("KID")
break
case 34:sOption("HAL Corporation")
break
case 35:sOption("Yuki Enterprise")
break
case 36:sOption("Omega Micott")
break
case 37:sOption("Layup")
break
case 38:sOption("Kadokawa Shoten")
break
case 39:sOption("Shall Luck")
break
case 40:sOption("Squaresoft")
break
case 43:sOption("Tom Create")
break
case 45:sOption("Namco")
break
case 46:sOption("Movic(?)")
break
case 47:sOption("E3 Staff(?)")
break
case 49:sOption("Vanguard")
break
case 50:sOption("Megatron")
break
case 51:sOption("Wiz")
break
case 52:sOption("Capcom")
break
default:sOption("(unknown publisher)")}sOption(X.U8(G+5),"1sttrk: ")}}else if(X.c("3026b2758e66cf11a6d900aa0062ce6c"))sName="Windows Media (.WMV/WMA)",bDetected=1
else if(X.c("'XAD!'"))sName="Riven the Mage's Exotic AdLib module (.XAD)",bDetected=1,X.isVerbose()&&(sOptionT(X.SA(4,36)),sOptionT(X.SA(40,36),"by: "))
else if(X.c("'Extended Module: '")&&X.c("1A",37)&&isWithin(X.U16(72),1,256)){V=X.U16(58),charset="CP437",sName="Fast Tracker 2 Extended module (.XM)",bDetected=1,text=tracker=mVlsw=bad="",insns=[],smpns=[],hdrp=60,hdrsz=X.U32(hdrp),restartp=X.U16(hdrp+6),flags=X.U16(hdrp+14),linearSlides=1&flags,xFilter=4096&flags,ord=X.U16(hdrp+4),chn=X.U16(hdrp+8),ptn=X.U16(hdrp+10),ins=X.U16(hdrp+12),tmp0=X.U16(hdrp+16),bpm0=X.U16(hdrp+18)
G=hdrp+hdrsz
if(260<=V)for(Y=0;Y<ptn;Y++)G+=X.U32(G)+X.U16(G+7)
var bs=128,J=256,Z=isOMPTMade=isOXM=mixlevCompatFT2=!1
for(madewith=0,X.c("'FastTracker v2.00   '",38)&&276===hdrsz?madewith=V<260?48:0<=(E=X.fSig(17,20,"00"))?restartp?2178:36==E?2434:firstNotOf(E+1,36-E,32)<0?272:2178:restartp?34:290:X.c("'FastTracker v 2.00  '",38)?madewith=1:(madewith=16,tracker=X.SC(38,20,charset).trim(),X.c("'OpenMPT '",38)?madewith=2072:X.c("'MilkyTracker '",38)?X.c("'       '",50)||(mixlevCompatFT2=!0):X.c("'Fasttracker II clone'",38)?madewith=48:X.c("'MadTracker 2.0'00",38)?(Z=!0,tracker=X.c("00000000",53)?"MadTracker 2":"MadTracker 2 (registered)"):X.c("'*Converted '",38)&&X.c("'-File*'",52)&&(madewith=528,tracker="Digitrakker")),xFilter&&2&madewith&&(madewith=2194),smp=smpReserved=0,insp=G,anyADPCM=anyInsSmp=!1,sflags=[],smpsz=lastsmphdsz=lastinstp=lastsmpreserved=-1,ord,Y=0;Y<ins;Y++){if(G+4>X.Sz()){bad=bad.addIfNone("!short")
break}if(ihdsz=(ihdsz=X.U32(G))||263,instp=X.U8(G+26),(inst=X.SC(G+4,22,"CP437").trim()).length&&insns.push(inst),smpn=X.U16(G+27),smphdsz=X.U32(G+29),1==madewith?(madewith|=16,245==ihdsz?(mVlsw="1.00.00.A5",tracker="ModPlug Tracker 1.0 alpha"):263==ihdsz?(mVlsw="1.00.00.B3",tracker="ModPlug Tracker 1.0 beta"):madewith=16):smpn||(263==ihdsz&&!smphdsz&&2&madewith?madewith|=16:29!=ihdsz&&512&madewith?madewith&=-513:160&madewith&&33!=ihdsz&&(madewith=0),33!=ihdsz?madewith&=~J:40<smphdsz&&madewith&J&&((anyInsSmp||-1!=lastsmphdsz&&smphdsz!=lastsmphdsz)&&(madewith=272),lastsmphdsz=smphdsz)),-1==lastinstp?lastinstp=instp:lastinstp!=instp&&32&madewith&&(madewith=-33&madewith|bs),vls=X.U8(G+40+195),vle=X.U8(G+40+196),vef=X.U8(G+40+200),pls=X.U8(G+40+198),ple=X.U8(G+40+199),pef=X.U8(G+40+201),midichecks=X.U8(G+40+208)|X.U8(G+40+209)|X.U16(G+40+210)|X.U8(G+40+214),G+=ihdsz,smp+=smpn,G>X.Sz()){bad=bad.addIfNone("!short")
break}260<=V&&(sflags=[])
var Us=0
if(smpn){for(anyInsSmp=!0,midichecks&&(madewith&=-260),263==ihdsz&&!instp||(madewith&=~J),16&madewith||!(madewith&J)||(4&vef||255!=vls||255!=vle)&&(4&pef||255!=pls||255!=ple)||(madewith=-3&madewith|16),l=0;l<smpn;l++){slen=(l,X.U32(G))
var us=X.I8(G+13),I=X.U8(G+14),Q=X.U8(G+15),$=X.U8(G+17),hs=(C=X.SC(G+18,22,"CP437")).trim()
smpReserved|=$,smpns.push(hs),isADPCM=173===$&&!(48&I),$&&173!=$&&(madewith&=-12),-1==lastsmpreserved?lastsmpreserved=$:lastsmpreserved!=$&&(madewith&=~J),128!=Q&&(madewith&=~J),15&us&&127!=us&&(madewith&=~J),sflags.push([I,isADPCM]),isADPCM&&(anyADPCM=!0),Us+=isADPCM?16+(slen+1>>1):slen,G+=40,160&madewith&&258&madewith&&!(16&madewith)&&(22<$||C.slice($).indexOf(" ")<0)&&(madewith=-33&madewith|144),3==(3&I)&&2&madewith&&(madewith|=4)}smpsz+=Us,260<=V&&(X.c("'OggS'",G)&&(isOXM=!0),G+=Us)}}if(!smpReserved&&2&madewith&&-1<X.fSig(17,20,"00")&&(madewith|=16),V<260){for(Y=0;Y<ptn;Y++)G+=X.U32(G)+X.U16(G+(258==V?6:7))
X.c("'OggS'",G)&&(isOXM=!0),G+=smpsz}for(basesz=G,""==tracker&&(tracker=512&madewith&&!smpReserved&&-1==(lastinstp||-1)?"Digitrakker":32&madewith?"FastTracker 2 or compatible":"Unknown"),fx=0,xt="";G+6<X.Sz()&&(E=X.SA(G,4),!(it=X.U32(G))||!X.U16(G+4)||!("228"===E||2155905152&it)&&1616928864&it);)if("text"===E)E=X.U32(G+4),G+=8,xt=xt.append("t"),text=X.SC(G,E,"CP437").trim(),G+=E,madewith=madewith&~J|16
else if(/F[0-9X]\d\d/.test(E))E=X.U32(G+4),G+8+E<=X.Sz()&&(G+=8+E,fx++),madewith|=16
else if("MIDI"===E)E=X.U32(G+4),madewith=madewith&~J|16,G+8+E<=X.Sz()&&(G+=8+E,xt=xt.append("m"))
else if("CHFX"===E||"CNAM"===E||"PNAM"===E)E=X.U32(G+4),G+8+E<=X.Sz()&&(G+=8+E),madewith=madewith&~J|16
else if("XTPM"===E)for(G+=4,xt=xt.append("x"),madewith=madewith&~J|16,isOMPTMade=!0,E=X.SA(G,4);G+7<X.Sz();){if(!X.U8(G)){G++
break}if(code=X.SA(G,4),icode=X.U32(G),"STPM"===code||"228"===code||2155905152&icode||!(1616928864&icode))break
for(prsz=X.U16(G+4),G+=6,Y=0;Y<ins;Y++)G+=prsz}else{if("STPM"!==E)break
for(G+=4,xt=xt.append("s"),madewith=madewith&~J|16;G+6<X.Sz();){if(!X.U8(G)){G++
break}if(X.c("'VWSL'",G)){switch(v=0,X.U16(G+4)){case 1:v=X.U8(G+6)
break
case 2:v=X.U16(G+6)
break
case 3:v=X.U24(G+6)
break
case 8:v=X.U64(G+6)
break
default:v=X.U32(G+6)}v&&(mVlsw=(t=v.toString(16).toUpperCase().padStart(7,"0")).slice(0,1)+"."+t.slice(1,3)+"."+t.slice(3,5)+"."+t.slice(5,7))
break}G+=6+X.U16(G+4)}}16&madewith&&(4&madewith?(mVlsw="1.11",tracker="ModPlug Tracker 1.0-11"):2&madewith&&!(madewith&J)?(mVlsw="1.16",tracker="ModPlug Tracker 1.0-16"):2&madewith&&madewith&J?(mVlsw="1.16",tracker="ModPlug Tracker 1.0-16 / PlayerPRO"):!(2&madewith)&&madewith&J&&(tracker="PlayerPRO")),X.c("'OpenMPT '",38)&&(mVlsw=X.SA(46,12).trim(),madewith=24),"1.17"<=(mVlsw=isOMPTMade&&mVlsw<"1.17"?"1.17":mVlsw)&&(tracker="OpenMPT v"+mVlsw),K=G,charset=""!=mVlsw||Z?"CP1252":"CP437",X.isVerbose()&&(sOptionT(X.SC(17,20,charset)),sOptionT(tracker,"in:"),isOXM&&sOption("OggMod FastTracker 2 (.OXM)","via:"),text.length&&sOption(addEllipsis(text,256)),insns.length&&sOption(addEllipsis(insns.filter(funSampleName).join(" "),256),'ins/msg:"','"'),smpns.length&&sOption(addEllipsis(smpns.filter(funSampleName).join(" "),256),'smp/msg:"','"'),a="chn:"+chn+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp:"+smp,fx&&(a+=" fx:"+fx),xt.length&&(a+=" xt:"+xt),K!=basesz&&(a+=" base_sz:"+basesz),a+=" sz:"+outSz(K),sOption(a)),sVersion="v"+(V>>8)+"."+(255&V)+bad+(anyADPCM?"/ADPCMpacked":"")}else if(X.c("'FORM' 0000000E 'XDIRINFO'  00000002 .... 'CAT ' ........ 'XMIDFORM' ........ 'XMID'"))bDetected=1,sName="Extended MIDI chiptune (.XMI,.C55,.PCS)",X.isVerbose()&&(1<(k=X.U8(20))&&sOption(k,"×"),sOption(outSz(30+X.U32(26,_BE)),"sz:"))
else if(X.c("'ofTAZ!'"))sName="Davey W. Taylor's Extra Simple Music module (.XSM)",bDetected=1
else if(/YM\d!/.test(X.SA(0,4))||X.c("'YM3b!'")||/YMT\dLeOnArD!/.test(X.SA(0,12))||X.c("'MIX1LeOnArD!'")){switch(bDetected=1,bad="",frm=smp=voc=loop=ddn=0,sName="ST-Sound chiptune stream (.YM)",sV=X.SA(0,4).replace(/!/g,"")){case"YM1":sVersion="YM1"
break
case"YM2":sVersion="MADMAX specific"
break
case"YM3":sVersion="YM-Atari"
break
case"YM3b":sVersion="YM-Atari+loopinfo",loop=X.U32(X.Sz()-4,_LE)
break
case"YM4":sVersion="YM-Atari extended"
break
case"YM5":case"YM6":sVersion="Generic YM2149 extended"
break
case"MIX1":sVersion="Atari Remix digital"
break
case"YMT1":case"YMT2":sVersion="YM-Tracker"}if(0<=["YM2","YM3","YM3b"].indexOf(sV)&&(frm=Util.divu64(X.Sz()-4,14)),0<=["YM5","YM6","YMT1","YMT2","MIX1"].indexOf(sV)){if("LeOnArD!"!=X.SA(4,8)&&(bad=bad.addIfNone("!badsig")),0<=["YM6!","YMT1","YMT2"].indexOf(sV)&&"End!"!=X.SA(X.Sz()-4)&&(bad=bad.addIfNone("!badfilesz")),0<=["YM5","YM6"].indexOf(sV)){for(ddn=X.U16(20,_BE),loop=X.U32(28,_BE),G=X.U16(32,_BE)+34,Y=0;Y<ddn;Y++)if(ds=X.U16(G,_BE),(G+=2+ds)>=X.Sz()){bad=bad.addIfNone("!tooshort")
break}}else if("MIX1"===sV)for(G=24,smp=X.U32(16,_BE),mixblk=X.U32(20,_BE),Y=0;Y<mixblk;Y++)G+=12
else 0<=["YMT1","YMT2"].indexOf(sV)&&(ddn=X.U16(24,_BE),voc=X.U16(13,_BE),frm=X.U32(16,_BE),G=30)
G>=X.Sz()?bad=bad.addIfNone("!nodata"):(E=G,0<=(t_=X.fSig(G,TOEOF,"00")-G)&&(G+=t_+1,p=G,a_=X.fSig(G,TOEOF,"00")-G,G+=a_+1,_=G,c_=X.fSig(G,TOEOF,"00")-G,G+=c_+1,0<=["YM5","YM6"].indexOf(sV))&&(X.c("'End!'",G+((frm=X.U32(12,_BE))<<4))||(bad=bad.addIfNone("!badframes"),sOption("frm/frames: "+(frm<<4)+"/"+(X.Sz()-G-4))))),X.isVerbose()&&(sOptionT(X.SA(E,t_)),sOptionT(X.SA(p,a_),"by: "),sOptionT(X.SA(_,c_)))}X.isVerbose()&&(voc&&sOption(voc,"voc:"),smp&&sOption(outSz(G+smp),"sz:"),ddn&&sOption(ddn,"digidrums:"),frm)&&sOption("len:"+frm+" sz:"+outSz(G+(frm<<4)+4)),""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/"))}else if(X.c("'YMST'")&&(sName="Nicolas 'Mr.Styckx' Pomarede's MYST ST-YM module (.YMST,.YM)",bDetected=1,X.isVerbose())){for(Y=0,G=4;Y<48&&(G+=8,X.U16(G-8,_BE));Y++);E=G,0<=(t_=X.fSig(G,TOEOF,"00")-G)&&(G+=t_+1,p=G,a_=X.fSig(G,TOEOF,"00")-G,G+=a_+1,_=G,c_=X.fSig(G,TOEOF,"00")-G,X.isVerbose())&&(sOptionT(X.SA(E,t_)),sOptionT(X.SA(p,a_),"by: "),sOptionT(X.SA(_,c_)))}if(!bDetected&&(function(){if(X.c("'ZXAYAMAD'")&&!(3<X.U8(9))&&(authp=12+X.I16(12,_BE))<X.Sz()&&(auth=authp?X.SA(authp,256):"",(miscp=14+X.I16(14,_BE))<X.Sz())&&(misc=miscp?X.SA(miscp,256):"",k=X.U8(16)+1,!((G=18+X.I16(18,_BE))>X.Sz()))){for(titles=[],Y=0;Y<k;Y++,G+=4)if(E=G+X.I16(G,_BE)){if(!(E<X.Sz()))return
titles.push(X.SA(E,256).trim())}return 1}})()&&(sName="František Fuka/Fuxoft's AY Amadeus module (.AMAD)",sVersion=[X.U8(8)?"Rel "+X.U8(8):"",X.U8(9)?"Plr "+X.U8(9):""].join(" ").trim(),X.isVerbose())&&(sOptionT(titles.join(",")),1<k&&sOption(k,"×"),authp&&sOptionT(auth,"by: "),miscp)&&sOptionT(misc),!bDetected&&(function(){if(X.c("'ZXAYEMUL'")&&!(3<X.U8(9))&&(authp=12+X.I16(12,_BE))<X.Sz()&&(auth=authp?X.SC(authp,256,"CP1250"):"",(miscp=14+X.I16(14,_BE))<X.Sz())&&(misc=miscp?X.SC(miscp,256,"CP1250"):"",k=X.U8(16)+1,!((G=18+X.I16(18,_BE))>X.Sz()))){for(titles=[],Y=0;Y<k;Y++,G+=4)if(E=G+X.I16(G,_BE)){if(!(E<X.Sz()))return
titles.push(X.SC(E,256,"CP1250").trim())}return 1}})()&&(sName="Sergej Bulba's AY Emul chiptune (.EMUL)",bDetected=1,sVersion=[X.U8(8)?"Rel "+X.U8(8):"",X.U8(9)?"Plr "+X.U8(9):""].join(" ").trim(),X.isVerbose())&&(sOptionT(titles.join(",")),1<k&&sOption(k,"×"),authp&&sOptionT(auth,"by: "),miscp)&&sOptionT(misc),!bDetected&&(function(){if(X.c("'CBMF'")){notes=ins=0
var s=!(G=4),e=Math.min(X.Sz(),65536),t=[]
for(Y=0;Y<16;Y++)t[Y]=!1
for(;!s&&G<e;)for(;!s&&(b=X.U8(G++))<128&&G<e;){if(isWithin(b,1,15)||isWithin(b,64,79)||isWithin(b,113,126))return
switch(b>>4){case 0:X.isHeuristicScan()||(s=!0)
break
case 1:if(!t[b-16])return
G++,notes++
break
case 2:break
case 3:t[b-48]=!0,G+=11
break
case 5:break
case 6:G++}}if(!X.isHeuristicScan()){if(!s&&e<X.Sz()||notes<16)return
for(Y=0;Y<16;Y++)t[Y]&&ins++
if(!ins)return}return 1}})()&&(sName="Bob's Adlib Music module (.BAM)",bDetected=1,sOption("ch:"+ins+" notes:"+notes+" sz:"+outSz(G))),!bDetected&&(function(){if(X.c("'CTMF'")&&isWithin(X.U16(4),256,257)&&isWithin(X.U16(8),37,X.Sz()-1)){for(nV=X.U16(4,_LE),ic=0,bad="",pins=X.U16(6,_LE),(pmus=X.U16(8,_LE))<=pins&&(ic++,bad=bad.addIfNone("!badptr")),ins=257<=nV?(G=40,X.U16(36)):(G=37,X.U8(36)),(E=Util.divu64(pmus-pins,16))!=ins&&(ic++,bad=bad.addIfNone("!inconsistentinscnt"+E)),(tp=X.U16(14,_LE))&&!isWithin(tp,G,pins-1)&&(tp=0,ic++,bad=bad.addIfNone("!badptr")),(ap=X.U16(16,_LE))&&!isWithin(ap,G,pins-1)&&(ap=0,ic++,bad=bad.addIfNone("!badptr")),(cp=X.U16(18,_LE))&&!isWithin(cp,G,pins-1)&&(cp=0,ic++,bad=bad.addIfNone("!badptr")),ch=0,Y=20;Y<36;Y++)1==(E=X.U8(Y))?ch++:1<E&&ic++
return ch||ic++,(K=X.fSig(pmus,Math.min(65536,X.Sz()),"FF2F00"))<0&&(K=X.fSig(pmus,Math.min(65536,X.Sz()),"FF2FFE"),bad=bad.addIfNone("!badeof")),0<K&&(K+=3),ic<5}})()&&(sName="Creative Labs' Creative Music Format chiptune (.CMF)",bDetected=1,sVersion="v"+(nV>>8)+"."+(255&nV),""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose())&&(tp&&sOptionT(addEllipsis(X.SC(tp,256,"CP437"))),ap&&sOptionT(addEllipsis(X.SC(ap,256,"CP437")),"by: "),cp&&sOptionT(addEllipsis(X.SC(cp,256,"CP437"))),257<=nV&&255==X.U8(K)&&K++,sOption("ch:"+ch+" ins:"+ins+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<90||!X.c("02011313 1412010B")||1<X.U8(8)||!isWithin(ch=X.U8(9),1,8)||4096<(ord=X.U16(10))||4096<(ptn=X.U16(12)))){X.U24(14)
for(smp=0,G=17,Y=0;Y<63;Y++,G++)Y,X.U8(G),128&X.U8(G)||(smp++,Y,X.U24(G+1),G+=3)
F=X.UCSD(G),G+=1+X.U8(G)
X.readBytes(G,8)
return(G+=8)>X.Sz()?void 0:1}})()&&(sName="Oregan Developments' Digital Symphony module (.DSYM)",sVersion="v"+X.U8(8),bDetected=1,X.isVerbose())&&(sOptionT(F),sOption("ch:"+ch+" ord:"+ord+" ptn:"+ptn+" smp:"+smp)),!bDetected&&(function(){if(!(!X.c("'DFM'1A")||1<X.U8(4)||[0,1,99].indexOf(X.U8(5))<0||32<X.U8(6))&&isWithin(tmp0=X.U8(39),5,31)){for(inss=[],Y=0,G=40;Y<32;Y++,G+=12){if(11<X.U8(G))return
inss.push(X.UCSD(G))}for(G+=352,ord=ptn=Y=0;Y<128&&128!=X.U8(G+Y);Y++,ord++)ptn=Math.max(ptn,X.U8(G+Y)+1)
for(Y++;Y<128;Y++)if(X.U8(G+Y))return
for(G+=128,optn=X.U8(G++),rptn=next=0;rptn<optn&&G<X.Sz();rptn=next+1)for(next=X.U8(G++),Y=0;Y<576;Y++)128&X.U8(G++)&&G++
return 1}})()&&(sName="Rene Verhaag's Digital-FM module (.DFM)",sVersion="v"+X.U8(4)+"."+X.U8(5).padStart(2,"0"),bDetected=1,X.isVerbose())&&(sOptionT(X.SC(7,32,"CP1252")),sOptionT(addEllipsis(inss.filter(funSampleName).join(" ")),'ins/msg:"','"'),sOption("ch:"+X.U8(6)+" tmp0:"+tmp0+" ord:"+ord+" ptn:"+(ptn!=optn?ptn+"/":"")+(rptn!=optn?rptn+"/":"")+optn+" sz:"+outSz(G))),!bDetected&&(function(){if(X.c("'DBRAWOPL'")&&(4278255360&(E=X.U32(8))?(sVersion="v0",mV=MV=0):65535&E?(MV=X.U16(8),mV=X.U16(10)):(mV=X.U16(8),MV=X.U16(10)),!(3<MV))){switch(MV&&(sVersion="v"+MV+"."+mV.padStart(2,"0")),db="",MV){case 0:db="DOSBox 0.62",lenMS=X.U32(8),dtsz=X.U32(12),hw=X.U8(16),dtofs=17
case 1:1==MV&&(db="DOSBox 0.63",lenMS=X.U32(12),dtsz=X.U32(16),hw=(E=X.U32(20))<=255?E:255,dtofs=24),1==hw?hw=2:2==hw&&(hw=1),fmt=0,co=0
break
case 2:if(db="DOSBox 0.73",dtsz=X.U32(12)<<1,lenMS=X.U32(16),hw=X.U8(20),fmt=X.U8(21),co=X.U8(22),ds=X.U8(23),dl=X.U8(24),regcmdcnt=X.U8(25),dtofs=26+regcmdcnt,128<regcmdcnt&&(regcmdcnt=128),regmap=X.readBytes(26,regcmdcnt),1==hw){for(G=dtofs,opl3on=0,reginit=[],Y=0;Y<512;Y++)reginit[Y]=!1
for(;G<X.Sz()&&(E=X.U8(G))!=ds&&E!=dl&&!((127&E)>=regcmdcnt);)creg=(128&E)<<1|regmap[127&E],reginit[creg]=!0,261==creg&&(opl3en=X.U8(G+1)),G+=2
reginit[261]&&1&opl3en&&(hw=2)}-1===(hw=["YM3812 (OPL2)","YM3812 (Dual OPL2)","YMF262 (OPL3)"].indexOf(hw))&&(hw="YMF262(portshift)")}return 1}})()&&(sName="DOSBox Raw OPL chiptune (.DRO)",sVersion=sVersion.appendS(hw,"#"),bDetected=1,X.isVerbose())&&sOption("len: "+secondsToTimeStr(Util.divu64(lenMS+500,1e3))+" via: "+db+" packed:"+co+" sz:"+outSz(dtofs+dtsz)),!bDetected&&(function(){if(!(X.Sz()<2303)&&X.c("'Funk'")&&(K=X.U32(8),isWithin(K,2303,1048576))){switch(E=X.U32(4),sV=X.SA(12,4),bad="",sus=0,sversion=/F2\d\d/.test(sV)?"R2 GOLD "+(1980+(E>>9&127))+"-"+(E>>5&15).padStart(2,"0")+"-"+(31&E).padStart(2,"0")+" ":"R1",/F[2vk]\d\d/.test(sV)?ch=X.SA(14,2):(sversion+="b",ch=8,sus++),E>>20&15){case 1:case 2:E="IBM"
break
case 3:E="Intel 386"
break
case 4:E="Intel 486"
break
case 5:E="Pentium"
break
case 6:E="Linux"
break
case 7:E="FreeBSD"
break
case 8:E="N/A"
break
default:E="unk.system"}switch(sversion+="#"+E,E>>16&15){case 0:E="SB 2.0"
break
case 1:E="SB Pro"
break
case 2:E="GUS+ch.pan"
break
case 3:E="SB compatible"
break
case 4:E="SB 16"
break
case 5:E="GUS"
break
case 6:E="conversion"
break
case 7:E="Pro Audio Spectrum"
break
case 8:E="Voxware /dev/dsp 8 bit"
break
case 9:E="Voxware /dev/dsp 16 bit"
break
case 15:E="unk.soundcard"
break
default:E="soundcard N/A"}for(sversion+=":"+E,!X.isVerbose()&&X.Sz()<K&&(bad=bad.addIfNone("!short")),ord=0,ptn=-1,Y=0;Y<256&&255!=(E=X.U8(17+Y));Y++)if(ord++,121<E){if(!X.isHeuristicScan())return
bad=bad.addIfNone("!badord")}else E>ptn&&(ptn=E)
for(ptn++,255!=(lp=X.U8(16))&&lp>ord&&(bad+="!badloop"),smp=sus=0,smps=[],Y=400;Y<2239;Y+=32){if(!isWithin(X.U8(Y),1,79))return
if(X.U32(Y+24)&&smp++,charStat(X.readBytes(Y+1,19),1).indexOf("allasc")<0&&sus++,3<sus)return
smps.push(X.SC(Y+1,19,"CP437").trim())}return 1}})()&&(sName="Jason Nunn's Funktracker module (.FNK,.Funk)",sVersion=sversion,bDetected=1,""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose())&&(bpm=X.U8(4),bits=1&bpm?16:8,Z=(bpm>>=1)>>6,bpm&=63,bpm=Z?125-bpm:125+bpm,sOptionT(addEllipsis(smps.filter(funSampleName).join(" ")),'smp/msg:"','"'),sOption("ch:"+ch+" bpm0:"+bpm+" ord:"+(255!=lp?lp+"~":"")+ord+" ptn:"+ptn+" smp:"+smp+" "+bits+"bit sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'PRT'")&&isWithin(ins=X.U8(64),1,64)&&isWithin(nV=X.U8(3),10,50)&&(!(nV<30)||(ptn=[X.U8(61)])[0]&&(ord=[X.U8(62)])[0]&&!((lp=[X.U8(60)])[0]>ord[0]))&&(k=1,G=90,ptnp=[],k=30<=nV?X.U8(G++):k)){30<=nV&&(ord=[],lp=[],ptn=[])
var s,e=[]
for(Y=0;Y<k;Y++){for(lp.push(X.U8(G++)),ptn.push(X.U8(G++)),e.push(X.U8(G++)),ord.push(X.U8(G++)),ptnp.push(X.U32(G,_BE)),G=(G+=4)+4*ord[Y]*2,Y=0;Y<k;Y++)ptnp[Y]+=G
mpp=(s=void 0,s=ptnp.indexOf(Math.max.apply(null,ptnp)),[ptnp[s],e[s]])}return X.Sz()>G}})()&&(sName="Manfred 'Pink' Linzner's PreTracker module (.PRT)",bDetected=1,sVersion=nV<25?"v<0.3":25==nV?"v0.3~0.866":26==nV?"v0.87~0.92":isWithin(nV,27,29)?"v.[0.93~1.5)":30==nV?"v1.5+":"v.TODO",X.isVerbose())&&(sOptionT(X.SA(20,20)),1<k&&sOption(k,"×"),sOptionT(X.SA(40,20),"by: "),sOption("ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" ins:"+ins+" wf:"+(wf=X.U8(65)))),bDetected||X.Sz()<100||!X.c("'CBT'")||!isWithin(nV=X.U8(3),1,12)||(sName="Manfred 'Pink' Linzner's Comeback Tracker module (.CBT)",bDetected=1,sVersion="v"+nV+"β"),!bDetected&&(function(){bad="",sus=lp=0,m=Math.min(X.Sz(),16384)
var s,e,t=X.U16(0),r=(isWithin(t,8,255)||(sus++,bad+="!badpos"),X.U16(2)),i=(isWithin(r,t,511)||(sus++,bad+="!badsmp"),X.U16(4)),n=(i&&!isWithin(i,r,1279)&&(sus++,bad+="!badorn"),X.U16(6))
if(isWithin(n,i,1535)||(sus++,bad+="!badptn"),F="",13<=t&&((e=(s=X.c("'psm1'00",8))?13:8)<t&&(F=decAnsi(e,t-e,CPSpeccy)),s)&&(sus-=2),!(2<sus)){var a=[],o=[0],p=[0],d=[]
for(G=t,ord=ptn=0;G<m;ord++){var c=X.U8(G++),f=(E=X.U8(G),X.I8(G++))
if(255==c){if(255==E)break
if(128&E){if((31&E)>=ord)return
lp=31&E}break}if(!isWithin(f,-36,36)||100<ord||32<c)return
a.includes(c)||a.push(c),c>=ptn&&(ptn=c+1)}if(ord){for(q=X.U16(r),smp=q-r>>1,G=r;G<q;G+=2){if(!isWithin(E=X.U16(G),r,i))return
o.includes(E)||o.push(E)}if(i==n)orn=0
else for(q=X.U16(i),orn=q-i>>1,G=i;G<q;G+=2){if(!isWithin(E=X.U16(G),i,n))return
p.includes(E)||p.push(E)}for(tmp=[100,0],Y=0,G=n;Y<ptn;Y++){if(!isWithin(E=X.U8(G++),2,50))return
for(tmp[0]>E&&(tmp[0]=E),tmp[1]<1&&(tmp[1]=E),l=0;l<3;l++,G+=2){if(!isWithin(E=X.U16(G),n,m))return
d.includes(E)||d.push(E)}}if(d.sort(function(s,e){return s-e}),Util.divu64(d[0]-n,7)==ptn){for(Y=1;Y<d.length;Y++)if(!isWithinRanges(E=X.U8(d[Y]-1),[255,[184,248]])&&5<++sus)return
for(G=d.pop();G<m&&255!=(_=X.U8(G++));)if(isWithin(_,177,183)||252==_)G++
else if(249==_)G+=4
else if([253,254].includes(_))return
return K=G,1}}}})()&&(sName="Denis 'Dexus' Dratov's Pro Sound Maker module (.PSM)",sVersion="compiled",bDetected=1,(0<sus||bad.length)&&(sVersion+="/malformed"+bad+"/sus"+sus),X.isVerbose())&&(sOptionT(F),sOption("tmp:"+tmp[0]+(tmp[0]==tmp[1]?"":"-"+tmp[1])+" ord:"+(lp?lp+"~":"")+ord+" ptn:"+ptn+" smp:"+smp+(orn?" orn:"+orn:"")+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'FORM'........ 'MODLVERS'00000016")&&X.c("'INFO'00000048",30)&&X.c("'CMNT'000001A4",102)&&X.c("'PTDT'",522))for(a=cmt=dt=pt=sv="",smp=ord=ptn=tmp0=0,K=X.U32(4,_BE)+8,maxsz=Math.min(K,X.Sz()),G=30;!bDetected&&G<maxsz&&(hkhd=X.SA(G,4),hksz=X.U32(G+4,_BE),!(charStat(hkhd,1).indexOf("allasc")<0));){switch(hkhd){case"INFO":a=decAnsi(G+8,32,CPAmiga).trim(),smp=X.U16(G+40,_BE),ord=X.U16(G+42,_BE),ptn=X.U16(G+44,_BE),bpm0=X.U16(G+48,_BE)
var s=X.U16(G+52,_BE)
if(!isWithin(s,1,31))return
var e=X.U16(G+54,_BE)
if(!isWithin(e,0,12))return
var t=X.U16(G+56,_BE)
if(isWithin(t,30,88))return
dt=1900+t+"-"+e.padStart(2,"0")+"-"+s.padStart(2,"0")+" "+X.U16(G+58,_BE).padStart(2,"0")+":"+X.U16(G+60,_BE).padStart(2,"0")+":"+X.U16(G+62,_BE).padStart(2,"0"),pt=secondsToTimeStr(3600*X.U16(G+64,_BE)+60*X.U16(G+66,_BE)+X.U16(G+68,_BE))
break
case"CMNT":"UNNAMED AUTHOR"===(auth=decAnsi(G+8,32,CPAmiga).trim())&&(auth=""),cmt=decAnsi(G+40,hksz-32,CPAmiga).trim()
break
case"PTDT":return 1}G+=hksz}})()&&(sName="ProTracker IFF-wrapped module (.PTM)",bDetected=1,(sv=X.SA(24,6).trim()).length||(sv="v3.6"),sVersion=sv,X.isVerbose())&&(sOption(a),sOption(auth,"by: "),sOption(cmt),sOption(dt,"on "),sOption(pt,"len "),sOption("bpm0:"+bpm0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp),sOption(outSz(K),"sz:")),!bDetected&&(function(){if(!(!X.c("'SCRM'",44)||!X.c("10",29)||[1,2].indexOf(X.U8(42))<0||X.Sz()<96)){for(keepmidims=fmttrkstr=trknc=ss=isSchism=!1,tracker=lswv=bad="",sus=0,X.c("1A",28)||(sus++,bad=bad.addIfNone("!badsig1a")),(z1=X.U16(30))&&(sus++,bad=bad.addIfNone("!badsig0")),1&(ord=X.U16(32))&&(sus++,bad=bad.addIfNone("!oddord")),smp=X.U16(34),ptn=X.U16(36),fl=X.U16(38),cwtv=X.U16(40),tv=cwtv>>12,wtv=4095&cwtv,fmtv=X.U16(42),gvol=X.U8(48),spd=X.U8(49),tmp=X.U8(50),mvol=X.U8(51),uc=X.U8(52),usept=0<(X.U8(53)&&252),r2=X.U16(54),special=X.U16(62),ch=4,Y=0;Y<32;Y++)255!=X.U8(64+Y)&&(ch=Y+1)
switch(E=Hex(cwtv),sv=E.substr(1,1)+"."+E.substr(2,2).padStart(2,"0"),tv){case 520&tv:tracker="Akord"
break
case 1:X.c("'SCLUB2.0'",54)?tracker="Sound Club 2":4896!=cwtv||special||15&ord||uc||-81&fl||!usept?4896!=cwtv||special||uc||fl||usept?4896!=cwtv||special||uc||8!=fl||usept?(ss=!0,4896==cwtv?tracker="Psi's Scream Tracker 3.20-21":(tracker="Psi's Scream Tracker",fmttrkstr=!0)):tracker="J.Lim's Impulse Tracker < 1.03":tracker=64==gvol&&48==mvol?"PlayerPRO":"Velvet Studio":(tracker=mvol?(lswv="1.16","ModPlug Tracker/OpenMPT 1.17"):(lswv="1.00.00.A0","ModPlug Tracker 1.0 alpha"),keepmidims=trknc=!0)
break
case 2:fmttrkstr=8211!=cwtv,tracker=fmttrkstr?"Imago Orpheus":"PlayerPRO",trknc=!0
break
case 3:tracker=13088==cwtv?"Impulse Tracker 1.03":532<r2?"Impulse Tracker 2.15":isWithin(wtv,533,535)?"Impulse Tracker 2.14p"+(533==wtv?"1-2":534==wtv?"3":"4-5"):"Impulse Tracker "+((3840&wtv)>>8)+"."+(255&wtv).toString(16).padStart(2,"0"),trknc=!0
break
case 4:var s,e
tracker=16640==cwtv?"BeRoTracker":(isSchism=!0,(s=(e=734016+(wtv<4095?wtv-80:r2))-(365*(t=Util.div64(1e4*e+14780,3652425))+Util.div64(t,4)-Util.div64(t,100)+Util.div64(t,400)))<0&&(s=e-(365*--t+Util.div64(t,4)-Util.div64(t,100)+Util.div64(t,400))),e=Util.div64(100*s+52,3060),"Schism Tracker "+(t+Util.div64(e+2,12)).padStart(4,"0")+"-"+((e+2)%12+1).padStart(2,"0")+"-"+(s-Util.div64(306*e+5,10)+1).padStart(2,"0")),trknc=!0
break
case 5:cwtv>>8==87?(tracker="NESMusa",fmttrkstr=!0):r2||16!=uc||1==X.U8(65)?tracker=21575!=cwtv?(19464192<=(v=wtv<<16)&&(v|=r2),"OpenMPT "+(lswv=(t=v.toString(16).toUpperCase().padStart(7,"0")).slice(0,1)+"."+t.slice(1,3)+"."+t.slice(3,5)+"."+t.slice(5,7))):"Dumbo's Graoumf Tracker":(tracker="Liquid Tracker",fmttrkstr=!0)
break
case 6:tracker="BeRoTracker"
break
case 7:tracker="BeRo's CreamTracker"
break
default:51712==cwtv&&(tracker="Camoto")}var t
if(!(2<=sus)){for(fmttrkstr&&(tracker+=" "+sv),charset=""!=lswv?"CP1252":"CP437",G=96+ord+2*smp,max=K=0,Y=0;Y<ptn;Y++){var r=X.U16(G+2*Y)<<4
r&&r>max&&(max=r,K=max+X.U16(r))}if(K%16&&(K+=16-K%16),usept){var i=!1
for(G+=2*ptn,Y=0;Y<ch;Y++)ss&&isWithin(X.U8(64+(255&Y)),16,29)&&X.U8(G+Y)<16&&(i=!0)
ch<32&&0<=lswv.indexOf("1.16")&&(tracker=i?"ModPlug Tracker 1.16/OpenMPT 1.17":"ModPlug Tracker")}for(G=96+ord,anysmp=anyADPCM=!1,gus=0,smps=[],Y=0;Y<smp;Y++)(si=X.U16(G+2*Y)<<4)&&(si>X.Sz()?bad=bad.addIfNone("!short"):(P=X.U8(si),A=X.U32(si+16),""!=(E=X.SC(si+48,28,charset).trim())&&smps.push(E),P<2&&(A&&(anysmp=!0,I=X.U8(31),anyADPCM||4!=X.U8(si+20)||6&I||(anyADPCM=!0)),gus|=X.U16(si+40)),1===X.U8(si)&&(sofs=X.U16(si+14)<<4)>max&&(4&I&&(A*=2),max=sofs,K<max+A)&&(K=max+A)))
return usegus=1<gus,ss&&anysmp&&!gus&&4864!=cwtv?(ss=!1,tracker="Unknown",4865!=cwtv||uc||(!(-81&fl)&&128&mvol&&usept?tracker="Laurent Clévy's UNMO3":fl||48!=gvol||176!=mvol||150!=tmp||usept?fl||64!=gvol||48!=(127&mvol)||6!=spd||125!=tmp||usept||(tracker="Zab/Kosmic's To-S3M"):tracker="Slixter's deMODifier")):ss&&(tracker+=usegus?" (GUS)":" (SB)"),anyADPCM&&(tracker+=" (ADPCM packed)"),1}}})()&&(sName="Sami 'Psi' Tammilehto's ScreamTracker 3 module (.S3M)",bDetected=1,sus&&(sVersion=sVersion.appendS("malformed"+bad+" sus"+sus,"/")),X.isVerbose())&&(sOptionT(X.SC(0,28,charset)),sOption(tracker,"in:"),sOption(addEllipsis(smps.join(" "),160),'smp/msg:"','"'),sOption("ch:"+ch+" tempo0:"+tmp+" spd0:"+spd+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" gvol:"+gvol+" smpvol:"+(127&mvol)+(128&mvol?"/mono":"/stereo")+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'MAD+'")){for(ord=X.U8(185),ptn=X.U8(186),tmr=X.U8(187),Y=0,G=188;Y<32*ptn*9;Y++)if(isWithin(X.U8(G++),96,253))return
for(Y=0;Y<ord;Y++)if(!isWithin(X.U8(G++),1,ptn))return
return 1}})()&&(sName="Mlat Adlib Tracker module (.MAD)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" sz:"+outSz(G)),!bDetected&&(function(){if(X.c("'SONG'")&&(K=X.U32(4,_LE),G=8,v=X.U8(G++),trk=1<=v?X.U8(G++):4,fxprm=17<=v?X.U8(G++):1,fxc=17<=v?X.U8(G++):0,F=X.SC(G,4096,"CP1250"),G+=F.length+1,ptnr=X.U8(G++)+1,seqr=X.U8(G++)+1,ptnr)&&seqr){for(mcr=0,Y=eof=0;G<X.Sz()&&!eof;G+=X.U32(G+4))switch(X.SA(G,4)){case"SEQU":if(X.U8(G+8)>seqr)return
Y|=1
break
case"PATT":Y|=16
break
case"MACR":Y|=256,mcr=X.U8(G+8)
break
default:if(Y<17)return
eof=1}return K=G,1}})()&&(sName="Tero 'kometbomb' Lindeman's ProtoTracker module (.SONG)",bDetected=1,sVersion=sVersion="v"+v,X.isVerbose())&&(sOption(F),sOption("trk:"+trk+(fxc?" fx:"+fxc:"")+(mcr?" mcr:"+mcr:"")+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'+SNT'")){for(Y=smp=0,G=4;Y<32;Y++){if(7<X.U8(G))return
if(1&X.U8(G++)){var s=X.U24(G),e=(G+=3+2*s,X.U24(G)),t=X.U24(G+3)
if(G+=6,s<e||s<t||t<e)return
s&&smp++}}for(vs=[],Y=ins=0;Y<16&&G<X.Sz();Y++){var r=X.U8(G++)
for(G+=r,r&&ins++,l=0;l<r&&G<X.Sz();l++){if(G+=2,!a())return
if(G+=1+55*X.U8(G),8<X.U8(G))return
if(!a())return
G+=10}if(1<(E=X.U8(G++)))return
if(E&&!n())return
if(1<(E=X.U8(G++)))return
E&&(G+=193)}for(G+=320,Y=0;Y<3;Y++){if(1&(fl=X.U8(G++))&&!n())return
if(2&fl&&!n())return
if(4&fl&&!n())return}if(X.c("'-SNT'",G)&&(G+=4,X.c("'GOAT'",G))){bad="",nv=X.U16(G+4),ch=X.U8(G+6),ptn=X.U8(G+7),ins=X.U8(G+8),bpm0=(bpm0=X.U8(G+9))||125,G+=12
for(ord=0,Y=0;Y<ch;Y++){X.U8(G++)
for(258==nv?E=X.U8(G++):(E=X.U16(G),G+=2),ord=Math.max(E,ord),l=0;l<E;l++)if(f=X.U16(G),G+=2,256<f&&(bad=bad.addIfNone("!badchnum")),f)for(U=256;U;U>>=1)f&U&&G++}var i
for(Y=0;Y<ptn;Y++){X.U8(G++)
for(258==nv?i=X.U8(G++):(i=X.U16(G),G+=2),i||(bad=bad.addIfNone("!badptnrows")),l=0;l<i;l++)if(f=X.U32(G),G+=4,f)for(U=65536;U;U>>=1)f&U&&(G+=4)}return 1}}function n(){switch(X.U8(G++)){case 1:if(1<X.U8(G+11)||!isWithin(X.F32(G+3),-.1,1.1))return
G+=12
break
case 2:if(1<X.U8(G+1)||1<X.U8(G+7))return
G+=14
break
case 3:G+=5
break
case 4:if(1<X.U8(G+9))return
G+=55
break
case 5:if(1<X.U8(G+1))return
G+=29
break
case 6:G+=9
break
case 7:G+=24
break
case 8:if(1<X.U8(G+24))return
G+=25
break
default:return}return 1}function a(){for(var s=X.U8(G++),e=0;e<s&&G<X.Sz();e++)if(!n())return
return 1}})()&&(sName="Fredrik 'Gnilk' Kling & Stefan 'Steffo' Hållén & Zyrax's Beaver Sweeper module (.GTK)",sVersion="v"+nv.toString(16).padStart(4,"0"),bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),bDetected=1,X.isVerbose())&&sOption("ch:"+ch+" bpm0:"+bpm0+" ord:"+ord+" ptn:"+ptn+(ins?" ins:"+ins:"")+" smp:"+smp+" sz:"+outSz(G)),bDetected||!X.c("'mpl'")||(G=X.U32(4,_BE))>X.Sz()||1&G||(songp=G+8,!X.c("'mdt'",G))||((G+=X.I32(G+4,_BE))>X.Sz()||1&G)||!X.c("'msm'",G)||(G+=X.I32(G+4,_BE))<X.Sz()||(K=G,smpp=songp+X.I32(songp-4,_BE),smpsz=X.I32(smpp-4,_BE),smp=X.I16(songp+20,_BE)-X.I16(songp+18,_BE)>>2,songsz=songp-8,k=X.I16(songp+4,_BE)-X.I16(songp+2,_BE)>>2,G=X.I16(songp,_BE),ord=X.I16(songp+6,_BE)-G-X.I32(songp+G+12,_BE),!1)||(sName="Anders 'Zonix' 0land's Music & Player module (.HOT)",bDetected=1,sVersion="v"+X.SA(3,1),X.isVerbose()&&(1<k&&sOption(k,"×"),sOption("ord:"+ord+" smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)),sOption(outSz(K),"sz:"))),!bDetected&&(function(){var s,e
if(/(UN0[4-6].*|APUN\x01[1-6])/.test(X.SA(0,6))&&(G=4,voc=0,"N"!=X.SA(3,1)?6<(s=X.U8(3)-48)&&(s=X.U16(4,_BE)):s=256,6<=s?(e=_BE,6==s?G++:(s=X.U16(G,e),G+=2),flg=X.U16(G,e),G+=2,ch=X.U8(G++),voc=X.U8(G++),ord=X.U16(G,e),ptn=X.U16(G+2,e),trk=X.U16(G+4,e),ins=X.U16(G+6,e),smp=X.U16(G+8,e),reppos=X.U16(G+10,e),G+=12,spd0=X.U8(G++),tmp0=X.U8(G++),vol0=X.U8(G++),262<=s?(bpmlimit=X.U16(G,e),G+=2):bpmlimit=32):(e=_LE,ch=X.U8(G++),ord=X.U16(G,e),G+=2,5==s?(lp=X.U16(G,e),G+=2):lp=0,ptn=X.U16(G,e),trk=X.U16(G+2,e),ins=X.U16(G+4,e),G+=6,smp=0,spd0=X.U8(G++),tmp0=X.U8(G++),G+=288,flg=X.U8(G++),bpmlimit=32),sv="N"==X.SA(3,1)?"v.APlayer":"v"+Hex(s),!(s<6&&!isWithin(ch,1,32)&&!isWithin(ord,1,256)||lp>ord))&&trk&&ptn&&isWithin(ins,1,256)&&spd0&&tmp0){if(titlesz=X.U16(G,_LE),titlep=G+2,G+=2+titlesz,s<258?(origssz=X.U16(G,_LE),origsp=G+2,G=p1=G+2+origssz,G=origsp+origssz):origssz=0,cmtsz=X.U16(G,_LE),cmtp=G+2,G+=2+cmtsz,6<=s&&(G=(G+=256<=s?2*ord:ord)+3*ch),smps=[],inss=[],smpsz=0,6<=s){for(Y=0;Y<smp;Y++)smpsz+=X.U32(G+7,e),E=X.U16(G+35,_LE),G+=37,smps.push(X.SC(G,E,"CP437").trim()),G+=E
for(Y=0;Y<ins;Y++)G+=13,pt=X.U8(G+1),G+=6+4*(256<=s?32:pt),pt=X.U8(G+1),G+=6+4*(256<=s?32:pt),pt=X.U8(G+1),G=(G+=6+4*(256<=s?32:pt))+(259<=s?240*smp:120*smp),E=X.U16(G,_LE),G+=2,inss.push(X.SC(G,E,"CP437").trim()),G+=E}else for(Y=0;Y<ins;Y++)for(smpn=X.U8(G),smp+=smpn,G+=209,E=X.U16(G,_LE),G+=2,E&&(inss.push(X.SC(G,E,"CP437").trim()),G+=E),l=0;l<smpn;l++)smpsz+=X.U32(G+5,e),E=X.U16(G+19,_LE),G+=21,E&&(smps.push(X.SC(G,E,"CP437").trim()),G+=E)
for(G+=2*ptn+2*ch*ptn,Y=0;Y<trk;Y++)G+=X.U16(G,e)+2
return K=G+smpsz,1}})()&&(sName="Otto Chrons/libmikmod UNIMOD/UNITRK module (.UNI)",sVersion=sv,bDetected=1,X.isVerbose())&&(sOptionT(X.SC(titlep,titlesz,"CP437")),origssz&&sOptionT(X.SA(origsp,origssz),"orig: "),sOptionT(X.SC(p1+2,X.U16(p1),"CP437")),sOption(addEllipsis(inss.filter(funSampleName).join(" ")),'ins/msg:"','"'),sOption("ch:"+ch+(voc?"/"+voc:"")+" spd0:"+spd0+" tmp0:"+tmp0+" trk:"+trk+" ord:"+(lp?lp+"~":"")+ord+" ptn:"+ptn+" ins:"+ins+(smp?" smp:"+smp:"")+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<40||65535<=X.Sz())){if(X.c("0001.... 000D00")&&X.c("FFFF",11))nV=0
else{if(!X.c("01..01.. 000F00")||!X.c("FFFF",13))return
nV=1}if(!((seqp=X.U16(3,_LE))<13||seqp>X.Sz())){for(k=1,seqtest=X.fSig(seqp+18+9,TOEOF,"0000000000 FFFF")-seqp;32<seqtest;)if(k++,seqtest-=32,!X.c("0000000000",seqp+seqtest))return
if(trkp=E=X.U16(5,_LE),X.c("FFFF",trkp-2)&&!(trkp<13)&&(insp=X.U16(7,_LE),X.c("FFFF",insp-2))&&!(insp<13)&&(K=X.U16(9,_LE),X.c("FFFF",K-2))&&!(K<13)&&(1!=nV||(sfxp=X.U16(11,_LE),X.c("FFFF",sfxp+8)))&&!(Math.abs(trkp-seqp)<20||Math.abs(trkp-insp)<20||Math.abs(seqp-insp)<20)){for(oldp=trkp,G=X.U16(trkp,_LE),ip=0,once=0;E<trkp+18&&trkp<X.Sz();){if((G=E===trkp?oldp=E:G)&&(oldp=G),!(G=X.U16(E,_LE))||G<trkp||G>X.Sz())return
if(!X.c("FFFF",G-2)&&1<++once)return
if(G<oldp&&2<++ip)return
for(q=G;!X.c("FFFF",q)&&q<X.Sz();)q+=2
if(!X.c("FFFF",q))return _log("D00nohdr: boh. t="+Hex(E)+" p="+Hex(G)+" q="+Hex(q)),0
E+=2}return r="",0<(E=X.fSig(K,512,"FFFF"))?(r=X.SC(K,E-K,"CP437").trim(),K=E+2):(r=X.readBytes(K,Math.min(K+256,X.Sz())-K),_=charStat(r,1),r=0<=_.indexOf("allxsc")?(r=decEncoding(r,CP437),K+=r.length,r.trim()):""),1}}}})()&&(sName="Jens Christian 'JCH/Vibrants' Huus's Edlib Tracker module (.D00)?",sVersion="old v"+X.U8(0),bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOptionT(addEllipsis(r,256,128),'msg:"','"'),sOption("sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<1084)){var s=X.readBytes(1080,4),e=X.SA(1080,4),t=1084,r=isGenericMCh=isMdKd=maybeWOW=isHMNT=isInconexia=isNoiseTracker=setMODVBlankTiming=hasLongSmp=hasEmptySmpwVol=hasRepLen0=!1,i=0,n=40
if(/(M\.K\.|M!K!|PATT|NSMS|LARD)/.test(e))chn=4,tracker="generic Protracker-compatible","M.K."===e&&(isMdKd=!0,maybeWOW=!0)
else if(/(M&K!|FEST|N\.T\.)/.test(e))chn=4,"N.T."===e?tracker="Pex 'Mahoney' Tufvesson & Anders 'Kaktus' Berkeman's NoiseTracker":(tracker="Pex 'Mahoney' Tufvesson & Anders 'Kaktus' Berkeman's His Master's NoiseTracker",isHMNT=!0),isNoiseTracker=!0
else if(/O[KC]TA/.test(e))chn=8,tracker="Armin Sander's Oktalyzer"
else if(/CD[68]1/.test(e))chn=s[2]-48,tracker="Christian Dahl et al.'s Octalyser STE (Atari)"
else if(compareArrays(s,[77,0,0,0])||compareArrays(s,[56,0,0,0]))chn=56===s[0]?8:4,n=1,tracker="Inconexia demo",isInconexia=!0
else if(/FA0[4-8]/.test(e))chn=s[3]-48,tracker="Digital Tracker",t=1088
else if(/(FLT|EXO)[48]/.test(e))4==(chn=s[3]-48)&&i++,r=setMODVBlankTiming=!0,tracker="Startrekker"
else if(/[1-9]CHN/.test(e))chn=s[0]-48,isGenericMCh=!0,tracker="generic MOD-compatible"
else if(/[1-9][0-9]C[HN]/.test(e))chn=10*s[0]+s[1]-528,isGenericMCh=!0,tracker="generic MOD-compatible"
else if(/TDZ[1-3]/.test(e))chn=s[3]-48,tracker="Twaddler and Dr. Zon's TakeTracker"
else{if(!/WARD/.test(e))return
chn=8,isGenericMCh=!0,tracker="generic MOD-compatible"}if(chn){for(restartpos=X.U8(951),G=20,wowsmpsz=ib=0;G<950;G+=30){var a=X.U16(G+22,_BE)<<1,o=(wowsmpsz+=a,!isHMNT&&!hasLongSmp&&131072<=a&&(hasLongSmp=!0),X.U8(G+24)),p=X.U8(G+25),d=X.U16(G+26,_BE)<<1,c=X.U16(G+28,_BE)<<1
if((o||a&&64!=p)&&(maybeWOW=!1),15<o&&ib++,64<p&&ib++,a||64!=p||(hasEmptySmpwVol=!0,i&&!d&&c<=2&&i++),a<d&&ib++,hasRepLen0||!a||c||(hasRepLen0=!0),ib>n)return}isFLT8=r&&8==chn
wowsmpsz
if((maybeWOW=restartpos?!1:maybeWOW)||(wowsmpsz=0),2<=i&&(tracker+="/Audio Sculpture"),ord=X.U8(950)){if(ol=X.readBytes(952,128),128<ord)ord=128
else if(!ord)for(ord=128;1<ord&&!ol[ord-1];)ord--
for(ptn=iptn=optn=0,Y=952,Y=0;Y<128;Y++){isFLT8&&(ol[Y]/=2)
var m=ol[Y]
m<128&&m>=ptn&&(ptn=m+1,Y<ord)&&(optn=ptn),ptn>=iptn&&(iptn=ptn+1)}var s=-2&X.Sz(),f=(wowsmpsz&&wowsmpsz+t+8*ptn*256==s?h(t+4*ptn*256)<16&&(chn=8):ptn!=optn&&64<h(t+optn*chn*256)&&(ptn=optn),iptn>ptn&&t+a+iptn*chn*256==s&&(ptn=iptn),maybeWOW&&8===chn&&(tracker="Mod's Grave",isGenericMCh=!0),(restartpos>=ord||120==restartpos&&4===chn)&&(restartpos=0),!0)
leftPan=extPan=maxPan=0
if(!isNoiseTracker){for(isNoiseTracker=isMdKd&&!hasEmptySmpwVol&&!hasLongSmp,G=t,m=0;m<ptn;m++)for(var l=0;G<m*chn*256;G+=4){var b=X.readBytes(G,4),S=(15&b[0])<<8|b[1],S=(S&&4095!=S&&f&&(S<113||856<S)&&(f=isNoiseTracker=!1),15&b[2]),b=b[3];(6<S&&S<10||14==S&&1<b||15==S&&31<b||13==S&&1<++l)&&(isNoiseTracker=!1),8==S&&(b>maxPan&&(maxPan=b),b<128?leftPan=!0:143<b&&164!=b&&(extPan=!0))}leftPan&&!extPan&&maxPan}if(f&&!hasRepLen0&&0<=["M.K.","M!K!","PATT"].indexOf(e)||!f&&127==restartpos&&isMdKd&&restartpos+2>=ord&&(tracker="Sami 'Psi/Future Crew' Tammilehto's Scream Tracker"),!((K=t+ptn*chn*256)>X.Sz())){G=20,smp=0,songsz=K,ib=0,smps=[]
for(var U=0;G<950;G+=30)isHMNT||(E=X.readBytes(G,22,!0),(E=decEncoding(E,CPAmiga).trim()).length&&smps.push(E)),(a=2*X.U16(G+22,_BE))&&smp++,X.c("'ADPCM'",K)&&(U++,a=5+(a+1>>1)+16),K+=a
if(X.c("8BBEB4BA 8BADBEBC B4BAAD",K)){for(var u=[];K<X.Sz()&&isWithin(223^X.U8(K),10,127);)u.push(223^X.U8(K++))
r=decEncoding(u,CP437),tracker="Twaddler and Dr. Zon's TakeTracker",/\ version\ \d+\./.test(r)&&(tracker+=" v"+/\ version\ (\d[^!]+)/.exec(r)[1])}else isMdKd&&X.c("001155332211",K)&&(tracker="Tetra Music Editor:"+X.U24(K+6,_BE).padStart(6,"0"),K+=9)
return U&&!isInconexia&&(tracker+=" (ADPCM packed: "+U+")"),1}}}}function h(s){var e=0
for(Y=0;Y<64*chn;Y++)224&X.U8(s+(Y<<2))&&e++
return e}})()&&(sName="Amiga Freelancers' Protracker module (.MOD)",bDetected=1,sVersion=X.SA(1080,4),X.isVerbose())&&(sOptionT(decAnsi(0,20,CPAmiga)),sOption(tracker,"in: "),sOptionT(addEllipsis(smps.filter(funSampleName).join(" "),200),'smp/msg:"','"'),sOption("ch:"+chn+" ord:"+ord+" ptn:"+(optn!=ptn?optn+"/":"")+ptn+(iptn!=ptn?"("+iptn+")":"")+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<2240)&&X.c("'KRIS'",952)&&!(128<(ord=X.U8(956))||127<(loop=X.U8(957))||loop<127&&loop>=ord)){G=22
var s=ib=0
smp=synwf=0,smps=[]
for(var e=0;e<31;G+=30,++e)if(X.U8(G)){""!=(E=X.SC(G,20,"IBM850").trim())&&"
"!=E&&smps.push(E)
var t=2*X.U16(G+22,_BE)
if(s+=t,240&X.U8(G+24)&&ib++,64<X.U8(G+25)&&ib++,2*X.U16(G+26,_BE)>t&&ib++,40<ib)return
smp++}else{t=Math.max(X.U8(G+1),X.U8(G+5),X.U8(G+10),X.U8(G+19))
t&&t>=synwf&&(synwf=t+1)}for(ptn=0,G=958,ord=X.U8(956),e=0;e<ord<<2;e++,G+=2)ptn<X.U8(G)&&(ptn=X.U8(G))
return ptn++,K=1984+(synwf<<6)+(ptn<<8)+s,1}})()&&(sName="Krister Wombell's ChipTracker module (.KRIS,.MOD)",bDetected=1,X.isVerbose())&&(sOption(X.SA(0,16)),sOptionT(addEllipsis(smps.join(" "),200),'smp/msg:"','"'),sOption("ord:"+(loop&&loop<127?loop+"-":"")+ord+" ptn:"+ptn+" smp:"+smp+(synwf?" synwf:"+synwf:"")+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'MTN'000000",1464))tracker="MnemoTroN's SoundTracker"
else{if(!X.c("'IT10'00",1464))return
tracker="Icepic's IceTracker 1.0~2'"}for(smp=smpsz=0,smps=[],G=20;G<950;G+=30)""!=(E=decAnsi(G,22,CPAmiga).trim())&&smps.push(E),(A=X.U16(G+22,_BE))&&smp++,smpsz+=A
if(ord=X.U8(G++),ptn=X.U8(G++),!(128<ord)){for(Y=0;Y<512;Y++)if(X.U8(G++)>ptn)return
return K=1468+64*ptn*4+smpsz,1}})()&&(sName=tracker+" module (.ST26,.ICE)",sVersion="v2.6",bDetected=1,X.isVerbose())&&(sOptionT(decAnsi(0,20,CPAmiga)),sOptionT(addEllipsis(smps.join(" "),128),'smps/msg:"','"'),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+K)),!bDetected&&(function(){if(X.c("'MVM'00")&&X.U8(4)&&X.U8(5)&&!(1e4<X.U32(6))&&X.U8(10)){var s=[],e=[],t=[]
for(G=10,mach=X.U8(G++),Y=0;Y<mach;Y++)s.push(X.U8(G++))
for(Y=0;Y<mach;Y++){if(E=X.U8(G++),0<=e.indexOf(E))return
e.push(E),t.push(Y)}var r=X.U8(G++)
for(Y=0;Y<r;Y++){var i=X.U8(G++),n=X.U8(G++)
if(G++,i>mach||n>mach||i==n)return
t=t.filter(function(){return t.indexOf(i)<0&&t.indexOf(n)<0})}return t.length?void 0:1}})()&&(sName="Gargaj/Conspiracy's MVX Module (.MVM)",bDetected=1,X.isVerbose())&&sOption("bpm0:"+X.U8(4)+" ticks:"+X.U8(5)+" rows:"+X.U32(6)+" machines:"+mach),!bDetected&&(function(){if(/MED[\x02-\x04]/.test(X.SA(0,4))){switch(nV=X.U8(3)){case 2:sVersion="v1.12"
break
case 3:sVersion="v2.00"
break
case 4:sVersion="v2.10+"}if(k=1,G=K=ptn=ord=trk=midi=syhy=smp=realsmp=0,smps=[],cs=bad="",!(nV<3)){var s=X.U8(4)
for(G=5;s;){if(1&s)for(var e=X.U8(G++);e;)smp+=1&e,e>>=1
s>>=1}for(Y=0;Y<smp;Y++){if(fl=X.U8(G++),smpnl=X.U8(G++),smps.push(X.SA(G,smpnl)),G+=smpnl,1&fl||(G+=2),2&fl||(G+=2),4&fl||G++,8&fl||G++,64<(T=48&fl?T:X.U8(G++)))return
64&fl||G++}for(Y=62;0<=Y;Y--)if(smps[Y]&&smps[Y].length){realsmp=Y+1
break}if(ptn=X.U16(G,_BE),!(ord=X.U16(G+2,_BE))||256<ord)return
for(G+=4,Y=0;Y<ord;Y++)if(X.U8(G++)>ptn)return
for(extsmp=!(8&X.U8(G+3)),tmp0=X.U16(G,_BE)+"//"+X.U16(G+4,_BE),G+=26,Y=0;Y<16;Y++)if(64<X.U8(G++))return
if(64<(mvol=X.U8(G++)))return
if(G>X.Sz())return
function t(){var s=X.U32(G,_BE)
G+=4
for(var e=0;e<32;e++)2147483648&(s=s<0?-s:s)&&(midi++,G++),s<<=1}for(3===nV&&(t(),t()),Y=0;Y<ptn;Y++){var r=X.U8(G++),i=X.U8(G),n=(trk<i&&(trk=i),X.U8(G+1),X.U16(G+2,_BE))
G+=r+n}if(!extsmp){var a=new BitReader(G,_BE),o=0
for(a.read(1),Y=0;Y<realsmp;Y++)o+=a.read(1)
for(a=void 0,G+=8,Y=0;Y<o;Y++)n=X.U32(G,_BE),hktp=X.U16(G+4,_BE),G+=6,65535!=hktp&&65534!=hktp||syhy++,G+=n}if(X.c("'MEDV'",G))for(;G+8<=X.Sz()&&/[A-Z]{4}/.test(X.SA(G,4));){switch(hkhd=X.SA(G,4),n=X.U32(G+4,_BE),G+=8,hkhd){case"MEDV":sVersion="v"+X.U8(G+2)+"."+X.U8(G+3).padStart(2,"0")
break
case"ANNO":cs=X.SC(G,n,"CP1252")
break
case"HLDC":break
default:_log("Unknown MED header: "+hkhd)}G+=n}}return(K=G)>X.Sz()&&(bad="!short"),1}})()&&(sName="OctaMED module (.MED)",bDetected=1,""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose())){for(sOptionT(cs);""==smps[smps.length];)delete smps[smps.length]
smps.length&&sOption("["+smps.join(",")+"]","smps:"),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+(realsmp!=smp?"("+realsmp+")":"")+(extsmp?"(ext.)":"")+(syhy?" synth+hybrid:"+syhy:"")+(midi?" midi:"+midi:"")+" trk:"+trk+" tmp0:"+tmp0+" mvol:"+mvol+" sz:"+outSz(K))}if(!bDetected&&(function(){if(X.c("'MMD'")&&!((nV=X.U8(3)-48)<0||3<nV)){switch(nV){case 0:C="MED module (.MED,.MMD0)",sversion="v2.1 Med MoDule 0"
break
case 1:C="OctaMED Professional module (.MED,.MMD1)",sversion="v.3.00-4.x"
break
case 2:C="OctaMED Professional module (.MED,.MMD2)",sversion="v5.x"
break
case 3:C="OctaMED Professional module (.MED,.MMD3)",sversion="v6.x?"}if(!((ptnsp=X.U32(16,_BE))<52||(smpsp=X.U32(24,_BE))&&smpsp<52||(expp=X.U32(32,_BE))>X.Sz()||(sec=G=0,(sngp=X.U32(G+8,_BE))<52)||4294966535<sngp||X.Sz()<Math.max(sngp+504+256,ptnsp,smpsp||52,expp+52))){songname=anno=iinfo="",ch=4,xsngs=X.U8(51),k=expp?xsngs+1:1,expp&&((psongname=X.U32(expp+44,_BE))&&(songnamelen=X.U32(expp+48,_BE))&&(songname=X.SC(psongname,songnamelen,"CP1252")),0<(pannotxt=X.U32(expp+12,_BE))&&(annolen=X.U32(expp+16,_BE),anno=X.SC(pannotxt,annolen,"CP1252")),0<(pMMDInstrInfo=X.U32(expp+20,_BE)))&&(iinfo=X.SC(expp,40,"CP1252")),ptn=0,ord=[]
var s=X.U32(16,_BE)
for(Y=0;Y<k;Y++){for(G=sngp+504,32767<(ptn1=X.U16(G,_BE))&&(ch=4),ptn+=ptn1,l=0;l<ptn1;l++)(pj=4*l+s)>X.Sz()||(pj=X.U32(pj,_BE))>X.Sz()||(pj=nV<1?X.U8(pj+4):X.U16(pj+4,_BE))>ch&&(ch=pj)
if(nV<2){if(ord[0]=X.U16(G+2,_BE),256<ord[0])return}else{if(sec=X.U16(G+2,_BE),!(trk=X.U16(G+16,_BE))||64<trk)return
if((sectp=X.U32(G+8,_BE))+2*sec>X.Sz())continue
for(playseqtp=X.U32(G+4,_BE),nplayseq=X.U16(G+18,_BE),secs=[],l=0;l<sec;l++)secs.push(X.U16(sectp+2*l,_BE))
for(l=0;l<secs.length;l++)l<=nplayseq&&ord.push(X.U16(X.U32(playseqtp,_BE)+40,_BE))}if((expp=X.U32(sngp+32,_BE))&&(X.U32(expp,_BE)<sngp||expp>X.Sz())){k=Y+1
break}sngp=X.U32(expp,_BE)}return 63<(smp=X.U8(G+283))?void 0:1}}})()&&(sName=C,sVersion=sversion,bDetected=1,X.isVerbose())&&("<unnamed>"!=songname&&"<ohne Namen>"!=songname&&sOption(songname),sOptionT(anno),sOptionT(iinfo,"ins0:"),1<k&&sOption(k,"×"),sOption((X.isDeepScan()?"ch:"+ch+" ":"")+"ord:"+ord.join("+")+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(X.U32(4,_BE)))),!bDetected&&(function(){if(!(X.Sz()<30)){if(X.c("'THX'0."))fmt="ahx"
else{if(!X.c("'HVL'0."))return
fmt="hvl"}bad=0
var s=X.U8(6)
switch(trk0saved=s>>7,s>>4&7){case 0:spd="50Hz"
break
case 1:spd="100Hz"
break
case 2:spd="150Hz"
break
case 3:spd="200Hz"
break
default:bad++,spd="?Hz"}if(999<(ord=4095&X.U16(6,_BE))&&bad++,(!ord||1024<ord)&&bad++,"ahx"===fmt?(lp=X.U16(8,_BE))>=ord&&bad++:chn=4+(X.U8(8)>>2),!(1<bad)&&(trl=X.U8(10))&&!(64<trl)&&(trk=X.U8(11),!(63<(ins=X.U8(12))))){if(sub=X.U8(13),"ahx"===fmt)for(K=14+2*sub+8*ord+trk*trl*3,trk0saved||(K+=3*trl),Y=0;Y<ins;Y++){var e=X.U8(K+21)
K+=22+4*e}else{for(K=16+2*sub+ord*chn*2,Y=trk0saved?1:0;Y<=trk;Y++)for(l=0;l<trl;l++)63==X.U8(K)?K++:K+=5
for(Y=0;Y<ins;Y++){e=X.U8(K+21)
K+=22+5*e}}for(F="",Y=0;Y<=ins;Y++){for(var t=K;X.U8(K)&&K<X.Sz();)K++
Y||(F=X.SA(t,K-t)),K++}return K>X.Sz()&&bad++,1}}})()&&("ahx"===fmt?(sName="Abyss' Highest eXperience module (.AHX)",sVersion=X.U8(3)?"v2.0+":"v1.00~1.27"):sName="Hively Tracker module (.HVL)",bDetected=1,bad&&(sVersion+="/malformed"+bad),X.isVerbose())){for(""!=F&&sOption(F),sub&&sOption(sub,"×"),n=0,G=14+2*sub+8*ord,_=trk*trl,trk0saved||(_+=trl),hp=!1,Y=0;Y<_;Y++)(note=X.U8(G+3*Y)>>2)&&n++,60<note&&"ahx"==fmt&&(hp=!0)
hp&&(sVersion+="/hi-pitch!"),"ahx"===fmt?sOption("spd:"+spd+" ord:"+ord+" lp:"+lp+" trk:"+trk+" ins:"+ins+" notes:"+n+" sz:"+outSz(K)):sOption("ch:"+chn+" spd:"+spd+" ord:"+ord+" trk:"+trk+" ins:"+ins+" notes:"+n+" sz:"+outSz(K))}if(!bDetected&&(function(){if(!(X.Sz()<960)&&X.c("000003C0",8)){ins=0,smp=[]
var s=olds=0
for(G=0;G<434;G+=14){if(64<X.U8(G+3)||(A=X.U16(G,_BE))<X.U16(G+4,_BE))return
if(!isWithin(sofs=X.U32(G+8,_BE),960,X.Sz())||sofs%2)return
if(s+=A<<1,X.U16(G,_BE)&&ins++,smp.includes(sofs)||smp.push(sofs),G&&2<Math.abs(sofs-olds))return
olds=sofs+(A<<1)}if(smp=smp.length,isWithin(s,3,2031585)){var e=0,t=4294967295
for(ptn=[],G=448;G<960;G+=4){if((E=X.U32(G,_BE))+2<s+960||E>X.Sz())return
e=Math.max(e,E),t=Math.min(t,E),ptn.includes(E)||ptn.push(E)}if(!(t%2||2<Math.abs(960+s-t))){for(ord=127,G=952;448<G&&X.U32(G,_BE)==E;G-=4,ord--)E=X.U32(G,_BE)
for(ptn=ptn.length,G=e,Y=0;Y<256;Y++)192<=X.U8(G)?(Y+=254-X.U8(G+1),G+=2):G+=4
return K=G,1}}}})()&&(sName="Azatoth/Phenomena's Pha Packer module (.PHA)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&zs()&&(sName=tracker+" (."+ext+")",bDetected=1,X.isVerbose())&&(sOptionT(X.SC(0,20,"CP437")),sOptionT(addEllipsis(smpn.filter(funSampleName).join(" ")),'smp/msg: "','"'),sVersion="STM"===ext?"v"+X.U8(30)+"."+nVm:"v1."+fmt,tmp0=X.U8(32),gvol=X.U8(34),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" gvol:"+gvol+" sz:"+outSz(K))),!bDetected&&Es()&&(sName="it"===type?"Impulse Tracker module (.IT)":"OpenMPT module (.MPTM)",bDetected=1,"?"!=sV&&(sVersion="v."+sV),""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose())&&(sOptionT(decAnsi(4,26,charset)),X.isDeepScan()&&(sOption(tracker,"in: "),sOptionT(auth,"by: "),sOption(addEllipsis(extsmp.join(", "),64,48),'ext.smp: "','"'),sOption(addEllipsis(chnm.join(", "),80,48),'ch.names: "','"')),1&special&&sOptionT(addEllipsis(X.SC(msgofs,Math.min(msglen,256),"CP437"),192),'msg: "','"'),sOption(addEllipsis(insnlst.filter(funSampleName).join(" "),128,48),'ins/msg: "','"'),sOption(addEllipsis(smpnlst.filter(funSampleName).join(" "),128,48),'smp/msg: "','"'),X.isDeepScan()?sOption("bpm0:"+tmp0+" spd0:"+spd0+" ch:"+ch+" ord:"+ord+(ord!=cord?"("+cord+")":"")+" ptn:"+ptn+" ins:"+ins+" smp:"+smp+(tunings?"tunings:"+tunings:"")+" sz:"+outSz(K)):sOption("bpm0:"+tmp0+" spd0:"+spd0+" ch:"+ch+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp:"+smp)),!bDetected&&(function(){if(X.c("'RIFF'........'AM  '"))align=1
else{if(!X.c("'RIFF'........'AMFF'"))return
align=0}if(X.c("C5",88)){for(K=X.U32(4,_LE)+8,G=12,ok=ord=ptn=smp=ins=0,mptn=-1,insts=[],E="";G<K&&G<X.Sz();){switch(hkhd=decAnsi(G,4,"CP437",!1),hksz=X.U32(G+4,_LE),G+=8,hkhd){case"INIT":case"MAIN":ok=1
break
case"ORDR":for(ord=hksz,loop=X.U8(G),Y=G+1;Y<G+hksz;Y++)mptn<X.U8(Y)&&(mptn=X.U8(Y))
mptn++
break
case"PATT":ptn++
break
case"RIFF":smp++
break
case"INST":for(ins++,E=X.readBytes(G+2,25,!0),""!=(E=decEncoding(E,"CP437").trim())&&insts.push(E.trim()),insn=X.U8(G+1),subsmp=X.U16(G+30,_LE),q=G+225;q<G+hksz;)hhd=decAnsi(q,4,CP437),hsz=X.U32(q+4),q+=8,"SAMP"==hhd&&smp++,t_=decAnsi(q,256,CP437),q+=hsz,0<debug&&q<G+hksz&&["SAMP","INST"].indexOf(decAnsi(q,4,"CP437"))<0&&_log(" | ^WTF J2B @"+Hex(q-hsz)+"->"+Hex(q))}G+=hksz+align*(1&hksz)}return!(K<G)&&ok&&ord&&ptn&&(smp||ins)?1:void 0}})()&&(sName="Jazz Jackrabbit 2/Galaxy Sound System module (.J2B)",sVersion="v."+(align?"__":"FF"),bDetected=1,X.isVerbose())&&(sOptionT(X.SA(20,64)),sOptionT(addEllipsis(insts.join("\n"),256,160),'msg:"','"'),sOption("ord:"+ord+" loop:"+loop+" ptn:"+mptn+(mptn!=ptn?"/"+ptn:"")+(ins?" ins:"+ins:"")+(smp?" smp:"+smp:"")+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("00407F40 00C081C0")&&X.c("41FAFFEE",56)){G=180
for(var s=Math.min(65536,X.Sz());E=X.U16(G,_BE),(G+=2)<s&&20085!=E;);if(!(s<G)){for(playp=G;E=X.U16(G,_BE),(G+=2)<s&&57340!=E;);if(!(s<G)){for(endp=G+=4;E=X.U16(G,_BE),(G+=2)<s&&20085!=E;);if(!(s<G)){for(;E=X.U16(G,_BE),(G+=2)<s&&32258!=E;);if(!(s<G)){for(songp=G+X.U16(G+2,_BE)+2,d0=X.U32(songp,_BE)>>2,k=d0/3,a1=G=songp,d5=0;d0--;)for(G=songp+X.U32(a1,_BE),a1+=4;G<s&&(E=X.U32(G,_BE),G+=4,E);)E>d5&&(d5=E)
for(K=songp+d5;135!=(E=X.U8(K++)););return 1}}}}}})()&&(sName="Rob Hubbard ST module (.RHO)",sVersion="v1.1",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption(outSz(K),"sz:")),!bDetected&&(function(){if(!(X.Sz()<9||(ptntp=X.U16(2,_LE),ord=X.U8(8),ptntp-ord!=9&&ptntp-ord!=72)||(smptp=X.U16(4,_LE))>X.Sz()||(orntp=X.U16(6,_LE))>X.Sz()||64!=X.U16(smptp,_LE)||64!=X.U16(orntp,_LE))){for(ptn=0,Y=0;Y<ord;Y++)G=X.U8(9+Y),ptn<G&&(ptn=G)
if(ptn++,X.U16(ptntp,_LE)==6*ptn){for(l=X.U16(orntp+64-2,_LE)+orntp;l<X.Sz()&&l<65535&&!(64&X.U8(l));)l+=2
if(bad="",65534<l||l>=X.Sz()){if(!X.isHeuristicScan())return
bad="/malformed!short"}return K=l+2,delay=X.U8(0),loop=X.U8(1),1}}})()&&(sName="A.'Andrew Strikes Code' Sendetskii/Power of Sound's ASC/Advanced Sound Master module (.ASC)",sVersion="v1.x-2.x"+bad,bDetected=1,X.isVerbose())&&(8<(pt=X.fSig(8,128,"'ASM COMPILATION OF '")+19)&&(pa=X.fSig(pt+19,32,"' BY '"),sOptionT(X.SA(pt,pa-pt)),sOptionT(X.SA(pa+4,20),"by: ")),sOption("ord:"+ord+" ptn:"+ptn+" delay:"+delay+" loop:"+loop+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<8||(ptntp=X.U16(1,_LE),ord=X.U8(7),ptntp-ord!=8&&ptntp-ord!=71)||(smptp=X.U16(3,_LE))>X.Sz()||(orntp=X.U16(5,_LE))>X.Sz()||64!=X.U16(smptp,_LE)||64!=X.U16(orntp,_LE))){for(ptn=0,Y=0;Y<ord;Y++)G=X.U8(8+Y),ptn<G&&(ptn=G)
if(ptn++,X.U16(ptntp,_LE)==6*ptn){for(l=X.U16(orntp+64-2,_LE)+orntp;l<X.Sz()&&l<65535&&!(64&X.U8(l));)l+=2
if(bad="",65534<l||l>=X.Sz()){if(!X.isHeuristicScan())return
bad="/malformed!short"}return K=l+2,delay=X.U8(0),1}}})()&&(bDetected=1,sVersion="v0.x"+bad,sName="Andrei 'Andrew Strikes Code' Sendetskii/Titus's Advanced Sound Master module (.AS0)",X.isVerbose())&&(7<(pt=X.fSig(7,128,"'ASM COMPILATION OF '")+19)&&(pa=X.fSig(pt+19,32,"' BY '"),sOptionT(X.SA(pt,pa-pt)),sOptionT(X.SA(pa+4,18),"by: ")),sOption("ord:"+ord+" ptn:"+ptn+" delay:"+delay+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<296)){G=41
var s,e=X.U16(5),t=X.U16(G-2)-e
for(Y=0;Y<14;Y++){if((s=X.U16(G)-e)-t<6||(s-t-2)%4||s>X.Sz())return
G+=2,t=s}for(t=X.U16(G)-e,G+=2,Y=0;Y<15;Y++){if((s=X.U16(G)-e)-t<3||s>X.Sz()||s-t!=2+X.U8(t+1))return
G+=2,t=s}for(K=s+2+X.U8(s+1),t=X.U16(G)-e,G+=2,Y=1;Y<96;Y++){if((s=X.U16(G)-e)-t<3||s>X.Sz())return
G+=2,t=s}if(ord=X.U8(G++),!((lp=X.U8(G++))>ord)){for(Y=0;Y<ord;Y++)if(X.U8(G++)%6)return
return X.U16(101)==G?1:void 0}}})()&&(sName="Doctor Max/Global Corp.'s' Global Tracker module (.GTR)",bDetected=1,sVersion="v"+(X.U8(4)>>4)+"."+(15&X.U8(4)),X.isVerbose())&&(dly=X.U8(0),ptn=X.U8(293),lp=X.U8(294),sOptionT(X.SA(7,32)),sOption("ord:"+(0<lp?lp+"-":"")+ord+" ptn:"+ptn+" delay:"+dly+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<512)){if(old=!1,bad="",!/V\.\d/.test(X.SA(26,3))){if(!X.c("'BPSM'",26))return
old=!0}if(!(525+16*(ord=X.U16(30,_BE))>X.Sz())){for(B=smp=0,Y=0;Y<15;Y++)if(255!=X.U8(32+32*Y)){if(sn=X.readBytes(32+32*Y,24),charStat(sn,CS_ALL).indexOf("xsc")<0)return
if(slen=X.U16(56+32*Y,_BE)<<1,lp=X.U16(58+32*Y,_BE),lpl=X.U16(58+32*Y,_BE),T=X.U16(62+32*Y,_BE),lpl>slen||lp-1>slen||lpl-1>slen)return
if(96<T)return
64<T&&(bad=bad.addIfNone("!badvol")),B+=slen,slen&&smp++}for(K=512+B+16*ord,old||(K+=64*X.U8(29)),ptn=0,Y=0;Y<16*ord;Y+=4)(G=X.U16(512+Y,_BE))>ptn&&(ptn=G)
return K+=48*ptn,1}}})()&&(bDetected=1,sName="Brian Postma's SoundMon module (.BP)",sVersion=old?"old":"v"+X.SA(28,1),""!=(bad=X.Sz()<K?bad.addIfNone("!short"):bad)&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOptionT(X.SA(0,26)),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<192)&&X.c("'SONG'",192)&&X.c("'INST'",200+X.U32(196,_BE))&&!((B=X.U32(10,_BE))<=2||1048560<=B)){for(smpdescs=0,smp=0,Y=0;Y<16;Y++){if((A=X.U16(14+2*Y,_BE))&&smp++,lpst=X.U16(78+2*Y,_BE),A<lpst)return
if(64<X.U8(46+2*Y))return
smpdescs+=A}if(!(smpdescs<=2||smpdescs>B)&&(ord=X.U8(111))&&!(40<ord)){for(ptn=0,Y=0;Y<40;Y++){if(40<(pt=X.U8(113+2*Y)))return
pt>ptn&&(ptn=pt)}return ptn++,(U=1024*ptn)+204>X.Sz()?void 0:(K=smpdescs+U+204,1)}}})()&&(sName="Andreas Fuchs's FuchsTracker module (.FUCHS)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&(function(){if(!(X.Sz()<444)&&X.c("000000",240)){for(smps=[],U=G=l=B=0;U<15;U++,G+=16){if(8388607<(o=X.U32(G,_BE))||1&o)return
if(65535<(j=X.U16(G+4,_BE)<<1))return
if(X.U8(G+6))return
if(64<X.U8(G+7))return
if(8388607<(p=X.U32(G+8,_BE))||1&p)return
if(2<(n=X.U16(G+12,_BE))&&n>j)return
if(1&X.U16(G+14,_BE))return
B+=j,j&&smps.push([o,j])}if(!(B<=4)){for(smps.sort(function(s,e){return s[0]-e[0]}),U=0;U<smps.length-1;U++)if(smps[U][0]+smps[U][1]>smps[U+1][0])return
if(ord=X.U8(243),isWithin(ord,1,100)){for(ptn=0,ords=[],Y=0;Y<100;Y++){if(1023&(G=X.U16(244+2*Y,_BE)))return
Y<ord&&(G>>=10)>ptn&&63!=G&&(ptn=G)}if(!(64<++ptn||(m=notes=badnotes=badled=0,end=!1,nps=[],(G=444)+1024*ptn>Math.min(X.Sz(),65532)))){for(Y=0;Y<ptn&&!end;Y++){for(badnotes=badled=0,l=0;l<256&&!end;l++,G+=4){if(d=X.readBytes(G,4),(np=(d[0]<<8)+d[1])&&65534!=np&&(isWithin(np,113,856)?(notes++,nps.includes(np)||nps.push(np),100<notes&&!X.isDeepScan()&&(end=!0)):badnotes++),d[2]&=15,3==d[2]&&64<d[3]&&badnotes++,4==d[2]&&99<d[3])return
if(5==d[2]&&d[3]>ord+1)return}if(16<badnotes)return 0<debug&&_log("GMCFault: over 16 bad notes"),0}return nps=nps.length,notes?(!(nps<=2)||X.isHeuristicScan())&&(K=444+1024*ptn+B,1):void 0}}}}})()&&(bDetected=1,sName="Andreas Tadic's Game Music Creator module (.GMC)",X.isVerbose())&&(sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smps.length+(X.isDeepScan()||notes<100?" notes:"+notes+"("+nps+" diff.)":"")+" sz:"+outSz(K)),X.Sz()<K)&&(sVersion="malformed!short"),!bDetected&&(function(){if(!(X.Sz()<377||(ord=X.U8(0),ofs=unpsz=0,220<ord&&ord<255))){for(255==ord?(ofs=1,ord=200):ord++,Y=0;Y<32;Y++)if(22<X.U8(163+ofs+Y))return
if(tmp0=X.U8(ofs+205)){for(G=ofs+376+ord,ptn=-1,Y=ofs+376;Y<G;Y++)(E=X.U8(Y))>ptn&&(ptn=E)
if(!(ptn<1||(ptnp=G+ofs,(ptn1=oldp=X.U16(ptnp))>X.Sz()))){for(Y=0;G<X.Sz()&&Y<ptn;Y++){if(G=X.U16(ptnp+2*Y),Y||(unpsz=G),G<ptnp+2*Y||G>X.Sz())return
if(Y&&256<G-oldp)return
oldp=G}if(ofs)G=ptn1
else if(G=ptnp+2*Y,unpsz!=G||G>X.Sz())return
for(;G<X.Sz()&&(_=X.U8(G++));)_<=242?unpsz++:unpsz+=_-242
return isWithin(G,376,15808)?(K=G,1):void 0}}}})()&&(sName="Remco Schrijvers et al.'s MSX MoonBlaster for MoonSound module (.MBM)",bDetected=1,ofs&&(sVersion="200-pos.ver."),"NONE"!=(drumkit=X.SA(ofs+320,8).trim())&&(sVersion=sVersion.appendS("+"+drumkit+".MBK","/")),X.isVerbose())&&(sOption(X.SA(ofs+207,40).trim()),sOption("tempo0:"+tmp0+" ord:"+ord+" ptn:"+ptn+" unpsz:"+unpsz+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<102)&&(tempo=X.U8(0),isWithin(tempo,2,15))&&!((ptntp=X.U16(67))>=X.Sz())){for(numofpos=X.U8(1),loop=X.U8(2),j1=65535,Y=l=0;Y<16;Y++){if((Q=X.U16(3+2*Y))>X.Sz())return
if(l<Q&&(l=Q),(op=X.U16(35+2*Y))>X.Sz())return
op&&j1>op&&(j1=op)}if(!(j1<103||l<103||65534<l||l>X.Sz()||l+3*X.U8(l)+2!=j1)){for(Y=l=0;Y<16;Y++){if((op=X.U16(35+2*Y,_LE))>X.Sz())return
l<op&&(l=op)}if(!(l<103||65536<(len=l+64)||len>X.Sz()+1)){for(l=99;l<=ptntp&&X.U8(l)<255;)l++
return l+1==ptntp?(ord=l-99,!(loop>ord)):void 0}}}})()&&(sName="Golden Disk ProTracker module (.PT1)",sVersion="v1.x/compiled",bDetected=1,X.isVerbose())&&(sOptionT(X.SA(69,30)),sOption("tempo:"+tempo+" ord:"+ord+" len:"+len)),!bDetected&&(function(){if(!(X.Sz()<132)&&(tmp=X.U8(0),isWithin(tmp,2,15))){var s=X.Sz()+512*X.isHeuristicScan()
if(ord=X.U8(1),lp=X.U8(2),!(!ord||lp>ord||131+ord>s-2)&&(smp0=X.U16(3),!((orn0=X.U16(67))-smp0>s+2||orn0<smp0))&&(ptnp=X.U16(99),isWithin(ptnp,101,orn0))){for(smp=orn=0,Y=mps=0,G=3;Y<32;Y++,G+=2)if((E=X.U16(G))>mps&&(mps=E),E&&(smp++,!isWithin(E,101,s-2)))return
for(mp=0;Y<48;Y++,G+=2)if((E=X.U16(G))>mp&&(mp=E),E&&++orn<=2&&!isWithin(E,Math.max(mps,orn0),s))return
for(G=131,ptn=Y=0;Y<=255;Y++,G++){if(G>X.Sz()-2)return
if(255==(o=X.U8(G)))break
o>ptn&&(ptn=o)}if(ptn++,G++,ord==Y&&ptnp==G){for(rptn=0;G<X.Sz()&&(E=X.U16(G));rptn++,G+=2)if(!isWithin(E,ptnp+6*ptn,X.Sz()))return
return rptn==3*ptn?(K=mp+2+X.U8(mp),1):void 0}}}})()&&(sName="Golden Disk ProTracker module (.PT2)",sVersion="v2.x",bDetected=1,X.isVerbose())&&(0<=(nc=charStat(E=X.readBytes(101,30),1)).indexOf("allxsc")?sOptionT(decEncoding(E,CPSpeccy)):sOption("<broken title>"),sOption("tmp:"+tmp+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" smp:"+smp+" orn:"+orn+" sz:"+outSz(K))),!bDetected&&ks(0)&&(sName="Golden Disk ProTracker module (.PT3)",sVersion=sv,bDetected=1,tsmode=5<=nv&&(32!=X.U8(98)||X.c("'Vortex Tra'",K)||X.c("'ProTracker 3'",K)),X.isVerbose()&&(info1="tmp0:"+tmp0+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+(rptn!=ptn?rptn+"/":"")+ptn+" smp:"+(rsmp!=smp?smp+"/":"")+rsmp+" orn:"+(rorn!=orn?rorn+"/":"")+orn+" notes:"+notes),sz1=K,ord1=ord,tmp1=tmp0,(tsmode=!tsmode||ks(K)&&ord1==ord&&tmp1==tmp0?tsmode:!1)&&(E=X.fSig(K,512,"'02TS'"))>K&&X.SA(E-6,4)===X.SA(E-12,4)&&(sz1==X.U16(E-8,_LE)?(sVersion+="[TurboSound:"+X.SA(E-6,4)+"]",K=E+4):7<=nv?sVersion+="/TurboSound":bad=bad.addIfNone("badTSver")),bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())){switch(X.c("'by ",63)&&(sOptionT(decAnsi(30,32,CPSpeccy)),sOptionT(decAnsi(66,32,CPSpeccy),"by: ")),sOptionT(tracker,"in: "),ttn){case 0:sOption("tuning 0: 1625000Hz PT3.3")
break
case 1:sOption("tuning 1: Sound Tracker")
break
case 2:sOption("tuning 2: ASM/PSC 1.75MHz")
break
case 3:sOption("tuning 3: RS 1625000Hz")
break
case 4:sOption("tuning 4: Ivan Roshchin's Natural Cmaj/Am")
break
default:sOption("tuning "+ttn+"/custom")}sOption((tsmode?"chip#1: ":"")+info1),tsmode&&sOption("chip#2: ptn:"+(rptn!=ptn?rptn+"/":"")+ptn+" smp:"+(rsmp!=smp?smp+"/":"")+rsmp+" orn:"+(rorn!=orn?rorn+"/":"")+orn+" notes:"+notes),sOption(outSz(K),"sz:")}if(bDetected||!Fs(1)&&!Fs(0)||(sName="Viktor 'KVA' Kuźmin's Pro Sound Creator module (.PSC)",sVersion=sv+"/compiled",bDetected=1,X.isVerbose()&&(ftitle&&sOptionT(decAnsi(25,20,CPSpeccy,!1,Chars0to1FSpeccy)),fby&&sOptionT(decAnsi(49,20,CPSpeccy,!1,Chars0to1FSpeccy),"by: "),sOption("ord:"+(0<lp?"("+lp+"-)":"")+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)))),!bDetected&&(function(){if(!(X.Sz()<215)){var s=Math.min(65536,X.Sz())
switch(X.U8(50)){case 59:notet=0
break
case 1:notet=1
case 2:notet=2
default:return}if(!((ptnp=X.U16(75))>=X.Sz()||X.U16(146)<=X.U16(82))){for(G=212,ptn=0;G<468&&G<X.Sz()&&X.U8(G)<128;G+=2,ord++)ptn=Math.max(ptn,X.U8(G)+1)
if(lp=X.U8(70),!(468<=G||lp>ord)){var e=X.U16(ptnp)-(6*ptn+ptnp+2)
if(!(e<0||X.U16(82)-e>=X.Sz()||ptnp>=X.U16(82)-e||X.U16(146)-e>=X.Sz())){var t=65535,r=0,i=0
for(G=82;G<146;G+=2)i=Math.max(i,X.U16(G))
for(;G<212;G+=2)t=Math.min(t,X.U16(G)),r=Math.max(r,X.U16(G))
return i-e>=Math.min(65534,X.Sz())||s<=t-e||s<=r-e||i<=ptnp||i+3+5*(X.U8(i-e+2)+1)!=t?void 0:!((K=i+3+2*(X.U8(i-e+2)+1)-e)<ptnp)}}}}})()&&(sName="S.'Orion' Matveev & A.'Sand' Plużnikov's Fast Tracker module (.FTС)",bDetected=1,X.isVerbose())&&(sOptionT(X.SA(8,42)),sOption("ord:"+(0<lp?"("+lp+"-)":"")+ord+" ptn:"+ptn+(ofs?" ofs:"+Hex(ofs):"")+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<3585)){for(G=smp=0;smp<15;smp++){for(Y=0;Y<32;Y++)if(15<X.U8(G++))return
for(Y=0;Y<32;Y++)if(32&X.U8(G++))return
for(Y=0;Y<32;Y++)if(G++,31<X.U8(G++))return
for(Y=0;Y<2;Y++)if(31<X.U8(G++))return}for(Y=0;Y<256;Y++){if(!isWithin(X.U8(G),1,32))return
G+=2}return 128&X.U8(G++)?void 0:(G+=544,dly=X.U8(G++),isWithin(dly,1,15)&&(pts=X.U8(G),!!isWithin(pts,1,64)))}})()&&(sName="Stanislav 'KSA' Kuzin's Sound Tracker Pro module (.STF,.F)",sVersion="uncompiled/packed",bDetected=1,X.isVerbose())&&sOption("dly:"+dly+" pts:"+pts),!bDetected&&(function(){if(tmp=X.U8(0),isWithin(tmp,1,50)){var s=X.Sz()-2,e=X.U16(1,_LE)
if(ord=X.U8(e),lp=X.U8(e+1),isWithin(e,10,s)&&!(lp>ord)&&ord){var t=X.U16(3,_LE)
if(isWithin(t,e+2+2*ord,s)){var r=X.U16(5,_LE)
if(isWithin(r,10,s)){var i=X.U16(7,_LE)
if(isWithin(i,10,s)&&!((K=i+30)>X.Sz())){var n=[],a=[]
for(Y=0;Y<ord;Y++){if(X.U8(e+2+2*Y)%6||!isWithin(E=X.U16(t+2*Y,_LE),10,s))return
n.indexOf(E)<0&&n.push(E)}for(Y=0;Y<15;Y++){if(!isWithin(E=X.U16(i+2*Y),10,s))return
a.indexOf(E)<0&&a.push(E)}return ptn=n.length,smp=a.length,ptn?1:void 0}}}}}})()&&(sName="Stanislav 'KSA' Kuzin's Sound Tracker Pro module (.STP)",sVersion="compiled",bDetected=1,X.isVerbose())&&(X.c("'KSA SOFTWARE COMPILATION OF '",10)&&sOptionT(X.SC(38,25,"CP1251")),sOption("tmp:"+tmp+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<17)&&(K=X.U16(0),!(X.Sz()<K))&&!((smptp=X.U16(2))<10)&&(orntp=X.U16(4),ptntp=X.U16(6),postp=X.U16(8),lpp=X.U16(10),!(orntp<=smptp+1))&&!(ptntp<orntp)&&!(postp<=ptntp)&&!(lpp<postp)&&(membase=smptp-10,!(lpp-membase>=K))&&(Y=postp-membase,b=X.U8(Y))){for(ord=0,ptn=0;b;){if(K<=Y+7)return
ord++,ptn<(E=127&b)&&(ptn=E),Y+=2,b=X.U8(Y),ptn<(E=127&b)&&(ptn=E),Y+=2,b=X.U8(Y),ptn<(E=127&b)&&(ptn=E),Y+=3,b=X.U8(Y)}if(ptn++,(G=X.U16(smptp-membase+2))-ptntp==2*ptn&&(G=12,(len=Y+7)==K)){for(E=X.U16(12),Y=1;Y<=orntp-smptp>>1;Y++){if(G+=2,(j3=X.U16(G))-E!=98&&(1337!=K||10!=ord||11!=ptn))return
E=j3}for(Y=1;Y<=ptntp-orntp>>1;Y++){if(G+=2,(j3=X.U16(G))-E!=34)return
E=j3}return 1}}})()&&(sName="Jiří 'George' Koudelka's Scalex Qjeta Tracker module (.SQT)",sVersion="compiled",bDetected=1,sOption("ord:"+ord+" ptn:"+ptn+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<6||0==(tempo=X.U8(0))||32<tempo||(postp=X.U16(1,_LE))<126||postp>X.Sz()||(orntp=X.U16(3,_LE))<126||orntp>X.Sz()||(ptntp=X.U16(5,_LE))<126||ptntp>X.Sz()||(ord=X.U8(postp)+1,0==(j2=ptntp-orntp)))){if(fID=!1,0<j2){if(0<j2%33)return}else if(0<j2%33){if(j1<55||0<(j1-55)%33)return
fID=!0}if(l=2*X.U8(postp)+3,j2<0){if(l+j2!=0)return}else if(l+postp-orntp!=0){if(ptntp<82||l+postp-ptntp+55!=0)return
fID=!0}if(!(65535<(l=orntp+33)||l>X.Sz())){for(;l;){if(l--,0<X.U8(l))return
if(l==orntp)break}for(l=ptntp,j1=0,j2=0,ptn=0;l+6<=X.Sz()&&l+6<65536&&X.U8(l)<255;)l++,j2=X.U16(l,_LE),j1<j2&&(j1=j2),l+=2,j2=X.U16(l,_LE),j1<j2&&(j1=j2),l+=2,j2=X.U16(l,_LE),j1<j2&&(j1=j2),l+=2,ptn++
if(!(X.U8(l)<255||j1>X.Sz()||X.U8(j1-1)<255)){for(bad=0;;){if(131<=X.U8(j1)<=142&&j1++,65535<++j1)return
if(j1>X.Sz()){if(X.isHeuristicScan()){bad=1
break}return}if(255==X.U8(j1)||j1==X.Sz())break}return len=255==X.U8(j1)?j1+1:X.Sz(),fID&&"SOUND TRACKER COMPILATION OF "!=X.SA(ptntp-55,29)&&"KSA SOFTWARE COMPILATION OF "!=X.SA(ptntp-55,28)?void 0:1}}}})()&&(sName="Jarosław 'BZYK' Burczyński's Sound Tracker module (.STC,.ZXS)",sVersion="v1.x",bDetected=1,bad&&(sVersion+="/malformed"+bad),K=X.U16(25,_LE),i_d=X.SA(7,18),r=0<=["SONG BY ST COMPILE","SONG BY MB COMPILE","SONG BY ST-COMPILE","SOUND TRACKER v1.1","S.T.FULL EDITION  ","SOUND TRACKER v1.3"].indexOf(i_d)?"":i_d,K!=X.Sz()&&(K=len,X.isVerbose()&&sOption("ord:"+ord+" ptn:"+ptn),32<=(255&K)<=127)&&(r+=String.fromCharCode(255&K),32<=K>>8<=127)&&(r+=String.fromCharCode(K>>8)),X.isVerbose())&&(sOptionT(r,"msg: "),sOption("ord:"+ord+" ptn:"+ptn+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&ss()&&(sName="S.T. Music's Recompiler v2 rebuilt STC module (.ST3)",sVersion="v3.0",bDetected=1,bad&&!X.isVerbose()&&(sVersion+="/malformed"+bad),X.isVerbose())&&(fID&&(sOptionT(decAnsi(9,55,CPSpeccy,!1,Chars0to1FSpeccy)),X.c("'KSA SOFTWARE COMPILATION OF '",9)||sOption(X.SA(9,28),"in: ")),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" delay:"+X.U8(0)+" @"+Hex(base)+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!((a0=X.fSig(0,65535,"41FA.... ....FFD4 43FA.... 228841FA ....D1E8 FFD843FA"))<0||1&a0||a0>X.Sz())&&(bad="",G=X.U16(a0+2,_BE),!((msgp=a0+G+2)<a0+16||msgp>X.Sz()))&&!((playp=X.fSig(a0+16,a0+msgp-6,"4E7548E7FFFE"))<0||1&playp)&&(smpd=X.U16(a0+2+G-2,_BE),ordp=X.U16(a0+2+G-6,_BE),ptnp=X.U16(a0+2+G-10,_BE),smpd)&&ordp&&ptnp&&!(a0+2+G+smpd>X.Sz()||a0+2+G+ordp>X.Sz()||smpd<=ordp&&1!=smpd)){if(ptn=ordp-ptnp>>6,ord=0,smps=[],1==smpd){if(ord++,(pt=a0+2+G+ordp)+4>X.Sz())return K=pt,1
for(pt+=4,E=1,K=ordp-ptnp;E<K;){if(E=X.U32(K,_BE),K+4>X.Sz()||!E)return 1
K+=4}K-=4,ord--}else{if(ord=smpd-ordp>>2,smpd+=a0+2+G,sdsz=X.U16(smpd+2,_BE),smp=sdsz>>5,smpd+sdsz>X.Sz()||sdsz%32)return
if(!sdsz)for(;;sdsz+=32){if(sdsz+36>X.Sz())return
if(stp=X.U32(smpd+sdsz+4,_BE),U=X.U32(smpd+sdsz+8,_BE),endp=X.U32(smpd+sdsz+12,_BE),stp>U||U>=endp)break
smp++,""!=(E=decAnsi(smpd+sdsz+16,16,CPAmiga).trim())&&smps.push(E)}for(mendp=0,Y=0;Y<smp;Y++)(endp=X.U32(smpd+32*Y+12,_BE))>mendp&&(mendp=endp),""!=(E=decAnsi(smpd+32*Y+16,16,CPAmiga))&&smps.push();(K=smpd+sdsz+4+mendp)>X.Sz()&&(bad=bad.addIfNone("!short"))}return 1}})()&&(sName="SIDMon module (.SID1,.SMN,.SID)",sVersion="v1",bDetected=1,""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&("SID-MON BY R.v.VLIET  (c) 1988"!=(E=decAnsi(msgp,256,CPAmiga).trim())&&sOptionT(E),sOptionT(addEllipsis(smps.join(","),200),"smps:"),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<90)&&X.c("'SIDMON II - THE MIDI VERSION'",58)&&(ord=X.U8(2)+1,spd0=X.U8(3),smp=X.U16(4,_BE),ofs=58+X.U32(6,_BE),songlenlen=X.U32(10,_BE),90==(ofs+=songlenlen))){for(G=14,Y=0;Y<10;Y++){if(1048575<(E=X.U32(G,_BE))||!E)return
switch(Y){case 0:var s=[ofs,E]
break
case 1:if(E!=s[1])return
var e=[ofs,E]
break
case 2:if(E!=e[1])return
break
case 3:if(E%32)return
break
case 7:if(E!=smp)return
var t=[ofs,E]
break
case 8:trk=E>>1
break
case 9:var r=[ofs,E]}if(G+=4,(ofs+=E)>X.Sz())return}for(1&(ofs=r[0]+r[1])&&ofs++,smpsz=0,smps=[],G=t[0];G<t[0]+t[1];G+=64)smpsz+=X.U16(G+4,_BE)<<1,""!=(E=decAnsi(G+32,32,CPAmiga).trim())&&smps.push(E)
return K=ofs+smpsz,smp>>=6,1}})()&&(sName="SIDMon II module (.SID2)",bDetected=1,X.isVerbose())&&(sOptionT(X.SA(7,32)),sOptionT(X.SA(39,32),"in: "),sOptionT(addEllipsis(smps.join(","),256),'smp/msg:"','"'),sOption("trk:"+trk+" ord:"+ord+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<17||31<(smp=X.U16(0,_BE))||(ordp=X.U32(2,_BE))<8*smp+2||128<(ptndp=X.U32(6,_BE))-ordp||255!=X.U8(ptndp-1)||65535<(smpdp=X.U32(10,_BE))||ptndp<=ordp+1||smpdp<=ordp||ordp>X.Sz()||ptndp>X.Sz())){for(l=B=0;l<smp;l++){if(65535<(A=X.U16(8*l+14,_BE)<<1))return
if((lst=X.U16(8*l+18,_BE)<<1)>A)return
if((lsz=X.U16(8*l+20,_BE)<<1)>A+2||lst+lsz>A+2||lst&&lsz<=2)return
if((lst||2<lsz)&&!A)return
if(15<X.U8(16+8*l)||64<X.U8(17+8*l))return
B+=A}if(!(B<=2)){for(Y=ordp,ptn=0;Y<ptndp-1;Y++){if(128<(E=X.U8(Y)))return
E>=ptn&&(ptn=E+1)}return K=B+smpdp,1}}})()&&(sName="Digital Illusions Creative Entertainment packed module (.DI)",bDetected=1,K>X.Sz()&&!X.isVerbose()&&(sVersion="malformed!short"),X.isVerbose())&&sOption("ord:"+(ptndp-ordp-1)+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&(function(){if(X.c("'IM10'",60)&&!(256<X.U16(32)||256<X.U16(34)||255<X.U16(36)||!X.U8(48)||X.U8(49)<32||64<X.U8(50)||X.I8(51)<4)){var s,e,t,r,i,n
for(ord=X.U16(32),ptn=X.U16(34),ins=X.U16(36),spd=X.U8(48),bpm=X.U8(49),ch=chon=0,chns=[],G=64;G<576;Y++,G+=16)X.isVerbose()&&(s=X.SC(G,12,"CP437").trim()).length&&chns.push(s),X.U8(G+15)<=1&&ch++,X.U8(G+15)||chon++
if(ch){for(notes=Y=0,G=832;Y<ptn&&G<X.Sz();Y++){if(r=X.U16(G)-4,256<(e=X.U16(G+2)))return
if(G+=4,X.isDeepScan())for(;0<=--r&&G<X.Sz();)if(0==(i=X.U8(G++))){if(e<=++t)return}else 32&i&&([160,255].indexOf(X.U8(G++))<0&&notes++,G++,r-=2),128&i&&(G+=2,r-=2),64&i&&(G+=2,r-=2)
else G+=r}if(!(G>X.Sz())){for(inss=[],smps=[],smp=Y=0;Y<ins;Y++){if(X.isVerbose()&&(s=X.SC(G,32,"CP437").trim()).length&&inss.push(s),G+=384,255<(n=X.U16(G-6)))return
if(!X.c("'II10'",G-4)&&X.U32(G-4))return
for(l=0;l<n;l++,smp++){X.isVerbose()&&smps.push(X.SC(G,13,"CP437").trim())
var a=X.U32(G+16),o=X.U32(G+20),p=X.U32(G+24)
X.U8(48)
if(1048576<a||1048576<o||1048576<p)return
if(64<X.U8(G+36))return
if(G+=64,!X.c("'IS10'",G-4)&&!X.c("'IW10'",G-4))return
G+=a}}return 1}}}})()&&(sName="Imago Orpheus module (.IMF)",bDetected=1,X.isVerbose())&&(sOptionT(X.SC(0,32,"CP437")),sOptionT(addEllipsis(inss.join(" ")),'insts/msg:"','"'),sOptionT(addEllipsis(smps.filter(funSampleName).join(" ")),'smps/msg:"','"'),sOption("spd0:"+spd+" bpm0:"+bpm+" ch:"+chon+(ch==chon?"":ch)+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp:"+smp+(notes?" notes:"+notes:"")+" sz:"+outSz(G))),!bDetected&&(function(){if(!(X.Sz()<37)&&isWithin(nV=X.I8(0),-1,2)){if(26==X.U16(1))var s=13
else{if(24!=X.U16(1))return
s=12}var e,t=[]
for(Y=0,oldchn=X.U16(1);Y<s;Y++){if(G=X.U16(1+2*Y),!isWithin(G,26,X.Sz()-1))return n(G,"!badtrkp"),0
if(t.push(Hex(G+1)+": "+((e=Y)<0?"??":e<6?"FM "+(e+1):e<9?"SSG "+(e-5):9===e?"OPNA ADPCM B":10===e?"OPNA Rhythm":11===e?"Rhythm Subs":12===e?"FM insts":"??")),isWithin(Y,1,11)&&128!=X.U8(G))return n(G,"!badtrkend"+X.U8(G)),0
if(isWithin(Y,1,10)&&G<=oldchn)return n(G,"!badtrkp"),0
if(!Y&&198==X.U8(G))for(l=G+1;l<G+9;l+=2)if((E=X.U16(l))&&!isWithin(E,G,X.Sz()-1))return n(G,"!badC6trkp"),0
oldchn=G}rhosz=X.U16(23)-X.U16(21)-1,rhysz=X.U16(25)-X.U16(23)-2>>1,rho=rhy=0
var r=oldrhy=0,i=16777215
if(0<rhosz)for(q=X.U16(21)+1;q<X.U16(23)+1&&128!=(E=X.U8(q));q++)E>=rhy&&E<128&&(rhy=E+1),rho++
if(0<rhysz&&0<rhosz)for(q=X.U16(23)+1;q<i&&q<X.U16(25)-1&&r<rhy&&(E=X.U16(q)+1,isWithin(E,q,X.Sz()))&&(r||(i=E),!(65024<=E||X.U16(25)-q<2));q+=2)r++,oldrhy=E
if(bad="",ttype="",extra=-1,sV="",4<=rhysz)if(extrap=G-3,extra_type=X.U8(extrap+2),isWithin(extra_type,64,79)||(bad=bad.addIfNone("!badxtype"+Hex(extra_type))),ttype=extra_type<66?"PCP/P86":extra_type<72?"PPS":-1==nV?"FM Towns":"PPZ",extra=X.U16(extrap,_LE)+1,isWithin(extra,1,X.Sz()))for(Y=0;Y<4;Y++)((G=X.U16(extra+2*Y,_LE))<27||G+1>X.Sz())&&(bad=bad.addIfNone("!extrapOOB"+Hex(extra)))
else bad=bad.addIfNone("!"+Hex(extra)+" out of "+Hex(extrap-1))
return 1}function n(s,e){return 1<debug&&_l2r("pmd",s,e),!1}})()&&(bDetected=1,sName="Masahiro 'Kajapon' Kajihara's Professional Music Driver module (.M,.M2)",sVersion=(sVersion=0<=nV?"v"+nV+"/"+["OPN/OPNA","OPM","OPL2",,,,,,,,,,,,,,][nV]:"").appendS(ttype," "),bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(fnames=[],0<extra&&(72<=extra_type&&(n=X.SC(X.U16(extra,_LE)+1,256,"Shift_JIS"),extra+=2,""!=n)&&fnames.push("PPZ:"+n),66<=extra_type&&(n=X.SC(X.U16(extra,_LE)+1,256,"Shift_JIS"),extra+=2,""!=n)&&fnames.push("PPS:"+n),n=X.SC(X.U16(extra,_LE)+1,256,"Shift_JIS"),extra+=2,""!=n&&fnames.push("PPC/P86:"+n),""==(F=X.SC(X.U16(extra,_LE)+1,256,"Shift_JIS"))&&(F=""),""==(c=X.SC(X.U16(extra+2,_LE)+1,256,"Shift_JIS"))&&(c=""),""==(arenji=X.SC(X.U16(extra+4,_LE)+1,256,"Shift_JIS"))&&(arenji=""),""==(rem=X.SC(X.U16(extra+6,_LE)+1,256,"Shift_JIS"))&&(rem=""),sOption(F),sOption(c,"by: "),sOption(arenji,"mixed by: "),sOption(rem),sOption(fnames.join(", "),"fn: ")),E=X.U8(X.U16(21)+1),sOption("rhyord:"+rho+(rho?(E?"×"+E:"")+" rhy:"+rhy:""))),!bDetected&&(function(){function s(s,e){return 1<debug&&_l2r("muap",s,e),!1}if(!(X.Sz()<Math.max(X.U16(32),38))){var e
for(ch=notes=K=sus=0,r="",Y=oldp=0;Y<17;Y++){if(e=X.U16(2*Y),!isWithin(e,Math.max(24,oldp),X.Sz()))return s(2*Y,"!ptr#"+Y+"OOB "+outArray([e,oldp,X.Sz()],16)),0
if(Y&&252!=X.U8(e-1))return s(e-1,"!FC@"),0
if(252!=X.U8(e)){var t=parseMUAP98(e,X.isDeepScan()?BCParseToEoF:BCParseToReasonable,Y)
if(t[0]==BCInvalidFormat)return
notes+=t[0],r=r.appendS(t[3],"\n"),ch++,K<t[4]&&(K=t[4]),sus+=t[5]}else K<e+1&&(K=e+1)
oldp=e}return sus>3*ch?void 0:(bad=sus?"suspicious"+sus:"",1)}})()&&(sName="Packen/ぱっくん Software MUAP98/みゅあっぷ Object chiptune (.O,.OX+TONES.DTA)",bDetected=1,bad.length&&(sVersion=bad),X.isVerbose())&&(sOptionT(r),sOption("ch:"+ch+(X.isDeepScan()?" notes:"+notes+" sz:"+outSz(K):""))),!bDetected&&X.isDeepScan()&&(function(){if(X.c("6000.... 6000.... 6000.... 6000.... 6000....  41FA.... ........ 4E7541FA")){for(a2=64,d4=8;9240!=X.U16(a2,_BE)&&(a2+=2,--d4););if(d4){for(smp=d3=X.U8(a2-1)+1,a2=54,d4=5;16890!=X.U16(a2,_BE)&&(a2+=2,--d4););if(d4){a2+=2,a4=a2,d4=a2+X.U16(a2,_BE)+2,53756==X.U16(a4+2,_BE)&&(d4+=64),a3=d4-2,d5=0,a2=a3
do{if(65536<(d1=X.U32(a3,_BE)))return}while(d1+=6,d5+=d1,a3+=d1,--d3)
if(20081==X.U16(a3,_BE)){a3=0,a0=130+a3,d0=10
do{if(16875==X.U16(a0,_BE)){a0+=2
break}}while(a0+=2,--d0)
if(d0){for(d1=0,d2=X.U16(a0,_BE),a3+=d2;a3+=18,d1++,X.U16(a3,_BE););d2=a2-a3
do{if(132!=(b=X.U8(a3))&&133!=b){if(a3++,--d2<0)break}else d0++,a3++,d2--}while(0<=d2)
return songsz=d4,K=d4+d5,steps=d0,k=d1,1}}}}}})()&&(sName="Rob Hubbard's module (.RH)",sVersion="v1.4",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" steps:"+steps+" songsz:"+songsz+" sz:"+outSz(K))),!bDetected&&(function(){if(!(256<(ord=X.U16(12,_BE)+1))&&(ptn=X.U16(14,_BE))&&!(128<ptn)&&(synsmp=X.U16(16,_BE),isWithin(synsmp,1,32))&&(loop=X.U16(18,_BE),bad="",loop>=ord&&(bad=bad.addIfNone("!badloop")),!(charStat(X.readBytes(0,12),1).indexOf("allxsc")<0))){for(G=80,Y=mp=0;Y<ord&&G<X.Sz();G+=14,Y++)for(_=0;_<4;_++){if(128<=(pt=X.U8(G+3*_))||!isWithin(X.I8(G+3*_+2),-48,48))return
pt>mp&&(mp=pt)}if(!(Y<ord||(mp++,(minsz=G+8*ptn+4+16*synsmp+4)>=X.Sz()))){for(Y=0;Y<ptn;Y++){if(!X.c("'patt'",G))return
for(G+=4,row=0;row<32;G+=4){var s=X.readBytes(G,4)
if(s[0]%2||!isWithin(s[3],1,32-row))return
row+=s[3]}}if(X.c("'patt'",G)){for(G+=4,smp=msmpp=mssz=evc=0,plim=Math.min(X.Sz(),1048576),Y=0;Y<10;Y++)if(smpp=X.U32(20+4*Y,_BE)){if(1&(A=X.U16(60+2*Y,_BE))&&A--,A<<=1,smpp<minsz||1048576<smpp)return
smpp>msmpp&&(msmpp=smpp,mssz=A),smp++}for(Y=0;Y<synsmp&&G<X.Sz();Y++){if(!X.c("'inst'",G))return
if(G+=4,!e(!0))return
if(!X.c("'insf'",G))return
if(G+=4,!e(!1))return}return X.c("'inst'",G)?((G+=4)>X.Sz()?(K=-1,bad=bad.addIfNone("!short")):K=Math.max(msmpp+mssz,G),1):void 0}}}function e(s){for(var e=!0;G+4<X.Sz();){var t=X.readBytes(G,4)
if(G+=4,e&&s&&192!=t[0])return
switch(t[0]){case 160:evc++
break
case 176:return evc++,!(3&t[1])
case 192:if(!s)return
evc++
break
case 208:if(s)return
evc++,1&t[1]&&(bad=bad.addIfNone("!oddpitch"))
break
case 224:return evc++,1
default:return s||"inst"!==decEncoding(t,CPAmiga)?void 0:(G-=4,0<evc)}e=!1}return 0<evc}})()&&(sName="PumaTracker module (.PUMA)",sVersion="v1.1",bDetected=1,""!=bad&&(sVersion=sVersion.appendS("/malformed"+bad,"/")),X.isVerbose())&&(sOption(decAnsi(0,12,CPAmiga).trim()),sOption("ord:"+ord+" ptn:"+mp+(mp!=ptn?"/"+ptn:"")+(smp?" wf.smp:"+smp:"")+" syn.smp:"+synsmp+(loop?" lp:"+loop:"")+" events:"+evc+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("0FFF0FE2")||X.c("10000FE2")){if(!X.c("0FC40FA7 0F8B0F6E",4))return
G=292,a0=8}else{if(!X.c("0F1C0F0E 0F000EF2 0EE40ED6"))return
G=452,a0=168}do{if(!(E=X.U32(G,_BE)))return
if((G+=2)>X.Sz())return}while([17914,17401,16889].indexOf(E>>16)<0)
for(initp=G-2,a0+=284,d1=0;d1<128;d1++){if(X.c("7F7F7F7F",a0)||X.c("FFFF",a0))return
a0+=2}k=IntAddress=0,Twin=!1
do{if(E=X.U16(G,_BE),(G+=2)>X.Sz())return}while([28672,29184].indexOf(E)<0)
if(28672===E)k=1
else{for(;!k&&G<X.Sz();){if(X.c("00000000",G))return
X.c("21C80070",G)?(G+=2,X.c("00003B76",588)&&(Twin=!0)):X.c("43FA",G)?(E=G+2+X.I16(G+2,_BE),k=X.I16(E,_BE)-E>>3):X.c("43EA",G)?(E=X.I16(G+2,_BE),k=X.I16(E,_BE)-E>>3):G+=2}if(!k||G>=X.Sz())return}return 1})()&&(sName="Sean Conran module (.SCR)",sVersion="v1.2",bDetected=1,Twin&&(sVersion+="/Megatwins"),X.isVerbose())&&1<k&&sOption(k,"×"),!bDetected&&X.isDeepScan()&&(function(){if(X.c("6000....6000.... ....6000")&&!((d1=X.I16(2,_BE))<=0||1&d1||d1>X.Sz())&&(a0=a1=a3=d1+2,!((d1=X.I16(6,_BE))<=0||1&d1||d1>X.Sz()))&&!((d1=X.I16(12,_BE))<=0||1&d1||d1>X.Sz())&&X.c("3F006100",a1)&&X.c("3D7C",a1+6)&&X.c("41FA",a1+12)){for(d0=127;d0;){if(X.c("D040D040 D04041FA",a0)){a0+=8,a1=a0+X.I16(a0,_BE)
break}if(a0+=2,!--d0||a0>X.Sz())return}k=0
s:for(;;){for(d2=4;d2;){if(d0=64512&X.U16(a1,_BE),(a1+=2)>X.Sz())return
if(d0){k--
break s}d2--}k++}for(k++,d5=d6=0,d0=128;d0;){if(E=X.U16(a0,_BE),(a0+=2)>X.Sz())return
if(16890===E)break
d0--}if(d0){for(smpi1=a0+X.U16(a0,_BE),a0=12+X.I16(12,_BE),d0=128;d0&&(d0--,!X.c("D040D040 41FA",a0));)if((a0+=2)>X.Sz())return
for((!d0||(a0+=6,1&(d0=X.I16(a0,_BE)))||(a0+=d0,X.I16(a0,_BE)))&&(a0=0),smpi2=a0,a0=smpi1;;){if(d0=X.U32(a0,_BE),(a0+=4)>X.Sz())return
if(!d0)break
if(d0>>16){a0-=4
break}}if(a0-=8,smp1=a0-smpi1>>2,d0=smpi2){for(a0=d0;;){if(d0=X.U32(a0,_BE),(a0+=4)>X.Sz())return
if(!d0)break
if(d0>>16){a0+=4
break}}a0-=8,smp2=a0-smpi2>>2}else smp2=0
d3=smp1,a2=smpi1+X.I32(smpi1,_BE),d1=X.I32(a2,_BE),d2=X.U16(a2+8,_BE),Y=d4=0
do{if(++Y===smp1)break
if((a2=smpi1+X.I32(smpi1+(Y<<2),_BE))<20||a2>X.Sz())return
if(d4=X.I32(a2,_BE),!(d1>d4)){if(d1!=d4)d6=d4!=X.I32(a2+4,_BE)?X.U16(a2+10,_BE):0,d5=X.U16(a2+8,_BE)
else if(d5=X.U16(a2+8,_BE),d2>d5)continue
d1=d4,d2=d5}}while(Y<smp1)
if(d2+=d6,K=smpi1+d1+(d2<<1),smpi2){d3=smp2<<2,a2=smpi2+X.I32(smpi2,_BE),d1=X.I32(a2,_BE),d2=X.U16(a2+8,_BE),Y=d6=0
do{if((Y+=4)===d3)break
if((a2=smpi2+X.I32(smpi2+Y,_BE))<20||a2>X.Sz())return
if(d4=X.I32(a2,_BE),!(d1>d4)){if(d1!=d4)d6=d4!=X.I32(a2+4,_BE)?X.U16(a2+10,_BE):0,d5=X.U16(a2+8,_BE)
else if(d5=X.U16(a2+8,_BE),d2>d5)continue
d1=d4,d2=d5}}while(Y<d3)
d2+=d6,a1=smpi1+d1+(d2<<1),K<a1&&(K=a1)}return 1}}})()&&(sName="Ben Daglish's module (.BD)",sVersion="v1.2",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp1+"+"+smp2+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(X.c("'BANK'")){for(Y=0;Y<20;Y++)if(2097152<=X.U32(4+(Y<<2),_BE))return
for(Y=0;Y<40;Y++)if(65536<=X.U32(84+(Y<<2),_BE))return
for(G=84,q=4,smp=0,smpt=[],s=484,Y=0;Y<20;Y++)E=X.U32(q,_BE),q+=4,E&&(smpt.push(X.SA(s,16).trim()),smp++,s+=16+X.U32(G,_BE)),G+=4
for(smpsz=s,bad=!1;s<X.Sz()&&(E=X.U8(s),s+=1,255!==E););if(s>X.Sz()){if(!X.isHeuristicScan())return
bad=!0}return 47===X.U8(s)?(K=s+1,songsz=K-smpsz):(K=s,bad=!0),1}})()&&(sName="Andrew Parton's module (.BYE)",sVersion="v1.2",bDetected=1,bad&&(sVersion+="/malformed"),X.isVerbose())&&sOption("smp:"+smp+" songsz:"+songsz+" smpsz:"+smpsz+" sz:"+outSz(K)),!bDetected&&X.isDeepScan()&&(function(){for(Y=G=0;Y<4;Y++){if(!X.c("6000",G))return
if(G+=2,(d2=X.I16(G,_BE))<=0||1&d2)return
G+=2}if(X.c("6000",G)){if(G+=2,(d2=X.I16(G,_BE))<=0||1&d2)return
if(G+=2,!X.c("6000",G))return
if(G+=2,(d2=X.I16(G,_BE))<=0||1&d2)return
if(G+=d2,!X.c("48E7FFFE 6100",G))return
if(G=(G+=6)+X.I16(G,_BE),!X.c("4DF9 00DFF000",G))return
sV="new"}else{if(!X.c("303C0000 662233C0",G))return
sV="old"}if("new"===sV){for(a2=special=28,a0=X.I16(2,_BE),F=X.SA(special,X.fStr(special,a0-a2,"  ")-a2).trim();E=X.U16(a0,_BE),a0+=2,17914!=E||a0>X.Sz(););if(a2=a0,(a0+=X.I16(a0,_BE))>X.Sz()-2){if(!X.isHeuristicScan())return
bad=!0}d0=X.I16(a0,_BE),k=d0>>2,a0+=d0+X.I16(a0-2,_BE)
do{if(a0>X.Sz()-2){if(!X.isHeuristicScan())return
bad=!0}}while(E=X.I16(a0,_BE),a0+=2,1010!=E)
K=a0,a='title: "'+F+'" sz:'+outSz(K)}else{for(special=0,a2=16,a0=2,a0+=X.U16(a0,_BE);E=X.I16(a0,_BE),a0+=2,6512!=E||a0>X.Sz(););for(a1=a0-4,a1+=X.I16(a1,_BE);E=X.I16(a0,_BE),a0+=2,16890!=E||a0>X.Sz(););for(a0+=X.I16(a0,_BE),k=a1-a0>>4;E=X.U16(a2,_BE),a2+=2,49916!=E||a0>X.Sz(););for(a2+=4,smpip=a2+X.U16(a2,_BE);E=X.U16(a2,_BE),a2+=2,18426!=E||a0>X.Sz(););for(a0=a2,a2+=X.U16(a2,_BE),songsz=a2;E=X.U16(a0,_BE),a0+=2,18938!=E||a0>X.Sz(););for(;E=X.U16(a0,_BE),a0+=2,18938!=E||a0>X.Sz(););for(a0+=X.U16(a0,_BE),smp=(a0-smpip)/44,d1=0,a1=smpip,a3=21747;0<=(d2=X.I32(a1+32,_BE))&&d1<=d2&&(d1=d2,a3=a1),a1+=44,a0>a1;);d0=X.U16(a3+40,_BE),d1+=d0+d0,smpsz=d1,K=songsz+smpsz,a="smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K)}return 1})()&&(sName="Ashley Hogg's module (.ASH)",sVersion=sV,bDetected=1,bad&&(sVersion+="/malformed"),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption(a)),!bDetected&&X.isDeepScan()&&(function(){if(X.c("'IBLK'")&&(d2=X.U8(4))&&!(128<d2)&&(a1=22+138*d2,!((aseq=X.fSig(a1,260,"'ASEQ'"))<0||1&aseq))){G=aseq+4,K=0,bad=!1
do{if((K+=5)+G>X.Sz()){if(X.isHeuristicScan()){bad=!0
break}return}}while(!X.c("102F00",K+G-3))
return K+=G,ord=Math.floor((K-G)/100),1}})()&&(sName="Cinemaware module (.CIN)",bDetected=1,bad&&(sVersion="malformed"),X.isVerbose())&&sOption("ord:"+ord+" sz:"+outSz(K)+" (sans ext.samples)"),!bDetected&&(function(){if(!(X.Sz()<3e3)){if(X.c("6000.... 6000")||X.c("4EF9.... ....4EF9")||X.c("4EB9.... ....4EF9")){G=8
for(var s=!1;X.c("42280030 42280031 42280032",G)&&(s=!0),G+=2,!s&&G<408;);}if(s){if(X.isVerbose()){for(G=q=d0=d5=0,d7=2048,org=0,smpi=0,songst=0,bad=!1;d7&&G<X.Sz();){if(3493939706===(_=X.U32(G,_BE)))d0=X.I16(G+4,_BE),q=G+d0+4,Table=q
else if([1223162108,1223163902].includes(_)){for(!(d6=a3)||org?d6=20:(q=G-a3,d5-=q,org=d5);0<=d6--;)if(E=X.U16(G,_BE),G+=2,16890===E){d0=X.I16(G,_BE),songst=q=G+d0
break}}else 3913828336===_?d1=X.I16(G+4,_BE):12571904===_?(tmrval=(X.U8(G-1)<<8)+X.U8(G+7),X.c("4E71",G+20)||(a3=X.c("21FC",G+28)?X.U32(G+30,_BE):X.c("C000",G+32)?X.U32(G+32,_BE):X.U32(G+22,_BE))):1118306332===_?(d0=X.I16(G+6,_BE),smpi=q=G+d0+6):[3829941242,3829932155].includes(_)?a4&&(d0=X.I16(G+4,_BE),a4-=X.I32(G+d0+4,_BE),org||(d5-=a4,org=d5)):1223098608===_&&(d0=X.I16(G+6,_BE),a4=G+d0+6)
if(G+=2,448796992===_)break
d7--}for(songst+=d1,k=0,G=songst+1;G<X.Sz()&&!X.c("DFF0A0",G);k++,G+=16);if(G>X.Sz())return bad=!0,1
for(smp=synsmp=0,G=smpi;!X.U32(G+28,_BE);G+=32)a2=X.U32(G,_BE)-org,2===(a24=X.U16(a2+4,_BE))||16===a24?smp++:synsmp++}return 1}}})()&&(sName="Ivo Zoer & Ron Klaren's CustomMade module (.CM)",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" syn:"+synsmp+" timer:"+tmrval)),!bDetected&&X.isDeepScan()&&(function(){if(a1=0,4===(d1=X.I16(0,_BE)))X.U32(24,_BE)||(a1+=4)
else{if(8!==d1)return
a1+=4}for(a1+=4,a2=a1,d2=0;d2<4;d2++){if(X.I16(a1,_BE))return
if(a1+=2,d1=X.I16(a1,_BE),a1+=2,d1<=0||1&d1)return}for(d0=0;d0<4;d0++){if(a1=d1=X.I32(a2,_BE),a2+=4,d2=X.I32(a1,_BE),X.I16(a1,_BE))return
if(a1+=2,d1=X.I16(a1,_BE),a1+=2,d1<=0||1&d1)return
if(a1=d2,48===(E=X.I16(a1,_BE))&&(a1+=2,E=X.I16(a1,_BE)),12===E&&(a1+=6,E=X.I16(a1,_BE),a1+=2,4===E))break}if(d2=X.I32(a1,_BE),1==X.I16(d2,_BE)&&!(a1=a2=d2>>16)){if(fmt=1,X.U32(24,_BE)){for(k=0,G=X.U16(0,_BE);G<X.Sz()&&(E=X.I16(G,_BE),G+=2,!E)&&(E=X.I16(G,_BE),G+=2,E&&!(1&E));)k++
k>>=2}else fmt=0,k=X.I16(2,_BE)-8>>5
for(bad="",K=0,a1=d2;a1<X.Sz()&&(a2=a1,a1-=14,1==X.I16(a1,_BE)););for(8!=(E=X.I16(a2-2,_BE))&&0!=E&&(a2+=14),smp=K=0;a2<X.Sz()&&1==(E=X.I16(a2,_BE));)smp++,a2+=2,d2=X.I32(a2,_BE),a2+=6,E=X.I32(a2,_BE),(d2=E>d2?E:d2)>K&&(K=d2),a2+=6
return K>X.Sz()&&(bad=bad.addIfNone("!short")),a2>=X.Sz()?bad=bad.addIfNone("!badsmpinfo"):K+=254,1}})()&&(sName='Dave "Uncle Art" Lowe New module (.DLN)',bDetected=1,sVersion="f."+fmt,""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<=2500)){for(a2=0,a0=8,d1=0;d1<4;d1++){if(!X.c("00010101",a0))return
a0+=16}a1=400+a0
do{if(a0===a1)return}while(E=X.I16(a0,_BE),a0+=2,18938!=E)
if(a0+=2,X.c("45F900DF F000357C 00FF009E 41FA",a0)&&(a0=(a0+=14)+X.I16(a0,_BE))==a2){for(a1=240;E=X.U16(a1,_BE),a1+=2,18938!=E&&a1<X.Sz(););for(a1-=2;E=X.U16(a1,_BE),a1+=2,18426!=E&&a1<X.Sz(););for(a2=a1+20,a1+=X.I16(a1,_BE),k=0,a1++;d1=X.U8(a1),a1++,d1&&(k++,d1!=X.U8(a1))&&a1<X.Sz(););for(;E=X.U16(a2,_BE),a2+=2,58177!=E&&a2<X.Sz(););for(;E=X.U16(a2,_BE),a2+=2,18426!=E&&a2<X.Sz(););for(smptsz=a1=a2+X.I16(a2,_BE);E=X.U16(a2,_BE),a2+=2,18426!=E&&a2<X.Sz(););for(a3=a2,a2+=X.I16(a2,_BE),smpp=a2,a0=a2,d4=a1-a2,a2=a1+d4,smp=0;E=X.I16(a1,_BE),a1+=2,E&&smp++,a1<a2;);for(;E=X.U16(a3,_BE),a3+=2,18426!=E&&a3<X.Sz(););for(a3+=2,(d6=3584&X.U16(a3,_BE))?d6>>=9:d6=8,ruch=d6,d1=X.I16(a0,_BE),songsz=d2=d1<<d6,E=d1,d1=d2,d2=E,d5=0;d0=X.I16(a0,_BE),a0+=2,d0>d2&&(d2=d0,d5=X.U16(a0+d4-2,_BE)),a0<smptsz;);return d2<<=d6,d5<<=1,d2+=d5,K=d2,smpsz=K-songsz,1}}})()&&(sName="Desire player module (.DSR)",bDetected=1,sVersion="v1.0",X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K)),K<X.Sz())&&(sVersion+="/malformed!short"),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<2048)){var s=Math.min(X.Sz(),16384)
for(K=k=ch=smp=sqwfsmp=Y=0;Y<s&&(18426!=X.U16(Y,_BE)||240!=(240&X.U8(Y+2)));Y+=2);if(!(s-6<=Y)){for(sofs=Y+2+X.I16(Y+2,_BE);Y<s&&Y<X.Sz()&&24832!=X.U16(Y,_BE);Y+=2);if(!(s-6<=Y)){for(sinit=Y,ssmpsinit=Y,24832==X.U16(Y+4,_BE)&&(ssmpsinit=Y+6+X.I16(Y+6,_BE)),Y=ssmpsinit;Y<s&&18987!=X.U16(Y,_BE);Y+=2);if(!(s-36<=Y)){if(102!=X.U8(Y+4)){for(Y=sinit;Y<s&&16875!=X.U16(Y,_BE);Y+=2);if(s-36<=Y)return
if(smpdp=sofs+X.I16(Y+2,_BE),Y+=4,114!=X.U8(Y+4))return
for(smp=X.U8(Y+5)+1;Y<s-4&&!X.c("41EB....E34F",Y);Y+=2);if(s-4<=Y)return
for(chvolp=sofs+X.I16(Y+2,_BE),Y=sinit;Y<s&&!X.c("41EB....17",Y);Y+=2);if(s-4<=Y)return
sstp=sofs+X.I16(Y+2,_BE),is32bp=!0,old=!0}else{if(old=!1,X.U8(Y+5)||(Y+=2),16890!=X.U16(Y+6,_BE))return
if(smpdp=X.I16(Y+8,_BE)+Y+8,Y+=10,X.c("2748....D0FC",Y)){if(smpdp+=X.U16(Y+6,_BE),Y+=12,53500!=X.U16(Y,_BE))return
smpdp+=X.U16(Y+2,_BE),Y+=4}if(!X.c("4BFA....72",Y))return
for(smpip=X.I16(Y+2,_BE)+Y+2,smp=X.U8(Y+5)+1,Y=sinit;Y<s-4&&(16890!=X.U16(Y,_BE)||75==X.U8(Y+4));Y+=2);if(s-4<=Y)return
if(4656!=X.U16(Y+4,_BE)&&14192!=X.U16(Y+4,_BE))return
for(sstp=Y+2+X.I16(Y+2,_BE),Y+=4;Y<s-8&&(16890!=X.U16(Y,_BE)||35==X.U8(Y+4));Y+=2);if(s-8<=Y)return
if(8304==X.U16(Y+4,_BE))is32bp=!0
else{if(12400!=X.U16(Y+4,_BE))return
is32bp=!1}}for(G=smpdp,Y=0;Y<smp;Y++){if(A=X.U32(G,_BE),(G+=6)+A>X.Sz())return bad=bad.addIfNone("!short"),1
K=G+=A}for(Y=0;Y<s;Y+=2)if(18426==X.U16(Y,_BE)){if(s-10<=Y)return
if(X.c("4A2B....67",Y+4)){if([13308,6012,2233].includes(X.U16(Y+10,_BE)))continue
break}}for(splay=Y,ch=0,Y=splay;Y<splay+200;Y+=2)if(126==X.U8(Y)){if(ch=X.U8(Y+1))ch++
else for(;Y<splay+500;Y+=2)if([48764,48700].includes(X.U16(Y,_BE))){ch=X.U8(Y+3)
break}break}if(ch){for(Y=splay;Y<splay+100;Y+=2)if(X.c("207A.... 303A",Y)){if(sqwfsmp=(X.I16(Y+2,_BE)+Y+2-smpip)/12,![12732,4540].includes(X.U16(Y+14,_BE)))return
if(80!=(240&X.U8(Y+20))||107!=X.U8(Y+21))return
if(3179!=X.U16(Y+24,_BE))return
if(![12732,4540].includes(X.U16(Y+38,_BE)))return
if(3179!=X.U16(Y+48,_BE))return}if(old){for(Y=splay;Y<s&&28672!=X.U16(Y,_BE);Y+=2);if(16!=X.U8(Y+2))return
var e=Y}else{for(Y=splay;Y<s&&21352!=X.U16(Y,_BE);Y+=2);if(s-16<=Y||103!=X.U8(Y+4))return
e=X.U8(Y+5)+Y+6
if(102!=X.U8(Y+12))return
for(Y=e;Y<s&&!X.c("45FA.... 322D",Y);Y+=2);if(s-6<=Y)return
if(s-144<=(Y=X.U16(Y+2,_BE)+Y+2))return
if(![4096,8192].includes(X.U16(Y,_BE)))return}for(Y=e;Y<s&&27392!=X.U16(Y,_BE);Y+=2);if(!(s-6<=Y)){var t=endlym=!1
for(Y=splay;Y<splay+100;Y+=2)if(4154==X.U16(Y,_BE)){t=!0,49404==X.U16(Y+6,_BE)&&(endlym=!0)
break}for(k=0,G=sstp,minpp=4294967295,sngspd=dlyspd=0,bad="";G+8<minpp&&(dlyspd=t?(sngspd=X.U8(G++),X.U8(G++)):(sngspd=X.U16(G,_BE),G+=2,0),!(255<sngspd));){for(Y=0;Y<ch;Y++)is32bp?(E=X.U32(G,_BE),G+=4):(E=X.U16(G,_BE),G+=2),minpp>sofs+E&&(minpp=sofs+E)
if(G>X.Sz()){bad=bad.addIfNone("!short")
break}k++}return 1}}}}}}})()&&(sName="David Whittaker's module (.DW)",sVersion=old?"old":"new",bDetected=1,""!=bad&&(sVersion+="/malformed"+bad),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("ch:"+ch+" smp:"+smp+(sqwfsmp?" sqwf.smp:"+sqwfsmp:"")+" spd:"+sngspd+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(X.c("13FC0040 ........ 4E710439 0001")&&X.c("66F44E75 48E7FFFE",18)){for(a2=0,bad="";9081!=X.U16(a2,_BE)&&a2<=1e3;)a2+=2
if(1e3<a2){if(!X.isHeuristicScan())return
bad="!badorigin"}for(org=X.U32(a2-4,_BE),a2=0,d1=1;9169==X.U16(a2,_BE)?(smplen=X.I32(a2+8,_BE)-org,smpp=X.I32(a2-6,_BE)-org,smplp=X.I32(a2+24,_BE)-org,smpnvol=X.I32(a2-30,_BE)-org,d1-=6):3237741568==X.U32(a2,_BE)?(ptn=X.I32(a2+6,_BE)-org,d1+=3):209257472==X.U32(a2,_BE)&&(songpos=X.I32(a2+12,_BE)-org,len=X.I32(a2+34,_BE),d1+=2),(a2+=2)<1e3;);if(d1){if(!X.isHeuristicScan())return
bad=bad.addIfNone("!badval")}for(a1=smpp,songsz=X.I32(smpp,_BE)-org,d0=X.I32(a1-4,_BE)<<1,a2=smplen,d1=a1-a2,a1+=d1,d1>>=2,smp=d1,d1=X.I32(a1-4,_BE)-org,K=d0+d1,smpsz=K-songsz,a1=songpos,a2=a1+len,ptn=0;E=X.U8(a1),ptn<E&&(ptn=E),++a1<a2;);return ptn++,d1=6*(d0-1),d0=d1,d1*=14187,dur=Math.floor(64*d1/709376),1}})()&&(sName="Fashion Tracker module (.EX)",bDetected=1,sVersion="v1.0",bad&&(sVersion+="/malformed."+bad),X.isVerbose())&&sOption("ord:"+len+" ptn:"+ptn+" smp:"+smp+" songsz:"+songsz+" sz:"+outSz(K)),!bDetected&&(function(){if(a0=a1=0,F=inst="",format="Aegis Sonix Music Driver",X.c("'FORM'")){if(!X.c("'SMUSSHDR'",8)||!X.U8(23)||!X.c("'NAME'",24))return
if((d1=X.U32(28,_BE))>>31)return
if(d1=(t_=d1)+1&4294967294,a1=32+d1,X.c("'SNX1'",a1)){if(a1+=4,(d1=X.U32(a1,_BE))>>31)return
a1+=4,d1=d1+1&4294967294,a1+=d1}else format="Electronic Arts' Simple Musical Score"
insinfp=a1,realsmp=[],ins=0
do{if(!X.c("'INS1'",a1))return
if(a1+=4,(d1=X.U32(a1,_BE))>>31)return
if(a1+=4,63<(d1=d1+1&4294967294)>>24)return
if(X.U8(a1+1))return}while(realsmp.push(X.U8(a1)),a1+=d1,ins++,!X.c("'TRAK'",a1))
for(K=a1,trk=0;K<X.Sz()&&(hkhd=X.SA(K,4),hksz=X.U32(K+4,_BE),"TRAK"==hkhd);)trk++,K+=8+hksz
F=X.SA(32,t_),fmt=2,ext="smus"}else if(240&X.U16(0,_BE)){if(X.Sz()<333)return
if(a1=48,320!=X.I32(a1,_BE))return
for(a1+=4,d1=3;d1;){if(d2=X.I32(a1,_BE),a1+=4,d2<=0||1&d2||d2>X.Sz())return
if(-1!=X.I16(d2,_BE)){if(X.I32(d2,_BE)||X.I16(d2+4,_BE))return
if(E=X.U8(d2+6),!isWithin(E,128,130))return}d1--}0<(K=X.fSig(d2,512,"FFFF"))&&(K+=2),fmt=1,ext="tiny"}else{for(d3=20,d1=4;d1;){if((d2=X.I32(a0,_BE))<=0||1&d2)return
a0+=4,d3+=d2,d1--}if(d3>=X.Sz())return
for(a0+=4,d1=4;d1;){if(!(32768&(E=X.U16(a0,_BE))))return
if(65535!=E&&132<E>>16)return
a0+=X.I32(a1,_BE),a1+=4,d1--}if(!X.U8(a0))return
if(0<(K=X.fSig(a0,512,"0000"))){for(;a0<K;)inst=inst.appendS(X.SA(a0,E=X.fSig(a0,512,"00")-a0),"; "),a0+=E+1
K+=2}fmt=0,ext="snx"}return 1})()&&(sName=format+" module (."+ext+")",sVersion="f."+fmt,bDetected=1,X.isVerbose())&&(F.length&&sOption(F),inst.length&&sOption(inst,'+instr.:"','"'),sOption("sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(X.c("'AmBk'"))a0=G=4
else{if(!X.c("C0"))return
a0=G=0}if(X.c("'Music   '",G+8)&&(G=(G+=20)+X.I32(G,_BE),6==X.I16(G,_BE))&&(i=G+=2,G+=X.I16(G+2,_BE)-2,-2==(G=X.I16(G,_BE))||!G)){for(F=X.SA(i+12,32),G=i+30+X.I16(i+30,_BE),ord=-1;ord++,d1=X.I16(G,_BE),(G+=2)<X.Sz()&&0<=d1;);for(d3=a0?4+(16777215&X.I32(a0+4,_BE)):16777215&X.I32(a0,_BE),K=d3+8,bad="",K>X.Sz()&&(bad=bad.addIfNone("!short")),G=i+X.I16(i+6,_BE),ptn=0;G<X.Sz()&&(d1=X.I16(G,_BE),G+=2,!(d1<0));)d1>ptn&&(ptn=d1)
for(ptn++,X.I16(G,_BE)||(G+=2),X.I16(G,_BE)!=ptn&&(bad=bad.addIfNone("!badptn")),q=a0+32,smp=d1=X.I16(q,_BE),q+=16,d7=0;d1&&q<X.Sz();)d2=(d2=X.I16(q,_BE))||X.I16(q-6,_BE),d7+=d2<<1,q+=32,d1--
return smpsz=d7,songsz=K-d7,1}})()&&(sName="François Lionet's AMOS Music Bank module (.ABK)",bDetected=1,""!=bad&&(sVersion="malformed"+bad),X.isVerbose())&&(sOption(F),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!(32<(ins=X.I16(0,_LE)))&&X.c("'INST'",4+2*ins)&&(E=8+114*ins,X.c("'SONG'",E))){for(E+=4,songsz=0,Y=0;Y<ins;Y++)songsz+=X.U16(4+2*Y,_LE)
return X.c("'ENDS'",E+4*songsz)?(K=E+4*songsz+4,1):void 0}})()&&(sName="TuneFish module (.TF4)",sVersion="v4",bDetected=1,X.isVerbose())&&sOption("ins:"+ins+" tempo:"+X.U16(2,_LE)+" songsz:"+Hex(songsz)+" sz:"+outSz(K)),!bDetected&&X.isDeepScan()&&(function(){if(a0=0,tfmx=0,X.c("'MCMD'"))fmt=-1,tfmx=a0
else if(X.c("48E7FFFE")){if(fmt=-1,a0+=4,d1=0,!X.c("61",a0))return
if(!(d1=X.U8(a0+1))||1&d1)return
if(a0+=d1+2,!X.c("2F006100",a0))return
if(a0+=4+X.I16(a0+4,_BE),!X.c("41FA",a0))return
if(!X.c("41FA",a0+18))return
if(a0=(a0+=20)+X.I16(a0,_BE),!X.c("'MCMD'",a0))return
tfmx=a0}else{if(fmt=0,!X.c("60",a0++))return
if(d1=X.U8(a0++)){if(1&d1)return
if(a0+=d1,!X.c("48E7FFFE",a0))return
if(a0+=4,!X.c("6100",a0))return
if(a0=(a0+=2)+X.I16(a0,_BE),!X.c("2F006100",a0))return
if(a0=(a0+=4)+X.I16(a0,_BE),!X.c("41FA",a0))return
a0+=20}else{if(fmt=1,(d1=X.I16(a0,_BE))<0||1&d1)return
if(!X.c("6000",a0+2))return
if(a0+=d1,!X.c("48E7FFFE",a0))return
a0+=4}if(E=X.c("41FA",a0),a0+=2,!E&&(E=X.c("41FA",a0),a0+=2,!E))return
if(a0+=X.I16(a0,_BE),tfmx=a0,!X.c("'TFMX'00",a0))return
if(a0+=4,!X.I16(a0+12,_BE))return fmt="sfx",K=0,k=1,1
if(d1=2+X.I16(a0,_BE)+X.I16(a0+2,_BE)<<6,d2=(1+X.I16(a0+4,_BE))*X.I16(a0+8,_BE),d3=12*(1+X.I16(a0+6,_BE)),d1+=d2+d3+6*(1+X.I16(a0+12,_BE))+32,a0+=d1+14,X.I32(a0,_BE))return
if(a0+=4,!(d2=X.I16(a0,_BE)))return
if((d2*=2)!=X.I32(a0+26,_BE))return}return K=a0=0,k=1,a1=a0+tfmx,d1=fmt<0?(d0=0,18):(d0=2,32),d0=(d0=d0+(X.I16(a1+4,_BE)+X.I16(a1+6,_BE))<<6)+d1,d1=fmt<0?0:1,d1+=X.I16(a1+8,_BE),ptn=d1,d1*=X.I16(a1+12,_BE),d0+=d1,d1=((d1=fmt<0?0:1)+X.I16(a1+10,_BE))*12,d0+=d1,a2=subp=a1+d0,d1=1,d1=fmt<0?(d2=X.I16(a1+14,_BE))<<3:(d2=X.I16(a1+16,_BE),6*(d1+d2)),k=d2,d0+=d1,a2=smpinfop=a1+d0,d2=fmt<0?(d1=X.I16(a1+16,_BE),28):(d1=X.I16(a1+18,_BE),30),smp=d1,d1*=d2,d0+=d1,smpp=a2=a1+d0,a1=smpp,fmt<0&&(a1+=2),smpsz=2*X.I16(a1-8,_BE)+X.I32(a1-12,_BE),songsz=a2-a0,K=songsz+smpsz,1})()&&(ext=fmt<0?".MCMD":".SOG",sName="Jochen 'Mad Max' Hippel's module ("+ext+",.HIP)",sVersion="f."+fmt,bDetected=1,X.Sz()<K&&(sVersion+="!short"),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(G=0,X.c("6000")){if(G=2,(d1=X.I16(G,_BE))<=0||1&d1)return
if(G=d1+2,(G=4+X.fSig(G,20,"308141FA"))<4)return
if((d1=X.I16(G,_BE))<=0||1&d1)return
G+=d1}if(X.c("'TFMX'00",G)&&(d0=d1=2+X.I16(G+4,_BE)+X.I16(G+6,_BE)<<6,d0+=32,ptn=d2=X.I16(G+8,_BE)+1,d3=28*(X.I16(G+10,_BE)+1),d2*=X.I16(G+12,_BE),d0+=d2,d1+=d2+d3,txt=X.U8(G+4+d0)?X.SA(G+4+d0,24):"",k=X.I16(G+16,_BE),d2=k+1<<3,ins=X.I16(G+18,_BE),insip=G+d1+d2+32,!X.I32(insip+18,_BE))&&(d2=2*X.I16(insip+22,_BE))&&d2==X.I32(insip+22+30-4,_BE)){var s=0,e=0
for(Y=0;Y<ins;Y++){var t=X.I32(insip+30*Y+18,_BE),r=X.U16(insip+30*Y+22,_BE)
s<=t&&(s=t,e=r)}return smpp=insip+30*ins,K=smpp+s+2*e,1}})()&&(sName="Jochen 'Mad Max' Hippel's module (.HIP7,.S7G)",sVersion="7V",bDetected=1,X.c("'TFMX'")||(sVersion+="+replayer"),X.Sz()<K&&(sVersion+="!short"),X.isVerbose())&&(""!=txt&&sOptionT(txt),1<k&&sOption(k,"×"),sOption("ptn:"+ptn+" ins:"+ins+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(X.c("'COSO'")&&X.c("'TFMX'",32)&&X.I16(48,_BE)&&X.I16(64,_BE)){var s=X.I32(28,_BE)
if(!(s>X.Sz())){a2=X.I32(4,_BE),d6=d7=0,d0=X.I16(36,_BE)
do{if(a1>X.Sz())return}while(a1=X.I16(a2,_BE),a2+=2,226===X.U8(a1)&&(128&X.U8(a1+1)?d7++:d6++),0<=--d0)
return d7>=d6?void 0:(ptn=X.I16(40,_BE)+1,smp=X.I16(50,_BE),a0=X.I32(24,_BE)+10*smp,smpsz=X.I32(a0-10,_BE)+2*X.I16(a0-6,_BE),K=s+smpsz,k=X.I16(48,_BE),1)}}})()&&(sName="Jochen 'Mad Max' Hippel's module (.HIPC)",sVersion="packed",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){for(a0=a1=a4=d4=0,d1=128,d0=X.Sz(),bad=r="";d1;){if(a0>X.Sz()||a1>X.Sz())return
if(128!=d1&&(E=X.I16(a1,_BE),a1+=2,16890===E)&&0<=(d2=X.I16(a1,_BE))&&!(1&d2)&&(a0=a1+d2),X.c("'MMME'",a0)){d0=2
break}if(X.c("'TFMX'",a0)){if(512<=X.I16(a0+4,_BE))d0=0
else if(X.I16(a0+16,_BE)){for(d0=X.I16(a0+4,_BE),a1=a0+32,d6=d7=0;226===X.U8(a1)&&(128&X.U8(a1+1)?d6++:d7++),a1+=64,0<=--d0;);d0=d6>d7?2:5}else d0=0
break}if(X.c("'COSO'",a0)){if(!X.I16(a0+48))return
if(!X.I32(a0+24))return
if(X.c("'TFMX'",a0+32)){a2=a0+X.I32(a0+4,_BE),d6=d7=0,d0=X.I16(a0+36,_BE)
do{if(X.I16(a0+64,_BE)?(a1=a0+X.I16(a2,_BE),a2+=2):(a1=a0+X.I32(a2,_BE),a2+=4),a1>X.Sz())return}while(226===X.U8(a1)&&(128&X.U8(a1+1)?d7++:d6++),0<=--d0)
d0=d7<d6?4:2}else d0=X.c("'MMME'",a0+32)?2:0
break}d0-=2,d1--}if(2==d0){if(lsmp=X.c("'LSMP'",a0+28)?1:0,d0=X.Sz()-a0,d4=a0,songsz=smpsz=0,K=sz1=-1,X.c("'COSO'",a0)||X.c("'MMME'",a0+32)){if(sV="packed",a1=a0,d3=0,d3=6*(1+X.I16(a0+50,_BE)),d2=d3+X.I32(a0+24,_BE),(d3=0)<(d0=(d0-=d2)<0?28:d0))if(a1+=d2,128==(E=X.I16(a1,_BE))&&256==E){for(;d3=X.I16(a1,_BE),a1+=8,X.I16(a1,_BE)&&a1<X.Sz(););(d0-=d2)<0&&(d0=28)}else{for(E>>=8,G=a1+1,r=[];E&&G<X.Sz();)r.push(E),E=X.U8(G++)
r=decEncoding(r,CPAmiga,1,Chars0to1FLF)}if(songsz=d2,smpsz=d3,K=a0+d3+d2,r.length<3&&(r=""),sz1=r.length?K+r.length+1:K,100<(k=X.U16(a0+48,_BE)))return}else{if(sV="unpacked",d6=a0,d1=2,a2=a0,d1=2+X.I16(a0+4,_BE)+X.I16(a0+6,_BE)<<6,d2=(1+X.I16(a0+8,_BE))*X.I16(a0+12,_BE),d3=12*(1+X.I16(a0+10,_BE)),d1+=d2+d3,d2=2+X.I16(a0+16,_BE),d1+=6*(d2+X.I16(a0+18,_BE))+32,d2=32,d3=d7=0,(d0-=d1)<0)d0=28,bad=bad.addIfNone("!short")
else if(0<d0)if(a1=d1+a2,128===(E=X.I16(a1,_BE))||256===E){for(d7=a1;d3=X.I16(a1,_BE),a1+=8,X.I16(a1,_BE)&&a1<X.Sz(););(d0-=d3)<0&&(d0=28)}else{for(E>>=8,G=a1+1,r=[];E&&G<X.Sz();)r.push(E),E=X.U8(G++)
r=decEncoding(r,CPAmiga,1,Chars0to1FLF)}if(d0=d1,smpsz=d3,songsz=d1,K=a0+songsz+smpsz,sz1=""!=r?K+r.length+1:K,100<(k=X.U16(a0+16,_BE)))return}return 1}})()&&(sName="Jochen 'Mad Max' Hippel's Atari ST module (.HST,.SOC,.SOG)",bDetected=1,sVersion=sV,""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOptionT(r,'msg:"','"'),a="",lsmp&&(a=a.appendS("ext.samples"," ")),0<K&&(a=a.appendS("sz:"+outSz(K,sz1)," ")),smpsz&&(a=("smpsz:"+Hex(smpsz)).appendS(a," ")),1<k&&(a=("×"+k).appendS(a," ")),sOption(a)),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<=1338)&&1==X.U8(0)&&!(37<X.U8(1))&&(E=X.I16(2,_BE))&&!(128<E)&&!(63<(d1=X.U16(4,_BE)))){for(d=255&d1,G=6;G<134;)if(E=X.U8(G),G++,d<E)return
for(_=0,G=314;G<1338;G+=4){if((E=X.I16(G,_BE))<0)return
if(E){if([1712,1616,1524,1440,1356,1280,1208,1140,1076,1016,960,906,856,808,762,720,678,640,604,570,538,508,480,453,428,404,381,360,339,320,302,285,269,254,240,226,214,202,190,180,170,160,151,143,151,127,120,113].indexOf(E)<0)return
_++}}return _?1:void 0}})()&&(sName="Editeur Musical Sequentiel module (.EMS)",bDetected=1),!bDetected&&(function(){if(!(X.Sz()<1280)&&X.c("48E7..F0 41FA.... 4CD80600")){if(X.c("78",2)&&X.c("0C0000FF",12))sversion="strange"
else if(!X.c("00",2)||!X.fSig(12,576,"700033FC 000F00DF F09641FA"))return
return soptions="",X.c("4A44",12)?(sversion="type 1",X.isVerbose()&&0<=(G=X.fSig(0,128,"0C04.... 66..41FA"))&&(O="×"+(X.U16(G+2,_BE)+3))):X.c("4A00",12)?sversion="type 2":X.c("0C00",12)&&(sversion="type 3"),1}})()&&(sName='Darius "Mark II" Zendeh module (.DZ)',sVersion=sversion,sOptions=soptions,bDetected=1),(function(){if(X.c("41FA",4)&&!(X.Sz()<1280)){for(G=8,Y=288;E=X.c("E742",G),G+=2,!E&&--Y;);if(Y){for(;E=X.c("41FA",G),G+=2,!E&&--Y;);if(Y){for(a3=G,G+=X.I16(G,_BE),d5=X.I16(a3+2,_BE),Y=24;E=X.c("D1FA",a3),a3+=2,!E&&--Y;);if(Y)a5=a3,a3+=X.I16(a3,_BE)
else{if(14192==d5)return
d5=0,a5=a3-28,Y=16}for(;E=X.c("41FA",a5),a5-=2,!E&&--Y;);return Y}}}})()&&(_setResult("audio","Darius Zendeh's Mark II Sound System module (.MK2)","",""),bDetected=1),!bDetected&&(function(){if((X.isHeuristicScan()||X.c("'BeEp'"))&&(smp=X.U8(5))&&!(31<smp)&&!(0<X.U8(6+40*smp))){for(U=B=0;U<smp;U++){if(!(j=X.U32(38+40*U,_BE))||j>X.Sz())return
B+=j}return 255<(ord=X.U16(6+40*smp,_BE))?void 0:(ptns=6+40*smp+2,!(255<(ptn=X.U16(ptns+6*ord,_BE)))&&(ptn0=X.U32(ptns+2,_BE),ptns+=6*ord,trkdtsz=X.U32(ptns-4,_BE)-ptn0,addlns=4*X.U8(ptns-5)*8,K=ptns+2+2*ptn+B+trkdtsz+addlns,1))}})()&&(sName="JamCracker/Pro module (.JAM,.JC)",bDetected=1,bad="",X.isHeuristicScan()&&(K+19==X.Sz()&&(sVersion="v1.0a (Xag)",X.isVerbose()&&sOptionT(X.SA(K,19)),K+=19),X.c("'BeEp'")||(bad=bad.addIfNone("!badsig"))),""!=(bad=K>X.Sz()?bad.addIfNone("!short"):bad)&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&X.isHeuristicScan()&&(function(){if(2==X.U16(0,_LE)&&X.c("00FF01FF02FF03FF04FF05FF06FF07FF08FF09FF0AFFFD00",54)&&!(!(seqt=X.U16(4,_LE))||seqt<30||seqt>=X.Sz()||!(inst=X.U16(6,_LE))||inst<=seqt||inst>=X.Sz())){for(ins=X.Sz()-inst>>4,mptn=65535,ch=0,trk=[],Y=0;Y<11;Y++)if(G=X.U16(10+2*Y,_LE),trk[Y]=G){if(ch++,G<=seqt||G>=inst)return
G<mptn&&(mptn=G)}for(ptn=mptn-seqt>>1,Y=0;Y<5;Y++)if(trk[Y]){if(G=X.U16(seqt+2*Y,_LE),65023!=X.U16(G-1,_LE))return
if(G<=seqt||G>=inst)return}return Y=X.U16(2,_LE),tmr=(1193810/(Y||65535)).toFixed(2),1}})()&&(sName="Johannes Bjerregaard Adlib module (.JBM)",bDetected=1,X.isVerbose())&&sOption("tmr:"+tmr+" ch:"+ch+" ptn:"+ptn+" ins:"+ins),!bDetected&&(function(){if(X.c("'SONG'",60)&&660<X.Sz())msmp=15
else{if(!(X.c("'SO31'",124)&&1204<X.Sz()))return
msmp=31}if(hdrp=4*msmp,smptp=hdrp+20,ordp=smptp+30*msmp,!(128<(ord=X.U8(ordp))||(E=X.U16(hdrp+4,_BE))<178)){for(tmp0=(1776930/E).toFixed(0),spd0=6,smp=smpsz=ic=0,smps=[],Y=0;Y<msmp;Y++){if(131072<(A=X.U32(4*Y,_BE)))return
for(smpsz+=A,A&&smp++,E=X.readBytes(smptp+30*Y,20),_=0;_<20;_++)E[_]&&E[_]<32&&ic++
if(128<=ic)return
""!=(E=decEncoding(E,CPAmiga)).trim()&&smps.push(E.trim()),smth=X.U16(smptp+30*Y+2,_BE)}return 1}})()&&(sName=15==msmp?"SoundFX module (.SFX)":"SoundFX 2 / MultiMedia Sound module (.MMS)",15==msmp&&(sVersion="v1.0-8"),bDetected=1,X.isVerbose())){for(G+=2,ptn=0,Y=ordp+2;Y<ordp+2+ord;Y++)(E=X.U8(Y))>ptn&&(ptn=E)
ptn++,K=ordp+130+1024*ptn+smpsz,31==msmp&&(K+=6),(lp=X.U8(ordp+1))>ord&&(sVersion=sVersion.appendS("malformed!badloop","/")),sOption("tmp0:"+tmp0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+(lp?" loop:"+lp:"")+" sz:"+outSz(K))}if(!bDetected&&(function(){if(fmt="",smp=smpp=0,K=-1,k=1,X.c("6000")){G=0,d1=3
do{if(!X.c("6000",G))return
if((E=X.I16(G+2,_BE))<=0||E%2)return}while(G+=4,d1--)
if(G=p0=6+X.I16(6,_BE),X.c("4A406B00",G)){if(!X.c("000641FA",G+4))return
if(G=(G+=8)+(X.I16(G,_BE)+4),!X.c("00017FFF",G))return
fmt="second"
var s=G=p0+8+X.I16(p0+8,_BE)
for(G+=8,k=0,d2=X.I32(G+10,_BE);G<X.Sz()&&d2==X.I32(G+10,_BE);)k++,G+=26
for(G=smpp=s+X.I32(s,_BE);G<X.Sz()&&(X.c("'FORM' 00?????? '8SVXVHDR'",G)&&(smp++,G+=4+X.I32(G+4,_BE)+2),!((G+=2)>=X.Sz())););if(G>X.Sz())return
if(K=G,G=s,d1=X.U32(G,_BE),(d2=X.U32(G+18,_BE))<=d1)G+=d1
else if(d3=d2-X.I32(G+22,_BE),35944==(K=d2+d3+G)&&--k,K>X.Sz())return}else{if(G-=4,X.c("C0FC",G))G+=2
else for(Y=0;Y<16&&G<X.Sz();Y++,G+=2)if(X.c("02800000",G)){if(!X.c("00FFC0FC",G+4))return
G+=8
break}if(G>X.Sz())return
for(mulu=X.I16(G,_BE),q=(G+=800)+900;G<X.Sz()&&!X.c("6AE064E0",G);)if((G+=2)===q)return
if(G>X.Sz())return
for(fmt="old",G=p0;G<X.Sz()&&(E=X.I16(G,_BE),G+=2,!(0<=E&&16634==(16634&E)&&(E=X.I16(G,_BE),G+=2,0<=E))););G+=E-2
for(k=(k=X.I16(G,_BE)-G)<mulu?1:Util.divu64(k,mulu);G<X.Sz()&&(X.c("'FORM' 0000???? '8SVXVHDR'",G)&&(smpp=smpp||G,smp++,G+=4+X.I32(G+4,_BE)+2),!((G+=2)>=X.Sz())););if(G>X.Sz())return
for(K=G,G=10+X.I16(10,_BE);G<X.Sz()&&(E=X.c("43FA",G),G+=2,!E););X.I16(G,_BE)
for(G+=2,d1=X.c("6000",12)?"7FFE":"7FFF";G<X.Sz()&&(E=X.c(d1,G),G+=2,!E););for(;G<X.Sz()&&(E=X.c("336C",G),G+=2,!E););X.I16(G+2,_BE)}}else if(X.c("0000 ???? 00017FFF")){var e=0
for(G=8;G<16;G+=2)if(E=X.I16(G,_BE)){if(E<0||E%2||!X.c("7FFF",E-2)&&!X.c("7FFE",E-4))return}else e++
if(1<e)return
if((G=2+X.I16(2,_BE))>X.Sz()||!X.c("'FORM' 00?????? '8SVXVHDR'",G))return
for(;G<X.Sz()&&(X.c("'FORM' 00?????? '8SVXVHDR'",G)&&(smp++,G+=4+X.I32(G+4,_BE)+2),!((G+=2)>=X.Sz())););if(G>X.Sz())return
K=G,fmt="harald"}else{if(512<(G=X.U16(0,_BE))||G<4||G%2)return
for(G+=2,Y=2;Y<G;Y+=2)if((E=X.I16(Y,_BE))<=0||E%2||!X.c("7FFF",E-2))return
fmt="latest",k=X.U16(0,_BE),G=smptp=X.U16(k+2,_BE),d3=X.U16(k,_BE),k>>=1,1==--k||!X.c("0000",d3-6)&&X.c("7F00",d3-4)||k--,smp0p=X.U16(G,_BE)
var t=hi=X.U24(smp0p+15,_BE)
for(smp=A=0;G<smp0p&&smp<128;){if(G>X.Sz())return
if(smp++,pp=X.U16(G,_BE),t>(sofs=X.U24(pp+15,_BE))&&(t=sofs),hi<=sofs&&(hi=sofs,A=X.I16(pp+18,_BE),X.c("'BODY'",sofs-8)||(sofs=X.U32(pp+20,_BE))>hi&&(hi=sofs,A=2*X.U16(pp+24,_BE))),hi>X.Sz())return
pp<smp0p&&(smp0p=pp),G+=2}X.c("'BODY'00'",t-8)&&(t=X.fSig("'FORM'00??????",t-150,t-20)),songsz=t,X.c("'BODY'00'",hi-8)?hi+=X.U32(hi-4,_BE):hi+=A<<1,K=hi}return 1})()&&(sName="Jesper Olsen's module (.JO)",sVersion=fmt,bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" sz:"+outSz(K))),!bDetected&&_s()&&(sName="Jason C. Brooke's module (.JB,.JCB)",sVersion=fmt,bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption(("new"==fmt?"wf.smp:"+smp:"steps:"+steps)+" syn.smp:"+synsmp+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("000003F3 00000000 00000003 00000000 00000002 ???????? 40?????? 00000001 000003E9")&&(twofiles=!1,G=48,d1=X.U32(20,_BE)&~(1<<30),X.U32(36,_BE)==d1)){if(X.c("60000016",40)){if(!X.c("0000ABCD",44))return}else G=24
if(48==G&&!X.c("B07C0000",64)||24==G){if(!X.c("41F90000 00004E75",G+16))return
twofiles=!0}for(G=64,smpp=0;!smpp&&G<X.Sz();)!(E=X.fSig(G,TOEOF,"'FORM'"))%2?smpp=E:G=Math.max(E+1,G+1)
if(!(smpp<0)){for(smp=0;G<X.Sz()&&X.c("'FORM' ???????? '8SVXVHDR'",G);)smp++,G+=4+X.U32(G+4,_BE)
return K=G,1}}})()&&(sName="Kris Hatlelid's module (.KH"+(twofiles?"+SONGPLAY":"")+")",bDetected=1,X.isVerbose())&&sOption("sz:"+outSz(K)),!bDetected&&(function(){if(!(X.Sz()<1537)&&97==X.U8(15)){for(U=0;U<15;U++)if(64<X.U8(54+32*U))return
for(trks=0,U=0;U<1024&&255!=(k_=X.U8(U+512));U++)k_>trks&&(trks=k_)
if(1024!=U&&0!=trks&&!(1536+192*trks+192>X.Sz())){for(U=0;U<=trks;U++)for(j=0;j<64;j++)if(36<X.U8(1536+192*U+3*j))return
for(B=smp=0,U=0;U<15;U++)(E=X.U16(52+32*U,_BE))&&smp++,B+=E
return K=192*(trks+1)+B+1536,1}}})()&&(sName="Jess D. 'Razmo' Skov-Nielsen's Kefrens Sound Machine module (.KSM)",bDetected=1,X.isVerbose())&&(sOptionT(X.SA(2,13)),sOption("trk:"+trks+(smp?" smp:"+smp:"")+" sz:"+outSz(K)),K>X.Sz())&&(sVersion="malformed!short"),!bDetected&&(function(){if(trk=X.U16(0,_BE),d2=X.U16(2,_BE),d3=X.U16(4,_BE),smp=X.U16(6,_BE),G=8,trk&&!(4<trk)&&d2&&d3&&smp){for(mp=0,trks=[],d1=trk;d1;d1--){if(E=X.U32(G,_BE),G+=4,E>>16||!E)return
trks.push(E),mp<E&&(mp=E)}for(;d2;d2--){if(E=X.I32(G,_BE),G+=4,E<=0||E%2)return
mp<E&&(mp=E)}for(d2=X.I32(G,_BE);d3;d3--){if(E=X.I32(G,_BE),G+=4,E<=0||E%2)return
mp<E&&(mp=E)}if((G+=12*smp)==d2){for(d2=15;d2;d2--,G+=16)if(!X.c("3F3F3F3F 3F3F3F3F 3F3F3F3F 3F3F3F3F",G))return
return 1}}})()&&(sName="Paul Robotham's module (.DAT+.SSD)",bDetected=1,X.isVerbose())&&sOption("trk:"+trk+" smp:"+smp),!bDetected&&X.isDeepScan()&&(function(){for(Y=0;Y<6;Y++)if(!(192<=X.U8(2*Y+1)<=255))return
if(!(135&(ptnsz=X.U8(12)))){for(ptn=-1,Y=0;Y<50;Y++){if(23<(l=X.U8(14+Y)))return
l>ptn&&(ptn=l)}if(ptn++,!((tempo=X.U8(64))<3||30<tempo)&&!(50<(loop=X.U8(65)))&&(ord=X.U8(67))&&!(50<ord)&&!((hss=X.U8(68))<2||56<hss)){for(bad=!1,smp=0,Y=0;Y<16;Y++){if(smpst=X.U16(90+16*Y+9,_LE),smplm=X.U16(90+16*Y+12,_LE),smplp=X.U16(90+16*Y+14,_LE),smpst>smplm||smpst<49152||smplm<49152)return
if((smplp<49152||smplp>smplm||smpst>smplp||49152<smplm&&smplm-smplp<6)&&(bad=!0,!X.isHeuristicScan()))return
smpst<smplm&&smp++}return 1}}})()&&(bDetected=1,sVersion="v1.x",bad&&(sVersion+="/malformed"),sName="Vasilii 'BACA' Pakhomov/LAVE's Digital Music Maker module (.DMM)",X.isVerbose())&&sOption("tempo:"+tempo+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" loop:"+loop),!bDetected&&(function(){if(!(X.Sz()<2978)&&(spd=X.U8(0),isWithin(spd,1,15))){for(ord=0,ptn=[],Y=0;Y<256;Y++)if(255!=(o=X.U8(1698+Y))){if(128<=o)return
Y>ord&&(ord=Y),ptn.indexOf(o)<0&&ptn.push(o)}if(ord++,ptn=ptn.length,nonz=!1,!((lp=X.U8(1))>ord)){for(smp=opl=smpsz=0,Y=0;Y<32;Y++){if(X.U8(2+13*Y+12)||X.U32(418+16*Y)||X.U8(930+13*Y+12))return
var s=X.U32(418+16*Y+4),e=X.U32(418+16*Y+8),t=X.U32(418+16*Y+12)
if(1048575<s)return
if(s&&t<1048575&&(s<t||t<e))return
if(_opl=!X.c("00000000 00000000 000000",1346+11*Y),240&X.U8(1346+11*Y))return
if(252&X.U8(1346+11*Y+5))return
if(252&X.U8(1346+11*Y+10))return
s&&(smp++,smpsz+=s),_opl&&opl++}for(bad=!1,ptnend=notes=0,Y=0;Y<128;Y++){if(G=2978+X.U32(1954+4*Y,_LE),M=X.U32(2466+4*Y,_LE),bad=bad||M<3||4096<M,16777215<G||X.Sz()<G+M)return
for(G+M>ptnend&&(ptnend=G+M),i=0;G<ptnend;){var r=X.U8(G++)
if(r<=12)G+=2,notes++
else if(32<=r&&r<=44)G++
else{if(64!=r){if(96==r)break
return}i+=X.U8(G++)}}if(64<i)return}return K=ptnend+smpsz,0<smp+opl}}})()&&(sName="Thomas 'Tran' Pytel's CDFM/Composer 670 module (.C67)",bDetected=1,bad&&(sVersion="malformed!badptn"),X.isVerbose())&&sOption("spd:"+spd+" ord:"+ord+(lp?" lp:"+lp:"")+" ptn:"+ptn+" smp:"+smp+" fm:"+opl+" notes:"+notes+" sz:"+outSz(K)),!bDetected&&(function(){if(X.c("6000.... 6000.... 6000")){if(a0=2+X.I16(2,_BE),X.c("48E77FFE E98841FA",a0))v=2
else{if(!X.c("48E740F0 4A006B0A",a0))return
v=3}return 1}})()&&(sName="Sean 'Odie' Connolly's module (.SCN)",sVersion="v"+v,bDetected=1),!bDetected&&(function(){if(d1="48E7FCFE",a0=0,X.c(d1))return!X.c("45FA",220)&&X.c("E9417000 41FA",4)&&(X.c(d1,148)||X.c(d1,164)||X.c(d1,168))&&(fmt=0,base=8)
if(X.c("2F0841FA")){if(a0=(a0+=4)+(X.I16(a0,_BE)+28),!X.c("45FA",a0+220))return}else if(X.c(d1,28)){if(a0+=28,!X.c("45FA",a0+220))return}else{if(X.c("6000")){if(!X.c("6000.... 6000.... 6000.... 6000.... 6000.... 6000.... 6000",4))return
if(X.c("6000",32)&&!X.c("6000",36))return
if(a0=14,a0+=X.I16(a0,_BE),X.c(d1,a0)){if(!X.c("45FA",a0+268)&&!X.c("E942",a0+274))return
if(a0+=4,!X.c("E9417000 41FA",a0))return
if(a0+=4,X.c(d1,a0+140)||X.c(d1,a0+156)||X.c(d1,a0+160))return fmt=0,base=a0,1}return(a0=26+X.I16(26,_BE),X.c(d1+"43FA",a0))?(fmt=1,base=a0,1):void 0}for(;!X.c("2F0841FA",a0+28)&&(a0+=2)<10;);if(10==a0)return
for(Y=76;!X.c(d1,a0)&&(a0+=2,--Y););if(!Y)return
if(!X.c("45FA",a0+268)&&!X.c("E942",a0+274))return}return a0+=4,X.c("E9417000 41FA",a0)&&(a0+=4,X.c(d1,a0+140)||X.c(d1,a0+156)||X.c(d1,a0+160))&&(fmt=0,base=a0,1)})()&&(sName="Martin Walker's Activision Pro module (.AVP)",sVersion="f."+fmt,bDetected=1,X.isVerbose())&&sOption(Hex(base),"base:"),!bDetected&&(function(){if(fmt=0,X.c("0002")&&!(1&X.U8(3)))for(;!(1&(E=X.I16(4,_BE)))&&!(1&X.I16(E))&&!((d0=X.I16(48,_BE))>X.Sz());){for(a1=2;a1<=46&&!(!(E=X.U16(a1,_BE))||1&E||E>X.Sz()||d0<=E);a1+=2);if(a1<48)break
fmt=3840==(3840&X.U16(E,_BE))?2:1
break}if(!fmt){if(X.I16(0,_BE)||X.I16(128,_BE)||!X.c("00000CBE",132)||!X.c("000308BE",3254)||!X.c("000309BE",3258))return
fmt=3}if(smpsz=smp=0,k=1,3==fmt){if((K=X.U32(2234,_BE)+2)<2236||K>X.Sz())return
for(t0=X.U32(0,_BE),Y=4;Y<128;Y+=4){if(t1=X.U32(Y,_BE),(E=t1-t0)<0)return
smpsz+=E,E&&smp++,t0=t1}if(smpsz+=128,7382==K&&19290==smpsz)k=16
else for(k=0,a1=1726;d0=X.U32(a1,_BE),a1+=4,65280!=X.U16(d0,_BE)&&(k++,a1<K););}else for(K=X.U16(48,_BE),a0=X.U16(12,_BE)+2,a1=X.U16(28,_BE),k=a1-a0>>1,Y=X.U16(2,_BE);Y<K-4;Y+=4)slen=X.U32(Y,_BE),smpsz+=slen,slen&&smp++
return 1})()){switch(fmt){case 1:sName="Jason Page's module (.JP)"
break
case 2:sName="Jason Page's module (.JPN)"
break
case 3:sName="Jason Page's old module (.JP)"}sVersion="f."+fmt,bDetected=1,X.isVerbose()&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" smp.sz:"+smpsz+" song sz:"+outSz(K)))}if(!bDetected&&(function(){if(a2=242,(X.c("0C40",a2)||(a2-=6,X.c("33C0",a2)))&&X.c("48E7FFFE 61064CDF 7FFF4E75",a2-12)&&!((a2=X.fSig(a2,65535,"6000")+2)<2)&&!(!(E=X.I16(a2,_BE))||E<0||1&E)&&(a2+=E,X.c("2D58",a2))){a2=0
var s=[],e=(t("48E7FFFE"),s.push(a2>>16),s.push(65535&a2),t("33FC0001"),a2+=4,rel=X.U32(a2,_BE),r("41F9"),s.push(a2>>16),s.push(65535&a2),d1=X.I32(a2,_BE),r("B1FC"),d0=X.U32(a2,_BE),k=d0=d0-d1>>4,r("41F9"),s.push(a2>>16),s.push(65535&a2),r("B1FC"),s.push(a2>>16),s.push(65535&a2),r("303C"),t("48E7FFFE ........ 6100"),s.push(a2>>16),s.push(65535&a2),r("41F9"),s.push(a2>>16),s.push(65535&a2),d2=X.U32(a2,_BE),r("B1FC"),d3=X.U32(a2,_BE),(d3=d4=d3-d2)%24)
if(d3=Util.divu64(d3,24),e){if(e=(d4+=4)%24,d4=Util.divu64(d4,24),e)return i("@d436 error 5"),0
if(d3=d4,X.c("4654443C",2008))for(a3=1904,d4=2;0<=d4;d4--)a3-=4,wpU32be(a3+4,rpU32be(a3))}if(s.push(d3>>16),s.push(65535&d3),r("4BF9"),d5=rpU32be(a2)-rel,a2>X.Sz())return i("@d464 a2 too high"),0
if(X.isDeepScan()){s.push(d5>>16),s.push(65535&d5),s.push(0),a5=20178,s.push(a5>>16),s.push(65535&a5),a3=(s[0]<<16)+s[1]
s:for(;a3<X.Sz();)switch(rpU16be(a3)){case 13294:case 13308:a3+=2
case 12345:case 13248:case 13249:case 15417:case 16889:case 17017:case 19065:case 19449:case 19961:case 21369:case 45564:a3+=2,(a3_=rpU32be(a3))>>16!=223&&(wpU32be(a3,a3_-rel),a3+=4)
break
case 13305:a3+=2,(a3_=rpU32be(a3))>>16==223||wpU32be(a3,a3_-rel),a3+=4,(a3_=rpU32be(a3))>>16!=223&&(wpU32be(a3,a3_-rel),a3+=4)
break
default:if((a3+=2)>=d5)break s}if(d4=d3,a2=(s[10]<<16)+s[11],a2=rpU32be(a2),a2_=rpU32be(a2)-rel,wpU32be(a2,a2_),d2=a2_,d5=a2_+2*rpU32be(a2+4),a2+=24,a2_=rpU32be(a2),128<(d3-=2))return i("@d51a badsmp:"+Hex(d3)),0
for(;0<=d3;)a2_-=rel,wpU32be(a2,a2_),d5<=a2_&&(d5=a2_+2*rpU32be(a2+4)),d2>a2_&&(d2=a2_),a2+=24,a2_=rpU32be(a2),d3--
if(s.push(a2>>16),s.push(65535&a2),a2=rpU32be((s[4]<<16)+s[5]),a3=(s[6]<<16)+s[7],a3_=rpU32be(a3),d3=Util.divu64(a3_-a2,24),s.push(d3),smp=d3+d4,d4=d3,a2_=rpU32be(a2),128<d4)return i("@d55e d4="+Hex(d4)+" > 80h"),0
for(;0<d4;)a2_-=rel,wpU32be(a2,a2_),d5<=a2_&&(d5=a2_+2*rpU32be(a2+4)),d2>a2_&&(d2=a2_),a2+=24,a2_=rpU32be(a2),d4--
for(a2>(s[19]<<16)+s[20]&&(s[19]=a2>>16,s[20]=65535&a2),d0<<=2,a2=rpU32be((s[2]<<16)+s[3]),a2_=rpU32be(a2),d3=0;4294967295!=a2_&&d3<a2_-rel&&(d3=a2_-rel),a2+=4,a2_=rpU32be(a2),d0--,a2<X.Sz()&&0<d0;);for(a3=(s[8]<<16)+s[9];a3<X.Sz()&&(a3+=2,!X.c("0C40",a3-2)););if(d0=rpU16be(a3+22),s.push(d0),d5>d3){if(d5>X.Sz())return i("@d5ce error 1C"),0
for(a2=d2,a1=(s[19]<<16)+s[20];rpU16be(a1)==d0&&(a1+=6,wpU32be(a1,rpU32be(a1)-rel)),(a1+=2)!=a2&&a1<X.Sz(););a2=d5}else{if(d3>X.Sz())return i("@d5ee error 1C"),0
for(a2=d3;a2<X.Sz()&&(a2+=2,!(0<=[148,254,255,510,511].indexOf(rpU16be(a2-2)))););for(a1=d5,a1_=rpU32be(a1);d0==a1_>>16&&(a1+=6,a1_=rpU32be(a1)-rel,wpU32be(a1,a1_),d3<a1_)&&(d3=a1_),a1+=2,a1_=rpU32be(a1),a2!=a1;);if(a2<=d3)for(a2=d3;a2<X.Sz()&&(a2+=2,!(0<=[148,254,255,510,511].indexOf(rpU16be(a2-2)))););}patchClear(),K=a2,smpsz=d5-d2,songsz=a2-smpsz}else patchClear()
return 1}function t(s){for(;a2<X.Sz()&&!X.c(s,a2);)a2+=2}function r(s){for(;a2<X.Sz()&&(a2+=2,!X.c(s,a2-2)););}function i(s){return 1<debug&&_log("MikeDavies: "+s),patchClear(),!1}})()&&(sName="Mike Davies module (.MD)",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),X.isDeepScan())&&sOption("smp:"+smp+" songsz:"+Hex(songsz)+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K)),!bDetected&&(function(){if(a0=0,(X.c("0016",a0+4)||(a0+=6,X.c("0016",a0+4)))&&X.c("0000 00000000 00000000 ....0020 ....0020",a0+6)&&!(1&(d1=X.U32(a0+14,_BE)))&&X.c("00000058",a0+d1)){for(a2=a0+88,a3=0,X.c("0016",10)&&(a3+=6),a3=(a3+=X.U32(a3+14,_BE))+X.U32(a3,_BE),a2=a3,k=smp=K=d0=d3=0;a3<X.Sz();){if(a3=a2,a2+=4,!X.U32(a3,_BE)||X.U8(a3)){a3=K,K+=X.U32(a3+2,_BE)
break}if((a3+=X.I32(a3,_BE))>K&&(K=a3),a3>X.Sz())return
if(X.c("FF02",a3+6))k++
else{if((E=X.U32(a3+2,_BE))>X.Sz())return
smp++,d3+=E,d0<E&&(d0=E)}}return a3>X.Sz()||K>X.Sz()?void 0:(smpsz=d3,1)}})()&&(sName="Michel Pernot's Silmarils module (.MOK)",bDetected=1,bad="",3<k&&(bad=bad.addIfNone("!subsongs>3")),""!=(bad=32<smp?bad.addIfNone("!smp>32"):bad)&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K))),!bDetected&&(function(){if(!((E=X.U32(0,_BE))<112||1&E)&&X.c("FFFF FFFFFFFF",E-6)){for(K=E,smp=0,G=4;G<100;G+=12){if(1&(E=X.U32(G,_BE))||E&&E<112||K<E)return
E&&smp++}if(smp){for(;G<112;G+=4)if((E=X.U32(G,_BE))<112||1&E||K<E)return
return X.c("FFFF FFFFFFFF",G+E-6)?(smpsz=X.U32(100,_BE),G=116+smpsz,1):void 0}}})()&&(sName="GT Game Systems module (.DUX)",bDetected=1,X.isVerbose())&&(ord=1+Util.div64(X.U32(104,_BE)-smpsz,60),smpsz-=112,sOption("ord:"+ord+" smp:"+smp+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'buz2'0200")&&(gvol=X.F32(8),isWithin(gvol,0,2))&&(bpm=X.U32(12),isWithin(bpm,10,200))&&(startpos=X.U32(16),ord=X.U32(20)+1,!(startpos>=ord||1<(looping=X.U8(24))))){for(nV=X.U16(6),G=156,K=-1,bad="",maxptn=maxtrk=64,maxtml=128,ptn=X.U32(G),trk=X.U32(G+4),G+=8,1<=nV&&(maxptn=X.I32(G),maxtrk=X.I32(G+4),maxtml=X.I32(G+8),G+=12),G+=16*maxptn+maxtrk*maxtml,trks=[],Y=0;Y<64;Y++)""!=(E=X.SA(G,64).trim())&&trks.push(E),G+=64
for(ptns=[],Y=0;Y<64;Y++)""!=(E=X.SA(G,64).trim())&&ptns.push(E),G+=64
if(ins=X.U32(G),!((G+=4)>X.Sz())){for(inss=[],totalops=0,Y=0;Y<ins;Y++){""!=(E=X.SA(G,128).trim())&&inss.push(E)
var s=X.U32(G+388)
totalops+=s,G+=9232+552*s}return(K=G)>X.Sz()&&(bad=bad.addIfNone("!short")),1}}})()&&(sName="Buzzic module (.buz2)",bDetected=1,sVersion="v2."+nV.padStart(2,"0"),X.isVerbose())&&sOption("bpm:"+bpm+" trk:"+trk+" ptn:"+ptn+" ins:"+ins+" g.vol:"+Math.round(100*gvol)+"% ops:"+totalops+" sz:"+outSz(K)),!bDetected&&(function(){if(X.c("000200")&&X.c("FF000F",X.U16(4,_BE)+1)){for(K=X.U16(16,_BE)+2,Y=10,oldp=X.U16(8,_BE);Y<32;Y+=2)if(16!=Y){if((G=X.U16(Y,_BE))<=oldp||G+1>X.Sz())return
if(!X.c("FF",G+1))return
oldp=G}return 1}})()&&(sName="Infogrames (RobHubbard2) module (.DUM&.INS)",bDetected=1,X.isVerbose())&&sOption(outSz(K),"sz:"),!bDetected&&(function(){if(X.c("6000")&&!((d2=X.U16(2,_BE))<=0||d2%2)){for(a1=2,a0=4,Y=0;Y<3;Y++){if(!X.c("6000",a0))return
if(E=X.U16(a0+2,_BE),a0+=4,E<=0||E%2)return}if(a1+=d2,X.c("6000",a0)){for(Y=0;Y<3;Y++){if(!X.c("6000",a0))return
if(E=X.U16(a0+2,_BE),a0+=4,E<=0||E%2)return}if(X.c("6000",a0))return}else{if(!X.c("6100",a1))return
a1+=4}return X.c("41F9",a1)?(a1+=6,!!X.c("43F9",a1)):void 0}})()&&(sName="M.Cannon & J.Dunn's Special FX module (.JD)",bDetected=1),!bDetected&&(function(){if(!(X.Sz()<2300)&&(X.c("00000000")||X.c("0101")||X.c("00000101")||X.c("6000"))){for(var s=0,e=140,t=X.Sz()-4;s<X.Sz()&&!X.c("00090800",s);)if(e==(s+=2))return
if(X.c("01120900",s+74)||X.c("02240A00",s+148)||X.c("00090800",s+222)||X.c("01120900",s+296)||X.c("02240A00",s+370)){for(s=e+1860;s<X.Sz()&&!X.c("0EF80E10",s);)if(t<=(s+=2))return
K=-1
for(var r,i,e=0,n=0;e<X.Sz()&&(d0-=2,e+=2,!X.c("E740",e-2)););for(k=X.U16(e-12,_BE),r=e-4+X.U16(e-4,_BE);e<X.Sz();){if(X.c("101A234A",e))e+=10
else if(X.c("4880D040",e))break
e+=2}for(i=e-2+X.U16(e-2,_BE);e<X.Sz()&&!X.c("08C70007",e);)e+=2
if(!((t=e)>=X.Sz())){for(;0<t&&(t-=2,!X.c("41FA",t)););for(;e<X.Sz();){if(X.c("41F9",e)){t=X.U16(e+2,_BE)
break}if(E=X.c("41FA",e),e+=2,E){t=e+X.U16(e,_BE)
break}}for(;e<X.Sz()&&!X.c("08870002",e);)e+=2
for(t=e+6,X.c("41F9",t-2)?n=t=X.U16(t,_BE):t+=X.U16(t,_BE);e<X.Sz()&&!X.c("08C70002",e);)e+=2
for(t=e+=10,X.c("41F9",t-2)?t=X.U16(t,_BE):t+=X.U16(t,_BE);e<X.Sz()&&(E=X.c("41FA",e),e+=2,!E););var t=e+X.U16(e,_BE),a=0
for(bad="";e<X.Sz();){if(X.c("0EF80E10",e)){a=1
break}if(X.c("7000101A",e))break
e+=2}if(!a){for(t=e-2+X.U16(e-2,_BE);e<X.Sz();){if(X.c("0EF80E10",e)){a=1
break}if(E=X.c("41FA",e),e+=2,E)break}t=e,e+=X.U16(e,_BE)}if(a||e>X.Sz()&&(bad=bad.addIfNone("!short"),a=2),!(a=a||(K=e,n)?a:1))for(;t<X.Sz()&&(X.c("41FA",t)&&(K=e=t+2+X.U16(t+2,_BE)+14),X.c("110010",t));)t+=2
return 2!=a&&(0<(d0=i-r)&&(d0>>=3),0<d0)&&(k=d0),1}}}})()&&(sName="Special FX ST module (.DODA)",bDetected=1,""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(1<k&&sOption(k,"×"),-1!=K)&&sOption(outSz(K),"sz:"),bDetected||(a0=d1=16+X.U16(2,_BE)+X.U16(6,_BE)+X.U16(10,_BE)+X.U16(14,_BE))>X.Sz()||a0%2||(a0+=X.U16(a0,_BE))%2||!X.c("005800B0",a0+4)||(sName="Tronic Delta Packer module (.DP)",bDetected=1,sOption("in:TronicTracker(?)")),!bDetected&&(function(){if(X.U16(0)&&(smp=X.U8(2))&&!((ord=X.U8(3))<2||!(d2=smpsz=X.U32(4,_BE))||d2%2||d2>X.Sz()||524288<d2||131072<(d3=X.U32(8,_BE)))){for(a0=12,k=0,Y=ord-1;Y;Y--){if((d4=X.I32(a0,_BE))<0||131072<d4||d4%2)return
X.U8(a0+4)||k++,a0+=6}if(X.c("00000000 0000",a0)){for(a0+=6,d3<<=2,a0+=d3,a2=a0+18*smp,s=0;a0<X.Sz()&&a0<a2;){if(d1=X.I32(a0+2,_BE),!isWithin(d1,0,d2))return
if((d0=X.U32(a0+12,_BE))>d2)return
if(64<X.U8(a0+16)||X.U8(a0+17))return
a0+=18}return a0>X.Sz()||d2!=d0+X.I32(a0-16,_BE)?void 0:(K=a0+smpsz,1)}}})()&&(sName="Andrew Bailey & David Hanlon's Digital Sonix & Chrome module (.DSC)",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("ord:"+ord+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("00000000 0000000 0000")){if((E=X.U16(164))===X.U16(168)&&E===X.U16(172)&&E===X.U16(176)&&0<(E=X.I16(160,_BE))&&!(E%2)&&X.c("00B400B6",E))fmt=1,G=166
else if((E=X.U16(516))===X.U16(520)&&E===X.U16(524)&&E===X.U16(528)&&0<(E=X.I16(512,_BE))&&!(E%2)&&X.c("02140216",E))fmt=-1,G=518
else{if(!((E=X.U16(514))===X.U16(518)&&E===X.U16(522)&&E===X.U16(526)&&0<(E=X.I16(516,_BE)))||E%2||!X.c("FFEC",E-2)&&!X.c("FFE8",E-2))return
fmt=0,G=516}for(mp=0,a3=0,Y=0;Y<4;Y++)E=X.U16(G,_BE),mp<E&&(mp=E),G+=4
for(a3+=mp,mp=X.U16(a3-2,_BE);a3<X.Sz()&&(E=X.U16(a3,_BE),a3+=2,E!=mp););if(smpp=a3,isWithin(smpp,1024,16384)){for(a3=1==fmt?X.I16(170,_BE):0==fmt?X.I16(516,_BE):X.I16(522,_BE),ord=0;a3<X.Sz()&&(E=X.U16(a3,_BE),a3+=2,E!=mp);)ord++
if(isWithin(ord,1,128)){for(Y=G=smp=smpsz=0;Y<16;Y++)G+=2,1!=fmt&&(G+=20),(E=X.U16(G,_BE))&&(smpsz+=E,smp++),G+=8,1!=fmt&&(G+=2)
return smpsz<<=1,smp&&isWithin(smpsz,8192,131072)?(K=smpp+smpsz,1):void 0}}}})()&&(sName="Paul Shields' module (.PS)",sVersion="f."+fmt,bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" smp:"+smp+" smpsz:"+Hex(smpsz)+" sz:"+outSz(K)),!bDetected&&(function(){if(!(X.Sz()<863)&&isWithin(X.U32(0),196608,262144)&&X.c("'Tempo'00",182)&&isWithin(X.U16(44),1,48)&&isWithin(X.U16(46),1,16)&&isWithin(X.U16(48),16,80)&&isWithin(X.U16(50),32,80)&&isWithin(X.U8(52),0,1)&&!(1<(mode=X.U8(53)))){for(bpm0=X.F16(197),q=!0,ch=voices=X.U8(53)?9:11,ev=X.U16(199),Y=mclk=0,G=54;Y<45;Y++,G+=2)Y<11&&(X.U16(G)||ch--,mclk=Math.max(mclk,X.U16(G)))
for(Y=54;Y<76&&q;Y+=2)4351<X.U16(Y)&&(q=!1)
for(;Y<144&&q;Y+=2)511<X.U16(Y)&&(q=!1)
if(q){for(G=203+6*X.U16(201),mtln=mdur=notev=insev=volev=pitev=0,Y=0;Y<voices;Y++){if(G+=15,dur=0,tln=X.U16(G),G+=2,tln)for(;dur+=X.U16(G+2),G+=4,notev++,dur<tln&&G<X.Sz(););tln>mtln&&(mtln=tln),dur>mdur&&(mdur=dur),G+=15,insev+=E=X.U16(G),G+=2+14*E+15,volev+=E=X.U16(G),G+=2+6*E+15,pitev+=E=X.U16(G),G+=2+6*E}return K=G,1}}})()&&(sName="Ad Lib's AdLib Visual Composer pianoroll (.ROL)",bDetected=1,X.isVerbose())&&("\\roll\\default"!=(_=X.SA(4,40))&&sOption(_),sOption("ch:"+(ch!=voices?ch+"/":"")+voices+" rhythm:"+X.U16(44)+"/"+X.U16(46)+" bpm0:"+bpm0.toFixed(1)+" len:"+mdur+" notes:"+notev+" ins.ev:"+insev+" ins.ev:"+insev+" vol.ev:"+volev+" pitchev:"+pitev+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<428)&&X.c("'GYMX'")){for(Y=4;Y<424;Y++)if(isWithin(X.U8(Y),1,10)||isWithin(X.U8(Y),14,31))return
return(unpsz=X.U32(424))<=2&&parseMDGYM(428,X.isDeepScan()?BCParseToEoF:BCParseToReasonable)<=0?void 0:1}})()&&(sName="Sega Genesis/Mega Drive YM2612 chiptune (.GYM)",bDetected=1,unpsz<=2&&(sVersion=sVersion.append("unpacked")),X.isVerbose())&&(sOptionT(X.SC(4,32,"CP1252")),sOptionT(X.SC(36,32,"CP1252"),"for: "),sOptionT(X.SC(68,32,"CP1252"),"at: "),sOptionT(X.SC(100,32,"CP1252"),"emu: "),sOptionT(X.SC(132,32,"CP1252"),"by: "),sOptionT(X.SC(164,256,"CP1252")),2<unpsz)&&sOptionT(X.U32(424),"unp.sz:"),!bDetected&&(function(){if(!(!X.c("6000.... 6000.... 6000")||(G=base=a6=X.I16(2,_BE)+2)<=0||G%2||(playp=X.I16(6,_BE)+6)<=0||playp%2)){for(p1=G+30;G<p1&&!X.c("47FA",G-2);G+=2);if(!(G>=p1)){var s=G
for(E=Math.min(X.Sz(),131072);G<E&&!X.c("4E75",G-2);G+=2);if(!(G>=X.Sz()||E<=G)&&(fmt="old",X.c("177C0000",G-8)&&(fmt="new",G-=6),X.c("00BFE001",G-6))){if(G=base,k=1,d0=0,X.c("1740",G+6)||X.c("1740",G+4)){for(;G<X.Sz()&&!X.c("47FA",G-2);G+=2);G+=X.I16(G,_BE),a6=G}else do{if(X.c("3C00",G)){for(a3=a6=(G=s)+X.I16(G,_BE);G<X.Sz()&&!X.c("7600",G-2);G+=2);for(a3+=X.I16(G-4,_BE)+3,d0=7;d0&&(X.U16(a3,_BE)||1!=X.U8(a3+2));a3+=3,k++,d0--);d0=X.U8(a3-1)
break}for(X.c("4A00",G+40)&&(k++,d0=X.I16(G+52,_BE));G<X.Sz()&&!X.c("47FA",G-2);G+=2);}while(G+=X.I16(G,_BE),a6=G,0)
for(ord=d0,G=12;G<X.Sz()&&!X.c("1743",G-2);G+=2);for(a3=a6,pos=a6+X.I16(G,_BE),G=12;G<X.Sz()&&!X.c("5203",G-2);G+=2);if(K=-1,patchable=X.c("177C",G+10)){if(a2=base,a3+=X.I16(G+2,_BE),ord=ord||X.U8(a3),"new"==fmt){for(G=base+2;G<X.Sz()&&!X.c("41EB",G-2);G+=2);for(a3=a6,a6+=X.I16(G,_BE),a3+=X.I16(G+4,_BE),a6+=X.I32(a3,_BE),smpip=a6,songsz=a6+X.I16(a3-2,_BE),smp=smpsz=0;a6<X.Sz()&&(d3=X.I32(a6,_BE),a6+=4,0<d3&&(A=X.U16(a6,_BE)<<1)&&(smp++,d3+=A,smpsz<d3)&&(smpsz=d3),!((a6+=6)>=songsz)););}else{for(G=base+2;G<X.Sz()&&!X.c("3D70",G-2);G+=2);for(;G<X.Sz()&&!X.c("D5F0",G-2);G+=2);for(a3=a6+X.I16(G-4,_BE),a6+=X.I32(a3,_BE),E=a6,a6+=X.U16(G-18,_BE),smpip=a6,smp=smpsz=0,a3=a6+128,d1=32;d1;d1--)1<X.U16(a3,_BE)&&(smp++,A=X.U16(a3,_BE)<<1,d3=A+X.I32(a6,_BE),smpsz<d3)&&(smpsz=d3),a6+=4,a3+=2
songsz=E+X.U16(G-8,_BE)}K=songsz+smpsz}return 1}}}})()&&(sName="Sound Master module (.SM,.SMPRO,.SM3)",sVersion=fmt,bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),patchable)&&sOption("ord:"+ord+" sz:"+outSz(K)),!bDetected&&(function(){if(!(X.Sz()<1728||2097152<(K=X.U32(0,_BE))||K%2||(d2=X.U32(4,_BE))>K||d2%2||1023&(d2-=704)||(ptn=d2>>=10,d2--,G=444,X.U8(G))||(ord=d1=X.I8(G+1))<0)){for(G+=4,d2<<=10,d3=0;d1;G+=2,d1--){if(1023&(E=X.I16(G,_BE)))return
d3<E&&(d3=E)}if(d2==d3){for(smp=0,G=14;G<448;G+=14)X.U16(G,_BE)&&smp++
return 1}}})()&&(sName="Tom Pakarinen's Tomy Tracker module (.SG)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&(function(){if((X.c("0003",32)||X.c("0002",32)&&!X.U32(28,_BE))&&!X.U16(16,_BE)&&!((G=X.I16(18,_BE))<0||G%2)&&X.c("FFFF0000 0400",G+62)&&(F=X.readBytes(0,16),!(charStat(F,1).indexOf("allasc")<0||(F=decEncoding(F,"CP437"),a2=0,a3=K=64+X.U32(16,_BE),d2=X.U32(20,_BE),K+=d2,a4=K,d1=X.U32(24,_BE),K+=d1+X.U32(28,_BE),d2-=1024,X.Sz()<K)))){for(ord=d1=Util.divu64(d1,12),d1--,voc=0,d3=6;d3;d3--,a4+=2)for(G=a4,d4=ord;d4;d4--,G+=12)if(X.U16(G,_BE)){voc++
break}for(a3+=1084,smp=d3=0;d2>d3;)d4=X.U32(a3,_BE),a3+=d4,d3+=d4,smp++
if(k=1,nv=0,sv="",X.U32(28,_BE))switch(K){case 95960:k=2
case 54544:sv="v4.0"
break
case 81906:sv="v5.0"}else switch(K){case 126446:k=3,sv="v3.0"
break
case 136612:k=2,sv="v3.0"
break
case 154704:k=2
case 103808:sv="v3.2"}for(G=64,ptn=0;G<576;G+=2)X.U16(G,_BE)&&ptn++
return 1}})()&&(sName="Holger Gehrmann's Soundcontrol module (.SCT)",sVersion=sv,bDetected=1,X.isVerbose())&&(sOptionT(F),1<k&&sOption(k,"×"),sOption("ch:"+voc+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(2097152<(K=X.U32(0,_BE))||K>X.Sz())){for(lastfound=!(k=16),G=19;4<=G;G--){if(15<(E=X.U8(G)))return
!lastfound&&E&&(k=G-4,lastfound=!0)}for(m=X.U32(20,_BE),G=24;G<276;G+=4){if(2097152<(E=X.U32(G,_BE))||K<E)return
m>E&&(m=E)}if(276==m){if(X.isDeepScan()){for(G=276,smp=smpsz=0;G<K-8;){for(;q=X.fSig(G,K-8-G,"84"),(G=q<0?K:q+q%2)<K&&!q%2;);G<K&&(d1=X.U8(G+1))<=31?(d1>>=2,smpp[d1]=G,d4=X.U16(G+2,_BE)<<1,smpsz+=d4-38,smp++,G+=d4):G+=2}if(!smp||32<smp)return}return 1}}})()&&(sName="Soundfactory module (.PSF)",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption((X.isDeepScan()?"smp:"+smp+" smpsz:"+Hex(smpsz)+" ":"")+"sz:"+outSz(K))),!bDetected&&(function(){if(ord=X.U8(0),ptn=X.U8(1),ins=X.U8(2),!(!ptn||204<ptn||31<ins)){var s=[],e=[]
for(G=3,mptn=mins=0,Y=0;Y<ptn;Y++){if(203<(E=X.U8(G++)))return
mptn<E&&(mptn=E),s.indexOf(E)<0&&s.push(E)}if(ins)for(Y=0;Y<ins;Y++){if(!isWithin(E=X.U8(G++),1,31))return
mins<E&&(mins=E),e.indexOf(E)<0&&e.push(E)}if(rptn=s.length,rins=e.length,mptn++,!(rptn!=ptn||ins&&rins!=ins)){for(o=0;o<ord;o++)for(Y=0;Y<9;Y++)if(s.indexOf(X.U8(G++))<0)return
for(notes=0,Y=0;Y<64*ptn;Y++,G+=3){var t=X.U8(G)>>4,r=(1&X.U8(G))<<4|X.U8(G+1)>>4
if(12<t||r&&e.indexOf(r)<0)return
12!=t&&notes++}return G+=11*ins,"v1.3"==(sv=X.c("'B.J.'",G)?(G+=4,"v1.8"):"v1.3")&&100<ptn?void 0:(K=G,1)}}})()&&(sName="SPP's Beni Tracker (Adlib) module (.PIS)",sVersion=sv,bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+(ptn!=mptn?"/"+mptn:"")+" ins:"+ins+(ins!=mins?"/"+mins:"")+" notes:"+notes+" sz:"+outSz(K)),!bDetected&&(function(){for(G=0;G<16;G+=4)if(!X.c("6000",G)||(E=X.U16(G+2,_BE))>X.Sz()||E%2)return
if(E=X.I16(6,_BE)+6,X.c("49FA....1940....4E75 43FA.... 49FA.... 41FA.... 45FA",E)&&X.c("'FORM'66",E+28)&&(E=X.I16(10,_BE)+10,X.c("49FA....4CFA00FF",E))&&X.c("103A.... 660C 1940.... 6100... .6000",E+10)&&X.c("2A4C DAD8 22CD 2A4C DAD8 22CD 2A4C DAD8 22CD",E+52)&&(E=X.I16(14,_BE)+14,X.c("70002A7C 00DFF0A8 3A803B40",E))&&X.c("1A801B40 00011B40 00021B40",E+26)&&(initp=X.I16(2,_BE)+2,X.c("43FA....49FA....41FA....45FA",initp))&&X.c("'FORM'66",initp+18)){for(a0=0,G=initp;G<initp+16;G+=2)if(X.c("41FA",G-2)){a0=G+X.I16(G,_BE)
break}if(!((G=6+X.fSig(initp,4096,"E7404281"))<6)){for(E=G+X.I16(G,_BE);G<X.Sz()&&!X.c("41FA",G-2);G+=2);for(;G<X.Sz()&&!X.c("D08043FA",G);G+=2);for(G=(G+=4)+X.I16(G,_BE),k=G-E>>3,G=a0,smp=0;G<X.Sz();smp++){if(!X.c("'FORM'........'8SVXVHDR'",G)){X.U32(G)||(G+=4)
break}G+=8+X.U32(G+4,_BE)}return K=G,smp?1:void 0}}})()&&(sName="Steve Barrett's module (.SB)",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<1024)&&X.c("49FA",16)){for(G=0;G<16;G+=4)if(!X.c("6000",G)||(E=X.I16(G+2,_BE))<=0||E%2)return
if(X.c("48E7FFFE 4DFA.... 51EE.... 41FA",G=2+X.I16(2,_BE))&&X.c("48E7FFFE 4DFA.... 4A2E.... 6700.... 70033F00 49FA",G=6+X.I16(6,_BE))&&X.c("48E7FFFE 4DFA.... 51EE.... 6100",G=10+X.I16(10,_BE))){for(G=16;G<X.Sz()&&!X.c("40C2",G);G+=2);for(;G<X.Sz()&&!X.c("41FA",G);G+=2);for(K=(G+=6)+X.I16(G,_BE),G+=2;G<X.Sz()&&!X.c("43E9",G-2);G+=2);if(K+=X.I16(G,_BE)<<1,!((a3=K)>X.Sz())){for(a0=0;G<X.Sz()&&(X.c("206C0032",G)&&(a0+=8,G+=4),!X.c("08380007",G)&&!X.c("08390007",G));G+=2);for(;G<K&&!X.c("40C1",G);G+=2);for(G+=4;G<X.Sz()&&!X.c("4CDF",G);G+=2);for(;G<K&&86!=X.I32(G,_BE);G+=2);for(k=0;G<a3;G+=2)70==X.I16(G,_BE)&&k++
return k>>=2,1}}}})()&&(sName="Illusions/Microdeal Quartet module (SQT.)",sVersion="PSG synth",bDetected=1,X.isVerbose())&&(1<k&&sOption(k,"×"),sOption(outSz(K),"sz:")),!bDetected&&(function(){if(G=modp=smp=synsmp=ord=ptn=0,k=1,sv=bad="",owner=[],X.c("'SOARV1.0STBL'")){if(k=X.I32(12,_BE),spd0=X.U8(17),ptnlen0=X.U8(19),pst0=X.U16(20,_BE),ped0=X.U16(22,_BE),lp0=X.U16(24,_BE),irqps0=X.U16(26,_BE),!isWithin(spd0,2,16)||!isWithin(irqps0,16,120)||pst0>ped0||lp0>ped0)return
if(G=16+12*k,!X.c("'OVTB'",G))return
if(ord=X.I32(G+4,_BE),ped0>ord)return
if(G+=24+(ord<<4),!X.c("'NTBL'",G-16))return
if(ntbl=X.I32(G-12,_BE),G+=ntbl<<2,!X.c("'INST'",G-8))return
for(ptn=Util.divu64(ntbl,16),ins=X.I32(G-4,_BE),inss=[],Y=0;Y<ins;Y++,G+=152)X.U16(G,_BE)?synsmp++:smp++,E=X.readBytes(G+122,30,!0),""!=(E=decEncoding(E,CPAmiga).trim())&&inss.push(E)
if(!X.c("'SD8B'",G))return
for(n=smp=X.I32(G+4,_BE),G+=8+38*smp,pp=G,G+=smp<<2;n--&&G<X.Sz();pp+=4)G+=X.U32(pp,_BE)
if(!X.c("'SYWT'",G))return
if(synsmp=X.I32(G+4,_BE),G+=8+(synsmp<<7),!X.c("'SYAR'",G))return
if(E=X.I32(G+4,_BE),G+=8+(E<<7),!X.c("'SYAF'",G))return
if(E=X.I32(G+4,_BE),G+=8+(E<<7),!X.c("'EDAT'",G))return
K=G+24,sv="song"}else{if(X.c("4EFA")){if((E=X.I16(2,_BE))<=0||E%2)return
if(!X.c("48E7FFFE 41FA",E+2)||!X.c("201045F0 0800228A 43FA",E+14)||!X.c("20280004 45F00800 228A 43FA",E+26))return
if((G=X.I16(E+8,_BE))<=0||G%2)return
modp=G+=E+8,sv="+replayer"}else sv="pure"
if(G+40>X.Sz()||!X.c("00000028",G))return
if(spd0=X.U16(G+40,_BE),irqps0=X.U16(G+50,_BE),lp0=X.U16(G+48,_BE),!isWithin(spd0,2,16)||!isWithin(irqps0,16,120))return;(1==(k=(X.I32(G+4,_BE)-40)/12)||X.I16(G+60,_BE)<0)&&(k=1)
var s=[0]
for(Y=0;Y<8;Y++){if(E=X.I32(G,_BE),G+=4,E<=0||E%2||E<s[s.length-1])return
s.push(E)}var e=s[2],t=s[3],r=s[4],i=s[5],n=X.I32(modp+E,_BE)
if(ord=Util.div64(t-e,16),ptn=Util.div64(r-t,64),ins=Util.div64(i-r,152),(G=modp+E)>X.Sz())return
for(Y=0;Y<ins;Y++)X.U16(modp+r+152*Y,_BE)?synsmp++:smp++
if(smp!=n&&(bad=bad.addIfNone("!inconsistentsmpcnt"+n)),G+=4,smp)for(pp=G,G+=n<<2;n--&&G<X.Sz();pp+=4)G+=X.U32(pp,_BE)
if(!X.c("'deadbeef'",G)){if(!X.isHeuristicScan())return
bad=bad.addIfNone("!badeof")}for(n=G+=12,lim=Math.min(G+1024,X.Sz());G<lim&&!(255==(_=255^X.U8(G++))||isWithin(_,0,8)||isWithin(_,11,12)||isWithin(_,14,31));)10==_&&(_=32)==owner[owner.length-1]||owner.push(_)
32==owner[owner.length-1]&&owner.pop(),K=G,255!=_&&G-n!=80&&(bad=bad.addIfNone("!badinfo"))}return bpm0=(15*irqps0/spd0).toFixed(1),owner=decEncoding(owner,CPAmiga).trim(),1})()&&(sName="BrainTrace Design's Sonic Arranger module (.SA"+("pure"==sv?",.LION":"")+")",bDetected=1,sVersion=sv,""!=bad&&(sVersion=sVersion.appendS("malformed:"+bad,"/")),X.isVerbose())&&(1<k&&sOption(k,"×"),""!=owner&&sOption(addEllipsis(owner,160,128),'info:"','"'),sOption("bpm0:"+bpm0+(ord?" ord:"+ord:"")+(lp0?" lp0:"+lp0:"")+(ptn?" ptn:"+ptn:"")+(ins?" ins:"+ins:"")+(smp?" wf.smp:"+smp:"")+(synsmp?" syn.smp:"+synsmp:"")+" sz:"+outSz(K))),!bDetected&&X.c("'SASI'00000000000100")&&(sName="BrainTrace Design/MEDIA Verlags Sonic Arranger synth instrument",bDetected=1),!bDetected&&(function(){if(!(X.Sz()<1700)){for(G=0;G<40&&!X.c("02390001",G);G+=2);if(40!=G&&(G+=8,X.c("66..4E75",G++))&&!((E=X.I8(G++))<=0)){if(G+=E,X.c("4A39",G))for(l=4;l--;G+=18)if(!X.c("4A39",G))return
if(X.c("78001839",G)){for(l=G;;){if((G=X.fSig(l,262144,"1400E302"))<0)return
if(!(Y%2))break
l=G+1}for(var s=X.U32(G+6,_BE);;){if((G=X.fSig(l,262144,"03580328"))<0)return
if(!(Y%2))break
l=G+1}for(s-=G,G=0;G<262144&&(!X.c("B23C00FF",G)&&!X.c("0C0100FF",G));G+=2);if(!(262144<=G)){for(;G<262144&&!X.c("267C",G-2);G+=2);if(!(262144<=G)){for(G+=4;G<262144&&!X.c("49F9",G-2);G+=2);if(!(262144<=G)){for(smpip=X.U32(G,_BE)-s,G+=4;G<262144&&!X.c("0026267C",G-4);G+=2);if(!(262144<=G)){for(G+=4;G<262144&&!X.c("23F4",G);G+=2);if(!(262144<=G)){for(subsongp=X.U32(G-4,_BE)-s,G+=6,k=0,G=subsongp;G<262144&&12==X.U8(G+16)&&(E=X.U32(G,_BE),X.U32(G+4,_BE)!=E||X.U32(G+8,_BE)!=E||X.U32(G+12,_BE)!=E);G+=18)k++
for(l=X.U32(smpip,_BE)-s,Y=smpip+4,a=l-Y>>2,d0=X.I32(l+4,_BE),d1=2*X.I16(l+2,_BE)+d0,smp=1;Y<l;Y+=4)E=X.U32(Y,_BE)-s,(d3=X.U32(E+4,_BE))&&(d4=2*X.I16(E+2,_BE)+d3,d3<d0&&(d0=d3),d4>d1&&(d1=d4),smp++)
for(songsz=d0-s,K=d1-s,Y=0;Y<262144&&!X.c("4E75",Y-2);Y+=2);return specialmsg="",2!=(d1=X.U8(Y-3))&&(specialmsg=X.SC(Y,256,CPAmiga)),1}}}}}}}}})()&&(sName="Jeroen 'WAVE' Tel's module (.JT)",bDetected=1,X.isVerbose())&&(""!=specialmsg&&sOption(specialmsg),1<k&&sOption(k,"×"),sOption("smp:"+smp+" songsz:"+Hex(songsz)+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<=306||!X.c("'AN COOL'")||127<(ptn=X.U32(8,_BE))||15<(tmp0=X.U8(12))||X.U8(13)||(ord=X.I8(142))<=0)){if("!"==X.SA(7,1))fmt=0
else{if("."!=X.SA(7,1))return
fmt=1}if(ptnp=fmt?306:272,!((smpp=ptnp+512*ptn)+212>X.Sz())&&X.c("FFFFFFFF00000000",smpp+204)&&212==X.U32(smpp+68,_BE)){for(smp=0,G=smpp+72,Y=0;Y<16&&G<X.Sz();Y++)1!=X.U32(G,_BE)&&smp++
return K=smpp+X.U32(smpp,_BE),1}}})()&&(sName="Anders 'AN Cool' Nilsson's TCB Tracker module (.TCB)",sVersion="f."+fmt,bDetected=1,X.isVerbose())&&sOption("tempo:"+tmp0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&(function(){if(!(!X.c("'if'")&&!X.c("'JN'")||X.Sz()<2033||64<(smp=X.U8(110))||128<(ptn=X.U8(111))||128<=(lp=X.U8(112)))){for(ic=0,Y=2;Y<109;Y++)if(isWithin(X.U8(Y),1,31)&&40<++ic)return
for(Y=ord=0;Y<128;Y++){if((o=X.U8(113+Y))>=ptn&&o<254)return
if(o<128&&!(E=X.U8(241+Y)))return
if(15<E||64<=X.U8(369+Y))return
o<254&&ord++}if(K=497+25*smp+1536*ptn,!(X.Sz()<K)){for(Y=rsmp=0;Y<smp;Y++)if(A=X.U32(510+25*Y),slps=X.U32(514+25*Y),slpe=X.U32(518+25*Y),A){if(rsmp++,67108864<A)return
if([1048575,15794175,4294967295].indexOf(slps)<0&&slps>A)return
if([1048575,15794175,4294967295].indexOf(slpe)<0&&(slpe>A||slpe<slps))return
K+=A}return 1}}})()&&(sName=(X.c("'if'")?"Renaissance's Composer 669":"Jason 'JsNO BAR----' Nunn's UNIS 669 Composer")+" module (.669)",bDetected=1,X.isVerbose())&&(E=(E=(E=X.SC(2,36,"CP850").trim()).appendS(X.SC(38,36,"CP850").trim()," ")).appendS(X.SC(74,36,"CP850").trim()," "),sOption(E),sOption("ord:"+ord+(lp?" loop:"+lp:"")+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<44712)&&(susv=0,ins=X.U32(18944))&&!(128<ins)&&(trk=X.U32(36492))&&!(64<trk)&&(ptn=X.U32(36484))&&!(128<ptn)&&!((gvol=X.F32(36500))<0||2<gvol||(gvol=Math.round(100*gvol)+"%",(bpm=X.U8(36504))<10&&susv++,start=X.U32(36508),(ord=X.U32(36512))||susv++,127<ord)||start>ord||(ord++,1<(floop=X.U32(36516))))){for(Y=0;Y<ins;Y++){if((G=148*Y)+147>Math.min(X.Sz(),18944))return
if(1<X.U8(G+128))return
var s=X.I8(G+129)
if(s||susv++,s<0&&-s>trk)return
var e=X.I8(G+130)
if(e<0&&-e>trk)return
e=X.U8(G+131)
if(127<e)return
var t=X.I8(G+132)
if(t<0&&-t>trk)return
e||susv++,t||susv++
e=X.U8(G+133)
if(3<e)return
e<3&&!s&&susv++
t=X.I8(G+134)
if(0<s&&s+t<=0)return;(t<-32||64<t)&&susv++
e=X.U8(G+135),s=X.U8(G+136),t=X.U8(G+137)
if(s<e||t<s||127<t||127<e||127<t)return
e||s||t||susv++
e=X.I8(G+138)
if(e<0&&-e>trk)return
s=X.I8(G+140)
if(s<0&&-s>trk)return
t=X.U8(G+141),e=X.U8(G+142),s=X.U8(G+143)
if(127<t||127<e||127<s)return
t=X.I8(G+144)
if(t<0&&t>trk)return
e=X.I8(G+145)
if(e<0&&e>trk)return
s=X.U8(G+146),t=X.U8(G+147)
if(127<s||127<t||!t&&s||t&&t<=s)return}if(!(susv>3*ins)){for(Y=18948;Y<20100;Y++)if(127<X.U8(Y))return
for(Y=20100;Y<28292;Y++)if(X.U8(Y)>ptn)return 0<debug&&_logIt("@"+Hex(Y)+": bad ptn"),0
return isAllZeroes(28292,8192)?1:void 0}0<debug&&_logIt("data too suspicious")}})()&&(sName="Buzzic module (.BUZ)",sVersion="v1.0",bDetected=1,sOption("trk:"+trk+" ord:"+ord+(start?" (from "+start+")":"")+" ptn:"+ptn+" ins:"+ins+" bpm:"+bpm+" gvol:"+gvol+" sz:44712")),!bDetected&&X.isDeepScan()&&(function(){if(!(X.Sz()<45224)&&(susv=0,ins=X.U32(19456))&&!(128<ins)&&(trk=X.U32(37004))&&!(64<trk)&&(ptn=X.U32(36996))&&!(128<ptn)&&!((gvol=X.F32(37012))<0|1.91<gvol||(gvol=Math.round(100*gvol)+"%",(bpm=X.U8(37016))<10&&susv++,start=X.U32(37020),(ord=X.U32(37024))||susv++,127<ord)||start>ord||(ord++,1<(floop=X.U32(37028))))){for(Y=0;Y<ins;Y++){if((G=152*Y)+151>Math.min(X.Sz(),18944))return
if(1<X.U8(G+128))return
var s=X.I8(G+129)
if(s||susv++,s<0&&-s>trk)return
var e=X.I8(G+130)
if(e<0&&-e>trk)return
e=X.U8(G+131)
if(127<e)return
var t=X.I8(G+132)
if(t<0&&-t>trk)return
e||susv++,t||susv++
e=X.U8(G+133)
if(3<e)return
e<3&&!s&&susv++
t=X.I8(G+134)
if(0<s&&s+t<=0)return;(t<-32||64<t)&&susv++
e=X.U8(G+135),s=X.U8(G+136),t=X.U8(G+137)
if(s<e||t<s||127<t||127<e||127<t)return
e||s||t||susv++
e=X.I8(G+138)
if(e<0&&-e>trk)return
s=X.I8(G+140)
if(s<0&&-s>trk)return
t=X.U8(G+141),e=X.U8(G+142),s=X.U8(G+143)
if(127<t||127<e||127<s)return
t=X.I8(G+144)
if(t<0&&t>trk)return
e=X.I8(G+145)
if(e<0&&e>trk)return
s=X.U8(G+146),t=X.U8(G+147)
if(127<s||127<t||!t&&s||t&&t<=s)return
if(118<X.I8(G+148))return
e=X.I8(G+149),t=X.I8(G+151)
if(e<0&&-e>trk||t<0&&-t>trk)return}if(!(susv>3*ins)){for(Y=19460;Y<20612;Y++)if(127<X.U8(Y))return
for(Y=20612;Y<28804;Y++)if(X.U8(Y)>ptn)return 0<debug&&_logIt("@"+Hex(Y)),0
return isAllZeroes(28804,8192)?1:void 0}0<debug&&_logIt("too suspicious")}})()&&(sName="Buzzic module (.BUZ)",sVersion="v1.1",bDetected=1,sOption("trk:"+trk+" ord:"+ord+(start?" (from "+start+")":"")+" ptn:"+ptn+" ins:"+ins+" bpm:"+bpm+" gvol:"+gvol+" sz:45224")),!bDetected&&(function(){function s(s,e){return-1<debug&&_l2r("mdx",s,e),!1}if(!(X.Sz()<42||(da1=X.fSig(0,Math.min(1024,X.Sz()),"0D0A1A"))<0)){for(crypt=X.c("00'crypt'",da1-6),sus=crypt?-10:0,Y=0;Y<da1;Y++)if(X.U8(Y)<32&&[0,9,27,10,26].indexOf(X.U8(Y))<0)return
if(F=X.SC(0,da1,"SJIS"),!((G=X.fSig(da1+3,Math.min(15,X.Sz()-da1),"00"))<0)){if(pdxfn=da1+3!=G?X.SC(da1+3,G,"SJIS"):"",ofs=++G,bad="",comp=!1,ch=9,"LZX "==X.SA(ofs+4,4)&&(lzxsz=X.U32(ofs+18,_BE)))return comp=!0,(K=X.fSig(ofs+22,TOEOF,"'[ LZX.X ]'0D0A0000")+13)<13&&(bad=bad.addIfNone("!short")),usedch=ch,bpm0=notes=vdn=0,1
if(crypt?vd=-1:((vd=X.U16(ofs,_BE)+ofs)>X.Sz()&&(vd=-1,sus++),241!=X.U8(vd-2)&&241!=X.U8(vd-3)&&(vd=-1,sus++),G+=2),X.c("0014",G)||X.c("0022",G)){if(m=Math.min(1048575,X.Sz()-2),crypt)K=X.fSig(ofs+20,m,"'protected by cryptmdx v1.00 (c)1995 H.Yano'00")+43,usedch=ch,bpm0=0
else{var e=chn=oldchn=X.U16(G,_BE)+ofs
if(!isWithin(chn,G,m))return s(chn,"!chn"+Hex(G)+"-"+Hex(m)),0
ch=(chn-ofs-2)/2,usedch=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],notes=vdn=mp=0,vds=[]
var t=bpm0=-1,r=[],i=[0,1]
if(X.isDeepScan())for(visited=[],Y=0;Y<m;Y++)visited[Y]=0
for(U=1;U<=ch;U++){(G+=2)>mp&&(mp=G),U==ch?chn=isWithin(vd,oldchn+2,X.Sz())?vd:m:(chn=X.U16(G,_BE)+ofs,isWithin(chn,oldchn+2,m)&&(241==X.U8(chn-2)||241==X.U8(chn-3))||(chn=oldchn,usedch[U-1]=!1),isWithin(chn,oldchn+2,m)||(s(chn,"!p="+Hex(G)+",ch["+U+"] not between "+Hex(oldchn+2)+" and "+Hex(m)),sus+=2),241!=X.U8(chn-2)&&241!=X.U8(chn-3)&&(bad=bad.addIfNone("!badchnend@"+Hex(chn-2)+"="+Hex(X.U24(chn-3,_BE))),X.isDeepScan()||sus++))
var n=clk=0
if(X.isDeepScan())for(t=oldchn,stop=!1;!stop&&t!=chn&&t<m;){visited[t]=1,t>mp&&(mp=t)
var a=X.U8(t++)
if(a<128)clk+=a+1
else if(a<=223)n++,notes++,usedch[U-1]=!0,clk+=X.U8(t++)+1
else switch(a){case 255:bpm0<0&&(bpm0=X.U8(t)),t++
break
case 254:p=X.U8(t),b=X.U8(t+1),isYM2151Reg()?8==p&&200&b?(n++,notes++,usedch[7&b]=!0):isWithin(p,96,127)&&(i[0]=!0):(sus++,bad=bad.addIfNone("!OPMreg@"+Hex(t-2))),t+=2
break
case 253:E=X.U8(t++),vds.indexOf(E)<0&&vds.push(E)
break
case 252:t++
break
case 251:E=X.U8(t++),isWithin(E,22,127)&&(bad=bad.addIfNone("!FB@"+Hex(t-2)+"="+Hex(E)),sus++),i[0]=1
break
case 250:case 249:case 247:case 238:case 232:break
case 248:(E=X.U8(t++))||(bad=bad.addIfNone("!F8@"+Hex(t-1)),sus++)
break
case 246:X.U8(t+1)?t++:t+=2
break
case 245:246!=X.U8(t+X.I16(t,_BE)-1)&&(bad=bad.addIfNone("!F5→F6@"+Hex(t)),sus++),t+=2
break
case 244:245!=X.U8(t+X.I16(t,_BE)+1)&&(bad=bad.addIfNone("!F4→F5@"+Hex(t)),sus++),t+=2
break
case 243:case 242:t+=2
break
case 241:X.U8(t)?(r[U]=t+2+X.I16(t,_BE),isWithin(r[U],e,m)||(bad=bad.addIfNone("!loopOOB@"+Hex(t-1)),sus++),visited[r[U]]?(stop=!0,t+=2):t=r[U]):t++,0<vd&&vd<t&&(vd=t)
break
case 240:case 239:case 237:t++
break
case 236:case 235:case 234:128!=(E=X.U8(t++))&&129!=E&&(t+=4)
break
case 233:t++
break
case 231:1!=X.U8(t)&&(bad=bad.addIfNone("!E7@"+Hex(t-1)),sus++),t+=2
break
default:stop=!0,bad=bad.addIfNone("!unk"+Hex(a)),sus++}t>mp&&(mp=t)}if(n&&(usedch[U-1]=!0),oldchn=chn,8<sus)return s(mp,sus+" "+bad),0}if(X.isDeepScan()&&"1"!=i[0]&&(bad=bad.addIfNone("!novol"),sus++),8<sus)return s(mp,sus+" "+bad),0
if(0<vd&&vd<chn&&(bad=bad.addIfNone("!ins@"+Hex(vd)+"<chn@"+Hex(chn)),sus++),X.isDeepScan()){vdn=vds.length,vds.sort(function(s,e){return s-e})
var o=[]
for(m=Math.min(X.Sz(),vd+6912),G=0<vd&&vd<chn?chn:0<vd?vd:G;vds.length&&G<m&&vds.length&&(!(192&X.U8(G+1)||240&X.U8(G+2))&&o.indexOf(E=X.U8(G))<0);G+=27)o.push(E),vds=vds.filter(function(s,e,t){return s!=X.U8(G)}),G>mp&&(mp=G)
o.sort(function(s,e){return s-e}),vds.length&&(bad+="!missingInst"+outArray(vds,16)),K=mp+27}K=X.isDeepScan()?mp:-1,vd==X.Sz()&&(K=vd)}return 1}}}})()&&(sName="Konami's X68k Music Data eXtended module (.MDX)",bDetected=1,""!=pdxfn&&(sVersion=sVersion.appendS("+ "+pdxfn," ")),9<ch&&(sVersion+="#EX-PCM"),comp&&(sVersion=sVersion.appendS("compressed","/")),crypt&&(sVersion=sVersion.appendS("cryptmdx","/")),bad.length&&(sVersion=sVersion.appendS("malformed"+bad+(sus?"/sus"+sus:""),"/")),X.isVerbose())){for(sOption(addEllipsis(F),'"','"'),ch=0,Y=0;Y<16;Y++)usedch[Y]&&ch++
crypt?sOption("sz:"+outSz(K)):sOption("ch:"+ch+" bpm0:"+(bpm0<0?"default":bpm0)+(notes?" notes:"+notes:"")+(vdn?" ins:"+vdn:"")+(0<K?" sz:"+outSz(K):""))}if(!bDetected&&Os()&&(sName="Fred & Julien Clermonte's Fred Editor module (.FRED,.FRD)",sVersion="final",bDetected=1,""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("tempo:"+spds.sort().join("-")+(smp?" smp:"+smp:"")+(syn?" syn:"+syn:"")+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'AMF'")){var s=X.U8(3)
if((1==s||isWithin(s,8,14))&&(G=s<9?4:36,smp=X.U8(G),ord=X.U8(G+1),trk=X.U16(G+2),ch=9<=s?X.U8(G+4):16,smp)&&ord&&trk&&(G+=9<=s?5:4,!(s<12)||isWithin(ch,1,16))&&isWithin(ch,1,32)){G+=11<=s?12<=s?32:16:9<=s?16:0,spd0=13<=s?((tmp0=X.U8(G++))<32&&(tmp0=125),X.U8(G++)):(tmp0=125,6)
for(14<=s&&0,Y=0;Y<ord;Y++)14<=s&&(ord,X.U16(G),X.U16(G),G+=2),G+=2*ch
var e=!1
if(10==s){var t=G
for(Y=0;Y<smp;Y++)if(t+65<X.Sz()){if(1<X.U8(t)||X.U32(t+46)>smp||1048576<(A=X.U32(t+50))||64<X.U8(t+56)||X.U32(t+57)>A||X.U32(t+61)>A){e=!0
break}t+=65}}smps=[]
var r=0
for(rsmp=0,Y=0;Y<smp;Y++)(E=X.SC(G+1,32,"CP437").trim()).length&&smps.push(E),s<10?(r+=E=X.U16(G+50),E&&rsmp++,G+=59):(r+=E=X.U32(G+50),E&&rsmp++,G+=e?59:65)
for(trkc=0,Y=0;Y<trk;Y++)E=X.U16(G),G+=2,E>trkc&&(trkc=E)
for(Y=0;Y<trkc;Y++)E=X.U16(G),G+=3,E&&(G+=3*E+(1==s?3:0))
return K=G+r,1}}})()&&(sName="Digital Sound and Music Interface Advanced Music Format module (.AMF)",sVersion="v"+X.U8(3),bDetected=1,X.isVerbose())&&(sOptionT(X.SC(4,32,"CP437")),sOption(addEllipsis(smps.join(" "),160),'smp/msg:"','"'),sOption("ch:"+ch+" spd0:"+spd0+" tmp0:"+tmp0+" ord:"+ord+" trk:"+(trkc!=trk?trkc+"/":"")+trk+" smp:"+(rsmp==smp?"":rsmp+"/")+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(X.c("'SAdT'")&&isWithin(nV=X.U8(4),1,9)){var s
switch(nV){case 1:s=7
break
case 2:s=6
break
case 3:s=6
break
case 4:s=14
break
case 5:0
case 6:s=142
break
case 7:s=200
break
case 8:s=152
break
case 9:s=184}for(G=5+31*(8&s?15:11),Y=0,inst=[];Y<29;Y++)""!=(E=X.SC(G+1,X.U8(G),"CP437").trim())&&inst.push(E),G+=17
G+=3
var e=X.readBytes(G,128)
if(G+=128,1&s&&(G+=127),isWithin(ptn=X.U16(G),1,64)&&(G+=2,isWithin(ord=X.U8(G++),1,128))){for(Y=rptn=0;Y<ord;Y++)e[Y]+1>rptn&&(rptn=e[Y]+1)
if(e=void 0,!(rptn>ptn||(lp=X.U8(G++))>=ord)){if(bpm=X.U16(G),G+=2,4&s&&(bpm=5*bpm/2),128&s&&(G+=512),16&s&&(G+=576),32&s?(actch=X.U16(G)<<16,G+=2):actch=-1,trk=0,2&s)for(;trk<ptn&&G<X.Sz();)G+=2880,trk++
else if(64&s)for(;trk<ptn&&G<X.Sz();)G+=1728,trk++
else for(;trk<576&&G<X.Sz();)G+=192,trk++
return K=G,1}}}})()&&(sName=nV<8?"Surprise! AdLib Tracker module (.SAT)":"Surprise! AdLib Tracker 2 module (.SA2)",sVersion="v"+nV,bDetected=1,X.isVerbose())&&(sOptionT(addEllipsis(inst.join(" "),160),'ins/msg:"','"'),sOption("bpm:"+bpm+(0<=actch?"ch:"+actch:"")+" ord:"+(lp?lp+"-":"")+ord+" ptn:"+(rptn!=ptn?rptn+"/":"")+ptn+(trk!=ptn?" trk:"+trk:"")+" sz:"+outSz(K))),!bDetected&&Bs()){switch(sName="Chris Hülsbeck's The Final Musicsystem eXtended module (TFX.,.TFM,MDAT.+SMPL.,MDST.+SMPL.)",bDetected=1,tp){case"1.5":sVersion="v1.5"
break
case"pro":sVersion="Professional"
break
case"7v":sVersion="7 voices"}tfmxst&&(sVersion="ST "+sVersion),pt<ptn&&(sVersion+="/malformed!badptn"),X.isVerbose()&&(sOptionT(F),1<k&&sOption(k,"×"),sOption(album,"in: "),sOptionT(by,"by: "),0<=flag5&&sOption(flag5,"flag5:"),"(Empty)"==cmt&&(cmt=""),sOption(addEllipsis(cmt,160),'msg:"','"'),sOption("ord:"+ord.join("+")+" ptn:"+ptn+(ptn!=pt?"/"+pt:"")+" ins:"+(128<ins?"128/":"")+ins+" sz:"+outSz(K)))}if(!bDetected&&(function(){if((X.c("'P22A'")||X.c("'P30A'")||X.c("'P40A'")||X.c("'P40B'")||X.c("'P41A'"))&&(ptn=X.U8(4),smp=X.U8(6),volofs="41A"==X.SA(1,3)?32:34,!(127<ptn||!smp||31<smp))){for(Y=0;Y<smp;Y++){if(!isWithin(X.U16(volofs+16*Y,_BE),1,64))return
if(32==volofs&&X.U16(volofs+2+16*Y,_BE)%74)return}for(Y=smpsz=0;Y<smp;Y++){if(!(A=X.U16(24+16*Y,_BE)<<1)||65534<A||X.U16(30+16*Y,_BE)<<1>A+2)return
smpsz+=A}if(!(smpsz<=4)){ord=X.SA(1,1)<"4"?(X.U8(5)>>1)-1:X.U8(5),G=16+16*smp
var s=X.U32(8,_BE),e=X.U32(12,_BE),t=X.U32(16,_BE),r=0
if(G!=e&&(s-=r=e-G,e-=r,t-=r),isWithin(s,G,X.Sz())&&isWithin(e,G,X.Sz())&&isWithin(t,G,X.Sz())){for(Y=G=0;Y<smp;Y++){if(32==volofs&&1110<X.U16(volofs+2+16*Y,_BE))continue;(Q=X.U32(20+16*Y,_BE))>G&&(G=Q-r,A=X.U16(24+16*Y,_BE))}return K=4+t+G+(A<<1),1}}}})()&&(sName="Jarno 'Guru' Paananen's The Player module (."+X.SA(0,2)+"X,."+X.SA(0,4)+")",sVersion="v"+X.SA(1,1)+"."+X.SA(2,2),bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&Vs()&&(sName="Jarno 'Guru' Paananen's The Player module (.P"+sv[0]+"X,.P"+sv[0]+sv[2]+"A)",sVersion="v"+sv+"A",bDetected=1,dtsmp&&(sVersion=sVersion.appendS("deltasmp","/")),pksmp&&(sVersion=sVersion.appendS("packedsmp","/")),X.isVerbose())&&sOption("ord:"+ord+" ptn:"+(mptn!=ptn?mptn+"/":"")+ptn+" smp:"+smp+(0<notes?" notes:"+notes:"")+" sz:"+outSz(smpp+smpsz)),!bDetected&&(function(){if(!(X.Sz()<6800)){var s=X.I32(46,_BE)
if(isWithin(s,2,67108864)&&!(s%2)&&X.I32(0,_BE)-s==64){for(G=4,Y=0,d4=64;Y<4;Y++,G+=4)if(d4+=1024,X.I32(G,_BE)-s!=d4)return
for(Y=0;Y<3;Y++,G+=4)if(d4+=256,X.I32(G,_BE)-s!=d4)return
for(smp=X.U8(35),K=smp-1,smpsz=-1,G=68;G<4160;G+=4)(E=X.U32(G-4,_BE)-s)>K&&(K=E)
if(!(((K+=64)-6800)%3)){if(k=11792==K?5:10112==K?3:1,ptn=Util.divu64(Util.divu64(K-6800,3),X.U8(41)+1),bad="",1024<ptn&&(bad=bad.addIfNone("!badptn")),31<smp)bad=bad.addIfNone("!badsmp")
else for(Y=0,G=5360;Y<smp;Y++,G+=48)smpsz+=X.U16(G,_BE)
return d1=256+X.U8(33)-X.U8(34)+1,d1*=2+X.U8(44),d2=d1,d1*=X.U16(42,_BE),d3=Util.divu64(14318==K?715904:709376,X.U8(41)+1),d1=Util.divu64(d1,d3),dur=secondsToTimeStr(d1),1}}}})()&&(sName="Thomas Hermann's module (.THM+.SMP)",bDetected=1,bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(1<k&&sOption(k,"×"),sOption("len."+dur+" ptn:"+ptn+" smp:"+smp+" smpsz:"+smpsz+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<26243)&&isWithin(X.U32(0),3456,3457)&&(ptn=X.U32(4))&&(k=X.U32(8))&&(ins=X.U32(12))&&isAllZeroes(16,36)){for(mbpm=400,Mbpm=ch=smp=0,ord=[],titles=[],s=0,G=52;s<k&&G<X.Sz();s++,G+=16564){for(Y=G+64;Y<G+80;Y++)if(1<X.U8(Y))return
if(!isWithin(bpm=X.U32(G+80),10,300))return
if(mbpm>bpm&&(mbpm=bpm),Mbpm<bpm&&(Mbpm=bpm),!isWithin(X.U8(G+84),0,3))return
if((startpos=X.U32(G+88))>(endpos=X.U32(G+96)))return
if((looppos=X.U32(G+104))>endpos)return
if(!isWithin(E=X.U16(G+146),1,16))return
if(ch<E&&(ch=E),!isWithin(delay=X.U16(G+148),2e3,6e4))return
if(!isWithin(amp=X.U16(G+166),20,999))return
if(X.isDeepScan())for(o=G+180;o<G+16564;o+=4)if(X.U16(o)>=ptn||!X.U16(o+2)||-121&X.U16(o+2))return
"Empty"!==(E=X.SC(G+114,32,"CP1250"))&&""!==E.trim()&&titles.push(E.trim()),ord.push(endpos)}for(G+=64*ptn*5,Y=0;Y<ptn&&G<X.Sz();Y++)G+=4+X.U32(G)
for(Y=0;Y<ins&&G<X.Sz();Y++,G+=8712){if([1234,1235].indexOf(X.U16(G))<0)return
if(16<X.U16(G+34)||!isWithin(X.U16(G+36),1,256))return
if(255<X.U16(G+38)||16<X.U16(G+40)||32<X.U16(G+42))return
if(15<X.U16(G+46)||16<X.U16(G+48)||64<X.U16(G+50))return
X.U32(G+512)&&smp++,(E=X.U32(G+516))&&(G+=E)}return G>X.Sz()?void 0:(G+=256,1)}})()&&(sName="Reinier 'Rhino' van Vliet's Jaytrax/Syntrax module (.JXS)",sVersion="v."+X.U32(0),bDetected=1,X.isVerbose())&&(1<titles.length?sOption(addEllipsis(titles.join("/"),192),"×"+k+" subsongs:"):(titles.length&&sOption(titles[0]),1<k&&sOption(k,"×")),ord=1<k?ord.join("+"):(startpos?startpos+"~":"")+(looppos>startpos?"("+looppos+"-)":"")+endpos,sOption("ch:"+ch+" bpm:"+mbpm+(mbpm!=Mbpm?"-"+Mbpm:"")+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" smp:"+smp+" sz:"+outSz(G))),!bDetected&&(function(){if(33==X.U8(0)&&128==X.U8(9)&&(ord=X.U16(1))&&(ins=X.U16(3))&&(smp=X.U16(5))&&!(smp>ins)&&(ptn=X.U16(7))&&isWithin(mvol=X.U8(10),1,32)&&isWithin(spd=X.U8(11),1,32)&&isWithin(tmp=X.U8(12),32,160)&&!(charStat(X.readBytes(13,26),1).indexOf("allxsc")<0)){for(G=39;G<103;G++)if(64<X.U8(G))return
for(G=167;G<167+ord;G++)if(255!=X.U8(G)&&X.U8(G)>=ptn)return
if(255==X.U8(G-1)){var s
for(rins=0,rsmp=0,bad="",Y=0;Y<ins&&G<X.Sz();Y++){if(["I","i"].indexOf(s=X.SA(G++,1))<0)return
if("I"===s){if(128<X.U8(G+2))return
for(G+=0<=X.I8(G+5)?244:6,l=3;l;l--)if(X.U8(G++)){if(X.U8(G+1)>X.U8(G+2)||X.U8(G+3)>X.U8(G+4))return
G+=5+3*X.U8(G)}rins++}}for(Y=smpsz=0;Y<smp&&G<X.Sz();Y++){if(s=X.SA(G++,1),["S","s"].indexOf(s)<0)return
if("S"==s){if(64<X.U8(G)||64<X.U8(G+2))return
X.U8(G+1)
var e=X.I32(G+3),t=X.U32(G+7),r=X.U32(G+11),i=X.U32(G+14),n=X.U32(G+19),a=X.readBytes(G+32,13)
if(charStat(a,1).indexOf("allxsc")<0)return
switch(decEncoding(a,CP437)){case"909OH.WAV":e=3424
break
case"909SD.WAV":e=3413
break
case"CRASH.WAV":e=16098}if(e<t||e<r||e<i||e<n||r<t||n<i)return
smpsz+=e,G+=45,rsmp++}}for(Y=0;Y<ptn&&G<X.Sz();Y++){if(s=X.SA(G++,1),["P","p"].indexOf(s)<0)return
if("P"==s){var o=X.U16(G),p=X.U16(G+2)
if(!o||!p)return
G+=4+o}}for(l=X.U32(G),G+=4,Y=0;Y<l&&G<X.Sz()&&!(charStat(X.readBytes(G,8),1).indexOf("allxsc")<0);Y++,G+=268);return l=X.U8(G++),1}}})()&&(sName="Sahara Surfers' iXalance module (.IXS)",sVersion="unpacked",bDetected=1,bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOptionT(X.SA(13,26,"CP1250")),sOption("ord:"+ord+" ptn:"+ptn+" ins:"+(rins!=ins?rins+"/":"")+ins+" smp:"+(rsmp!=smp?rsmp+"/":"")+smp+" smpsz:"+smpsz+"s sz:"+outSz(G))),!bDetected&&(function(){var s=126
if(X.c("200D0A1A",122)){if(!X.c("0D0A",53)||!X.c("0D0A",108))return}else if(!X.c("20202020",122))if(X.c("04C50964c504641A2609810F9919008C82100C830382100CC464C464C464C4641A"))s=0
else{if(!X.c("'msx2'00469E2A4E8A22626C2D'bl-demo.bas'00",2607)||!X.c("'OPXPLAY SYS'00",2860))return
s=3198}if(4!=X.U8(0))for(Y=0;Y<53;Y++)if(X.U8(Y)<32)return
return!(2<X.U8(s+1)||63<X.U8(s+3)||6<X.U8(s+4)||5<X.U8(s+6)||33<X.U8(s+7)||1<X.U8(s+8)||79<X.U8(s+9)||X.U8(s+10)||1<X.U8(s+12)||3<X.U8(s+14)||3<X.U8(s+16)||3<X.U8(s+18))})()&&(sName="MSX Performer OPX chiptune (.OPX)",bDetected=1,X.isVerbose())&&sOption(addEllipsis(X.SC(0,123,"SJIS"))),!bDetected&&(function(){if(!(X.Sz()<1852||(smpp=X.U32(1080,_BE))<=1084||(d1h=(smpp-1084)%768)||(ptn=d2=Util.div64(smpp-1084,768),127<(ord=X.U8(950))))){for(mptn=0,Y=0;Y<=ord;Y++){if(127<(E=X.U8(952+Y)))return
mptn<E&&(mptn=E)}if(ptn==mptn+1){for(smp=smpsz=0,smps=[],bad="",smpns=[],Y=0;Y<31;Y++)X.isVerbose()&&smpns.push(X.SC(20+30*Y,22,"CP437").trim()),(E=X.U16(20+30*Y+22,_BE))&&(smp++,smpsz+=E<<1)
if(msmp=smpns[smpns.length-1],(K=smpp+smpsz)<X.Sz()&&(bad=bad.addIfNone("!short")),a1=952,d1=ord,k=a0=notes=0,X.isVerbose()){do{a0=1084+768*X.U8(a1),a3=a0+768,a1++
do{var s=X.readBytes(a0,2),e=(192&s[0])>>2|s[1]>>4
if(63&s[0]&&(notes++,debug)&&e>msmp&&(bad=bad.addIfNone("!missingsmp#"+e)),!1&s[1]){k++
break}}while((a0+=3)<a3&&a0<X.Sz())}while(--d1)
k=k||1}else k=1
return 28732===smpp&&12898===smpsz&&X.c("'beast-busters1.st'")&&(k=11),1}}})()&&(sName="Neil Crossley's Images Music System module (.IMS)",bDetected=1,sVersion="v1.0",""!=bad&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOption(X.SC(0,20,"CP437")),1<k&&sOption(k,"×"),sOption(addEllipsis(smpns.filter(funSampleName).join(","),256,160),'smp/msg:"','"'),sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K))),!bDetected&&(function(){if(!(X.Sz()<555)){var s,e=0,t=!0,r=0,e=b(X.readBytes(0,20))
for(bad="",B=allvols=smp=r=0,snames=[],U=0;U<15;U++){var i=X.readBytes(20+30*U,22,!0),n=decEncoding(i,CPAmiga).trim()
if(/ST-[0-9A-F]+:/i.test(n)?e-=4:snames.push(n),e+=b(i),S(20+30*U,"STKsmp["+U+'] "'+n.trim()+'" invalid chars:'+e+" ("+charStat(i,1)+")"),10<e)return S(20+30*U,"!title or sample names too broken"),0
if(X.U8(20+30*U)&&!/^st-[0-9a-f]\d:/i.test(n)&&(t=!1),73728<(slen=2*X.U16(42+30*U,_BE)))return S(42+30*U,"!smp #"+U+" too large:"+Hex(slen)),0
if(15<X.U8(44+30*U)&&(bad=bad.addIfNone("!finetune"),e+=16),64<(T=X.U8(45+30*U)))return
sls=X.U16(46+30*U,_BE),sll=X.U16(48+30*U,_BE),(9998<slen||4999<sls)&&(r=Math.max(r,5)),slen&&smp++,B+=slen,allvols+=T,sll>slen+2&&(S(42+30*U,"!smp "+U+" LpLen "+sll+" > sSz "+slen),bad=bad.addIfNone("!sLpLen>sSz")),slen&&sls>=slen&&(S(46+30*U,"!smp "+U+" LpStart "+sls+" >= sSz "+slen),bad=bad.addIfNone("!sLpStart>=sSz")),sls&&!sll&&(S(42+30*U,"!smp "+U+" LpStart "+sls+" LpSz 0"),bad=bad.addIfNone("!sLpStart0LpSz")),sls&&!slen&&(S(46+30*U,"!smp "+U+" LpStart "+sls+" sSz 0"),bad=bad.addIfNone("!sLpStart0SSz"))}if(B<8||!allvols)return S(20,"!smps too small or no smpvols"),0
if(!(128<(ord=X.U8(470))||220<(restartp=X.U8(471)))){for(restartp&&!/jjk55/.test(X.SA(0,6))||(restartp=120),bpm0=125,120!=restartp&&(bpm0=(88672375/(6100*(240-restartp))).toFixed(2),r=1<r?Math.max(r,t?4:5):Math.max(r,t?1:2)),ptn=offptn=badptn=ord_=0,usedptns=[],usedsmps=[],o=0;o<128;o++){if(63<(k=X.U8(472+o)))return S(472+o,"!impossible ptn #"+k),0
ptn<=k&&(ptn=k+1,o<ord)&&(offptn=ptn,usedptns.indexOf(k)<0)&&usedptns.push(k),k>=badptn&&(badptn=ptn+1),k&&ord_++}if(ord_++,(songszoffptn=600+1024*offptn)>X.Sz())return S(songszoffptn,"!patterns cut off"),0
for(e=tnDxx=notes=0,Y=0;Y<ptn;Y++){for(emptycmd=nDxx=badnote=ptnic=ptnotes=0,row=0;row<64;row++)for(chn=0;chn<4;chn++){var a=600+(Y<<10)+(row<<4)+(chn<<2),a=(k=X.readBytes(a,4),X.isDeepScan()&&(emptycmd||k[0]||k[1]||k[2]||k[3]?emptycmd=0:32<++emptycmd&&(r=6)),240&k[0]|(240&k[2])>>4),p=((15&k[0])<<8)+k[1],d=15&k[2]
if(0<=usedptns.indexOf(Y)&&(15<a?ptnic++:usedsmps.indexOf(a)<0&&usedsmps.push(a)),!(X.isDeepScan()||notes<100)||0<=(a=[0,856,808,762,720,678,640,604,570,538,508,480,453,428,404,381,360,339,320,302,285,269,254,240,226,214,202,190,180,170,160,151,143,135,127,120,113]).indexOf(s=p)||0<=a.indexOf(s-1)||0<=a.indexOf(s+1)?p&&ptnotes++:(ptnic+=2,badnote++),X.isDeepScan())switch(d){case 1:case 2:31<k[3]&&1==r?r=t?1:0:1==d&&0<k[3]&&k[3]<3?r=Math.max(r,2):1==d&&(55==k[3]||71==k[3])&&r<=2&&(r=t?1:0)
break
case 11:r=6
break
case 12:case 13:case 14:if(r=Math.max(r,2),13==d){if(emptycmd=1,!k[3]&&!row)break
nDxx++}break
case 15:r<3&&(r=3)}}if(ptn>=offptn&&64<ptnic?ptn=offptn:(e+=ptnic,notes+=ptnotes,badnote&&(bad=bad.addIfNone("!badnotes"))),e>Math.max(512,128*ptn))return S("!badbytes:"+e),0
nDxx&&nDxx<3&&(r=6),tnDxx+=nDxx}if(tnDxx>ptn+32&&6==r&&(r=5),X.isDeepScan())switch(r){case 0:tracker="Karsten Obarski's Ultimate ST 1.0~21"
break
case 1:tracker="Karsten Obarski's Ultimate ST 1.8~2.0"
break
case 2:tracker="The Exterminator's ST 2.0 / D.O.C.'s ST II"
break
case 3:tracker="Il Scuro/Defjam's ST III / Alpha Flight ST IV / D.O.C.'s' ST IV / VI"
break
case 4:tracker="D.O.C.'s' ST IX"
break
case 5:tracker="Tip/The New Masters' Master ST 1.0"
break
case 6:tracker="D.O.C.'s ST 2.0~2"
break
default:tracker="???"}K=600+1024*ptn+B
var c=Math.abs(K-X.Sz()),m=Math.abs(ord-ord_),f=ord||1e-4,l=0
return(20<e&&l++,isWithin(smp,3,15)||l++,2048<c&&l++,K>X.Sz()&&l++,restartp||l++,ord&&ord_&&!(badptn>ptn+2)||l++,.8<m/f&&l++,ptn||l++,notes<2&&l++,allvols<smp&&l++,isWithin(bpm0,20,300)||l++,4<=l)?S(l,"!too suspicious"):(e&&(bad=bad.addIfNone("!baddata="+e)),K>X.Sz()&&(bad=bad.addIfNone("!short")),l&&(bad=bad.addIfNone("!sus+"+l)),1)}}function b(s){for(var e=0,t=0;t<s.length;t++)s[t]&&(s[t]<32||isWithin(128,254))&&[10,13,14].indexOf(s[t])<0&&e++
return e}function S(s,e){return 1<debug&&_l2r("stk",s,e),!1}})()&&(sName="Karsten Obarski's SoundTracker module (.STK,.MOD)",bDetected=1,""!=bad&&(sVersion="malformed"+bad),X.isVerbose())&&(sOptionT(X.SA(0,20)),X.isDeepScan()&&sOption(tracker,"in:"),sOption(snames.filter(funSampleName).join(" "),'smps/msg:"','"'),sOption("bpm0:"+bpm0+" ord:"+ord+(ord_!=ord?"/"+ord_:"")+" ptn:"+(offptn!=ptn?offptn+"/":"")+ptn+" smp:"+smp+(X.isDeepScan()?" notes:"+notes:"")+" sz:"+outSz(K))),!bDetected&&(function(){if(spd=X.U8(0),isWithin(spd,1,15)&&(ord=X.U8(1))&&!(128<=ord)&&(ptn=X.U8(2))&&!(32<(smp=X.U8(3))||(opl=X.U8(4),(lp=X.U8(5))>ord)||(smpp=X.U32(6))>X.Sz())){for(G=10,Y=0;Y<ord;Y++)if(X.U8(G++)>=ptn)return
for(ptnpt=G,G+=4*ptn,Y=smpsz=0;Y<smp;Y++,G+=16){if(X.U32(G))return
var s=X.U32(G+4),e=X.U32(G+8),t=X.U32(G+12)
if(!s||1048575<s)return
if(smpsz+=s,t<1048575&&(s<t||t<e))return}for(Y=0;Y<opl;Y++,G+=11){if(240&X.U8(G))return
if(252&X.U8(G+5))return
if(252&X.U8(G+10))return}for(Y=notes=0,ptnp=G,bad=!1;Y<ptn;Y++){if((G=ptnp+X.U32(ptnpt+4*Y))>smpp-3)return
if(ptnend=Y>=ptn-1?smpp:ptnp+X.U32(ptnpt+4*Y+4),!isWithin(ptnend-G,3,4096))return
for(i=0;G<ptnend;){var r=X.U8(G++)
if(r<=12)G+=2,notes++
else if(32<=r&&r<=44)G++
else{if(64!=r){if(96==r)break
return}i+=X.U8(G++)}}if(64<i)return}return K=smpsz+smpp,0<opl+smp}})()&&(sName="CDFM/Composer 670 module (.670)",sVersion="compact",bDetected=1,bad&&(sVersion="malformed!badptn"),X.isVerbose())&&sOption("spd:"+spd+" ord:"+ord+(lp?" lp:"+lp:"")+" ptn:"+ptn+" smp:"+smp+" fm:"+opl+" notes:"+notes+" sz:"+outSz(K)),!bDetected&&(function(){if(!(X.Sz()<136||2<(mode=X.U8(0))||31<X.U8(1)&&208!=X.U8(1)||X.U8(2)<66||67<X.U8(2)||(tempo=X.U8(3))<3||31<tempo||135&(ptnsz=X.U8(4)))){for(Y=5;Y<14;Y++)if(4<X.U8(Y))return
if(!(2<(regbd=X.U8(14)))&&(ins=X.U16(15))&&!(63<ins)){for(G=17;G<17+46*ins;G+=46){if(3<X.U8(G+4)&&225!=X.U8(G+4)||4<X.U8(G+9))return
if(127<X.U8(G+10)||192&X.U8(G+12))return
if(!isWithin(X.I8(G+21),-48,48)||!isWithin(X.I8(G+23),-48,48))return
if(!isWithin(X.I8(G+27),-48,48)||!isWithin(X.I8(G+32),-48,48))return
if(48<X.U8(G+36)||1<X.U8(G+37)||!isWithin(X.I8(G+39),-4,0))return
if(isInside(X.U8(G+43),48,232)||X.U16(G+44))return}if((ord=X.U16(G))&&!(96<ord)){for(mp=-1,ptnp=(G+=2)+9*ord*3+2,Y=0;Y<ord;Y++)for(l=0;l<9;l++){if((pt=X.U16(G))%2||pt+ptnp>X.Sz()||16384<pt)return
mp<pt&&(mp=pt),G+=3}return digisnd=X.U16(G),G+=2,K=ptnp+digisnd,X.Sz()<K?void 0:(ptn=Util.divu64(digisnd,2),1)}}}})()&&(sName="Loudness Sound System Ad Lib module (.LDS)",bDetected=1,X.isVerbose())&&sOption("ch:9 mode:"+mode+" spd:"+X.U16(1)+" tempo:"+tempo+" ord:"+ord+" ptn:"+ptn+" ins:"+ins+" sz:"+outSz(K)),!bDetected&&(function(){for(Y=0;Y<4;Y++)if(!isWithin(X.U8(Y),0,87))return
for(;Y<11;Y++)if(X.U8(Y))return
for(;Y<16;Y++)if(X.U8(Y)<251)return
for(;Y<32;Y++)if([240,4,6,8,12].indexOf(X.U8(Y))<0)return
for(_=0;Y<37;Y++){if(5<X.U8(Y))return
X.U8(Y)||_++}if(!(3<_)){for(;Y<42;Y++)if(X.U8(Y))return
for(;Y<48;Y++)if(1<X.U8(Y))return
for(Y=64;Y<80;Y++)if(!isWithin(X.U8(Y),32,63))return
return X.c("32323232 323232",68)?1:void 0}})()&&(sName="Ken Silverman's Adlib module (.KSM)",bDetected=1,X.isVerbose())&&sOption("notes:"+(notes=X.U16(80))+" sz:"+outSz(82+4*notes)),!bDetected&&(function(){function s(s,e){return 1<debug&&_l2r("tmc",s,e),!1}if(!(X.Sz()<464||32!=X.U8(35))){if((bin=parseAtariBinary())[0]<470)return s("!binsz"),0
if(255!=X.U8(bin[1][0][1]+5))return s(0,"!ptnend"+outArray(bin,16)),0
if(!isWithin(spd0=X.U8(36),1,16)||!isWithin(ticks=X.U8(37),1,4))return s(37,"!spd"+spd0+"/"+ticks),0
for(ins=t0=0,p0=65536,G=38;G<102;G++)if(X.U8(G)||X.U8(G+64)){if([0,9].indexOf(15&X.U8(G))<0)return s("!susins"),0
if((E=(X.U8(G+64)<<8)+X.U8(G)+6-X.U16(2))<0||E<=t0)return s(E,"!-insptr"),0
if(0<(t0=E)){if(!isWithin(E,416,bin[1][0][1]+6))return s(E,"!insptr"),0
ins++,p0>E&&(p0=E)}}if(!ins)return s(p0,"!0inst"),0
if([0,9].indexOf(15&X.U8(166))<0)return s(p0,"!0ptnptr"),0
for(ptn=t0=0,G=166;G<294;G++){if(E=(X.U8(G+128)<<8)+X.U8(G)-X.U16(2)+6,p0>E&&(p0=E),E<0||E<=t0)return s(E,"!-ptnptr"),0
if((t0=E)&&!isWithin(E,416,bin[1][0][1]+6))return s(E,"!ptnptr"),0
E&&255!=X.U8(E)&&ptn++}for(ord=p0-422>>4,G=423,pt=-1,ic=0;G<p0;G+=2)X.c("FF",G)||X.c("7F",G)||(127<X.U8(G)?ic++:X.U8(G)>=pt&&(pt=X.U8(G)+1))
return 1}})()&&(sName="Marcin 'Jaskier' Lewandowski's Theta Music Composer module (.TMC,.TM4,.TM8)",sVersion="v1.x",bDetected=1,ic&&(sVersion=sVersion.appendS("malformed!"+ic+"ptns","/")),X.isVerbose())&&(sOption(decAnsi(6,30,CPATASCII,Chars0to1FATASCII_PL)),sOption("spd0:"+spd0+" ticks:"+ticks+" ord:"+ord+" ptn:"+(pt!=ptn?pt+"/":"")+ptn+" ins:"+ins+" sz:"+outSz(bin[0]))),!bDetected&&gs()&&(sName="Radik 'Raster' Štěrba's Raster Music Tracker module (.RMT)",sVersion="v"+v,bDetected=1,X.isVerbose())&&(1<bin[1].length&&sOption("metadata present"),sOption("ch:"+ch+" spd0:"+spd0+" ticks:"+ticks+" sz:"+outSz(bin[0]))),!bDetected&&(function(){if(X.c("AE")&&!(X.Sz()<121)){K=unpsz=-(G=1)
for(var s=end=R=0,e=Array(65536),t=[-1,-2,-3,-4];!end&&s<(X.isDeepScan()?65536:256)&&G<Math.min(X.isDeepScan()?65535:256,X.Sz());)if(174==(E=i(G++))){if((_=i(G++))<0)return n("PTFault: bad count"),0
if(!_){end=!0
break}if(1===_)e[s++]=174
else{if((b=i(G++))<0)return n("PTFault: bad byte"),0
for(;_;_--)e[s++]=b}}else e[s++]=E
if((tempo=e[8129])<16)return n("PTFault: tempo < 10h"),0
if(e[8064]||e[8080])return n("PTFault: nonzero smp#0"),0
if(s%256)for(;s%256&&32===e[s-1];)s--
if(s%256||X.isDeepScan()&&s<8192||65535<s||65535<G)return n("PTFault: bad range! o="+Hex(s)+" p="+Hex(G)),0
if((modsz=e[8131]+16<<8)!=s)return n("PTFault: allsmpsz mismatch: "+Hex(modsz)+" != "+Hex(s)),0
var r=[4,12]
for(smp=0,Y=8065;Y<8080;Y++)16<=e[Y]&&smp++,e[Y]>r[0]&&(r[0]=e[Y],r[1]=e[Y+16])
if((lastsmpend=(r[0]+16<<8)+(r[1]<<8))!=s)return n("PTFault: last smp end "+Hex(lastsmpend)+" != "+Hex(s)),0
for(notes=ic=0,Y=0;Y<Math.min(7936,s);Y++)e[Y]&&240!=e[Y]&&(notes++,(240&e[Y])==e[Y])&&ic++
if(X.isDeepScan())for(Y=8192;Y<s;Y++)if(63<e[Y])return n("PTFault: bad sample @"+Hex(Y)),0
for(unpsz=s,K=G,ord=ptn=0,Y=7936;Y<8064&&e[Y];Y++)ord++,(pt=e[Y]-223)>ptn&&(ptn=pt)
if(ic>ptn<<2)return n("PTFault: "+ic+" bad notes"),0
for(Y=8096;Y<8128;Y++)e[Y]&&e[Y]<26&&(e[Y]+=96)
return a=decEncoding(e.slice(8096,8112),CPAmiga),composer=decEncoding(e.slice(8112,8128),CPAmiga),e=void 0,1}function i(s){return t[R++]=X.U8(s),3<R&&(R=0),t[0]===t[1]===t[2]===t[3]?-(end=1):X.U8(s)}function n(s){return e=void 0,debug&&_log(s),!1}})()&&(sName="Polly Tracker module (.MOD)",bDetected=1,X.isVerbose())&&X.isDeepScan()&&(sOptionT(a),sOptionT(composer,"by:"),sOption("tempo:"+Hex(tempo)+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" notes:"+notes+" unpsz:"+unpsz+" sz:"+outSz(K))),!bDetected&&(function(){var s,e,t
return X.Sz()<27||(X.U16(0),(t=(e=(s=8+X.U16(2))+X.U16(4))+X.U16(6))>X.Sz())||1&s||1&e||1&t?void 0:X.c("014F",s-2)&&X.c("014F",e-2)&&X.c("014F",t-2)&&(K=t,E="",X.Sz()>t&&0<(G=X.fSig(t,4096,"00")-t+1)&&(E=decAnsi(t,G,CPFullCPETshifted,!0).trim(),K+=G),1)})()&&(sName="COMPUTE!'s Enhanced SidPlayer tune (.MUS+.STR+.WDS)",bDetected=1,X.isVerbose())&&sOption((E.length?'"'+addEllipsis(E,256,160)+'"':"").append("sz:"+outSz(K))),!bDetected&&As()&&(sName="Ultima 6 Adlib module (.M)",sOption("unpsz:"+unpsz+" sz:"+outSz(K)),bDetected=1),!bDetected&&(function(){if(isWithin(X.U16(0,_BE),4,16)&&isWithin(X.U16(2,_BE),8,32)&&isWithin(X.U16(4,_BE),4,48)&&isWithin(X.U8(6),1,4)&&X.c("0400000000",7)&&(X.c("'WT'",12)||!X.U32(12,_BE))&&isWithin(X.U8(23),3,119)&&!(76<(E=X.U32(24,_BE))||3&E)){K=16
var s=Math.min(X.Sz(),65535)
for(k=0,G=28;G<Math.min(X.Sz()-1,1024);G+=12)if(!isWithin(X.U16(G,_BE),70,108))return
for(;K<s&&X.c("0056",K);){for(k++,Y=0;Y<4;Y++)for(K+=2;K<s&&!X.c("0046",K);K+=2);K+=12
break}return spd0=X.U16(14,_BE),!k||K<=s}})()&&(sName="Illusions/Microdeal Quartet module (QTS.+SMP., .4V+.SET)",sVersion="samples",bDetected=1,X.isVerbose())&&sOption((spd0?"spd0:"+spd0+" ":"")+"sz:"+outSz(K)),(function(){if(!(X.Sz()<17408)&&(124==X.U8(256)||124==X.U8(287))&&!(charStat(X.readBytes(256,32),1).indexOf("allasc")<0)&&255==X.U8(516)&&(tempo=X.U8(528),isWithin(tempo,2,10))&&(ord=X.U8(530)+1,isWithin(ord,1,101))&&!((loop=X.U8(529))>=ord||charStat(X.readBytes(768,128),1).indexOf("allasc")<0)){for(K=16384,Y=0;Y<8;Y++){if(X.U8(192+4*Y))return
if(!isWithin(X.U8(192+4*Y+1),128,192))return
if(!isWithin(bnk=X.U8(192+4*Y+2),88,95))return
if(!isWithin(sec=X.U8(192+4*Y+3),1,128))return
X.U16(192+4*Y)
var s=sec<<8
bnk&=7,K+=s}if(!(K>X.Sz())){for(K+=1024,F=X.SC(257,30,"CP1251").trim(),Y=smp=0;Y<16;Y++)if(1<X.U8(288+8*Y+4))return
for(Y=ptn=0;Y<100;Y++){if(31<(E=X.U8(416+Y)))return
ptn<E&&(ptn=E)}return ptn++,1}}})()&&(sName="SQ Digital Tracker module (.SQD,.M)",bDetected=1,X.isVerbose())&&(sOptionT(F),sOption("tempo:"+tempo+" ord:"+ord+(loop?" loop:"+loop:"")+" ptn:"+ptn+" sz:"+outSz(K))),!bDetected&&(function(){if(!X.U8(0)&&X.c("00000200",12)){for(G=16,ptn=0;G<4112&&-1!=X.I32(G);G+=2){if(X.U8(G))return
X.U8(G+1)>ptn&&(ptn=X.U8(G+1))}for(ptn++,ord=G-16>>3,d2=G,G=4112+48*ptn;G<Math.min(X.Sz(),196608)&&!X.U32(G,_BE);)G+=4
if(X.c("'FORM'........'8SVXVHDR'",G+640)){for(smptp=G,smp=0,smps="",Y=32,K=0;Y--;G+=4)if(!X.U8(G)){var s=smptp+X.I32(G,_BE),e=X.I32(G+128,_BE)
if(s<640||!X.c("'FORM'........'8SVXVHDR'",s))return
smp++,K<s+e&&(K=s+e)}return 1}}})()&&(sName="Michael Winterberg's Speedy A1 System module (.SAS)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K)),!bDetected&&(function(){if(!(X.Sz()<382)&&isWithin(ord=X.U8(248),1,127)&&127==X.U8(249)){var s=X.U16(378,_BE)
if(G=377,B=0,s==X.U16(380,_BE)&&s==ord){for(ord_=-1,ptn=0;249<G;G--){if(100<(o=X.U8(G)))return
o&&ord_<0&&(ord_=G-249),o>=ptn&&(ptn=o+1)}for(ord_<0&&(ord_=1),G=smp=Y=0;Y<31;Y++,G+=8)(A=X.U16(G,_BE))&&(smp++,B+=A)
for(B<<=1,G=382,Y=m=0;Y<4*s;Y++,G+=2)m=Math.max(m,X.U16(G,_BE))
if(G+=m,1==ptn)for(E=X.U16(G-2,_BE),G+=2;G<X.Sz();G+=2)if(X.U16(G-2,_BE)==E)return 1
for(q=G,m=0;q<G+4;q++)m=Math.max(m,X.U8(q))
for(a3=G+m+4,m=0;q<a3;q++)m=Math.max(m,X.U8(q))
for(a3=G+m+4,m=0;q<a3;q++)m=Math.max(m,X.U8(q))
for(G+=2*m+4,songsz=G;X.c("04040404 08080808",G)&&G<65535;)G+=16
return 1}}})()&&(sName="Shaun Southern's Magnetic Fields Packer module (.MFP+.SMP)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+(ord!=ord_?"/"+ord_:"")+" ptn:"+ptn+" smp:"+smp+" smpsz:"+B+" songsz:"+songsz+" sz:"+outSz(G)),!bDetected&&(function(){if(!(X.Sz()<720)){for(G=ap=z=ic=0,nV=4,ofs=500;G<ofs;G+=2)4==nV&&isWithin(w=X.U16(G),500,65534)&&(1<debug&&_logIt("@"+Hex(G)+": "+Hex(w)),nV=3,ofs=X.c("6C776DFFFFFF6E6F",120)?250:120)
var s=Math.min(65535+ofs,X.Sz())
if(G=ofs,nV<4){for(nprog=150,Y=0;Y<nprog;Y++)if(w=X.U16(G),G+=2,w&&65535!=w){if(ap++,w<1e3&&(nV=1,600!=X.U16(120)))return
if(!isWithin(w,600,s))return 0<debug&&_logIt("!w="+w+"<600 or > sz"),0
w+=ofs,142!=(y=X.U8(w))&&9<y&&z++}if(1<nV){if(X.Sz()<1120)return
for(nprog=250,G=ofs+300,Y=150;Y<nprog;Y++,G+=2)if((w=X.U16(G))&&65535!=w){if(ap++,!isWithin(w,1e3,s))return 0<debug&&_logIt("!w="+w+"<1000 or > sz"),0
w+=ofs,(y=X.U8(w))||z++,142!=y&&9<y&&ic++}}}else{if(X.Sz()<2500)return
for(nprog=500,G=ofs,Y=0;Y<nprog;Y++,G+=2)if((w=X.U16(G))&&65535!=w){if(ap++,!isWithin(w,2e3,s))return 0<debug&&_logIt("!w="+w+"< 2000 or > sz"),0
w+=ofs,(y=X.U8(w))||z++,142!=y&&9<y&&ic++}}for(mw=Y=0,mo=(nprog<<1)+ofs;Y<nprog;Y++,G+=2)if((w=X.U16(G))&&65535!=w){if(ap++,w+=ofs,!isWithin(w,mo,X.Sz()))return 0<debug&&_logIt(!1+Hex(G)),0
mw=Math.max(mw,w)}if(!((K=mw+11)<6900)){if(ptn=[],4==nV)for(G=0;G<500;G+=2)!isWithin(y=X.U16(G),1,65534)||ptn.includes(y)||ptn.push(y)
else for(G=ofs;G<250;G+=2)!isWithin(y=X.U16(G),1,65534)||ptn.includes(y)||ptn.push(y)
return ptn=ptn.length,0<debug&&_log("@"+Hex(G)+" v:"+nV+" ic:"+ic+" zeros:"+z+" ap:"+ap+" ptn:"+ptn),ic<5&&z<50&&1<ap}}})()&&(sType="audio",sName="Westwood ADL module (.ADL)",bDetected=1,sVersion=250==ofs?"v.sfx":"v"+[,"1","2","2","3"][nV],X.isVerbose())&&sOption("ptn:"+ptn+" sz:"+outSz(K)),!bDetected&&(function(){var s,e,t,r,i,n,a,o
if(!(X.Sz()<52)&&(ordp=X.U16(0),ornp=X.U16(2),smpp=X.U16(4),orn=smpp-ornp,isWithin(orn,0,30))&&!(orn%2)&&(orn>>=1,s=ordp,!((smp=ordp-smpp)<=0||64<smp||smp%4))&&(smp>>=2,e=X.U16(6),ord=e-s-1,isWithin(ord,1,256))&&!(X.Sz()<12+ord+1+36*smp+34*orn+3-1)){for(n=(r=6)+2*orn+4*smp,p=X.Sz()+1-n,(n+=186)>X.Sz()+1-ord-1-3&&(n=X.Sz()+1-ord-1-3)%2&&--n;r<n&&(a=(i=X.U16(r))-s,isWithin(a,1,p))&&!(f()&&r+6<n&&l(r)&&(t=X.U16(r+2),!orn||t-X.I16(r-2)==32)&&(1==smp&&s-t==96||1<smp&&l(r+4)&&X.I16(r+6)-t==96));){if(i<e)return m("!cura < ptna: "+Hex(i)+" < "+Hex(e)),0
r+=2}if(!f())return m("!post-cycle invalid smp ofs"),0
if(!((n=r+4*smp)>X.Sz()+1-ord-1-3)){for(var p=X.Sz()+1-n,d=0,c=0;c<smp;c++,r+=4){if(l(r)||d++,1<d)return m("!badsmpparams"),0
if(a=(i=X.U16(r+2))-s,!isWithin(a,1,p))return m("!bad cura-orda"),0}for(c=0;c<ord;c++,r++)if(!isWithin(X.U8(r),1,31))return m("!badpos"),0
return X.U8(r)?(m("!badordendmarker"),0):(o=e-r-1,(ornp-o)%2||(smpp-o)%2?(m("!odd orna or smpa"),0):(s-=o)%2?(m("!odd orda"),0):!((K=X.U16(s-2)+96-o)<=s)||(m("!size<=orda"),0))}}function m(s){0<debug&&_log("[isFLS]@"+Hex(r)+": "+s)}function f(){return r>=12+2*orn&&!((r-2*orn)%6)}function l(s){var e=X.U8(s),s=X.U8(s+1)
if(!(32<e)){if(e){if(!isWithin(s,1,33-e))return}else if(!isWithin(s,1,32))return
return 1}}})()&&(sName="Amadeus Voxon/Flash Inc.'s Flash Tracker module (.FLS)",bDetected=1,X.isVerbose())&&sOption("ord:"+ord+" ptn:"+ptn+" smp:"+smp+" orn:"+orn+" sz:"+outSz(K)),X.isHeuristicScan()){if(extIs("imf")||extIs("wlf")?(freq=extIs("imf")?"560Hz (or 280Hz if Duke Nukem II)":"700Hz",_setResult("~audio","id/Apogee Music Format chiptune (.IMF)","","freq: "+freq)):extIs("svar")&&X.c("'PK'")&&_setResult("~audio","SVArTracker module (.SVAR)","",""),X.c("8400")?(sversion=240==X.U8(2)?"adv.":"",_setResult("~audio","Sierra Adlib chiptune (.SCI)",sversion,"")):X.c("1C52")?_setResult("~audio","Sound Interface System module (.LEM)","",""):X.c("'NED'")?_setResult("~audio","Nerd Tracker ][ module (.NED)","",""):X.c("'MODU'")?_setResult("~audio","NovoTrade Packer module (.NTP)","",X.isVerbose()?X.SA(4,16):""):(X.c("'Ice!'")||X.c("'ICE!'"))&&(dsize=X.U32(8,_BE),_setResult("~audio","Atari ST module (.SND,.SNDH)","compressed",X.isVerbose()?"orig.sz:"+dsize+" sz:"+outSz(X.U32(4,_BE)):"")),hdr=X.SA(0,2),!(["AY","YM","ay","ym"].indexOf(hdr)<0||6<X.U8(2)||(hasyear=["AY","YM"].indexOf(hdr)<0,yr=0,hasyear&&(yr=X.U16(10,_LE))&&(yr<1980||2050<yr))||(unpsz=X.U32(hasyear?12:10,_LE))<2||10485760<unpsz||(chipfrq=X.U32(5,_LE))<8e5||4e6<chipfrq)&&(intfrq=X.U8(9),1)){switch(sversion=X.U8(2)?"2ch":"1ch",hdr){case"AY":case"ay":sversion+=" AY-3-8910/12"
break
case"YM":case"ym":sversion+=" YM2149"
break
default:sversion+=" unk.chip"}X.isVerbose()&&(G=hasyear?16:14,E=X.SC(G,Math.min(256,X.Sz()-G),"CP1251"),sOptionT(E),G+=E.length+1,p=X.SC(G,Math.min(256,X.Sz()-G),"CP1251"),sOptionT(p,"by:"),G+=p.length+1,hasyear&&(yr&&sOption(yr,"'"),pr=X.SC(G,Math.min(256,X.Sz()-G),"CP1251"),G+=pr.length+1,sOptionT(pr,"for:"),tn=X.SA(G,Math.min(256,X.Sz()-G)),sOptionT(tn,"in:"),G+=tn.length+1,_=X.SA(G,Math.min(256,X.Sz()-G)),sOptionT(_)),sOption((7&X.U8(2)).toString(2).padStart(3,"0"),"mode:"),sOption(chipfrq,"chip freq:","Hz"),sOption(intfrq,"int.freq:","kHz"),E=Util.div64(unpsz,14*intfrq),sOption("time:"+secondsToTimeStr(E)),loop=X.U16(3,_LE))&&sOption(loop,"loop:"),_setResult("~audio","Vortex Project chiptune (.VTX)",sversion,sOptions),sOptions=""}(function(){if(!(X.Sz()<768||16793599<X.Sz())){K=en=0
nonzeroaddr=-1
var s=4294967295,e=[]
for(sus=0,bad="",Y=0;8*Y<(4294967295==s?768:Math.min(s,X.Sz()));Y++){var t=X.U32(8*Y,_BE),r=X.U32(8*Y+4,_BE)
if(t){if(t<8*Y||1048575<r)return
nonzeroaddr<0&&(nonzeroaddr=Y),t<s&&768<=t&&(s=t),e.push([t,r]),en++,K<t+r&&(K=t+r)}}return!en||4<findGaps(e,2).length?void 0:!((e=e.sort(function(s,e){return s[0]!=e[0]?s[0]-e[0]:s[1]-e[1]}))[0][0]%8||!isWithin(e[0][0],768,16384))}})()&&(sversion="",K>X.Sz()&&!X.isVerbose()&&(bad+="!short"),bad.length&&(sversion=sversion.appendS("malformed"+bad+(sus?"sus"+sus:""),"/")),_setResult("~audio","Konami's MXDRV PCM resource (.PDX)",sversion,X.isVerbose()?"entries:"+en+" sz:"+outSz(K):"")),X.Sz()<12||X.U32(0,_LE)||!(numnotes=X.U32(4,_LE))||8192<numnotes||!(numtracks=X.U32(8,_LE))||256<numtracks||(K=12+4*numtracks+11*numnotes)!=X.Sz()&&K!=X.Sz()+numnotes||(sversion=K>X.Sz()?"no panning effects":"",_setResult("~audio","Ken Silverman's Digital Music module (.KDM)",sversion,X.isVerbose()?"trk:"+numtracks+" notes:"+numnotes:"")),(function(){if(!(X.Sz()<111104||63<(lp=X.U8(0)))){for(ptn=0,Y=1;Y<100;Y++){if(31<(pt=X.U8(Y)))return
pt>ptn&&(ptn=pt)}if(ptn++,tmp=X.U8(100),(ord=X.U8(101))&&!(100<ord)&&!(lp>ord)){for(F=X.readBytes(102,28),Y=0;Y<28;Y++)if(F[Y]<32||127<F[Y])return
for(F=decEncoding(F,CPSpeccy),compiled=!isAllZeroes(200,56),allsmp=smp4bit=0,smps=[],G=256;G<512;G+=16){X.U16(G),X.U16(G+2),X.U8(G+4),X.U8(G+5),X.U16(G+6)
for(Y=8;Y<16;Y++)if(X.I8(G+Y)<32)return
""!=(E=decAnsi(G+8,8,CPSpeccy,!1).trim())&&smps.push(E)}return 1}}})()&&(C="Underground Systems Digital Studio module (.DST)",sversion=compiled?"compiled":"",X.isVerbose()?(sOptionT(F),sOptionT(smps.filter(funSampleName).join(" "),'smp/msg:"','"'),sOption("ord:"+ord+" ptn:"+ptn+(lp?" loop:"+lp:"")+" page0:"+X.U8(512)+" sz:"+outSz(compiled?115200:111104)),O=sOptions,sOptions=""):O="",_setResult("~audio",C,sversion,O)),(function(){if(!(X.Sz()<112640||63<(lp=X.U8(0))||(tmp=X.U8(1))<3||15<tmp||64<(ord=X.U8(2)))){for(F=X.readBytes(3,30),Y=0;Y<30;Y++)if(F[Y]<32||127<F[Y])return
for(F=decEncoding(F,CPSpeccy),ptn=0,G=34;G<134;G++){if(31<(pt=X.U8(G)))return
pt>ptn&&(ptn=pt)}for(ptn++;G<166;G++){var s=X.U8(G)
if(s<4||64<s)return}var e=[81,83,84,86,87]
for(Y=0;G<186;Y++,G+=4){if(124<X.U8(G))return
if(X.U8(G+1)!=e[Y])return
if(X.U8(G+2)&&X.U8(G+2)<132)return
if(16<X.U8(G+3))return}var t=0
for(G=188;G<203;G++)X.U8(G)&&t++
if(!(3<t)){var r=X.readBytes(203,53,!0)
if(!(charStat(r,!0).indexOf("allasc")<=0||X.U8(255)))for(smps=[],G=256;G<512;G+=16){if(e.indexOf(X.U8(G+4))<0)return
if(16<X.U8(G+5))return
if(124<X.U8(G+6))return
for(E=X.readBytes(G+8,8),Y=0;Y<8;Y++)if(E[Y]<32||127<E[Y])return
""!=(E=decEncoding(F,CPSpeccy).trim())&&smps.push(E)}}}})(),(!X.c("4EFA....4EFA....4EFA")||(Z=X.U16(2,_BE))>X.Sz()-10?void 0:X.c("4BFA.... 08AD 0000",Z+2))&&_setResult("~audio","Jeroen 'WAVE' Tel & Charles Deenen's Maniacs of Noise module (.MON)","",""),(function(){if(!(X.Sz()<128)){for(oldp=smp=0,Y=0;Y<128;Y+=8){if((G=X.U16(Y,_BE))>X.Sz())return
if(G){if(G<oldp)return
oldp=G,smp++}if(!X.c("0010 01000000",Y+2)&&!X.c("0000 00000000",Y+2))return}return smp<8?void 0:1}})()&&_setResult("~audio","Jochen 'Mad Max' Hippel's Atari ST sample set (SMP.set)","",X.isVerbose()?"smp:"+smp+" sz:"+outSz(oldp):""),!bDetected&&X.isDeepScan()&&(function(){if(notes=chs=0,!(X.Sz()<480)&&(timediv=X.U32(0,_LE))&&!([96,128,480].indexOf(timediv)<0)&&(maxtime=X.U32(4))&&(gdnum=X.U32(8))){G=12+10*gdnum
var s=pbs=ccs=0
for(ch=0;ch<16;ch++){if(notenum=X.U32(G),G+=4,notes+=notenum,1e6<notenum)return
if(notenum){if(chs++,(G+=5*notenum)>X.Sz())return
for(s+=pcnum=X.U32(G),G+=4+4*pcnum,pbnum=X.U32(G),pbs+=pbnum,G+=4+5*pbnum,cn=0;cn<7;cn++)ccnum=X.U32(G),ccs+=ccnum,G+=4+4*ccnum}if(G>X.Sz())return}if(!(!notes||ccs>50*notes||pbs>3*notes||s>3*notes||maxtime<notes||16384<(size=X.U32(G))||(G+=4+size)>X.Sz()||1048576<(size=X.U32(G))||(G+=4+size)>X.Sz())){if(spsize=X.U32(G),G+=4,spsize<8192){for(Y=G+4,q=4*X.U32(G),E=Math.min(X.Sz,G+4+q);Y<E;Y+=4)if(!isWithin(X.U32(Y),q,G-4+spsize))return
G+=spsize}return K=G,1}}})()&&(sName="farbrausch V2 Synthesizer module (.V2M)",bDetected=1,X.isVerbose())&&(sOptions="ch:"+chs+" notes:"+notes+" timediv:"+timediv+" maxtime:"+maxtime+(spsize?" syn.speech":"")+" sz:"+outSz(K)),!X.c("01000000",6)||X.Sz()<1500||9e3<X.Sz()||X.calculateEntropy(12,1200)<7.8||_setResult("~audio","TwinTeam's Twin Trackplayer module (.DMO)","",X.isVerbose()?"unp.sz:"+X.U16(12):""),(function(){for(O="",smp=ptn=smpsz=0,Y=0;Y<32;Y++){if(charStat(E=X.readBytes(32*Y,16),1).indexOf("allxsc")<0)return
var s=E.indexOf(0)
if(s){if(s<0)return
for(l=15;s<l&&!E[l];)l--
if(s<l)return
var e=X.U32(32*Y+20,_BE)
e&&(smpsz+=e,smp++)}}if(tmp0=X.U8(1152),ord=X.U8(1153),!(!smpsz||!tmp0||15<tmp0||!ord||128<ord)){for(Y=0;Y<ord;Y++)(E=X.U8(1154+Y)+1)>ptn&&(ptn=E)
if(!(32<ptn)){for(;Y<128;Y++)if(X.U8(1154+Y))return
return K=1282+2048*ptn+smpsz,X.Sz()<K?void 0:(O="tmp0:"+tmp0+" ord:"+ord+" ptn:"+ptn+" smp:"+smp+" sz:"+outSz(K),1)}}})()&&_setResult("~audio","SHINING 8's Voices_8/8CHNL Soundtracker module","",X.isVerbose()?O:""),(function(){if(!(X.Sz()<2739||59188<X.Sz()||isAllZeroes(0,1524))){G=E=ic=0
var s=[[10,13],[23,14],[35,38],[41,45],[58,63],[69,80],[90,94],[105,107],[117,119],[122,125],[131,133],[137,138],[179,191],[211,223],[250,254]],e=[[27,28],[33,47],[52,62],[65,71],[73,84],[90,94],[102,114],[117,127],[129,135],[137,191],[201,207],[209,223]],t=[[43,46],,[54,62],[69,76],[81,87],[89,103],[105,108],[110,113],[118,128],[136,143],[157,175],[177,191],[193,201],[203,207]],r=[[1,5],[7,16],[21,30],[39,44],[57,62],[69,79],[87,95],[105,109],[138,142],[154,159],[172,176],[185,191],[199,209],[215,223],[232,239],[250,253]],i=[[1,15],[25,30],[39,46],[55,63],[73,79],[88,95],[106,110],[120,127],[137,143],[154,159],[172,174],[186,198],[201,210],[213,227],[234,238],[250,252]],a=[[10,14],[27,30],[36,38],[55,58],[60,63],[73,78],[90,96],[107,110],[124,126],[128,131],[138,144],[154,161],[167,175],[177,198],[200,205],[207,220],[222,224],[226,230],[232,237]],o=[[12,14],[25,30],[39,46],[57,65],[89,94],[106,110],[121,127],[138,149],[154,165],[171,198],[202,205],[209,222],[224,237]],p=[[18,21],[23,31],[35,54],[56,63],[65,77],[79,81],[90,96],[98,104],[106,109],[111,126],[128,147],[149,245]],d=[[16,23],[25,64],[66,96],[101,104],[106,118],[122,144],[146,177]],c=[[16,28],[33,47],[49,66],[73,84],[86,93],[96,109],[111,114],[116,136],[1930,152]],f=[[10,15],[18,31],[33,47],[49,54],[56,63],[69,86],[88,95],[97,102],[104,111],[120,127],[129,150],[154,239],[241,254]]
for(Y=0,m=X.isDeepScan()?127:16;Y<m;Y++,G+=12)if(E=X.U8(G),(isWithinRanges(E,s)||isWithin(E,165,177))&&ic++,E=X.U8(G+1),(isWithinRanges(E,s)||isWithin(E,146,167))&&ic++,(225<=(E=X.U8(G+2))||isWithinRanges(E,e))&&ic++,(209<=(E=X.U8(G+3))||isWithinRanges(E,t))&&ic++,E=X.U8(G+4),isWithinRanges(E,r)&&ic++,E=X.U8(G+5),isWithinRanges(E,i)&&ic++,E=X.U8(G+6),isWithinRanges(E,a)&&ic++,E=X.U8(G+7),isWithinRanges(E,o)&&ic++,(247<=(E=X.U8(G+8))||isWithinRanges(E,p))&&ic++,(179<=(E=X.U8(G+9))||isWithinRanges(E,d))&&ic++,(154<=(E=X.U8(G+10))||isWithinRanges(E,c))&&ic++,E=X.U8(G+11),isWithinRanges(E,f)&&ic++,2<ic)return
if(ptn=ord=k=0,!(177<X.U8(1536))){for(visited=[],Y=0;Y<50;Y++)visited[Y]=!1
for(G=1536;G<1587&&!visited[G-1536]&&(visited[G-1536]=!0,isInside(E,49,128)&&(E=255),!(177<(E=X.U8(G))));G++)if(128&E&&E<=177){if(1586<(E=(E&63)+1536)||177<X.U8(E)||E==G)return 0<debug&&_logIt("@"+Hex(G)+", t:"+Hex(E)+" :: "+Hex(X.U8(E))),0
G=1536+E-1}else 128&E?ic++:(ptn<E&&(ptn=E),ord++)
for(q=1586;1536<q&&255!=X.U8(q);q--);if(ord&&(ptn||255==X.U8(G))&&(k||k++,!(50<++ptn))){K=(G=1587)+1152*ptn
var l=0
for(Y=0;Y<576*ptn&&l<100;Y++)if(n=X.U8(G++),m=X.U8(G++),n||m){if(202<=n||isWithinRanges(n,[[98,126],[129,143],[145,200]]))return
if(isWithinRanges(m,[[56,67],[69,81],[86,95],[105,128],[130,136],[138,155],[157,159],[170,174],[215,221],[223,230],[232,239],[249,254]]))return
if(isWithin(m,7,15)&&128!=n&&0!=n&&ic++,isWithin(m,112,159)){if(129!=m&&137!=m)return
ic++}if(20<ic)return
l++}return ic&&(bad="!ic"+ic),1}}}})()&&(O="",X.isVerbose()&&(O=(O=1<k?"×"+k:O).appendS("ord:"+ord+" ptn:"+ptn+" sz:"+outSz(K),", ")),_setResult("~audio","Hannes Seifert's HSC Adlib Composer/ECR HSC-Tracker module (.HSC)",bad.length?"malformed"+bad:"",O)),(function(){if(!(X.Sz()<Math.max(X.U16(30),48))){var s
for(ch=0,Y=oldp=0;Y<16;Y++){if(!isWithin(s=X.U16(2*Y),Math.max(48,oldp),X.Sz()))return
if(Y&&128!=X.U8(s-1))return
128!=X.U8(s)&&ch++,oldp=s}return 1}})()&&_setResult("~audio","K.Ohshima's FMX chiptune (.FMX)","",X.isVerbose()?"ch:"+ch:""),X.Sz()<352||(_gyminfo=parseMDGYM(0,X.isDeepScan()?BCParseToEoF:BCParseToReasonable),0<debug&&_logIt("gym?"+outArray(_gyminfo,16)),_gyminfo[0]<0)||_setResult("~audio","Sega Genesis/Mega Drive YM2612 chiptune (.GYM)","headerless",X.isDeepScan()?"notes:"+_gyminfo[0]+" sz:"+outSz(_gyminfo[1]):""),X.isOverlay()||X.Sz()<352||(0<debug&&(rs=new CheckpointTimer).init(300),_cyminfo=parseYM2151RegLog(0,X.isDeepScan()?BCParseToEoF:BCParseToReasonable),0<debug&&rs.next("OPM (.cym) parsed"),0<debug&&_logIt("cym?"+outArray(_cyminfo,16)),_cyminfo[0]<0)||_setResult("~audio","YM2151 OPM/Callus chiptune (.CYM)","headerless",X.isDeepScan()?"notes:"+_cyminfo[0]+" sz:"+outSz(_cyminfo[1]):""),X.isOverlay()||X.Sz()<352||(0<debug&&(es=new CheckpointTimer).init(300),_opl2info=parseYM3812RegLog(0,X.isDeepScan()?BCParseToEoF:BCParseToReasonable),0<debug&&es.next("OPM (.cym) parsed"),0<debug&&_logIt("cym?"+outArray(_cyminfo,16)),_opl2info[0]<0)||_setResult("~audio","YM3812/OPL2/Ad Lib chiptune","headerless",X.isDeepScan()?"notes:"+_opl2info[0]+" sz:"+outSz(_opl2info[1]):"")}return result()}function zs(){for(E=X.readBytes(20,8),Y=0;Y<8;Y++)if(E[Y]<32||127<=E[Y])return
if((isstm=!([26,2].indexOf(X.U8(28))<0||[1,2].indexOf(X.U8(29))<0||!X.c("02",30)||[0,10,20,21].indexOf(X.U8(31))<0||64<X.U8(33)||64<(gvol=X.U8(34))&&88!=gvol||(nVm=X.U8(31),ptn=X.U8(33),maxord=nVm?128:64,minsz=1040+maxord+256*ptn,X.Sz()<minsz)||(smp=0,ord=-1,tracker="Sami 'Psi' Tammilehto's Scream Tracker 2 module",ext="STM",0)))||(isstx=(function(){if(!X.c("'SCRM'",60))return!1
if((ptnsz=X.U16(28))<64&&26!=ptnsz||2112<ptnsz)return!1
if(X.U16(30)||X.U32(38)||1!=X.U32(44))return!1
if(64<(E=X.U8(42))&&88!=E)return!1
if(64<(ptn=X.U16(48)))return!1
if(96<(smp=X.U16(50)))return!1
if(129<(ord=X.U16(52))&&257!=ord)return!1
if(ptntp=X.U16(32)<<4,smptp=X.U16(34)<<4,chtp=X.U16(36)<<4,minsz=64+Math.max(ptntp+2*ptn,smptp+2*smp,chtp+32+5*ord),X.Sz()<minsz)return!1
if(findIntersections([[ptntp,2*ptn],[smptp,2*smp],[chtp,32+5*ord]]).length)return!1
for(G=chtp+32,Y=0;Y<ord;Y++,G+=5)if(63<(E=X.U8(G))&&99!=E&&255!=E)return!1
return tracker="Sami 'Psi' Tammilehto's Scream Tracker Music Interface Kit module",ext="STX",!0})())){if(K=sz1=minsz,smpn=[],max=0,isstm){for(Y=0;Y<31;Y++){if((zero=X.U8(48+32*Y+12))&&46!=zero)return
smpn.push(X.SC(48+32*Y,12,"CP437").trim())
var s=X.U16(48+32*Y+14,_LE)<<4,e=X.U16(48+32*Y+16,_LE)
e&&48<s&&s<X.Sz()&&((sz1=e?s+e:sz1)>K&&(K=sz1),1<e)&&smp++}for(Y=0;Y<maxord;Y++)if(99===(E=X.U8(1040+Y))||255===E)E=255
else{if(63<E)return
ord++}ord++}else{if(!isstx)return
for(G=smptp,Y=0;Y<smp;Y++)si=X.U16(G+2*Y)<<4,smpn.push(X.SC(si+48,28,"CP437").trim()),si&&1===X.U8(si)&&(s=X.U16(si+14)<<4)>max&&(e=X.U32(si+16),4&X.U8(si+31)&&(e*=2),max=s,K<max+e)&&(K=max+e)
if(fmt=1,ptntp&&26!=ptnsz){if((G=X.U16(ptntp)<<4)>X.Sz())return X.isHeuristicScan()&&(bad=bad.addIfNone("!badptnp"),1)
X.U16(G)===ptnsz&&(fmt=0)}for(Y=0,G=ptntp;Y<ptn;Y++,G+=2){if((E=X.U16(G)<<4)>X.Sz()&&X.isHeuristicScan())return bad=bad.addIfNone("!badptnp"),1
if(0==fmt&&2112<X.U16(E))return}}return 1}}function Es(){var e=0
if(X.c("'IMPM'"))type="it"
else{if(!X.c("'tpm.'"))return
type="mpt"}if((ord=X.U16(32,_LE))||e++,99<(ins=X.U16(34,_LE))&&e++,255<(smp=X.U16(36,_LE))&&e++,(ptn=X.U16(38,_LE))||X.isHeuristicScan()||e++,!(X.Sz()<192+4*(ins+smp+ptn)||(cwtv=X.U16(40,_LE),cmwt=X.U16(42,_LE),flags=X.U16(44,_LE),special=X.U16(46,_LE),128<(gvol=X.U8(48))&&e++,128<(mvol=X.U8(49))&&e++,(spd0=X.U8(50))||e++,(tmp0=X.U8(51))<31&&e++,128<(sep=X.U8(52))&&e++,msglen=X.U16(54,_LE),(msgofs=X.U32(56,_LE))+msglen>X.Sz()&&e++,2<e))){bad="",e&&(bad=bad.addIfNone("!badinitinfo")),pwd=X.U8(53),nreserved=X.U32(60,_LE),sreserved=X.SA(60,4),tracker=auth="",mVlsw=mVcw=sV="?",ch=1,cord=0,K=-1
var s=0,t=0
if(type="it",chnm=[],insnlst=[],smpnlst=[],X.isDeepScan()){var w=0<=X.fSig(64,64,"FF"),r=0
function i(s){return s.slice(0,1)+"."+s.slice(1,3)+"."+s.slice(3,5)+"."+s.slice(5,7)}if(X.c("'tpm.'"))type="mpt",G=X.Sz()-4,s=X.U32(G,_LE),X.c("'228'04'mptm'",s)?K=X.Sz():s=0
else{if(2184<cwtv<=4095&&(G=X.Sz()-4,256<=(s=X.U32(G,_LE))<X.Sz()-4))if(X.c("'228'04'mptm'",s)){if(type="mpt",K=X.Sz(),4096<=cwtv)return sV="future",charset="UTF8",extsmp=0,1}else s=0
"it"===type&&(20480==(61440&cwtv)?(r=(4095&cwtv)<<16,X.c("'OMPT'",60)?0:19464192<=r&&(r|=65535&nreserved),mVlsw=i(r.toString(16).toUpperCase().padStart(7,"0"))):2184===cwtv||2184===cmwt?mVlsw="1.17.00.00":532!==cwtv||514!==cmwt||nreserved?768!==cwtv||768!==cmwt||nreserved||256!==ord||128!==sep||pwd||(mVlsw="1.17.02.20",0):(mVlsw="1.09.00.00",tracker="ModPlug Tracker b3.2 - 1.09",0))}var n=-1,a=0
if("mpt"===type&&2186<cwtv&&cwtv<=2189){if(G=192,X.U16(G,_LE))return
if(G+=2,n=X.U32(G,_LE),G+=4,256<n||X.Sz()<G+4*n)return}else G=192
for(0<=n&&(ord=n),Y=0;Y<ord;Y++)n<0?254===(o=X.U8(G++))?a=65534:(cord++,255===o&&(a=65535)):(o=X.U32(G,_LE),G+=4,a=o,cord++)
minp=4294967295
var L=[]
for(Y=0;Y<ins;Y++){if((e=X.U32(G,_LE))<=(G+=4)||e>X.Sz())return
q=X.readBytes(e+32,26,!0),""!=(q=decEncoding(q,CP437,!1).trim())&&insnlst.push(q),K<e&&(K=e),e&&e<minp&&(minp=e),L.push(e)}var p=[]
for(Y=0;Y<smp;Y++)e=X.U32(G,_LE),G+=4,e>X.Sz()&&(bad=bad.addIfNone("!short")),q=X.readBytes(e+20,26,!0),""!=(q=decEncoding(q,CP437,!1).trim())&&smpnlst.push(q),K<e&&(K=e),e&&e<minp&&(minp=e),p.push(e)
var d=[]
for(Y=0;Y<ptn;Y++){if(e=X.U32(G,_LE),G+=4,30<e&&e<=G||e>X.Sz())return
K<e&&(K=e),e&&e<minp&&(minp=e),d.push(e)}1&special&&(minp=Math.min(minp,msgofs),K<msgofs+msglen)&&(K=msgofs+msglen)
r=!(532!==cmwt||cwtv&&532!==cwtv||X.U16(30)||pwd||nreserved||192&flags)
if(r&&!ins&&smp&&G+4*p.length+2<=minp){var c=!0
for(Y=0;Y<smp;Y++){if(X.U32(G)){c=!1,G-=4*Y
break}G+=4}c&&(tracker="UNMO3 <= v2.4")}r&&!cwtv&&(tracker="UNMO3 v0/1"),2&special?(T=X.U16(G),X.Sz()>G+8*T&&G+8*T<=minp&&(G+=2+8*T,r)&&!T&&(tracker=4&special?"UNMO3 <= 2.4.0.1":"UNMO3")):r&&special<=1&&!X.U16(G)&&(tracker="UNMO3 <= 2.4",G+=2)
var m=0
if((128&flags||8&special)&&(G+=4896),G>X.Sz())return
for(var f=hasPluginChunks=hasMPTM=!1;G+9<X.Sz();){if(hkhd=X.SA(G,4),hksz=X.U32(G+4,_LE),"MODU"===hkhd)f=!0
else if("CNAM"===hkhd)for(ch=hksz/20,m=G+8,hasMPTM=!0,Y=0;Y<ch;Y++)e=X.SA(m,20).trim(),m+=20,""!=e&&chnm.push(e)
else"PNAM"===hkhd?hasMPTM=!0:"CHFX"!==hkhd&&!/F[X0-9]\d\d/.test(hkhd)||(hasPluginChunks=!0)
if(0<=["IMPI","IMPS","XTPM","STPM"].indexOf(hkhd)||G+8+hksz>X.Sz()||G>=msgofs)break
G+=8+hksz}535!==cwtv||512!==cmwt||nreserved||f||(tracker=hasMPTM||0<ord&&65535==a||w?(mVlsw="1.16.00.00","ModPlug Tracker 1.09-16"):(mVlsw="1.17.00.00","OpenMPT 1.17 (compat.export)"),0)
var l,t=0<smp?p[smp-1]+80:G,b=!1,U=!(extsmp=[])
for(Ss=[],maxsmpofs=-1,Y=0;Y<smp;Y++)if(p[Y])if(p[Y]>X.Sz())bad=bad.addIfNone("!short")
else{X.c("'IMPS'",p[Y])||(bad=bad.addIfNone("!badsmp"))
var u=X.U8(p[Y]+18),z=X.U8(p[Y]+46),E=X.U32(p[Y]+48),k=X.U32(p[Y]+72)
if(S={ofs:0,slen:0,bits:2&u?16:8,chn:1,en:"LE",codec:"sPCM",bps:0,length:0},G=k,S.ofs=k,S.slen=E,64===z)G+=12
else if(128===z)e=readVarUInt(G),extsmp.push(X.SA(G+1,e[1])),G+=e[0]+e[1]
else if(X.c("'fLaC'",k))S.codec="FLAC"
else if(X.c("'OggS'",k))S.codec="Ogg"
else{switch(S.codec=1&z?"sPCM":"uPCM",4&u&&532<=cwtv&&(S.chn=2),8&u?S.codec=4&z?"IT215":"IT214":2&u||255!=z?(2&z&&(S.en="BE"),4&z&&(S.codec="dPCM"),8&z&&(S.codec="8d16")):S.codec="ADPCM",S.codec){case"sPCM":case"uPCM":case"dPCM":case"fPCM":case"MT2":case"fPCM15":case"fPCM23":case"fPCMn":case"sPCMn":S.bps=S.bits
break
case"8d16":S.bps=16
break
case"ADPCM":S.bps=4
break
case"uLaw":case"aLaw":S.bps=8
break
default:S.bps=0}S.bps?(S.length=E*S.chn*(S.bps>>3),G+=S.length):b=!0,Ss[Y]=S}K<(t=t<G?G:t)&&(K=t),"uPCM"===S.codec&&E&&(U=!0)}if(U&&516===cwtv&&512===cmwt&&!special&&!nreserved&&21==(-9&flags)&&128===gvol&&48===mvol&&128===sep&&!pwd&&!msglen){for(Y=0;Y<64;Y++)if([32,64].indexOf(X.U8(64+Y))<0){U=!1
break}if(U)for(Y=0;Y<64;Y++)if(64!=X.U8(128+Y)){U=!1
break}if(U)for(Y=20;Y<26;Y++)if(X.U8(4+Y)){U=!1
break}U&&(tracker="XM Conversion")}for(Y=0;Y<ptn;Y++)if((e=d[Y])&&!(e>X.Sz())){X.U16(e,_LE)
var F=X.U16(e+2,_LE)
if(e+=4,!(!F||1024<F||e+4>X.Sz())){G=e+4
for(var _,O=[],B=0;B<F&&G<X.Sz();)(x=X.U8(G++))?((_=127&x)&&_--,128&x&&(O[_]=X.U8(G++)),15&O[_]&&ch<=_&&_<127&&(ch=_+1),1&O[_]&&G++,2&O[_]&&G++,4&O[_]&&G++,8&O[_]&&(G+=2)):B++
K<(t=t<G?G:t)&&(K=t)}}if(ch=ch||1,t&&(G=t,b)){if((S=Ss[Ss.length-1]).bps)S.bps%8?S.length=("ADPCM"==S.codec?16:0)+Math.ceil((E+1)/2*S.ch):S.length=("ADPCM"==S.codec?16:0)+S.slen*S.bps/8*S.chn
else if(4==S.bps&&1==S.chn&&"LE"==S.en&&"ADPCM"==S.codec)S.length=16+(S.slen+1)/2,G+=S.length
else if(1<S.slen&&("IT214"===S.codec||"IT215"===S.codec)){for(var m=G,V=0,W=0;m<X.Sz()&&V<S.slen;){if(X.c("'XTPM'",m)||X.c("'STPM'",m)||X.c("'228'04'mptm'",m)){W=1,G=m
break}V+=ucsz=X.U16(m,_LE),m+=2+ucsz}if(W)G=m
else{var v=bit_buf=cend=readdef=0
function R(s){for(;v<s;)bit_buf|=Util.shlu64(X.U8(G++),v),v+=8
var e=bit_buf&Util.shlu64(1,s)-1
return bit_buf=Util.shru64(bit_buf,s),v-=s,e}for(defW=16==S.bits?(fetchA=4,lowerB=-8,upperB=7,17):(fetchA=3,lowerB=-4,upperB=3,9),_=0;_<S.chn;_++){var g=S.slen,A=csz=clen=topbit=0
for(cend=G;g&&G<X.Sz();)if(csz=X.U16(G,_LE),cend=(G+=2)+csz,csz){if(cend>X.Sz()){_=3599,bad=bad.addIfNone("!short")
break}clen=Math.min(g,32768>>(S.bits>>4))
var D=defW
for(bit_buf=v=0;clen&&G<X.Sz();){if(D>defW){bad=bad.addIfNone("!badITsmp"),g=0
break}if(A=R(D),topbit=1<<D-1,D<7){if(A==topbit){D<=(A=R(fetchA)+1)&&A++,D=A
continue}}else if(D<defW){if(A>=topbit+lowerB&&A<=topbit+upperB){D<=(A-=topbit-1+lowerB)&&A++,D=A
continue}}else if(A&topbit){D=1+(255&A)
continue}clen--,g--}}else readdef=10,_log("IT @"+Hex(G)+" malformed sample?")
G>X.Sz()&&(bad=bad.addIfNone("!short"))}}}else"FLAC"!==S.codec&&"Ogg"!==S.codec&&("AMS"===S.codec&&1==S.chn?(sOption("\n!!! Please send this file to the detector dev!!! Poor fella hasn't any to test on"),l=X.U32(G+4,_LE),X.U8(G+8),S.length=l+9):"8d16"===S.codec&&1==S.chn&&16==S.bps?sOption("\n!!! Please send this file to the detector dev!!! Poor fella hasn't any to test on"):"MDL"===S.codec&&1==S.chn&&S.bps<=16?(l=X.U32(G),S.length=4+l):"DMF"===S.codec&&1==S.chn&&S.bps<=16?sOption("\n!!! Please send this file to the detector dev!!! Poor fella hasn't any to test on"):"uLaw"!==S.codec&&"aLaw"!==S.codec||16!=S.bps||(S.length=S.slen*S.chn))
K<G&&(K=G)}if(X.c("'XTPM'",G)){for(G+=4;G+6<X.Sz()&&(e=X.SA(G,4),it=X.U32(G),!("STPM"===e||"228"===e||2155905152&it))&&1616928864&it;){var M=X.U16(G+4,_LE)
for(G+=6,Y=0;Y<ins;Y++)G+=M}K<G&&(K=G)}if(X.c("'STPM'",G)){for(G+=4;G+7<X.Sz();){if(e=X.SA(G,4),it=X.U32(G),M=X.U16(G+4,_LE),"228"===e||"228"==e){s=G
break}if(2155905152&it||!(1616928864&it)||G+6+M>X.Sz())break
switch(G+=6,e){case"...C":var C=0
switch(M){case 2:C=X.U16(G,_LE)
break
case 3:C=X.U24(G,_LE)
break
case 4:C=X.U32(G,_LE)
break
default:C=X.U8(G)}C>ch&&(ch=C)
break
case".VWC":A=0
switch(M){case 1:A=X.U8(G)
break
case 2:A=X.U16(G,_LE)
break
case 3:A=X.U24(G,_LE)
break
case 8:A=X.U64(G,_LE)
break
default:A=X.U32(G,_LE)}A&&(mVcw=i(A.toString(16).toUpperCase().padStart(7,"0")))
break
case"VWSL":A=0
switch(M){case 1:A=X.U8(G)
break
case 2:A=X.U16(G,_LE)
break
case 3:A=X.U24(G,_LE)
break
case 8:A=X.U64(G,_LE)
break
default:A=X.U32(G,_LE)}A&&(mVlsw=i(A.toString(16).toUpperCase().padStart(7,"0")))
break
case"AUTH":auth=X.SC(G,M,"UTF8")}G+=M}K<G&&(K=G)}if(tunings=0,X.c("'HSCT'",G)){var T=!1,A=X.I32(G+4,_LE)
G+=8,1==A?(sOption("Please send this file to the detection author!!! This is ultra-rare, how did you make it?!"),G=(G+=X.U32(G))+(4+Math.min(256,j))):2==A?G+=1+X.U8(G):(T=!0,bad=bad.addIfNone("!badtuningver")),T||(tunings=X.U32(G+2),G+=6,e=X.fSig(G,4096,"'FSCT'"),G<=e&&(G=e+4)),K<G&&(K=G)}else if(X.c("'228'04'mptm'",G)){function I(s){var e=0,t=0,r=0
if(!(G+1<X.Sz()))return 0
if(e=X.U8(G++),16==s)t=1&e
else if(32==s)t=3&e
else{if(64!=s)return 0
t=(1<<(3&e))-1}for(var r=16==s?e>>1:e>>2,i=0;i<t;i++){if(e=0,!(G+1<X.Sz()))return 0
r|=(e=X.U8(G++))<<8*(i+1)-2}return r}if(s=s||G,(function(){var s
return!X.c("'228'",G)||(posstart=G,G+=3,s=X.U8(G++),h=X.SA(G,s),G+=s,flagbyte=0,hd=X.U8(G++),idbytes=3==(3&hd)?4:3&hd,twochar=64&hd,1<(hsz=I(32))&&((e=X.U8(G++))||(flagbyte=X.U8(G)),G+=hsz-1),s=i((e=16&hd?I(64):e).toString(16).toUpperCase().padStart(7,"0")),"?"===mVlsw&&(mVlsw=s+"[mptinfo]"),32&hd&&(G+=X.U8(G++)),1&flagbyte&&(e=X.U8(G++),idbytes=1&e?65535:e>>1),fes=0,2&flagbyte&&(fes=I(32)),hasstartpos=4&hd,hassz=8&hd,hasid=idbytes,hasdesc=128&hd,hasmap=hasid||hasstartpos||hassz||hasdesc,4&flagbyte&&(e=I(16),G+=e*(twochar?2:1)),8&flagbyte&&(G+=5),entries=I(64),hasmap&&(e=I(64)),G>X.Sz())?void 0:(rposMapBegin=hasmap?e:G-posstart,1)})()&&(hasmap||fes))for(G=posstart+rposMapBegin,Y=0;Y<entries&&G<X.Sz();Y++){var N=idbytes
65535==N&&(N=I(16)),G+=N,hasstartpos&&I(64),fes||hassz&&I(64),hasdesc&&(e=I(16),G+=e*(twochar?2:1))}K<G+4&&(K=G+4),X.U32(G,_LE)!=s&&(bad=bad.addIfNone("!badmptptr"))}if("?"!=(mVlsw="?"===mVlsw&&2184===cwtv?"1.17.00.00":mVlsw)&&""===tracker)tracker="OpenMPT",isCompatX=20480==(61440&cwtv),(isCompatX="1.17.00.00"===mVlsw&&"OMPT"!=sreserved?!1:isCompatX)?tracker+=" (compat. export)":("1.17.02.54"<mVlsw&&mVlsw<"1.18.02.00"&&"1.18.00.00"!=mVlsw||"1.18.02.00"<mVlsw&&"00"!=mVlsw.slice(mVlsw.length-2,mVlsw.length))&&(tracker+=" (test build)")
else{8191===cwtv?nreserved:cwtv
switch(cwtv>>12){case 0:f?tracker="BeRoTracker":532!==cwtv||512!==cmwt||9!==flags||special||X.U16(62)||ins||ptn+1!==ord||128!==gvol||100!==mvol||1!==spd||128!==sep||pwd||msglen||msgofs||nreserved?532!==cwtv||512!==cmwt||X.U16(62)||nreserved?532===cwtv&&532===cmwt&&"CHBI"===sreserved?tracker="ChibiTracker":532===cwtv&&532===cmwt&&special<=1&&!pwd&&!nreserved&&4==(4262&flags)&&1<smp&&X.c("'XXXXXXXX.YYY'",p[1]+4)?tracker="CheeseTracker":cwtv||""!==tracker?cmwt<768&&""===tracker&&(tracker=532<cmwt?"Impulse Tracker 2.15":isWithin(cwtv,533,535)?"Impulse Tracker 2.14p"+(533==cwtv?"1-2":534==cwtv?"3":"4-5"):"Impulse Tracker "+((3840&cwtv)>>8)+"."+(255&cwtv).toString(16).padStart(2)):tracker="Unknown":(mVlsw="1.00.00.A5",tracker="ModPlug Tracker 1.00a5",0):tracker="OpenSPC conversion"
break
case 1:var x,P,y=4095&cwtv
tracker=y<=80?"Schism Tracker 0."+y.toString(16):((P=(y=734016+(y<4095?y-80:nreserved))-(365*(x=Util.div64(1e4*y+14780,3652425))+Util.div64(x,4)-Util.div64(x,100)+Util.div64(x,400)))<0&&(P=y-(365*--x+Util.div64(x,4)-Util.div64(x,100)+Util.div64(x,400))),y=Util.div64(100*P+52,3060),"Schism Tracker "+(x+Util.div64(y+2,12)).padStart(4,"0")+"-"+((y+2)%12+1).padStart(2,"0")+"-"+(P-Util.div64(306*y+5,10)+1).padStart(2,"0"))
break
case 4:tracker="pyIT "+((3840&cwtv)>>8)+"."+(255&cwtv).toString(16)
break
case 6:tracker="BeRoTracker"
break
case 7:tracker=32767===cwtv&&533===cmwt?"munch.py":"ITMCK "+(cwtv>>8&15)+"."+(cwtv>>4&15)+"."+(15&cwtv)
break
case 13:tracker=56043==cwtv?"spc2it":53710==cwtv?"itwriter":"unknown"}}}"?"!=mVlsw?(charset="CP1252",sV="?"==mVcw?mVlsw:mVcw!=mVlsw?"cw:"+mVcw+"/lsw:"+mVlsw:mVcw):(charset="CP437","?"!=mVcw&&(sV=mVcw))
var H=0
for(Y=0;Y<bad.length;Y++)"!"==bad[Y]&&H++
return H<3}}function ks(s){if(!(X.Sz()-s<202)){G=0
var e=Math.min(65535,X.Sz()+512*X.isHeuristicScan()),t=[],r=[],i=[],n=[]
if(bad="",4<(ttn=X.U8(s+99))){if(!X.isHeuristicScan())return
bad=bad.addIfNone("!badtuning")}if(tmp0=X.U8(s+100)){if(ord=X.U8(s+101),(ptnp=s+202+ord)!=X.U16(s+103)+s||ptnp>X.Sz()-2)return d("!badptnp+"+Hex(ptnp)),0
if((lp=X.U8(s+102))>ord-1)return d("!badlp"),0
for(orn=smp=mp=0,s||(ptnp0=ptnp),G=s+105;G<s+169;G+=2)X.U16(G)&&smp++
for(;G<s+201;G+=2)X.U16(G)&&orn++
for(ptn=Y=0,G=s+201;Y<=255&&255!=(o=X.U8(G++));Y++){if(o%3)return
n.indexOf(o/3)<0&&n.push(o/3),o/3>ptn&&(ptn=o/3)}if(ptn++,!Y||Y!=ord)return d("!realord:"+Y+" != ord:"+ord),0
for(E=X.readBytes(s,10),tracker="",nv=0<=charStat(E,1).indexOf("allasc")?"ProTracker"==(E=decEncoding(E,CPSpeccy))?(tracker="Pro Tracker",sv="v"+X.SA(s+11,4).trim(),X.U8(s+13)-48):(sv="Vortex Tra"==E?(tracker="Vortex Tracker ][","v"+X.SA(s+18,4).trim()):(tracker='"'+X.SA(s,14)+'"',"v3.x"),7):(tracker="hacked Pro Tracker",sv="v3.x",7),Y=notes=0;Y<3*ptn&&G<e;Y++,G+=2){if(!isWithin(E=X.U16(G)+s,G,e))return d("!badptnp2:"+Hex(E)),0
if(!(n.indexOf(Util.divu64(Y,3))<0)&&!c(i,trk=[E,0])){for(var a=0,p=!1;!p&&a<256&&E<e;){for(eol=!1,z=0;!eol&&E<X.Sz();)0==(k=X.U8(E++))?eol=p=!0:1==k||8==k?z+=3:2==k?z+=5:0<=[3,4,6,9].indexOf(k)?z++:5==k?z+=2:7==k?bad=bad.addIfNone("!badcmd07h"):16==k?(k=X.U8(E++),y=X.U16(105+k)+s,t.indexOf(k)<0&&(y>s&&!isWithin(y,ptnp,e)&&(bad=bad.addIfNone("!badsmp")),t.push(k))):k<32?(E+=2,k=X.U8(E++),y=X.U16(105+k)+s,t.indexOf(k)<0&&(y>s&&!isWithin(y,ptnp,e)&&(bad=bad.addIfNone("!badsmp")),t.push(k))):k<64||(k<80?(k&=15,r.indexOf(k)<0&&(r.push(k),mp<(y=X.U16(s+169+2*k)+s))&&(mp=y)):k<176?(notes++,eol=!0):176!=k&&(177==k?a+=X.U8(E++):k<192?E+=2:192==k?eol=!0:k<208||(208==k?eol=!0:k<240?(k=(31&k)<<1,y=X.U16(s+105+k)+s,t.indexOf(k)<0&&(y>s&&!isWithin(y,ptnp,e)&&(bad=bad.addIfNone("!badsmp1")),t.push(k))):(k&=15,r.indexOf(k)<0&&(r.push(k),mp<(y=X.U16(s+169+2*k)))&&(mp=y),k=X.U8(E++),y=X.U16(s+105+k)+s,t.indexOf(k)<0&&(y>s&&!isWithin(y,ptnp,e)&&(bad=bad.addIfNone("!badsmp2")),t.push(k))))))
if(a++,E+=z,z=0,256<a){if(!X.isHeuristicScan())return d("!badlines"),0
bad=bad.addIfNone("!badlns")}}trk[1]=E-trk[0],c(i,trk)||i.push(trk),mp<E&&(mp=E)}}if(E=findIntersections(i,!0).length){if(!X.isHeuristicScan()||5<E)return d("trackxsections"),0
bad=bad.addIfNone("!trkxsec")}if(E=findGaps(i,0).length){if(!X.isHeuristicScan()||5<E)return d("trackgaps"),0
bad=bad.addIfNone("!trkgap")}return(rsmp=t.length,rorn=r.length,!(rptn=n.length)||32<rsmp)?(d("!rptn="+rptn+",rsmp="+rsmp),0):X.fStr("compilation of",10,20)<0&&!rsmp?(d("!nosmp"),0):(K=mp+2+X.U8(mp+1),1)}}function d(s){1<debug&&_l2r("pt3",G,s)}function c(s,e){for(var t=0;t<s.length;t++)if(s[t][0]==e[0])return 1}}function Fs(s){switch(s){case 1:sv="v1.04+"
break
case 0:sv="v1.00~3"
break
default:return}var e=Math.min(X.Sz(),65536)
if(!(e<78)){var t=X.U16(69),r=X.U16(71),i=X.U16(74)
if(isWithin(t,78,e)&&isWithin(r,78,e-11)&&isWithin(i,78,Math.min(e,140))&&!(i%2)){var n=X.U16(i)+s*i,t=X.U16(76)+76*s,a=X.U16(i-2)+76*s
if(!(t>Math.min(i+64,X.Sz()-5)||e<=n||e<=a||n-a<8||(n-a)%6!=2)){for(G=t+4,smp=0;G<e&&32&X.U8(G);G+=6)smp++
if(!(65534<G||G>X.Sz())){if(0<i-76-2){if(G+3!=X.U16(78)+76*s)return}else if(G+4!=n)return
if(G=r+1,255!=X.U8(G)){for(ord=ptn=0;G+3<e;){if(!isInside(X.U16(G+1),n,r)||!isInside(X.U16(G+3),n,r)||!isInside(X.U16(G+5),n,r))return
if(G+=8,ord++,255==X.U8(G)){if(X.U8(G-1)>=ord)return
lp=X.U8(G-1)
break}ptn=Math.max(ptn,X.U8(G-1)+1)}return K=G+3,dly=X.U8(73),ftitle=0<=charStat(X.readBytes(0,24),!0).indexOf("allasc"),fby=0<=charStat(X.readBytes(46,23),!0).indexOf("allasc"),1}}}}}}function ss(){if(!(X.Sz()<8||(orntp=X.U16(5))>X.Sz()-6||(ptntp=X.U16(7),(j1=ptntp-orntp)<=0)||(smptp=X.U16(3),(j2=orntp-smptp)<=0)||(ordp=X.U16(1),(j3=smptp-ordp)>X.Sz())||(j4=ordp-9)<=0)){if(j4%130){if(j4<55||(j4-55)%130)return
fID=!0}else fID=!1
if(smp=X.U8(smptp),isWithin(smp,1,16)&&(G=130*smp+9+(fID?55:0),ordp==G)&&(ord=X.U8(G))){for(ptn=Y=0;Y<ord;Y++)ptn=Math.max(ptn+1,X.U8(G+1+2*Y))
if(G+=2*ord+1,(smptp==G||smptp==G+2)&&(orn=X.U8(orntp))&&!(16<orn)&&(G=smptp+2*smp+1+32*orn,orntp==G)&&(G+=2*orn+1,X.U16(ptntp)==G)&&(base=X.U16(smptp+1)-9,fID&&(base-=55),!(base<0))&&(G=X.U16(orntp+1)-base)==smptp+2*smp+1){for(Y=G;Y<G+32;Y++)if(X.U8(Y))return
for(j8=-1,G=ordp+2,Y=0;Y<ord;Y++){if((b=X.U8(G))%6)return
j8<b&&(j8=b),G+=2}if(bad="",(K=ptntp+j8+6)-1>X.Sz()&&(bad=bad.addIfNone("!short")),!(65536<base+G))return!0}}}}function _s(){function s(s){for(;G<X.Sz()&&(E=X.c(s,G),G+=2,!E););}function e(s){for(;0<G&&(G-=2,!X.c(s,G)););}if(fmt="",G=0,X.c("48E7F0F0")){if(!X.c("424047FA FFF84A2B",4))return
if(fmt="old",!X.isVerbose())return 1
for(a0=G=12,s("43FA"),d7=G+X.U16(G,_BE)+1,s("228A"),d2=(G+=2)-8+X.U16(G-8,_BE),s("137B"),d6=a4=G+X.U16(G,_BE)-1,k=1;d6<X.Sz()&&(d6+=10,X.U16(d6,_BE))&&!X.U8(d6);)k++
e("48E7")
var t,r=X.U16(a4+2,_BE)
for(d0=k;d0--;)for(a4+=2,d3=4;d3--;)E=X.U16(a4,_BE),a4+=2,E<r&&(r=E)
for(G=r,r=t=X.U16(G,_BE),G+=2;(E=X.U16(G,_BE))&&(E<r&&(r=E),t<E)&&(t=E),(G+=2)<d7;);for(a3=r,synsmp=r-d2>>7,G=t;G<X.Sz()&&!(0<=[133,135].indexOf(X.U8(G)));)G++
d0=0
do{for(;a3<X.Sz()&&!(0<=[133,135].indexOf(X.U8(a3)));)a3++}while(a3++,d0++,a3<G)
if(G++,a3=d6){for(d1=128,found=!1;d1--&&!found;)E=X.c("41FA",a3),a3+=2,E&&(found=!0)
if(found){for(a3+=X.U16(a3,_BE);a3<X.Sz()&&(X.c("FF",a3+4)||X.c("FF",a3+6));)a3+=18
G=a3}K=G,steps=d0}}else{for(G=172;G<224&&(E=X.c("48E7",G),G+=2,!E););if(224<G)return
if(!X.c("F8FC",G)&&!X.c("F8F8",G))return
if(!X.c("08F90001 00BFE001 33FC0780 00DFF09A 47FA",G+2))return
if(65536-(G+=20)-X.U16(G,_BE))return
if(fmt="new",!X.isVerbose())return 1
G=0,s("48E7"),s("49F9"),G+=6,s("7600"),d0=X.U16(G-10,_BE)
for(var i="10320000";G<X.Sz()&&!X.c(i,G);)G+=2
for(a4=G-2+X.U16(G-2,_BE),s("48E7"),G=a3=G-6,s("43FA"),G+=X.U16(G,_BE)-1,a4-=G,d3=Util.divu64(a4,18),k=1,d2=0;G<X.Sz()&&(G+=18,d2=X.U16(G,_BE),!X.U8(G,_BE))&&!(--d2<=0);k++);for(d3<k&&(k=d3),G=a3,e("45FA"),d0=G=G-2+X.U16(G-2,_BE),synsmp=smp=d5=0,smpp=G+=4;G<X.Sz();)if((E=X.U32(G,_BE))>d0){if(smp||(d5=E),E<=d5&&(d5=a4=E),smp++,(G+=10)>a4)break}else synsmp++,G+=10
for(Y=smp+synsmp,K=0,G=smpp;Y--&&G<X.Sz();)E=X.U32(G,_BE)+X.U16(G+4,_BE),K<E&&(K=E),G+=10}return 1}function Os(){var s=modp=ofsdiff=0
if(bad="",(function(){if(!(X.Sz()<2830)&&X.c("4EFA....4EFA....4EFA....4EFA")&&!((s=X.I16(2,_BE)+2)<=16||s%2)&&(X.c("123A.... B0016200 007E47FA 08761680 45FA0873 49FA086E D5C01892 E7887E03 7C0041FA 08D8",s)||X.c("42380001 123A.... B0016200 007E47FA 08B61680 45FA08B3 49FA08AE D5C01892 E7887E03 7C0041FA 0918",s))){for(Y=0;Y<4;Y++)if(X.c("123A....B001",s+2*Y)){modp=s+2*Y+1+X.I16(s+2*Y+2,_BE)
break}if(!(4==Y||modp>X.Sz()))for(;Y<60;Y++)if(X.c("47FA....D7FA",s+2*Y))return ofsdiff=s+2*(Y+1)+X.I16(s+2*Y+2,_BE),1}})()&&(s=modp+1,!(10<(k=X.U8(s++)+1)))){for(spd0=X.U8(s++),spds=[],Y=0;Y<10;Y++)E=X.U8(s++),spds.indexOf(E)<0&&spds.push(E)
s++
var e=ofsdiff+X.U32(s,_BE),t=ofsdiff+X.U32(s+4,_BE),r=(Math.abs(e-t),[]),i=[],n=[]
for(Y=0,ord=[],s+=620;Y<k;Y++)r[Y]=[0,0,0,0],ord[Y]=0
for(Y=0;Y<k;Y++)for(l=0;l<4&&s<X.Sz();l++,s+=2)r[Y][l]=X.U16(s,_BE)-8*k>>1
if(!(s>X.Sz())){for(ordp=s,otsz=Math.min(e,t)-s>>1,Y=0;Y<otsz;Y++,s+=2)i.push(X.I16(s,_BE))
for(trksz=Math.abs(e-t),Y=tr=0;Y<trksz;tr++){for(si=Y;128!=X.U8(s+Y++)&&Y!=trksz&&s+Y<X.Sz(););if(Y==trksz&&128!=X.U8(s+Y-1))break
n[si]=tr}for(Y=0;Y<k&&s<X.Sz();Y++)for(l=0;l<4&&s<X.Sz();l++)for(on=!0,_=r[Y][l];_-r[Y][l]<255&&0<=i[_];_++)if(void 0===n[i[_]])return
for(syn=smp=0,msmpp=2147483647,Msmpp=smpe=0,s=e;;){var a=X.U32(s,_BE),o=X.I16(s+4,_BE),p=X.U16(s+6,_BE)<<1,d=X.U8(s+39)
if(s+40>=X.Sz()||s+63>=msmpp)break
if(255!=d)if(a){if((a+=ofsdiff)>X.Sz())break
a<msmpp&&(msmpp=a),a>Msmpp&&a<X.Sz()&&(Msmpp=a,smpe=a+p),smp++}else{if(-779===o)break
if(-1!=o&&0!=d)return
syn++}s+=64}return K=smp?smpe:s,1}}}function Bs(){if(!(X.Sz()<512)){var s=tp=mdatsz=smplsz=-1,e=0
if(F=album=by="",flag5=-1,tfmxst=!1,X.c("'TFMX-MOD'")){if(s=e=20,K=X.U32(12,_LE),smplsz=K-X.U32(8,_LE),!(mdatsz=X.U32(8,_LE)-8)||!isWithin(K,530,X.Sz()))return
for(;K<X.Sz();){E=X.U8(K)
var t=X.U16(K+1,_LE)
if(K+=3,!E&&!t)break
switch(E){case 1:by=X.SC(K,t,"CP1252")
break
case 2:album=X.SC(K,t,"CP1252")
break
case 5:flag5=X.U8(K)
break
case 6:F=X.SC(K,t,"CP1252")}if(!E){K+=17
break}K+=t}}if(X.c("'TFHD'")){if(s=X.U32(4,_BE),tp=X.U8(8),v=X.U8(9),mdatsz=X.U32(10,_BE),smplsz=X.U32(14,_BE),K=s+mdatsz+smplsz,s<18||!mdatsz||!isWithin(K,530,X.Sz()))return
if(128&tp||!(127&tp))e=G=s
else switch(127&tp){case 1:tp="1.5"
break
case 2:tp="pro"
break
case 3:tp="7v"
break
default:return}}else if(X.c("'TFMX '",e)&&!X.c("'SONG'",e+5))tp="1.5"
else{if(!(X.c("'TFMX-SONG'",e)||X.c("'TFMX_SONG'",e)||X.c("'tfmxsong'",e)))return
var r=0,i=!1,n=X.readBytes(e+256,31),a=(a=X.U32(e+464,_BE))||2048
for(Y=0;Y<31;Y++){var o=!0,p=n[Y]
if(511==p)break
for(;o&&G<X.Sz();)if(G=e+a+16*p,E=X.U16(G,_BE),cmd=X.U16(G+2,_BE),G+=4,61438!=E)o=!1
else switch(cmd){case 1:r?r<0?(p=X.U16(G,_BE),r=X.I16(G+2,_BE)-1,G+=4):(r--,p=X.U16(G,_BE),G+=2):(r=-1,p++)
break
case 2:case 4:p++
break
case 3:i=!0,p++
break
default:o=i=!1}if(i)break}if((function(s){var e,t=X.U32(s+468,_BE)
t?(e=X.U32(s+472,_BE),e=X.U32(s+e,_BE)):(e=X.U32(s+1536,_BE),t=X.U32(s+2044,_BE))
for(var r=X.readBytes(s+e,t-e),i=0;i<r.length;i+=4)if(isWithin(r[i],64,127))return 1})())return
tfmxst=!0,tp=i?"7v":"pro"}for(Y=0,G=e+16,cmt="";Y<6;Y++,G+=40)cmt=cmt.appendS(decAnsi(G,40,CPAmiga).trim(),"  ")
cmt=cmt.trim(),_l2r("tfmxcmt",e+16,decAnsi(G,240,CPAmiga).trim())
var d=[],c=[],m=[]
for(Y=0;Y<32;Y++)d.push(X.I16(G,_BE)),G+=2
for(Y=0;Y<32;Y++)c.push(X.I16(G,_BE)),G+=2
for(Y=0;Y<32;Y++)m.push(X.I16(G,_BE)),G+=2
G+=16
var f=X.I32(G,_BE),l=X.I32(G+4,_BE),b=X.I32(G+8,_BE)
if(l?l-=512:l=512,b?b-=512:b=1024,f?f-=512:f=1536,!((G+=48)>X.Sz())){var S=G,U=Math.min(196608+S,X.Sz())
for(l+=S,b+=S,f+=S,len=0<s?mdatsz:Math.min(U,X.Sz())-G,ins=mip=0,G=b,ino=X.I32(G,_BE);ins<256&&G+4<=X.Sz()&&!(3&(E=X.I32(G,_BE)-512+S)||!isWithin(E,f,U)||E&!X.c("F0000000",E-4)&&!X.c("07000000",E-4)||ins&&8192<Math.abs(E-ino));ins++,G+=4)mip<E&&(mip=E),ins&&(ino=E)
ptn=Math.min(b-l>>2,128)
var u=X.U32(l,_BE)-512+S
if(pt=ptn,(trkst=u-f>>4)<0&&(trkst=0),s<0)switch(Math.max(b,l,mip)){case b:K=b+4*ins
break
case mip:for(G=mip;G<U&&!X.c("07000000",G);G+=4);(K=G)<U&&(K+=4)
break
case l:for(_l2r("tfmx",S,"p:"+Hex(G)+" ptnp:"+Hex(l)+" insp:"+Hex(b)+" trkp:"+Hex(f)+" trkst["+Hex(l)+"="+Hex(u)+"]:"+Hex(trkst)+" len:"+Hex(len)+"/"+Hex(U)),G=l+4,po=X.I32(l,_BE),pt=1;pt<256&&!(3&(E=X.I32(G,_BE)-512+S)||!isWithin(E,f,U)||!X.c("F0000000",E-4)&&!X.c("07000000",E-4)||8192<Math.abs(E-po));G+=4,pt++)po=E
K=G}k=-1
var h=2
for(ord=[0],Y=0;Y<32&&0<h&&(k++,d[Y]||h--,511!=d[Y]&&511!=c[Y])&&(d[Y]<=trkst&&(ord[k]=c[Y]-d[Y]+1),!(d[Y]>=trkst))&&(d[Y]!=c[Y]||d[Y]||d[Y+1]);Y++);return k=k||1,1}}}function Vs(){if(!(X.Sz()<7)&&(z=sig=X.c("'P50A'")||X.c("'P60A'")||X.c("'P61A'")?4:0,smpp=X.U16(z,_BE)+z,ptn=X.U8(z+2))&&!(127<ptn)&&!(32&(smp=X.U8(z+3)))&&(pksmp=64&smp,dtsmp=128&smp,smp&=63)&&!(7+6*smp>X.Sz())&&(pksmp&&(z+=4),!(smpp<z+4+6*smp+8*ptn||smpp>X.Sz()))){smpsz=notes=0
var s=vols=0
for(Y=0,G=z+4;Y<smp;Y++,G+=6){if(isWithin(A=X.U16(G,_BE),32768,65503)||!A)return
if(65503<A&&65535-A>smp)return
var e=128&X.U8(G+2)
if(15<(127&X.U8(G+2))||64<X.U8(G+3))return
if(vols|=X.U8(G+3),isWithin(X.U16(G+4,_BE),A,65534))return
A<65280&&(smpsz+=A<<(e?0:1),s+=A<<1)}if(vols&&(!pksmp||X.U32(z,_BE)==s)){for(Y=0;Y<4*ptn;Y++)if(X.U16(z+4+6*smp,_BE)+4+z+6*smp+8*ptn>smpp)return
if(Y=mptn=0,(function(){for(;255!=(E=X.U8(z+4+6*smp+8*ptn+Y))&&Y<128;Y++){if(E>ptn-1)return
E>mptn&&(mptn=E)}return 1})())v=6
else{if(!(function(){for(;255!=(E=X.U8(z+4+6*smp+8*ptn+Y))&&Y<128;Y++){if(E%2||E>2*ptn)return
E>mptn&&(mptn=E)}return mptn>>=1,1})())return
v=5}if(Y&&128!=Y){if(ord=Y,mptn++,6==v)if(t())sv="6.0"
else{if(!(function(){for(Y=ord+z+5+6*smp+8*ptn;Y<smpp;Y++)if(127!=(E=X.U8(Y))){if(255==E)switch(192&X.U8(Y+1)){case 0:Y++
continue
case 64:Y+=2
continue
case 192:if(Y<X.U16(Y+2,_BE)-1)return
Y+=3
continue}switch(240&E){case 240:if((31&X.U8(Y+1))>smp)return
Y+=2
continue
case 112:if((31&X.U8(Y+1))>smp)return
Y+=1
continue
case 224:Y+=2
continue
case 96:Y+=1
continue}if(128==(128&E)){if((E<<4&16|X.U8(Y+1)>>4)>smp)return
Y+=3}else{if((E<<4&16|X.U8(Y+1)>>4)>smp)return
Y+=2}}return 1})())return
sv="6.1"}else t()&&(sv="5.0")
return 1}}}function t(){for(Y=ord+z+5+6*smp+8*ptn;Y<smpp;Y++)if(128&(E=X.U8(Y)))Y+=3
else{if(73<E||(E<<4&16|X.U8(Y+1)>>4)>smp)return
2<=E&&notes++,Y+=2}return 0<notes}}function gs(){if((bin=parseAtariBinary(0))[0]<256)return 1<debug&&_l2r("rmt","!binsz",void 0),0
if(base=X.U16(2),G=bin[1][0][0],ch=X.U8(G+3)-48,X.c("'RMT'",G)&&[4,8].includes(ch)){var s,e,t,r
X.U8(G+4)
if(spd0=X.U8(G+5),spd)if(ticks=X.U8(G+6))return v=X.U8(G+7),s=G+X.U16(G+8)-base,e=G+X.U16(G+10)-base,t=G+X.U16(G+12)-base,r=G+X.U16(G+14)-base,s>X.Sz()||e<s||t<e||r<t||e>X.Sz()||t>X.Sz()||r>X.Sz()?void 0:1}}function As(){if(!(X.Sz()<421)&&isWithin(unpsz=X.U16(0),782,2849)&&X.c("00000007",2)){var s,e,t=0,r=Math.min(X.Sz(),unpsz),i=new BitReader(4),n=!1,a=0,o=9,p=258,d=[],c=defdictsz=4096,m=[],f=258
for(Y=0;Y<c-256;Y++)m.push({rt:0,cw:0})
var l=[]
for(Y=0;Y<unpsz;Y++)l.push(0)
for(;!n&&i.offset<=r&&t<=unpsz;){if(o<9||12<o)return
switch(e=i.read(o)){case 256:if(c=512,f=p=258,(o=9)<9||12<o)return
if(e=i.read(o),t>=unpsz)return
l[t++]=255&e
break
case 257:n=!0
break
default:S=b=void 0
for(var b=e<p?e:a,S=b;255<S;)d.push(m[S-256].rt),S=m[S-256].cw
if(d.push(255&S),s=255&d[d.length-1],e<p)for(;d.length;){if(t>=unpsz)return
l[t++]=255&d.pop()}else{for(;d.length;){if(t>=unpsz)return
l[t++]=s,d.pop()}if(e!=p)return}f<c&&(m[f-256]={rt:s,cw:a},f++),c<=++p&&o<12&&(o++,c<<=1)}a=e}return n?(K=i.offset,!(131!=l[0]||l[1]||8&l[2]||32&l[3]||128&l[5]||1<l[6])):void 0}}}

================================================
FILE: dbs_min/db/Binary/audio_8svx.1.sg
================================================
function detect(){return Binary.compare("'FORM'")&&-1!=Binary.findString(0,Binary.getSize(),"BODY")&&-1!=Binary.findString(0,Binary.getSize(),"FORM")&&-1!=Binary.findString(0,Binary.getSize(),"ANNO")&&(bDetected=1),result()}meta("audio","8SVX")

================================================
FILE: dbs_min/db/Binary/audio_ACM.1.sg
================================================
function detect(){var e,i,t,r
return!(!File.compare("97280301")||File.getSize()<16||(e=File.read_uint32(4),i=File.read_uint16(8),t=File.read_uint16(10),!(e&&isWithin(i,1,2)&&isWithin(t,6e3,49716))))&&(bDetected=1,Binary.isVerbose()&&(r=(t/1e3).toFixed(1),sOption("ch: "+i+" s/r: "+r+"kHz len: "+secondsToTimeStr(Util.divu64(e+(t>>1),t*i)))),result())}meta("audio","Interplay ACM waveform audio (.ACM)")

================================================
FILE: dbs_min/db/Binary/audio_ADX.1.sg
================================================
function detect(){if(!X.c("8000"))return!1
if(!isWithin(p=X.U16(2,_BE)+4,20,X.Sz()))return!1
if(!X.c("'(c)CRI'",p-6))return!1
if(fmt=X.U8(4),[2,3,4].indexOf(fmt)<0)return!1
if(X.U8(5)%18||4!=X.U8(6))return!1
if(8<(ch=X.U8(7)))return!1
switch(nV=X.U8(18),bDetected=1,sVersion="",nV){case 3:sVersion="v3"
break
case 4:sVersion="v4"
break
case 5:sVersion="v4NL"}switch(fmt){case 2:sVersion+=" fixed-coefficient"
break
case 4:sVersion+=" exponential-scale"}return 0<X.U8(19)&&(sVersion+=" encrypted"),X.isVerbose()&&sOption(X.U8(7)+"ch "+(sr=X.U32(8,_BE))+"Hz len "+secondsToTimeStr(((smp=X.U32(12,_BE))/sr/ch).toFixed(0))),result()}meta("audio","CRI Middleware's ADX 4-bit ADPCM stream (.ADX,.ADP)")

================================================
FILE: dbs_min/db/Binary/audio_AHX.1.sg
================================================
function detect(){return!!X.c("8000")&&!!isWithin(p=X.U16(2,_BE)+4,20,X.Sz())&&!(!X.c("'(c)CRI'",p-6)||(fmt=X.U8(4),[16,17].indexOf(fmt)<0)||X.U8(5)||X.U8(6)||1!=X.U8(7)||6!=X.U8(18))&&(bDetected=1,sVersion="",16===fmt&&(sVersion+="+bigger frames"),0<X.U8(19)&&(sVersion+=" encrypted"),X.isVerbose()&&(0<(sz=X.fSig(p,TOEOF,"'AHXE(c)CRI'"))&&(sz+=10),sOption("1ch "+(sr=X.U32(8,_BE))+"Hz len "+secondsToTimeStr(((smp=X.U32(12,_BE))/sr).toFixed(0))+" sz:"+outSz(sz))),result())}meta("audio","CRI Middleware's AHX ADPCM stream (.AHX)")

================================================
FILE: dbs_min/db/Binary/audio_AIF.1.sg
================================================
function detect(){return Binary.compare("464f524d00......'AIFFCOMM'")&&(bDetected=1),result()}meta("audio","AIF")

================================================
FILE: dbs_min/db/Binary/audio_AU.1.sg
================================================
function detect(){if(X.c("'.snd'"))tp="BE",en=_BE
else if(X.c("'dns.'"))tp="LE",en=_LE
else if(X.c("00'ds.'"))tp="LE-ds.DEC",en=_LE
else{if(!X.c("'.sd'00"))return!1
tp="BE-ds.",en=_BE}if(!isWithin(dataofs=X.U32(4,en),24,X.Sz()))return!1
if(bad="",dataofs<28&&(bad=bad.addIfNone("!badofs"+Hex(dataofs))),datasz=X.I32(8,en),!(ch=X.U32(20,en))||256<ch)return!1
if(!(sr=X.U32(16,en)))return!1
if(bDetected=1,sVersion=tp,fmt=X.U32(12,en),sVersion=29<fmt?sVersion.appendS("unknown format ("+Hex(fmt)+")","/"):sVersion.appendS(["unspecified format","8-bit G.711 μ-law","8-bit linear PCM","16-bit linear PCM","24-bit linear PCM","32-bit linear PCM","32-bit IEEE floating point","64-bit IEEE floating point","Fragmented sample data","nested format","DSP program","DSP 8-bit fixed-point data","DSP 16-bit fixed-point data","DSP 24-bit fixed-point data","DSP 32-bit fixed-point data","unknown format (0Fh)","Sound Kit's visual data","μ-law squelch","16-bit linear w/emphasis","16-bit linear compressed","16-bit linear w/emphasis compressed","Music Kit DSP commands","Music Kit DSP commands: samples","ITU-T G.721 4-bit ADPCM","ITU-T G.722 4-bit SB-ADPCM","ITU-T G.723 3-bit SB-ADPCM","ITU-T G.723 5-bit SB-ADPCM","8-bit G.711 A-law","AES","8-bit Delta μ-law"][fmt],"/"),bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose()){for(info=[],t=24;t<dataofs&&t<X.Sz();)(z=X.fSig(t,Math.min(X.Sz(),256,dataofs-t),"00"))<0&&(z=dataofs),(i=X.SC(t,z-t,"CP437").trim()).length&&info.push(i),t=z+1
sOption(addEllipsis(info.join("; "),192),'info:"','"'),sOption("ch:"+ch+" s/r:"+(sr/1e3).toFixed(1)+"kHz"+(0<datasz?" sz:"+outSz(dataofs+datasz):""))}return result()}meta("audio","NeXT/Sun Au waveform audio (.AU,.SND)")

================================================
FILE: dbs_min/db/Binary/audio_BCSTM.1.sg
================================================
function detect(){var e,i,U,o,c
return!(!X.c("'CSTM'FF")&&!X.c("'CSTM'FE")||X.U8(5)<254||(e=254==X.U8(5)?_LE:_BE,!X.c("'INFO'",ip=X.U32(24,e)))||(ip+=32,!X.c("'SEEK'",t=64+X.U32(68,e)))||t!=X.U32(36,e)||!X.c("'DATA'",t+=X.U32(t+4,e))||t!=X.U32(48,e))&&(bDetected=1,sVersion="v"+X.U32(8,e).toString(16)+"_"+(254==e?"le":"be"),X.isVerbose()&&(i=["PCM8","PCM16","DSP ADPCM","IMA ADPCM"][X.U8(ip)],U=X.U8(ip+1),o=X.U8(ip+2),c=X.U32(ip+4,e),sOption(i+" "+o+"ch "+c+"Hz"+(U?" looped":"")+" sz:"+outSz(X.U32(12,e)))),result())}meta("audio","Nintendo CTR Stream (.BCSTM)")

================================================
FILE: dbs_min/db/Binary/audio_BCWAV.1.sg
================================================
function detect(){if(!X.c("'CWAV'FF")&&!X.c("'CWAV'FE")||X.U8(5)<254)return!1
var e=254==X.U8(5)?_LE:_BE
if(!X.c("'INFO'",ip=X.U32(24,e))||!X.c("'DATA'",X.U32(36,e))||ip+X.U32(ip+4,e)!=X.U32(36,e))return!1
if(bDetected=1,sVersion="v"+X.U32(8,e).toString(16)+"_"+(254==e?"le":"be"),X.isVerbose()){var t=X.U8(ip+8),i=["PCM8","PCM16","DSP ADPCM","IMA ADPCM"][t],r=X.U8(ip+9),o=X.U32(ip+12,e),n=X.U8(ip+28),U=X.U32(X.U32(36,e)+4,e)-8,c=""
switch(t){case 0:c=(U/o/n).toFixed(1).toString()
break
case 1:c=(U/o/2/n).toFixed(1).toString()
break
case 3:c=(2*U/o/n).toFixed(1).toString()}sOption(i+" "+n+"ch "+o+"Hz"+(r?" looped":"")+(c.length?" len "+secondsToTimeStr(c):"")+" sz:"+outSz(X.U32(12,e)))}return result()}meta("audio","Nintendo Binary CTR Wave (.BCWAV)")

================================================
FILE: dbs_min/db/Binary/audio_CXT.1.sg
================================================
function detect(){var e,s,d=12,i=_BE,t=0,c=0,n=0,r=[!1,!1,!1]
if(!(X.Sz()<16)){if(X.c("'RIFX'")&&["MV93","FGDM","MC95","FGDC"].includes(X.SA(8,4)))i=_BE
else{if(!X.c("'XFIR'")||!["39VM","MDGF","59CM","CDGF"].includes(X.SA(8,4)))return
i=_LE}if(!((e=8+X.U32(4,i))<12)){for(;d<X.Sz()&&d<e;){switch(hkhd=X.SA(d,4),s=X.U32(d+4,i),d+=8,"CAS"===hkhd.slice(0,3)?r[0]=1:"KEY*"===hkhd?r[1]=1:"snd"===hkhd.slice(0,3)&&(r[2]=1),hkhd){case"sndH":c++
break
case"sndS":t++
break
case"snd ":n++}d+=s+=1&s}if(r[0]&&r[1]&&r[2])return bDetected=1,sVersion=i==_LE?"le":"be",X.isVerbose()&&sOption("snd:"+n+" sndH:"+c+" sndS:"+t+" sz:"+outSz(e)),result()}}}meta("audio","Adobe Director Protected Cast file (.CXT)")

================================================
FILE: dbs_min/db/Binary/audio_DSS.1.sg
================================================
function detect(){if(X.c("02'dss'")||X.c("03'dss'"))sName="Digital Speech Standard audio (.DSS)"
else{if(!(X.c("02'ds2'")||X.c("03'ds2'")||X.c("02'enc'")||X.c("03'enc'")))return!1
sName="Digital Speech Standard Pro audio (.DS2)"}if(nv=X.U8(0),v1=X.c("'dss'",1),hdrsz=512*nv,X.Sz()<hdrsz)return!1
if(tm=X.SA(38,12),charStat(tm,1).indexOf("allnum")<0||!isWithin(tm.slice(2,4),"01","12")||!isWithin(tm.slice(4,6),"01","31")||!isWithin(tm.slice(6,8),"00","23")||!isWithin(tm.slice(8,10),"00","59")||!isWithin(tm.slice(10,12),"00","59"))return!1
if(tm="20"+tm.slice(0,2)+"-"+tm.slice(2,4)+"-"+tm.slice(4,6)+" "+tm.slice(6,8)+":"+tm.slice(8,10)+":"+tm.slice(10,12),dur=X.SA(62,6),charStat(dur,1).indexOf("allnum")<0||!isWithin(dur.slice(2,4),"00","59")||!isWithin(dur.slice(4,6),"00","59"))return!1
if(dur=dur.slice(0,2)+"h"+dur.slice(2,4)+"m"+dur.slice(4,6)+"s",auth=X.readBytes(12,16),charStat(auth,1).indexOf("allxsc")<0)return!1
if(auth=decEncoding(auth,CP437),v1)switch(cn=X.U8(676)){case 0:co="DSS standard-play mode 11025Hz b/r "+13.860150916277398.toFixed(3)+"k"
break
case 2:co="g723.1 long-play mode 8000Hz"
break
default:co="unknown ("+Hex(cn)+")"}else cn=0,co="DSS standard-play mode"
if(asz=0==cn?hdrsz+3750*(3600*dur.slice(0,2)+60*dur.slice(3,5)+dur.slice(6,8)):-1,cmt="",v1){if(cmt=X.readBytes(798,64),charStat(cmt,1).indexOf("allxsc")<0)return!1
cmt=decEncoding(cmt,CP437)}else for(i=576;i<934;i+=60)": "!=(t=X.SC(i,30,"CP437").trim()+": "+X.SC(i+30,30,"CP437").trim())&&(cmt=cmt.appendS(t,", "))
return bDetected=1,sVersion="v"+nv,X.c("'enc'",1)&&(sVersion+=" encrypted"),X.isVerbose()&&(sOptionT(auth,"by: "),sOption(tm,"on: "),sOption(cmt),sOption(co,"codec: "),sOption(dur,"duration: "),0<asz)&&sOption("approx.filesize: "+(asz/1048576).toFixed(2)+"M"),result()}meta("audio","")

================================================
FILE: dbs_min/db/Binary/audio_EXA.1.sg
================================================
function detect(){if(X.Sz()<32||!X.c("'SC'"))return!1
X.U16(2,_BE)
for(var e=sr=ch=nv=pf=cd1=cd2=-1,a=16,c=_LE,s=X.U16(4)?_LE:_BE,r=0,d=0,i=0;r<X.Sz()&&!i;){var n=X.SA(r,4),t=X.U32(r+4,s)
switch(X.c("'SC'",r)&&d++,n){case"SCHl":if(d++,q=r+8,"GSTR"!==(pfid=X.SA(q,4))&&"PT"!==pfid.slice(0,2)&&(q+=4,pfid=X.SA(q,4)),"GSTR"===pfid)pf=8,q+=4
else{if("PT"!==pfid.slice(0,2))return!1
pf=X.U16(q+2,_LE)}function b(){var e=0,a=X.U8(q++)
if(255==a)return q+=4+X.U32(q,_BE),0
if(4<a)return q+=a,0
for(;0<a;a--)e=Util.shlu64(e,8)+X.U8(q++)
return e}for(q+=4,hdend=0;!hdend&&q<r+t&&q<X.Sz();)switch(X.U8(q++)){case 0:hdend||b()
break
case 3:case 4:case 5:case 6:case 7:case 8:case 9:case 10:case 11:case 12:case 13:case 14:case 15:case 16:case 17:case 18:case 19:case 20:case 21:case 25:case 27:case 28:case 29:case 30:case 31:case 32:case 33:case 34:case 35:case 36:case 37:b()
break
case 252:case 253:break
case 131:cd1=b()
break
case 160:cd2=b()
break
case 128:nv=b()
break
case 129:a=b()
break
case 130:if(6<(ch=b()))return!1
break
case 132:sr=b()
break
case 133:e=b()
break
case 134:case 135:case 136:case 137:case 148:case 149:case 162:case 163:case 143:case 144:case 145:case 171:case 172:case 173:case 26:case 38:case 39:case 40:case 41:case 42:case 140:case 138:case 139:case 141:case 142:case 146:case 147:case 152:case 153:case 156:case 157:case 158:case 159:case 166:case 167:case 161:b()
break
case 255:case 254:hdend=1
break
default:return!1}break
case"SCCl":case"SCDl":d++
break
case"SCEl":d++
case"":case"ÿÿÿÿ":i=!0}r+=t||1}if(i||3<d){if(bDetected=1,0<=[2,3,4,6,8,9,14,16].indexOf(pf)&&(c=_BE),ch<=0&&(ch=1),-1==nv&&(pf<=4?nv=0:pf<=5?nv=1:pf<=8?nv=2:pf<=20&&(nv=3)),sVersion="v"+nv,cd1<0&&0==nv)switch(pf){case 0:case 3:case 4:cd1=0
break
case 1:cd1=6
break
case 2:cd1=5
break
default:bad=bad.addIfNone("!badcodec1")}if(0<=cd1&&cd2<0)switch(cd1){case 0:cd2=0==pf?8==a?2:c==_BE?1:0:8==a?9:c==_BE?7:8
break
case 5:cd2=6
break
case 6:cd2=5
break
case 7:cd2=0==pf||3==pf?3:10
break
case 9:cd2=4
break
default:bad=bad.addIfNone("!badcodec1")}if(cd2<0)switch(pf){case 0:case 3:case 8:case 9:case 10:case 14:cd2=10
break
case 1:case 5:cd2=5
break
case 6:cd2=7
break
case 7:cd2=8
break
case 16:case 20:cd2=18
break
default:bad=bad.addIfNone("!badcodec2")}if(sr<0)switch(pf){case 0:case 1:case 2:case 3:case 4:case 5:case 10:sr=22050
break
case 6:case 7:sr=24e3
break
case 16:case 20:sr=32e3
break
case 9:case 14:sr=44100
break
case 8:sr=48e3
break
default:bad=bad.addIfNone("!badsmprate")}isWithin(pf,0,20)?sVersion+="#"+["PC","Sony Playstation","Nintendo 64","MAC","Sega Saturn","Sony Playstation 2","Nintendo Gamecube/Wii","Microsoft Xbox","Generic","Microsoft X360","Sony PSP","pc-eaac","x360-eaac","psp-eaac","Sony Playstation 3","ps3-eaac","Nintendo Wii","wii-eaac","pc64-eaac","mobile-eaac","Nintendo 3DS"][pf]:sVersion+="#unk.platform",sVersion+=c==_LE?"/le":"/be",c!=s&&(sVersion+="/file"+(s==_LE?"_le":"_be"))
var f=isWithin(cd2,0,27)?["S16LE_INT","S16BE_INT","S8_INT","EA-XA_INT","MT10","VAG","N64","S16BE","S16LE","S8","EA-XA","u8_int","cdxa","ima_int","layer1","Layer2","Layer3",,"GCADPCM","s24le_int","XboxADPCM","s24be_int","MT5","EALayer3","xas0_int","ealayer3_int","ATRAC3","ATRAC3+"][cd2]:cd2<0?"":"SND10"
X.isVerbose()&&sOption((f.length?"codec:"+f+" ":"")+ch+"ch "+sr+"Hz"+(0<a?" "+a+"bit":"")+" len "+secondsToTimeStr((e/sr).toFixed(0))+" sz:"+outSz(r))}return result()}meta("audio","Electronic Arts' EA-XA stream (.EXA)")

================================================
FILE: dbs_min/db/Binary/audio_FLAC.1.sg
================================================
function detect(){if(File.compare("'fLaC'")){for(end=0,p=4,hk=hks=malformed="",ch=rate=bps=smp=smplen=sz=xa=xna=0,seekt=-1;!end&&p<File.getSize();){if(t=File.read_uint8(p),5==p&&255&t)return
switch(last=128&t,mdbt=127&t,mdsz=File.read_uint24(p+1,_BE),p+=4,mdbt){case 0:hk="STREAMINFO",minb=File.read_uint16(p,_BE),maxb=File.read_uint16(p+2,_BE),minf=File.read_uint24(p+4,_BE),maxf=File.read_uint24(p+7,_BE),(minb<16||65535<maxb||minb>maxb)&&(malformed+="!badblksz"),br=new BitReader(p+10,_BE),rate=br.read(20),ch=1+br.read(3),bps=1+br.read(5),smp=br.read(36),smplen=smp/rate
break
case 1:hk="PADDING"
break
case 2:switch(hk="APP",s=File.read_ansiString(p,4)){case"ATCH":hk+=":Flacfile"
break
case"BSOL":hk+=":beSolo"
break
case"BUGS":hk+=":Bugs Player"
break
case"Cues":hk+=":GoldWave"
break
case"Fica":hk+=":CUE Splitter"
break
case"Ftol":hk+=":flac-tools"
break
case"MOTB":hk+=":MOTB MetaCzar"
break
case"MPSE":hk+=":MP3 Stream Editor"
break
case"MuML":hk+=":MusicML"
break
case"RIFF":hk+=":Sound Devices RIFF c.s"
break
case"SFFL":hk+=":Sound Font FLAC"
break
case"SONY":hk+=":Sony Creative Software"
break
case"SQEZ":hk+=":flacsqueeze"
break
case"TtWv":hk+=":TwistedWave"
break
case"UITS":hk+=":UITS Embedding tools"
break
case"aiff":hk+=":FLAC AIFF c.s"
break
case"imag":hk+=":flac-image file"
break
case"peem":hk+=":Parseable Embedded Extensible Metadata"
break
case"qfst":hk+=":QFLAC Studio"
break
case"riff":hk+=":FLAC RIFF c.s (OpenMPT?)"
break
case"tune":hk+=":TagTuner"
break
case"w64 ":hk+=":FLAC Wave64 chunks"
break
case"xbat":hk+=":XBAT"
break
case"xbat":hk+=":xmcd"
break
default:hk+=":<"+s+">"}break
case 3:hk="SEEKTABLE",seekt=p,hk+="#"+Math.floor(mdsz,18)
break
case 4:hk="VORBIS_COMMENT"
break
case 5:for(hk="CUESHEET",xa=xna=0,trkn=File.read_uint8(p+395),u=p+396,i=0;i<trkn;i++)u+=21,128&File.read_uint8(u++)?xna++:xa++,u=(u+=13)+12*File.read_uint8(u++)
break
case 6:hk="PICTURE"
break
case 127:end=1,hk="frames"
break
default:hk="unknown"+Hex(mdbt)}"frames"!=hk&&(hks=hks.append("["+hk+"]")),p+=mdsz,last&&(end=1)}if(sz<p&&(sz=p),t=p+(smp*bps*ch>>3),sz<t&&(sz=t),_log("t:"+t),0<=seekt)for(i=0;i<mdsz/18;i++)smpn=File.read_uint64(seekt+18*i,_BE),seek=p+File.read_uint64(seekt+8+18*i,_BE),st=seek+(File.read_uint16(seekt+16+18*i,_BE)*bps*ch>>3),sz<st&&(sz=st)
if(end=0,!smp&&File.isDeepScan())for(;!end&&p<File.getSize();)end=1
return malformed&&(sVersion+=malformed),bDetected=1,Binary.isVerbose()&&(sOption(Math.floor(smplen/60)+":"+(Math.floor(smplen)%60).padStart(2,"0")),(1<xa||xna)&&sOption("x"+xa+"+"+xna),sOption(hks),sOption(rate+"Hz ch:"+ch+" bps:"+bps),minb===maxb)&&sOption("fixed-size stream"),result()}}meta("audio","FLAC waveform audio (.FLAC)")

================================================
FILE: dbs_min/db/Binary/audio_FSB.1.sg
================================================
function detect(){if(36<=Binary.getSize()&&Binary.compare("'FSB'..")){var e,a=Binary.getString(0,4)
switch(sVersion=a,bDetected=1,a){case"FSB1":case"FSB2":e=Binary.read_int32(4)
break
case"FSB3":case"FSB4":e=Binary.read_int32(4),Binary.read_int32(16),Binary.read_int32(20)
break
case"FSB5":switch(e=Binary.read_int32(8),Binary.read_int32(16),Binary.read_int32(24)){case 1:sOption("PCM8")
break
case 2:sOption("PCM16")
break
case 3:sOption("PCM24")
break
case 4:sOption("PCM32")
break
case 5:sOption("PCMFLOAT")
break
case 6:sOption("GCADPCM")
break
case 7:sOption("IMA ADPCM")
break
case 8:sOption("VAG")
break
case 9:sOption("HEVAG")
break
case 10:sOption("XMA")
break
case 11:sOption("MP3")
break
case 12:sOption("CELT")
break
case 13:sOption("AT9")
break
case 14:sOption("XWMA")
break
case 15:sOption("VORBIS")
break
case 16:sOption("FADPCM")
break
case 17:sOption("OPUS")
break
default:bDetected=0}break
default:bDetected=0}sOption("Samples:"+e)}return result()}meta("audio","FMOD Sample Bank (.FSB)")

================================================
FILE: dbs_min/db/Binary/audio_HMI.1.sg
================================================
function detect(){return Binary.compare("'HMI-MIDISONG061595'0000000000000000000000000000000000000000ff00ffffffffff01")&&(sVersion="2.0",sOptions="MIDI",bDetected=1),result()}meta("audio","Human Machine Interfaces")

================================================
FILE: dbs_min/db/Binary/audio_OGG.1.sg
================================================
function detect(){return Binary.compare("'OggS'00020000000000000000")&&(bDetected=1),result()}meta("audio","Vorbis")

================================================
FILE: dbs_min/db/Binary/audio_PAF.1.sg
================================================
function detect(){return Binary.compare("20'paf'00000000000000000000AC44")&&(bDetected=1),result()}meta("audio","Ensoniq PARIS (.PAF)")

================================================
FILE: dbs_min/db/Binary/audio_PVF.1.sg
================================================
function detect(){var e
return Binary.compare("'PVF'")&&(e=Binary.getString(7,5).trim(),/^[0-9]{5}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("audio","Portable Voice Format (.PVF)")

================================================
FILE: dbs_min/db/Binary/audio_RIFF-IMA.1.sg
================================================
function detect(){var e,t
return X.c("'RIFF'")&&X.c("'IMA '",8)&&X.U32(12)&&45<=X.U32(4)&&(bDetected=1,X.isVerbose())&&(e=X.U32(36),t=Util.divu64(X.U32(4)-44<<8,X.U16(12))>>8,sOption("ch:"+e+" len "+secondsToTimeStr(t)+" s/r:"+X.U32(12)+"Hz "+["not looped","looped"][+(0!=X.U32(32))]+" sz:"+outSz(X.U32(4)))),result()}meta("audio","Nintendo DS RIFF IMA-ADPCM stream (.STRM,.BIN,.LBIN)")

================================================
FILE: dbs_min/db/Binary/audio_SOU.1.sg
================================================
function detect(){return Binary.compare("'SOU'2000000000")&&(bDetected=1),result()}meta("audio","SOU")

================================================
FILE: dbs_min/db/Binary/audio_STRM.1.sg
================================================
function detect(){if(!(!X.c("'STRM'FE")&&!X.c("'STRM'FF")||X.U8(4)==X.U8(5)||X.U8(5)<254)&&X.c("'HEAD'",16)){var e,t,U=255==X.U8(4)?_LE:_BE,o=16+X.U32(20,U)
if(!(1<X.U8(25)||o>X.Sz()))if(X.c("'DATA'",o)&&X.U32(40,U)==o+8&&X.U32(8,U)==o+X.U32(o+4,U))return bDetected=1,sVersion=["PCM8s","PCM16","IMA-ADPCM"][X.U8(24)]+"/"+(U==_LE?"le":"be"),X.isVerbose()&&(e=X.U8(26),t=(X.U32(36,U)/X.U16(28,U)).toFixed(0),sOption("ch:"+e+" len "+secondsToTimeStr(t)+" s/r:"+X.U16(28,U)+"Hz "+["not looped","looped"][X.U8(25)]+" sz:"+outSz(X.U32(o+4,U)+o))),result()}}meta("audio","Nintendo DS multi-channel stream (.STRM)")

================================================
FILE: dbs_min/db/Binary/audio_STRM.2.sg
================================================
function detect(){if(X.c("'STRM'E8030000")&&X.U32(16)&&!(X.U32(24)<31)&&(sz=X.U32(16))==X.U32(24)){if(bDetected=1,X.isVerbose()){var e=Math.min(sz,X.Sz()),s=X.U32(8),r=0
if(X.isDeepScan())for(p=30;p<e;r++){var t=X.U16(p,_BE)>>4&4095,i=X.U32(p+2,_BE)>>5&8191
if(4095!=t||i<=8)break
p+=i}p<e&&(sVersion="malformed!badAAC"),r=(1024*r/s).toFixed(0),sOption((r?"len "+secondsToTimeStr(r)+" ":"")+"s/r:"+s+"Hz sz:"+outSz(30+sz))}return result()}}meta("audio","José Ramón 'Gryzor87' García/Abylight's Nintendo 3DS stream (.STRM)")

================================================
FILE: dbs_min/db/Binary/audio_ShockwaveAudio.1.sg
================================================
function detect(){return Binary.compare("000001..00000003")&&(bDetected=1),result()}meta("audio","Shockwave Audio")

================================================
FILE: dbs_min/db/Binary/audio_TUN.1.sg
================================================
function detect(){var t
return Binary.compare("'ALP'")&&(t=Binary.getString(8,5).trim(),/^[A-Z]{5}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("audio","TUN")

================================================
FILE: dbs_min/db/Binary/audio_VOC.1.sg
================================================
function detect(){if(bad="",!X.c("'Creative Voice File'1A")){if(!X.c("'Creative Voice File'..1A"))return!1
bad=bad.addIfNone("!bad1Asig")}if((4660+~(nV=X.U16(22))&65535)!=X.U16(24))return!1
function e(e){switch(e){case 0:codec="8-bit uPCM"
break
case 1:codec="Creative 8 to 4-bit ADPCM"
break
case 2:codec="Creative 8 to 3-bit ADPCM"
break
case 3:codec="Creative 8 to 2-bit ADPCM"
break
case 4:codec="16-bit sPCM"
break
case 5:codec="CCITT a-Law"
break
case 6:codec="CCITT u-Law"
break
case 8192:codec="Creative 16 to 4-bit ADPCM"
break
default:codec="invalid codec "+Hex(e)}return codec}for(codec="<default codec>",sV=nV.toString(16).padStart(4,"0"),sVersion="v"+sV[1]+"."+sV.slice(2,4),bn=sz=-1,extended=z=!1,p=26,rate=Hz=bps=bCodec=0,info=[];p<(X.isDeepScan()?X.Sz():65535)&&!z;){switch(bst=p,bhd=X.U8(p++),bn++,bsz=X.U24(p),p+=3,at="",bhd){case 0:info.push(at+"EoF"),p-=3,z=!0
break
case 1:extended||(rate=1e6/(256-X.U8(p)),Hz=rate<1e5?Math.round(rate)+"Hz":(rate/1e3).toFixed(1)+"kHz",bCodec=X.U8(p+1)),info.push(at+"audio data in "+codec+" at "+Hz),p+=bsz
break
case 2:p+=bsz
break
case 3:len=X.U16(p)+1,rate=1e6/(256-X.U8(p+2)),Hz=rate<1e5?Math.round(rate)+"Hz":(rate/1e3).toFixed(1)+"kHz",info.push(at+"silence ("+(len/rate).toFixed(2)+" sec at "+Hz+")"),p+=bsz
break
case 4:info.push(at+"marker #"+X.U16(p)),p+=bsz
break
case 5:s=X.SA(p,bsz),p+=bsz,info.push(at+'"'+s+'"')
break
case 6:n=X.U16(p),p+=bsz,info.push(at+(65535==n?"infinite":n)+" repeats { ")
break
case 7:info.push(at+"end repeat }")
break
case 8:extended||(chn=X.U8(p+3)+1,rate=256e6/(chn*(65536-X.U16(p))),Hz=rate<1e5?Math.round(rate)+"Hz":(rate/1e3).toFixed(1)+"kHz",bCodec=X.U8(p+2)),extended=!0,p+=bsz,info.push(at+"set to "+e(bCodec)+" at "+Hz+", "+chn+"chn")
break
case 9:nV<274&&(bad=bad.addIfNone("!badver")),(rate=X.U32(p))||(bad=bad.addIfNone("!badrate@"+Hex(bst))),z=!0
break
default:bad=bad.addIfNone("!invalidblock@"+Hex(bst)),z=!0}p==X.Sz()&&(z=!0),X.isDeepScan()&&(p>X.Sz()?bad=bad.addIfNone("!short"):sz=p)}return bDetected=1,""!=bad&&(sVersion=sVersion.appendS("malformed"+addEllipsis(bad,128,64),"/")),X.isVerbose()&&(sOption(addEllipsis(info.join("; "),512,256)),sOption(outSz(sz),"sz:")),result()}meta("audio","Creative (Sound Blaster) Voice waveform (.VOC)")

================================================
FILE: dbs_min/db/Binary/audio_WAV.1.sg
================================================
function detect(){var e,s,a=12,i=_BE,r=[],o=[],n=cue=0,c=nRate=nChannels=nBPS=0,V=-1,b=-1,k=0,S=0,t=4,C="",A="",M="",l="",P="",u="",d="",I="",D=[!1,!1,!1]
if(!(X.Sz()<36)){if(X.c("'RIFF'........'WAVE'"))i=_LE
else{if(!X.c("'RIFX'........'WAVE'"))return
i=_BE}if(!((b=8+X.U32(4,i))<12)){for(b-8>=X.Sz()&&X.c("'NXBF'",36)&&(b=X.Sz());a<X.Sz()&&a<b;){switch(e=X.SA(a,4),t=X.U32(a+4,i),a+=8,e){case"fmt ":switch(D[0]=!0,S=t,c=X.U16(a,i),nChannels=X.U16(a+2,i),nRate=X.U32(a+4,i),nBlockSize=X.U16(a+12,i),nBPS=X.U16(a+14,i),c){case 0:sVersion="Yamaha AICA ADPCM (unofficial)",b-4==X.Sz()?b-=4:b-8==X.Sz()?b-=8:b+2==X.Sz()&&(b-=2),18==t&&(t+=2)
break
case 1:if(7&nBPS||!isWithin(nBPS,8,32))return
sVersion="Microsoft PCM"+(32==nBPS?"32_le":24==nBPS?"24_le":16==nBPS?"16":"8U")+" (uncompressed)"
break
case 2:if(4==nBPS){if((function(e){var s=[[256,0],[512,-256],[0,0],[192,64],[240,0],[460,-208],[392,-232]]
if(7!=X.U16(e,i))return-1
e+=2
for(var a=0;a<7;a++,e+=4){var r=X.I16(e,i),o=X.I16(e+2,i)
if(r!=s[a][0]||o!=s[a][1])return-1}return e})(a+20)<0)return}else sVersion=16==nBPS&&nBlockSize==2*nChannels&&12<=b?"MS-IMA ADPCM":"Microsoft ADPCM"
break
case 3:if(32!=nBPS)return
sVersion="Microsoft IEEE float"
break
case 4:sVersion="Compaq VSELP"
break
case 5:sVersion="IBM CVSD"
break
case 6:sVersion="ITU G.711 a-law"
break
case 7:sVersion="ITU G.711 u-law"
break
case 8:sVersion="Microsoft DTS"
break
case 9:sVersion="DRM"
break
case 10:sVersion="WMA 9 Speech"
break
case 11:sVersion="Microsoft Windows Media RT Voice"
break
case 16:sVersion="OKI-ADPCM"
break
case 17:sVersion=4==nBPS?"MS-IMA ADPCM":"Intel IMA/DVI-ADPCM",b-8>>2==X.U32(48,i)?b=X.Sz():X.Sz()-b-16<=2304&&X.c("'cont'",b)&&(b+=8+X.U32(b+4,i))
break
case 18:sVersion="Videologic Mediaspace ADPCM"
break
case 19:sVersion="Sierra ADPCM"
break
case 20:sVersion="Antex G.723 ADPCM"
break
case 21:sVersion="DSP Solutions DIGISTD"
break
case 22:sVersion="DSP Solutions DIGIFIX"
break
case 23:sVersion="Dialogic OKI ADPCM"
break
case 24:sVersion="Media Vision ADPCM"
break
case 25:sVersion="HP CU"
break
case 26:sVersion="HP Dynamic Voice"
break
case 32:sVersion=4==nBPS?"Yamaha AICA ADPCM":"Yamaha ADPCM"
break
case 33:sVersion="SONARC Speech Compression"
break
case 34:sVersion="DSP Group True Speech"
break
case 35:sVersion="Echo Speech Corp."
break
case 36:sVersion="Virtual Music Audiofile AF36"
break
case 37:sVersion="Audio Processing Tech."
break
case 38:sVersion="Virtual Music Audiofile AF10"
break
case 39:sVersion="Aculab Prosody 1612"
break
case 40:sVersion="Merging Tech. LRC"
break
case 48:sVersion="Dolby AC2"
break
case 49:sVersion="Microsoft GSM610"
break
case 50:sVersion="MSN Audio"
break
case 51:sVersion="Antex ADPCM"
break
case 52:sVersion="Control Resources VQLPC"
break
case 53:sVersion="DSP Solutions DIGIREAL"
break
case 54:sVersion="DSP Solutions DIGIADPCM"
break
case 55:sVersion="Control Resources CR10"
break
case 56:sVersion="Natural MicroSystems VBX ADPCM"
break
case 57:sVersion="Crystal Semiconductors IMA ADPCM"
break
case 58:sVersion="Echo Speech ECHOSC3"
break
case 59:sVersion="Rockwell ADPCM"
break
case 60:sVersion="Rockwell DIGITALK"
break
case 61:sVersion="Xebec Multimedia"
break
case 64:sVersion="Antex G.721 ADPCM"
break
case 65:sVersion="Antex G.728 CELP"
break
case 66:sVersion="Microsoft MSG723"
break
case 67:sVersion="IBM AVC ADPCM"
break
case 69:sVersion="ITU-T G.726"
break
case 80:sVersion="Microsoft MPEG"
break
case 81:sVersion="RT23 or PAC"
break
case 82:sVersion="InSoft RT24"
break
case 83:sVersion="InSoft PAC"
break
case 85:sVersion="MP3"
break
case 89:sVersion="Cirrus"
break
case 96:sVersion="Cirrus Logic"
break
case 97:sVersion="ESS Tech. PCM"
break
case 98:sVersion="Voxware Inc."
break
case 99:sVersion="Canopus ATRAC"
break
case 100:sVersion="APICOM G.726 ADPCM"
break
case 101:sVersion="APICOM G.722 ADPCM"
break
case 102:sVersion="Microsoft DSAT"
break
case 103:sVersion="Microsoft DSAT-DISPLAY"
break
case 105:sVersion=4==nBPS?"XBOX IMA ADPCM":"Voxware Byte Aligned",b-8==X.Sz()?b-=8:b-4==X.Sz()?b-=4:b+8==X.Sz()&&(b+=8)
break
case 112:sVersion="Voxware ACB"
break
case 113:sVersion="Voxware AC10"
break
case 114:sVersion="Voxware AC16"
break
case 115:sVersion="Voxware AC20"
break
case 116:sVersion="Voxware MetaVoice"
break
case 117:sVersion="Voxware MetaSound"
break
case 118:sVersion="Voxware RT29HW"
break
case 119:sVersion="Voxware VR12"
break
case 120:sVersion="Voxware VR18"
break
case 121:sVersion="Voxware TQ40"
break
case 122:sVersion=extIs("med")?4==nBPS?"4-bit MS-IMA ADPCM":3==nBPS?"3-bit MS-IMA ADPCM":"Voxware SC3/med":"Voxware SC3"
break
case 123:sVersion="Voxware SC3"
break
case 128:sVersion="Soundsoft"
break
case 129:sVersion="Voxware TQ60"
break
case 130:sVersion="Microsoft MSRT24"
break
case 131:sVersion="AT&T G.729A"
break
case 132:sVersion="Motion Pixels MVI-MV12"
break
case 133:sVersion="DataFusion G.726"
break
case 134:sVersion="DataFusion GSM610"
break
case 136:sVersion="Iterated Systems Audio"
break
case 137:sVersion="Onlive"
break
case 138:sVersion="Multitude, Inc. FT SX20"
break
case 139:sVersion="Infocom IT’S A/S G.721 ADPCM"
break
case 140:sVersion="Convedia G729"
break
case 141:sVersion="Congruency, Inc. (not specified)"
break
case 145:sVersion="Siemens SBC24"
break
case 146:sVersion="Sonic Foundry Dolby AC3 APDIF"
break
case 147:sVersion="MediaSonic G.723"
break
case 148:sVersion="Aculab Prosody 8kbps"
break
case 151:sVersion="ZyXEL ADPCM"
break
case 152:sVersion="Philips LPCBB"
break
case 153:sVersion="Studer Professional Audio Packed"
break
case 160:sVersion="Maiden PhonyTalk"
break
case 161:sVersion="Racal Recorder GSM"
break
case 162:sVersion="Racal Recorder G720.a"
break
case 163:sVersion="Racal G723.1"
break
case 164:sVersion="Racal Tetra ACELP"
break
case 176:sVersion="NEC AAC NEC Corporation"
break
case 255:sVersion="AAC"
break
case 256:sVersion="Rhetorex ADPCM"
break
case 257:sVersion="IBM u-Law"
break
case 258:sVersion="IBM a-Law"
break
case 259:sVersion="IBM ADPCM"
break
case 273:sVersion="Vivo G.723"
break
case 274:sVersion="Vivo Siren"
break
case 288:sVersion="Philips Speech Processing CELP"
break
case 289:sVersion="Philips Speech Processing GRUNDIG"
break
case 291:sVersion="Digital G.723"
break
case 293:sVersion="Sanyo LD ADPCM"
break
case 304:sVersion="Sipro Lab ACEPLNET"
break
case 305:sVersion="Sipro Lab ACELP4800"
break
case 306:sVersion="Sipro Lab ACELP8V3"
break
case 307:sVersion="Sipro Lab G.729"
break
case 308:sVersion="Sipro Lab G.729A"
break
case 309:sVersion="Sipro Lab Kelvin"
break
case 310:sVersion="VoiceAge AMR"
break
case 320:sVersion="Dictaphone G.726 ADPCM"
break
case 336:sVersion="Qualcomm PureVoice"
break
case 337:sVersion="Qualcomm HalfRate"
break
case 341:sVersion="Ring Zero Systems TUBGSM"
break
case 352:sVersion="Microsoft Audio1"
break
case 353:sVersion="Windows Media Audio V2 V7 V8 V9 / DivX audio (WMA) / Alex AC3 Audio"
break
case 354:sVersion="Windows Media Audio Professional V9"
break
case 355:sVersion="Windows Media Audio Lossless V9"
break
case 356:sVersion="WMA Pro over S/PDIF"
break
case 368:sVersion="UNISYS NAP ADPCM"
break
case 369:sVersion="UNISYS NAP ULAW"
break
case 370:sVersion="UNISYS NAP ALAW"
break
case 371:sVersion="UNISYS NAP 16K"
break
case 372:sVersion="MM SYCOM ACM SYC008 SyCom Technologies"
break
case 373:sVersion="MM SYCOM ACM SYC701 G726L SyCom Technologies"
break
case 374:sVersion="MM SYCOM ACM SYC701 CELP54 SyCom Technologies"
break
case 375:sVersion="MM SYCOM ACM SYC701 CELP68 SyCom Technologies"
break
case 376:sVersion="Knowledge Adventure ADPCM"
break
case 384:sVersion="Fraunhofer IIS MPEG2AAC"
break
case 400:sVersion="Digital Theater Systems DTS DS"
break
case 512:sVersion="Creative Labs ADPCM"
break
case 514:sVersion="Creative Labs FASTSPEECH8"
break
case 515:sVersion="Creative Labs FASTSPEECH10"
break
case 528:sVersion="UHER ADPCM"
break
case 533:case 534:sVersion="Ulead DV ACM"
break
case 544:sVersion="Quarterdeck Corp."
break
case 560:sVersion="I-Link VC"
break
case 576:sVersion="Aureal Semiconductor Raw Sport"
break
case 577:sVersion="ESST AC3"
break
case 592:sVersion="Interactive Products HSX"
break
case 593:sVersion="Interactive Products RPELP"
break
case 608:sVersion="Consistent CS2"
break
case 624:sVersion="ATRAC3/Sony SCX"
break
case 625:sVersion="Sony SCY"
break
case 626:sVersion="Sony ATRAC3"
break
case 627:sVersion="Sony SPC"
break
case 640:sVersion="TELUM Telum Inc."
break
case 641:sVersion="TELUMIA Telum Inc."
break
case 645:sVersion="Norcom Voice Systems ADPCM"
break
case 768:b-8==X.Sz()&&(b-=8),sVersion=4==nBPS&&nBlockSize==1024*nChannels&&12==b&&1==nChannels?"DVI IMA":"Fujitsu FM TOWNS SND"
break
case 769:case 770:case 771:case 772:case 773:case 774:case 775:case 776:sVersion="Fujitsu (not specified)"
break
case 848:sVersion="Micronas Semiconductors, Inc. Development"
break
case 849:sVersion="Micronas Semiconductors, Inc. CELP833"
break
case 1024:sVersion="Brooktree Digital"
break
case 1025:sVersion="Intel Music Coder (IMC)"
break
case 1026:sVersion="Ligos Indeo Audio"
break
case 1104:sVersion="QDesign Music"
break
case 1280:sVersion="On2 VP7 On2 Technologies"
break
case 1281:sVersion="On2 VP6 On2 Technologies"
break
case 1365:sVersion="Level-5 4-bit ADPCM"
var p=b+4*(X.U16(22,i)-1)
p<X.Sz()&&X.Sz()-p<16&&(b=p)
break
case 1664:sVersion="AT&T VME VMPCM"
break
case 1665:sVersion="AT&T TCP"
break
case 1792:sVersion="YMPEG Alpha (dummy for MPEG-2 compressor)"
break
case 2222:sVersion="ClearJump LiteWave (lossless)"
break
case 4096:sVersion="Olivetti GSM"
break
case 4097:sVersion="Olivetti ADPCM"
break
case 4098:sVersion="Olivetti CELP"
break
case 4099:sVersion="Olivetti SBC"
break
case 4100:sVersion="Olivetti OPR"
break
case 4352:sVersion="Lernout & Hauspie"
break
case 4353:sVersion="Lernout & Hauspie CELP"
break
case 4354:case 4355:case 4356:sVersion="Lernout & Hauspie SBC"
break
case 5120:sVersion="Norris Comm. Inc."
break
case 5121:sVersion="ISIAudio"
break
case 5376:sVersion="AT&T Soundspace Music Compression"
break
case 6172:sVersion="VoxWare RT24 speech"
break
case 6174:sVersion="Lucent elemedia AX24000P Music"
break
case 6513:sVersion="Sonic Foundry LOSSLESS"
break
case 6521:sVersion="Innings Telecom Inc. ADPCM"
break
case 7175:sVersion="Lucent SX8300P speech"
break
case 7180:sVersion="Lucent SX5363S G.723 compliant"
break
case 7939:sVersion="CUseeMe DigiTalk (ex-Rocwell)"
break
case 8132:sVersion="NCT Soft ALF2CD ACM"
break
case 8192:sVersion="FAST Multimedia DVM"
break
case 8193:sVersion="Dolby DTS"
break
case 8194:sVersion="RealAudio 1 / 2 14.4"
break
case 8195:sVersion="RealAudio 1 / 2 28.8"
break
case 8196:sVersion="RealAudio G2 / 8 Cook (low bitrate)"
break
case 8197:sVersion="RealAudio 3 / 4 / 5 Music (DNET)"
break
case 8198:sVersion="RealAudio 10 AAC (RAAC)"
break
case 8199:sVersion="RealAudio 10 AAC+ (RACP)"
break
case 9472:sVersion="Reserved range to 0x2600 Microsoft"
break
case 13075:sVersion="makeAVIS (ffvfw fake AVI sound from AviSynth scripts)"
break
case 16707:sVersion="Divio MPEG-4 AAC audio"
break
case 16897:sVersion="Nokia adaptive multirate"
break
case 16963:sVersion="Divio G726 Divio, Inc."
break
case 17228:sVersion="LEAD Speech"
break
case 22092:sVersion="LEAD Vorbis"
break
case 22358:sVersion="WavPack Audio"
break
case 26447:sVersion="Ogg Vorbis (mode 1)"
break
case 26448:sVersion="Ogg Vorbis (mode 2)"
break
case 26449:sVersion="Ogg Vorbis (mode 3)"
break
case 26479:sVersion="Ogg Vorbis (mode 1+)"
break
case 26480:sVersion="Ogg Vorbis (mode 2+)"
break
case 26481:sVersion="Ogg Vorbis (mode 3+)"
break
case 28672:sVersion="3COM NBX 3Com Corporation"
break
case 28781:sVersion="FAAD AAC"
break
case 31265:sVersion="GSM-AMR (CBR, no SID)"
break
case 31266:sVersion="GSM-AMR (VBR, including SID)"
break
case 41216:sVersion="Comverse Infosys Ltd. G723 1"
break
case 41217:sVersion="Comverse Infosys Ltd. AVQSBC"
break
case 41218:sVersion="Comverse Infosys Ltd. OLDSBC"
break
case 41219:sVersion="Symbol Technologies G729A"
break
case 41220:sVersion="VoiceAge AMR WB VoiceAge Corporation"
break
case 41221:sVersion="Ingenient Technologies Inc. G726"
break
case 41222:sVersion="ISO/MPEG-4 advanced audio Coding"
break
case 41223:sVersion="Encore Software Ltd G726"
break
case 41225:sVersion="Speex ACM Codec xiph.org"
break
case 57260:sVersion="DebugMode SonicFoundry Vegas FrameServer ACM"
break
case 61868:sVersion="Free Lossless Audio Codec FLAC"
break
case 65534:sVersion="Extensible"
var p=X.U32(32,_LE),T=X.U16(36,_LE)<<16|X.U16(38,_LE),m=X.U32(40,_BE),L=X.U32(44,_BE)
1==p&&16==T&&2147483818==m&&3709809==L&&16==nBPS&&(sVersion+=":PCM16"),3911428799==p&&3411559537==T&&2702835706==m&&31772258==L&&(sVersion+=":ATRAC3+"),1205945042==p&&918179213==T&&2298241381==m&&1334608748==L&&(sVersion+=":ATRAC9"),b+24==X.Sz()?b+=24:b+56==X.Sz()?b+=56:b+64==X.Sz()&&(b-=64)
break
case 65535:sVersion="Development"
break
default:sVersion="Unknown:"+Hex(c,4)}break
case"fact":n=X.U32(a,_LE)
break
case"data":D[1]=!0,!nBPS||1!=c||nBPS%8||(s=Math.round(X.U32(a-4,i)/(nBPS>>3)/nRate/nChannels*1e4)/10,V=new Date(s).toISOString().substr(11,8))
break
case"cue":for(var E=a+4,f="",R=0;E<a+t&&E<X.Sz();)f=X.SA(E,4),R=X.U32(E+4,_LE),E+=8,"data"==f&&cue++,E+=R+R&1
break
case"cmnt":u=u.appendS(X.SC(a+2,t-8,"SJIS"),"\n")
break
case"LIST":case"list":if(["INFO","ADTL"].includes(X.SA(a,4).toUpperCase()))for(E=a+4,f="",R=0;E<a+t&&E<X.Sz();){switch(f=X.SA(E,4),R=X.U32(E+4,_LE),E+=8,f){case"INAM":C=X.SC(E,R,"CP1252")
break
case"IART":M=X.SC(E,R,"CP1252")
break
case"ICMS":P=X.SC(E,R,"CP1252")
break
case"ICOP":d=X.SC(E,R,"CP1252")
break
case"ICRD":A=X.SC(E,R,"CP1252")
break
case"ISFT":I=X.SC(E,R,"CP1252")
break
case"IGNR":l=X.SC(E,R,"CP1252")
break
case"ICMT":u=u.appendS(X.SC(E,R,"CP1252"),"\n")
break
case"labl":r.push(X.SC(E+4,R-4,"CP1252").trim())
break
case"ltxt":o.push(X.SC(E+20,R-20,X.SA(E+18,2)).trim())}E+=R+=1&R}break
case"smpl":k=X.U32(a+28,i)
break
case"wsmp":k=X.U32(a+16,i)
break
case"ctrl":k=X.I32(a,i)?1:0
break
case"NXBF":t=X.U32(a,i),a+=4,ch+="/"+X.U32(a+12,i),k=0<=X.I32(16,i)?1:0
break
case"JUNK":D[2]=!0}a+=t+=1&t}if(D[0]&&D[1])return bDetected=1,sVersion+=i==_LE?"/le":"/be",fact=Math.round(n/1048576),2==c&&4==nBPS&&extIs("adpcm")&&!(nChannels<2||0<fact||54==S&&512!=nBlockSize||50==S&&![512,155,105].includes(nBlockSize))&&(sVersion=sVersion.appendS("UE4","/")),26368==(65280&c)&&b+1==X.Sz()&&(b+=1),X.isVerbose()&&(sOptionT(addEllipsis(C)),sOptionT(A,"created: "),sOptionT(addEllipsis(M),"by: "),sOptionT(l,"genre: "),sOptionT(addEllipsis(I),"s/w: "),sOptionT(addEllipsis(P),"cms.by: "),sOptionT(d,"©"),sOption(addEllipsis(u.trim()),'cmt: "','"'),r.length&&sOptionT(addEllipsis(r.filter(function(e){return 0<e.length}).join("; ")),'labels: "','"'),o.length&&sOptionT(addEllipsis(o.filter(function(e){return 0<e.length}).join("; ")),'captions: "','"'),sOption("ch:"+nChannels+(nBPS?" "+nBPS+"-bit":"")+" s/r:"+nRate+"Hz"+(n?" fact:"+fact+"M":"")+(-1!==V?" len: "+V:"")+(0<k?" looped"+(1<k?"×"+k:""):"")+" sz:"+outSz(b))),result()}}}meta("audio","RIFF container/WAVE file (.WAV)")

================================================
FILE: dbs_min/db/Binary/audio_WEM.1.sg
================================================
function detect(){var e,s,r=12,a=_BE,n=fmtp=0,t=(xma2p=0,datap=0),i=(vorbp=0,wiihp=0,seekp=0,smplp=0)
metap=0
if(!(X.Sz()<36)&&(X.c("'WAVE'",8)||X.c("'XWMA'",8))){if(X.c("'RIFF'"))a=_LE
else{if(!X.c("'RIFX'"))return
a=_BE}for(;r<X.Sz();){switch(s=X.SA(r,4),e=X.U32(r+4,a),r+=8,s){case"fact":return
case"fmt ":fmtp=r,n=e
break
case"XMA2":xma2p=r,0
break
case"data":datap=r,t=e
break
case"vorb":vorbp=r,0
break
case"WiiH":wiihp=r,0
break
case"seek":seekp=r,0
break
case"smpl":smplp=r,i=e
break
case"meta":metap=r,0
break
default:if(r+e>X.Sz())return}r+=e}if(datap){var c=nRate=nChannels=nBPS=0,o=-1,p=8+X.U32(4,a),f=xsz=chlo=chtp=0
if(iswem=extIs("wem")||extIs("bnk"),info=[],lp=prefetch=!1,xma2p)c=357,info=xma2_pase_xma2_chunk(xma2p),nChannels=info[0],nRate=info[1],lp=info[2],f=info[3]
else{if(n<16)return
c=X.U16(fmtp,_LE),nChannels=X.U16(fmtp+2,_LE),nRate=X.U32(fmtp+4,_LE),nBlockSize=X.U16(fmtp+12,_LE),nBPS=X.U16(fmtp+14,_LE),6==(xsz=16<n&&357!=c&&358!=c?X.U16(fmtp+20,_BE):xsz)&&(chlo=X.U32(r+20,_BE))==nChannels&&(chtp=chlo>>8&15,chlo>>=12)}switch(358==c&&(info=xma2_parse_fmt_chunk_extra(r,_BE),lp=info[0],f=info[1]),smplp&&34<=i&&1==X.U32(r+28)&&0==X.U32(r+40)&&(lp=!0),c){case 1:sVersion="older Wwise, PCM",prefetch=1
break
case 2:sVersion="newer Wwise IMA:platform ADPCM",prefetch=1,xsz==12+46*nChannels?sVersion+=":DSP+coefs":10==xsz&&wiihp?sVersion+=":WiiH_DSP":nBlockSize==260*nChannels&&(sVersion+=":PTADPCM")
break
case 105:sVersion="older Wwise IMA",prefetch=1
break
case 353:sVersion="Microsoft WMAv2",prefetch=1
break
case 354:sVersion="Microsoft WMAPro",prefetch=1
break
case 357:sVersion="Microsoft XMA2",prefetch=1
break
case 358:sVersion="fmt-chunk Microsoft XMA2",prefetch=1
break
case 12345:sVersion="Opus NX",prefetch=1
break
case 12352:sVersion="Opus",prefetch=1
break
case 12353:sVersion="Wwise 2019.2.3 Opus_WEM/WW",prefetch=1
break
case 33553:sVersion="Wwise 2019.1 PTADPCM",prefetch=1
break
case 43712:sVersion="AAC"
break
case 65520:sVersion="DSP",prefetch=1
break
case 65531:sVersion="HEVAG"
break
case 65532:sVersion="ATRAC9",prefetch=1
break
case 65534:sVersion="PCM for Wwise Authoring",prefetch=1
break
case 65535:sVersion="Vorbis",prefetch=1
break
default:return void(iswem&&_setResult("audio","Wwise: unknown format ",Hex(c,4),""))}if(datap+t>X.Sz()){if(datap+t<20480&&65536<X.Sz())return void _setResult("audio","Wwise: bad rip?","","datasz:"+Hex(t))
if(!prefetch)return
prefetch=2}return 65534==c&&2==prefetch&&X.c("'OggS'",datap)&&(sVersion="CP2077 Opus"),bDetected=1,sVersion+=a==_LE?"/le":"/be",f&&(f=Math.round(f/nRate/nChannels*1e4)/10,o=new Date(f).toISOString().substr(11,8)),X.isVerbose()&&sOption("ch:"+nChannels+(nBPS?" "+nBPS+"-bit":"")+" s/r:"+nRate+"Hz"+(-1!==o?" len: "+o:"")+(lp?" looped":"")+" sz:"+outSz(p)),result()}}}init("audio","Audiokinetic Wwise RIFF (.WEM,.BNK)"),includeScript("vgmcodingutils")

================================================
FILE: dbs_min/db/Binary/audio_mp3.2.sg
================================================
meta("audio","MP3 Audio File"),includeScript("duration")
var MP3={aVersion:["2.5","2","1"],aLayer:["III","II","I"],aRatev1:[32,40,48,56,64,80,96,112,128,160,192,224,256,320,32,48,56,64,80,96,112,128,160,192,224,256,320,384,32,64,96,128,160,192,224,256,288,320,352,384,416,448],aRatev2:[8,16,24,32,40,48,56,64,80,96,112,128,144,160,32,48,56,64,80,96,112,128,144,160,176,192,224,256],aFreq:[11025,12e3,8e3,22050,24e3,16e3,44100,48e3,32e3],aCh:["Stereo","Joint stereo","Dual mono","Mono"],header:function(n){var r=X.U32(n,_BE)
if(-2097152!=(4292870144&r))return null
var e=r>>>19&3
if(1==e)return null
1<e&&--e
var a=r>>>17&3
if(0==a)return null;--a
var i=r>>>12&15
if(0==i||15==i)return null;--i
var t,s,o,u,l=r>>>10&3
return 3==l?null:(t=r>>>9&1,r=r>>>6&3,i=2==e?this.aRatev1[14*a+i]:this.aRatev2[14*(2==a)+i],l=this.aFreq[3*e+l],s=2==a?384/l:1==a||2==e?1152/l:576/l,-(o=1)==(u=Binary.findString(n,40,"Xing"))&&(u=Binary.findString(n,40,"Info"),o=0),-1!=u&&1&X.U8(u+7)?(s*=X.U32(u+8,_BE),n=o?-1:-2):X.c("'VBRI'",n+32)?(s*=X.U32(u+46,_BE),n=-1):n+=2==a?4*Math.floor(12e3*i/l+t):Math.floor(125*i*s+t),[this.aVersion[e],this.aLayer[a],i,l,this.aCh[r],s,n])}}
function detect(){if(128<=X.Sz()){X.c("'TAG'",X.Sz()-128)&&(sOptions="ID3v1")
var n=0,r=0
X.c("'ID3'")?(n=X.U8(6)<<21|X.U8(7)<<14|X.U8(8)<<7|X.U8(9),n+=10,""==sOptions?sOptions="ID3v2":sOptions+="&2",r=1):X.c("'WAVEfmt '........55",8)&&(n=Binary.findString(50,50,"data")+8)
var e=null,a=MP3.header(n)
if(null==a&&(r&&(n=Binary.findSignature(n,768,"FFFB"),a=MP3.header(n)),null==a))return""
if(0<a[6]&&null==(e=MP3.header(a[6])))return""
if(bDetected=1,sVersion=a[0]+",Layer "+a[1],File.isVerbose()){for(var i=1,t=a[2],s=a[3],o=a[5],u=0,l=0;null!=e;)i++,t+=e[2],s+=e[3],o+=e[5],e[2]!=a[2]&&(u=1),e[3]!=a[3]&&(l=1),e=MP3.header(e[6])
sOptions=sOptions.append(Math.round(t/i)+"kbps"),u&&(sOptions+="(avg)"),sOptions=sOptions.append(Math.round(s/i)+"Hz"),l&&(sOptions+="(avg)"),sOptions=sOptions.append(a[4],duration(o))}}return result()}

================================================
FILE: dbs_min/db/Binary/backup_images.1.sg
================================================
function detect(){if(Binary.compare("7ca0932f"))bDetected=1,sName="R-Studio image",-1!=Binary.compare("78da",56)&&(sOptions="compressed (zlib)")
else if(Binary.compare("'$CAN'")){switch(Binary.readByte(4)){case 228:sOptions="First or single file"
break
case 96:sOptions="next file"}bDetected=1,sName="Norton Ghost image"}return result()}meta("format","")

================================================
FILE: dbs_min/db/Binary/bin.Atari_ST.1.sg
================================================
function detect(){return Binary.compare("601a0000....................0000")&&(bDetected=1),result()}meta("format","Atari ST TOS executable")

================================================
FILE: dbs_min/db/Binary/bin.IDA.1.sg
================================================
function detect(){if(32<=Binary.getSize())if(Binary.compare("'IDA'..0000")&&Binary.compare("DDCCBBAA",26)){var e=Binary.read_uint16(30)
switch(sVersion=e+".0",Binary.getString(0,4)){case"IDA0":bDetected=1,sName="IDA Database (.IDB)"
break
case"IDA1":bDetected=1,sName="IDA Database for 32-bit binary (.IDB)"
break
case"IDA2":bDetected=1,sName="IDA Database for 64-bit binary (.I64)"}if(bDetected)switch(e){case 2:case 3:case 4:detect_zlib(Binary,Binary.read_uint32(6)+5)
break
case 5:case 6:detect_zlib(Binary,Binary.read_uint32(6)+9)}}else if(Binary.compare("'IDASGN'")){sName="IDA FLIRT Signature Database (.SIG)",bDetected=1
const e=Binary.read_uint8(6),a=Binary.read_uint16(18),i=(Binary.read_uint8(16),Binary.read_uint8(34)),t=37
sVersion=e,a||(a=Binary.read_uint32(37),t+=4,10<=e&&(t+=4)),sOptions='"'+Binary.getString(t,i)+'"',Binary.isVerbose()&&(detect_zlib(Binary,t+i),sOption("modules:"+a),sOption("p:"+Binary.read_uint8(7)),sOption("a:"+Binary.read_uint16(14)),sOption("o:"+Binary.read_uint16(12)),sOption("f:"+Binary.read_uint32(8)))}else Binary.compare("'IDATIL'")&&(sName="IDA Type Information List (.TIL)",sOptions='"'+Binary.getString(15,Binary.read_uint8(14))+'"',bDetected=1)
return result()}meta("format"),includeScript("zlib")

================================================
FILE: dbs_min/db/Binary/bin.ISO_9660.1.sg
================================================
function detect(){return 32784<Binary.getSize()&&(Binary.compare("01'CD001'01",32768)||Binary.compare("01'CD001'01",37656)||Binary.compare("01'CD001'01",37648))&&(bDetected=1),result()}meta("format","ISO 9660")

================================================
FILE: dbs_min/db/Binary/bin.RPGMaker2Kdata.1.sg
================================================
function detect(){function s(){return!!(X.isHeuristicScan()||X.c("'Lcf'",1)&&!charStat(X.readBytes(1,X.U8(0)),1).indexOf(!1))}return!bDetected&&(function(){var i
return X.c("'XYZ1'")&&(w=X.U16(4),h=X.U16(6),i=X.isHeuristicScan()?32768:2560,isWithin(w,1,i))&&isWithin(h,1,i)?1:void 0})()&&(sName="RPGMaker 2000/2003 bitmap (.XYZ)",bDetected=1,X.isVerbose())&&sOption(w+"×"+h),!bDetected&&(function(){if(s()&&X.c("0B")&&X.c("64",12)){if(bad="",!X.c("'LcfSaveData'",1)){if(!X.isHeuristicScan())return
bad=bad.addIfNone("!badsig")}if(isWithin(dt=X.F64(16),36500,73e3)){var i=new Date(Date.UTC(1899,11,30))
for(dt=(dt=new Date(i.getTime()+864e5*dt)).toISOString(),ch0nm=ch1fs=ch2fs=ch3fs=ch4fs="",ch0lv=ch0hp=ch1fsi=ch2fsi=ch3fsi=ch4fsi=-1,info="",idx=0,p=24;p<X.Sz();){if(idx=readVarUInt(p),!isWithin(idx[0],1,3))return
if(p+=idx[0],!(idx=idx[1]))break
if(sz=readVarUInt(p),!isWithin(sz[0],1,5))return
switch(p+=sz[0],sz=sz[1],idx){case 11:heronm=X.SC(p,sz,"SJIS")
break
case 12:herolv=readVarUInt(p,sz)[1]
break
case 13:herohp=readVarUInt(p,sz)[1]
break
case 21:ch1fs=X.SC(p,sz,"SJIS")
break
case 22:ch1fsi=readVarUInt(p,sz)[1]
break
case 23:ch2fs=X.SC(p,sz,"SJIS")
break
case 24:ch2fsi=readVarUInt(p,sz)[1]
break
case 25:ch3fs=X.SC(p,sz,"SJIS")
break
case 26:ch3fsi=readVarUInt(p,sz)[1]
break
case 27:ch4fs=X.SC(p,sz,"SJIS")
break
case 28:ch4fsi=readVarUInt(p,sz)[1]}p+=sz}for(bad="",v="",sz=p,calcidx=101;p<X.Sz();calcidx=calcidx<114?calcidx+1:200){if(idx=readVarUInt(p),!isWithin(idx[0],1,3))return
if(p+=idx[0],!(idx=idx[1]))break
if(calcidx!=idx&&200!=calcidx){bad=bad.addIfNone("!brokenchunk")
break}if(sz=readVarUInt(p),!isWithin(sz[0],1,5)||!sz[1])return
switch(p+=sz[0],sz=sz[1],idx){case 200:tag="easyRPG_data",1==readVarUInt(p)[1]&&(t=readVarUInt(p+1)[1],v=((v=readVarUInt(p+2)[1])>>8&255|(255&v)<<8).toString(16))
break
case 108:for(tag="actors",q=p+2;q<p+sz;)if(idx2=readVarUInt(q),isWithin(idx2[0],1,3)){if(q+=idx2[0],!(idx2=idx2[1]))break
if(sz2=readVarUInt(q),!isWithin(sz2[0],1,5))return
switch(q+=sz2[0],sz2=sz2[1],idx2){case 1:t=X.SA(q,sz2),info=info.append("actor:"+("
"==t?"*":X.SC(q,sz2,"SJIS")))
break
case 2:t=X.SA(q,sz2),info=info.append("title:"+("
"==t?"*":X.SC(q,sz2,"SJIS")))
break
case 11:(t=X.SC(q,sz2,"SJIS")).length&&(info=info.append("char:"+t))
break
case 21:(t=X.SC(q,sz2,"SJIS")).length&&(info=info.append("sprite:"+t))
break
case 31:info=info.append("level:"+readVarUInt(q)[1])
break
case 33:(t=readVarUInt(q)[1])&&(info=info.append("hpmod:"+t))
break
case 34:(t=readVarUInt(q)[1])&&(info=info.append("spmod:"+t))
break
case 71:info=info.append("curhp:"+readVarUInt(q)[1])
break
case 72:info=info.append("cursp:"+readVarUInt(q)[1])}q+=sz2}else _l2r("lsd",q,"idx2="+Hex(idx2[0])+" is weird"),q=p+sz
break
case 101:tag="system"
break
case 102:tag="screen"
break
case 103:tag="pictures"
break
case 104:tag="party_loc"
break
case 105:tag="boat_loc"
break
case 106:tag="ship_loc"
break
case 107:tag="airship_loc"
break
case 109:tag="inventory"
break
case 110:tag="teleport_targets"
break
case 111:tag="map_info"
break
case 112:tag="panorama"
break
case 113:tag="fg_ev_execstate"
break
case 114:tag="common_events"
break
default:tag="ERROR!"+Hex(idx)}if(p+=sz,200==idx)break}return p>X.Sz()?void 0:(sz=p,sVersion=200==idx?"easyRPG"+(v.length?" v"+v.slice(0,4):""):"RPG_RT",1)}}})()&&(sName="RPGMaker 2000/2003 save data (.LSD)",bDetected=1,bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOption("on: "+dt.slice(0,19)),sOption(heronm+" lv."+herolv+" "+herohp+"HP","preview: "),0<=ch1fsi&&sOption(ch1fs),0<=ch2fsi&&sOption(ch2fs),0<=ch3fsi&&sOption(ch3fs),0<=ch4fsi&&sOption(ch4fs),sOption(info,"info: "),sOption(outSz(sz),"sz:")),!bDetected&&(function(){if(s()&&X.c("0A")&&(bad="",X.c("'LcfMapTree'",1))&&(i=readVarUInt(11),isWithin(i[0],1,5))){for(p=11+i[0]+1,len=i[1],title="",maps=[],idx=i=0;p<X.Sz()&&i<len;){if(51==idx&&(p+=readVarUInt(p)[0],aid=readVarUInt(p),p+=aid[0],(aid=aid[1])<++i)){bad=bad.addIfNone("!badidx")
break}if(i>=len)break
if(idx=readVarUInt(p),!isWithin(idx[0],1,3))return
if(p+=idx[0],idx=idx[1],sz=readVarUInt(p),!isWithin(sz[0],1,5)||!sz[1])return
p+=sz[0],sz=sz[1],1===idx&&(t=X.SC(p,sz,"SJIS"),title.length?maps.push(aid+"."+t):title=t),p+=sz}for(i=0;i<aid+1;i++)p+=readVarUInt(p)[0]
for(i=0;p<X.Sz();){if(idx=readVarUInt(p),!isWithin(idx[0],1,3))return
if(p+=idx[0],!(idx=idx[1]))break
if(sz=readVarUInt(p),!isWithin(sz[0],1,5)||!sz[1])return
p+=sz[0],sz=sz[1],p+=sz}return(sz=p)>X.Sz()?void 0:1}})()&&(sName="RPGMaker 2000/2003 map tree data (.LMT)",bDetected=1,bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOption("for: "+title),sOption(addEllipsis(maps.join("\r"),49152),len+" maps:"),sOption(outSz(sz),"sz:")),!bDetected&&(function(){if(s()&&X.c("0B")&&X.c("0B",12)&&(bad="",X.c("'LcfDataBase'",1))){var e=[]
for(chars=[],idx=i=0,p=12;p<X.Sz();i++){if(idx=readVarUInt(p),!isWithin(idx[0],1,3))return a(p),0
if(p+=idx[0],idx=idx[1],!isWithin(idx,11,31)){if(i<14)return a(p,idx),0
p--
break}if(sz=readVarUInt(p),!isWithin(sz[0],1,6)||!sz[1])return a(p,sz[1]),0
if(p+=sz[0],sz=sz[1],11==idx)for(q=p;q<p+sz&&q<X.Sz();){for(len=j=0;q<p+sz&&q<X.Sz();j++){if(t=readVarUInt(q),!isWithin(t[0],1,3))return
if(q+=t[0],t=t[1],len||(len=t,j=0),t=readVarUInt(q),!isWithin(t[0],1,3))return
for(q+=t[0],t=t[1];q<p+sz&&q<X.Sz();){if(idx1=readVarUInt(q),!isWithin(idx1[0],1,3))return
if(q+=idx1[0],!(idx1=idx1[1])){q--
break}if(sz1=readVarUInt(q),!isWithin(sz1[0],1,5))return a(q,Hex(idx1)),0
switch(q+=sz1[0],sz1=sz1[1],idx1){case 1:case 2:e.push(X.SC(q,sz1,"SJIS"))
break
default:e.length&&chars.push(e.join(": ")),e=[]}q+=sz1}}i++}p+=sz}return sz=p,1}function a(){return!1}})()&&(sName="RPGMaker 2000/2003 database (.LDB)",bDetected=1,bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(sOption(addEllipsis(chars.join(", ")),"chars:"),sOption(outSz(sz),"sz:")),!bDetected&&(function(){if(s()&&X.c("0A")&&(bad="",X.c("'LcfMapUnit'",1))){for(id=-1,bg="",bgf=!1,idx=i=0,p=11;p<X.Sz();i++){if(idx=readVarUInt(p),!isWithin(idx[0],1,3))return
if(p+=idx[0],idx=idx[1],!isWithin(idx,1,91)){if(i<3)return
break}if(sz=readVarUInt(p),!isWithin(sz[0],1,6)||!sz[1])return
switch(p+=sz[0],sz=sz[1],idx){case 1:id=readVarUInt(p)[1]
break
case 31:bgf=!0
break
case 32:bg=X.SC(p,sz,"SJIS")}p+=sz}return(sz=p)>X.Sz()?void 0:1}})()&&(sName="RPGMaker 2000/2003 map unit (.LMU)",bDetected=1,bad.length&&(sVersion=sVersion.appendS("malformed"+bad,"/")),X.isVerbose())&&(0<=id&&sOption(id,"id:"),bgf&&sOption(bg,'bg:"','"'),sOption(outSz(sz),"sz:")),result()}meta("game")

================================================
FILE: dbs_min/db/Binary/data_overlay_null_padding.1.sg
================================================
function detect(){if(!Binary.isOverlay())return result()
var e=Binary.getSize()
Binary.isZeroFilled(0,e)&&_setResult("overlay","null padding","","")}

================================================
FILE: dbs_min/db/Binary/data_overlays.6.sg
================================================
function detect(){var e
return Binary.isOverlay()&&(Binary.compare("'aWAW'")?(sName="CreateInstall data",bDetected=1):Binary.compare("';!@Install@!UTF-8!'")?(sName="7-zip Installer data",bDetected=1):Binary.compare("00'TMSAMVOH'")?(sName="ActiveMark protector data",bDetected=1):Binary.compare("....................'MSCF'00")?(sName="Actual Installer data",bDetected=1):Binary.compare("'10JP'")?(sName="Adveractive Installer data",bDetected=1):Binary.compare("'EWETAR DATA FILE!! VER 1.00 <<<>>>'")?(sName="Aeco Systems installer data",bDetected=1):Binary.compare("c0ab........60ea")?(sName="ARJSFX32 data",bDetected=1):Binary.compare("67570402")?(sName="ARQ archive",bDetected=1):Binary.compare("0b0bafaf0b0ba4")?(sName="AutoPlay Media Studio installer data",bDetected=1):Binary.compare("'wwgT)'")||Binary.compare("..120100....0000")?(sName="ClickTeam installer data",bDetected=1):Binary.compare("'CK16'")?(sName="CrypKey Installer archive",bDetected=1):Binary.compare("........'DIMDMSCF'")?(sName="Dimd SFX data",sOptions="CAB",bDetected=1):Binary.compare("'[metadata]'")?(sName="distutils installer data",bDetected=1):Binary.compare("b297e169")?(sName="Envoy Packager data",bDetected=1):Binary.compare("'EPSF'")?(sName="Eschalon Installer archive",bDetected=1):Binary.compare("........'SPIS'1a'LH5'")?(sName="GPInstall data",sOptions="SPIS LH5",bDetected=1):Binary.compare("'zlb'1A")||Binary.compare("'idska32'1A")?(sName="Inno Setup Installer data",bDetected=1):Binary.compare("'Inno Setup Messages'")?(sName="Inno Setup uninstall data",bDetected=1):Binary.compare("'1CNT'")?(sName="LucasArts Update Installer data",bDetected=1):Binary.compare("'MPU'0d")?(sName="MP-ZipTool SFX32 data",bDetected=1):Binary.compare("'MPQ'1a20")?(sName="MPQ archive",bDetected=1):Binary.compare("'PK??NOS_PO'")||Binary.compare("'NOS_PO'")?(sName="NOS Installer data",bDetected=1):Binary.compare("970300000201")?(sName="Pantaray QSetup data",sVersion="10.X",bDetected=1):Binary.compare("370700000201")?(sName="Pantaray QSetup data",sVersion="11.X",bDetected=1):Binary.compare("04'PBG'")?(sName="Paquet archive",bDetected=1):Binary.compare("'PB'................................'7z'")?(sName="Paquet Builder",sOptions="7zip",bDetected=1):Binary.compare("'qres'")?(sName="QT installer data",bDetected=1):Binary.compare("4B2A9A")||Binary.compare("4B2A84")?(sName="RTPatch archive",bDetected=1):Binary.compare("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7")?(sName="Setup Factory installer data",sVersion="8.X, 9.X",bDetected=1):Binary.compare("e0e1e2e3e4e5e6")?(sName="Setup Factory installer data",sVersion="4.X, 5.X",bDetected=1):Binary.compare("67155234ff4d3642")?(sName="STATICSUP installer data",bDetected=1):Binary.compare("'ESIV'")||Binary.compare("'SIVM'",61440)?(sName="Vise Installer data",bDetected=1):Binary.compare("'RsDl'")?(sName="WinImage SFX data",bDetected=1):Binary.compare("'IMP'0a")?(sName="IMP archive",bDetected=1):Binary.compare("'@Daisy@Lucy@xyzzy@'................1f8b08")||Binary.compare("'@Daisy@Lucy@xyzzy@'1f8b08")?(sName="WinPatch Apply Program data",sOptions="gzip",bDetected=1):Binary.compare("'***messages***'")?(sName="WinRAR Installer data",bDetected=1):Binary.compare("fffe2a002a002a006d0065007300730061006700650073002a002a002a00")?(sName="WinRAR Installer data",sVersion="5.X",bDetected=1):Binary.compare("'MPV*'")?(sName="ZipCentral SFX-32 data",bDetected=1):Binary.compare("'[20/20]'")?(sName="PCInstall data",bDetected=1):Binary.compare("'ISSetupStream'")?(sName="InstallShield data",sVersion="18.X",bDetected=1):Binary.compare("'FWS'")||Binary.compare("'CWS'")?(sName="Adobe Flash",bDetected=1):Binary.compare("'Smart Install Maker v'")?(sName="Smart Install Maker data",sVersion=Binary.getString(Binary.getOverlayOffset()+23),bDetected=1):Binary.compare("....0000dcedbd")?(sName="PackageForTheWeb data",sOptions="InstallShield",bDetected=1):Binary.compare("'00000000000000BD00000000000000010000000000000001'",6560)?(sName="Autodesk Self-Extract data",bDetected=1):Binary.compare("c0dececb8d8d8d8d")?(sName="Ghost Installer archive",sOptions="xored MSCF, mask: 8D",bDetected=1):Binary.compare("02060a0405fd59")?(sName="CreateInstall data",sVersion="2003.3.5",bDetected=1):Binary.compare("'RWMV'")?(sName="VMWare Installation Launcher data",bDetected=1):Binary.compare("........'GRCSETUPINFORMATION'")?(sName="Codegear Installer data",bDetected=1):Binary.compare("'xvm'0003")?(sName="Spoon Studio data",bDetected=1):Binary.compare("2f30ee1f5e4ee51e")?(sName="Advanced Installer data",sOptions="MS Compound-like format",bDetected=1):Binary.compare("'^OPT'")?-1!=(e=Binary.findString(Binary.getOverlayOffset(),80,"^ARC"))&&Binary.compare("1f8b08",e+4)&&(sName="Adobe SVG Installer",sOptions="gzip",bDetected=1):Binary.compare("07d26cbf2159abaa0100000000")?(sName="Chilkat ZIP Self-Extractor data",bDetected=1):Binary.compare("'IST'00")?(sName="Dolphin Virtual Machine data",sVersion="5.0",bDetected=1):Binary.compare("'@._P-DATA_.@'")?(sName="CodeFusion Wizard data",bDetected=1):Binary.compare("'ASWsetupFPkgFil3'")?(sName="avast! Antivirus installer data",bDetected=1):Binary.compare("5b3e")?-1!=(e=Binary.findSignature(Binary.getOverlayOffset(),1280,"'PK'0304"))&&(sName="InstallAnywhere data",sOptions="zip",bDetected=1):Binary.compare("........efbeadde'NullsoftInst'")?(sName="NSIS data",bDetected=1):Binary.compare("................fec1cd666ebccf01fec1cd666ebccf0100..............78da")?(sName="Internet Download Manager installer data",sOptions="zlib",bDetected=1):Binary.compare("d513e4e801000000")?(sName="Install4j installer data",bDetected=1):Binary.compare("efbbbf';!@Install@!UTF-8!'")?(sName="7-zip Installer data",bDetected=1):Binary.compare("'UM'030a00")?(sName="Sony Windows installer data",bDetected=1):Binary.compare("7b00320030003700320036003300370037002d00")||-1!=Binary.findSignature(Binary.getOverlayOffset(),Math.min(256,Binary.getOverlaySize()),"7b00320030003700320036003300370037002d00")?(sName="ADS Self Extractor data",bDetected=1):Binary.compare("276327631226097513180178")?(sName="Chaos Software installer data",bDetected=1):Binary.compare("'OWS9G1'",11)?(sName="Gentee installer data",bDetected=1):Binary.compare("'SQ5SFX'")?(sName="Squeez SFX data",bDetected=1):Binary.compare("'Inno Setup Setup Data'")?(sName="Inno Setup data",bDetected=1):-1!=Binary.findSignature(Binary.getOverlayOffset(),Math.min(256,Binary.getOverlaySize()),"'MSCF00000000'")?(sName="CAB archive",bDetected=1):-1!=Binary.findSignature(Binary.getOverlayOffset(),Math.min(256,Binary.getOverlaySize()),"'ISc('")?(sName="InstallShield archive",bDetected=1):Binary.compare("'ExcelsiorII1'")?(sName="Excelsior installer data",bDetected=1):Binary.compare("'InstallShield'00")?(sName="InstallShield data",sOptions="2.X-3.X",bDetected=1):Binary.compare("'wwwwI'874712")?(sName="Multimedia Fusion installer data",bDetected=1):Binary.compare("'PIMPFILE'00")?(sName="PIMP installer data",bDetected=1):Binary.compare("'tiz1'........78da")?(sName="Tarma installer data",sOptions="zlib",bDetected=1):Binary.compare("'XXataDfOnigeB'")?(sName="I-D Media installer data",bDetected=1):Binary.compare("'This is the end of the executable'")?(sName="SwiftView installer data",bDetected=1):Binary.compare("1f8b08",12288)?(sName="BulletProofSoft installer data",sOptions="gzip",bDetected=1):Binary.compare("'AddD'03")?(sName="SecuROM data",e=Binary.getOverlayOffset(),sVersion=Binary.getString(e+8),bDetected=1):Binary.compare("'NB02'")?(sName="CodeView 3.14 debug information",bDetected=1):Binary.compare("'NB09'")?(sName="CodeView 4.10 debug information",bDetected=1):Binary.compare("'NB11'")?(sName="CodeView 5.0 debug information",bDetected=1):Binary.compare("'NB10'")?(sName="PDB 2.0 file link",bDetected=1):Binary.compare("'RSDS'")?(sName="PDB 7.0 file link",bDetected=1):Binary.compare("'[(*|*)]MZ'")?(sName="Mioplanet installer executable+data",bDetected=1):Binary.compare("'MPV'")?(sName="DelZip SFX data",bDetected=1):Binary.compare("'MPU'00")?(sName="CoffeeCup SFX data",bDetected=1):Binary.compare("'<KRZIP FILE BEGINS HERE>'")?(sName="KRZIP archive",bDetected=1):Binary.compare("..........87000001........5d0000800000")?(sName="Smart Install Maker data",bDetected=1):Binary.compare("'RS'")?(sName="AOLSetup data",bDetected=1):Binary.compare("'TGCF'")?(sName="Setup-Specialist archive",bDetected=1):Binary.compare("a3484bbe986c4aa9")?(sName="AutoIt compiled script",sVersion="2.XX-3.XX",bDetected=1):Binary.compare("'MSCF'00000000")?(sName="CAB archive",bDetected=1):Binary.compare("'PK'0304")?(sName="ZIP archive",bDetected=1):Binary.compare("'$_BIM_CONFIG_START_$")?(sName="Bytessence Install Maker data",bDetected=1):Binary.compare("........'.eh_frame'00")?(sName="BitRock installer data",bDetected=1):Binary.compare("09050000")?(sName="ThinApp data",bDetected=1):Binary.compare("BDA6EEE9F9EDEFEDE5ED")?(sName="Hamrick Software XOR-ed ZIP",bDetected=1):Binary.compare("000000000000000038e8020000000000")?(sName="Box Stub installer data",bDetected=1):Binary.compare("a7870800")||Binary.compare("a7870800")?(sName="Install Factory data",bDetected=1):Binary.compare("a6d6b210")?(sName="Sax Software archive",bDetected=1):Binary.compare("'Win_Sfx_For_Windows_'")?(sName="XZIP-SFX data",sOptions="by Netzip",bDetected=1):"[GeneralOptions]"==X.SU16(2,16)?(sName="Advanced Installer data",bDetected=1):Binary.compare("d90e0100889f")&&(sName="Winlicense xored EXE (0xC5 xor mask)",bDetected=1)),result()}meta("data","")

================================================
FILE: dbs_min/db/Binary/debug_data_debugData.1.sg
================================================
function detect(){var r=Binary.getSize()
if(21243===Binary.readWord(0))return a=Binary.readByte(2),e=Binary.readByte(3),a=(10*(a>>4)+(15&a)).toString(),e=(10*(e>>4)+(15&e)).toString(),_setResult(sType,"Borland",e+"."+a,"TDS"+(Binary.readWord(14)?" "+Binary.readWord(14)+" symbols":"")),!0
if(Binary.compare("'FB09'"))return _setResult(sType,"Borland","","Delphi TDS"),!0
if(Binary.compare("'FB0A'"))return _setResult(sType,"Borland","","C++ TDS"),!0
var e=Binary.readDword(r-4)
if(16<r&&33670===Binary.readWord(r-14))return 0<=r-e&&_setResult(sType,"Watcom",Binary.readByte(r-12)+"."+Binary.readByte(r-11),"0x"+e.toString(16)+" bytes"),!0
if(16<r&&16974===Binary.readWord(r-8)&&/^NB0[5789]|NB1[01]$/.test(Binary.read_ansiString(r-8,4)))return 0<=r-e&&_setResult(sType,"CodeView","4.0","0x"+e.toString(16)+" bytes"),!0
if(16<r&&5458260===Binary.readDword(r-16)&&0===Binary.readDword(r-12)&&0===Binary.readDword(r-8)){var a=r-e
if(0<=a)return(r=get_DWRAF_vi(a,r-a)).bIsValid&&_setResult(sType,"DWARF",r.sVersion,"0x"+e.toString(16)+" bytes, Watcom"),!0}return Binary.isDebugData()&&Binary.compare("'RSDS'")?(sName="PDB file link",_setResult(sType,sName,"7.0",""),!0):result()}meta("debug data","")

================================================
FILE: dbs_min/db/Binary/font.ADOBE.1.sg
================================================
function detect(){var e
return 15<=Binary.getSize()&&(Binary.compare("'StartFontMetrics '")&&Binary.compare("'.'",18)?(sName="Adobe Font Metrics (.AFM)",sVersion="v"+Binary.getString(17,3),bDetected=1):384==Binary.read_uint16(0)&&896==Binary.read_uint16(Binary.getSize()-2)?(sName="Adobe Printer Font Binary (.PFB)",bDetected=1,Binary.isVerbose()&&(e=Binary.getString(6,512).match(/%!PS-AdobeFont-1.0: (.*?)[\r\n]/))&&sOption(e[1])):Binary.compare("0001")&&Binary.getSize()==Binary.read_uint32(2)&&(sName="Adobe Printer Font Metrics (.PFM)",bDetected=1,Binary.isVerbose())&&(sOptions=Binary.getString(6,60))),result()}meta("font")

================================================
FILE: dbs_min/db/Binary/font_BMF.1.sg
================================================
function detect(){if(48<=Binary.getSize())if(Binary.compare("'BMF'")){switch(bDetected=1,Binary.read_uint8(3)){case 1:sVersion="v1",sOptionT("Binary")
break
case 2:sVersion="v2",sOptionT("Binary")
break
case 3:sVersion="v3",sOptionT("Binary")
break
default:bDetected=0}if(bDetected&&Binary.isVerbose())for(var e=4;e<Binary.getSize();){var i=Binary.read_uint8(e),n=(e+=1,Binary.read_uint32(e))
switch(e+=4,i){case 1:sOptionT('"'+Binary.getString(e+14)+'"'),sOptionT("Size:"+Binary.read_int16(e))
break
case 2:sOptionT("pages:"+Binary.read_int16(e+4)+"x"+Binary.read_int16(e+6)+"x"+Binary.read_int16(e+8))
break
case 3:break
case 4:sOptionT("chars:"+n/20)
break
case 5:sOptionT("kerning_pairs:"+n/10)}e+=n}}else Binary.isPlainText()&&0<=Binary.find_utf8String(0,200,"info face")&&0<=Binary.find_utf8String(0,200,"stretchH")&&(bDetected=1,0<=Binary.find_utf8String(0,200,"<?xml")?sOptionT("XML"):sOptionT("Text"))
return result()}meta("font","AngelCode Bitmap Font (.FNT)")

================================================
FILE: dbs_min/db/Binary/font_FFN.1.sg
================================================
function detect(){return Binary.compare("'FNTF'......00")&&(sOptions="Windows",bDetected=1),result()}meta("font","FFN")

================================================
FILE: dbs_min/db/Binary/font_TFM.1.sg
================================================
function detect(){return Binary.compare("....0012000000")&&(bDetected=1),result()}meta("font","TFM")

================================================
FILE: dbs_min/db/Binary/font_VTF.1.sg
================================================
function detect(){return bDetected=Binary.compare("'TNFV'"),result()}meta("font","VTF")

================================================
FILE: dbs_min/db/Binary/font_XTT.1.sg
================================================
function detect(){var t
return Binary.compare("78 74 74 66")&&(t=Binary.getString(1,3).trim(),/^[a-z]{3}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("font","Xbox 360 System Font (.XTT)")

================================================
FILE: dbs_min/db/Binary/format_AS.1.sg
================================================
function detect(){var t
return Binary.compare("'Act;'")&&(t=Binary.getString(4,5).trim(),/^[a-zA-Z/]{5}/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=!0),result()}meta("format","AS")

================================================
FILE: dbs_min/db/Binary/format_AmigaIcon.1.sg
================================================
function detect(){if(Binary.compare("E310 0001")){switch(bDetected=1,ic_Type=File.read_uint8(48)){case 1:sVersion="DISK"
break
case 2:sVersion="DRAWER"
break
case 3:sVersion="TOOL"
break
case 4:sVersion="PROJECT"
break
case 5:sVersion="GARBAGE"
break
case 6:sVersion="malformed:DEVICE"
break
case 7:sVersion="KICK"
break
case 8:sVersion="malformed:APPICON"
break
default:sVersion="malformed"}if(Binary.isVerbose()&&(ic_DefaultTool=0!=File.read_uint8(50),ic_ToolTypes=0!=File.read_uint8(54),ic_CurrentX=File.read_int32(58,_BE),ic_CurrentY=File.read_int32(62,_BE),ic_DrawerData=0!=File.read_uint8(66),ic_ToolWindow=0!=File.read_uint8(70),p=4,ga_Width=File.read_int16(p+8,_BE),ga_Height=File.read_int16(p+10,_BE),ga_SelectRender=0!=File.read_uint8(p+22),p=78,ic_DrawerData&&(p+=56,sOption("Drawer data present")),(im_Width=File.read_int16(p+4,_BE))%2==1&&im_Width++,im_Height=File.read_uint16(p+6,_BE),im_Depth=File.read_uint16(p+8,_BE),icoinfo="icon: "+im_Width+"×"+im_Height+"@"+im_Depth+" at ["+Hex(p+20)+"..",p+=20+im_Width*im_Height*im_Depth/8,icoinfo+=Hex(p)+")",sOption(icoinfo),ga_SelectRender&&((im_Width=File.read_int16(p+4,_BE))%2==1&&im1_Width++,im_Height=File.read_int16(p+6,_BE),im_Depth=File.read_int16(p+8,_BE),info="sel.icon: "+im_Width+"×"+im_Height+"@"+im_Depth+" at ["+Hex(p+20)+"..",p+=20+im_Width*im_Height*im_Depth/8,icoinfo+=Hex(p)+")",sOption(icoinfo)),"pn"==File.getFileBaseName().toLowerCase())&&0<(p=File.findSignature(6,File.getSize()-20,"'SONGS='")-1)){for(tp="",x="",t="",c="",cp="",pn=!1,tagsz=File.getSize()-p,tagl=[],tagr=[];p<File.getSize();)lr=File.read_ucsdString(p),tagl.push(lr.split("=")[0]),tagr.push(lr.split("=")[1]),p+=lr.length+5
for(i=0;i<tagl.length;i++)switch(tagl[i]){case"SONGS":x=tagr[i]
break
case"TYPE":"POKEY"==tagr[i]&&(pn=!0)
break
case"NAME":t=tagr[i]
break
case"CREATOR":c=tagr[i]
break
case"COPYRIGHT":cp=tagr[i]}pn&&(sOption("POKEYNoise info found"),sOption(t),"1"<x&&sOption(x,"x"),sOption(c,"by "),sOption(cp,"(c) "))}}return result()}meta("format","Amiga Icon Format (.INFO)")

================================================
FILE: dbs_min/db/Binary/format_BCD1.1.sg
================================================
function detect(){var t
return Binary.compare("'[ENVIINFO]'")?(t=Binary.getString(11,4).trim(),/^[A-Za-z0]{4}$/.test(t)&&(X.isVerbose()&&(sOptions=t),bDetected=1)):Binary.compare("'[AppliInfo]'")&&(t=Binary.getString(13,4).trim(),/^[A-Za-z]{4}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","BCD1")

================================================
FILE: dbs_min/db/Binary/format_BOU.1.sg
================================================
function detect(){var t=Binary.getString(0,20).trim()
return/^[CLcl]\d{2}([Cc]alcul|[Ll]ecture) \d ans/.test(t)&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","BOU")

================================================
FILE: dbs_min/db/Binary/format_BSP.1.sg
================================================
function detect(){return Binary.compare("'VBSP'15000000")&&(bDetected=1),result()}meta("format","BSP")

================================================
FILE: dbs_min/db/Binary/format_BTF.1.sg
================================================
function detect(){return bDetected=Binary.compare("9feb01001800000000000000"),result()}meta("format","BTF")

================================================
FILE: dbs_min/db/Binary/format_BackupMii.1.sg
================================================
function detect(){var e
return Binary.compare("'BackupMii v1'")&&(e=Binary.getString(25,8).trim(),/^[a-z0-9]{8}$/.test(e))&&(X.isVerbose()&&(sOptions="ConsoleID: "+e),sVersion="1.0",bDetected=1),result()}meta("format","BackupMii")

================================================
FILE: dbs_min/db/Binary/format_CCD.1.sg
================================================
function detect(){var e
return Binary.compare("'[CloneCD]'")&&(e=Binary.getString(19,1).trim(),/^[0-9]{1}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("format","CloneCD Control")

================================================
FILE: dbs_min/db/Binary/format_CSO.1.sg
================================================
function detect(){return Binary.compare("'CISO'0000000000......000000000008")&&(bDetected=1),result()}meta("format","Compressed ISO file (.CISO)")

================================================
FILE: dbs_min/db/Binary/format_CTRK.1.sg
================================================
function detect(){return Binary.compare("01000800000000000000")&&(sOptions=File.cleanString(Binary.getString(26)),bDetected=1),result()}meta("format","CTRK")

================================================
FILE: dbs_min/db/Binary/format_CURE.1.sg
================================================
function detect(){var t
return Binary.compare("'[Global]'")&&(t=Binary.getString(10,4).trim(),/^[a-zA-Z]{4}/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","Mesh configuration (.CURE)")

================================================
FILE: dbs_min/db/Binary/format_CVM.1.sg
================================================
function detect(){if(!(X.Sz()<2048)&&X.c("'CVMH'")&&isAllZeroes(12,16)&&X.c("'ROFS'",52)){var e=X.SA(68,4)
if(/^[0-9\.]{4}/.test(e)){var s,t,r=X.U64(28,_BE),i=X.U32(128,_BE),a=0,c=!1
if(!(r<12+X.U64(4,_BE))&&isWithin(i,1,12+X.U64(4,_BE)-256>>2)){for(;a<r&&a<X.Sz();){if(s=X.SA(a,4),t=X.U64(a+4,_BE),a+=12,!t||!charStat(s,!0).includes("allasc"))return
switch(s){case"CVMH":case"ZONE":break
default:c=!0}if(c)break
a+=t}return sVersion="v"+e,bDetected=1,X.isVerbose()?sOption(outSz(r),"sz:"):r<X.Sz()&&(sVersion+="/malformed!short"),result()}}}}meta("format","CRI Middleware's PS2 CVM/ROFS image (.CVM)")

================================================
FILE: dbs_min/db/Binary/format_DESKTOP.1.sg
================================================
function detect(){return Binary.isText()&&(Binary.compare("'#'")||Binary.compare("'\n'")||Binary.compare("'['"))&&Binary.isSignaturePresent(0,512,"'[Desktop Entry]'")&&(bDetected=1),result()}meta("format","Desktop Entry (.desktop)")

================================================
FILE: dbs_min/db/Binary/format_DSW.1.sg
================================================
function detect(){var e
return Binary.compare("'Microsoft Developer Studio Workspace File'")&&(e=Binary.getString(57,5).trim(),/^\d+\.\d{2}$/.test(e))&&(sVersion=e,bDetected=1),result()}meta("format","Microsoft Developer Studio Workspace")

================================================
FILE: dbs_min/db/Binary/format_DTA.1.sg
================================================
function detect(){var t
return Binary.compare("03000000....08")&&(t=Binary.getString(7,8).trim(),/^[a-z0-9]{8}/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","DTA")

================================================
FILE: dbs_min/db/Binary/format_Director.1.sg
================================================
function detect(){return Binary.compare("5249465800")?(sOptions=Binary.getString(8,8),sVersion="Win",bDetected=1):Binary.compare("58464952......00")&&(sOptions=Binary.getString(8,8),sVersion="Mac",bDetected=1),result()}meta("format","Director (.DXR/.DIR/.DCR/.DRX/.CXT/.CST/.CCT)")

================================================
FILE: dbs_min/db/Binary/format_DunkleSchattenConfig.1.sg
================================================
function detect(){return Binary.compare("'DSchCFG'000001")&&(bDetected=1),result()}meta("format","Dunkle Schatten Config")

================================================
FILE: dbs_min/db/Binary/format_DunkleSchattenSave.1.sg
================================================
function detect(){return Binary.compare("'DSchSAV'000001")&&(bDetected=1),result()}meta("format","Dunkle Schatten Save")

================================================
FILE: dbs_min/db/Binary/format_Empty.1.sg
================================================
function detect(){return 0==Binary.getSize()&&(bDetected=1),result()}meta("format","Empty file")

================================================
FILE: dbs_min/db/Binary/format_FAS.1.sg
================================================
function detect(){return Binary.compare("0d0a20'FAS4-FILE'")&&(bDetected=1),result()}meta("format","FAS")

================================================
FILE: dbs_min/db/Binary/format_FLDB.1.sg
================================================
function detect(){return Binary.compare("'FLDB'",20)&&(bDetected=1),result()}meta("format","Becker file location databases")

================================================
FILE: dbs_min/db/Binary/format_FNX.1.sg
================================================
function detect(){var t
return Binary.compare("'adgames'")&&(t=Binary.getString(17,4).trim(),/^[12]\d{3}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","FNX")

================================================
FILE: dbs_min/db/Binary/format_FST.1.sg
================================================
function detect(){return Binary.compare("';Ligne de commentaires'0d0a")&&(bDetected=1),result()}meta("format","FST")

================================================
FILE: dbs_min/db/Binary/format_GAL.1.sg
================================================
function detect(){var t
return Binary.compare("'Gale102'..00000001")&&(t=Binary.getString(20,6).trim(),/^[A-Za-z0-9]{6}/.test(t))&&(sVersion="1.0.2",sOptions=t,bDetected=1),result()}meta("format","Gale (.GAL)")

================================================
FILE: dbs_min/db/Binary/format_GBI.1.sg
================================================
function detect(){return Binary.compare("'GBI'000000000000000000000000004C")&&(bDetected=1),result()}meta("format","gBurner Image (.GBI)")

================================================
FILE: dbs_min/db/Binary/format_GME.1.sg
================================================
function detect(){return Binary.compare("'1CHOMPTECH DATA FORMAT CopyRight 2009'",32)&&(bDetected=1),result()}meta("format","GME")

================================================
FILE: dbs_min/db/Binary/format_GameMaps.1.sg
================================================
function detect(){return Binary.compare("'TED5v1.0'..ff")&&(sVersion="1.0",bDetected=1),result()}meta("format","GameMaps (TED editor)")

================================================
FILE: dbs_min/db/Binary/format_GamingRoot.1.sg
================================================
function detect(){return Binary.compare("52 47 42 58 01 00 00 00 58 00 62 00 6F 00 78 00 47 00 61 00 6D 00 65 00 73 00 00 00")&&(sVersion="Xbox Games",bDetected=1),result()}meta("format","GamingRoot")

================================================
FILE: dbs_min/db/Binary/format_HIV.1.sg
================================================
function detect(){return Binary.compare("'regf'..0000000..00000")&&(bDetected=1),result()}meta("format","Windows Registry Hive (.HIV)")

================================================
FILE: dbs_min/db/Binary/format_HNM.1.sg
================================================
function detect(){return Binary.compare("'HNM6'0000..108002")&&(bDetected=1),result()}meta("format","HNM")

================================================
FILE: dbs_min/db/Binary/format_HSM.1.sg
================================================
function detect(){return Binary.compare("'1LMB'000000108002")&&(bDetected=1),result()}meta("format","HSM")

================================================
FILE: dbs_min/db/Binary/format_ILK.1.sg
================================================
function detect(){return Binary.compare("'Microsoft Linker Database'0a0a071a000000")&&(bDetected=1),result()}meta("format","Name incremental database file (.ILK)")

================================================
FILE: dbs_min/db/Binary/format_IPCH.1.sg
================================================
function detect(){var e
return Binary.compare("'EDG C/C++ version '")&&(e=Binary.getString(18,3).trim())&&(sVersion=e,bDetected=1),result()}meta("format","Intellisense Precompiled Header File (.IPCH)")

================================================
FILE: dbs_min/db/Binary/format_ITL.1.sg
================================================
function detect(){var e
return Binary.compare("'hdfm'00000090")&&(e=Binary.getString(17,8).trim(),/^[0-9/.]{8}$/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("format","iTunes Library")

================================================
FILE: dbs_min/db/Binary/format_IVF.1.sg
================================================
function detect(){var t
return Binary.compare("'DKIF'00002000")&&(t=Binary.getString(8,4).trim(),/^[A-Z0-9]{4}$/.test(t))&&(X.isVerbose()&&(sOptions="Codec: "+t),bDetected=1),result()}meta("format","Duck IVF")

================================================
FILE: dbs_min/db/Binary/format_Img.UDIF.1.sg
================================================
function detect(){return Binary.compare("7801730d62626060")?(sOptions="read-only zlib-compressed",bDetected=1):Binary.compare("45520200")&&Binary.compare("'disk image'",1040)&&(sOptions="read/write",bDetected=1),result()}meta("format","Universal Disk Image Format")

================================================
FILE: dbs_min/db/Binary/format_InnoSetupUninstall.1.sg
================================================
function detect(){var t
return Binary.compare("'Inno Setup Uninstall Log (b) 64-bit'")&&(sVersion="64-bit",t=Binary.getString(64,39).trim(),/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/.test(t))&&(X.isVerbose()&&(sOptions="UUID: "+t),bDetected=1),result()}meta("format","Inno Setup Uninstall Log")

================================================
FILE: dbs_min/db/Binary/format_InterleafFile.1.sg
================================================
function detect(){var e
return Binary.compare("52494646........'OMNI'")&&(e=Binary.getString(12,4).trim(),/^[A-Za-z]{4}/.test(e))&&(X.isVerbose()&&(sOptions=e),bDetected=1),result()}meta("format","Interleaf File")

================================================
FILE: dbs_min/db/Binary/format_LCA.1.sg
================================================
function detect(){var t
return Binary.compare("4c45474f")&&(t=Binary.getString(85,12).trim(),/^[A-Z0-9/.]{12}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","LCA")

================================================
FILE: dbs_min/db/Binary/format_LGX.1.sg
================================================
function detect(){var e
return Binary.compare("'LGX'")&&(e=Binary.getString(7,5).trim(),/^[0-9]{5}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("format","Logox4 Speechengine")

================================================
FILE: dbs_min/db/Binary/format_LIXS.1.sg
================================================
function detect(){var t
return Binary.compare("'Island Xtreme Stunts - Silicon Dreams'")&&(t=Binary.getString(40,5).trim(),/^[12]\d{3}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","LIXS")

================================================
FILE: dbs_min/db/Binary/format_LVL.1.sg
================================================
function detect(){var t
return Binary.compare("1C070000....0000")&&(t=Binary.getString(16,13).trim(),/^[A-Za-z]{13}/.test(t))&&(sOptions=t,bDetected=1),result()}meta("format","LVL")

================================================
FILE: dbs_min/db/Binary/format_MAT.1.sg
================================================
function detect(){var t
return Binary.compare("'MATLAB'")&&(t=Binary.getString(7,3).trim(),/^[0-9/.]{3}$/.test(t))&&(X.isVerbose()&&(sVersion=t),bDetected=1),result()}meta("format","MatLab")

================================================
FILE: dbs_min/db/Binary/format_MDL.1.sg
================================================
function detect(){var e
return Binary.compare("'IDST'")&&(e=Binary.getString(4,1).trim(),/^[0-9]{1}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("format","MDL")

================================================
FILE: dbs_min/db/Binary/format_MDS.1.sg
================================================
function detect(){if(X.c("'MEDIA DESCRIPTOR'01")){var e=""
switch(X.U16(18,_LE)){case 0:e="CD"
break
case 1:e="CD-R"
break
case 2:e="CD-RW"
break
case 16:e="DVD"
break
case 18:e="DVD-R"
break
default:return}sVersion="v1-"+X.U8(17)+"/"+e,bDetected=1}return result()}meta("format","Alcohol 120% Media Descriptor Sidecar file (.MDS)")

================================================
FILE: dbs_min/db/Binary/format_MS-DBG.1.sg
================================================
function detect(){return 9<=Binary.getSize()&&Binary.compare("'MDMP'93A7")&&(bDetected=1),result()}meta("format","Windows Minidump (.DMP)")

================================================
FILE: dbs_min/db/Binary/format_MS-PST.sg
================================================
function detect(){return 1024<Binary.getSize()&&Binary.compare("21 42 44 4E")&&Binary.compare("53 4D",8)&&(bDetected=1),result()}meta("format","Microsoft Outlook Personal Storage Table (PST)")

================================================
FILE: dbs_min/db/Binary/format_MS-VHD.1.sg
================================================
function detect(){if(512<=Binary.getSize()&&Binary.compare("'conectix'",Binary.getSize()-512)){switch(bDetected=1,nOffset=Binary.getSize()-512,sVersion="v"+Binary.read_uint16(nOffset+12,_BE)+"."+Binary.read_uint16(nOffset+14,_BE),Binary.read_uint32(nOffset+60,_BE)){case 2:sOption("Fixed")
break
case 3:sOption("Dynamically")
break
case 4:sOption("Differencings")
break
default:return}if(sOption("OrginalSize:"+Binary.bytesCountToString(Binary.read_uint64(nOffset+40,_BE))),sOption("CurrentSize:"+Binary.bytesCountToString(Binary.read_uint64(nOffset+48,_BE))),Binary.isVerbose())switch(sOption("CreaterApp:"+Binary.getString(nOffset+28,4)),sOption("v"+Binary.read_uint16(nOffset+32,_BE)+"."+Binary.read_uint16(nOffset+34,_BE)),Binary.read_uint32(nOffset+36,_BE)){case 1466511986:sOption("WI2R")
break
case 1466511979:sOption("WINDOWS")
break
case 1462923893:sOption("W2RU")
break
case 1462922101:sOption("W2KU")
break
case 1298228e3:sOption("MACINTOSH")
break
case 1293300312:sOption("MACX")
break
default:return}}return result()}meta("format","Microsoft Virtual Hard Disk (.VHD)")

================================================
FILE: dbs_min/db/Binary/format_MS-VHDX.sg
================================================
function detect(){return 1048576<Binary.getSize()&&Binary.compare("76 68 64 78 66 69 6C 65")&&(bDetected=1,sOption("CreaterApp:"+Binary.read_unicodeString(8,50))),result()}meta("format","Virtual Hard Disk v2 (VHDX)")

================================================
FILE: dbs_min/db/Binary/format_MS-XNA.1.sg
================================================
function detect(){if(9<=Binary.getSize())if(Binary.compare("'XNB'")){bDetected=1,sName="Microsoft XNA Game Studio Binary Package (.XNB)"
var e=Binary.read_uint8(4),a=Binary.read_uint8(5)
switch(e){case 3:sVersion="v3.0"
break
case 4:sVersion="v3.1"
break
case 5:sVersion="v4.0"
break
default:bDetected=0}switch(Binary.read_uint8(3)){case 119:sOption("Windows")
break
case 120:sOption("Xbox 360")
break
case 109:sOption("Windows Phone 7")
break
case 105:sOption("iOS")
break
case 97:sOption("Android")
break
case 88:sOption("MacOSX")
break
case 80:sOption("PS4")
break
case 83:sOption("Switch")
break
default:sOption("UNKNOWN")}Binary.isVerbose()&&((1&a)>>0&&sOption("hiDef"),(128&a)>>2&&sOption("compressed"),!Binary.getSize()==Binary.read_uint32(5))&&sOption("wrong size!")}else Binary.compare("'WBND'")?(bDetected=1,sName="Microsoft XACT Wave Bank (.XWB)"):Binary.compare("'SDBK'")?(bDetected=1,sName="Microsoft XACT Sound Bank (.XSB)"):Binary.compare("'XGSF'")&&(bDetected=1,sName="Microsoft XACT Global Settings File (.XGS)")
return result()}meta("format","")

================================================
FILE: dbs_min/db/Binary/format_OBC.1.sg
================================================
function detect(){var t
return Binary.compare("'OBC Copyright MDO'20")&&(t=Binary.getString(18,5).trim(),/^[12]\d{3}$/.test(t))&&(sVersion=t,sOptions=File.cleanString(Binary.getString(84,14)),bDetected=1),result()}meta("format","Compiled DEV7 object (.OBC)")

================================================
FILE: dbs_min/db/Binary/format_OpenSSH.1.sg
================================================
function detect(){return Binary.compare("2d2d2d2d2d424547494e20'OPENSSH PRIVATE KEY'2d2d2d2d2d")&&(bDetected=1),result()}meta("format","OpenSSH Private Key")

================================================
FILE: dbs_min/db/Binary/format_P7X.1.sg
================================================
function detect(){return Binary.compare("'PKCX0'82")&&(sOptions="PKCX0",bDetected=1),result()}meta("format","P7X")

================================================
FILE: dbs_min/db/Binary/format_PAT.1.sg
================================================
function detect(){return Binary.compare("000000..00000..10000")&&(bDetected=1),result()}meta("format","Gimp Pattern")

================================================
FILE: dbs_min/db/Binary/format_PDB.1.sg
================================================
function detect(){if(Binary.compare("'BSJB'0100")?(sVersion="1.0",bDetected=1):Binary.compare("'Microsoft C/C++ program database 2.00\r\n'1A4A470000")?(sVersion="2.0",bDetected=1):Binary.compare("'Microsoft C/C++ MSF 7.00\r\n'1A4453000000")&&(sVersion="7.0",bDetected=1),bDetected){var r,e={"'$'11'@P:Microsoft.VisualBasic'00":"VB.NET","%%%%%%%%%%'.cs'00":"C#","'$'11'@P:FSharp.Core'00":"F#","'std::'%%%%%%":"C++"}
for(r in e)if(Binary.isSignaturePresent(0,9437184,r)){sLang=e[r]
break}}return result()}meta("format","Microsoft Program Database (.PDB)")

================================================
FILE: dbs_min/db/Binary/format_PEM.1.sg
================================================
function detect(){return Binary.compare("2d2d2d2d2d424547494e20'CERTIFICATE'2d2d2d2d2d")?(sVersion="Certificate",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'PRIVATE KEY'2d2d2d2d2d")?(sVersion="Private Key",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'RSA PRIVATE KEY'2d2d2d2d2d")?(sVersion="RSA Private Key",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'ENCRYPTED PRIVATE KEY'2d2d2d2d2d")?(sVersion="Encrypted Private Key",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'PUBLIC KEY'2d2d2d2d2d")?(sVersion="Public Key",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'CERTIFICATE REQUEST'2d2d2d2d2d")?(sVersion="Certificate Signing Request (CSR)",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'PKCS7'2d2d2d2d2d")?(sVersion="PKCS7/CMS Message",bDetected=1):Binary.compare("2d2d2d2d2d424547494e20'X509 CRL'2d2d2d2d2d")&&(sVersion="Certificate Revocation List (CRL)",bDetected=1),result()}meta("format","Privacy-Enhanced Mail (.PEM)")

================================================
FILE: dbs_min/db/Binary/format_PGP.1.sg
================================================
function detect(){return Binary.compare("2d2d2d2d2d424547494e20'PGP'205349474e41545552452d2d2d2d2d")&&(bDetected=1),result()}meta("format","GPG")

================================================
FILE: dbs_min/db/Binary/format_POL.1.sg
================================================
function detect(){return Binary.compare("5052656701000000")&&(bDetected=1),result()}meta("format","Registry Policy File")

================================================
FILE: dbs_min/db/Binary/format_PRI.1.sg
================================================
function detect(){return Binary.compare("'mrm_pri2'00000100")&&(bDetected=1),result()}meta("format","PRI")

================================================
FILE: dbs_min/db/Binary/format_PS-X.1.sg
================================================
function detect(){var e
return Binary.compare("'PS-X EXE'")&&(e=Binary.getString(76,48).trim())&&(X.isVerbose()&&(sOptions="Region: "+e),bDetected=1),result()}meta("format","PlayStation executable (PS1)")

================================================
FILE: dbs_min/db/Binary/format_PSM2CFG.1.sg
================================================
function detect(){var t
return Binary.compare("'PSM2CFG'")&&(t=Binary.getString(17,4).trim(),/^[0-9\.]{4}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","PSM2CFG")

================================================
FILE: dbs_min/db/Binary/format_RARREG.1.sg
================================================
function detect(){return Binary.compare("'RAR registration data'0d0a")&&(bDetected=1),result()}meta("format","RAR registration data (.RARREG)")

================================================
FILE: dbs_min/db/Binary/format_RCK.1.sg
================================================
function detect(){return Binary.compare("'RKET'00000000")&&(bDetected=1),result()}meta("format","RCK")

================================================
FILE: dbs_min/db/Binary/format_RCO.1.sg
================================================
function detect(){return Binary.compare("0050524600010000")&&(bDetected=1),result()}meta("format","Resource Container (.RCO)")

================================================
FILE: dbs_min/db/Binary/format_RGS.1.sg
================================================
function detect(){return Binary.compare("'HKCR'0d0a7b0d0a09")&&(sVersion="Windows Registry Script",bDetected=1),result()}meta("format","InstallShield")

================================================
FILE: dbs_min/db/Binary/format_RedShirt.1.sg
================================================
function detect(){return Binary.compare("'REDSHIRT'00")?(sVersion="v1.0",bDetected=1):Binary.compare("'REDSHRT2'00")&&(sVersion="v2.0",bDetected=1),result()}meta("format","RedShirt")

================================================
FILE: dbs_min/db/Binary/format_SDI.1.sg
================================================
function detect(){return Binary.compare("'$SDI0001'0000000000000000")&&(bDetected=1),result()}meta("format","System Deployment Image (.SDI)")

================================================
FILE: dbs_min/db/Binary/format_SFK.1.sg
================================================
function detect(){return Binary.compare("'SFPK'0100000040")&&(bDetected=1),result()}meta("format","SFK")

================================================
FILE: dbs_min/db/Binary/format_SHBIN.1.sg
================================================
function detect(){var t
return Binary.compare("'DVLB'")&&(t=Binary.getString(12,4).trim(),/^[A-Z]{4}/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","Shader Binary")

================================================
FILE: dbs_min/db/Binary/format_SLN.1.sg
================================================
function detect(){var t
return Binary.compare("efbbbf0d0a'Microsoft Visual Studio Solution File'")&&(t=Binary.getString(59,5).trim(),/^\d+\.\d{2}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","Visual Studio solution file")

================================================
FILE: dbs_min/db/Binary/format_SLNX.1.sg
================================================
function detect(){return Binary.compare("'<Solution>'0d0a2020")&&(bDetected=1),result()}meta("format","SLNX")

================================================
FILE: dbs_min/db/Binary/format_SSHPublicKey.1.sg
================================================
function detect(){return Binary.compare("'ssh-ed25519'20")?(sOptions="ed25519",bDetected=1):Binary.compare("'ssh-rsa'20")&&(sOptions="RSA",bDetected=1),result()}meta("format","SSH Public Key")

================================================
FILE: dbs_min/db/Binary/format_SystemErr.1.sg
================================================
function detect(){var t
return Binary.compare("'System_Err'")&&(t=Binary.getString(11,32).trim(),/^[ A-Za-z0-9\-\:\\\.]{1,}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","System_Err")

================================================
FILE: dbs_min/db/Binary/format_TLB.1.sg
================================================
function detect(){return Binary.compare("'MSFT'020001000000000009040000")&&(bDetected=1),result()}meta("format","Microsoft Type Library")

================================================
FILE: dbs_min/db/Binary/format_TOT.1.sg
================================================
function detect(){var r
return Binary.compare("?? ** 00'")&&Binary.isSignaturePresent(0,32,"00 00 '(c)'")&&(bDetected=1,-1!==(r=Binary.findSignature(0,64,"'Version ' %% 2E %%"))&&(sVersion=Binary.getString(r+8,4)),-1!==(r=Binary.findSignature(0,64,"'19' %% %%")))&&(sVersion+=(sVersion?", ":"")+Binary.getString(r,4)),result()}meta("format","TOT")

================================================
FILE: dbs_min/db/Binary/format_TPU.1.sg
================================================
function detect(){return Binary.compare("'TPUQ'00000000")&&(bDetected=1),result()}meta("format","Turbo Pascal Unit (.TPU)")

================================================
FILE: dbs_min/db/Binary/format_UCM.1.sg
================================================
function detect(){return Binary.compare("'UCM1'02000000")&&(sVersion="1.0",sOptions=Binary.getString(8),bDetected=1),result()}meta("format","UCM")

================================================
FILE: dbs_min/db/Binary/format_UPC.1.sg
================================================
function detect(){var t
return Binary.compare("'UPC'")&&(t=Binary.getString(13,3).trim(),/^[A-Z]{3}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","UPC")

================================================
FILE: dbs_min/db/Binary/format_UPF.1.sg
================================================
function detect(){var t
return Binary.compare("'UPF'")&&(t=Binary.getString(13,3).trim(),/^[A-Z]{3}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","UPF")

================================================
FILE: dbs_min/db/Binary/format_UPI.1.sg
================================================
function detect(){var t
return Binary.compare("'UPI'")&&(t=Binary.getString(13,3).trim(),/^[A-Z]{3}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","UPI")

================================================
FILE: dbs_min/db/Binary/format_VDI.1.sg
================================================
function detect(){if(512<=Binary.getSize()&&Binary.compare("7F10DABE",64)){sVersion="v"+Binary.read_uint16(68)+"."+Binary.read_uint16(70)
var i=Binary.getString(0).match(/<<< (.*?)\ >>>/)
if(i&&(sOptions='"'+sOptions.append(i[1])+'"',bDetected=1),bDetected&&Binary.isVerbose()){switch(Binary.read_uint16(76)){case 1:sOption("Normal dynamically")
break
case 2:sOption("Preallocated fixed size")
break
case 3:sOption("Dynamically growing for undo/commit changes")
break
case 4:sOption("Dynamically growing for differencings")}sOption("Size:"+Binary.bytesCountToString(Binary.read_uint64(368)))}}return result()}meta("format","Virtual Disk Image (.VDI)")

================================================
FILE: dbs_min/db/Binary/format_VM2.1.sg
================================================
function detect(){return Binary.compare("'Sony PS2 Memory Card Format 1.2.0.0'000000000000020200100000")&&(sVersion="1.2.0.0",bDetected=1),result()}meta("format","PS2 Memory Card")

================================================
FILE: dbs_min/db/Binary/format_VTF.1.sg
================================================
function detect(){return Binary.compare("'VTF'0007000000")&&(bDetected=1),result()}meta("format","Valve Texture")

================================================
FILE: dbs_min/db/Binary/format_VVD.1.sg
================================================
function detect(){return Binary.compare("'IDSV'04000000")&&(bDetected=1),result()}meta("format","VVD")

================================================
FILE: dbs_min/db/Binary/format_W3D.1.sg
================================================
function detect(){return Binary.compare("'IFX'000800000011000000")&&(bDetected=1),result()}meta("format","Shockwave 3D")

================================================
FILE: dbs_min/db/Binary/format_WASM.1.sg
================================================
function detect(){return Binary.compare("00'asm'010000000")&&(bDetected=1),result()}meta("format","WebAssembly (.WASM)")

================================================
FILE: dbs_min/db/Binary/format_WBFS.1.sg
================================================
function detect(){return Binary.compare("'WBFS'00....000915000001000000")&&(sOptions=File.cleanString(Binary.getString(512,6)),bDetected=1),result()}meta("format","Wii Backup File System")

================================================
FILE: dbs_min/db/Binary/format_XBE.1.sg
================================================
function detect(){return Binary.compare("'XBEH'000000000000000000000000")&&(sOptions="unsigned",bDetected=1),result()}meta("format","Xbox Executable (.XBE)")

================================================
FILE: dbs_min/db/Binary/format_XBF.1.sg
================================================
function detect(){var t
return Binary.compare("'XBF'")&&(t=Binary.getString(68,32).trim(),/^[A-Z0-9]{32}/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","XBF")

================================================
FILE: dbs_min/db/Binary/format_XCG.1.sg
================================================
function detect(){var t
return Binary.compare("'xcg File'")&&(t=Binary.getString(9,4).trim(),/^[0-9/.]{4}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","XCG (Graphics)")

================================================
FILE: dbs_min/db/Binary/format_XCI.1.sg
================================================
function detect(){var t
return Binary.compare("'xci File'")&&(t=Binary.getString(9,4).trim(),/^[0-9/.]{4}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","XCI")

================================================
FILE: dbs_min/db/Binary/format_XCR.1.sg
================================================
function detect(){var t
return Binary.compare("'xcr File'")&&(t=Binary.getString(9,4).trim(),/^[0-9/.]{4}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","XCR")

================================================
FILE: dbs_min/db/Binary/format_XCS.1.sg
================================================
function detect(){var t
return Binary.compare("58 43 53")&&(t=Binary.getString(4,2).trim(),/^[A-Z]{2}$/.test(t))&&(sVersion=t,bDetected=1),result()}meta("format","XPAT Compiled Script (.XCS)")

================================================
FILE: dbs_min/db/Binary/format_XDelta.1.sg
================================================
function detect(){return Binary.compare("d6c3c4000502")&&(bDetected=1),result()}meta("format","XDelta")

================================================
FILE: dbs_min/db/Binary/format_XEX.1.sg
================================================
function detect(){return Binary.compare("'XEX2'000000..00")&&(bDetected=1),result()}meta("format","Xbox Executable File (.XEX)")

================================================
FILE: dbs_min/db/Binary/format_ZZDATA.1.sg
================================================
function detect(){return Binary.compare("'DIRINFO'000000000000000000")&&(sVersion="CD-I",bDetected=1),result()}meta("format","ZZDATA")

================================================
FILE: dbs_min/db/Binary/format_ZinsSAV.1.sg
================================================
function detect(){return Binary.compare("'ZinsSAV'000001")&&(bDetected=1),result()}meta("format","Captain Zins Save")

================================================
FILE: dbs_min/db/Binary/format_bin.AAALogo.1.sg
================================================
function detect(){return 90<=Binary.getSize()&&Binary.compare("2CA46774")&&(bDetected=1),result()}meta("format","AAA Logo")

================================================
FILE: dbs_min/db/Binary/format_bin.COL.1.sg
================================================
function detect(){var e=0,r=[],t=0,a=""
for(p=0;p<X.Sz();t++,p+=e){if(!X.c("'COLL'",p)||X.U8(p-1)||p+8>X.Sz()){if(!X.c("'COLL'",--p))break
a=a.addIfNone("!badchunk")}if(e=8+X.U32(p+4,_LE),p+e>X.Sz())return
var i=X.SA(p+8,8)
if(!i.length)break
if(charStat(i,1).indexOf("allasc")<0)return
r.push(X.SA(p+8,8))}if(t)return a.length&&(sVersion=sVersion.appendS("malformed"+a,"/")),X.isVerbose()&&(sOption(addEllipsis(r.join(","))),sOption(outSz(p),"sz:")),bDetected=1,result()}meta("format","RenderWare collision data (.COL)")

================================================
FILE: dbs_min/db/Binary/format_bin.GuitarPro.1.sg
================================================
function detect(){if(31<Binary.getSize())if(Binary.compare("'BCFZ'")||Binary.compare("'BCFS'"))sVersion="6.X",sName+=" Tablature",bDetected=1
else if(Binary.compare("'GPAR'"))sVersion="6.X",sName+=" Soundbank",bDetected=1
else if((X.c("18")||X.c("19"))&&X.c("'FICHIER GUITAR PRO'20",1)&&(sV=/v(\d*)\.(\d*)/.exec(X.SA(X.U8(0)-4,6)))[0]){sName+=" Tablature",bDetected=1,sVersion=sV[0],nV=Number(sV[1]+sV[2]),enc="CP1251",tempo="",p=31,title=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),subtitle=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),artist=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),album=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),words=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),500<=nV?(music=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p)):music=words,cr=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),tab=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p),instructions=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p)
var e="",n=X.U32(p)
for(p+=4,i=0;i<n&&p<X.Sz();i++)0<i&&(e+="\r\n"),e+=X.SC(p+5,X.U8(p+4),enc),p+=4+X.U32(p)
if(nV<500&&p++,400<=nV)for(p+=4,i=0;i<5&&p<X.Sz();i++)p+=8+X.U32(p+4)
if(510<=nV&&(p+=19),500<=nV){for(p+=30,i=0;i<10&&p<X.Sz();i++)p+=4+X.U32(p)
tempo=X.SC(p+5,X.U8(p+4),enc).trim(),p+=4+X.U32(p)}for((t=X.U32(p))&&(tempo=tempo.appendS(t+"bpm",":")),p+=4,510<=nV&&p++,p+=4,400<=nV&&p++,p+=768,500<=nV&&(p+=42),bars=X.U32(p),trk=X.U32(p+4),p+=8,i=0;i<bars&&p<X.Sz();i++)1&(s=X.U8(p++))&&p++,2&s&&p++,8&s&&p++,16&s&&nV<500&&p++,32&s&&(p+=8+X.U32(p)),64&s&&(p+=2),500<=nV&&(p+=3,3&s)&&(p+=4)
for(i=0,trks=[];i<trk&&p<X.Sz();i++){var s=X.U8(p++)
""!=(t=X.SC(p+1,X.U8(p),enc).trim())&&trks.push(t),p+=41,X.U32(p),p+=32,X.U32(p+12),X.U32(p+16)
p+=24,500<=nV&&(p+=45),510<=nV&&(p=(p+=8+X.U32(p))+(4+X.U32(p)))}X.isVerbose()&&(sOptionT(title,' title:"','"'),sOptionT(subtitle,"～","～"),sOptionT(artist,'artist:"','"'),sOptionT(album,'album:"','"'),sOptionT(cr,"©"),sOptionT(tab,"tab:"),sOptionT(instructions,"instructions:"),sOptionT(e,"notice:"),sOption(tempo,"tempo:"),sOption(trk,"tracks:"),sOption(bars,"bars:"))}return result()}meta("format","Arobas Music Guitar Pro")

================================================
FILE: dbs_min/db/Binary/format_bin.Hermes.1.sg
================================================
function detect(){return 12<=Binary.getSize()&&Binary.compare("C61FBC03C103191F",Binary.read_uint64(0,_BE))&&(sVersion=Binary.read_uint32(8),bDetected=1),sLang="JavaScript",result()}meta("format","Hermes JavaScript bytecode")

================================================
FILE: dbs_min/db/Binary/format_bin.JMDL.1.sg
================================================
function detect(){if(8<=Binary.getSize()&&Binary.compare("CAFEBEEF")){var e=X.U16(6,_BE)
if(e){switch(sVersion="JDK ",e){case 45:sVersion+="1.1"
break
case 46:sVersion+="1.2"
break
case 47:sVersion+="1.3"
break
case 48:sVersion+="1.4"}bDetected=45<=e&&e<=66}}return sLang="Java",result()}meta("format","Microstation Java (JMDL) Compiled Class")

================================================
FILE: dbs_min/db/Binary/format_bin.JSC.1.sg
================================================
meta("format","JavaScript Compiled/Bytenode (.JSC)")
var VersionHash=[["11.8.172.17","4aaade2a","6e55fcb4"],["11.3.244.8","88b331c0","bc2e4000"],["10.8.168.25","22162e5c","866ceba8"],["10.2.154.26","353c3291","82a06935"],["9.6.180.15","96a2e9d1","77a0eea2"],["9.6.180.14","efecf234","15e726e8"],["9.5.172.25","87f3c490","7845cebc"],["9.5.172.21","22b0877a","d54c6bc9"],["9.4.146.26","4f3466a4","ee64ddac"],["9.4.146.24","34bdcb66","251899cd"],["9.4.146.19","1c8f8b6a","15375929"],["8.6.395.17","4e4909d8","a8d671f0"],["8.6.395.16","2e933797","42ff7bd2"],["8.4.371.23","422a9510","305d5cb4"],["8.4.371.19","9ee57fe0","8b279ced"],["8.3.110.9","98545131","878c72a5"],["8.1.307.31","2cb9ba58","8912ed09"],["8.1.307.30","22d2f67c","f8e02587"],["7.9.317.25","e46e0ba2","affe52ff"],["7.9.317.23","327e22f1","a5ef90cb"],["7.8.279.23","f4ca7648","2453843a"],["7.8.279.17","533dd511","2e4f9afd"],["7.7.299.13","7ee98716","8f1d647f"],["7.7.299.11","f4bd9236","defcacc7"],["7.6.303.29","62a5311c","905e664f"],["7.4.288.27","8d2f9651","84fec91f"],["7.5.288.22","8176065f","8b9ea960"],["7.4.288.21","4e79ebb1","27f6dd21"],["7.0.276.38","5aa2a8c8","261396d3"],["7.0.276.32","302bcaf2","1c3c201f"],["6.8.275.32","4914c00b","8af4d4f4"],["6.8.275.30","34fd59c5","91d1cc59"],["6.8.275.24","70ff0c52","74a2eeac"],["6.7.288.49","f5e4a619","aa47d109"],["6.7.288.46","555f09bb","6070752b"],["6.7.288.45","3f06ef23","ca0b678f"],["6.7.288.43","bc67142f","884dad18"],["6.6.346.32","9ac1441d","600024b1"],["6.6.346.27","741c5f3b","91b8852b"],["6.6.346.24","cbb74c67","3e6b9b38"],["6.2.414.78","4d9d4c8d","c2f91993"],["6.2.414.77","2e12ba35","818125c8"],["6.2.414.72","90a269a0","96890b15"],["6.2.414.66","a8f60b85","36eba645"],["6.2.414.54","6ed53280","82f11b7d"],["6.2.414.50","ae6544a8","bd692ce0"],["6.2.414.46","4e617339","81adf054"],["6.2.414.44","c60a7c87","7e207921"],["6.2.414.32","42110b24","84d039aa"],["6.1.534.50","a0f6f0f4","9e10b69f"],["6.1.534.48","f14f22a0","82467775"],["6.1.534.47","79276eb0","221a8fc5"],["6.1.534.46","babe69a4","64318412"],["6.1.534.42","166f25d9","9892d1c2"],["6.0.287.53","a1bc32d4","6fcdcd18"],["6.0.286.52","2cf4293d","a030b731"],["5.5.372.43","b96063d0","c10a0c40"],["5.1.281.111","bb23baab","78f44bee"],["4.6.85.32","35a37732","ca4b83fd"],["4.5.103.53","15953e0e","b217e70b"],["3.28.71.20","26145e77","fec9a40d"]]
function detect(){if(32<=Binary.getSize()&&Binary.compare("DEC0",2))for(bDetected=1,i=0;i<VersionHash.length;i++)Binary.compare(VersionHash[i][1],4)?sVersion="v"+VersionHash[i][0]+" x86":Binary.compare(VersionHash[i][2],4)&&(sVersion="v"+VersionHash[i][0]+" x64")
return sLang="JavaScript",result()}

================================================
FILE: dbs_min/db/Binary/format_bin.Java.1.sg
================================================
function detect(){if(8<=Binary.getSize()&&Binary.compare("CAFEBABE")){bDetected=1
var a=Binary.read_uint16(4,_BE)
switch(Binary.read_uint16(6,_BE)){case 45:sVersion="JDK 1.1"
break
case 46:sVersion="JDK 1.2"
break
case 47:sVersion="JDK 1.3"
break
case 48:sVersion="JDK 1.4"
break
case 49:sVersion="Java SE 5.0"
break
case 50:sVersion="Java SE 6"
break
case 51:sVersion="Java SE 7"
break
case 52:sVersion="Java SE 8"
break
case 53:sVersion="Java SE 9"
break
case 54:sVersion="Java SE 10"
break
case 55:sVersion="Java SE 11"
break
case 56:sVersion="Java SE 12"
break
case 57:sVersion="Java SE 13"
break
case 58:sVersion="Java SE 14"
break
case 59:sVersion="Java SE 15"
break
case 60:sVersion="Java SE 16"
break
case 61:sVersion="Java SE 17"
break
case 62:sVersion="Java SE 18"
break
case 63:sVersion="Java SE 19"
break
case 64:sVersion="Java SE 20"
break
case 65:sVersion="Java SE 21"
break
case 66:sVersion="Java SE 22"
break
case 67:sVersion="Java SE 23"
break
case 68:sVersion="Java SE 24"
break
case 69:sVersion="Java SE 25"}if(sVersion&&a&&(sVersion+="."+a),bDetected&&Binary.isVerbose()){var e=8,s=Binary.read_uint16(e,_BE)
for(e+=2,pool=1;pool<s;pool++)switch(Binary.read_uint8(e)){case 1:e+=3+Binary.read_uint16(e+1,_BE)
break
case 3:case 4:e+=5
break
case 5:case 6:e+=9
break
case 7:case 8:case 16:e+=3
break
case 9:case 10:case 11:case 12:case 18:e+=5
break
case 15:e+=4
break
default:sOption("err unk tag:"+e)}a=Binary.read_uint16(e,_BE)
1&a&&sOption("ACC_PUBLIC"),2&a&&sOption("ACC_PRIVATE"),4&a&&sOption("ACC_PROTECTED"),8&a&&sOption("ACC_STATIC"),16&a&&sOption("ACC_FINAL"),32&a&&sOption("ACC_SUPER"),64&a&&sOption("ACC_VOLATILE"),128&a&&sOption("ACC_TRANSIENT"),256&a&&sOption("ACC_NATIVE"),512&a&&sOption("ACC_INTERFACE"),1024&a&&sOption("ACC_ABSTRACT"),2048&a&&sOption("ACC_STRICT")}}return sLang="Java",result()}meta("format","Java Class File (.CLASS)")

================================================
FILE: dbs_min/db/Binary/format_bin.KeePass.1.sg
================================================
function detect(){return Binary.compare("03 D9 A2 9A")&&(bDetected=1,Binary.compare("65 FB 4B B5",4)&&(sVersion="1.X",sOptions=".KBD",bDetected=1),Binary.compare("66 FB 4B B5",4)&&(sVersion="2.X, pre-release (alpha/beta)",sOptions=".KBDX",bDetected=1),Binary.compare("67 FB 4B B5",4))&&(sVersion="2.X",sOptions=".KBDX",bDetected=1),result()}meta("format","KeePass")

================================================
FILE: dbs_min/db/Binary/format_bin.LUA.1.sg
================================================
function detect(){if(8<=Binary.getSize()&&Binary.compare("1B'Lua'..00")){switch(bDetected=1,Binary.read_uint8(4)){case 80:sVersion="v5.0"
break
case 81:sVersion="v5.1"
break
case 82:sVersion="v5.2"
break
case 83:sVersion="v5.3"
break
case 84:sVersion="v5.4"
break
default:return}if(Binary.isVerbose())switch(Binary.read_uint8(6)){case 0:sOption("BigEndian")
break
case 1:sOption("LittleEndian")
break
default:return}}return sLang="Lua",result()}meta("format","Lua Bytecode (.LUAC)")

================================================
FILE: dbs_min/db/Binary/format_bin.NVA.1.sg
================================================
function detect(){return 8<=Binary.getSize()&&Binary.compare("'%NVA'")&&(sVersion=Binary.getString(5,3),bDetected=1),result()}meta("format","NVA")

================================================
FILE: dbs_min/db/Binary/format_bin.Nintendo-certified-file.1.sg
================================================
function detect(){if(X.c("'SCE'00")){var i,r
if(X.c("0000 0002",4))r=_BE
else{if(!X.c("0300 0000",4))return
r=_LE}var e=X.U16(8,r),i=X.U16(10,r),s=(X.U32(12,r),X.U64(16,r)),n=X.U64(24,r),t=(r==_BE||X.U64(32,r),r==_BE||X.U64(40,r),r==_BE?32:48)
switch(i){case 1:var d=X.U64(t,r)
if(!(r==_BE&&3==d||r==_LE&&4==d))return
var d=X.U64(8+t,r),c=X.U64(16+t,r),f=X.U64(24+t,r)
X.U64(32+t,r)
if(d+32!=c||c+64!=f)return
sName=X.c("7F 'ELF' .. .. 01",c)?"Nintendō signed ELF/PRX (.SELF,.SPRX)":"Nintendō signed ELF/PRX, headerless (.SELF,.SPRX)"
break
case 2:sName="Nintendō signed revoke list (.SRVK)"
break
case 3:sName="Nintendō signed package (.SPKG)"
break
case 4:sName="Nintendō signed security policy profile (.SSPP)"
break
case 5:sName="Nintendō signed diff (.SDIFF)"
break
case 6:sName="Nintendō signed param.sfo"
break
default:if(!X.isHeuristicScan())return
sType="~"+sType,sName+=" type "+Hex(i)}if(!isWithin(s,t,X.Sz())||n<s)return
bDetected=1,sVersion=r==_BE?"PS3":"PSVita",32768==e&&sOption("fSELF"),X.isVerbose()&&sOption(outSz(s+n),"sz:")}return result()}meta("format","Unknown Certified File")

================================================
FILE: dbs_min/db/Binary/format_bin.PEFF.1.sg
================================================
function detect(){return Binary.compare("'Joy!peff'00000001")?(sVersion="1.0",bDetected=1):Binary.compare("'Joy!peffpwpc'00000001")&&(sOptions="PowerPC",sVersion="1.0",bDetected=1),result()}meta("format","Preferred Executable Format")

================================================
FILE: dbs_min/db/Binary/format_bin.PalmFile.1.sg
================================================
function detect(){if(!(/S98[0-3]/.test(X.SA(0,4))&&X.U32(4)<=32&&!X.U32(12)&&(!X.U32(16)||isWithin(X.U32(16),32,8388608))&&X.U32(20)<131072&&(!X.U32(24)||isWithin(X.U32(24),X.U32(20),8388608))&&X.U32(28)<=64)){var e="",t=0,s=X.SA(0,32),n=charStat(s,!0)
if(!(n.indexOf("asc")<0)){X.U16(32,_BE),X.U16(34,_BE)
var n=X.U32(36,_BE),a=X.U32(40,_BE),r=X.U32(44,_BE),o=X.U32(48,_BE),f=X.U32(52,_BE),d=X.U32(56,_BE),S="PDB",l=X.SA(60,4),U=X.SA(64,4),p=X.U32(68,_BE),u=X.U16(72,_BE),c=X.U16(76,_BE),z=c?78:80
if(c||(t+=3),32767<c&&(t+=2),4095<o&&(t+=2),u&&(t++,e=e.addIfNone("!baddbdir")),16777215<p&&t++,/\w{3,}/.test(U)){switch(l){case"appl":S="PRC"
break
case"pqa ":if("clpr"!=U)return
S="PQA"
default:0<=charStat(X.readBytes(z,4),!0).indexOf("allasc")&&(S="PRC",e=e.addIfNone("!badtype"+X.SA(z,4)))}var E,u=A(a,"mod"),B=8,O=i=0,h="",_=[]
if(a&&""===u&&(t+=2,e=e.addIfNone("!nodate")),n&&""===A(n,"cre")&&t++,r&&""===A(r,"bak")&&t++,"PRC"===S)for(E=z+(B=10)*c;z<E;z+=B){if(z+10>X.Sz())return
var m=X.SA(z,4),b=(X.U16(z+4,_BE),X.U32(z+6,_BE))
if(!isWithin(b,z,X.Sz())||!/\w{3,}/.test(m)||0<=_.indexOf(b))return
_.push(b),O<b&&(O=b,h=m),"tver"===m&&(sVersion="v"+X.SA(O,256).trim())}else if("PDB"===S)for(E=z+(B=8)*c;z<E;z+=B){if(z+8>X.Sz())return
b=X.U32(z,_BE),X.U8(z+4),X.U24(z+5,_BE)
if(!isWithin(b,z,X.Sz())||0<=_.indexOf(b))return
_.push(b),O<b&&(O=b)}if(!(f&&!isWithin(f,78+B*c,X.Sz())||d&&!isWithin(d,76+B*c,X.Sz())||f&&d&&d<f||(sVersion=""!=sVersion?l.appendS(sVersion," "):l,f&&16<Math.abs(f-z))||3<t)){if("PRC"==S)if(0<=["taic","tAIN","tver","tSTR"].indexOf(h))sz=outSz(X.fSig(O,-1,"00")+1)
else if("tSTL"==h){var g,x=X.U8(O+2,_BE)
for(O+=4,i=0;i<x&&O<=X.Sz();i++){if((g=X.fSig(O,TOEOF,"00"))<0){e=e.addIfNone("!short")
break}O=g+1}sz=outSz(O)}else 0<=["pref"].indexOf(h)?sz=outSz(O+10):X.c("'RIFF'........'WAVE'",O)?sz=outSz(O+X.U32(O+4)+8):(sz=Hex(Math.max(O,z,f,d))+"+"+h,"code"!==h||X.c("4E75",X.Sz()-2)||(e=e.addIfNone("!noRTSatEoF")))
else sz=Math.max(O,z)+"+"+h
return sName="Palm OS file (."+S+")",bDetected=1,t&&(e+="!sus×"+t),""!=e&&(sVersion=sVersion.appendS("malformed"+e,"/")),X.isVerbose()&&(sOption(s),sOption(U,"by:"),sOption(u,"lastmod"+(1<o?" (×"+o+")":"")+":"),sOption(Hex(p),"idseed:"),f&&sOption("appinfo"),d&&sOption("sortinfo"),sOption(c,"res:"),sOption(sz,"sz:")),result()}}}}function A(e,i){"string"!=typeof i&&(i="")
var i=new Date(1904,0,1).getTime()+1e3*e,t=new Date(i)
return isWithin(t.getFullYear(),1996,2040)||1907==t.getFullYear()||(i=new Date(0).getTime()+1e3*e,t=new Date(i)),isWithin(t.getFullYear(),1996,2040)||1907==t.getFullYear()?"1907"==(i=t.toISOString().slice(0,19)).slice(0,4)?"2001"+i.slice(4,19):i:isWithin(e,1996,2040)?"y"+e:""}}meta("format","Palm OS file ")

================================================
FILE: dbs_min/db/Binary/format_bin.Python.1.sg
================================================
function detect(){if(64<=Binary.getSize())if(153==Binary.read_uint16(2))switch(bDetected=1,Binary.read_uint32(0)){case 10066178:sVersion="1.0"
break
case 10066179:sVersion="1.1-1.2"
break
default:return}else if(2573==Binary.read_uint16(2)&&Binary.isSignaturePresent(16,256,"00 00 00 00")){bDetected=1
var e=Binary.read_uint16(0)
switch(e){case 11913:sVersion="1.3"
break
case 5892:sVersion="1.4"
break
case 20121:sVersion="1.5-1.5.2"
break
case 50428:sVersion="1.6"
break
case 50823:sVersion="2.0-2.0.1"
break
case 60202:sVersion="2.1-2.1.2"
break
case 60717:sVersion="2.2"
break
case 62011:case 62021:sVersion="2.3a0"
break
case 62041:sVersion="2.4a0"
break
case 62051:sVersion="2.4a3"
break
case 62061:sVersion="2.4b1"
break
case 62071:case 62081:case 62091:case 62092:sVersion="2.5a0"
break
case 62101:case 62111:sVersion="2.5b3"
break
case 62121:sVersion="2.5c1"
break
case 62131:sVersion="2.5c2"
break
case 62135:sVersion="2.5 (Dropbox)"
break
case 62151:sVersion="2.6a0"
break
case 62161:sVersion="2.6a1"
break
case 62171:case 62181:case 62191:case 62201:case 62211:sVersion="2.7a0"
break
case 62218:sVersion="2.7 (PyPy)"
break
case 22138:sVersion="2.7 (Pyston)"
break
case 2657:sVersion="2.7 (Pyston-0.6.1)"
break
case 3e3:case 3010:case 3020:case 3030:case 3040:case 3050:case 3060:case 3061:case 3071:case 3081:case 3091:case 3101:case 3103:sVersion="3.0"
break
case 3111:sVersion="3.0a4"
break
case 3131:sVersion="3.0b1"
break
case 3141:case 3151:sVersion="3.1a1"
break
case 3160:sVersion="3.2a1"
break
case 3170:sVersion="3.2a2"
break
case 3180:sVersion="3.2a3"
break
case 48:sVersion="3.2 or 3.2 (PyPy)"
break
case 3187:sVersion="3.2 (PyPy)"
break
case 3190:case 3200:case 3210:sVersion="3.3a1"
break
case 3220:sVersion="3.3a2"
break
case 3230:sVersion="3.3a4"
break
case 64:sVersion="3.3 (PyPy)"
break
case 3250:case 3260:case 3270:case 3280:sVersion="3.4a1"
break
case 3290:case 3300:sVersion="3.4a4"
break
case 3310:sVersion="3.4rc2"
break
case 3320:sVersion="3.5a1"
break
case 3330:sVersion="3.5b1"
break
case 3340:sVersion="3.5b2"
break
case 3350:sVersion="3.5b3"
break
case 3351:sVersion="3.5.2"
break
case 112:sVersion="3.5 (PyPy)"
break
case 3360:sVersion="3.6a0"
break
case 3361:sVersion="3.6a1"
break
case 3370:case 3371:case 3372:sVersion="3.6a2"
break
case 3373:case 3375:case 3376:case 3377:sVersion="3.6b1"
break
case 3378:sVersion="3.6b2"
break
case 3379:sVersion="3.6rc1"
break
case 192:sVersion="3.6 (PyPy)"
break
case 160:sVersion="3.6.1 (PyPy)"
break
case 3390:sVersion="3.7a1"
break
case 3391:sVersion="3.7a2"
break
case 3392:sVersion="3.7a4"
break
case 3393:sVersion="3.7b1"
break
case 3394:sVersion="3.7b5"
break
case 240:sVersion="3.7 (PyPy)"
break
case 3400:case 3401:case 3410:sVersion="3.8a1"
break
case 3411:case 3412:sVersion="3.8b2"
break
case 3413:sVersion="3.8b4 or 3.8.10 (Graal) or 3.8.12-3.8.16 (PyPy)"
break
case 256:sVersion="3.8 (PyPy)"
break
case 21150:sVersion="3.8.5 (Graal)"
break
case 3420:case 3421:case 3422:sVersion="3.9a0"
break
case 3423:case 3424:sVersion="3.9a2"
break
case 3425:sVersion="3.9a2 or 3.9.10-3.9.16 (PyPy)"
break
case 336:sVersion="3.9 (PyPy)"
break
case 3430:case 3431:sVersion="3.10a1"
break
case 3432:case 3433:sVersion="3.10a2"
break
case 3434:sVersion="3.10a6"
break
case 3435:sVersion="3.10a7"
break
case 3436:case 3437:case 3438:case 3439:sVersion="3.10b1"
break
case 384:sVersion="3.10 (PyPy)"
break
case 21280:sVersion="3.10 (Graal)"
break
case 3450:case 3451:case 3452:case 3453:case 3454:case 3455:case 3456:case 3457:case 3458:case 3459:case 3460:case 3461:sVersion="3.11a1"
break
case 3462:sVersion="3.11a2"
break
case 3463:case 3464:case 3465:sVersion="3.11a3"
break
case 3466:case 3467:case 3468:case 3469:case 3470:case 3471:case 3472:case 3473:case 3474:sVersion="3.11a4"
break
case 3475:case 3476:case 3477:case 3478:case 3479:case 3480:case 3481:case 3482:case 3483:case 3484:case 3485:sVersion="3.11a5"
break
case 3486:case 3487:case 3488:case 3489:case 3490:case 3491:sVersion="3.11a6"
break
case 3492:case 3493:case 3494:case 3495:sVersion="3.11a7"
break
case 416:sVersion="3.11 (PyPy)"
break
case 21290:sVersion="3.11 (Graal)"
break
case 3500:case 3501:case 3502:case 3503:case 3504:case 3505:case 3506:case 3507:case 3508:case 3509:sVersion="3.12a1"
break
case 3510:case 3511:case 3512:sVersion="3.12a2"
break
case 3513:case 3514:sVersion="3.12a4"
break
case 3515:case 3516:case 3517:sVersion="3.12a5"
break
case 3518:case 3519:case 3520:sVersion="3.12a6"
break
case 3521:case 3522:case 3523:case 3524:sVersion="3.12a7"
break
case 3525:case 3526:case 3527:case 3528:case 3529:case 3530:case 3531:sVersion="3.12b1"
break
case 12897:sVersion="3.12 (Rust)"
break
case 3550:case 3551:case 3552:case 3553:case 3554:case 3555:case 3556:case 3557:case 3558:case 3559:case 3560:case 3561:case 3562:case 3563:case 3564:case 3565:sVersion="3.13a1"
break
case 3571:sVersion="3.13"
break
case 12641:sVersion="3.13.0 (Rust)"
break
case 3600:sVersion="3.14"
break
case 3627:sVersion="3.14rc3"
break
default:sVersion="Unknown"}X.isVerbose()&&(sVersion=sVersion.append("magic: "+e))}return sLang="Python",result()}meta("format","Python Compiled Module")

================================================
FILE: dbs_min/db/Binary/format_bin.SWF.1.sg
================================================
function detect(){if(32<=Binary.getSize()&&Binary.compare("%% %% %% ?? ?? ?? ?? 00")){switch(Binary.getString(0,3)){case"FWS":sOptions="uncompressed",bDetected=1
break
case"CWS":detect_zlib(Binary,8)&&(bDetected=1)
break
case"ZWS":sOptions="LZMA",bDetected=1}bDetected&&(sVersion=Binary.read_uint8(3))}return result()}meta("format","Small Web Format (.SWF)"),includeScript("zlib")

================================================
FILE: dbs_min/db/Binary/format_bin.VCF.1.sg
================================================
function detect(){var i,S,a,d,f
if(!(!X.c("'BEGIN:VCARD'0d0a")||(i=X.fSig(20,8192,"0d0a'END:VCARD'"))<20||(S=X.fSig(10,i,"0d0a'VERSION:'"))<10)&&/\d(\.\d)?/.test(S=X.SA(S+10,3).trim()))return bDetected=1,a=2.1,d=i+13,f=11,sVersion="v"+S,X.isVerbose()&&((X.fSig(f,i,"0d0a'GEO:geo:'")>f||X.fSig(f,i,"0d0a'ANNIVERSARY'")>f||X.fSig(f,i,"0d0a'CALADRURI'")>f||X.fSig(f,i,"0d0a'CALURI'")>f||X.fSig(f,i,"0d0a'CLIENTPIDMAP'")>f||X.fSig(f,i,"0d0a'FBURL'")>f||X.fSig(f,i,"0d0a'GENDER'")>f||X.fSig(f,i,"0d0a'PRONOUNS'")>f||X.fSig(f,i,"0d0a'KIND'")>f||X.fSig(f,i,"0d0a'MEMBER'")>f||X.fSig(f,i,"0d0a'RELATED'")>f||X.fSig(f,i,"0d0a'XML'")>f)&&(a=4),(+S<(a=X.fSig(f,i,"0d0a'CATEGORIES:'")>f||X.fSig(f,i,"0d0a'CLASS:'")>f||X.fSig(f,i,"0d0a'IMPP'")>f||X.fSig(f,i,"0d0a'NAME'")>f||X.fSig(f,i,"0d0a'NICKNAME'")>f||X.fSig(f,i,"0d0a'PRODID'")>f||X.fSig(f,i,"0d0a'PROFILE'")>f||X.fSig(f,i,"0d0a'SORT-STRING'")>f?Math.max(a,3):a)||4==a&&"4.0"==S&&(X.fSig(f,i,"0d0a'LABEL'")>f||X.fSig(f,i,"0d0a'SORT-STRING'")>f))&&sOption("version-incompatible fields"),sOption(outSz(d),"sz:")),result()}meta("format","vCard/Virtual Contact File (.VCF,.vcard)")

================================================
FILE: dbs_min/db/Binary/format_bin.WindowsIconCacheDB.1.sg
================================================
function detect(){if(20<=Binary.getSize()&&Binary.compare("..000000'Win4'"))switch(bDetected=1,Binary.read_uint16(12)){case 6e3:sOption("Vista (Build 6000)")
break
case 6001:sOption("Vista (Build 6001)")
break
case 7600:sOption("Windows 7 (Build 7600)")
break
case 7601:sOption("Windows 7 (Build 6701)")
break
case 10586:sOption("Windows 10 (Build 10586)")
break
default:sOption("Unknown version")}return result()}meta("format","Windows IconCacheDB")

================================================
FILE: dbs_min/db/Binary/format_database.SQLite.1.sg
================================================
function detect(){if(Binary.compare("'SQLite format 3'00")){bDetected=1
var e=Binary.read_uint32(68,_BE),a=Binary.read_uint32(96,_BE),r=Binary.read_uint32(24,_BE),t=a/1e6>>0,i=(a-1e6*t)/1e3>>0
switch(sVersion=t+"."+i+"."+(a-1e6*t-1e3*i>>0),Binary.read_uint32(56,_BE)){case 1:sOption("UTF-8")
break
case 2:sOption("UTF-16LE")
break
case 3:sOption("UTF-16BE")
break
default:return}e&&Binary.isVerbose()&&sOption("AppID: "+e),r&&Binary.isVerbose()&&sOption("Changes: "+r)}return result()}meta("format","SQLite 3 database (.SQLITE)")

================================================
FILE: dbs_min/db/Binary/format_databases.1.sg
================================================
function detect(){return Binary.compare("00010000'Standard Jet DB'00")&&(sName="Microsoft Access database (.MDB)",bDetected=1),!bDetected&&(function(){switch(nv=X.U8(0),v5=!1,nv){case 2:sv="FoxBase 1.0"
break
case 3:sv="FoxBase 2.x / dBASE III, no memo file"
break
case 4:sv="dBASE IV, no memo file"
break
case 5:sv="dBASE V, no memo file"
break
case 7:sv="VISUAL OBJECTS v1.x for dBase III, no memo file"
break
case 48:sv="Visual FoxPro (possibly with DBC)"
break
case 49:sv="Visual FoxPro with auto increment"
break
case 50:sv="Visual FoxPro with varchar/varbinary"
break
case 67:sv="dBASE IV SQL Table, no memo file / Flagship .dbv memo var size"
break
case 100:sv="dBASE IV SQL System, no memo file"
break
case 131:sv="FoxBase 2.x / dBASE III+ with memo file"
break
case 135:sv="VisualObjects 1.x with memo file"
break
case 139:sv="dBASE IV with memo file"
break
case 140:sv="dBASE V with memo file"
break
case 142:sv="dBASE IV with SQL table"
break
case 179:sv=".dbv with memo table"
break
case 203:sv="dBASE IV SQL Table with memo file"
break
case 229:sv="Clipper SIX with memo file"
break
case 245:sv="FoxPro 2 with memo file"
break
case 251:sv="FoxPro 2, no memo file"
break
default:return}if(2==nv){if(!(recc=X.U16(1)))return
if(!(recsz=X.U16(6)))return
hdrsz=521,rectp=8,enc="IBM437"}else{if((y=X.U8(1))<80?y+=2e3:y+=1900,m=X.U8(2),d=X.U8(3),X.c("000000",1))upd="never"
else{if(!isWithin(y,1970,2100)||!isWithin(m,1,12)||!isWithin(d,1,31))return
upd=y+"-"+m.padStart(2,"0")+d.padStart(2,"0")}if(!(recc=X.U32(4)))return
if(hdrsz=X.U16(8),recsz=X.U16(10),hdrsz<32||!recsz)return
if(res0=X.U24(12),res1=X.readBytes(15,13),res2=X.U32(28),0<=[4,140].indexOf(nv))rectp=68,enc="CP"+X.SA(34,3),isWithin(t=X.SA(37,1),"0","9")&&(enc+=t),"CPKOI8"==enc&&(enc+=X.SA(38,1)),v5=!0
else switch(rectp=32,X.U8(29)){case 2:enc="CP850"
break
case 3:enc="CP1252"
break
case 4:enc="CP10000"
break
case 100:enc="CP852"
break
case 101:enc="CP865"
break
case 102:enc="CP866"
break
case 103:enc="IBM861"
break
case 106:enc="IBM737"
break
case 107:enc="IBM857"
break
case 150:enc="CP10007"
break
case 151:enc="CP10029"
break
case 152:enc="CP10006"
break
case 200:enc="CP1250"
break
case 201:enc="CP1251"
break
case 202:enc="CP1254"
break
case 203:enc="CP1253"
break
default:enc="IBM437"}}for(validC=["C","N","L","D","M","F","B","G","P","Y","T","I","V","X","@","O","+","0"],fldc=0,totalfldsz=1,p=rectp,old=[0,1];13!=X.U8(p)&&p<hdrsz;){var e=X.readBytes(p,v5?31:11)
if(ns=charStat(e,1),!e[0]||ns.indexOf("allxsc")<0&&ns.indexOf("allforeign")<0)return
if(tp=X.SA(v5?p+32:p+11,1),validC.indexOf(tp)<0)return
if(fldst=2==nv?X.U16(p+13):v5?0:X.U32(p+12),!(fldsz=X.U8(2==nv?p+12:v5?p+33:p+16)))return
if(old[0]&&fldst&&old[0]+old[1]!=fldst)return
if(old=[fldsz,fldst],totalfldsz+=fldsz,decn=X.U8(2==nv?p+15:p+17),"N"===tp&&decn>fldsz)return
fldc++,p+=2==nv?16:v5?48:32,0<=charStat(e.slice(0,e.indexOf(0)),1).indexOf("foreign")&&"IBM437"==enc&&(enc="CP1251")}if(totalfldsz-recsz==0){if(del=0,X.isDeepScan())for(p=hdrsz,i=0;i<recc;i++,p+=recc)42==X.U8(p)&&del++
return sz=hdrsz+recc*recsz,26==X.U8(sz)&&sz++,sz<=X.Sz()||X.isHeuristicScan()}})()&&(sName="dBase Database (.DBF)",sVersion=sv,bDetected=1,X.isVerbose())&&sOption("fld:"+fldc+" rec: "+recc+(del?"(* "+del+")":"")+" enc: "+enc+" sz: "+outSz(sz)),result()}meta("format","")

================================================
FILE: dbs_min/db/Binary/format_doc.CHM.1.sg
================================================
function detect(){return Binary.compare("'ITSF'..000000")&&(bDetected=1,sVersion=Binary.read_int32(4,_LE),sOption(Binary.read_uint32(20,_LE),"LangID: ")),result()}meta("format","Microsoft Compiled HTML Help")

================================================
FILE: dbs_min/db/Binary/format_doc.DJVU.1.sg
================================================
function detect(){var s=!1
if(X.c("'AT&TFORM'"))if(X.c("'DJVM'........00",12))sVersion="multi-page"
else if(X.c("'DJVU'........00",12))sVersion="single-page"
else if(X.c("'DJVI'........00",12))sVersion="multi-file"
else{if(!X.c("'THUMTH44'",12))return!1
sVersion="thumbnails"}else{if(!X.c("'SDJVFORM'"))return!1
sName="Secure "+sName,s=!0}if(bad="",sz=X.U32(8,_BE)+12,X.Sz()<sz&&(bad=bad.addIfNone("!short")),X.isDeepScan()&&!s){minw=minh=mindpi=mingm=4294967295
var i=maxh=maxdpi=maxgm=0
for(p=16;p<sz;){switch(hkhd=X.SA(p,4),hksz=X.U32(p+4,_BE),p+=8,hkhd){case"INFO":sVersion=sVersion.appendS("image","/")
break
case"NAVM":X.isVerbose()&&(sOptions=sOptions.addIfNone(" bookmarks,"))
break
case"ANTa":case"ANTz":X.isVerbose()&&(sOptions=sOptions.addIfNone("annotated,"))
break
case"DIRM":X.U16(p+1)
break
case"FORM":if(!X.c("'DJV'",p)&&!X.c("'THUM'",p))return _log("bad subchunk "+X.SA(p,8)),!1
for(q=p+4;q<p+hksz;){if(shd=X.SA(q,4),ssz=X.U32(q+4,_BE),(q+=8)+ssz>p+hksz){bad=bad.addIfNone("!short")
break}switch(shd){case"INFO":var e=X.U16(q,_BE),a=X.U16(q+2,_BE),n=X.U16(q+6,_LE),m=X.U8(q+8)
e<minw&&(minw=e),i<e&&(i=e),a<minh&&(minh=a),a>maxh&&(maxh=a),n<mindpi&&(mindpi=n),n>maxdpi&&(maxdpi=n),m<mingm&&(mingm=m),m>maxgm&&(maxgm=m)
break
case"INCL":break
case"TXTa":case"TXTz":X.isVerbose()&&(sOptions=sOptions.addIfNone("text&layoutinfo,"))}(q+=ssz)%2&&q++}break
default:bad=bad.addIfNone("!badchunk<"+hkhd+">@"+Hex(p-8))}(p+=hksz)%2&&p++}}return sOptions.length&&","==sOptions[sOptions.length-1]&&(sOptions=sOptions.slice(0,sOptions.length-1)),bDetected=1,""!=bad&&(sVersion=sVersion.appendS("malformed"+addEllipsis(bad,128,64),"/")),X.isVerbose()&&(X.isDeepScan()&&(sOption((minw!=i?"["+minw+"～"+i+"]":minw)+"×"+(minh!=maxh?"["+minh+"～"+maxh+"]":minh)),sOption(mindpi!=maxdpi?"["+mindpi+"～"+maxdpi:mindpi,"","dpi"),sOption("gamma "+(mingm!=maxgm?"["+(mingm/10).toFixed(1)+"～"+(maxgm/10).toFixed(1)+"]":(mingm/10).toFixed(1)))),sOption(outSz(sz),"sz:")),result()}meta("format","DjVu document (.DJVU)")

================================================
FILE: dbs_min/db/Binary/format_doc.HLP.1.sg
================================================
function detect(){return Binary.compare("3f5f0300")&&(bDetected=1),result()}meta("format","MS Help")

================================================
FILE: dbs_min/db/Binary/format_doc.PDF.1.sg
================================================
function detect(){if(/^\%PDF-\d+\.\d+/.test(File.read_ansiString(0,10))){sVersion=File.getString(5,3),bDetected=1
var t=0
for(i=8;i<15;i++)128&File.read_uint8(i)&&t++
t&&(sOptions="binary data")}return result()}meta("format","PDF")

================================================
FILE: dbs_min/db/Binary/format_doc.RTF.1.sg
================================================
function detect(){if(/^{\\rtf1?/.test(File.read_ansiString(0,6))){bDetected=1
for(var e=4;e<Math.min(File.getSize(),256);e++)if(128&File.read_uint8(e))return}return result()}meta("format","RTF")

================================================
FILE: dbs_min/db/Binary/format_iCalender.1.sg
================================================
function detect(){var t
return Binary.compare("42 45 47 49 4E 3A 56 43 41 4C 45 4E 44 41 52")&&(t=Binary.getString(33,5).trim(),/^[A-Z0-9/-]{5}$/.test(t))&&(X.isVerbose()&&(sOptions=t),bDetected=1),result()}meta("format","iCalendar (.ICS)")

================================================
FILE: dbs_min/db/Binary/format_img.VM.1.sg
================================================
function detect(){return(Binary.compare("'KDMV'01")||Binary.compare("'KDMV'02")||Binary.compare("'KDMV'03"))&&(sVersion=File.read_uint8(4),bDetected=1),result()}meta("format","VMWare Virtual Disk (VMDK)")

================================================
FILE: dbs_min/db/Binary/format_text.RegistryFile.sg
================================================
function detect(){return Binary.compare("'REGEDIT4'0D 0A 0D 0A")?(bDetected=1,sVersion="4.0"):Binary.compare("'Windows Registry Editor Version 5.00'0D 0A 0D 0A")?(bDetected=1,sVersion="5.0"):Binary.compare("FF FE 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6F 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 20 00 35 00 2E 00 30 00 30 00 0D 00 0A 00 0D 00 0A 00")&&(bDetected=1,sVersion="5.0",sOption("UTF-16LE")),result()}meta("format","Registry file")

================================================
FILE: dbs_min/db/Binary/format_text.pdb.1.sg
================================================
function detect(){if(Binary.compare("'HEADER'")&&(Binary.isHeuristicScan()||extIs("pdb"))&&(L=["","","","",""],ttl="",L[0]=Binary.read_ansiString(0,Binary.findSignature(0,81,"0A")),/[\x20-\x7F]{65,}/.test(L[0]))&&(bDetected=1,Binary.isVerbose())){for(p=L[0].length+1,i=1;i<L.length;i++)L[i]=Binary.read_ansiString(p,Binary.findSignature(p,81,"0A")-p),p+=L[i].length+1
for(i=0;i<L.length;i++)switch(L[i].substr(0,6)){case"HEADER":sOptionT(L[i].substr(10,40),"Classification: "),sOptionT(L[i].substr(62,10),"ID: "),sOptionT(L[i].substr(50,9),"dep. ")
break
case"TITLE ":ttl+=" "+L[i].substr(10,70).trim()}sOptionT(ttl,"Title: ")}return result()}meta("format","Protein Data Bank file")

================================================
FILE: dbs_min/db/Binary/format_text.plaintext.3.sg
================================================
function detect(){var e,t
return Binary.isPlainText()&&(e=Binary.getString(0,Math.min(Binary.getSize(),3)),/^\xef\xbb\xbf/.test(e)&&(sName="UTF-8 text"),e=Binary.getSize()<4096?Binary.getSize():4096,-1!==(t=Binary.findByte(0,e,10))?sOptions=0!=t&&13==Binary.readByte(t-1)||t+1<Binary.getSize()&&13==Binary.readByte(t+1)?"CRLF":"LF":-1!=Binary.findByte(0,e,13)&&(sOptions="CR"),bDetected=1),result()}meta("format","Plain text")

================================================
FILE: dbs_min/db/Binary/format_video.BIK.1.sg
================================================
function detect(){return Binary.compare("'BIK'........00....0000....0000")&&(bDetected=1),result()}meta("format","Bink Video")

================================================
FILE: dbs_min/db/Binary/format_video.BK2.1.sg
================================================
function detect(){return Binary.compare("'KB2'00")&&(sVersion="2.0",bDetected=1),result()}meta("format","BinkMovie")

================================================
FILE: dbs_min/db/Binary/format_video.FLV.1.sg
================================================
function detect(){return 37<Binary.getSize()&&Binary.compare("'FLV'")&&Binary.compare("'onMetaData'",27)&&(bDetected=1),result()}meta("format","Flash Video")

================================================
FILE: dbs_min/db/Binary/format_video.MOV.1.sg
================================================
function detect(){var t
return Binary.compare("........'moov'")?(t=Binary.getString(11,5).trim(),/^[a-z]{5}$/.test(t)&&(sOptions=t,bDetected=1)):Binary.compare("........6d646174")&&(sOptions="Movie data atom",bDetected=1),result()}meta("format","QuickTime Movie")

================================================
FILE: dbs_min/db/Binary/format_video.MP4.1.sg
================================================
function detect(){return 100<Binary.getSize()&&Binary.compare("000000..'ftyp'")&&(sOptions=Binary.getString(16),bDetected=1),result()}meta("format","MP4 Video")

================================================
FILE: dbs_min/db/Binary/format_video.Matroska.1.sg
================================================
function detect(){return Binary.compare("1a45dfa3a34286810142f7810142f2810442f38108428288'matroska'")&&(bDetected=1),result()}meta("format","Matroska Video (.MKV)")

================================================
FILE: dbs_min/db/Binary/format_video.RobotAnimation.1.sg
================================================
function detect(){return Binary.compare("1600534f4c00")&&(bDetected=1),result()}meta("format","Robot Animation")

================================================
FILE: dbs_min/db/Binary/format_video.Smacker.1.sg
================================================
function detect(){return Binary.compare("'SMK2'....0000")&&(bDetected=1),result()}meta("format","Smacker Video")

================================================
FILE: dbs_min/db/Binary/format_video.VMD.1.sg
================================================
function detect(){return Binary.compare("2e03000001")?(sVersion="Adi2/Adibou1/Playtoons/Woodruff",sOptions="Video+Sound",bDetected=1):Binary.compare("2e0300000700a4030000000040018800011002003003000069763332")?(sOptions="Indeo 3 (compressed)",sVersion="3.24.01.01",bDetected=1):Binary.compare("2e0302000700........00004001f000000001003003000049563332")?(sOptions="Indeo 3 (compressed)",sVersion="3.24.15.03",bDetected=1):Binary.compare("2e030105000200000000008007e001")?bDetected=1:Binary.compare("2e03..000100....000000008002")?(sOptions="Video+Sound",sVersion="Adi4/Adibou2",bDetected=1):Binary.compare("2e030200000015")?(sOptions="Adibou2 (Sciences)",bDetected=1):Binary.compare("2e0302000000..000000000000000000001101004403")?(sOptions="Sound only",sVersion="Adiboud'chou",bDetected=1):Binary.compare("2e0302000d00")?(sOptions="Video+Sound",sVersion="Adibou2 (Sciences)/Adi4",bDetected=1):Binary.compare("3200..000000")?(sOptions="Sound only",sVersion="Adi5/Adibou3",bDetected=1):Binary.compare("2e0302001d00..00..00..00")?(sOptions="Video+Sound",bDetected=1):Binary.compare("2e0302..........00000000000000000010..003003")?(sOptions="Sound only",bDetected=1):Binary.compare("32000200..00..0000000000..00..00......0034")?(sOptions="Animation only",sVersion="Adibou3",bDetected=1):Binary.compare("2e0301000100........................02003003")?(sOptions="Animation+Sound",sVersion="Adibou2",bDetected=1):Binary.compare("2e0301000100......................1001003003")&&(sOptions="Sound only",sVersion="Adibou2",bDetected=1),result()}meta("format","Video and Media Data (.VMD)")

================================================
FILE: dbs_min/db/Binary/formats.1.sg
================================================
function detect(){var a=[]
return a.BASE=a.cmap=a.DSIG=a.EBDT=a.Feat=a.FFTM=a.GDEF=a.GPOS=a.GSUB=a.LTSH=a["OS/2"]=1,Binary.compare("950412de00000000")||Binary.compare("de12049500000000")?sName="GNU Gettext Machine Object (.MO)":a[Binary.getString(12,4)]?sName="TrueType font (.TTF)":Binary.compare("f702018392c01c3b")?sName="Device Independent Document (.DVI)":Binary.compare("31be000000ab0000")||Binary.compare("32be000000ab0000")?sName="Windows Write document (.WRI)":Binary.compare("'MICROSOFT PIFEX'0087010000",369)?sName="Microsoft Program Information (.PIF)":Binary.compare("4c0000000114020000000000c000000000000046")?sName="Windows Shortcut (.LNK)":Binary.compare("'Zinc Data File Version'")?sName="Zinc Data (.DAT)":Binary.compare("00010000'Jet System DB  '00")?sName="Microsoft Access Workgroup Information (.MDW)":Binary.compare("dca5..00..................00000000")||Binary.compare("eca5c100..................00000000")?sName="Microsoft Word 2 document":Binary.compare("'OTTO'................'CFF '")?sName="OpenType - CFF compact font (.OTF)":Binary.compare("3cb86418caef9c95")?sName="Qt Message (.QM)":Binary.compare("'SIB file: TsiLang binary translation data'")?sName="TsiLang binary translation data (.SIB)":Binary.compare("......00..........000200")&&Binary.compare("00'LP'",33)?sName="Embedded OpenType font (.EOT)":Binary.compare("d4c3b2a1020004")?sName="TCPDUMP's style capture (.ACP/PCAP)":Binary.compare("'HSP'")?sName="OS/2 help file":Binary.compare("'LN'0200")?sName="Quick Help":Binary.compare("'MZIP'")?sName="MZIP archive":Binary.compare("'Kaydara FBX Binary  '00")?(sName="Kaydara FBX Binary (.FBX)",sVersion=Binary.read_uint16(23)):Binary.compare("89'FCP'0D0A1A0A")?(sName="High-Logic FontCreator Project (.FCP)",sVersion=Binary.read_uint16(8)+"."+Binary.read_uint16(10),detect_zlib(Binary,20+17*Binary.read_uint32(16)+12)):Binary.compare("'XALZ'")&&(sName="Xamarin Compressed DLL",sOptions=sOptions.append("LZ4 compression","Index:"+Binary.read_uint32(4),"Original size:"+Binary.read_uint32(8))),bDetected=bDetected||Boolean(sName),result()}meta("format"),includeScript("zlib")

================================================
FILE: dbs_min/db/Binary/graphics.1.sg
================================================
function detect(){return Binary.compare("d7cdc69a0000")?sName="Windows MetaFile (.WMF)":Binary.compare("ff4fff51002f0000")?sName="JPEG-2000 Code Stream (.JP2)":Binary.compare("0000000C6A50....................'ftypjp2'..........'jp2'20")?sName="LuraWave JPEG-2000 (.JP2)":Binary.compare("'P4'0a")?sName="Unix Portable BitMap (.PBM)":Binary.compare("'P5'0a")||Binary.compare("'P6'0a")?sName="Portable BitMap Package (.PPM)":Binary.compare("01da010100")?sName="Silicon Graphics bitmap (.SGI)":Binary.compare("010009000003............................................'WMFC'")?sName="Windows Metafile (old Win 3.x format) (.WMF)":Binary.compare("01000000640000000000000000000000")&&Binary.compare("'EMF'000001",41)?sName="Windows Enhanced Metafile (.EMF)":Binary.compare("'WGq'")&&(sName="Liar-soft Windows Computer Graphics image (.WCG)"),bDetected=bDetected||Boolean(sName),result()}meta("image")

================================================
FILE: dbs_min/db/Binary/image.PNG.1.sg
================================================
function detect(){if(File.compare("89'PNG'0D0A1A0A........'IHDR'")){switch(bDetected=1,sName="Portable Network Graphics (.PNG)",ct=File.read_uint8(25)){case 0:sOption("grey")
break
case 2:sOption("RGB")
break
case 3:sOption("indexed")
break
case 4:sOption("grey+alpha")
break
case 6:sOption("RGBA")
break
default:sOption("unk.colour type")}if(File.read_uint8(28)&&sOption("interlaced"),File.compare("00000008'acTL'",33),File.isVerbose()){for(var e=8,a=0,i=simplea=musthaveplte=!1,s=h="?",r=icc=title=auth=desc=timestamp=sw=warn=cmt=sd="";!i&&e<File.getSize();){if(hksz=File.read_uint32(e,_BE),hkhd=File.read_ansiString(e+4,4),e+12+hksz>File.getSize()){sVersion+="!short"
break}switch(e+=8,hkhd){case"IEND":i=!0
break
case"IHDR":s=File.read_uint32(e,_BE),h=File.read_uint32(e+4,_BE),a=1<<File.read_uint8(e+8),musthaveplte=3==File.read_uint8(e+9)
break
case"PLTE":musthaveplte=!1
break
case"tRNS":simplea=!0
break
case"iCCP":icc=File.read_codePageString(e,79,"CP850")
break
case"iTXt":case"tEXt":var n=e
if("iTXt"===hkhd){if(n+=(t1=File.read_codePageString(n,79,"CP850").toLowerCase()).length+1,!File.read_uint8(n+=2))break
n=(n+=(t=File.read_codePageString(n,256,"CP850")).length+1)+((t=File.read_codePageString(n,256,"CP850")).length+1),t2=File.read_utf8String(n,hksz-n)}else n+=(t1=File.read_codePageString(e,79,"CP850").toLowerCase()).length+1,t2=File.read_codePageString(n,hksz-n,"CP850")
switch(_log("t1:"+t1.slice(0,4)),t1){case"title":title=t2
break
case"author":auth=t2
break
case"description":desc=t2
break
case"creation time":timestamp=t2
break
case"software":sw=t2
break
case"warning":warn=t2
break
case"comment":cmt=t2
break
default:"xml:"==t1.slice(0,4)&&(desc=desc.append("XML info found"))}break
case"sBIT":switch(ct){case 0:sd=File.read_uint8(e)
break
case 2:case 3:sd="R"+File.read_uint8(e)+"G"+File.read_uint8(e+1)+"B"+File.read_uint8(e+2)
break
case 4:sd="g"+File.read_uint8(e)+"a"+File.read_uint8(e+1)
break
case 6:sd="R"+File.read_uint8(e)+"G"+File.read_uint8(e+1)+"B"+File.read_uint8(e+2)+"a"+File.read_uint8(e+3)}case"tIME":timestamp="UTC"+File.read_uint16(e,_BE)+"-"+File.read_uint8(e+2)+"-"+File.read_uint8(e+3)+"T"+File.read_uint8(e+4)+":"+File.read_uint8(e+5)+":"+File.read_uint8(e+6)
break
case"acTL":sName="Animated Portable Network Graphics (.PNG)",r=Binary.read_uint32(e,_BE)
break
default:for(n=0;n<4;n++){var c=hkhd[n]
if(c<"A"||"Z"<c&&c<"a"||"z"<c){sVersion+="!badchunkheader"
break}}}e+=4+hksz}musthaveplte&&(sVersion+="!badpalette"),i||(sVersion+="!noIEND"),sOption(s+"x"+h),sOption(a,"colours:"),sOption(r,"frames:"),sOption(sd,"src.depth:"),simplea&&sOption("simple alpha"),sOptionT(icc),sOption(title),sOption(auth,"by:"),sOption(timestamp,"on:"),sOption(sw,"in:"),sOption(warn,"/!\\:"),sOption(addEllipsis(desc,70,512)),sOption(cmt),sOption(e,"sz:")}}return result()}meta("image")

================================================
FILE: dbs_min/db/Binary/image_ANI.1.sg
================================================
function detect(){var i
return 48<=Binary.getSize()&&Binary.compare("'RIFF'........'ACON'")&&(-1!=(i=Binary.findString(12,Binary.getSize()-12,"framicon"))&&(sOptions=Binary.readByte(i+18)+"x"+Binary.readByte(i+19),i+=12+Binary.readDword(i+30),sOptions=sOptions.append(Binary.readWord(i+14)+"bpp")),-1!=(i=Binary.findSignature(12,Binary.getSize()-12,"'anih'24000000"))&&(i=Binary.readDword(i+12),sOptions=sOptions.append(i+(1==i?" icon":" icons"))),bDetected=1),result()}meta("image","Windows Animated Cursor")

================================================
FILE: dbs_min/db/Binary/image_BMP.1.sg
================================================
function detect(){if(40<=Binary.getSize()&&Binary.compare("'BM'")&&Binary.getSize()>=Binary.readDword(2)){switch(Binary.readDword(14)){case 40:sVersion="3"
break
case 108:sVersion="4"
break
case 124:sVersion="5"}if(sVersion){switch(Binary.readDword(30)){case 1:case 2:sOptions="RLE"
break
case 4:sOptions="JPEG"
break
case 5:sOptions="PNG"}(nHeight=~~Binary.readDword(22))<0&&(nHeight=-nHeight,sOptions=sOptions.append("top-down")),sOptions=sOptions.append(Binary.readDword(18)+"x"+nHeight,Binary.readWord(28)+"bpp")}bDetected=1}return result()}meta("image","Windows Bitmap")

================================================
FILE: dbs_min/db/Binary/image_CUR.1.sg
================================================
function detect(){if(40<=X.Sz()&&X.c("00000200")){var s,n,r=X.U16(4),t=0,i=0,e=0,p=6+16*r
if(6===p||p>X.Sz())return!1
for(var o=0;o<r;o++){if(Binary.read_uint8(9+16*o))return!1
if(!(sz_=Binary.read_uint32(14+16*o,_LE))||sz_>X.Sz()-22)return!1
p+=sz_
var u=X.U8(6+16*o)
t<u?(t=u,i=X.U8(7+16*o),e=getCurIcoBPP(6+16*o),s=X.I16(10+16*o),n=X.I16(12+16*o)):u==t&&e<(u=getCurIcoBPP(6+16*o))&&(e=u,s=X.I16(10+16*o),n=X.I16(12+16*o))}sOptions=t+"x"+i,sOptions=(sOptions=0!=e?sOptions.append(e+"bpp"):sOptions).append("("+s+","+n+")"),sOptions=(sOptions=1<r?sOptions.append(r+" cursors"):sOptions).append("sz:"+p),bDetected=1}return result()}meta("image","Windows Cursor"),includeScript("CurIcoBPP")

================================================
FILE: dbs_min/db/Binary/image_DDS.1.sg
================================================
function detect(){var e
return 64<=Binary.getSize()&&Binary.compare("'DDS '7C000000")&&(bDetected=1,Binary.isVerbose())&&(sOption(Binary.read_uint32(12)+"x"+Binary.read_uint32(16)),(e=Binary.getString(84,4))?sOption("compressed: "+e):sOption("uncompressed"),Binary.read_uint32(28))&&sOption("MipMap"),result()}meta("image","DirectDraw Surface (.DDS)")

================================================
FILE: dbs_min/db/Binary/image_EPS.1.sg
================================================
function detect(){var e,r
return 64<=Binary.getSize()&&Binary.compare("'%!PS-Adobe-'",0)&&Binary.compare("' EPSF-'",14)&&(sVersion=sVersion.append(Binary.getString(11,3),Binary.getString(20,3)),e=Binary.getString(0,1024),bDetected=1,Binary.isVerbose())&&((r=e.match(/%%Creator: (.*?)[\r\n]/))&&(sOptions=sOptions.append("Creator:"+r[1])),r=e.match(/%%Pages: (.*?)[\r\n]/))&&(sOptions=sOptions.append("Pages:"+r[1])),result()}meta("image","Encapsulated PostScript (.EPS)")

================================================
FILE: dbs_min/db/Binary/image_FSH.1.sg
================================================
function detect(){return Binary.compare("'SHPI'......00..000000")&&(sOptions="PC",bDetected=1),result()}meta("image","FSH")

================================================
FILE: dbs_min/db/Binary/image_GIF.1.sg
================================================
function detect(){if(!(!File.compare("'GIF87'")&&!File.compare("'GIF89'")||File.getSize()<11||(sVersion=Binary.getString(4,2),/\d[a-z]/.test(sVersion)<0))){if(sVersion="v198"+sVersion,bDetected=1,File.isDeepScan()||File.compare("3B",File.getSize()-1)||(sVersion+="/malformed"),!File.isVerbose())return result()
var e=File.read_uint8(10),i=File.read_uint8(12),a="",r=(sOption(File.read_uint16(6)+"x"+File.read_uint16(8)),1<<1+(7&e)),n=(sOption(r,"col:"),File.read_uint8(11))
if(n&&sOption(n,"bgc:"),i&&sOption((i+15)/64,"a/r:"),File.isDeepScan()){p=13,imgs=0,cmt="",128&e&&(p+=3*r),blocksp=p
e:for(;;){var l=File.read_uint8(p++)
if(59===l)break
if(33===l){var s=File.read_uint8(p++)
switch(s){case 249:p+=File.read_uint8(p++)
break
case 254:(s=File.read_uint8(p++))&&(cmt+=File.read_ansiString(p,s),p+=s)
case 255:if(11!==(s=File.read_uint8(p++))){a+="!badappext"
break e}for(t=File.read_ansiString(p,s),sOption(t,"appdata:"),p+=s,s=File.read_uint8(p++);s&&p<File.getSize();)p+=s,s=File.read_uint8(p++)
break
default:for(s=File.read_uint8(p++);s;)p+=s,s=File.read_uint8(p++)}}if(p>=File.getSize()){a+="!short"
break}if(44==l){if(imgs++,!File.read_uint16(p+4)||!File.read_uint16(p+6)){a+="!badimg"
break}for(p+=8,e=File.read_uint8(p++),p++,128&e&&(r=1<<1+(7&e),p+=3*r,_log("  local palettes skipped @"+Hex(p))),s=File.read_uint8(p++);s&&p<File.getSize();)p+=s,s=File.read_uint8(p++)
if(p>=File.getSize()){a+="!short"
break}}}59!=l&&(a+="!badEoS"),imgs?(1<imgs&&sOption(imgs,"frames:"),a?sVersion+="/malformed"+a:sOption(p,"sz:")):bDetected=0}}}meta("image","Graphics Interchange Format file (.GIF)")

================================================
FILE: dbs_min/db/Binary/image_ICNS.sg
================================================
function detect(){return Binary.compare("'icns'00")&&(bDetected=1),result()}meta("image","Apple Icon Image")

================================================
FILE: dbs_min/db/Binary/image_ICO.1.sg
================================================
function detect(){if(X.c("00000100")){var t=X.U16(4,_LE),i=6+16*t
if(!t||i>X.Sz())return!1
for(var n,r,e,a=0,s=0,c=0,_=68719476735,o=68719476735,u=68719476735,f=0;f<t;f++){if(X.U8(9+16*f)||8<X.U16(10+16*f,_LE)||!isWithin(X.U16(12+16*f,_LE),1,32))return!1
if(n=X.U8(6+16*f),e=getCurIcoBPP(6+16*f),!(sz_=X.U32(14+16*f,_LE))||sz_>X.Sz()-22)return!1
if(i+=sz_,0===n){var h=X.U32(18+16*f,_LE)
if(X.c("89'PNG\r\n'1A0A........'IHDR'",h))n=X.I32(h+16,_BE),r=X.I32(h+20,_BE)
else{if(!X.c("28000000",h))return!1
n=Math.abs(X.I32(h+4,_LE)),r=Math.abs(X.I32(h+8,_LE))}}else r=X.U8(7+16*f)
_=Math.min(n,_),o=Math.min(r,o),u=Math.min(e,u),a=Math.max(n,a),s=Math.max(r,s),c=Math.max(e,c)}if(!a||!s)return!1
sOption((_!=a||o!=s?_+"x"+o+" ~ ":"")+a+"x"+s),sOption((u!=c?u+"~":"")+c+"bpp"),1<t&&sOption(t+" icons"),sOption("sz: "+i),bDetected=1}return result()}meta("image","Windows Icon"),includeScript("CurIcoBPP")

================================================
FILE: dbs_min/db/Binary/image_IMG.1.sg
================================================
function detect(){var e
return Binary.compare("'IMG10'")?(e=Binary.getString(3,2).trim(),/^[0-9]{2}$/.test(e)&&(X.isVerbose()&&(sVersion=e),bDetected=1)):Binary.compare("'IMG1.0.1'")&&(e=Binary.getString(3,5).trim(),/^\d+\.\d+\.\d+$/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("image","Image (DEV7)")

================================================
FILE: dbs_min/db/Binary/image_JNG.1.sg
================================================
function detect(){if(64<=Binary.getSize()&&Binary.compare("8B'JNG\r\n'1A0A........'JHDR'")&&(bDetected=1,Binary.isVerbose()))switch(sOption(Binary.read_uint32(16,_BE)+"x"+Binary.read_uint32(20,_BE)),File.read_uint8(24)){case 8:sOption("Gray")
break
case 10:sOption("Color")
break
case 12:sOption("Gray Alpha")
break
case 14:sOption("Color Alpha")
break
default:return}return result()}meta("image","JPEG Network Graphics (.JNG)")

================================================
FILE: dbs_min/db/Binary/image_JPEG.1.sg
================================================
function detect(){if(22<=X.Sz())if(X.c("FFD8FFE0....'JFIF'00")){bDetected=1,sVersion=X.U8(11)+".",X.U8(12)<10&&(sVersion+="0"),sVersion+=X.U8(12)
for(var s=2;s<X.Sz();){var e=X.U16(s,_BE)
if(65472<=e&&e<=65475){switch(sOptions=X.U16(s+7,_BE)+"x"+X.U16(s+5,_BE),X.U8(s+9)){case 1:sOptions=sOptions.append("grey")
break
case 3:sOptions=sOptions.append("YCbCr")
break
case 4:sOptions=sOptions.append("CMYK")}break}s+=2+X.U16(s+2,_BE)}}else X.c("FFD8FFE1....'Exif'00")?(bDetected=1,sVersion=X.U8(11)+".",X.U8(12)<10&&(sVersion+="0"),sVersion+=X.U8(12),sOptions="EXIF"):X.c("FFD8FFDB")&&(bDetected=1,sOptions="OLD")
return result()}meta("image","JPEG")

================================================
FILE: dbs_min/db/Binary/image_JPEGXL.1.sg
================================================
function detect(){return 20<=Binary.getSize()&&(Binary.compare("FF0A")?(sOptions="codestream",bDetected=1):Binary.compare("0000000C4A584C200D0A870A")&&(sOptions="ISOBMFF-based container",bDetected=1)),result()}meta("image","JPEG XL")

================================================
FILE: dbs_min/db/Binary/image_KTX.1.sg
================================================
function detect(){if(64<=Binary.getSize())if(Binary.compare("AB'KTX 11'BB0D0A1A0A"))bDetected=1,sName="Khronos Texture (.KTX)",Binary.isVerbose()&&sOption(Binary.read_uint32(36)+"x"+Binary.read_uint32(40))
else if(Binary.compare("AB'KTX 20'BB0D0A1A0A")){if(bDetected=1,sName="Khronos Texture (.KTX2)",Binary.isVerbose()){for(sOption(Binary.read_uint32(20)+"x"+Binary.read_uint32(24)),p=80,sz=0,i=0;i<Math.max(1,Binary.read_uint32(40));i++,p+=24)(t=Binary.read_uint64(p))>sz&&(sz=t+Binary.read_uint64(p+8))
sOption("sz:"+outSz(sz))}}else Binary.compare("734213004D00")&&(bDetected=1,sName="Basis Universal GPU Texture (.BASIS)",Binary.isVerbose())
return result()}meta("image","")

================================================
FILE: dbs_min/db/Binary/image_LBM.1.sg
================================================
function detect(){if(File.compare("'FORM'")&&(File.compare("'ILBM'",8)||File.compare("'PBM '",8))){for(sz=File.read_uint32(4,_BE)+8,File.getSize()<sz&&(sVersion="malformed!short"),p=12,end=Math.min(File.getSize(),sz),w=viewportMode=hsx=-1;p<end;){switch(hkhd=File.read_ansiString(p,4),hksz=File.read_uint32(p+4,_BE),p+=8,hkhd){case"BMHD":w=File.read_uint16(p,_BE),h=File.read_uint16(p+2,_BE),x0=File.read_int16(p+4,_BE),y0=File.read_int16(p+6,_BE),numPlanes=File.read_uint8(p+8),mask=File.read_uint8(p+9),co=File.read_uint8(p+10),tcol=File.read_uint16(p+12),xa=File.read_uint8(p+14),ya=File.read_uint8(p+15),pw=File.read_int16(p+16,_BE),ph=File.read_int16(p+18,_BE)
break
case"CAMG":viewportMode=File.read_uint32(p,_BE)
break
case"GRAB":hsx=File.read_int16(p,_BE),hsy=File.read_int16(p+2,_BE)}p+=hksz,hksz%2&&p++}if(w<0)return
if(File.isVerbose()){switch(sOption(w+"x"+h+" ("+x0+","+y0+") ["+pw+"x"+ph+"] AR"+xa+":"+ya),sOption("planes:"+numPlanes),co){case 0:sOption("uncompressed")
break
case 1:sOption("RLE")
break
case 2:sOption("vertical RLE")
break
default:sOption("unk.compression")}2<=mask&&sOption("t.col:"+Hex(tcol)),0<=viewportMode&&sOption(Hex(viewportMode),"view_port_mode:"),0<=hsx&&sOption("hotspot: ("+hsx+","+hsy+")")}bDetected=1}return result()}meta("image","IFF InterLeaved BitMap (.IFF,.LBM)")

================================================
FILE: dbs_min/db/Binary/image_MNG.1.sg
================================================
function detect(){return 64<=Binary.getSize()&&Binary.compare("8A'MNG\r\n'1A0A........'MHDR'")&&(bDetected=1,Binary.isVerbose())&&(sOption(Binary.read_uint32(16,_BE)+"x"+Binary.read_uint32(20,_BE)),sOption("frames:"+Binary.read_uint32(24,_BE))),result()}meta("image","Multiple-image Network Graphics (.MNG)")

================================================
FILE: dbs_min/db/Binary/image_PCX.1.sg
================================================
function detect(){if(80<=X.Sz()&&10===X.U8(0)){switch(nv=X.U8(1)){case 0:sVersion="v2.5 using a fixed EGA palette"
break
case 2:sVersion="v2.8 using a modifiable EGA palette"
break
case 3:sVersion="v2.8 using no palette"
break
case 4:sVersion="Windows"
break
case 5:sVersion="v3.0+ or 24-bit"
break
default:return}var e="",s=0,i=X.U8(2)
if(1<i)return
i||(s++,e+="!uncompressed")
var n=X.U16(8)-X.U16(4)+1,t=X.U16(10)-X.U16(6)+1
if(n<=0||t<=0)return
var r=X.U16(12),o=X.U16(14),a=(r&&!isWithin(r,32,600)&&(s++,e+="!susXdpi"),o&&!isWithin(o,32,600)&&(s++,e+="!susYdpi"),X.U8(3)),p=X.U8(65),u=a*p
ext=!1
if([1,2,4,8,24].indexOf(a)<0)return
if(!p||4<p)return
X.U8(64)&&(s+=2,e+="!resnon0"),isAllZeroes(74,54)||(ext=!0)
p=X.U16(66)
if(p%2)return
if(p<n*u>>3&&(s++,e+="!bpline"+p+"<w"+n*u/8),3<s)return
s&&"!uncompressed"!=e&&(sVersion=sVersion.appendS("sus"+e,"/")),X.isVerbose()&&(sOption(n+"x"+t),i&&sOption("RLE"),ext&&sOption("extra_block"),sOption(u,"bit/pixel:"),sOption(a,"bit/plane:"),p<n*u>>3&&sOption(p,"scanline:"),sOption(r+"x"+o,"res:"," dpi"),X.U16(70)*X.U16(72)&&sOption(X.U16(70)+"x"+X.U16(72),"screen:"),i||sOption(128+(n*t*u>>3),"sz:")),bDetected=1}return result()}meta("image","ZSoft PiCture eXchange file (.PCX)")

================================================
FILE: dbs_min/db/Binary/image_PSD.1.sg
================================================
function detect(){if(32<=Binary.getSize()&&Binary.compare("'8BPS'")){switch(bDetected=1,File.read_uint16(4,_BE)){case 1:sName+=" (.PSD)",sVersion="v1.0"
break
case 2:sName+=" BIG (.PSB)",sVersion="v2.0"
break
default:bDetected=0}var e=Binary.read_uint16(12,_BE),a=Binary.read_uint32(14,_BE),t=Binary.read_uint32(18,_BE),i=Binary.read_uint16(22,_BE),n=Binary.read_uint16(24,_BE)
switch(sOption(t+"x"+a),n){case 0:sOption("Bitmap")
break
case 1:sOption("Gray-scale")
break
case 2:sOption("Indexed")
break
case 3:sOption("RGB")
break
case 4:sOption("CMYK")
break
case 7:sOption("Multichannel")
break
case 8:sOption("Duotone")
break
case 9:sOption("Lab")
break
default:bDetected=0}sOption(e*i+"-bit")}return result()}meta("image","Adobe Photoshop")

================================================
FILE: dbs_min/db/Binary/image_PVR.1.sg
================================================
function detect(){return 52<=Binary.getSize()&&Binary.compare("'PVR'03")&&(bDetected=1,sName="PowerVR PVR texture (.PVR)",Binary.isVerbose())&&(sOption(Binary.read_uint32(24)+"x"+Binary.read_uint32(28)),sOption(["PVRTC 2bpp RGB","PVRTC 2bpp RGBA","PVRTC 4bpp RGB","PVRTC 4bpp RGBA","PVRTC-II 2bpp","PVRTC-II 4bpp","ETC1","BC1\\DXT1","DXT2","BC2\\DXT3","DXT4","BC3\\DXT5","BC4","BC5","BC6","BC7","UYVY","YUY2","BW1bpp","R9G9B9E5 Shared Exponent","RGBG8888","GRGB8888","ETC2 RGB","ETC2 RGBA","ETC2 RGB A1","EAC R11","EAC RG11","ASTC_4x4","ASTC_5x4","ASTC_5x5","ASTC_6x5","ASTC_6x6","ASTC_8x5","ASTC_8x6","ASTC_8x8","ASTC_10x5","ASTC_10x6","ASTC_10x8","ASTC_10x10","ASTC_12x10","ASTC_12x12","ASTC_3x3x3","ASTC_4x3x3","ASTC_4x4x3","ASTC_4x4x4","ASTC_5x4x4","ASTC_5x5x4","ASTC_5x5x5","ASTC_6x5x5","ASTC_6x6x5","ASTC_6x6x6"][Binary.read_uint64(8)]),Binary.read_uint32(16)?sOption("Linear RGB"):sOption("Standard RGB")),result()}meta("image","")

================================================
FILE: dbs_min/db/Binary/image_QOI.1.sg
================================================
function detect(){if(14<=Binary.getSize()&&Binary.compare("'qoif'")){switch(bDetected=1,sOptions=sOptions.append(Binary.read_uint32(4,_BE)+"x"+Binary.read_uint32(8,_BE)),File.read_uint8(12)){case 3:sOption("RGB")
break
case 4:sOption("RGBA")
break
default:return}switch(File.read_uint8(13)){case 0:sOption("sRGB with linear alpha")
break
case 1:sOption("all channels linear")
break
default:return}}return result()}meta("image","Quite OK Image (.QOI)")

================================================
FILE: dbs_min/db/Binary/image_SMDH.1.sg
================================================
function detect(){return Binary.compare("'SMDH'00000000")&&(bDetected=1),result()}meta("image","SMDH")

================================================
FILE: dbs_min/db/Binary/image_TGA.1.sg
================================================
function detect(){if(X.Sz()<18)return!1
bad=""
var e=X.U8(0),s=X.U8(1),a=0,r=X.U8(2),o=X.U8(16),n="",t="none"
if((o<1||17<=o)&&24!=o&&32!=o)return!1
switch(r){case 1:if(!s)return
n="pseudo",X.isVerbose()&&sOption("colormap")
break
case 2:X.isVerbose()&&sOption("RGB"),a="24bit"
break
case 3:X.isVerbose()&&sOption("monochrome")
break
case 9:if(!s)return
t="rle",n="pseudo",X.isVerbose()&&sOption("RLE colormap")
break
case 10:t="rle",X.isVerbose()&&sOption("RLE RGB"),a="24bit"
break
case 11:t="rle",X.isVerbose()&&sOption("RLE monochrome")
break
case 32:if(!s)return
t="hdr",n="pseudo",X.isVerbose()&&sOption("H/d/RLE colormap")
break
case 33:if(!s)return
t="hdrq",n="pseudo",X.isVerbose()&&sOption("H/d/RLE 4-pass colormap")
break
default:return}var f=0,u=X.U16(3),c=X.U16(5),b=X.U8(7),d=X.U16(8),U=X.U16(10),l=X.U16(12),m=X.U16(14),S=X.U8(17)
if(!l||!m||4096<l||2048<m||1600<d||1200<U||32<b||192&S)return!1
if(d&&f++,U&&f++,l<4&&f++,m<4&&f++,1600<l&&f++,1200<m&&f++,16&S&&f++,!b&&c)return!1
1!=s||2!=r&&10!=r||f++,(b<15||isWithin(b,17,23)||isWithin(b,25,31))&&f++,256<c&&f++,u&&f++,2!=r&&10!=r||(u&&f++,c&&f++,b&&f++)
a=1<<(1!=r&&9!=r&&32!=r&&33!=r?!(o<=8)&&o<=16?5:8:!(b<=8)&&b<=16?5:8)
if("pseudo"==n)if(s)a=u+c
else if((a=1<<o)>X.Sz())return
if(p=18,e&&X.SC(p,e,"CP437"),p+=e,s)switch(a<u&&(a=u),b){case 8:default:p+=a
break
case 15:case 16:p+=2*a
break
case 24:p+=3*a
break
case 32:p+=4*a}if(a<c&&f++,!(3<f)){base=flag=skip=index=runlen=ofs=0
r=(192&S)>>6==2?2:1
if("hdr"!=t&&"hdrq"!=t){for(var O=0;O<m&&p<X.Sz();O++)for(var V=0;V<l&&p<X.Sz();V++)if("rle"==t&&(runlen?(runlen--,skip=0!=flag):(runlen=X.U8(p++),skip=0,(flag=128&runlen)&&(runlen-=128))),!skip)switch(o){case 1:7&V||p++
break
case 8:default:p++
break
case 15:case 16:p+=2
break
case 24:p+=3
break
case 32:p+=4}}else p=0
if((ofs+=r)>l&&(base++,ofs=base),p>X.Sz()){if(!X.isHeuristicScan())return
bad=bad.addIfNone("!short")}return ea=0,X.isHeuristicScan()&&(sigsz=15,found=!1,ext=X.fSig(p,4096,"'TRUEVISION-XX.'00"),(found=k(ext)?!0:found)||(sigsz=18,k(ext=X.fSig(p,4096,"'TRUEVISION-XFILE.'00"))&&(found=!0)),found||k(ext=X.fSig(X.Sz()-20,21,"'TRUEVISION-XFILE.'00"))&&(found=!0),found)?(sVersion=sV,p=ext+sigsz):sVersion="v1.X",X.isVerbose()&&(sOption(l+"x"+m+" ("+d+","+U+")"),sOption(o,"bpp:"),o<24&&sOption(a,"colours:"),ea&&(sOption(gamma,"gamma:"),sOptionT(auth,"by:"),sOption(timestamp,"on:"),sOption(sw,"in:"),sOption(xmsg,'msg:"','"')),"rle"==t&&!X.isDeepScan()||sOption(outSz(p),"sz:")),bad&&(sVersion+="/malformed"+bad),bDetected=1,result()}function k(e){if(!(e<=p)){ea=X.U32(e-8),esz=X.U16(ea)
var s=X.U32(e-4)
if(!(p>e-8||ea&&p>ea||s&&p>s||(s||ea)&&ea==s||ea&&ea+esz>e||s&&ea&&ea<s&&ea+esz>s)){if(ea?(sV=495==esz?"v2.0":"v2.X",auth=X.SC(ea+2,41,"CP437"),xmsg=X.SC(ea+43,324,"CP437"),timestamp=X.U16(ea+371)+"-"+X.U16(ea+369)+"-"+X.U16(ea+367)+" "+X.U16(ea+373)+":"+X.U16(ea+375)+":"+X.U16(ea+377),sw=X.SC(ea+426,41,"CP437").trim()+" v"+Math.floor(X.U16(ea+467)/100).toString()+"."+(X.U16(ea+467)%100).toString()+X.SC(ea+469,1,"CP437"),gamma=(X.U16(ea+478)/X.U16(ea+480)).toFixed(1)):sV="v2.X",s){var a=X.U16(s),r=10*a+2
if(e<s+r||ea&&s+r>ea)return
for(i=0;i<a;i++){var o=X.U32(s+4+10*i),n=X.U32(s+8+10*i)
if(e<o+n||o+n<p)return}}return 1}}}}meta("image","Truevision Advanced Raster Graphics Adapter bitmap (.TGA,.ICB,.VDA,.VST)")

================================================
FILE: dbs_min/db/Binary/image_TIFF.1.sg
================================================
function detect(){if(14<=Binary.getSize()){switch(bDetected=1,Binary.read_uint32(0,_BE)){case 1296891946:var i=_BE
sOption("BE")
break
case 1229531648:i=_LE
sOption("LE")
break
default:return}var e,a,r,n,t,s=Binary.read_uint32(4,i),c=Binary.read_uint16(s,i)
for(s+=2;c--;){var o=Binary.read_uint16(s,i),k=Binary.read_uint16(s+2,i),u=Binary.read_uint32(s+4,i)
switch(o){case 256:e=b(k)
break
case 257:a=b(k)
break
case 258:r=u*b(k)
break
case 259:t=b(k)
break
case 262:n=b(k)
break
case 271:sOption("Make:"+b(k))
break
case 50706:sName="Digital Negative (.DNG)"}s+=12}switch(t){case 1:sOption("Uncompressed")
break
case 2:sOption("Huffman")
break
case 3:sOption("Group 3")
break
case 4:sOption("Group 4")
break
case 5:sOption("LZW")
break
case 6:sOption("embedded JPEG (602Photo software)")
break
case 7:sOption("JPEG")
break
case 32771:sOption("Alchemy software type 6 unknown compression")
break
case 32773:sOption("PackBits")
break
case 32946:sOption("Deflate")
break
case 34690:sOption("LDF bitonal")
break
case 65e3:sOption("Kodak DCR"),sName="Kodak DCS Pro SLR (.DCR)"}switch(0!=e&&0!=a&&sOption(e+"x"+a),sOption(r+"-bit "),n){case 0:sOption("W/B")
break
case 1:sOption("B/W")
break
case 2:sOption("RGB")
break
case 3:sOption("index")}}function b(e){var a=0,r=0
switch(e){case 1:break
case 2:return r=Binary.read_uint32(s+8,i),a=Binary.getString(r,u)
case 3:if(1==u)return a=Binary.read_uint16(s+8,i)
for(r=Binary.read_uint32(s+8,i);u--;)a=Binary.read_uint16(r,i),r+=2
return a
case 4:if(1==u)return a=Binary.read_uint32(s+8,i)
for(r=Binary.read_uint32(s+8,i);u--;)a=Binary.read_uint32(r,i),r+=4
return a}}return result()}meta("image","Tagged Image File Format (.TIFF)")

================================================
FILE: dbs_min/db/Binary/image_XAR.1.sg
================================================
function detect(){if(64<=Binary.getSize()&&Binary.compare("'XARA'A3A30D0A")){bDetected=1
var e=Binary.getString(31),i=Binary.getString(31+e.length+1),t=Binary.getString(31+e.length+1+i.length+1)
if(sName=e+" Document (.XAR)",sVersion=i,Binary.isVerbose())switch(sOption("build: "+t),Binary.getString(16,3)){case"CXW":sOption("Web file")
break
case"CXN":sOption("Paper-publishable file")}}return result()}meta("image","Xar Vector graphic file (.XAR)")

================================================
FILE: dbs_min/db/Binary/image_XCF.1.sg
================================================
function detect(){var e
return Binary.compare("67 69 6D 70 20 78 63 66")&&(e=Binary.getString(9,4).trim(),/^[a-z-0-9]{4}/.test(e))&&(X.isVerbose()&&(sVersion=e),bDetected=1),result()}meta("image","eXperimental Computing Facility (GIMP Image)")

================================================
FILE: dbs_min/db/Binary/image_bin.ZBMP.1.sg
================================================
function detect(){return X.c("'ZBMP'")&&X.c("78DA",16)&&(w=X.U32(4))&&w<65536&&(h=X.U32(8))&&h<65536&&(bDetected=1,sOptions=w+"x"+h),result()}meta("image","Zlib-packed BMP file (.ZBM)")

================================================
FILE: dbs_min/db/Binary/image_heuristic.image.HDR.1.sg
================================================
function detect(){return X.isHeuristicScan()&&(bDetected=(0<=X.fSig(0,128,"'#?RADIANCE'0A")||0<=X.fSig(0,128,"'#?RGBE'0A"))&&0<=X.fSig(10,1024,"0A'FORMAT='")),result()}meta("~image","Greg Ward's RGBE / Radiance HDR (.hdr, .pic, .rgbe, .xyze)")

================================================
FILE: dbs_min/db/Binary/protector_javascript-obfuscator.2.sg
================================================
function detect(){return isSignatureInBeginAndEndPresent("'function'")&&(isSignatureInBeginAndEndPresent("'var '")||isSignatureInBeginAndEndPresent("'const '")||isSignatureInBeginAndEndPresent("')();'"))&&(isSignatureInBeginAndEndPresent("'_0x'")&&(isSignatureInBeginAndEndPresent("'_0x' .. .. .. .. '('")||isSignatureInBeginAndEndPresent("'_0x' .. .. .. .. .. '('")||isSignatureInBeginAndEndPresent("'_0x' .. .. .. .. .. .. '('"))&&(bDetected=1),isSignatureInBeginAndEndPresent("'parseInt(' .. '('")&&(sOptions="mangled",bDetected=1),isSignatureInBeginAndEndPresent("'=[\"'")&&isSignatureInBeginAndEndPresent("'\",\"'")||isSignatureInBeginAndEndPresent("'=[' 27")&&isSignatureInBeginAndEndPresent("27 ',' 27"))&&(sOptions+=(0!==sOptions.length?" + ":"")+"strings array"),result()}function isSignatureInBeginAndEndPresent(n){var e=10240
if(e>Binary.getSize()&&(e=Binary.getSize()),Binary.isSignaturePresent(0,e,n)||e!=Binary.getSize())return Binary.isSignaturePresent(Binary.getSize()-e,e,n)}meta("protector","javascript-obfuscator")

================================================
FILE: dbs_min/db/Binary/rom_32X.1.sg
================================================
function detect(){return Binary.compare("'SEGA SSF '",256)&&(bDetected=1),result()}meta("rom","Mega Drive (Mega Everdrive extensions)")

================================================
FILE: dbs_min/db/Binary/script_text.Shell.1.sg
================================================
function detect(){return isInterpreter("sh")&&(bDetected=1),result()}meta("script","Shell"),includeScript("shell-script")

================================================
FILE: dbs_min/db/Binary/shellcode.pe_to_shellcode.1.sg
================================================
function detect(){bDetected=0
var B=["4D5A4552E8000000005B4883EB09534881C3","4D5A4552E8000000005883E8095005","558BEC51518D45F85350E8AA0100005984C0750883C8FFE9A400000056578B7D08B84D5A00006639070F858C0000008B773C03F7813E50450000757F8D86A000000033DB391875046AFDEB71FF76345750E8FB00000083C40C84C075046AFCEB5C399E80000000742357FFB684000000FFB680000000FF75FCFF75F8E86F00000083C41484C075046AFBEB318D86C0000000391874095750E82800000059598B4628B90020000003C766854E167408536A0157FFD0EB07FFD0EB036AFE585F5E5BC9C204008B44240456578B7C24108B008B74380C85F674128B0E85C9740C6A006A0157FFD183C60475EE5FB0015EC3538B5C241855568B7424185703F3EB3C03C350FF5424188BE885ED74408B7E1003FBEB1F79050FB7C1EB058D430203C185C074295055FF54242085C0741F890783C7048B0F85C975DB83C6148B460C85C075BD85F60F95C05F5E5D5BC332C0EBF78B4424045355568B08034C241457EB478B410483F808723F8D68F8D1ED6A005B74320FB7545908668BC266C1E80C6685C074216683F803752B8B44241881E2FF0F00002B44241C03D6035424180102433BDD72CE0349048B3185F675B3B0015F5E5D5BC332C0EBF7565768029FE66AE88B0100008BF05985F67431688DBDC13F56E87C0000008BF8595985FF741E68FF1F7CC956E869000000595985C0740D8B4C240C894104B0018939EB0232C05F5EC353568B74240C83CAFF8A1E84DB743B8A7C24105784FF750A8D43BF3C19770380C3206A085F8BCA0FBEC3D1E933C28BD181F22083B8ED24010F44D1D0FB83EF0175E3468A1E84DB75CB5FF7D25E8BC25BC351515355568B742418B84D5A00005766390675618B463C8B44307885C074568B54301C33FF8B4C30188954241C8B5430208B443024894C241085C974388D1C328D2C308B4C241C0FB745006A018D048103C6894424188B0303C650E84FFFFFFF59593B44242074164783C50283C3043B7C241072CE33C05F5E5D5B5959C38B4424148B0003C6EBEF56578B7C240C83CAFF33F60FB7076685C0745B5355807C2418000FB7C8894C241475108D41BF6683F819770783C120894C2414668B5C24146A085D8BC233CAD1E88BD081F22083B8ED80E1010F44D066D1EB66895C241483ED0174068B4C2414EBD9460FB704776685C075A95D5BF7D25F8BC25EC364A1300000005356578B780C83C7148B37EB288D46F885C074258B581885DB741E8378300074126A00FF7030E85AFFFFFF59593B442410740C8B363BF775D433C05F5E5BC38BC3EBF800000000000000","4D5A4552E800000000594883E909488BC14805","56488BF44883E4F04883EC20E805000000488BE65EC348895C2408574883EC30488BF9488D4C2420E83702000084C0750883C8FFE9BD000000B84D5A00006639070F85AA00000048635F3C4803DF813B504500000F8597000000488D8BB0000000833900750AB8FDFFFFFFE9860000004C8B4330488BD7E86201000084C07507B8FCFFFFFFEB6F83BB9000000000742A0F28442420488D4C2420488B93900000004C8BC7660F7F442420E89300000084C07507B8FBFFFFFFEB3C488D8BD00000008339007408488BD7E8330000008B4328B9002000004803C766854B16740E4533C0488BCF418D5001FFD0EB09FFD0EB05B8FEFFFFFF488B5C24404883C4305FC348895C2408574883EC208B01488BFA488B5C10184885DB741B4C8B0B4D85C974134533C0488BCF418D500141FFD14883C30875E5488B5C2430B0014883C4205FC3488BC44889580848896810488970184889782041564883EC208BDA498BF04903D84C8BF1EB4A8BC84803CE41FF16488BE84885C074628B7B104803FEEB2679050FB7D1EB07488D56024803D14885D27447488BCD41FF56084885C0743B4889074883C708488B0F4885C975D24883C3148B430C85C075AF4885DB0F95C0488B5C2430488B6C2438488B742440488B7C24484883C420415EC332C0EBE148895C240848897C2410448B09498BD84C03CA4C8BDA33FF458B114585D27459418379040872F1418B51044C8BC74883EA0848D1EA7435430FB74C41080FB7C166C1E80C6685C074236683F80A752681E1FF0F0000498BC34103CA482BC34903CB49FFC04801014C3BC272CB418B41044C03C8EBA332C0EB02B001488B5C2408488B7C2410C348895C24084889742410574883EC20488BD9B9029FE66AE8FD010000488BF84885C07432BA8DBDC13F488BC8E893000000488BF04885C0741DBAFF1F7CC9488BCFE87E0000004885C0740B48894308B001488933EB0232C0488B5C2430488B7424384883C4205FC3448A09448ADA4C8BD14183C8FFEB414584DB750C418D41BF3C1977044180C120BA08000000418BC8410FBEC14133C0D1E9448BC14181F02083B8ED2401440F44C141D0F94883EA0175DB49FFC2458A0A4584C975BA41F7D0418BC0C3488BC448895808488968104889701848897820415441564157B84D5A0000448BFA4C8BC16639010F85870000004863413C8B8C088800000085C97478498D040833FF8B68184885ED746A448B4820448B50244D03C8448B601C4D03D0410FB702458B194D03D883CAFF498D3484EB2741BE080000008BCA0FBEC333C2D1E98BD181F22083B8ED24010F44D1D0FB4983EE0175E249FFC3418A1B84DB75D2F7D2413BD7742D48FFC74983C2024983C104483BFD72A833C0488B5C2420488B6C2428488B742430488B7C2438415F415E415CC3428B04064903C0EBDC48895C240848897C2410440FB7094183C8FF33FF8ADA448BD74C8BD9EB4684DB750F418D41BF6683F8197705664183C120BA08000000418BC8410FB7C14133C0D1E9448BC14181F02083B8ED2401440F44C16641D1E94883EA0175DA49FFC2470FB70C53664585C975B4488B5C240841F7D0488B7C2410418BC0C348895C240848896C24104889742418574883EC2065488B0425600000008BE9488B78184883C720488B1F483BDF7430488D43F04885C07427488B70304885F6741E488B48604885C9740B33D2E834FFFFFF3BC57405488B1BEBD0488BC6EB0233C0488B5C2430488B6C2438488B7424404883C4205FC300000000000000000000000000"],C=Binary.getSize()
16384<C&&(C=16384)
for(var F=0;F<B.length;F++)Binary.isSignaturePresent(0,C,B[F])&&(bDetected=1,sOptions=F<=2?"x86":"AMD64")
return result()}meta("shellcode","pe_to_shellcode")

================================================
FILE: dbs_min/db/Binary/shellcode_donut.1.sg
================================================
function detect(){bDetected=0
var e=Binary.readByte(0)
if(232==e&&Binary.readWord(1)==Binary.readWord(5)){e=Binary.readDword(1)+5
if(89==Binary.readByte(e))switch(bDetected=1,16777215&Binary.readDword(e+1)){case 5394778:sOptions="x86"
break
case 4767793:sOptions="x86 + AMD64"
break
default:sOptions="AMD64"}}return result()}meta("shellcode","Donut")

================================================
FILE: dbs_min/db/Binary/shellcode_srdi-monoxgas.1.sg
================================================
function detect(){var e
return Binary.isDeepScan()&&(e=Binary.findSignature(0,Binary.getSize(),"E800000000")+5,3364440409==Binary.readDword(e)?(sOptions="AMD64",bDetected=1):3850982744==Binary.readDword(e)&&(sOptions="x86",bDetected=1)),result()}meta("shellcode","Monoxgas sRDI")

================================================
FILE: dbs_min/db/Binary/source_text.HTML.1.sg
================================================
function detect(){var e=Binary.getHeaderString()
return/^<\s*(!DOCTYPE\s+)?html\b[^>]*>/im.test(e)&&(bDetected=1),sLang="HTM",result()}meta("source","HTML")

================================================
FILE: dbs_min/db/Binary/source_text.Pascal.1.sg
================================================
function detect(){var e=Binary.getHeaderString()
return/^\s*program\s.*\s*uses\s/im.test(e)&&(bDetected=1),sLang="Pascal",result()}meta("source","Pascal")

================================================
FILE: dbs_min/db/Binary/source_text.XML.1.sg
================================================
function detect(){var e=Binary.getHeaderString()
return/^(?:\xef\xbb\xbf)?<\?xml/.test(e)&&((e=e.match(/version="(.*?)"/))&&(sVersion=e[1]),bDetected=1),result()}meta("source","XML")

================================================
FILE: dbs_min/db/Binary/source_text.c.1.sg
================================================
function detect(){var e=Binary.getHeaderString()
if((/^#ifndef (\w+).*\s+^#define \1/m.test(e)||/#\s*pragma (?:once|hdrstop)/.test(e))&&(sOptions="header",bDetected=1),/^(?:class\b|virtual\b|public:|private:|template\b)/m.test(e))/\sdef\s/.test(e)||(sName="C++",bDetected=1)
else{var t=e.match(/^#include ["<].*?[>"]/gm)
if(t){bDetected=1
for(var s=0;s<t.length;s++)if(t[s].indexOf(".")<0){sName="C++"
break}}else/^#define/m.test(e)&&(bDetected=1)}return result()}meta("source","C/C++")

================================================
FILE: dbs_min/db/Binary/source_text.python.1.sg
================================================
function detect(){var t=Binary.getHeaderString()
return/import\s/.test(t)&&/class\s/.test(t)&&/self/.test(t)&&/\sdef\s/.test(t)&&(bDetected=1),sLang="Python",result()}meta("source","Python")

================================================
FILE: dbs_min/db/Binary/text.script.2.sg
================================================
function detect(){return sInterpreter&&(sName=sInterpreter.substr(0,1).toUpperCase()+sInterpreter.substr(1).toLowerCase(),bDetected=1),result()}meta("script"),includeScript("shell-script")

================================================
FILE: dbs_min/db/Binary/win_resources.1.sg
================================================
function detect(){var e
return Binary.isResource()&&(e={1:"Resource Cursor",2:"Windows Bitmap",3:"Resource Icon",4:"Resource Menu",5:"Resource Dialog",6:"Resource String Table",7:"Font Directory",8:"Font",9:"Accelerators",10:"RC Data",11:"Message Table",12:"Windows Cursor",14:"Windows Icon",15:"Name Table",16:"Resource Version Info",17:"DlgInclude",23:"HTML",24:"Manifest"}[Binary.getScanID()])&&(sName=e,sOptions="Resources",bDetected=1),result()}meta("format")

================================================
FILE: dbs_min/db/Borland
================================================
var nOffset,nSize,bBorlandC
void 0===bBorlandC&&(bBorlandC=0,PE.compare("'MZ'50000200000004000F00FFFF0000B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000020000BA10000E1FB409CD21B8014CCD219090'This program must be run under Win32\r\n$'370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'PE'0000")||PE.compareEP("A1........C1E002A3")?bBorlandC=1:PE.compareEP("EB10'fb:C++HOOK'90")?bBorlandC=2:1<PE.section.length&&(nOffset=PE.section[1].FileOffset,nSize=Math.min(1024,PE.section[1].FileSize),PE.isSignaturePresent(nOffset,nSize,"'Borland C++ - Copyright'"))&&(bBorlandC=1))

================================================
FILE: dbs_min/db/CFBF/Microsoft_Installer.1.sg
================================================
function detect(){return 4.62==CFBF.getFileFormatVersion()&&(sVersion="1.X-5.X",bDetected=1),result()}meta("Installer","Microsoft Installer")

================================================
FILE: dbs_min/db/CFBF/Microsoft_Office.1.sg
================================================
function detect(){return 3.62==CFBF.getFileFormatVersion()&&(sVersion="1997-2003",bDetected=1),result()}meta("format","Microsoft Office")

================================================
FILE: dbs_min/db/CFBF/_CFBF.0.sg
================================================
function detect(){return sName=CFBF.getFileFormatName(),sVersion=CFBF.getFileFormatVersion(),sOptions=CFBF.getFileFormatOptions(),bDetected=1,result()}meta("format","Compound File Binary Format")

================================================
FILE: dbs_min/db/CFBF/_init
================================================
var File=CFBF,X=CFBF

================================================
FILE: dbs_min/db/COM/32-bit_crypt.2.sg
================================================
function detect(){return Binary.compare("6633c9678a81........34..2c..34..678881........6683c1..6681f9........75")&&(sOptions="by SWW //DiGiTAl FaCToRY",bDetected=1),result()}meta("protector","32-bit crypt")

================================================
FILE: dbs_min/db/COM/COM_Sccrambler.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fcbe....8bfeb9....515657b4..04..ac90902ac432c4aae2..5f5e5903f183ee..a5a4b8....5083eb..33c9")&&(sVersion="0.1",sOptions="1995 by Moshe",bDetected=1),result()}meta("protector","COM Sccrambler")

================================================
FILE: dbs_min/db/COM/Character_Intro_Engine.1.sg
================================================
function detect(){return(Binary.compare("e9$$$$2e8b26....81c4....2ea1....2ea3....0e588ec08ed88bdc83c3..b1..d3eb43b4..cd21fc")||Binary.compare("e9$$$$2e8b26....81c4....0e588ec08ed88bdc83c3..b1..d3eb43b4..cd21fc"))&&(sOptions="by //UCF",bDetected=1),result()}meta("self-displayer","Character Intro Engine")

================================================
FILE: dbs_min/db/COM/Crypt_(CyPoxl).2.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$8bfc368b2d8bcd81ed....c3")&&(sVersion="1.1",bDetected=1),result()}meta("protector","Crypt by CyPoxl")

================================================
FILE: dbs_min/db/COM/Crypt_(Dismember).2.sg
================================================
function detect(){return Binary.compare("0E179C58F6C4..74..EB..90B4..BE....BF....B9....68....68....68....57F3A4C3")?(sVersion="1.7",bDetected=1):Binary.compare("e9$$$$bf....8bf7acad918ae157ac32c4f6d0d0c412e1aae2")&&(sVersion="2.0",bDetected=1),result()}meta("protector","Crypt by Dismember")

================================================
FILE: dbs_min/db/COM/Deep_Crypter.2.sg
================================================
function detect(){return Binary.compare("90e9$$$$e80000598be981ed....81e9....be....8dbe....668b056689048dbe....8bd78bdf83c3..8a043205f6d0")&&(sVersion="0.1b",sOptions="by PLasMoiD",bDetected=1),result()}meta("cryptor","Deep Crypter")

================================================
FILE: dbs_min/db/COM/Dn.COM_Cruncher.2.sg
================================================
function detect(){return Binary.compare("33dbb5..8bf98be9be....57f3a4bf....c3")&&(sVersion="1.2",bDetected=1),result()}meta("packer","Dn.COM Cruncher")

================================================
FILE: dbs_min/db/COM/Inbuild_Encryption.2.sg
================================================
function detect(){return Binary.compare("b9....bb....2ed2072e281f43e2")&&(sVersion="1.0",sOptions="by Christoph Gabler",bDetected=1),result()}meta("protector","Inbuild Encryption")

================================================
FILE: dbs_min/db/COM/LHarc_SFX.1.sg
================================================
function detect(){return Binary.compare("eb$$fcbc....bb....e8....8cc82e0306....8ed88ec005....2e3b06....76..bb....e9....bf....33d28bc2b9....d1e873..35....e2..abfec275..be....bf....b8....ba....2e3a24")?(sVersion="1.13S, 1.13L",bDetected=1):Binary.compare("e9$$$$fcbc....bb....e8....8cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")?(sVersion="1.14c",bDetected=1):Binary.compare("e9$$$$fcbc....e8....9090908cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")&&(bDetected=1),result()}meta("sfx","LHarc SFX")

================================================
FILE: dbs_min/db/COM/Maveriks_C0der.2.sg
================================================
function detect(){return Binary.compare("e9$$$$2e8b0e....49bb....fcbe....8a26....ac32c488074388c4e2..b9....ffe1")?(sVersion="1.XX",bDetected=1):Binary.compare("e9$$$$2e8b3e....81c7....2e8b058ac82ea3....2e8a45..2ea2....be....462e8a0432c12e88048ac83bf775..e9")&&(sVersion="1.00a",bDetected=1),result()}meta("protector","Mavericks C0der")

================================================
FILE: dbs_min/db/COM/Microsoft_C.4.sg
================================================
function detect(){return Binary.compare("fab8....05....b1..d3e88ccb03c38ed88cd0a3....8bc4a3....8cd88ed0bb....8be3fb891e....b8....a3....0633c0")&&(sVersion="1.04",bDetected=1),result()}meta("compiler","Microsoft C")

================================================
FILE: dbs_min/db/COM/Microsoft_RTL.3.sg
================================================
function detect(){return Binary.compare("b430cd213c..73..c38cdf8b36....2e893e....2bf781fe....72..be....b8....05....73..e8....33c050e8....b8ff4ccd218be0")?(sVersion="1990",bDetected=1):Binary.compare("b430cd213c..73..c38cdf8b36....2e893e....2bf781fe....72..be....bb....81c3....73..e8....33c050e8....b8....cd21")&&(sVersion="1992",bDetected=1),result()}meta("library","Microsoft RTL")

================================================
FILE: dbs_min/db/COM/MrHDKiller_Protection.2.sg
================================================
function detect(){return Binary.compare("e9$$$$4851442ea1....2d....8bd805....8bf0bf....b9....90f3a48bcb")&&(sVersion="1.1p",sOptions="//eMX!",bDetected=1),result()}meta("protector","Mr.HDKiLLeR PriotectioN")

================================================
FILE: dbs_min/db/COM/PC_FORTH.4.sg
================================================
function detect(){return Binary.compare("90e9$$$$29c08ed8bb....8a072ea2....80c8..80e0..8807a1....2ea3....a1....2ea3....a1....2ea3....a1....2ea3....8cc88ed08ec08ed8a3....8b26")&&(sOptions="1983 by Laboratory Microsystems Inc.",bDetected=1),result()}meta("compiler","PC/FORTH")

================================================
FILE: dbs_min/db/COM/RDT_ENC_3.2.sg
================================================
function detect(){return COM.compare("e9$$$$be....8bfe8bce33c08ed8c706........c606......26acba....52fe0e....74..e8....d0c8fec83206....c3")&&(sOptions="by mr. Wicked",bDetected=1),result()}meta("protector","RDT_ENC 3")

================================================
FILE: dbs_min/db/COM/RTD_Compressor.2.sg
================================================
function detect(){return Binary.compare("bf....be....b5..57f3a5c3")&&(sOptions="by Mr.Wicked",bDetected=1),result()}meta("packer","RTD_compressor")

================================================
FILE: dbs_min/db/COM/RTD_Compressor2.2.sg
================================================
function detect(){return Binary.compare("fcbf....be....b5..57f3a5c3")&&(sOptions="1997 by mr. Wicked",bDetected=1),result()}meta("packer","RTD_Compressor 2")

================================================
FILE: dbs_min/db/COM/SHOW_IT.1.sg
================================================
function detect(){return Binary.compare("bf....32db2e8a150ad274..b4..cd214780fa..75..fec380fb..75..32db53b4..cd16b4..cd165b75")&&(sVersion="1.2",bDetected=1),result()}meta("self-displayer","SHOW IT")

================================================
FILE: dbs_min/db/COM/SPHINX_C--.4.sg
================================================
function detect(){return Binary.compare("58bc....50b44abb....cd2173..b409ba....cd21c38cc88ec0bf....be....31d2bb....ac3c..74")?(sVersion="1993",bDetected=1):Binary.compare("58bc....50b44abb....cd2173..c3")?(sVersion="0.203 (1994)",bDetected=1):(Binary.compare("58bc....50b44abb....cd2173..b409ba....cd21c3")||Binary.compare("eb$$31c08ec026c706........268c0e....e9$$$$c8......b8....e8")||Binary.compare("e9....'SPHINXC--'")||Binary.compare("0e07bf....be....31d2bb....ac3c..74..3c..74..3c..74..aaac"))&&(bDetected=1),result()}meta("compiler","SPHINX C--")

================================================
FILE: dbs_min/db/COM/Shade's_COM_Encryptor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$33c033db33c933d233edbf....be....b9....ac83c3..d3c38d9f....8dae....03dd")&&(sVersion="1.0",bDetected=1),result()}meta("cryptor","ShadE's COM encRYPTOR")

================================================
FILE: dbs_min/db/COM/Shadow_COM_encryptor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b9....bb....be....bf....ad33c3ab86dff7d3e2..68")&&(sVersion="1.0",sOptions="by Tailgunner",bDetected=1),result()}meta("cryptor","Shadow COM encryptor")

================================================
FILE: dbs_min/db/COM/TPC_Scramble.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b0..bb....5351b9....2e3007fec043e2..bb....c707....c647....33c033db59c3")&&(bDetected=1),result()}meta("protector","TPC Scramble")

================================================
FILE: dbs_min/db/COM/Text_Header.1.sg
================================================
function detect(){return Binary.compare("e9$$$$b9....be....bf....f3a468....c3")&&(sVersion="1.0",sOptions="from EXE2COM 9.50 by B. Vorontsov",bDetected=1),result()}meta("other","Text Header")

================================================
FILE: dbs_min/db/COM/The_DRAW.1.sg
================================================
function detect(){return Binary.compare("eb$$b40fcd10bb....3c..74..3c..74..c606......bb....3c..74..ba....b409cd21c3")?(sVersion="4.6",bDetected=1):Binary.compare("eb$$b40fcd108ccb8edbbb....b4..3c..74..3c..73..bb....8a26....3c..73..8d16")&&(bDetected=1),result()}meta("self-displayer","The DRAW")

================================================
FILE: dbs_min/db/COM/Tiny_Xor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fcb8....bb....b9....be....300402c386c486df46e2..be....c704....c644....33c033db33c9ffe6")&&(sVersion="0.52b",sOptions="by ThE DOCTOr //DiPG",bDetected=1),result()}meta("protector","Tiny Xor [tDCE]")

================================================
FILE: dbs_min/db/COM/Unknown_cryptors.2.sg
================================================
function detect(){var e
return Binary.compare("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8")?(sVersion="#01",bDetected=1):Binary.compare("e9$$$$b9....b3..be....bf....acfec332c3aae2")?(sVersion="#02",sOptions="exe 0-relocs crypt",bDetected=1):Binary.compare("'GENERATED'00'FILE'bc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")?(sVersion="#03",sOptions="GENERATED FILE",bDetected=1):Binary.compare("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07")?(sVersion="#04",bDetected=1):Binary.compare("e8$$$$fc8bec8b4e..2bc08bf9f2aebb....03d9875e..fec58bf1ac8ad0ad8bc88bfeac32c2aae2")?(sVersion="#05",bDetected=1):Binary.compare("fc525756ba....b9....be....bf....52f3a52ec606......c3")?(sVersion="#06",bDetected=1):Binary.compare("b4..be....bf....b9....68....68....68....57f3a4c3")?(sVersion="#07",bDetected=1):Binary.compare("b8....05....50c3")?(e=Binary.readWord(1)+Binary.readWord(4)-256,Binary.compare("90902ea1....8bc85005....9083e9..bf....2e8035..47495083f9..74..c3",e)&&(sVersion="#08",sOptions="xorer",bDetected=1)):Binary.compare("e9$$$$e8$$$$5e83ee..2e8984....06562e8c9c....0e070e1fb430cd213c..7d..bb....03dee8....b0..b44ccd21")?(sVersion="#11",bDetected=1):Binary.compare("e9$$$$b9....be....bf....bb....5357ad3d....74..c1c8..bb....03d933c3abe2")?(sVersion="#15",sOptions="xorer",bDetected=1):Binary.compare("e9$$$$e8$$$$5d83ed..0e1f0e07be....03f5bf....b9....f3a460be....0204463b")?(sVersion="#16",sOptions="1995 by A.V.Lemenkov",bDetected=1):Binary.compare("e9$$$$be....56b9....c704....c644....8134....4646cce2")?(sVersion="#17",sOptions="xorer",bDetected=1):Binary.compare("60bb....be....bf....8bcf03fb5781e9....f3a4c3")?(sName="Com-crypt",sVersion="#18",bDetected=1):Binary.compare("e9$$$$8b1e....81eb....b8....5053b430cd215beb")?(sVersion="#19",sOptions="by WICKED!",bDetected=1):Binary.compare("e9$$$$bf....8bf43bf776..8be7e8$$$$5f53518bdf43b9....2bcb300f43e2")&&(sVersion="#20",sOptions="(xorer) 1988 by Executive Systems, Inc.",bDetected=1),result()}meta("cryptor","Unknown cryptor")

================================================
FILE: dbs_min/db/COM/VGA_font_loader.1.sg
================================================
function detect(){return Binary.compare("e9$$$$b8....8ed8fafcbf....8b36....8e1e....b9....f3a5b8....8ed8c706........8c0e....8cc88ed8")&&(sOptions="by Pete I. Kvitek",bDetected=1),result()}meta("other","VGA font loader")

================================================
FILE: dbs_min/db/COM/VSF&K_protection.2.sg
================================================
function detect(){return Binary.compare("e9$$$$eb$$8cdb8cca8edafa8becbe....bc....bf....313c312446474c75")&&(sOptions="1992",bDetected=1),result()}meta("protector","VSF&K protection")

================================================
FILE: dbs_min/db/COM/WSP_self_update.2.sg
================================================
function detect(){return Binary.compare("bb....b4..ba....cd212e891e....b4..bb....cd2173..ba....e9")&&(sVersion="1.50",bDetected=1),result()}meta("sfx","WSP self update")

================================================
FILE: dbs_min/db/COM/WiZ_Cryptor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fa60561e8ed8be....bf....b8....8706....ab8cc88706....ab1f68....9c5880cc..509dfc")&&(sVersion="1.00a",sOptions="by SP0T //UCL",bDetected=1),result()}meta("cryptor","WiZ Cryptor")

================================================
FILE: dbs_min/db/COM/_COM.0.sg
================================================
function detect(){return COM.isVerbose()&&(sName=COM.getOperationSystemName(),sVersion=COM.getOperationSystemVersion(),sOptions=COM.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","MS-DOS")

================================================
FILE: dbs_min/db/COM/_init
================================================
var File=COM,X=COM

================================================
FILE: dbs_min/db/COM/compiler_8086_Forth_83.4.sg
================================================
function detect(){return Binary.compare("e9$$$$8cc88ed88ed08ec0a1....b0..a3....2d....a3....2d....8be8bb....031e....892f2d....a3....bb....031e....89078be0be....e9")&&(sVersion="2.1.0",sOptions="1985",bDetected=1),result()}meta("compiler","8086 Forth 83")

================================================
FILE: dbs_min/db/COM/compiler_ASIC-Basic.4.sg
================================================
function detect(){return Binary.compare("e9$$$$33dbb4..cd108916....cc90b0..ba....33c9b7..b4..cd1031d28916....b4..30ffcd1090")?(sVersion="5.0",sOptions="1994 by David Visti of 80/20 Software",bDetected=1):Binary.compare("e9$$$$33dbb4..cd108916....cc90b0..a2....ba....a0....3c..75..b4..b0..cd2172..a3")?(sOptions="by David Visti of 80/20 Software",bDetected=1):Binary.compare("e9$$$$33dbb4..cd108916....cc90fcb9....be....bf....f3a490fcb9....be....bf....f3a4")&&(sVersion="3.0",sOptions="by David Visti of 80/20 Software",bDetected=1),result()}meta("compiler","ASIC-Basic")

================================================
FILE: dbs_min/db/COM/compiler_BAT2EXEC.2.sg
================================================
function detect(){return COM.compare("eb$$fcbd....8b....8b......8b......b44acd21a1....8986")?(sOptions="by Douglas Boling",sVersion="1.5",bDetected=1):COM.compare("fcbd....8b....8b......8b......b44acd21a1....8986")&&(sOptions="by Douglas Boling",sVersion="1.2",bDetected=1),result()}meta("compiler","BAT2EXEC")

================================================
FILE: dbs_min/db/COM/compiler_BatLite.4.sg
================================================
function detect(){return Binary.compare("eb$$e8....bb....8bf3031e....891e....81fb....73..bb....8bfb891e....031e....81c3....8be3b1..d3eb43")&&(sOptions="1991-95 by Pieter A. Hintjens",bDetected=1),result()}meta("compiler","BatLite")

================================================
FILE: dbs_min/db/COM/compiler_Borland_C++.4.sg
================================================
function detect(){return(Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8....a1....8ec033c08bd88bf8b9....fcf2aee3")||Binary.compare("8cca2e8916....b430cd218b2e....1e2c..daa3....8c06....891e....892e....e8....a1....8ec033c08bd88bf8b9....fcf2aee3"))&&(sOptions="1991",bDetected=1),sLang="C++",result()}meta("compiler","Borland C++")

================================================
FILE: dbs_min/db/COM/compiler_Datalight_C.4.sg
================================================
function detect(){return Binary.compare("eb$$fab8....b9....d3e88cc903c18ed88c06....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....81fb....77")&&(sVersion="3.10 S",sOptions="by Walter Bright",bDetected=1),sLang="C",result()}meta("compiler","Datalight/Northwest C")

================================================
FILE: dbs_min/db/COM/compiler_Easy!-C.4.sg
================================================
function detect(){return Binary.compare("9c55568ccd83c5..8db6....56be....56cb")&&(sOptions="1993 by Flight Technologys",bDetected=1),result()}meta("compiler","Easy!-C")

================================================
FILE: dbs_min/db/COM/compiler_Fig-FORTH.4.sg
================================================
function detect(){return Binary.compare("90e9$$$$be....8cc88ed88b26....8ed08ec0fc8b2e....e8$$$$b0..ba....b4..cd21c3")&&(sVersion="1.0",bDetected=1),result()}meta("compiler","Fig-FORTH")

================================================
FILE: dbs_min/db/COM/compiler_ForthCMP.2.sg
================================================
function detect(){return Binary.compare("90e9$$$$8cc88ed08ec08ed8bc....b430cd2180f8..73..ba....b409cd2131c0cd218cc881c0....8b1e....81eb....39d8")&&(sOptions="1995 by Thomas Almy",bDetected=1),Binary.compare("e9$$$$bc....c706........bd....892e....fce8....b8....cd21")&&(sVersion="2.1",sOptions="by Thomas Almy",bDetected=1),Binary.compare("e9$$$$bc....c706........bd....892e....b4..bb....cd21fce8")&&(sVersion="2.1",sOptions="by Thomas Almy",bDetected=1),result()}meta("compiler","ForthCMP")

================================================
FILE: dbs_min/db/COM/compiler_ForthCMP.4.sg
================================================
function detect(){return Binary.compare("90e9$$$$8cc88ed08ec08ed8bc....b430cd2180f8..73..ba....b409cd2131c0cd218cc881c0....8b1e....81eb....39d8")&&(sOptions="1995 by Thomas Almy",bDetected=1),Binary.compare("e9$$$$bc....c706........bd....892e....fce8....b8....cd21")&&(sVersion="2.1",sOptions="by Thomas Almy",bDetected=1),result()}meta("compiler","ForthCMP")

================================================
FILE: dbs_min/db/COM/compiler_GP-FORTH.4.sg
================================================
function detect(){return Binary.compare("e9$$$$8cc88ed8a1....a3....a1....a3....e8$$$$a1....3d....74..0306....72..a3....b1..d3e8408ccb8ec35003d8")&&(sVersion="93.9-94.7",sOptions="1990-94 by Golden Porcupine Software",bDetected=1),result()}meta("compiler","GP-FORTH")

================================================
FILE: dbs_min/db/COM/compiler_Lattice_C.4.sg
================================================
function detect(){return Binary.compare("fab8....05....b1..d3e88ccb03c38ed88ed0")?(Binary.compare("a3....bc....fbfc8cd88cc92bc1b1..d3c0a3....8126",19)||Binary.compare("bc....fb8cd88cc92bc1b1..d3c0a3....8126",19)?sVersion="3.0":Binary.compare("bc....fbb430cd210ac075",19)?sVersion="2.1":Binary.compare("268b1e....2bd8f7c3....75..b1..d3e3eb..bb",19)?sVersion="1.01":Binary.compare("bb....2bd8f7c3....75..b1..d3e3eb..bb",19)&&(sVersion="1.0"),bDetected=1):Binary.compare("eb$$fab8....05....b1..d3e88ccb03c32ea3....8ed88ed0bc....fbb430cd21")?(sVersion="2.1",bDetected=1):Binary.compare("b8....05....b1..d3e88ccb03c38ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb")?(sVersion="1.01",bDetected=1):Binary.compare("e9$$$$e8....8cc88ec0eb$$fab8....05....b1..d3e88ccb03c38ed88ed0bc....fbb430cd21")&&(sVersion="2.1",bDetected=1),result()}meta("compiler","Lattice C")

================================================
FILE: dbs_min/db/COM/compiler_MICRO-C.4.sg
================================================
function detect(){return(Binary.compare("bb....b44acd21bc....be....bf....bb....b9....8a043c..74..3c..75..46eb")||Binary.compare("bb....b44acd2133c08be0bf....b9....2bcff3aabe....bf....bb....b9....8a043c..74..46"))&&(sOptions="by Dave Dunfield",bDetected=1),result()}meta("compiler","MICRO-C")

================================================
FILE: dbs_min/db/COM/compiler_MINIFORTH.4.sg
================================================
function detect(){return Binary.compare("e9$$$$fc33c08bd8a3....89c52d....a3....89c4b8....a3....891e....be....adffe0")&&(sVersion="1.0",sOptions="1988 by Ted Beach",bDetected=1),result()}meta("compiler","MINIFORTH")

================================================
FILE: dbs_min/db/COM/compiler_MoonRock.2.sg
================================================
function detect(){return Binary.compare("bc....bb....b1..d3eb81c3....b4..cd2172..b8....cd212e891e....2e8c06....b8....ba....cd21")&&(sVersion="0.52.b01",sOptions="1994-2000 by Rowan Crowe",bDetected=1),result()}meta("compiler","MoonRock")

================================================
FILE: dbs_min/db/COM/compiler_OUTFORTH.4.sg
================================================
function detect(){return Binary.compare("90e9$$$$29c08ed8bb....8a0780c8..80e0..88078cc88ed08ec08ed8a3....ba....b4..b0..cd21ba....b4..b0..cd21be....8b26....8b2e....fce9")&&(sOptions="1989 by Norman L. Hills",bDetected=1),result()}meta("compiler","OUTFORTH")

================================================
FILE: dbs_min/db/COM/compiler_PBFC.2.sg
================================================
function detect(){return Binary.compare("eb$$90fcbd....8b....8b......8b......b44acd21a1....8986")&&(sOptions="1993, 2003 by Kinglion Software Workroom",sVersion="1.6c",bDetected=1),result()}meta("compiler","Personal Batch File Compiler")

================================================
FILE: dbs_min/db/COM/compiler_RMCOBOL.4.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$e8$$$$5a2e8c1e....b1..bb....81c3....f6c3..74..83c3..81e3....58fa8be3fb50d3eb52062e8e06....8bd3")&&(sVersion="2.2",sOptions="1985 by Ryan-McFarland Corp.",bDetected=1),sLang="Cobol",result()}meta("compiler","RM/COBOL")

================================================
FILE: dbs_min/db/COM/compiler_SP-FORTH.4.sg
================================================
function detect(){return Binary.compare("8b26....8bec83ed..e9$$$$e8$$$$83ed..8976..5eadffe0")?(sVersion="1.01",sOptions="1992 by Stroyprogress Ltd.",bDetected=1):Binary.compare("8b26....8bec83ed..e9$$$$e8$$$$87ec5687ec5eadffe0")&&(sVersion="1.5",sOptions="1993",bDetected=1),result()}meta("compiler","SP-FORTH")

================================================
FILE: dbs_min/db/COM/compiler_Surpas-86.4.sg
================================================
function detect(){return Binary.compare("e9$$$$e9$$$$b8....05....25....b1..d3e88cca03d08eda2ea1....2bc2a3....33db2d....73..8b1e....b1..d3e333c0")&&(sVersion="1.0",sOptions="1987 by Tixaku Pty Ltd",bDetected=1),result()}meta("compiler","Surpas-86 (Pascal compiler)")

================================================
FILE: dbs_min/db/COM/compiler_TCOM.4.sg
================================================
function detect(){return(Binary.compare("8cc805....8ed88ed0b8....8be0a3....b8....8bf0a3....c704....2d....a3....bb....8bebe8")||Binary.compare("8cc805....8ed88ed08ec08b1e....81c3....8bf3891e....83c3..891e....c707....81c3....8be3891e....83c3..891e....c706"))&&(sOptions="by Tom Zimmer",bDetected=1),result()}meta("compiler","Forth Target COMpiler")

================================================
FILE: dbs_min/db/COM/compiler_Turbo_C++.4.sg
================================================
function detect(){return Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8....c43e....8bc78bd8b9....fcf2ae")&&(sVersion="1990",bDetected=1),result()}meta("compiler","Turbo C++")

================================================
FILE: dbs_min/db/COM/compiler_Turbo_C.4.sg
================================================
function detect(){return Binary.compare("8cca2e8916....8b2e....8b1e....8eda8c06....892e....e8....8cda2bea8b3e....81ff....73..bf....893e")?(sVersion="1988",bDetected=1):Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c706")?(sVersion=Binary.compare("8e",42)?"1987":"1988",bDetected=1):Binary.compare("8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....8cda")?(sOptions="1990",bDetected=1):Binary.compare("e9$$$$8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8....c43e")?(sVersion="1990",bDetected=1):Binary.compare("fb8cca2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c706........e8")?(sVersion="1987",bDetected=1):Binary.compare("8cca2e8916....e8....8cda2bea8b3e....81c7....72..b1..d3ef473bef72..833e......75..bf....3bef")&&(bDetected=1),result()}meta("compiler","Turbo C")

================================================
FILE: dbs_min/db/COM/compiler_Turbo_Pascal.4.sg
================================================
function detect(){return(Binary.compare("e9$$$$e8$$$$e8$$$$b430e8$$$$80fc..74..80fc..74..80fc..74..80fc..74..55")||Binary.compare("e9$$$$e8$$$$..8cc82e03....2e03....2e03....2e3b06....76")||Binary.compare("e9$$$$eb$$e8....b8....b1..d3e88cca03d08eda2ea1....2bc2a3")||Binary.compare("e9$$$$e9$$$$b8....b1..d3e88cca03d08eda2ea1....2bc2a3")||Binary.compare("e9$$$$c706............................8b0c39c174..4e4ef3a5")||Binary.compare("e9$$$$e8$$$$1ee8$$$$5051b8....b1..d3e88cc903c18ed85958c3"))&&(sVersion="3.0",sOptions="1985",bDetected=1),result()}meta("compiler","Turbo Pascal")

================================================
FILE: dbs_min/db/COM/compiler_UNIFORTH.4.sg
================================================
function detect(){return Binary.compare("90e9$$$$8cc88ed88ed08ec0fc8b26....8b2e....8b3e....893e....ba....b8....cd21ba....b8....cd218b1e....8d4f..894d..8b0e....8bc1")&&(sOptions="1985 by Unified Software Systems",bDetected=1),result()}meta("compiler","UNIFORTH")

================================================
FILE: dbs_min/db/COM/compiler_Vienna-C.4.sg
================================================
function detect(){return Binary.compare("90e9$$$$8cc88ed8e8....803e......75..8a3e....883e....8b1e....891e....a3....8ec00306....8ed0a3....8b26....8b2e....be....c706")&&(bDetected=1),result()}meta("compiler","Vienna-C")

================================================
FILE: dbs_min/db/COM/compiler_Watcom_C.4.sg
================================================
function detect(){return Binary.compare("e9$$$$fb8cc98ec126bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8....01c383c3..80e3..8ed189dc26891e....89dad1")?(sName+="/C++16",sVersion="1994",bDetected=1):Binary.compare("e9$$$$fb8cc98ec1bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8....03d883c3..80e3..8ed18be326891e....8bd3d1ea")?(sName+="/C++16",sVersion="1993",bDetected=1):Binary.compare("e9$$$$fb8cc9bb....8ec1268c1e....26a1....3d....73..b8....03d88ed18be326891e....83c3")?(sName+="/C++16",sVersion="1988",bDetected=1):Binary.compare("e9$$$$fb8cc98ec1bb....83c3..83e3..26891e....268c1e....26a1....3d....73..b8....03d88ed18be326891e....83c3..83e3..8bd3d1ea")?(sVersion="1991",bDetected=1):Binary.compare("e9$$$$0e0e1f07b4..ba....cd21ba....cd21e8....803e......74..b4..ba....cd21e9")?(sName+="/C++32",sVersion="1995",bDetected=1):Binary.compare("eb$$fb8cc98ec1bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8........83c3..80e3..8ed1")?(sName="Open Watcom C/C++16",sVersion="2002 by Sybase, Inc.",sOptions="type 1",bDetected=1):Binary.compare("eb$$fb8cc98ec1bb....83c3..80e3..891e....8c1e....a1....3d....73..b8....03d883c3..80e3..8ed1")?(sName="Open Watcom C/C++16",sVersion="2002 by Sybase, Inc.",sOptions="type 2",bDetected=1):Binary.compare("eb$$fb8cc98ec126bb....83c3..80e3..26891e....268c1e....26a1....3d....73..b8........83c3..80e3..8ed1")&&(sName="Open Watcom C/C++16",sVersion="2002 by Sybase, Inc.",sOptions="type 3",bDetected=1),result()}meta("compiler","Watcom C")

================================================
FILE: dbs_min/db/COM/compiler_Zbikowski_C.4.sg
================================================
function detect(){return Binary.compare("8975..8a0430e48946..408bf88a85....30e425....74..8b46..2d....eb..8b76..8a0430e42d....8346")&&(sOptions="1983 by Mark Zbikowski (Microsoft Corp.)",bDetected=1),result()}meta("compiler","Zbikowski C")

================================================
FILE: dbs_min/db/COM/compiler_Zortech_C.4.sg
================================================
function detect(){return Binary.compare("eb$$fab8....05....b9....d3e88cc903c18ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd881fb....72")?(sVersion="2.10",sOptions="1990 by Walter Bright",bDetected=1):Binary.compare("eb$$fcbe....b9....8b3e....5703f981c7....57f3a45f81c7....ffe7")||Binary.compare("eb$$8cc883c0..50b8....50cbfc8e06....b0..b9....33fff2aeae75..4747be....e8")?(sVersion="2.00",sOptions="1990 by Walter Bright",bDetected=1):Binary.compare("eb$$fab8....05....b9....d3e88cc903c1dbe38ed88c06....8bd82b1e....891e....268b1e....2bd8")&&(sVersion="4.00",sOptions="by Walter Bright",bDetected=1),result()}meta("compiler","Zortech C")

================================================
FILE: dbs_min/db/COM/compiler_muSIMP-83.4.sg
================================================
function detect(){return Binary.compare("e9$$$$8cc88ed88ed0bc....a3....ba....e8....c606......e8....803e......75..0e17bc....e8....e8....eb")&&(sVersion="4.12",sOptions="1985 by The SOFT WAREHOUSE",bDetected=1),result()}meta("compiler","muSIMP-83")

================================================
FILE: dbs_min/db/COM/converter_A3E.1.sg
================================================
function detect(){return Binary.compare("1e33c050be....81c6....b8....8ec0bf....b9....f3a5cb")&&(sOptions="1992 by JHSoft",bDetected=1),result()}meta("converter","A3E (text2com)")

================================================
FILE: dbs_min/db/COM/converter_AutoCracker.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$be....e8$$$$5133c9ac3c..74..32c8d1e1b4..8ad03c..74..cd21eb")&&(sVersion="1.X",sOptions="1997 Dmitry Gorshkov",bDetected=1),result()}meta("converter","AutoCracker")

================================================
FILE: dbs_min/db/COM/converter_COM2TXT.1.sg
================================================
function detect(){return Binary.compare("'XP5~~-~}P]XP-@?->@1Fq1Fx0F6,00F7,b(F8ZRu(XP2FzE,@r42fzWBxG!='")&&(sOptions="1997 by GyikSoft",bDetected=1),result()}meta("converter","COM2TXT")

================================================
FILE: dbs_min/db/COM/converter_COMT.1.sg
================================================
function detect(){return Binary.compare("'ENC.COM.B&F='")&&(sVersion="0.1d",sOptions="(com2text) by Alex Pruss",bDetected=1),result()}meta("converter","COMT")

================================================
FILE: dbs_min/db/COM/converter_CRX2COM.1.sg
================================================
function detect(){return Binary.compare("e9$$$$8b1e....c1....81c3....e8....b4..ba....cd21bb....e8....b4..ba....cd21b8....ba....cd2173")&&(bDetected=1),result()}meta("converter","CRX2COM")

================================================
FILE: dbs_min/db/COM/converter_E2C.1.sg
================================================
function detect(){return Binary.compare("be....bf....b9....57f3a5c3")?(sVersion="1.00-1.02",bDetected=1):Binary.compare("be....bf....b9....fc57f3a5c3")&&(sVersion="1.02a",bDetected=1),result()}meta("converter","E2C (EXE2COM) by The DoP")

================================================
FILE: dbs_min/db/COM/converter_EXE2COM.1.sg
================================================
function detect(){return Binary.compare("e9$$$$bf....be....a5a48cda83c2..50b9....ad970115e2")?(sVersion="1.0",sOptions="by D'B",bDetected=1):Binary.compare("e9$$$$e800005b508cc005....8b0e....03c889....8b0e")?(sVersion="1.0",sOptions="by Microsoft",bDetected=1):Binary.compare("b3..b9....33d2be....8bfeac32c3aa434932e403d0e3..eb..3b16....75..be....8bc6b1..d3e88cdb03c30344..a3....8cc805")?(sOptions="CRC check",bDetected=1):Binary.compare("e8$$$$bf....be....a5a48cda83c2..0116....81c2....8ed2bc....eb")?(sOptions="by //ViP",bDetected=1):Binary.compare("e9$$$$bf....be....a5a48cda83c2..50b4..bb....cd21580116....81c2....8ed2")?(sOptions="0-Relocs by dR.No //ViP",bDetected=1):Binary.compare("e9$$$$bf....be....a5a48cda83c2..0116....81c2....8ed2bc....eb..ea")?(sOptions="0-Relocs by Sage //UCF",bDetected=1):Binary.compare("e9$$$$e800005b81eb....8db7....bf....b9....f3a58db7....538ccf83c7..ad")?(sVersion="2.0",sOptions="by Paul Shpilsher",bDetected=1):Binary.compare("e9$$$$8cca81c2....3b16....76..ba....b409cd21cd20")?(sOptions="generic, type 1",bDetected=1):Binary.compare("be....8b043d....74..ba....b409cd21cd208bc6b1..d3e88cdb03c303....a3....8cc805....a3....8b44")?(sOptions="by RaskY",bDetected=1):Binary.compare("bf....be....b9....fcf3a4068ccb83c3..011e....011e....b9....8b54..03d381c2....8ec28b3c")||Binary.compare("bf....be....b9....fcf3a48ccb011e....011e....eb00bf....be....b9....bb....bd....fa")?(sVersion="1.0",sOptions="by Milkov",bDetected=1):Binary.compare("eb$$be....8bc6b1..d3e88cdb03c30344..89048cc805....8be88b44..b1..d3e803c50344..bb....8b1f")?(sOptions="by JauMing Tseng",bDetected=1):Binary.compare("e8$$$$bf....be....a5a48cda83c2..50b4..bb....cd21b9....ad970115e2")?(sVersion="1.0d",sOptions="1994 by D'B",bDetected=1):Binary.compare("e9$$$$92be....bf....fca5a48ccb83c3..b9....ad97011de2")?(sOptions="1996 by EM-Phaser",bDetected=1):Binary.compare("b430cd213c..73..33c00650cb")?(sOptions="by JVP",bDetected=1):Binary.compare("bf....be....b9....f3a48cd805....0344..8ccb9305....8be60364..8b4c..e3..5f5a")?(sName="CC",sVersion="2.61 beta",sOptions="EXE2COM",bDetected=1):Binary.compare("e8$$$$bf....be....a5a48cda83c2..50b4..bb....cd21580116....81c2....8ed2bc....eb")?(sOptions="by unknown",bDetected=1):Binary.compare("e9$$$$e9$$$$8cca81c2....3b16....76..ba....b409cd21cd20")?(sOptions="generic, type 2",bDetected=1):Binary.compare("be....8b043d4d5a74$$8bc6b1..d3e88cdb03c30344..a3....8cc8")&&(sOptions="by BuZZ Soft",bDetected=1),result()}meta("converter","EXE2COM")

================================================
FILE: dbs_min/db/COM/converter_EXETools_EXE2COM.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e800005d8bcd83ed..bf....be....2bcff3a4b9....be....03f5e3..8cdb035e..ad8bf8011de2")?(sVersion="2.0, 2.1",bDetected=1):Binary.compare("68....68....68....68....68....68....5fbe....b9....f3a4c3")&&(sOptions="com header from EXETools 2.1",bDetected=1),result()}meta("converter","EXETools EXE2COM")

================================================
FILE: dbs_min/db/COM/converter_FIXCRK.1.sg
================================================
function detect(){return Binary.compare("'ROMANOID'32e4b0..cd104c5abf....c606......bd....e8....c606......bf....bd....e8....bd....c606......bf")&&(sOptions="by romanoid",bDetected=1),result()}meta("converter","FIXCRK")

================================================
FILE: dbs_min/db/COM/converter_FromBAT.1.sg
================================================
function detect(){return Binary.compare("e9$$$$be....bf....bb....c604..b9....fe04803c..77..c644....b80629cd21be....3c..74..8a04880743e2")&&(sOptions="1991 by Clockwork Software",bDetected=1),Binary.compare("e9$$$$fcbe....bf....bb....c604..b9....fe04803c..77..c644....b80629cd21be....3c..74..8a04880743e2")&&(sName="BatchMaster",sOptions="1993 by Clockwork Software",bDetected=1),result()}meta("converter","FromBAT")

================================================
FILE: dbs_min/db/COM/converter_MAKEBOO.1.sg
================================================
function detect(){return Binary.compare("'XPHPD[0GG0G,0G51G31GB'27'(G+(G:u'27'0g?(G>(GE1G@arwIV_F*=US@<1|_,5wXNg-7muTu(4'")&&(sOptions="executable2text",bDetected=1),result()}meta("converter","MAKEBOO")

================================================
FILE: dbs_min/db/COM/converter_NetCode.1.sg
================================================
function detect(){return Binary.compare("'T_OOWW3=XXWX5 2PY5w3P_-l.P-KD1Ep-OLPZ-pJP-pw40PQX5fsPu'")?(sVersion="1.11",sOptions="by JauMing Tseng //Nide",bDetected=1):Binary.compare("':?7%00%CCPY-@=PZ5+")&&(sVersion="1.40",sOptions="by JauMing Tseng //Nide",bDetected=1),result()}meta("converter","NetCode")

================================================
FILE: dbs_min/db/COM/converter_NetRun.1.sg
================================================
function detect(){return Binary.compare("'XPPPYZIQD[L-f6-g41GDSXu'17'@,~P^P_O,!(GU(GZ(Gnu5'")&&(sVersion="3.10",bDetected=1),result()}meta("converter","NetRun")

================================================
FILE: dbs_min/db/COM/converter_TurboBAT.1.sg
================================================
function detect(){return Binary.compare("ba....b4..909006b8....8ec0b9....268a26....80e4..26a0....24..3ac4")?(sVersion="3.10",bDetected=1):Binary.compare("e9$$$$fcbd....8b6e..8b66..8b5e..b4..cd21a1....8946..b8....50c646....8b5e..ffe3")?bDetected=1:Binary.compare("9090909090909006b8....8ec0b9....268a26....80e4..26a0....24..3ac474..26a0....24")?(sOptions="unregistered",bDetected=1):Binary.compare("ba....b4..cd2106b8....8ec0b9....268a26....80e4..26a0....24..3ac474..26a0....24")&&(sVersion="3.16-9u",bDetected=1),result()}meta("converter","TurboBAT")

================================================
FILE: dbs_min/db/COM/converter_Vacsina.4.sg
================================================
function detect(){return Binary.compare("e9$$$$e8....5b508cc005....8b0e....894f..8b0e....03c8894f..8b0e....894f..8b0e....03c8894f..8b3e....8b16")&&(bDetected=1),result()}meta("converter","Vacsina EXE2COM")

================================================
FILE: dbs_min/db/COM/converter_XCK2COM.1.sg
================================================
function detect(){return Binary.compare("e9$$$$be....e8....ad89c15156e8....be....e8")&&(bDetected=1),result()}meta("converter","XCK2COM")

================================================
FILE: dbs_min/db/COM/cryptor_Anti-Lamer_Cryptor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fa8cd3ba....8ed233d28ed38bdafb33c08ec026f716....eb")&&(sVersion="1.0",sOptions="1999 by Ozzman //iHC",bDetected=1),result()}meta("cryptor","Anti-Lamer Cryptor")

================================================
FILE: dbs_min/db/COM/cryptor_CSCRYPT.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e8000059eb$$cceb$$e4..bb....ba....eb$$81eb....0c..2bcb")&&(sVersion="3.30",sOptions="by Christian Schwarz",bDetected=1),result()}meta("cryptor","CSCRYPT")

================================================
FILE: dbs_min/db/COM/cryptor_EXINCT.2.sg
================================================
function detect(){return Binary.compare("e8$$$$ba....b8....cd218bd8b8....33c933d2cd2191b4..cd218bdc8b072d....89078bf05603f183ee..8904")&&(sOptions="by Razor 1911",bDetected=1),result()}meta("cryptor","EXINCT")

================================================
FILE: dbs_min/db/COM/cryptor_J0B_cryptor.2.sg
================================================
function detect(){return(Binary.compare("e9$$$$fabe....8d0e....2bcee8$$$$5051ba....8bda301cac32c35183c4..b9")||Binary.compare("e9$$$$be....e8$$$$5052ac8a26....28e00ac0"))&&(sOptions="1996",bDetected=1),result()}meta("cryptor","J0B cryptor")

================================================
FILE: dbs_min/db/COM/cryptor_PU-Cryptor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fce8$$$$068cc8a3....b0..bf....b9....263005fec047e2")?(sOptions="1994",bDetected=1):Binary.compare("e9$$$$fcb0..bf....b9....300547e2")?(sOptions="1992",bDetected=1):(Binary.compare("e9$$$$fcb0..bf....b9....263005fec047e2")||Binary.compare("e9$$$$fcbc....e8$$$$068cc8a3....b0..bf....b9....263005fec047e2")||Binary.compare("e9$$$$bc....fce8$$$$068cc8a3....b0..bf....b9....263005fec047e2"))&&(sOptions="1994",bDetected=1),result()}meta("cryptor","PU-Cryptor")

================================================
FILE: dbs_min/db/COM/cryptor_Phrozen_Crew_cryptor.2.sg
================================================
function detect(){return Binary.compare("e9$$$$eb$$be....8b3c83ef..578bf781c6....83c6..bf....a5a55f83ef..5733f6bd....33c9300a414f8bf175..5f83ff..74")&&(sOptions="1998",bDetected=1),result()}meta("cryptor","Phrozen Crew cryptor")

================================================
FILE: dbs_min/db/COM/cryptor_SDW.2.sg
================================================
function detect(){return Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....75..e8")?(sVersion="1.7X",sOptions="by MANtiC0RE",bDetected=1):Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....74..50584c4c5b33c3")?(sVersion="1.78",sOptions="by MANtiC0RE",bDetected=1):Binary.compare("e9$$$$ac2d....04..89c5e8....f514..f9362633f6")?(sVersion="1.79",sOptions="by MANtiC0RE",bDetected=1):Binary.compare("e9$$$$e9$$$$e4..e8....e4..e9$$$$26fb78")?(sVersion="1.7",sOptions="by MANtiC0RE",bDetected=1):(Binary.compare("b8....bd....2e8a76..80f6..80ee..2e8876..83c5..4874..eb")||Binary.compare("be....31d281c2....2e8034..83ee..83c2..74..31c005....50c3"))&&(sVersion="1.80",sOptions="by MANtiC0RE",bDetected=1),result()}meta("cryptor","Shadow Com Cryptor (SDW)")

================================================
FILE: dbs_min/db/COM/cryptor_Sydex.2.sg
================================================
function detect(){return Binary.compare("eb$$ba....b8....bb....33ed8bf8434f505952494748542053..4445582c..414c4c")||Binary.compare("e9$$$$ba....b8....bb....33ed8bf8434f505952494748542053..4445582c..414c4c")?(sOptions="1987 by Sydex and C.P.Guzis",bDetected=1):Binary.compare("e9$$$$33c09e8bd88bc88bd08be88bf08bf88cc88ed88ec08ed08d26....8d36")&&(sOptions="1986,1987 by Sydex and C.P.Guzis",bDetected=1),result()}meta("cryptor","Sydex cryptor")

================================================
FILE: dbs_min/db/COM/cryptor_UComCry.1.sg
================================================
function detect(){return Binary.compare("e9$$$$6006fae4640c40e664b8....8ec026c706")&&(sOptions="by UniquE",bDetected=1),result()}meta("cryptor","UComCry")

================================================
FILE: dbs_min/db/COM/cryptor_USCC.2.sg
================================================
function detect(){return Binary.compare("e9$$$$60bb....b9....300f43e2")&&(sVersion="1.4",sOptions="by UniquE",bDetected=1),result()}meta("cryptor","Shitty COM Cryptor")

================================================
FILE: dbs_min/db/COM/cryptor_cryptors.2.sg
================================================
function detect(){var e
return Binary.compare("e9$$$$60c704....c644....b9....bf....ac32018bd64a")?(sVersion="0.04",sOptions="by SkullC0DEr",bDetected=1):Binary.compare("e9$$$$60c704....c644....e8$$$$5f83c7..33dbb9....8a043201")?(sName="crypt 95-97",sOptions="type 2 by SkullC0DEr",bDetected=1):Binary.compare("e800005dbf....e8$$$$fa065733ff57078d76..b9....8004..46e2")?(sOptions="by Synopsis",bDetected=1):Binary.compare("eb$$fdbf....ba....33c01e8ed8a3....1fb1..525e3bfa74..ac3205aae2..eb")?(sOptions="by Min-Jei-Chen",bDetected=1):Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....eb$$ad2ea3....2e3136....8bc18bdef7e3eb$$2e3106....2e3116....2ea1....abe2")?(sOptions="by PHOENiX",bDetected=1):Binary.compare("5053515756b8....508bf0b9....b0..8bfe0004f71404..46e2")?(sOptions="by FalCoN'AleX",bDetected=1):Binary.compare("40429c58f6c4..74..eb....b4..be....bf....b9....68....68....68....57f3a4c3")?(sOptions="by Terrible BloodSucker //FDs Group",bDetected=1):Binary.compare("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2")?(sName+=" N1",sOptions="by ZeroCoder //XG",bDetected=1):Binary.compare("be....b9....ac03d8e2..81fb....74..cd19be....8bfeb9....8a26....ac32c1aae2")?(sOptions="by Kai",bDetected=1):Binary.compare("eb$$c606......f873..e9$$$$be....bf....0633c08ec0bb....fa268b07268917a3")?(sName+=" N2",sOptions="by ZeroCoder //XG",bDetected=1):Binary.compare("e9$$$$e800002e9c589e72..fa9cfc505393584c4c3bc35b74..9de8....32e480c4")?(sOptions="by Digital Information Pirates Group (DiPG)",bDetected=1):Binary.compare("'PHROZEN'fa'CREW'0d....fbfdbe....ac300481fe....77..94")?(sOptions="by Phrozen Crew",bDetected=1):Binary.compare("0e1fb9....be....80....301c46e2..eb")?(sOptions="by Dwolf //ROK",bDetected=1):Binary.compare("2e8036....28eb00c3")?(sName+=" #2",sOptions="by Misha",bDetected=1):Binary.compare("be....e8$$$$5d8bce8d72..bf....fd5747acaa86c4ac32c4aae2..8d75..fcf98d7e..c3")?(sOptions="by TGT",bDetected=1):Binary.compare("e9$$$$33dbb9....d1e941b8....8b97....33c28987....924343e2..68....c3")?(sOptions="by hijaq",bDetected=1):Binary.compare("e9$$$$0e179c58f6c4..75..b9....b8....2bc8bf....be....8a0551b9....8ae0862432c44ee2..88054759e2..e9")?(sOptions="1996 by WildRover",bDetected=1):Binary.compare("668d3e....66b9........678137....6683c7..e2..e9")?(sOptions="by PCY group",bDetected=1):Binary.compare("e9$$$$66b8........66a3....be....8bfeb9....fcad35....f7d0abe2..68....c3")?(sOptions="by Evil Genius //rPG",bDetected=1):Binary.compare("e9$$$$9cfafc1e06bb....b44acd21b448bb....cd218ec0be....b9....51bf....57f3a5061fb9....5e8bfe")?(sOptions="by AliS S0fT //VCrT",bDetected=1):Binary.compare("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d")?(sVersion="#2",sOptions="by RAZOR 1911",bDetected=1):Binary.compare("'SNOWPANTHER'e9$$$$................8db7....bf....b9....f3a58db7....538ccf83c7..ad09c074..91ad")?(sName+=" #1",sOptions="by Snow Panther //DTG",bDetected=1):Binary.compare("fcbe....bf....b9....90ba....c606......90ac0fb61e....03da8a2732c4aafe06....803e......75..c606")?(sOptions="by pASkuda",bDetected=1):Binary.compare("e9$$$$50538bdc8cd0bc....8ed49090909090909090909090909090909033e48ed4bc....909090909090909090909090909090908ed08be35b58c606")?(sOptions="by Crack Soft",bDetected=1):Binary.compare("e9$$$$16179c58f6c4..74..faeb..e8$$$$58")?(sVersion="1.0",sOptions="1999 by Alex",bDetected=1):Binary.compare("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35")?(sOptions="by DREAMMASTER",bDetected=1):Binary.compare("b8....ffe0")?(e=Binary.readWord(1)-256,Binary.compare("be....8be88bd88bf883c5..908bd04a5287d687fe5981e9....52",e)&&(sOptions="by BlackLight, MANtiCORE",bDetected=1)):Binary.compare("'FALCON//TULACREW'0d....e9$$$$be....b9....33c0f7d03004eb..04..32e046e2")?(sOptions="by FALCON //UCL",bDetected=1):Binary.compare("bb....b9....be....301c02df86df46e2")?(sName+=" #1",sOptions="by dR.No",bDetected=1):Binary.compare("be....b9....b8....bb....33c34086c44b86fb93300446e2")?(sName+=" #2",sOptions="by dR.No",bDetected=1):Binary.compare("a3....eb$$5351525756b9....fa8bdc8cd2bc....03e1d1e94c4c5886e9d3c033c186e9f7d050e2")?(sOptions="by venus soft.",bDetected=1):Binary.compare("e9$$$$3aac....3a29fc1aa8....80cd..1e0e0e1f0726fe06....ba....be....81f6....80f9")?(sName+=" #1",sOptions="by LiGHt DRUiD //SOS",bDetected=1):Binary.compare("e9$$$$fd1e0e81de....89f63bf23aaf....03f423f61bf40a2d80f9..18dd0e071f03f433f081e6")?(sName+=" #2",sOptions="by LiGHt DRUiD //SOS",bDetected=1):Binary.compare("fcbe....8bfeac3206....8006......84c0aa75..be....e8")?(sOptions="by Sludge Vohaul //DAT",bDetected=1):Binary.compare("'[HPA]'b5..8bf98be9be....57f3a4c3")?(sOptions="by Hungarian Pirates Alliance [HPA]",bDetected=1):Binary.compare("bc....bb....b4..cd21bb....b9....8037..43e2..b409ba....cd21b8....cd21891e")?(sOptions="by .EXEcutor //SOS",bDetected=1):Binary.compare("e9$$$$e800005b8bcc8cd2fa33c08ec08ed0bc....588947..90588947..900e8bc305....508ed28be1fb")?(sOptions="1998 by Demon Magister Protection",bDetected=1):Binary.compare("eb$$2ea3....8cc82e0306....502eff36....cb")?(sOptions="1991 by YMI",bDetected=1):Binary.compare("53515256570633c08ec0fa26a1....268b16....fb075052b8....06508cca33c08ec058fa26a3....268916....fb07")?(sOptions="1991 by Elisoft",bDetected=1):Binary.compare("b8....5650c3")?(e=Binary.readWord(1)-256,Binary.compare("bf....8bdeb9....8b0533c689074747434346e2..c3",e)&&(sOptions="by PC0R$AiR //UCL",bDetected=1)):Binary.compare("908cc8515a54e9$$$$36c0e0..eb$$eb$$6a..e8$$$$58eb$$e8$$$$58eb$$e8$$$$eb$$2eeb$$eb$$665eeb$$eb$$7c")||Binary.compare("0f011e....fbe9$$$$e90000c0c3..f8eb$$6a..c0e9..e800000f23dae8000059665e36e8")?(sName="Rowdy's Strong Protection {MtE}",bDetected=1):Binary.compare("fa499033c0fbe9$$$$e800005eeb")?(sName="Rowdy's Strong Protection",bDetected=1):Binary.compare("e9$$$$5060bf....c706........c605..e8....5e5681c6....b9....5756ffe7")?(sOptions="1998 by StrangeLion",bDetected=1):Binary.compare("e8$$$$5f87f757b9....ac34..aae2..c3")?(sName="Wumpus soft lab cryptor",bDetected=1):Binary.compare("e8$$$$5eb9....ac32c12e8844..e2..e9")?(sOptions="by MXL //RIP",bDetected=1):Binary.compare("e9$$$$8d36....fd8d0e....81e9....d1e9add1c835....8944..e2..ff26")?(sOptions="1989 by Sydex",bDetected=1):Binary.compare("e9$$$$bb....b4..b0..8b0e....8a1728c230e28857..43fec0e2")?(sOptions="1999 by SLine",bDetected=1):Binary.compare("'(C)1997'00'by'00'PSH'0d0a..005b..3139287a..2850..81c6....33db8bfeb9....ad35")?(sOptions="1997 by PSH",bDetected=1):Binary.compare("e9$$$$bf....be....b9....b0..2e8a1c32c132d82e881d4647e2..e9")?(sName="SAGE-crypt",bDetected=1):Binary.compare("e9$$$$fcb0..bf....b9....263005fec047e2..b9....be....e8")?(sName="PU-Disk encryption",sOptions="1992",bDetected=1):Binary.compare("e9$$$$bb....8a073c..74..e8$$$$50515234..3c..74..b4..8ad0cd21e9")?(sOptions="1999 by Leon",bDetected=1):Binary.compare("fa'SNOW'fa'PANTHER'fabc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")?(sName+=" #2",sOptions="by Snow Panther //DTG",bDetected=1):Binary.compare("e9$$$$c704....c644....b9....5683c6..8bfeb2..b6..ac32c202d6aae2..c3")?(sOptions="1997 by Ment0R //UCL",bDetected=1):Binary.compare("eb$$bb....8b0f03d981c3....8be38cc88ed88ec08ed0b8....ba....cd21b3..ccb3..cc")?(sOptions="1993 by The Shadow Lord",bDetected=1):Binary.compare("eb$$ccbe....bb....b2..bf....cc8b0d8bc103c7cc05....83c7..8be0cc")?(sOptions="by The Shadow Lord",bDetected=1):Binary.compare("eb$$bb....001f4beb$$001f4beb")?(sName="Crypt.Trivial.173",sOptions="1998 by SMT",bDetected=1):Binary.compare("'SFINKS_SOFT___'fafcb430cd21fb33c0502ec606......0783e9..3be175..26c706........b9")?(sOptions="by SFINKS SOFT",bDetected=1):Binary.compare("e8$$$$1e33c08ed8f716....eb$$f716....1f5ebf....57b9....ac34..aae2")?(sOptions="by R!SC",bDetected=1):Binary.compare("e9$$$$6033edbe....b4..bd....bf....ac32c4aa80c4..fec43bf575..33c0b9....f3ab61bf....ffe7")?(sOptions="by DarkGrey //DSA",bDetected=1):Binary.compare("'(C)1997'00'by'00'PSH'............................bc....6081c6....33db8bfeb9....ad35....c1c0..03d8abe2")?(sOptions="1997 by PSH",bDetected=1):Binary.compare("eb$$bf....33dbba....fcbe....8bcfccad")?(sName+=" #3",sOptions="by Misha /ACE",bDetected=1):Binary.compare("e9$$$$061e33c08ed8be....8904be....89041e071fb8....bf....268905be....b9....8a04263205")&&(sOptions="by SafeSoft",bDetected=1),result()}meta("cryptor","Cryptor")

================================================
FILE: dbs_min/db/COM/driver_DIGPAK.1.sg
================================================
function detect(){return Binary.compare("e9$$$$8cc88ed88ec0e8$$$$1e56be....33c08ed8c5340bf674")?(sOptions="1992 by The Audio Solutions",bDetected=1):Binary.compare("e9$$$$8cc88ed88ec0c706........c706........c706........b8....50e8$$$$558bec061e5657fc")&&(sOptions="1991 by The Audio Solutions",bDetected=1),result()}meta("driver","DIGPAK")

================================================
FILE: dbs_min/db/COM/driver_MIDPAK.1.sg
================================================
function detect(){return Binary.compare("e9$$$$bb....d1ebd1ebd1ebd1eb43b8....cd21fa8cc88ed0bc....fb8ed88ec0c706")&&(sOptions="1992 by The Audio Solutions",bDetected=1),result()}meta("driver","MIDPAK")

================================================
FILE: dbs_min/db/COM/immunizer_ARF_AV_Inject.1.sg
================================================
function detect(){return Binary.compare("e9$$$$b8....50558bec83c4..061e90c746......c746......c646....c746......c746......8b5e..8dbf....b9")&&(sVersion="2.4",sOptions="1995 by ARF Enterprises",bDetected=1),result()}meta("immunizer","ARF/AV Inject")

================================================
FILE: dbs_min/db/COM/immunizer_CPAV.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e9$$$$e8$$$$5b81eb....5051525657558beb2ec686......268e06....061fb9....bf....8bc7fcf2ae26803d..75")&&(sVersion="1993",bDetected=1),result()}meta("immunizer","Central Point Anti-Virus immunizer")

================================================
FILE: dbs_min/db/COM/immunizer_F-XLOCK.1.sg
================================================
function detect(){return Binary.compare("e8$$$$505351521e8e1e....33db8b07433d....74..75..43833f..75..4343")&&(sVersion="1.16",bDetected=1),result()}meta("immunizer","F-XLOCK")

================================================
FILE: dbs_min/db/COM/immunizer_IMMUN.1.sg
================================================
function detect(){return Binary.compare("e9$$$$5053515256571e06e8....5e81ee....2e8936....8bfe81c7....2e8b1d2bfb83c7..81ef....8befb430cd21")&&(sVersion="1.2r",sOptions="1993 by J.Bleuel",bDetected=1),result()}meta("immunizer","IMMUN")

================================================
FILE: dbs_min/db/COM/immunizer_TAV.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e9$$$$e800005b81eb....5051525657558beb2ec686......268e06....061f")&&(sOptions="by CARMEL Software Engineering",bDetected=1),result()}meta("immunizer","Turbo Anti-Virus")

================================================
FILE: dbs_min/db/COM/immunizer_VSS.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$5b81eb....1e065051525354555657061e8bebb430cd2186e03d....73..e9")&&(sVersion="1993 by Ralph Roth",bDetected=1),result()}meta("immunizer","Viren Schutz Schild")

================================================
FILE: dbs_min/db/COM/other_XLOADER.2.sg
================================================
function detect(){return Binary.compare("fc8cdb33c08ec0b8....26a3....268c0e....5052faba....b0..ee42ec")&&(sVersion="2.00",sOptions="by CyberMan + ST!LLS0N",bDetected=1),result()}meta("other","XLOADER")

================================================
FILE: dbs_min/db/COM/other_integrity_checker.1.sg
================================================
function detect(){return Binary.compare("e9$$$$505351521ea1....8ed829db43833f..75..434389dab8....cd211fb9....ba....72..89c3b4..cd21")&&(sOptions="1990-92 by D.A. Martynoff",bDetected=1),result()}meta("other","integrity checker")

================================================
FILE: dbs_min/db/COM/packer_4kZIP.2.sg
================================================
function detect(){return Binary.compare("fcb1..e8$$$$8736....b8....d3e0482306....66d32e....280e....77..506633c0ac8a0e....80c1..66d3e0")&&(sOptions="by pascal //Digital Nightmare",bDetected=1),result()}meta("packer","4kZIP")

================================================
FILE: dbs_min/db/COM/packer_AVPACK.2.sg
================================================
function detect(){return Binary.compare("eb$$8cda0316....3916....73..b409ba....cd21c3")&&(sVersion="1.22",sOptions="Andrei Volkov",bDetected=1),result()}meta("packer","AVPACK")

================================================
FILE: dbs_min/db/COM/packer_COMPACK.2.sg
================================================
function detect(){return Binary.compare("BE....E8....5D83C5..55505351520E070E1F8BCE8D72..BF....D1E9FD57F3A5")?(sVersion="4.5",bDetected=1):Binary.compare("BE....E8....5D83C5..55505351520E070E1F8D72..bf....b9....90fd57f3a58d75..fcf98bfdc3")?(sVersion="4.5?",bDetected=1):Binary.compare("BE....E8....5D83C5..555053510E070E1F8BCE8D72..BF....D1E9FD57F3A5")?(sVersion="5.1",bDetected=1):Binary.compare("BE....E8....5D83C5..550e1f0e07505351528bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3")?(sVersion="4.5",bDetected=1):Binary.compare("be....0e530e520e070e1fe800005d8bce8d72..bf....d1e9fd57f3a58d75..fcf98d7e..c3")||Binary.compare("be....505351520e070e1fe800005d8bce8d72..bf....d1e9fd57f3a58d75..fcf98d7e..c3")?(sVersion="4.4",sOptions="1990",bDetected=1):Binary.compare("BE....E8....5D83C5..558bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3")&&(sVersion="4.5?",bDetected=1),result()}meta("packer","COMPACK")

================================================
FILE: dbs_min/db/COM/packer_Cheat_packer.2.sg
================================================
function detect(){return Binary.compare("eb$$b9....ba....bf....bb....b8....be....83ec..8becfc8866..32e48976..8bf703c18bf83bfe76..fd574e4f")&&(sOptions="1993 by TWIN of TRSi",bDetected=1),result()}meta("packer","Cheat packer")

================================================
FILE: dbs_min/db/COM/packer_Compressor.2.sg
================================================
function detect(){return Binary.compare("eb$$8cc8488ec026813e........72..05....8ec0be....ba....33ffb9....b0..f3aa")&&(sVersion="1.0",bDetected=1),result()}meta("packer","Compressor")

================================================
FILE: dbs_min/db/COM/packer_CyberWare_Packer.2.sg
================================================
function detect(){return Binary.compare("565056fd8bfc83ef..b9....be....fea447ffe7")&&(sOptions="1997",bDetected=1),result()}meta("packer","CyberWare Packer")

================================================
FILE: dbs_min/db/COM/packer_Diet.2.sg
================================================
function detect(){return Binary.compare("bf....3bfc72$$fdbe....b9....f3a5fc8bf7bf....adad8be8b2..e9")?(sVersion="1.00",sOptions="modified",bDetected=1):Binary.compare("bf....3bfc72$$be....b9....fdf3a5fc8bf7bf....adad8be8b2..e9")?(sVersion="1.00, 1.00d",bDetected=1):Binary.compare("......bf....b9....3bfc72$$fdf3a5fc8bf7bf....adad8be8b2..e9")?(sVersion="1.02b, 1.10a",bDetected=1):Binary.compare("......bf....b9....3bfc72$$31dbeb$$fdf3a5fc8bf7bf....adad8be8b2..e9")?(sVersion="1.20",bDetected=1):Binary.compare("f99ceb$$55061e575652515350e8$$$$59b1..d3e98cc803c18ed88ec0")&&(sVersion="1.44/1.45",bDetected=1),result()}meta("packer","Diet")

================================================
FILE: dbs_min/db/COM/packer_EXC.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$5f81fc....72..8745..a3....8a45..a2....fc8db5....bd....8cca")&&(sVersion="1.0.0",sOptions="by Kris Heidenstrom",bDetected=1),result()}meta("packer","EXC")

================================================
FILE: dbs_min/db/COM/packer_ICE.1.sg
================================================
function detect(){return Binary.compare("eb$$be....8bfe8b0e....8b16....b8....50fcad33c2ab8bd0e2")&&(sVersion="1.0",bDetected=1),result()}meta("packer","ICE")

================================================
FILE: dbs_min/db/COM/packer_LGLZ.2.sg
================================================
function detect(){return Binary.compare("bf....3bfc72$$be....b9....fdf3a4fc8bf746bf....e8")&&(sVersion="1.03/04",sOptions="1996",bDetected=1),result()}meta("packer","LGLZ")

================================================
FILE: dbs_min/db/COM/packer_PKLITE.2.sg
================================================
function detect(){return Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.12, 1.20",bDetected=1):Binary.compare("B8....BA....3bc473..8bc42d....9025....8bf8b9....90be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.15",bDetected=1):Binary.compare("50B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.50",bDetected=1):Binary.compare("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")?(sVersion="1.00, 1.03",sOptions="exe2com",bDetected=1):Binary.compare("ba....a1....2d....8ccb81c3....3bc377..05....3bc377..b4..ba....cd21cd20")?(sVersion="1.00c",bDetected=1):Binary.compare("ba....b8....05....3b06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")?(sVersion="1.1X",bDetected=1):Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1")&&(sVersion="1.12, 1.15, 1.20",bDetected=1),result()}meta("packer","PKLITE")

================================================
FILE: dbs_min/db/COM/packer_PRO-PACK.2.sg
================================================
function detect(){return Binary.compare("83ec..8becbe....fce8....05....8bc8e8....8bd003c605....8bf8e8....ad88....32e489....8bf703c18bf83bfe76")?(sVersion="2.08-2.19",bDetected=1):Binary.compare("83ec..8becbe....fce8....05....8bc8e8....8bd003c605....8bf8e8....8946..895e..ad8866..32e48976..8bf703c18bf83bfe76")?(sVersion="2.08-2.19",sOptions="-m1, locked",bDetected=1):Binary.compare("be....fce8....05....8bc8e8....8bd003c605....8bf883c6..ad32e48bee8bf703c18bf83bfe76")?(sVersion="2.14",sOptions="-m2",bDetected=1):Binary.compare("be....fce8....05....8bc8e8....8bd003c605....8bf8e8....5350ad32e48bee8bf703c18bf83bfe76")&&(sVersion="2.08-2.19",sOptions="-m2",bDetected=1),result()}meta("packer","PRO-PACK")

================================================
FILE: dbs_min/db/COM/packer_SCRE2B.2.sg
================================================
function detect(){return Binary.compare("8cda0116....ff2e....00")&&(sVersion="1.02",sOptions="by Graeme W. McRae",bDetected=1),result()}meta("packer","SCRE2B")

================================================
FILE: dbs_min/db/COM/packer_SCRNCH.2.sg
================================================
function detect(){return Binary.compare("eb$$bb....b44acd2181eb....73..ba....b9....e9")?(sVersion="1.02",sOptions="1988 by Graeme W. McRae",bDetected=1):Binary.compare("bb....b44acd2181eb....73..ba....b9....e9$$$$0e1fb440bb....cd21b8....cd21")?(sVersion="1.00",sOptions="1988 by Graeme W. McRae",bDetected=1):Binary.compare("bb....b44acd2181eb....73..ba....b9....e9$$$$b440bb....cd21b8....cd21")&&(sVersion="1.01",sOptions="1988 by Graeme W. McRae",bDetected=1),result()}meta("packer","SCRNCH")

================================================
FILE: dbs_min/db/COM/packer_SHRINK.2.sg
================================================
function detect(){return Binary.compare("509cfcbe....bf....57b9....f3a48b0e....be....bf....f3a4c3")&&(sVersion="1.0",sOptions="by Thomas G. Hanlin",bDetected=1),result()}meta("packer","SHRINK")

================================================
FILE: dbs_min/db/COM/packer_Scramb.2.sg
================================================
function detect(){return(Binary.compare("e9$$$$e8$$$$5b0e1f81eb....8bc305....508bc803d12bfac3")||Binary.compare("e9$$$$e8....5b0e1f81eb....8bc305....508bc803d12bfac3"))&&(sVersion="1.20",sOptions="by B.U.G.",bDetected=1),result()}meta("packer","Scramb")

================================================
FILE: dbs_min/db/COM/packer_Six-2-Four.2.sg
================================================
function detect(){return Binary.compare("'[ESP]'b5..8bf98be9be....57f3a4c3")?(sVersion="1.1",sOptions="Boogie //ESP",bDetected=1):Binary.compare("'PULP'83c4..fcbf....be....b5..57f3a5c3")&&(sVersion="1.0",sOptions="Kimmy //Pulp",bDetected=1),result()}meta("packer","Six-2-Four")

================================================
FILE: dbs_min/db/COM/packer_TPACK.2.sg
================================================
function detect(){return Binary.compare("03'TUSCON'030d0a005868....60e9")?(sVersion="0.5c",sOptions="1996 by Max //TUSCON",bDetected=1):Binary.compare("68....fd60be....bf....b9....f3a48bf7bf....fc46e9")&&(sVersion="0.55c",sOptions="1996 by Max //TUSCON",bDetected=1),result()}meta("packer","TPACK")

================================================
FILE: dbs_min/db/COM/packer_Triplex.2.sg
================================================
function detect(){return Binary.compare("bd....be....5553525a5b505351520e1f0e078bce8d72..bf....d1e9fd57f3a5")&&(sOptions="1994",bDetected=1),result()}meta("packer","Triplex")

================================================
FILE: dbs_min/db/COM/packer_UPX.2.sg
================================================
function detect(){return Binary.compare("b9....be....bf....fdf3a4fcf7e19387f783ee..19ed57")?(sVersion="0.50",sOptions="dos/com",bDetected=1):Binary.compare("81fc....77..cd20b9....be....bf....bb....fdf3a4fc87f783ee")?(sVersion="0.81-1.20",sOptions="dos/com",bDetected=1):Binary.compare("b9....be....bf....bd....fdf3a4fcf7e19387f783c6..57e9")&&(sVersion="0.30-0.40",sOptions="dos/com",bDetected=1),result()}meta("packer","UPX")

================================================
FILE: dbs_min/db/COM/packer_X-PACK.2.sg
================================================
function detect(){return Binary.compare("bd....be....bf....b8....99fcfa33c9e9$$$$8bd9ffd5")&&(sOptions="by Jari Kytojoki",bDetected=1),result()}meta("packer","X-PACK")

================================================
FILE: dbs_min/db/COM/packer_XE.2.sg
================================================
function detect(){return Binary.compare("be....56bf....b9....fc56f3a55fe9")&&(sVersion="1.42",bDetected=1),result()}meta("packer","XE")

================================================
FILE: dbs_min/db/COM/packer_XPACK.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fa8bece8....06bf....57e8....06b8....50be....bf....cb")?(sVersion="1.67",bDetected=1):Binary.compare("e9$$$$fa8bece8....fb06bf....57e8....06b8....50be....bf....cb")?(sVersion="1.67.1",bDetected=1):Binary.compare("e9$$$$8cc805....8ec0bf....8bf7fcb9....f3a506b8....50cb")?(sVersion="1.65",bDetected=1):Binary.compare("e9$$$$8cc8a3....05....8ec0bf....8bf7fcb9....f3a506b8....50cb")&&(sVersion="1.4",bDetected=1),result()}meta("packer","XPACK/LZCOM")

================================================
FILE: dbs_min/db/COM/packer_aPACK.2.sg
================================================
function detect(){return Binary.compare("be....bf....8bcffc57f3a4c3")?(sVersion="0.98-0.99 small",bDetected=1):Binary.compare("8cc880c4..8ec0fcb9....be....8bfe57f3a55fbe....0668....1e078ed8cb")?(sVersion="0.82b-0.94b",bDetected=1):Binary.compare("8cc805....8ec0598ed051be....bf....5057fcb2..bd....50a4ffd5")?(sVersion="0.61",bDetected=1):Binary.compare("8cc805....8ec0598ed051be....bf....5057fcb6..bd....ffd5")?(sVersion="0.58-0.74",bDetected=1):Binary.compare("8cc880c4..8ec0fcb9....be....8bfe57f3a55fbe....06ba....521e078ed8cb")&&(sVersion="0.82-0.94",bDetected=1),result()}meta("packer","aPACK")

================================================
FILE: dbs_min/db/COM/packer_com_RLE_packer.2.sg
================================================
function detect(){return Binary.compare("60be....bf....8b0e....f3a4be....bf....57b9....f3a4c3")?(sOptions="by NOP/PC",bDetected=1):Binary.compare("fc8cc833ff05....8ec006be....b9....57f3a40e07cb")&&(bDetected=1),result()}meta("packer","com RLE packer")

================================================
FILE: dbs_min/db/COM/packer_envelope.2.sg
================================================
function detect(){return Binary.compare("60ba....3bd472$$be....8bfeb9....bb....fcad33c343abe2")&&(sOptions="by ROWDY, St.Petersburg",bDetected=1),result()}meta("packer","envelope")

================================================
FILE: dbs_min/db/COM/protector_ABK-Scrambler.2.sg
================================================
function detect(){return Binary.compare("b430cd2186e03d....73..cd209c06b8....50cf")&&(bDetected=1),result()}meta("protector","ABK-Scrambler")

================================================
FILE: dbs_min/db/COM/protector_ACE_Scrambler.2.sg
================================================
function detect(){return(Binary.compare("2c..fec024..34..fec824..34..bb....0c..eb$$24..0c..81eb....f6d8eb$$2c..fec0ffe3")||Binary.compare("24..0c..f6d8eb$$fec8bb....04..0c..f6d804..fec0f6d881eb....24..f6d8fec034..0c..04..2c..ffe3")||Binary.compare("34..fec834..0c..24..04..fec0bb....0c..2c..0c..81eb....eb$$fec0f6d82c..fec0f6d80c..ffe3")||Binary.compare("24..fec82c..bb....fec8f6d8eb$$04..81eb....0c..fec0fec80c..34..ffe3")||Binary.compare("24..eb$$04..bb....f6d834..fec8fec0eb$$0c..81eb....34..24..34..eb$$ffe3")||Binary.compare("34..fec804..24..0c..04..bb....0c..04..f6d881eb....0c..fec8f6d824..0c..ffe3")||Binary.compare("f6d834..2c..bb....0c..34..fec004..34..fec004..81eb....2c..34..24..eb$$04..2c..04..ffe3")||Binary.compare("fec0eb$$24..34..bb....f6d834..fec024..fec0f6d834..81eb....f6d80c..eb$$04..ffe3"))&&(sOptions="1996",bDetected=1),result()}meta("protector","A.C.E. Scrambler")

================================================
FILE: dbs_min/db/COM/protector_AVAST-Protect.2.sg
================================================
function detect(){return Binary.compare("eb$$8cc82e0306....502eff36....cb")&&(sOptions="1999 by P.Baudis",bDetected=1),result()}meta("protector","AVAST-Protect")

================================================
FILE: dbs_min/db/COM/protector_AdFlt.2.sg
================================================
function detect(){return Binary.compare("68....9c0fa00fa860fd6a..0fa1be....ad6664ff36....648b16....643106....6664ff36....648916....adff36")?(sVersion="2.0",sOptions="by EliCZ",bDetected=1):Binary.compare("9c0fa06660fd6a..0fa1be....ad6664ff36....648b16....668f06....643106....6664ff36....648916....668f06....adff36")&&(sOptions="by EliCZ",bDetected=1),result()}meta("protector","AdFlt")

================================================
FILE: dbs_min/db/COM/protector_Adys_COM-Scrambler.2.sg
================================================
function detect(){return Binary.compare("33c08ed88ec0fcfabe....8bfead2ea3....ad2ea3....b8....ab8cc8ab")&&(sOptions="1993",bDetected=1),result()}meta("protector","Ady`s COM-Scrambler")

================================================
FILE: dbs_min/db/COM/protector_Anti-hack_encryption_system.2.sg
================================================
function detect(){return Binary.compare("eb$$bd....33c08ec026c706........268c0e....8b46..26a3....268c0e....0e07")&&(sOptions="by Rezaul Kabir //Shuvro",bDetected=1),result()}meta("protector","Anti-hack encryption system")

================================================
FILE: dbs_min/db/COM/protector_BIN-Lock.2.sg
================================================
function detect(){return Binary.compare("eb$$31c08ec026c706........268c0e....26c706........268c0e....2ec706........2e8c0e....cccd01eb")&&(sVersion="1.00",sOptions="by Hit-BBS Programmers crew",bDetected=1),result()}meta("protector","BIN-Lock")

================================================
FILE: dbs_min/db/COM/protector_Best_Protection_Kit-B.2.sg
================================================
function detect(){return Binary.compare("eb$$fc8c06....e421a2....b0..e621fb33c08ed08be0be....8d3e....b9")?(sOptions="1993 by Eric Zmiro",bDetected=1):Binary.compare("eb$$fc8c06....e421a2....b0..e621fbf433c08ed08be0be....8d3e....b9")&&(sOptions="1992 by Eric Zmiro",bDetected=1),result()}meta("protector","Best Protection Kit-B")

================================================
FILE: dbs_min/db/COM/protector_BinCOD.2.sg
================================================
function detect(){return Binary.compare("e9$$$$60fa6a000726ff36....26ff36....26c706........26c706........fbb9....bf....03f9ac")&&(sVersion="1.1",sOptions="by SierraMan",bDetected=1),result()}meta("protector","BinCOD")

================================================
FILE: dbs_min/db/COM/protector_Budokan.1.sg
================================================
function detect(){return Binary.compare("bf....b9....8bc1fd3305abe2..e9")&&(sOptions="by Electronic Arts, Inc.",bDetected=1),result()}meta("protector","Budokan")

================================================
FILE: dbs_min/db/COM/protector_C-crypt.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e800005d83ed..55d9d09c5825....509d5057bf....b0..aa5f58665166b9........cc")&&(sVersion="1.02",sOptions="by De'FeinD //uCT",bDetected=1),result()}meta("protector","C-crypt")

================================================
FILE: dbs_min/db/COM/protector_CC#3.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e800005d33db8bc3bf....893f81c3....532eff36....1f1e568d76..8bfbb9....f2a4c6")&&(sOptions="by ZeroCoder //XG",bDetected=1),result()}meta("protector","CC#3")

================================================
FILE: dbs_min/db/COM/protector_CC.2.sg
================================================
function detect(){return Binary.compare("b8....ba....3be073..b409ba....cd21b8....cd218bdc81eb....83e3..fcbe....8bfbb9....f3a48bc3b1..d3e88cc903c15033c050cb")?(sVersion="1.0",sOptions="1991 by B.Vorontsov",bDetected=1):Binary.compare("ba....b430cd213c..73..33c00650cbb9....b8....eb$$05....fc80c4..eb")?(sVersion="2.61 Beta",sOptions="by UniHackers",bDetected=1):Binary.compare("e9$$$$b9....be....8bfe5156b4..ac32c4c0c4..02e1aae2..bf....5e59f3a4be....56c3")?(sVersion="1.01",sOptions="by B.Vorontsov",bDetected=1):Binary.compare("bf....be....b9....fdf3a5fc8bf7bf....adad8be8b2..e9")&&(sVersion="1998",sOptions="by B.Vorontsov",bDetected=1),result()}meta("protector","CC")

================================================
FILE: dbs_min/db/COM/protector_CC286.2.sg
================================================
function detect(){return Binary.compare("e9$$$$eb$$e800005d81ed....eb$$bf....eb$$b0..eb$$e664eb$$b0..eb$$aaeb$$4f8d9e....eb$$538bdf")&&(sVersion="2.1",sOptions="by Dark Stalker //UCF",bDetected=1),result()}meta("protector","CC286x2")

================================================
FILE: dbs_min/db/COM/protector_CCC.2.sg
================================================
function detect(){return(Binary.compare("e9$$$$e800005b8b4c..501736890e....8b47..1347..3347..2b47..36a3....83c6..b9....8b7f..037f..ac363006")||Binary.compare("e9$$$$e800005b8b4c..501736890e....8b47..3347..36a3....83c6..b9....8b7f..037f..ac363006"))&&(sOptions="by ZeroCoder //XG",bDetected=1),result()}meta("protector","CCC")

================================================
FILE: dbs_min/db/COM/protector_CHECKPRG.2.sg
================================================
function detect(){return Binary.compare("33c0be....8bd8b9....bf....ba....474a74..ac320503d8e2")&&(sOptions="1992 by Jordi Mas Hernandez",bDetected=1),result()}meta("protector","CHECKPRG")

================================================
FILE: dbs_min/db/COM/protector_CNT.2.sg
================================================
function detect(){return Binary.compare("'CNT'58e8$$$$5e8b4c..bf....ac3306....3306")&&(sOptions="by C0NTRiVER",bDetected=1),result()}meta("protector","CNT")

================================================
FILE: dbs_min/db/COM/protector_COM-Protect.2.sg
================================================
function detect(){return Binary.compare("e9$$$$8b1e....83eb..b8....5053b430cd215b9ceb")?(sOptions="1995 by Mr.Wicked",bDetected=1):Binary.compare("e9$$$$565699521fe8....5d8d86....0e508f06....8f06....83c6..565f0e1fb9....b8....a3")?(sOptions="1994 by SiAC",bDetected=1):Binary.compare("2e8006......eb00c3")&&(sOptions="1994 by Misha //UCF",bDetected=1),result()}meta("protector","COM-Protect")

================================================
FILE: dbs_min/db/COM/protector_COM-Protection.2.sg
================================================
function detect(){return Binary.compare("e9$$$$eb$$86c08ec086dbeb$$05....87db8b2e....97eb$$aaaaeb$$aaaaeb$$bb....03ddb9....03cd87cbb8")&&(sOptions="by JAM //UCF",bDetected=1),result()}meta("protector","COM-Protection")

================================================
FILE: dbs_min/db/COM/protector_COMCRYPT.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b9....be....89f70e1f0e07bb....fcad31d8abe2")?(sOptions="1997 by HPA",bDetected=1):Binary.compare("e9$$$$eb$$5053575152061e572e8b36....81c6....8a5c..2e881e....8a5c")?(sVersion="1.0b",bDetected=1):Binary.compare("e9$$$$b9....be....89f7fcac04..aae2..b8....bf....abb0..aab8....5033c0c3")?(sOptions="1997 by HPA",bDetected=1):Binary.compare("b8....ffe0")&&Binary.compare("bb....b9....33c02e802f..43e2",Binary.readWord(1)-256)&&(sOptions="by Stone",bDetected=1),result()}meta("protector","ComCrypt")

================================================
FILE: dbs_min/db/COM/protector_COMPROTECT.2.sg
================================================
function detect(){return Binary.compare("b8....15....72..8ac4bb....50515253555657061e50b8....58eb")&&(sVersion="2.10",sOptions="1988-95 by Ralph Roth",bDetected=1),result()}meta("protector","COMPROTECT (RCP)")

================================================
FILE: dbs_min/db/COM/protector_COP.2.sg
================================================
function detect(){return Binary.compare("bf....be....b9....ac3206....aae2")&&(sVersion="1.0",sOptions="by Jack A. Orman",bDetected=1),result()}meta("protector","COP")

================================================
FILE: dbs_min/db/COM/protector_CodeLock.2.sg
================================================
function detect(){return Binary.compare("e9$$$$bb....535856535981e9....31ff575a5dbe....e9")?(sVersion="4.0",sOptions="1993 by Dr. Detergent",bDetected=1):Binary.compare("e9$$$$b430cd213c037d$$068e06....061f31c0505e565fae")&&(sVersion="3.0",sOptions="1993 by Dr. Detergent",bDetected=1),result()}meta("protector","CodeLock")

================================================
FILE: dbs_min/db/COM/protector_Codesafe.2.sg
================================================
function detect(){return Binary.compare("e9$$$$5033c08ec02ef606......74..26ff36....061e07e8....07268f06....fb2e8c1e....26ff36....268f06")&&(sOptions="by EliaShim Ltd",bDetected=1),result()}meta("protector","Codesafe")

================================================
FILE: dbs_min/db/COM/protector_ComProt.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e800005e8bee81ed....8db6....b9....f61446e2")&&(sVersion="1.0b",bDetected=1),result()}meta("protector","ComProt")

================================================
FILE: dbs_min/db/COM/protector_ComProtector.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b9....bb....bf....2e8a0734..fec8c0c0..2e88052e000d2e002d4743e2")?(sVersion="1.0",sOptions="1998 by Marco Ruhmann",bDetected=1):Binary.compare("e9$$$$b9....e800005b83c3..90fa8bd48be133c02e030e....2ec007..0f23f82e2b0e....2e300f0f23d8")&&(sVersion="1.1",sOptions="1998 by Marco Ruhmann",bDetected=1),result()}meta("protector","ComProtector")

================================================
FILE: dbs_min/db/COM/protector_Comlock.2.sg
================================================
function detect(){return Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bc82e300446ffc0e2")||Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bcb2e300446fec0e2")?(sVersion="0.10",bDetected=1):Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....8bcbbe....2e3004fec046e2")&&(sVersion="0.1X",bDetected=1),result()}meta("protector","Comlock by Trouble Makers")

================================================
FILE: dbs_min/db/COM/protector_CrAcKeR.2.sg
================================================
function detect(){return Binary.compare("eb$$be....8bfe5633c0be....ac02e081fe....72..5eac34..aa81fe....72")&&(sVersion="0.2a",sOptions="by Deu$",bDetected=1),result()}meta("protector","CrAcKeR")

================================================
FILE: dbs_min/db/COM/protector_Crack2EXE.1.sg
================================================
function detect(){return Binary.compare("b9....bf....8035..47e2..be....8034..46803c..75..be....e8....be....e8....be....e8....bd")?(sName+="/486",sVersion="0.02 Alfa",sOptions="1996 by Professor Nimnul",bDetected=1):Binary.compare("b9....bf....8035..47e2..d7aa6de9")&&(sVersion="0.02",sOptions="(crypted) 1996 by Professor Nimnul",bDetected=1),result()}meta("protector","Crack2exe")

================================================
FILE: dbs_min/db/COM/protector_CryptCom.2.sg
================================================
function detect(){return Binary.compare("e9$$$$be....56b9....c704....c644....8134....4646e2..31f631c9c3")?(sVersion="2.0",sOptions="by Nowhere Man",bDetected=1):Binary.compare("bf....57be....90b9....f3a4c3")&&(sVersion="1.1",sOptions="by Frank Baumgartner",bDetected=1),result()}meta("protector","CryptCom")

================================================
FILE: dbs_min/db/COM/protector_Crypto-King.2.sg
================================================
function detect(){return Binary.compare("bf....be....57b9....f3a4c3")&&(sVersion="1.08",bDetected=1),result()}meta("protector","Crypto-King")

================================================
FILE: dbs_min/db/COM/protector_DCFR.2.sg
================================================
function detect(){return Binary.compare("b8....ba....3bc4eb$$72$$5250b9....bb....8b0733c140890743e2")&&(sVersion="0.0.4",bDetected=1),result()}meta("protector","DCFR")

================================================
FILE: dbs_min/db/COM/protector_DS-CRP.2.sg
================================================
function detect(){var e
return Binary.compare("b8....50c3")&&(e=Binary.readWord(1)-256+8,Binary.compare("e800005d81ed....9c32e4509d9c5880e4..80fc..74..b4..509d9c5880e4..74..9deb",e)&&(sVersion="1.30"),sOptions="by Dark Stalker //UCF",bDetected=1),result()}meta("protector","DS-CRP")

================================================
FILE: dbs_min/db/COM/protector_Deeper.2.sg
================================================
function detect(){return Binary.compare("90e9$$$$e8000059fa8bdc36c747......36837f....75..fb66fafb8be981ed....81e9....be....8dbe....668b05668904")&&(sVersion="1.0c",bDetected=1),Binary.compare("90e9$$$$e80000fa8bdc36c747......36837f....75..fb598be981ed....81e9....be....8dbe....668b05668904")&&(sVersion="1.0a",bDetected=1),result()}meta("protector","Deeper")

================================================
FILE: dbs_min/db/COM/protector_E2C-Scrambler.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fabc....c1ea..8ccd03ea8ec5bf....be....b9....bb....fdac320702c1d2c002c5aa4381fb....75..bb....e2")&&(sOptions="1999 by Amokk //FTW",bDetected=1),result()}meta("protector","E2C-Scrambler")

================================================
FILE: dbs_min/db/COM/protector_E2C1.2.sg
================================================
function detect(){return Binary.compare("bc....33c050b8....50ba....b8....cd21b8....cd21bf....be....b9....9081ff....74..8a050204aa46e2..eb")&&(sOptions="1990 by Erik Labs",bDetected=1),result()}meta("protector","E2C protection")

================================================
FILE: dbs_min/db/COM/protector_EPW.2.sg
================================================
function detect(){return Binary.compare("e9$$$$06571e565552515350bb....81c3....2e8b078ccb03c305....50b8....50cb")&&(sVersion="1.2",sOptions="by Aland D. Jones",bDetected=1),result()}meta("protector","EPW")

================================================
FILE: dbs_min/db/COM/protector_EXETools.2.sg
================================================
function detect(){return Binary.compare("68....68....68....be....bf....57b9....f3a4c3")?(sVersion="2.1 /E",bDetected=1):Binary.compare("e9$$$$e800005d8bcd83ed..bf....be....2bcff3a4b9....be....03f5")?(sVersion="2.1",bDetected=1):Binary.compare("68....bf....8bf757b9....51b4..ac32c4c0c4..02e102f0aae2..33c0595e5f57eb")?(sVersion="2.0",bDetected=1):Binary.compare("68....68....68....be....bf....57b9....f3a4c3")&&(sVersion="2.1 /E",bDetected=1),result()}meta("protector","EXETools by Dismember")

================================================
FILE: dbs_min/db/COM/protector_Encriptor.2.sg
================================================
function detect(){return Binary.compare("eb$$b9....be....bf....acd0c8aae2..be....bf....acaa")&&(sVersion="1.00c",sOptions="by Dark Stalker //UCF",bDetected=1),result()}meta("protector","Encriptor")

================================================
FILE: dbs_min/db/COM/protector_Entropy_Coder.2.sg
================================================
function detect(){return Binary.compare("be....bf....b9....fdf3a447fcffe7")&&(sOptions="by Sergey Lukashev",bDetected=1),result()}meta("protector","Entropy Coder")

================================================
FILE: dbs_min/db/COM/protector_ExOM.2.sg
================================================
function detect(){return Binary.compare("'EXOM'fabd....ffe5")&&(sVersion="0.0X",sOptions="by Abdelaziz BELBACHiR",bDetected=1),result()}meta("protector","ExOM")

================================================
FILE: dbs_min/db/COM/protector_FCRYPT.2.sg
================================================
function detect(){return Binary.compare("e9$$$$505351be....bf....8befb9....fcacd0c032c1d0c032c1aae2..595b58ffe5")&&(sVersion="2.10b",sOptions="1992-93 by Chip & Dale SoftGroup",bDetected=1),result()}meta("protector","FCRYPT")

================================================
FILE: dbs_min/db/COM/protector_GOAT.2.sg
================================================
function detect(){return(Binary.compare("5156505253813c....75$$424a81c3....8bdb595e585a5bb4..ba....cd21b8....cd21474f")||Binary.compare("50565351b8....807c....74$$8bc0585e5b59b4..ba....cd21b8....cd21474f4154")||Binary.compare("56515052807c....75$$81c2....8bc05e59585ab4..ba....cd21b8....cd21474f4154"))&&(sOptions="1996 by Martin Overton",bDetected=1),result()}meta("protector","GOAT")

================================================
FILE: dbs_min/db/COM/protector_Guardian_Angel.2.sg
================================================
function detect(){return Binary.compare("e9$$$$06fcbe....eb$$ba....eb$$eb$$eb$$8a04eb$$eb$$eb$$d0c8eb$$2ad0eb$$32c6eb$$d1c2eb$$8804eb$$eb$$eb$$4681fe....74")||Binary.compare("e9$$$$06fcbe....8be8e4210c..eb$$e6218bc5ba....8be8e4210c..eb$$e6218bc58a0ceb")||Binary.compare("e9$$$$06fcbb....eb$$eb$$eb$$b9....8be8e42102..eb$$e6218bc58a17eb")||Binary.compare("e9$$$$06fcbb....8be8e4210c..eb$$e6218bc5ba....eb$$eb$$eb$$8a0f")||Binary.compare("e9$$$$06fcbe....eb$$......eb$$8a..8be8e4210c..eb$$e6218bc5fe")?(sVersion="1.0",bDetected=1):Binary.compare("e9$$$$06fcbf....8be8e4210c..eb$$e6218bc5bb....eb$$8a05eb$$eb$$eb$$fe")?(sVersion="1.0",sOptions="registered",bDetected=1):Binary.compare("e9$$$$e800005d81ed....9c588bc825....509d9c5825....3d....75..eb")?(sVersion="1.0b",bDetected=1):Binary.compare("e9$$$$06fcbb....eb$$ba....eb$$eb")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Guardian Angel")

================================================
FILE: dbs_min/db/COM/protector_HDKPROTC.2.sg
================================================
function detect(){return Binary.compare("e9$$$$4851442ea1....2d....8bd805....8bf0bf....b9....f3a48bcbd1e9b8....8bf08bf8066a..07268b2e")&&(sVersion="1.1",bDetected=1),result()}meta("protector","HDKPROTC")

================================================
FILE: dbs_min/db/COM/protector_HackStop.2.sg
================================================
function detect(){return Binary.compare("fabe....ffe6")?(sVersion="1.17cr",bDetected=1):Binary.compare("fabd....ffe5")?(sVersion="1.13cs",bDetected=1):Binary.compare("fabb....ffe3")&&(sVersion="1.14s",bDetected=1),result()}meta("protector","HackStop")

================================================
FILE: dbs_min/db/COM/protector_IntroC0der.1.sg
================================================
function detect(){return Binary.compare("be....b9....8bfeac32c1d2c032c5aae2")&&(sOptions="1995 by SkullC0der",bDetected=1),result()}meta("protector","IntroC0der")

================================================
FILE: dbs_min/db/COM/protector_Keygen_crypt.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e800005d8d7e..575eb9....ad35....abe2")&&(sVersion="1.00",sOptions="by Majestic",bDetected=1),result()}meta("protector","KeyGen Crypt")

================================================
FILE: dbs_min/db/COM/protector_Khrome_Crypt.2.sg
================================================
function detect(){return Binary.compare("b9....b8....eb$$05....fc80c4..eb$$eb$$f4")&&(sVersion="0.3",sOptions="1997 by Teraphy",bDetected=1),result()}meta("protector","Khrome Crypt")

================================================
FILE: dbs_min/db/COM/protector_LAME_GG.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$5eb9....314c..33c08ee003c605....faeb$$648b1e....899c....648b1e....899c....64a3....648c0e")&&(sOptions="1999",bDetected=1),result()}meta("protector","LAME GG (PROPHECY protection)")

================================================
FILE: dbs_min/db/COM/protector_LAMPROT.2.sg
================================================
function detect(){return Binary.compare("e9$$$$8b0e....be....bf....f3a4b9....bb....8a0734..880743e2..33c033c933db33d233ff33f668....c3")&&(sOptions="by gds //FH",bDetected=1),result()}meta("protector","LAMPROT")

================================================
FILE: dbs_min/db/COM/protector_Lock-Master.2.sg
================================================
function detect(){return Binary.compare("e9$$$$eb$$31c0061e502d....501f0726ff77..26ff77..8f87....8f87....ffb7....ffb7....585b29c353bb....5a1f07")&&(sVersion="9.0",sOptions="by Andrew Kacy",bDetected=1),result()}meta("protector","Lock-Master")

================================================
FILE: dbs_min/db/COM/protector_MASK.2.sg
================================================
function detect(){return Binary.compare("e8$$$$5557cd03fc4d41534bfa8bec836e....8b6e..fb49e8....5b81eb....50d6515256")?(sVersion="2.0",sOptions="1995 by JosB M. L. Lopes.",bDetected=1):Binary.compare("e8$$$$5557cd03fc4d41534bfa8bec8346....ff76..5d49e8....5b81eb....50d6515256")?(sVersion="2.4",sOptions="1995 by JosB M. L. Lopes.",bDetected=1):Binary.compare("e8$$$$5557cd03fc4d41534bfd50fa8bc4f7dcbc....9449fbd651521f5256")?(sVersion="2.5",sOptions="1995 by JosB M. L. Lopes.",bDetected=1):Binary.compare("e8$$$$5557cd03fc4d41534bfa8bec836e....ff76..5d49e800005b81eb")&&(sVersion="2.3",sOptions="1995 by JosB M. L. Lopes.",bDetected=1),result()}meta("protector","MASK")

================================================
FILE: dbs_min/db/COM/protector_MCLock.2.sg
================================================
function detect(){return(Binary.compare("e9$$$$909090fa29c08ec026c606......26c606......268c0e....26c606......26c606......268c0e....fbcd01")||Binary.compare("e9$$$$eb00e9$$$$909090fa29c08ec026c606......26c606......268c0e....26c606......26c606......268c0e....fbcd01"))&&(sVersion="1.2, 1.3",bDetected=1),result()}meta("protector","MCLock")

================================================
FILE: dbs_min/db/COM/protector_MESS.2.sg
================================================
function detect(){return Binary.compare("....................b9....f326ace3..eb$$ba....b409cd21cd20")&&(sVersion="1.07",bDetected=1),result()}meta("protector","MESS")

================================================
FILE: dbs_min/db/COM/protector_MSCC.2.sg
================================================
function detect(){return Binary.compare("e9$$$$0e07be....bf....b9....f3a4b9....be....accc9803d8e2")&&(sVersion="1.0a",sOptions="1997 by Mad $cientist",bDetected=1),result()}meta("protector","MSCC")

================================================
FILE: dbs_min/db/COM/protector_MegaShield.2.sg
================================================
function detect(){return Binary.compare("90b8....e72133d252be....bd....b9....ad03d0d3c233c2d3ca2bd0e2")&&(sVersion="1.01a",sOptions="by t-REX //PSA",bDetected=1),result()}meta("protector","MegaShield")

================================================
FILE: dbs_min/db/COM/protector_Microxor.2.sg
================================================
function detect(){return Binary.compare("e8$$$$bf....5e57b9....300ca4e2..c3")&&(sOptions="2000 by Jibz",bDetected=1),result()}meta("protector","MiCRoXoR")

================================================
FILE: dbs_min/db/COM/protector_NH.2.sg
================================================
function detect(){return Binary.compare("be....bf....57b9....f3a4c3")&&(bDetected=1,sOptions="by MANtiC0RE"),result()}meta("protector","NH")

================================================
FILE: dbs_min/db/COM/protector_NoAV.2.sg
================================================
function detect(){return Binary.compare("e9$$$$68....60be....66b8........668706....b9....51c1e9..41be....5156bf....e8")&&(sOptions="by VAG",bDetected=1),result()}meta("protector","NoAV")

================================================
FILE: dbs_min/db/COM/protector_Nodebug.2.sg
================================================
function detect(){return Binary.compare("e8$$$$b430cd21b4..03f897d6405e50978b4d..ac32c1aae2")&&(sVersion="1.0 part 1",sOptions="by JVP",bDetected=1),result()}meta("protector","Nodebug")

================================================
FILE: dbs_min/db/COM/protector_PCOM.2.sg
================================================
function detect(){return Binary.compare("be....b9....2e8a0434..2e880446e2")&&(sVersion="2.8b2, 2.8b3 -e -i",sOptions="1999",bDetected=1),result()}meta("protector","PCOM")

================================================
FILE: dbs_min/db/COM/protector_PCRYPT.2.sg
================================================
function detect(){return Binary.compare("'PCRYPT'ff'v3.51'00e9")&&(sVersion="3.51",sOptions="1997 by MERLiN //DTG",bDetected=1),result()}meta("protector","PCRYPT")

================================================
FILE: dbs_min/db/COM/protector_PCVault-Protect.2.sg
================================================
function detect(){return Binary.compare("be....fcac3c..75..e9....ac3c..74..e9....eb")&&(sOptions="1993 by E. Johnson",bDetected=1),result()}meta("protector","PCVault-Protect")

================================================
FILE: dbs_min/db/COM/protector_PROTECT.2.sg
================================================
function detect(){var e=Math.min(65536,Binary.getSize())
return-1!=Binary.findSignature(0,e,"0c02e9......e421e9......88e0..........eb....e621e9......88c4........e9......e621eb")?(sVersion="5.5",bDetected=1):-1!=Binary.findSignature(0,e,"e42150e9......e621e9......58e621e9......b0ffeb")||Binary.compare("e9$$$$ba....81f2")||Binary.compare("e9$$$$bb....81c3....eb")||Binary.compare("e9$$$$be....81ee....bb....d1cb8b04")||Binary.compare("e9$$$$bf....81ef....eb")||Binary.compare("e9$$$$be....81ee....bb....d1cb8b04")||Binary.compare("e9$$$$bf....81f7")||Binary.compare("e9$$$$ba....81c2....eb")||Binary.compare("e9$$$$bd....81f5....eb")||Binary.compare("e9$$$$bd....d1cd")||Binary.compare("e9$$$$bb....81f3")?(sVersion="5.0",bDetected=1):Binary.compare("e9$$$$1efd2efe")?(sVersion="5.5",bDetected=1):Binary.compare("e9$$$$e800005d81ed....33c08ed88bf0bf....b9....fcf3a5fd87fe8cc08ed833c08ec04f4f")?(sVersion="4.0",bDetected=1):Binary.compare("e9$$$$1eb430cd213c..73..cd20be....e8....e8....1f8cd88ec0")?(sVersion="6.0",bDetected=1):Binary.compare("e8$$$$501e060e550e1f33c08ec0fafc26a1....5026a1....50")?(sVersion="3.0/3.1",bDetected=1):Binary.compare("b8....50b8....50e9$$$$c606......eb$$8cc6060b01c3")?(sVersion="2.0",sOptions="1993",bDetected=1):Binary.compare("b8....50e9$$$$c606......eb$$8cc6060701c3eb")&&(sVersion="1.0",sOptions="1993",bDetected=1),result()}meta("protector","PROTECT! COM")

================================================
FILE: dbs_min/db/COM/protector_PTP.2.sg
================================================
function detect(){return Binary.compare("'PTP50'fafafcb430cd21fb585c582bc05257502ec606")?(sVersion="5.0",bDetected=1):Binary.compare("'PTP40'fafafcb430cd21fb585c582bc05257502ec606")&&(sVersion="4.0",bDetected=1),result()}meta("protector","PTP")

================================================
FILE: dbs_min/db/COM/protector_PassCOM.2.sg
================================================
function detect(){return Binary.compare("e9$$$$be....bf....b9....8ae1ac32c402e1aae2..68....c3")&&(sVersion="2.0",bDetected=1),result()}meta("protector","PassCOM")

================================================
FILE: dbs_min/db/COM/protector_Propellerhead_encryption.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b430cd2180fc..72..90e9....90bb....81c3....53b0..04..51b9....e9")&&(sOptions="1997",bDetected=1),result()}meta("protector","Propellerhead encryption")

================================================
FILE: dbs_min/db/COM/protector_ProtEXE.2.sg
================================================
function detect(){return Binary.compare("e9$$$$9c5053515256571e0655fabe....8a64..8b54..8bda81c3....8c4f..908b0f894c..8a4f..884c..8bfe8bca83e9..fcac")&&(sVersion="3.0",sOptions="1996",bDetected=1),result()}meta("protector","ProtEXE (com)")

================================================
FILE: dbs_min/db/COM/protector_R-Crypt.2.sg
================================================
function detect(){return Binary.compare("e9$$$$68....60bf....b9....b0..2e3005fec047e2..61c706........c606")?(sVersion="0.91",bDetected=1):Binary.compare("e9$$$$68....60bf....b9....b0..2e300547fec0e2..61c706........c606")?(sVersion="0.93",bDetected=1):Binary.compare("e9$$$$bf....57b9....c705....c645....8135....4747e2..33ffc3")&&(sVersion="0.92",bDetected=1),result()}meta("protector","R-Crypt")

================================================
FILE: dbs_min/db/COM/protector_RCC.2.sg
================================================
function detect(){var e
return Binary.compare("fabc....ffe4")?(e=Binary.readWord(2)-256,Binary.compare("83c4..bc....60e8$$$$e8$$$$50b8....58eb",e)&&(sVersion="0.51/386",bDetected=1)):Binary.compare("90bd....ffe5")?(e=Binary.readWord(2)-256,Binary.compare("faf7dc87ec83c4..81c4....f7dc83ec..87ecbc....50535251061eb9....b0..e6",e)&&(sVersion="1.08h",bDetected=1)):Binary.compare("fcbe....bf....5657b9....f3a55e5f33db33d2")?(sVersion="1.08h",bDetected=1):Binary.compare("e9$$$$9c505351525657551e06fcb8....cd21")&&(sName="RCC/286",sVersion="1.10",bDetected=1),result()}meta("protector","RCC II")

================================================
FILE: dbs_min/db/COM/protector_RSCC.2.sg
================================================
function detect(){return Binary.compare("b1..32ff82c7..b2..b5..b3..81c2....d0c203d133d1f7d232d13097")?(sVersion="1.03",bDetected=1):Binary.compare("....82........81......32..80....2b..81")||Binary.compare("....80........81......30..80....30..80")||Binary.compare("32ed80c5..b2..b6..29ff81cf....32c980")||Binary.compare("29ff81f7....33d281f2....31c981c9....f81015a64975..fa53f889ea8944")||Binary.compare("2aed80cd..28c982c1..2ad282ca..bb....81c2....f7da03d102d128174383")||Binary.compare("28ed82cd..2aff82cf..32db80f3..b1..33c081c0....05....d0c033c1f7d002c1f83187")?(sVersion="1.04",bDetected=1):Binary.compare("30c982f1..29d281ca....be....32ed82f5..81c2....d0c2f7da33d1")||Binary.compare("32ff82c7..b3..30ed80c5..b1..f88197........4343e2")?(sVersion="1.03",bDetected=1):Binary.compare("f5bb....b8....bf....2e8037..81ff....4374..4875..90b5..1f9b")?(sVersion="1.20",bDetected=1):Binary.compare("33d281f2....2bdb81f3....b9....3197....83c3..497f..2a142cca3aca")?(sVersion="1.04",bDetected=1):Binary.compare("2bc981c1....29d281f2....33db81c3....81c2....291783c3..497f..ab")||Binary.compare("b9....2bdb81cb....f880b7......434975..55fc532245..ef57f9")?(sVersion="1.03",bDetected=1):(Binary.compare("bf....8bf7b9....b4..8a0532c480c4..aae2")||Binary.compare("b9....be....8bfeadd1c034..86c42ae003c7abe2")||Binary.compare("fc50be....bf....57b9....f3a4c3")||Binary.compare("eb$$fcbe....bf....57b9....f3a4bf....be....b9....c3"))&&(sVersion="1.0X",sOptions="mutated COM like RSCC",bDetected=1),result()}meta("protector","RSCC")

================================================
FILE: dbs_min/db/COM/protector_SCC.2.sg
================================================
function detect(){return Binary.compare("fd53565b0fa1be....ad648b16....643106....648916....adff36....643306")&&(sOptions="by The Cleric //LZ0",bDetected=1),result()}meta("protector","SCC")

================================================
FILE: dbs_min/db/COM/protector_SCRAM.2.sg
================================================
function detect(){return Binary.compare("'SCRAM'b430cd213c..77..cd20bc....b9....8bfcb2..584cf6d82ac2d2c8feca32d181ff....73..eb")&&(sVersion="0.8a1",sOptions="1997 by bushwoelie & ACP",bDetected=1),result()}meta("protector","SCRAM!")

================================================
FILE: dbs_min/db/COM/protector_Scrambler.2.sg
================================================
function detect(){return Binary.compare("eb$$fafc31ff8ec726ff36....26ff36....8d36....b9....f3a4b9....cd00")&&(sVersion="1.00",bDetected=1),result()}meta("protector","Scrambler")

================================================
FILE: dbs_min/db/COM/protector_Scrypt!.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$e800005a5f578bf78bce33dbb7..acfec0f6d032c7aa86fb43c1c3..331e....331e....331e....331e")?(sVersion="0.4",sOptions="by DarkGrey //DTG",bDetected=1):Binary.compare("e9$$$$e8$$$$5d81ed....b9....be....03f58bfeb4..ac32c4f6d4aae2")&&(sVersion="0.4",sOptions="1998 by DarkGrey //DTG",bDetected=1),result()}meta("protector","Scrypt!")

================================================
FILE: dbs_min/db/COM/protector_Scrypt.2.sg
================================================
function detect(){return Binary.compare("e9$$$$e800005d8d5e..eb$$53eb$$66bd........e9$$$$b8....eb$$cc")&&(sVersion="1.0",sOptions="1998 by hijaq //BAC",bDetected=1),result()}meta("protector","SCRYPT")

================================================
FILE: dbs_min/db/COM/protector_SelfCrypt.2.sg
================================================
function detect(){return Binary.compare("8cc88ed833ffbe....bb....8a048a1132c288043c..74..4683ff..7d..47eb")?(sOptions="1999 by MCS",bDetected=1):(Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2")||Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....ad2ea3....2e3136....8bc18bdef7e32e3106....2e3116....2ea1....abe2"))&&(sVersion="1994 by PHOENiX",bDetected=1),result()}meta("protector","SelfCrypt")

================================================
FILE: dbs_min/db/COM/protector_SelfProtect386.2.sg
================================================
function detect(){return Binary.compare("'=SYRIUS=DIRE=SERVICE='071a")&&(bDetected=1),result()}meta("protector","SelfProtect386")

================================================
FILE: dbs_min/db/COM/protector_SnoopStop.2.sg
================================================
function detect(){return Binary.compare("90e9$$$$eb$$55e80000598be981ed....66608d9e....8d8e....2bcb2e8a0734..34..34..fec0f6d0")&&(sVersion="1.15",sOptions="1998 by Trills and Technologies",bDetected=1),result()}meta("protector","SnoopStop")

================================================
FILE: dbs_min/db/COM/protector_SoftGuard.1.sg
================================================
function detect(){return Binary.compare("e9$$$$8cc88ed88c06....8cc73bc774..8bfc368b052ea3....368b45..2ea3....a1....a3....a1....a3....a1....b1")&&(sOptions="1984-86",bDetected=1),result()}meta("protector","Softguard")

================================================
FILE: dbs_min/db/COM/protector_Steplock.2.sg
================================================
function detect(){return Binary.compare("e9$$$$0e1fb9....030e....be....d204282c46e2")&&(sVersion="1.00A",sOptions="by Morten Pedersens",bDetected=1),result()}meta("protector","Steplock")

================================================
FILE: dbs_min/db/COM/protector_TCEC.2.sg
================================================
function detect(){return Binary.compare("1aff5fb9....f326ace3..eb")&&(sVersion="3.60",sOptions="by ThE CLERiC! //LZ0, EVD",bDetected=1),result()}meta("protector","TCEC")

================================================
FILE: dbs_min/db/COM/protector_UnPackStop.2.sg
================================================
function detect(){var e
return Binary.compare("68....c3")&&(e=Binary.readWord(1)-256,Binary.compare("8bc450be....bf....eb$$b8....501f58eb",e))&&(sVersion="0.95",sOptions="by Szaszi (Szabo Laszlo)",bDetected=1),result()}meta("protector","UnPackStop")

================================================
FILE: dbs_min/db/COM/protector_UniCrypt.1.sg
================================================
function detect(){return Binary.compare("8cc805....50b8....50cb")&&(sVersion="1.01",sOptions="1998 by V.Slinchuk",bDetected=1),result()}meta("protector","UniCrypt")

================================================
FILE: dbs_min/db/COM/protector_Venus.2.sg
================================================
function detect(){return Binary.compare("b9....fa8bdc8cd2bc....03e1d1e94c4c5886e9d3c033c186e9f7d050e2")&&(bDetected=1),result()}meta("protector","Venus crypt")

================================================
FILE: dbs_min/db/COM/protector_XORCOPY.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b8....bb....ba....3107434039d375..c606......c606......c606......31c031db31d2e9")&&(sVersion="1.0",sOptions="1995 by DeiMoS",bDetected=1),result()}meta("protector","XORCOPY")

================================================
FILE: dbs_min/db/COM/protector_XcomOR.2.sg
================================================
function detect(){return Binary.compare("'MMX'e8$$$$83c5..8306......b8....5050ffe0")?(sVersion="0.XX",bDetected=1):Binary.compare("'MMX'668136............eb$$668136............eb")?(sVersion="0.99i, 0.99h",bDetected=1):Binary.compare("'MMX'b409ba....cd21e8$$$$1e6a..1f8136........8136........8b1e....a1....501f813f....75")?bDetected=1:Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533edeb$$4f030de8")?(sName="XcomOR/486 by madmax",bDetected=1):Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533ede8$$$$1e6a..1f")?(sVersion="0.99f",bDetected=1):Binary.compare("e8$$$$8006......b4..5050c3bf....57bb....8b4d..81")?(sVersion="0.99a",bDetected=1):Binary.compare("'MMX'eb$$4feb$$8b0dba....83c2..90eb")&&(bDetected=1),result()}meta("protector","XcomOR by madmax")

================================================
FILE: dbs_min/db/COM/protector_XoReR.2.sg
================================================
function detect(){return Binary.compare("e9$$$$ba....b9....51b0..e660fab430cd213c..73..33c00650cbbf....8b36....59e2")?(sVersion="2.l",sOptions="by dR.No //ViP",bDetected=1):Binary.compare("e9$$$$be....8bfeb9....33db80c3..ac32c3aae2")?(sVersion="1.0",sOptions="by dR.No //ViP",bDetected=1):Binary.compare("e9$$$$b8....e721b8....cd21b430cd218b2e....8b1e....bf....b9....b430cd2132..73..be....bf....b9....fcac300547e2")?(sVersion="1.0 [2nd pass]",sOptions="by dR.No //ViP",bDetected=1):Binary.compare("e9$$$$ba....b9....51b8....e721b430cd213c..73..33c00650cb")&&(sVersion="2.0",sOptions="1998 by dR.No //ViP",bDetected=1),result()}meta("protector","XoReR")

================================================
FILE: dbs_min/db/COM/protector_XorCom.2.sg
================================================
function detect(){return Binary.compare("e9$$$$fcbe....bf....57b9....ac34..aae2..c3")&&(sVersion="1.0",sOptions="by tFF",bDetected=1),result()}meta("protector","XorCom")

================================================
FILE: dbs_min/db/COM/protector_aPatch.2.sg
================================================
function detect(){return Binary.compare("e8$$$$fde8$$$$ffc75e83ee..e8$$$$5d8176......c646....eb")&&(sVersion="0.05-0.33",bDetected=1),result()}meta("protector","aPatch")

================================================
FILE: dbs_min/db/COM/protector_acBBS_protection.2.sg
================================================
function detect(){return Binary.compare("e9$$$$bf....b9....870581f0....86e0faeb$$e8$$$$501e33c08ed8eb$$8706....eb$$8706....8706....1f58c3")&&(sOptions="1994 by p.q.",bDetected=1),result()}meta("protector","acBBS protection p1")

================================================
FILE: dbs_min/db/COM/protector_com-crypt.2.sg
================================================
function detect(){return Binary.compare("b8....ffe0")?(sOffset=Binary.readWord(1),Binary.compare("5756bf....b8....abb8....abb0..aa89feb9....31dbad01c329cb89d8abe2",sOffset-256)?(sOptions="by BlackLight, MANtiCORE",bDetected=1):Binary.compare("be....562ec704....2ec744......2ec644....b9....8a0434..880446",sOffset-256)&&(sName="com-crypt on BASIC",sOptions="by BlackLight, MANtiCORE",bDetected=1)):Binary.compare("e8$$$$b7..538b4f..8a47..c0c8..880743e2")&&(sOptions="by Frenzy",bDetected=1),result()}meta("protector","com-crypt")

================================================
FILE: dbs_min/db/COM/protector_fds-cp.2.sg
================================================
function detect(){return Binary.compare("8cca2e8916....b4..8b2e....8b1e....8edaa3....8c06....891e....892e....eb")&&(sVersion="0.04a",bDetected=1),result()}meta("protector","fds-cp")

================================================
FILE: dbs_min/db/COM/protector_mCrypt.2.sg
================================================
function detect(){return Binary.compare("e9$$$$1e06be....bf....b9....0e1f0e07e8$$$$33c0fa5083c4..83ec..58fb0bc075..c3")&&(sVersion="0.1a",sOptions="1998 by //UFO CREW",bDetected=1),result()}meta("protector","mCrypt")

================================================
FILE: dbs_min/db/COM/protector_protection.2.sg
================================================
function detect(){return Binary.compare("33db9090b9....fcad03d8e2..b9....be....8bfefcad33c3ab43e2")&&(sOptions="by ROWDY, St.Petersburg",bDetected=1),result()}meta("protector","protection")

================================================
FILE: dbs_min/db/COM/protector_spirit.2.sg
================================================
function detect(){return Binary.compare("e9$$$$b430cd21f6d12ea6e8....b462cd21e8....3636fb969034..c3")?(sVersion="1.X",bDetected=1):(Binary.compare("e9$$$$aee8$$$$e4210c..fbe62190b8....fb5026509087c1")||Binary.compare("e9$$$$369f9f1c..e9$$$$e8$$$$e421f80c..e6218d06....fc505089c1fb")||Binary.compare("e9$$$$f8d72606b435cd2107e8$$$$1c..1c..33d226f6da12ddfcf905....f8f5f6ea"))&&(sVersion="1.5",bDetected=1),result()}meta("protector","$pirit")

================================================
FILE: dbs_min/db/COM/protector_sticker.2.sg
================================================
function detect(){return Binary.compare("be....8bc6b1..d3e88cdb03c30344..a3....8cc805....a3....8b44..b1..d3e8")&&(sOptions="1994 by TigraSoft",bDetected=1),result()}meta("protector","sticker")

================================================
FILE: dbs_min/db/COM/protector_x3.2.sg
================================================
function detect(){return(Binary.compare("e8$$$$5ebf....57b9....ac34..aae2..c3")||Binary.compare("ba....2e408b142633f6402681c6....2e1ad3"))&&(sVersion="1.4",sOptions="by MANtiC0RE",bDetected=1),result()}meta("protector","x3")

================================================
FILE: dbs_min/db/COM/self-displayer_ACiDDRAW.1.sg
================================================
function detect(){return(Binary.compare("e9$$$$b8....cd10b4..b9....cd10e8....ba....90e8....3d....75..e9....3d....75..e9....3d....75..e9....3d....75..eb")||Binary.compare("eb$$b8....cd10b4..b9....cd10e8....ba....90e8....3d....75..e9....3d....75..e9....3d....75..e9....3d....75..eb"))&&(sVersion="1.2",bDetected=1),result()}meta("self-displayer","ACiDDRAW")

================================================
FILE: dbs_min/db/COM/self-displayer_ANS2ALL.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$b8....cd103c..75..80fb..73..58b8....cd21fcb8....8ec0be....bf....b9....f3a4fa")&&(sVersion="1.3",sOptions="by ZeroCoder //XG",bDetected=1),Binary.compare("e9$$$$2bc9b6..b2..b7..b4..cd212ad22af6b7..b4..cd10b6..32d2b7..b4..cd101e33c050")&&(sOptions="by ZeroCoder //XG",bDetected=1),result()}meta("self-displayer","ANS2ALL")

================================================
FILE: dbs_min/db/COM/self-displayer_ASC2COM.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e8$$$$33c0cd333d....75..c606......b8....cd338916....c3")?(sVersion="2.02",sOptions="1992 by MorganSoft",bDetected=1):Binary.compare("e8$$$$e8$$$$b401b7..b9....cd10c3f8bb....8b073d....75..c3")?(sVersion="1.10B",sOptions="1989 by MorganSoft",bDetected=1):Binary.compare("e9$$$$e8$$$$50535157bb....803f..74..33c98a0f438bfbb8....e3")?(sVersion="2.01 Compressed",sOptions="1992 by MorganSoft",bDetected=1):Binary.compare("e9$$$$e8$$$$e8$$$$b4..b7..b9....cd10c3")&&(sOptions="1989 by MorganSoft",bDetected=1),result()}meta("self-displayer","ASC2COM")

================================================
FILE: dbs_min/db/COM/self-displayer_DOC2COM.1.sg
================================================
function detect(){return Binary.compare("fc8b0e....498b36....8bfeac3204aae2")&&(sOptions="by Jerry DePyper",bDetected=1),result()}meta("self-displayer","DOC2COM")

================================================
FILE: dbs_min/db/COM/self-displayer_DOC2PAGE.1.sg
================================================
function detect(){return Binary.compare("e9$$$$fc8a0e....32ede3..bf....b0..f3ae74..e8....ba....cd21ba....cd21e9")&&(sOptions="by Th. Edel",bDetected=1),result()}meta("self-displayer","DOC2PAGE")

================================================
FILE: dbs_min/db/COM/self-displayer_GTXT.1.sg
================================================
function detect(){return Binary.compare("bb....b4..b1..8a070ac074..247f3c..75..438a070ac0")&&(sVersion="1.1",sOptions="by EGans 05/08/86",bDetected=1),result()}meta("self-displayer","GTXT")

================================================
FILE: dbs_min/db/COM/self-displayer_HYPDOC.1.sg
================================================
function detect(){return Binary.compare("e9$$$$e8....e8....e8....2ec606......2ec606......b9....2e8a26....b0..e8....2ec606......2ec606......2e8b3e....0e07")&&(sVersion="1.0",bDetected=1),result()}meta("self-displayer","HYPDOC")

================================================
FILE: dbs_min/db/COM/self-displayer_List.1.sg
================================================
function detect(){return Binary.compare("bc....1e2bc0508926....b430cd213c")?(sOptions="by Vernon D. Buerg",bDetected=1):Binary.compare("bc....1e2bc0508926....e8$$$$b430cd213c")?(sVersion="6.00",sOptions="1985 by Vernon D. Buerg",bDetected=1):Binary.compare("bc....1e2bc0508926....b430cd21a2")&&(sVersion="6.2a",sOptions="1987 by Vernon D. Buerg",bDetected=1),result()}meta("self-displayer","List")

================================================
FILE: dbs_min/db/COM/self-displayer_MakeRead.1.sg
================================================
function detect(){return Binary.compare("e9$$$$c706........c606......c606......e8....bf....893e....bf....893e....b4..b0..0106....578bc78b3e....fcab")&&(sVersion="1.8",sOptions="1987",bDetected=1),result()}meta("self-displayer","MakeRead")

================================================
FILE: dbs_min/db/COM/self-displayer_ONLINE-HELP.1.sg
================================================
function detect(){return Binary.compare("e9$$$$8cc805....2ea3....be....ac3c..74..72..3c..72..3c..77..4e33c033dbba....8a1c80eb..80fb..77")&&(sOptions="1990 by Clockwork Software",bDetected=1),result()}meta("self-displayer","ONLINE-HELP")

================================================
FILE: dbs_min/db/COM/self-displayer_PFL2COM.1.sg
================================================
function detect(){return Binary.compare("eb$$be....bf....53bb....8a1780fa..74..80fa..75..c706")&&(sOptions="by C.P.White 1987-90",bDetected=1),result()}meta("self-displayer","PFL2COM")

================================================
FILE: dbs_min/db/COM/self-displayer_RELETTER.1.sg
================================================
function detect(){return Binary.compare("e9$$$$bc....bf....bb....8a0784c075..e9....438a073c..74..3c..74..89da438a073c..74")&&(sVersion="1.0",sOptions="1993 by Hans J. Baer",bDetected=1),result()}meta("self-displayer","RELETTER")

================================================
FILE: dbs_min/db/COM/self-displayer_SHOWV20.1.sg
================================================
function detect(){return Binary.compare("e9$$$$b8....2b06....a3....e8$$$$bf....cd1125....3d....74..bf....893e....c3")&&(sName+="V20",sOptions="1992-93 by Simple Software Co.",bDetected=1),Binary.compare("e9$$$$b8....2b06....a3....e8$$$$50a0....a2....58c3")&&(sOptions="1992-93 by Simple Software Co.",bDetected=1),result()}meta("self-displayer","SHOW")

================================================
FILE: dbs_min/db/COM/self-displayer_TXT2COM.1.sg
================================================
function detect(){return Binary.compare("e8$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7")||Binary.compare("e9$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7")?(sVersion="1.1",sOptions="1987 by Keith P. Graham",bDetected=1):Binary.compare("8d26....e8$$$$b4..cd103c..74..c706........c706........3c..74..3c..74..8d16....b409cd21cd20c706")&&(sVersion="2.06",sOptions="1989 by Keith P. Graham",bDetected=1),result()}meta("self-displayer","TXT2COM")

================================================
FILE: dbs_min/db/COM/self-displayer_TXTmaker.1.sg
================================================
function detect(){return Binary.compare("eb$$b4..33dbcd1080fc..74..b0..eb$$b44ccd21")&&(sVersion="1.22",sOptions="1991 by Jack A. Orman",bDetected=1),result()}meta("self-displayer","TXTmaker")

================================================
FILE: dbs_min/db/COM/self-displayer_Txt2Exe.1.sg
================================================
function detect(){return Binary.compare("bf....033e....b9....2b0e....d1e9b8....f3abb4..cd1030e4a3....b8....cd10b8....8a1e....cd10")&&(sVersion="3.1b",sOptions="2001 by BlackLight",bDetected=1),result()}meta("self-displayer","Txt2Exe")

================================================
FILE: dbs_min/db/COM/self-displayer_readme.com.1.sg
================================================
function detect(){return Binary.compare("bb....b8....cd21be....fcbf....f6c2..74..f6c2..74..bf....ac3c..74..b4")&&(bDetected=1),result()}meta("self-displayer","README.COM")

================================================
FILE: dbs_min/db/COM/sfx_LHA.1.sg
================================================
function detect(){return Binary.compare("eb$$fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")?(sVersion="2.05L, 2.10-2.13, 2.55",bDetected=1):Binary.compare("eb$$00fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")&&(sVersion="2.13S",bDetected=1),result()}meta("sfx","LHA SFX")

================================================
FILE: dbs_min/db/COM/sfx_PKZip.1.sg
================================================
function detect(){return Binary.compare("b9....bf....2bcf32c0f3aab430cd21a3....8da5....8926....b8....e8")&&(sVersion="2.04g",bDetected=1),Binary.compare("b9....bf....2bcf32c0f3aa8da5....83e4..8926....b430cd21a3....8cd8")&&(sVersion="2.50",sOptions="1999 by PKWARE Inc.",bDetected=1),result()}meta("sfx","PKZip mini-sfx")

================================================
FILE: dbs_min/db/COM/simple_ansi_viewer.1.sg
================================================
function detect(){return Binary.compare("b8....bb....b9....0e1fba....cd21b8004ccd21")&&(bDetected=1),result()}meta("self-displayer","simple ANSI viewer")

================================================
FILE: dbs_min/db/COM/simple_self-displayer.1.sg
================================================
function detect(){return Binary.compare("b8....8ec0b4..b9....cd102bc92bffb8....51b9....f3ab59be....2bdb2bed2bd28bfdac")&&(bDetected=1),result()}meta("self-displayer","simple self-displayer")

================================================
FILE: dbs_min/db/COM/virus.1.sg
================================================
function detect(){return Binary.compare("e9$$$$fa8bece800005b81eb....2ef687......74..8db7....bc....31343124464c75")?(sName="Cascade.1701",bDetected=1):Binary.compare("e9$$$$89e5fae800005b81eb....2ef687......74..8db7....bc....31343124464c75")&&(sName="Cascade.1704",bDetected=1),result()}meta("virus","")

================================================
FILE: dbs_min/db/CurIcoBPP
================================================
function getCurIcoBPP(r){var a=0
return r=Binary.readDword(r+12),40==Binary.readDword(r)?a=Binary.readWord(r+14):Binary.compare("89'PNG\r\n'1A0A",r)&&(a=32),a}

================================================
FILE: dbs_min/db/DEX/_DEX.0.sg
================================================
function detect(){return DEX.isVerbose()&&(sName=DEX.getOperationSystemName(),sVersion=DEX.getOperationSystemVersion(),sOptions=DEX.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","Android")

================================================
FILE: dbs_min/db/DEX/_DEX2.0.sg
================================================
function detect(){return sName=DEX.getFileFormatName(),sVersion=DEX.getFileFormatVersion(),sOptions=DEX.getFileFormatOptions(),bDetected=1,result()}meta("format","DEX")

================================================
FILE: dbs_min/db/DEX/_init
================================================
var File=DEX,X=DEX

================================================
FILE: dbs_min/db/DEX/compiler_dexlib2.4.sg
================================================
function detect(){return 237496182==DEX.getMapItemsHash()&&(bDetected=1),result()}meta("compiler","dexlib2")

================================================
FILE: dbs_min/db/DEX/library_UnicomSDK.4.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/unicom/dcLoader/Utils;"),result()}meta("library","UnicomSDK")

================================================
FILE: dbs_min/db/DEX/obfuscator_ProGuard.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/google/android/gms/common/ProGuardCanary;"),result()}meta("obfuscator","ProGuard")

================================================
FILE: dbs_min/db/DEX/protector_AESObfuscator.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("AESObfuscator.java"),sLang="Java",result()}meta("protector","AESObfuscator")

================================================
FILE: dbs_min/db/DEX/protector_APKProtect.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("APKProtect"),result()}meta("protector","APKProtect")

================================================
FILE: dbs_min/db/DEX/protector_AlibabaProtection.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/ali/mobisecenhance/StubApplication;"),result()}meta("protector","AlibabaProtection")

================================================
FILE: dbs_min/db/DEX/protector_AllatoriObfuscator.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("ALLATORIxDEMO"),sVersion=bDetected?"Demo":"",result()}meta("protector","Allatori")

================================================
FILE: dbs_min/db/DEX/protector_ApkEncryptor.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcn/beingyi/sub/utils/Native;"),result()}meta("protector","ApkEncryptor")

================================================
FILE: dbs_min/db/DEX/protector_AppSolid.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lweb/apache/sax/app;"),result()}meta("protector","AppSolid")

================================================
FILE: dbs_min/db/DEX/protector_BaiduProtection.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/baidu/protect/StubApplication;"),result()}meta("protector","BaiduProtection")

================================================
FILE: dbs_min/db/DEX/protector_BangcleProtection.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("apkFilePath"),result()}meta("protector","BangcleProtection")

================================================
FILE: dbs_min/db/DEX/protector_EasyProtector.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("com.easyprotector.android"),result()}meta("protector","EasyProtector")

================================================
FILE: dbs_min/db/DEX/protector_Jiagu.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("/.jiagu"),result()}meta("protector","Jiagu")

================================================
FILE: dbs_min/db/DEX/protector_Kiwi.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("Kiwi__Version__Obfuscator"),result()}meta("protector","Allatori")

================================================
FILE: dbs_min/db/DEX/protector_LIAPP.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/lockincomp/liapp/LiappClassLoader;"),result()}meta("protector","LIAPP")

================================================
FILE: dbs_min/db/DEX/protector_MedusaH.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/seworks/medusah/MedusahDex;"),result()}meta("protector","Medusah")

================================================
FILE: dbs_min/db/DEX/protector_ModGuard.2.sg
================================================
function detect(){return DEX.isDexStringPresent("ModGuard - Protect Your Piracy v1.2 by ill420smoker")?sVersion="v1.2":DEX.isDexStringPresent("ModGuard - Protect Your Piracy v1.3 by ill420smoker")&&(sVersion="v1.3"),result()}meta("protector","ModGuard")

================================================
FILE: dbs_min/db/DEX/protector_NQShield.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/nqshield/Common;"),result()}meta("protector","NQShield")

================================================
FILE: dbs_min/db/DEX/protector_NagaPTProtection.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("LIBRARY_DDOG")||DEX.isDexStringPresent("LIBRARY_FDOG"),result()}meta("protector","NagaPTProtection")

================================================
FILE: dbs_min/db/DEX/protector_PangXie.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("PangXie")||DEX.isDexStringPresent("nsecure"),result()}meta("protector","Jiagu")

================================================
FILE: dbs_min/db/DEX/protector_QDBH.2.sg
================================================
function detect(){return bDetected=DEX.isDexStringPresent("/qdbh"),result()}meta("protector","QDBH")

================================================
FILE: dbs_min/db/DEX/protector_SecNeo.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/secneo/apkwrapper/ApplicationWrapper;"),result()}meta("protector","SecNeo")

================================================
FILE: dbs_min/db/DEX/protector_TencentProtection.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/tencent/StubShell/TxAppEntry;"),result()}meta("protector","TencentProtection")

================================================
FILE: dbs_min/db/DEX/protector_VDog.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/vdog/Common;"),result()}meta("protector","Vdog")

================================================
FILE: dbs_min/db/DEX/protector_Yidun.2.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("La/_;"),result()}meta("protector","Yidun")

================================================
FILE: dbs_min/db/DEX/tool_ApkToolPlus.6.sg
================================================
function detect(){return bDetected=DEX.isDexItemStringPresent("Lcom/linchaolong/apktoolplus/jiagu/utils/ApkToolPlus;"),result()}meta("tool","ApkToolPlus")

================================================
FILE: dbs_min/db/DOS16M/_DOS16M.0.sg
================================================
function detect(){return DOS16M.isVerbose()&&(sName=DOS16M.getOperationSystemName(),sVersion=DOS16M.getOperationSystemVersion(),sOptions=DOS16M.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","DOS16M")

================================================
FILE: dbs_min/db/DOS16M/_init
================================================
var File=DOS16M,X=DOS16M

================================================
FILE: dbs_min/db/DOS16M/compiler_Watcom.2.sg
================================================
function detect(){return bDetected=1,result()}meta("compiler","Watcom C")

================================================
FILE: dbs_min/db/DOS4G/_DOS4G.0.sg
================================================
function detect(){return DOS4G.isVerbose()&&(sName=DOS4G.getOperationSystemName(),sVersion=DOS4G.getOperationSystemVersion(),sOptions=DOS4G.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","DOS4G")

================================================
FILE: dbs_min/db/DOS4G/_init
================================================
var File=DOS4G,X=DOS4G

================================================
FILE: dbs_min/db/DOS4G/compiler_Watcom.2.sg
================================================
function detect(){return bDetected=1,result()}meta("compiler","Watcom C")

================================================
FILE: dbs_min/db/ELF/Borland_Kylix.4.sg
================================================
function detect(){return(ELF.isSectionNamePresent("borland.ressym")||ELF.isSectionNamePresent("borland.reshash")||ELF.isSectionNamePresent("borland.resdata")||ELF.isSectionNamePresent("borland.resspare"))&&(bDetected=1),sLang="Pascal/C/C++",result()}meta("compiler","Borland Kylix")

================================================
FILE: dbs_min/db/ELF/Free_Pascal.4.sg
================================================
function detect(){var e,t,i,c
return ELF.compareEP("5989e38d44....83e4..8915........a3........890d........891d........e8........8925........31ede8........c3")?(sVersion="2.6.0",bDetected=1):ELF.compareEP("31ED5989E3")||ELF.isSectionNamePresent(".fpc.resources")?bDetected=1:ELF.isSectionNamePresent(".fpcdata")?(bDetected=1,e=ELF.getSectionNumber(".fpcdata"),t=ELF.getSectionFileOffset(e),0<(i=ELF.getSectionFileSize(e))&&-1!=(c=ELF.findString(t,4,"FPC "))&&(sVersion=ELF.getString(c+4))):ELF.isSectionNamePresent(".data")&&(e=ELF.getSectionNumber(".data"),t=ELF.getSectionFileOffset(e),256<=(i=ELF.getSectionFileSize(e)))&&-1!=(c=ELF.findString(t+i-256,256,"FPC "))&&(sVersion=ELF.getString(c+4),bDetected=1),sLang="Pascal",result()}meta("compiler","Free Pascal")

================================================
FILE: dbs_min/db/ELF/HP_C++.4.sg
================================================
function detect(){return ELF.isSectionNamePresent(".HP.init")&&(bDetected=1),sLang="C++",result()}meta("compiler","HP C++")

================================================
FILE: dbs_min/db/ELF/IBM_AIX_kernel_loader.4.sg
================================================
function detect(){return 4<=ELF.getNumberOfPrograms()&&ELF.getProgramFileSize(1)<=256&&-1!=ELF.findString(ELF.getProgramFileOffset(1),Math.min(256,ELF.getProgramFileSize(1)),"IBM,RPA-Client-Config")&&(bDetected=1),-1!=ELF.findString(ELF.getProgramFileOffset(0),Math.min(256,ELF.getProgramFileSize(0)),"PowerPC")&&(sVersion="PowerPC"),result()}meta("boot","IBM AIX kernel loader")

================================================
FILE: dbs_min/db/ELF/Oracle_Solaris_Studio.4.sg
================================================
function getOSSVersion(){var e=ELF.getSectionNumber(".comment")
if(-1!=e){var t=ELF.getSectionFileOffset(e),e=ELF.getSectionFileSize(e),n=ELF.findString(t,e,"Sun WorkShop")
if(-1!=n)return ELF.getString(n+13,100)
if(-1!=(n=ELF.findString(t,e,"acomp: Sun C")))return ELF.getString(n+13,100)
if(-1!=ELF.findString(t,e,"SUNWCC.h"))return"5.X"}return""}function detect(){var e
return ELF.compareEP("bc1020..e003....1300....e022....a203a0..1300....e222....1300....e222....a52c20..a404a0..a40440122700....e804....80a520")&&(ELF.isSectionNamePresent(".SUNW_version")&&(bDetected=1),e=getOSSVersion())&&(bDetected=1,sVersion=e),sLang="C/C++",result()}meta("compiler","Oracle Solaris Studio")

================================================
FILE: dbs_min/db/ELF/_ELF.0.sg
================================================
function detect(){return ELF.isVerbose()&&(sName=ELF.getOperationSystemName(),sVersion=ELF.getOperationSystemVersion(),sOptions=ELF.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","Unix")

================================================
FILE: dbs_min/db/ELF/_init
================================================
var File=ELF,X=ELF

================================================
FILE: dbs_min/db/ELF/compiler_DMD.4.sg
================================================
function getVersion(){var e=ELF.getSectionNumber(".comment")
if(-1!=e){e=ELF.findString(ELF.getSectionFileOffset(e),ELF.getSectionFileSize(e),"DMD v")
if(-1!=e)return ELF.getString(e+5,20)}return ""}function detect(){var e=getVersion()
return e&&(bDetected=1,sVersion=e),sLang="D",result()}meta("compiler","DMD")

================================================
FILE: dbs_min/db/ELF/compiler_FASM.4.sg
================================================
function detect(){if(0==ELF.getElfHeader_shstrndx()&&0==ELF.getElfHeader_shnum()&&ELF.getElfHeader_shentsize()){sVersion="1.X",bDetected=1
for(var e=0;e<ELF.getNumberOfPrograms()-1&&bDetected;e++)0==ELF.getProgramFileOffset(e)&&(bDetected=0)}return sLang="ASMx"+(ELF.is64()?"64":"86"),result()}meta("compiler","FASM")

================================================
FILE: dbs_min/db/ELF/compiler_Go.4.sg
================================================
function detect(){return(ELF.isSectionNamePresent(".gosymtab")||ELF.isSectionNamePresent(".gopclntab")||ELF.isSectionNamePresent(".go.buildinfo")||ELF.isSectionNamePresent(".note.go.buildid"))&&(bDetected=1),ELF.compareEP("488d742408488b3c24b810174200ffe0b870f94100ffe0000000000000000000")?(bDetected=1,sVersion="1.2.2"):ELF.compareEP("488d742408488b3c24b8907f4200ffe0b800564200ffe0000000000000000000")?(bDetected=1,sVersion="1.3 or 1.3.1"):ELF.compareEP("488d742408488b3c24b8c07f4200ffe0b830564200ffe0000000000000000000")?(bDetected=1,sVersion="1.3.2"):ELF.compareEP("488d742408488b3c24b8e07f4200ffe0b850564200ffe0000000000000000000")?(bDetected=1,sVersion="1.3.3"):ELF.compareEP("488d742408488b3c24488d0510000000ffe00000000000000000000000000000")?(bDetected=1,sVersion="1.4.x or 1.5.X"):ELF.compareEP("488d742408488b3c24488d0510000000ffe0cccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.6.X-1.9.X"):ELF.compareEP("e92bc9ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")?(bDetected=1,sVersion="1.10.X"):ELF.compareEP("e9cbc6ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")?(bDetected=1,sVersion="1.11.X"):ELF.compareEP("e9dbc6ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")?(bDetected=1,sVersion="1.12.X"):ELF.compareEP("e92bc6ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")?(bDetected=1,sVersion="1.13.X"):ELF.compareEP("e92bc4ffffcccccccccccccccccccccc8b7c2408b8e70000000f05c3cccccccc")?(bDetected=1,sVersion="1.14.X"):ELF.compareEP("e91bcbffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.15.X"):ELF.compareEP("e95bcaffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.16.X"):ELF.compareEP("e93bc6ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.17.X"):ELF.compareEP("e9fbc5ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.18.X"):ELF.compareEP("e99bc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.22.X-1.23.X"):ELF.compareEP("e95bc5ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.20.X"):ELF.compareEP("e9bbc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.23.X"):ELF.compareEP("e9dbc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.23.2"):ELF.compareEP("e91bc7ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.23.5"):ELF.compareEP("e95bc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")||ELF.compareEP("e97bc8ffffcccccccccccccccccccccccccccccccccccccccccccccccccccccc")?(bDetected=1,sVersion="1.24.X"):ELF.compareEP("4831ed4889e7488d35........4883e4..e8........8b37488d57..49c7c0")?(bDetected=1,sVersion="1.24.0"):ELF.compareEP("31ed4989d15e4889e24883e4..505449c7c0........48c7c1........48c7c7")?(bDetected=1,sVersion="1.24.1"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e87902ffffe804000000cd030000")?(bDetected=1,sVersion="1.2.2"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e8f977feffe804000000cd030000")?(bDetected=1,sVersion="1.3 or 1.3.1"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e8e977feffe804000000cd030000")?(bDetected=1,sVersion="1.3.2"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e8c977feffe804000000cd030000")?(bDetected=1,sVersion="1.3.3"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e89932ffffe804000000cd030000")?(bDetected=1,sVersion="1.4.X"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e809000000cd0300000000000000")?(bDetected=1,sVersion="1.5.X"):ELF.compareEP("83ec088b4424088d5c240c890424895c2404e809000000cd03cccccccccccccc")?(bDetected=1,sVersion="1.6.X-1.9.X"):ELF.compareEP("e9....ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.10"):ELF.compareEP("e9ebd8ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.10.X"):ELF.compareEP("e96bdbffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.11.X"):ELF.compareEP("e97b..ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.12.X"):ELF.compareEP("e99bffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.13.X"):ELF.compareEP("e99bd9ffffccccccccccccccccccccccb8fc0000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.14.X"):ELF.compareEP("e9abdcffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.15.X"):ELF.compareEP("e9dbdcffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.16.X"):ELF.compareEP("e92bdeffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.17.X"):ELF.compareEP("e9..ddffffccccccccccccccccccccccb8010000008b5c2404cd80cd03c3cccc")?(bDetected=1,sVersion="1.23.X-1.24.X"):ELF.compareEP("00009de504108de204409fe500f084e2feffffea")&&(bDetected=1),sLang="Go",result()}meta("compiler","Go")

================================================
FILE: dbs_min/db/ELF/compiler_MWCC.4.sg
================================================
function detect(){return ELF.compareOverlay("4d57204d495053204320436f6d70696c65722028322e342e312e303129")&&(sVersion="2.4.1.01",sOptions="PlayStation 2",bDetected=1),sLang="C",result()}meta("compiler","MW MIPS C")

================================================
FILE: dbs_min/db/ELF/compiler_Rust.4.sg
================================================
function detect(){var e,$
return(ELF.compareEP("f30f1efb31ed5e89e183e4..505452e8........81c3")||ELF.compareEP("31ed5e89e183e4..505452e8........81c3")||ELF.compareEP("31ed89e083e4..5050e8........8104"))&&(bDetected=1),(ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$488b37488d57..4531c94c8d05........488d0d........488d3d$$$$$$$$5541574156")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$5541574156")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$4156")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$5541574156")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$5541574156")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$41574156")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$53")||ELF.compareEP("f30f1efa31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$554889e541574156")||ELF.compareEP("31ed4989d15e4889e24883e4..50544531c031c9488d3d$$$$$$$$41574156")||ELF.compareEP("31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$504889f14863d7488d05$$$$$$$$5541574156")||ELF.compareEP("31ed4989d15e4889e24883e4..50544c8d05........488d0d........488d3d$$$$$$$$41574156")||ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$4881ec........8b074989f8ffc04898")||ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$4881ec........8b0783c0..4898")||ELF.compareEP("4831ed4889e7488d35........4883e4..e8$$$$$$$$8b37488d57..488d3d$$$$$$$$41574156"))&&(bDetected=1),(ELF.compareEP("1d0080d21e0080d2e0030091........210000911fec7c92")||ELF.compareEP("1f2003d51d0080d21e0080d2e50300aae10340f9e2230091e6030091")||ELF.compareEP("1d0080d21e0080d2e50300aae10340f9e2230091e6030091")||ELF.compareEP("1d0080d21e0080d2fd030091e50300aae10340f9e2230091e6030091"))&&(bDetected=1),(ELF.compareEP("00b0a0e300e0a0e304109de40d20a0e104202de504002de5")||ELF.compareEP("00b0a0e300e0a0e310109fe501108fe00d00a0e10fc0c0e3"))&&(bDetected=1),(ELF.compareEP("f0000b4ff0000e03497944684620f00f0ce54600f002f8..")||ELF.compareEP("f0000b4ff0000e02bc6a4604b401b4dff824a008a39a44df")||ELF.compareEP("f0000b4ff0000e5df8041b6a464df8042d4df8040ddff828"))&&(bDetected=1),ELF.isStringInTablePresent(".strtab","rust_panic")&&(bDetected=1,$=ELF.getSectionNumber(".debug_str"),e=ELF.getSectionFileOffset($),0<ELF.getSectionFileSize($))&&-1!=($=ELF.findString(e,6,"rustc "))&&(sVersion=ELF.getString($)),sLang="Rust",result()}meta("compiler","Rust")

================================================
FILE: dbs_min/db/ELF/compiler_VBCC.4.sg
================================================
function detect(){return 0==ELF.getElfHeader_entry()&&ELF.compare("6000000048......................7c08....9001....9421....bdc1....3d......902b....3d......39ad....3960....800b....3d......90",ELF.getSectionFileOffset(1))&&(sVersion="0.7",bDetected=1),sLang="C",result()}meta("compiler","VBCC")

================================================
FILE: dbs_min/db/ELF/compiler_Watcom.4.sg
================================================
function detect(){var e=ELF.getSectionNumber(".data"),t=ELF.getSectionFileOffset(e),e=ELF.getSectionFileSize(e)
return-1!=ELF.findString(t,e,"WATCOM")?bDetected=1:ELF.compareEP("33ed8925........598bf48d44....505651e8")&&(sName="Open Watcom C/C++32",sOptions="2002",bDetected=1),sLang="C/C++",result()}meta("compiler","Watcom")

================================================
FILE: dbs_min/db/ELF/compiler_Zig.4.sg
================================================
function detect(){var e,t
return ELF.isSectionNamePresent(".rodata")&&ELF.isDeepScan()&&(t=ELF.getSectionNumber(".rodata"),e=ELF.getSectionFileOffset(t),t=ELF.getSectionFileSize(t),-1!=ELF.findSignature(e,t,"5a49475f44454255475f434f4c4f52"))&&(bDetected=1),sLang="Zig",result()}meta("compiler","Zig")

================================================
FILE: dbs_min/db/ELF/compiler_gcc.4.sg
================================================
function getVersion(e,c){e=ELF.findString(e,c,"GCC:")
return-1!=e?ELF.getString(e+5,100):""}function detect(){ELF.compareEP("31ed5e89e183e4..50545268........68........515668........e8")?ELF.compareEP("$$$$$$$$57565383ec..8b7424..8b7c24..8b5c24..b8........85c00f84........8b0d........85c90f94c025........a3........8b5424..8b4c24..8d44....a3........8b5424..8915........90",29)?(sVersion="4.7.2, exe",bDetected=1):ELF.compareEP("$$$$$$$$55b8........57565383ec..85c08b7c24..8bb424........8b9c24........0f84........8b15........31c085d20f94c08b5424..8b4c24..a3........8d44....8b9424........a3........8915........6690",29)?(sVersion="4.6.1, exe",bDetected=1):ELF.compareEP("$$$$$$$$5589e557565383ec..8b7d..8b75..8b5d..b8........85c00f84........a1........85c00f94c025........a3",29)?(sVersion="4.5.3, exe",bDetected=1):ELF.compareEP("$$$$$$$$55b8........89e557565383ec..85c08b7d..8b75..8b5d..74..31c0833d..........0f94c0",29)?(sVersion="4.4.6, exe",bDetected=1):ELF.compareEP("$$$$$$$$55b8........89e557565383ec..85c08b7d..8b5d..74..31c08b15........85d20f94c0",29)?(sVersion="4.4.5, exe",bDetected=1):ELF.compareEP("$$$$$$$$55b8........89e557565383ec..85c08b....8b5d..74..31c0833d..........0f94c0",29)?(sVersion="4.3.3, exe",bDetected=1):ELF.compareEP("$$$$$$$$55ba........89e557565381ec........85d20f85........8b45..8b4d..8915........8d54",29)&&(sVersion="4.1.2, exe",bDetected=1):ELF.compareEP("31ed5589e583e4..8d45..83ec..50ff75..52e8$$$$$$$$5589e557565383ec..8b5d..8b7d..8d74....8935........85db7e..8b0785c074..a3........0fb610")?(sVersion="4.4.7, exe",bDetected=1):ELF.compareEP("5589e5565383ec..83e4..8b5d..89d18d74....85db8935........7e..8b45..85c074..a3........0fb610")?(sVersion="4.2.1, exe",bDetected=1):ELF.compareEP("55575653e8........81c3........83ec..8b93........8b8b........8b83........8b2a8b93........890c24895424..8b93........895424..eb")?(sVersion="4.7.2, so",bDetected=1):ELF.compareEP("5589e557565383ec..83e4..8b5d..89d78d74....85db8935........7e..8b45..85c074..a3........89c10fb601")?(sVersion="3.4.6, exe",bDetected=1):ELF.compareEP("5589e557565383ec..89d18d7d..8b5f..8d74....8935........85db7e..837d....74..8b45..a3........89c28038..74..8db6........8dbf........803a..75..8d42..a3")?(sVersion="3.2.1, exe",bDetected=1):ELF.compareEP("5557565383ec..8b7424..8b6c24..8b3ec745..........c74424..........c74424..........8b078904248d4424..894424..ff57")?(sVersion="3.2, so",bDetected=1):ELF.compareEP("7c290b785421....38......9421ff..7c0803a690......3d......85......48")?(sVersion="3.2.X",bDetected=1):ELF.compareEP("6a..6a..8bec52b8........85c074")?(sVersion="2.95.2",bDetected=1):ELF.isStringInTablePresent(".strtab","gcc2_compiled.")?(sVersion="2.X",bDetected=1):ELF.isStringInTablePresent(".dynstr","GCC_3.0")?(sVersion="3.X",bDetected=1):ELF.isSectionNamePresent(".gcc_except_table")&&(bDetected=1)
var e,c=ELF.getSectionNumber(".comment")
return-1==c||sVersion||(e=getVersion(ELF.getSectionFileOffset(c),ELF.getSectionFileSize(c)))&&(sVersion=e,bDetected=1),sVersion||ELF.isOverlayPresent()&&(e=getVersion(ELF.getOverlayOffset(),Math.min(8192,ELF.getOverlaySize())))&&(sVersion=e,bDetected=1),sLang="C",result()}meta("compiler","GCC")

================================================
FILE: dbs_min/db/ELF/compiler_gdc.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libgphobos.so.2")&&(bDetected=1),sLang="C/C++",result()}meta("compiler","gdc")

================================================
FILE: dbs_min/db/ELF/compiler_ldc.4.sg
================================================
function getLDCVersion(){var e,t="",r=ELF.getSectionNumber(".comment")
return t=-1!=r&&(e=ELF.getSectionFileOffset(r),r=ELF.getSectionFileSize(r),-1!=(e=ELF.findString(e,r,"ldc version ")))?ELF.getString(e+12,20):t}function detect(){(ELF.isLibraryPresent("libphobos2-ldc-shared.so.98")||ELF.isLibraryPresent("libdruntime-ldc-shared.so.98"))&&(bDetected=1)
var e=getLDCVersion()
return e&&(bDetected=1,sVersion=e),sLang="D",result()}meta("compiler","ldc")

================================================
FILE: dbs_min/db/ELF/compiler_movfuscator.4.sg
================================================
function detect(){return ELF.compareEP("A1........8B98........8B03BA........668B9400........8913A1........8B98........")&&(bDetected=1,sVersion="v2",_setResult("protection","M/o/Vfuscator","","")),sLang="C",result()}meta("compiler","movfuscator")

================================================
FILE: dbs_min/db/ELF/library_Curl.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libcurl.so.4")&&(bDetected=1),result()}meta("library","Curl")

================================================
FILE: dbs_min/db/ELF/library_FFmpeg.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libffmpeg.so")&&(bDetected=1),result()}meta("library","FFmpeg")

================================================
FILE: dbs_min/db/ELF/library_FLAC.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libFLAC.so.14")&&(bDetected=1),result()}meta("library","FLAC")

================================================
FILE: dbs_min/db/ELF/library_Flexlm.4.sg
================================================
function detect(){var t=ELF.findSignature(0,ELF.getSize(),"'@(#) F'")
return-1!=t&&(sName=ELF.getString(t,200).match(/\w\S*/i),sVersion=ELF.getString(t,200).match(/\d\S*/i),bDetected=1),result()}meta("library","")

================================================
FILE: dbs_min/db/ELF/library_FluidSynth.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libfluidsynth.so.3")&&(bDetected=1),result()}meta("library","FluidSynth")

================================================
FILE: dbs_min/db/ELF/library_FreeType.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libfreetype.so.6")&&(bDetected=1),result()}meta("library","FreeType")

================================================
FILE: dbs_min/db/ELF/library_GLEW.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libGLEW.so.2.2")&&(bDetected=1),result()}meta("library","GLEW")

================================================
FILE: dbs_min/db/ELF/library_GLIBC.3.sg
================================================
function getMaxVersion(t,e){for(var r=t.toString().split("."),i=e.toString().split("."),n=0;n<3;n++){if(r[n]>i[n])return t
if(r[n]<i[n])return e}return e}function detect(){if(ELF.isSectionNamePresent(".dynstr")){for(var t,e=ELF.getSectionNumber(".dynstr"),r=ELF.getSectionFileOffset(e),i=ELF.getSectionFileSize(e),n=r,s=i;0<s&&-1!=(n=ELF.findString(n,i,"GLIBC_"));)bDetected=1,t=ELF.getString(n+6),sVersion=getMaxVersion(sVersion,t),s=i-(n-r+1),n++
sOptions=ELF.getGeneralOptions()}return result()}meta("library","GLIBC")

================================================
FILE: dbs_min/db/ELF/library_LZMA.4.sg
================================================
function detect(){return ELF.isLibraryPresent("liblzma.so.5")&&(bDetected=1),result()}meta("library","LZMA")

================================================
FILE: dbs_min/db/ELF/library_Lego1.4.sg
================================================
function detect(){return ELF.isLibraryPresent("liblego1.so")&&(bDetected=1),result()}meta("library","Lego1")

================================================
FILE: dbs_min/db/ELF/library_MPEG2.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libmpeg2.so.0")&&(bDetected=1),result()}meta("library","MPEG2")

================================================
FILE: dbs_min/db/ELF/library_Mikmod.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libmikmod.so.3")&&(bDetected=1),result()}meta("library","Mikmod")

================================================
FILE: dbs_min/db/ELF/library_OGG.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libogg.so.0")&&(bDetected=1),result()}meta("library","OGG")

================================================
FILE: dbs_min/db/ELF/library_OpenAL.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libopenal.so.1")&&(bDetected=1),result()}meta("library","OpenAL")

================================================
FILE: dbs_min/db/ELF/library_PulseAudio.4.sg
================================================
function detect(){return ELF.isLibraryPresent("libpulse.so.0")&&(bDetected=1),result()}meta("library","PulseAudio")

================================================
FILE: dbs_min/db/ELF/library_QT.3.sg
================================================
function getQTVersion(){var e="",t=ELF.getSize(),t=ELF.findString(0,t,"/usr/local/Trolltech/Qt-")
return e=-1!=t&&(t=(e=ELF.getString(t+24)).match(/(.*)\//))?t[1]:e}function detect(){var e
return ELF.isStringInTablePresent(".dynstr","libQtCore.so.4")?(sVersion="4.X",bDetected=1):ELF.isStringInTablePresent(".dynstr","libQt5Core.so.5")?(sVersion="5.X",bDetected=1):(ELF.isStringInTablePresent(".dynstr","libQt6Core_x86.so")||ELF.isStringInTablePresent(".dynstr","libQt6Core.so.6"))&&(sVersion="6.X",bDetected=1),bDetected&&(e=getQTVersion())&&(sVersion=e),result()}meta("library","Qt")

================================================
FILE: dbs_min/db/ELF/library_SDL.3.sg
================================================
function getSDLVersion(){var e,t="",n=ELF.getSectionNumber(".dynstr")
return t=-1!=n&&(e=ELF.getSectionFileOffset(n),n=ELF.getSectionFileSize(n),-1!=(e=ELF.findString(e,n,"libSDL-")))&&(n=ELF.getString(e).match(/libSDL-(.*).so/))?n[1]:t}function detect(){return(bDetected=ELF.isStringInTablePresent(".dynstr","SDL_Init")?!0:bDetected)&&(sVersion=getSDLVersion()),result()}meta("library","SDL")

================================================
FILE: dbs_min/db/ELF/packer_Ezuri.1.sg
================================================
function detect(){var e,t,i,n
return ELF.isSectionNamePresent(".strtab")&&ELF.isSectionNamePresent(".gopclntab")&&ELF.isSectionNamePresent(".noptrdata")&&ELF.isSectionNamePresent(".rodata")&&(e=ELF.getSectionNumber(".strtab"),t=ELF.getSectionNumber(".gopclntab"),i=ELF.getSectionNumber(".noptrdata"),n=ELF.getSectionNumber(".rodata"),-1!=ELF.findString(ELF.getSectionFileOffset(e),ELF.getSectionFileSize(e),"main.runFromMemory"))&&-1!=ELF.findString(ELF.getSectionFileOffset(e),ELF.getSectionFileSize(e),"main.aesDec")&&-1!=ELF.findString(ELF.getSectionFileOffset(t),ELF.getSectionFileSize(t),"crypto/cipher.NewCFBDecrypter")&&-1!=ELF.findString(ELF.getSectionFileOffset(n),ELF.getSectionFileSize(n),"/proc/self/fd/%d")&&-1!=ELF.findString(ELF.getSectionFileOffset(n),ELF.getSectionFileSize(n),"/dev/null")&&-1!=ELF.findSignature(ELF.getSectionFileOffset(i),ELF.getSectionFileSize(i),"A5 63 63 C6 84 7C 7C F8")&&-1!=ELF.findSignature(ELF.getSectionFileOffset(i),ELF.getSectionFileSize(i),"63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76")&&(bDetected=1),result()}meta("packer","Ezuri")

================================================
FILE: dbs_min/db/ELF/packer_PyInstaller.2.sg
================================================
function detect(){var e=ELF.getSectionNumber("pydata")
return-1!=e&&-1!=ELF.findSignature(ELF.getSectionFileOffset(e),ELF.getSectionFileSize(e),"4d45490c0b0a0b0e")&&(bDetected=1),sLang="Python",result()}meta("packer","PyInstaller")

================================================
FILE: dbs_min/db/ELF/packer_UPX.2.sg
================================================
function getUPXOptions(e){var t=ELF.readByte(e+2),e=ELF.readByte(e+3),s=""
switch(t){case 2:case 3:case 4:case 5:case 6:case 7:case 8:case 9:case 10:s="NRV"
break
case 14:s="LZMA"
break
case 15:s="zlib"}s&&(sOptions=sOptions.append(s),sOptions=8==e?sOptions.append("best"):sOptions.append("brute"))}function detect(){var e=ELF.getSize(),e=(ELF.compare("'UPX!'",e-36)?(getUPXOptions(e-32),bDetected=1):ELF.compareEP("E8........EB0E5A585997608A542420E9........60")&&(sVersion="3.X",bDetected=1),ELF.findString(0,e,"$Id: UPX"))
return-1!=e&&(sVersion=ELF.getString(e+9,4),bDetected=1),result()}meta("packer","UPX")

================================================
FILE: dbs_min/db/ELF/packer_Virbox.2.sg
================================================
function detect(){for(var r=0;r<ELF.getNumberOfPrograms();r++){var e=ELF.getProgramFileOffset(r)
if(-1!=ELF.findString(e,32,"Virbox Protector")){sVersion="Virbox Protector",bDetected=1
break}}return result()}meta("packer","Virbox")

================================================
FILE: dbs_min/db/ELF/packer_exepak.1.sg
================================================
function detect(){return ELF.compareEP("b9........81e9........89cb83e9..be........89f7033d........f3a48b15........b8")&&(sVersion="1.1",bDetected=1),result()}meta("packer","exepak")

================================================
FILE: dbs_min/db/ELF/protector_Burneye.2.sg
================================================
function detect(){return ELF.compareEP("FF35........9C608B0D........E9")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Burneye")

================================================
FILE: dbs_min/db/ELF/protector_HASP.1.sg
================================================
function detect(){var e,t
return 2==ELF.getNumberOfSections()&&ELF.isSectionNamePresent("protect")&&0==ELF.getSectionFileSize(0)&&(e=ELF.getProgramFileOffset(3),t=ELF.getProgramFileSize(3),-1==ELF.findString(e,t,"hasp")&&(e=ELF.getProgramFileOffset(1),t=ELF.getProgramFileSize(1),-1==ELF.findString(e,t,"hasp"))||(bDetected=1)),result()}meta("protector","HASP")

================================================
FILE: dbs_min/db/FASM
================================================
var bFASM
!bFASM&&PE&&(bFASM=PE.compare("'MZ'80000100000004001000FFFF00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\n$'0000000000000000'PE'0000"))

================================================
FILE: dbs_min/db/FPC
================================================
var nOffset,bFPC
void 0===bFPC&&"undefined"!=typeof PE&&PE.section[".data"]&&(nOffset=PE.section[".data"].FileOffset+PE.section[".data"].FileSize-4132,bFPC=-1!=PE.findString(nOffset,4132,"FPC "))

================================================
FILE: dbs_min/db/IPA/_init
================================================
var File=IPA,X=IPA

================================================
FILE: dbs_min/db/ISO9660/_ISO9660.0.sg
================================================
function detect(){return ISO9660.isVerbose()&&(sName=ISO9660.getFileFormatName(),sVersion=ISO9660.getFileFormatVersion(),sOptions=ISO9660.getFileFormatOptions(),sName)&&(bDetected=1),result()}meta("format","ISO9660")

================================================
FILE: dbs_min/db/ISO9660/_init
================================================
var File=ISO9660,X=ISO9660

================================================
FILE: dbs_min/db/ISO9660/bootloader_Grub.1.sg
================================================
function detect(){return ISO9660.compare("'GRUB'",384)&&(bDetected=1),result()}meta("bootloader","Grub")

================================================
FILE: dbs_min/db/ISO9660/filesystem_AppleHFS.1.sg
================================================
function detect(){return ISO9660.compare("'Apple_HFS'",1072)||ISO9660.compare("'Apple_map_partiton'",560)?(sOptions="ISO",bDetected=1):(ISO9660.compare("'Apple_HFS'",1088)||ISO9660.compare("'Apple_map_partiton'",576))&&(sOptions="BIN",bDetected=1),result()}meta("filesystem","Apple HFS")

================================================
FILE: dbs_min/db/ISO9660/iso_Rimage.1.sg
================================================
function detect(){return Binary.compare("'Rimage Image Server Version: 8.6.604.1'",33651)&&(sVersion="8.6.604.1",bDetected=1),result()}meta("iso","Rimage Image Server")

================================================
FILE: dbs_min/db/ISO9660/library_IMAPI.1.sg
================================================
function detect(){var e=ISO9660.getDataPreparerIdentifier()
return-1!==e.indexOf("IMAPI ISO-9660 Formatter")&&(sVersion="1.0",bDetected=1,-1!==e.indexOf("Microsoft & Roxio"))&&(sOptions="Microsoft & Roxio"),result()}meta("library","IMAPI")

================================================
FILE: dbs_min/db/ISO9660/library_IMAPI2.1.sg
================================================
function detect(){var e,r=ISO9660.getDataPreparerIdentifier()
return-1!==r.indexOf("IMAPI2")&&(bDetected=1,-1!==(e=r.indexOf("IMAPI2")))&&"("===(r=r.substring(e+6).trim()).charAt(0)&&-1!==(e=r.indexOf(")"))&&(sVersion=r.substring(1,e)),result()}meta("library","IMAPI2")

================================================
FILE: dbs_min/db/ISO9660/library_libburn.1.sg
================================================
function detect(){var e,r=ISO9660.getDataPreparerIdentifier()
return-1!==r.indexOf("LIBBURN")&&(bDetected=1,-1!==(e=r.indexOf("LIBBURN-")))&&(e=(r=r.substring(e+8)).indexOf(","),sVersion=-1!==e?r.substring(0,e):r.trim()),result()}meta("library","libburn")

================================================
FILE: dbs_min/db/ISO9660/library_libisoburn.1.sg
================================================
function detect(){var e,r=ISO9660.getDataPreparerIdentifier()
return-1!==r.indexOf("LIBISOBURN")&&(bDetected=1,-1!==(e=r.indexOf("LIBISOBURN-")))&&(-1!==(e=(r=r.substring(e+11)).indexOf(","))?sVersion=r.substring(0,e):-1!==(e=r.indexOf(" "))&&(sVersion=r.substring(0,e))),result()}meta("library","libisoburn")

================================================
FILE: dbs_min/db/ISO9660/library_libisofs.1.sg
================================================
function detect(){var e,i=ISO9660.getDataPreparerIdentifier()
return-1!==i.indexOf("LIBISOFS")&&(bDetected=1,-1!==(e=i.indexOf("LIBISOFS-")))&&(-1!==(e=(i=i.substring(e+9)).indexOf(","))?sVersion=i.substring(0,e):-1!==(e=i.indexOf(" "))&&(sVersion=i.substring(0,e))),result()}meta("library","libisofs")

================================================
FILE: dbs_min/db/ISO9660/partition_EFI_PART.1.sg
================================================
function detect(){return ISO9660.compare("'EFI PART'",512)&&(bDetected=1),result()}meta("partition","EFI PART")

================================================
FILE: dbs_min/db/ISO9660/tool_CDBurnerXP.1.sg
================================================
function detect(){return ISO9660.compare("'CDBURNERXP PRO 3'",33342)&&(sVersion="Pro 3",bDetected=1),result()}meta("tool","CDBurnerXP")

================================================
FILE: dbs_min/db/ISO9660/tool_CDIMAGE.1.sg
================================================
function detect(){var e,t=ISO9660.getApplicationIdentifier()
return-1!==t.indexOf("CDIMAGE")&&(bDetected=1,-1!==(e=t.indexOf("CDIMAGE")))&&-1!==(e=(t=t.substring(e+8).trim()).indexOf(" "))&&(sVersion=t.substring(0,e)),result()}meta("tool","CDIMAGE")

================================================
FILE: dbs_min/db/ISO9660/tool_CeQuadrat.1.sg
================================================
function detect(){var e,t=ISO9660.getDataPreparerIdentifier().toUpperCase()
return-1!==t.indexOf("CEQUADRAT")&&-1!==t.indexOf("ISO-9660 FORMATTER")&&(bDetected=1,-1!==(e=t.indexOf("COPYRIGHT (C)")))&&-1!==(e=(t=t.substring(e+14,e+30).trim()).indexOf(" "))&&(sVersion=t.substring(0,e).trim()),result()}meta("tool","CeQuadrat")

================================================
FILE: dbs_min/db/ISO9660/tool_ImgBurn.1.sg
================================================
function detect(){return ISO9660.compare("'ImgBurn'",33651)&&(sVersion=ISO9660.getString(33660,7),bDetected=1),result()}meta("tool","ImgBurn")

================================================
FILE: dbs_min/db/ISO9660/tool_MKARCHISO.1.sg
================================================
function detect(){return ISO9660.compare("'REPARED BY MKARCHISO'",33215)&&(bDetected=1),result()}meta("tool","MKARCHISO")

================================================
FILE: dbs_min/db/ISO9660/tool_NeroBurningROM.1.sg
================================================
function detect(){var e,t,n=ISO9660.getApplicationIdentifier()
return-1!==n.indexOf("NERO___BURNING_ROM")?bDetected=1:-1!==n.indexOf("NERO BURNING ROM")&&(bDetected=1,-1!==(e=n.indexOf("VER ")))&&3<=(n=n.substring(e+4,e+13).trim().split(",")).length&&(e=n[0],t=n[1],n=1e3*parseInt(n[2],10),sVersion=e+"."+t+"."+n.toString()),result()}meta("tool","Nero Burning ROM")

================================================
FILE: dbs_min/db/ISO9660/tool_PersonalRomMaker.1.sg
================================================
function detect(){return ISO9660.compare("'The Personal RomMaker (32-bit Windows 95 V4.10)'",2048)&&(sVersion="4.10",sOptions="Windows 95 32-bit",bDetected=1),result()}meta("tool","The Personal RomMaker")

================================================
FILE: dbs_min/db/ISO9660/tool_QuickToPix.1.sg
================================================
function detect(){return ISO9660.compare("'MI_QUICKTOPIX'",33215)?bDetected=1:ISO9660.compare("'MI QUICKTOPIX 2.00 BUILD 209_PHB_MPO'",33215)&&(sVersion="2.00",sOptions="Build: 209_PHB_MPO",bDetected=1),result()}meta("tool","QuickToPix")

================================================
FILE: dbs_min/db/ISO9660/tool_RoxioToast.1.sg
================================================
function detect(){return ISO9660.compare("'TOAST 2.5 Partition'",1040)?(sVersion="2.5",bDetected=1):ISO9660.compare("..'Toast 3.0 PPC HFS Optimizer'",1039)?(sVersion="3.0",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 3.0.2 PPC HFS Optimizer'",1040)?(sVersion="3.0.2",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 3.0.5 PPC HFS Optimizer'",1040)?(sVersion="3.0.5",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("....'Toast 3.5 PPC HFS Optimizer'",1038)?(sVersion="3.5",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 3.5.3 PPC Partition'",1040)?(sVersion="3.5.3",bDetected=1):ISO9660.compare("'Toast 3.5.4 PPC HFS Optimizer'",1040)?(sVersion="3.5.4",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 3.5.5 PPC HFS Optimizer'",1040)?(sVersion="3.5.5",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("....'Toast 3.5.6 PPC Partition'",1038)?(sVersion="3.5.6",sOptions="PowerPC",bDetected=1):ISO9660.compare("'Toast 3.5.6 PPC HFS Optimizer'",1040)?(sVersion="3.5.6",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 3.5.7 PPC HFS Optimizer'",1040)?(sVersion="3.5.7",sOptions="PowerPC HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 3.5.7 PPC Partition'",1040)?(sVersion="3.5.7",sOptions="PowerPC",bDetected=1):ISO9660.compare("'Toast 4.0 PPC HFS Optimizer'",1040)?(sVersion="4.0",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("....'Toast 4.1 Partition'",1038)?(sVersion="4.1",bDetected=1):ISO9660.compare("....'Toast 4.1.3 Partition'",1038)?(sVersion="4.1.3",bDetected=1):ISO9660.compare("'Toast F-4.1.3 Partition'",1040)?(sVersion="F-4.1.3",bDetected=1):ISO9660.compare("'Toast 5.0 HFS Optimizer'",1040)?(sVersion="5.0",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 5.0.2 HFS/Joliet Builder'",1040)?(sVersion="5.0.2",sOptions="HFS/Joliet Builder",bDetected=1):ISO9660.compare("'Toast 5.0.2 HFS Optimizer'",1040)?(sVersion="5.0.2",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 5.1.1 HFS Optimizer'",1040)?(sVersion="5.1.1",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 5.2.3 HFS Optimizer'",1040)?(sVersion="5.2.3",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 6.0 HFS Optimizer'",1040)?(sVersion="6.0",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("..'Toast 6.0.7 HFS Optimizer'",1039)?(sVersion="6.0.7",sOptions="HFS Optimizer",bDetected=1):ISO9660.compare("'Toast 9.0.2 HFS Optimizer'",1040)&&(sVersion="9.0.2",sOptions="HFS Optimizer",bDetected=1),result()}meta("tool","Roxio Toast")

================================================
FILE: dbs_min/db/ISO9660/tool_UltraISO.1.sg
================================================
function detect(){var t,e
return"ULTRAISO"==ISO9660.getString(33651)&&(sVersion=ISO9660.getString(33660),bDetected=1),bDetected||-1!==(t=ISO9660.getApplicationIdentifier()).indexOf("UltraISO")&&(bDetected=1,-1!==(e=t.indexOf("UltraISO")))&&"V"===(t=t.substring(e+9).trim()).charAt(0)&&-1!==(e=t.indexOf(" "))&&(sVersion=t.substring(1,e)),result()}meta("tool","UltraISO")

================================================
FILE: dbs_min/db/ISO9660/tool_WinISO.1.sg
================================================
function detect(){return ISO9660.compare("'WinISO software'",33086)&&(bDetected=1),result()}meta("tool","WinISO")

================================================
FILE: dbs_min/db/ISO9660/tool_genisoimage.1.sg
================================================
function detect(){var e,t=ISO9660.getApplicationIdentifier().toUpperCase()
return-1!==t.indexOf("GENISOIMAGE")&&(bDetected=1,-1!==(e=t.indexOf("CDRKIT TEAM")))&&-1!==(e=(t=t.substring(0,e)).lastIndexOf("(C)"))&&-1!==(e=(t=t.substring(e+4).trim()).indexOf(" "))&&(sVersion=t.substring(0,e).trim()),result()}meta("tool","genisoimage")

================================================
FILE: dbs_min/db/ISO9660/tool_xorriso.1.sg
================================================
function detect(){var e,t=ISO9660.getDataPreparerIdentifier()
return-1!==t.indexOf("XORRISO")&&(bDetected=1,-1!==(e=t.indexOf("XORRISO-")))&&-1!==(e=(t=t.substring(e+8)).indexOf(" "))&&(sVersion=t.substring(0,e)),result()}meta("tool","xorriso")

================================================
FILE: dbs_min/db/Image/_Image.0.sg
================================================
function detect(){return Image.isVerbose()&&(sName=Image.getFileFormatName(),sVersion=Image.getFileFormatVersion(),sOptions=Image.getFileFormatOptions(),sName)&&(bDetected=1),result()}meta("format","Image")

================================================
FILE: dbs_min/db/Image/_init
================================================
var File=Image,X=Image

================================================
FILE: dbs_min/db/JAR/_JAR.0.sg
================================================
function detect(){return JAR.isVerbose()&&(sName=JAR.getOperationSystemName(),sVersion=JAR.getOperationSystemVersion(),sOptions=JAR.getOperationSystemOptions(),bDetected=1),result()}meta("virtual machine","JVM")

================================================
FILE: dbs_min/db/JAR/_init
================================================
var File=JAR,X=JAR

================================================
FILE: dbs_min/db/JAR/tool_SingleJar.3.sg
================================================
function detect(){return"singlejar"==JAR.getManifestRecord("Created-By")&&(bDetected=1),result()}meta("tool","SingleJar")

================================================
FILE: dbs_min/db/JPEG/_Jpeg.0.sg
================================================
function detect(){return sName=Jpeg.getFileFormatName(),sVersion=Jpeg.getFileFormatVersion(),sOptions=Jpeg.getFileFormatOptions(),sName&&(bDetected=1),result()}meta("format","JPEG")

================================================
FILE: dbs_min/db/JPEG/_init
================================================
var File=Jpeg,X=Jpeg

================================================
FILE: dbs_min/db/JPEG/camera_camera.2.sg
================================================
function detect(){return(sName=Jpeg.getExifCameraName().replace(/\s{2,}/g," ").trim())&&(bDetected=1),result()}meta("camera","")

================================================
FILE: dbs_min/db/JPEG/image_DQT.4.sg
================================================
function detect(){return bDetected=1,sOptions=Jpeg.getDqtMD5(),result()}meta("image","DQT")

================================================
FILE: dbs_min/db/JPEG/image_comment.4.sg
================================================
function detect(){return(sOptions=Jpeg.getComment())&&(bDetected=1),result()}meta("image","comment")

================================================
FILE: dbs_min/db/JPEG/tool_Tools.3.sg
================================================
function detect(){return Jpeg.isChunkPresent(226)&&_setResult("tool","FlashPix/ICC","",""),Jpeg.isChunkPresent(227)&&_setResult("tool","Kodak","",""),Jpeg.isChunkPresent(228)&&_setResult("tool","FlashPix","",""),Jpeg.isChunkPresent(229)&&_setResult("tool","Ricoh","",""),Jpeg.isChunkPresent(230)&&_setResult("tool","GoPro","",""),Jpeg.isChunkPresent(231)&&_setResult("tool","Pentax/Qualcomm","",""),Jpeg.isChunkPresent(232)&&_setResult("tool","Spiff","",""),Jpeg.isChunkPresent(233)&&_setResult("tool","MediaJukebox","",""),Jpeg.isChunkPresent(234)&&_setResult("tool","PhotoStudio","",""),Jpeg.isChunkPresent(235)&&_setResult("tool","HDR","",""),Jpeg.isChunkPresent(236)&&_setResult("tool","Photoshop","","Web"),Jpeg.isChunkPresent(237)&&_setResult("tool","Photoshop","",""),Jpeg.isChunkPresent(238)&&_setResult("tool","Adobe","",""),Jpeg.isChunkPresent(239)&&_setResult("tool","GraphicConverter","",""),result()}meta("tool","")

================================================
FILE: dbs_min/db/JavaClass/_JavaClass.0.sg
================================================
function detect(){return sName=JavaClass.getFileFormatName(),sVersion=JavaClass.getFileFormatVersion(),sOptions=JavaClass.getFileFormatOptions(),bDetected=1,result()}meta("format","JavaClass")

================================================
FILE: dbs_min/db/JavaClass/_init
================================================
var File=JavaClass,X=JavaClass

================================================
FILE: dbs_min/db/LE/_LE.0.sg
================================================
function detect(){return LE.isVerbose()&&(sName=LE.getOperationSystemName(),sVersion=LE.getOperationSystemVersion(),sOptions=LE.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","Windows")

================================================
FILE: dbs_min/db/LE/_init
================================================
var File=LE,X=LE

================================================
FILE: dbs_min/db/LE/compiler_Watcom_C.4.sg
================================================
function detect(){return LE.compareEP("eb$$fb83e4..8bdc891d........891d........66b8....66a3........bb........2bc0b430cd21a2")?(sName="Watcom C/C++",sOptions="1988-93",bDetected=1):LE.compareEP("eb$$fb83e4..89e3891d........891d........66b8....66a3........bb........29c0b430cd21a2")?(sName="Open Watcom C/C++",sOptions="1988-2002",bDetected=1):LE.compareEP("eb$$fb83e4..89e3891d........891d........55575666b8....cd21668cc00f00e875..0f00eb75")&&(sName="Open Watcom C/C++",sOptions="1988-1995",bDetected=1),sLang="C/C++",result()}meta("compiler","Watcom C")

================================================
FILE: dbs_min/db/LE/packer_UPX.1.sg
================================================
function getUPXOptions(e){var t=LE.readByte(e+2),e=LE.readByte(e+3),s=""
switch(t){case 2:s="NRV2B_LE32"
break
case 3:s="NRV2B_8"
break
case 4:s="NRV2B_LE16"
break
case 5:s="NRV2D_LE32"
break
case 6:s="NRV2D_8"
break
case 7:s="NRV2D_LE16"
break
case 8:s="NRV2E_LE32"
break
case 9:s="NRV2E_8"
break
case 10:s="NRV"
break
case 14:s="LZMA"
break
case 15:s="zlib"}s&&(sOptions=sOptions.append(s),sOptions=8==e?sOptions.append("best"):sOptions.append("brute"))}function getUPXVersion(){var e=LE.getEntryPointOffset(),t=LE.findString(e-1024,1024,"$Id: UPX "),e=LE.findString(e,1024,"UPX!");-1!=e&&getUPXOptions(e+4),""==(sVersion=-1!=t?LE.getString(t+9,4):sVersion)&&-1!=e&&(sVersion=LE.getString(e-5,4))}function detect(){return(LE.compareEP("bf........6957..........061e07578db7........8dbf........b9........fdf3a5fc8d77..5f83cd..57e9")||LE.compareEP("bf........be........6957..........57fc31db83cd..909001db75"))&&(sOptions="for Watcom C",bDetected=1),getUPXVersion(),result()}meta("packer","UPX")

================================================
FILE: dbs_min/db/LX/_LX.0.sg
================================================
function detect(){return LX.isVerbose()&&(sName=LX.getOperationSystemName(),sVersion=LX.getOperationSystemVersion(),sOptions=LX.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","OS/2")

================================================
FILE: dbs_min/db/LX/_init
================================================
var File=LX,X=LX

================================================
FILE: dbs_min/db/LX/compiler_Borland_C.4.sg
================================================
function detect(){return(LX.compareEP("8b4424..a3........5868........50e8........e9$$$$$$$$558bec83ec..535756e8........68")||LX.compareEP("8b4424..a3........5868........50e9$$$$$$$$558bec83ec..53575668........ff35"))&&(sVersion="1992"),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),sLang="C/C++",result()}meta("compiler","Borland C++")

================================================
FILE: dbs_min/db/LX/compiler_Watcom_C.4.sg
================================================
function detect(){return LX.compareEP("e9$$$$$$$$535152565783ec..e8........8b5c24..a3........894424..eb")||LX.compareEP("e9$$$$$$$$535152565783ec..8b7424..83c724....74..e8")||LX.compareEP("e9$$$$$$$$53515283ec..b8........8b4c24..8b5c24..8b5424..e8........89e0")||LX.compareEP("e9$$$$$$$$535152565783ec..8b7424..837c24....74..e8")||LX.compareEP("e9$$$$$$$$535152565781ec........8bb424........83bc24..........74..e8")?sOptions="1988-95":LX.compareEP("e9$$$$$$$$5351525657558b5c24..8b7424..85f674..5653e8........8b15")||LX.compareEP("e9$$$$$$$$53515283ec..837c24....74..e8........ba........89c3")||LX.compareEP("e9$$$$$$$$53575581ec........8b9c24........8b9424........85d274..5253")||LX.compareEP("e9$$$$$$$$535657558b5c24..8b7424..85f674..5653e8........8b15")||LX.compareEP("e9$$$$$$$$535152575581ec........8b9c24........8b9424........85d274..5253")?sOptions="1988-94":LX.compareEP("e9$$$$$$$$5351525657558b5c24..8b7424..85f674..8b15........83fa..7e..8d5a..31c0891d")?sOptions="1988-2002":LX.compareEP("eb$$e9$$$$$$$$51525589e550508b45..eb..89d08d50..8038..75..8b45..a3........8915")||LX.compareEP("eb$$e9$$$$$$$$51525589e5837d....74..e8........89c2e8........89d0")?(sName="Watcom C 386",sOptions="1989, 1992"):(LX.compareEP("e9$$$$$$$$535657558b5c24..8b7424..85f674..8b15........83fa..7e..8d5a..31c0")||LX.compareEP("e9$$$$$$$$535152565589e583ec..b8........e8........a1........83c0..24..31d2")||LX.compareEP("e9$$$$$$$$53515257c8......8b5d..837d....0f84........833d..........7e..ff"))&&(sName="Open Watcom C/C++",sOptions="1988-2002"),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),sLang="C/C++",result()}meta("compiler","Watcom C/C++")

================================================
FILE: dbs_min/db/MACH/_MACH.0.sg
================================================
function detect(){return MACH.isVerbose()&&(sName=MACH.getOperationSystemName(),sVersion=MACH.getOperationSystemVersion(),sOptions=MACH.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","macOS")

================================================
FILE: dbs_min/db/MACH/_init
================================================
var File=MACH,X=MACH

================================================
FILE: dbs_min/db/MACH/compiler_Delphi.4.sg
================================================
function detect(){var e=MACH.getSectionNumber("__rodata")
return-1!=e&&-1!=MACH.findSignature(ACH.getSectionFileOffset(e),MACH.getSectionFileSize(e),"'TObject'")&&(sName="Embarcadero Delphi",sVersion="XE2-XE6",bDetected=1),sLang="Delphi",result()}meta("compiler","Delphi")

================================================
FILE: dbs_min/db/MACH/compiler_Rust.4.sg
================================================
function detect(){return(MACH.compareEP("554889e5415741564154534883ec..31ffbe........31c0e8........83f8")||MACH.compareEP("554889e54883ec..4889f14863d7488d05........488945..488d35........488d7df84531c0")||MACH.compareEP("554889e5415741564154534881ec........31ffbe........31c0e8........83f8")||MACH.compareEP("554889e541574156534881ec........31ffbe........31c0e8........83f8")||MACH.compareEP("554889e541574156534883ec..31ffbe........31c0e8........83f8"))&&(bDetected=1),(MACH.compareEP("ff8300d1fd7b01a9fd430091e30301aa027c4093")||MACH.compareEP("ff....d1fc6f..a9fa67..a9f85f..a9f657..a9f44f..a9")||MACH.compareEP("ffc303d1fa670aa9f85f0ba9f6570ca9f44f0da9fd7b0ea9")||MACH.compareEP("ff8302d1f85f06a9f65707a9f44f08a9fd7b09a9fd430291"))&&(bDetected=1),sLang="Rust",result()}meta("compiler","Rust")

================================================
FILE: dbs_min/db/MACH/compiler_Zig.4.sg
================================================
function detect(){var e
return MACH.isSectionNamePresent("__cstring")&&MACH.isDeepScan()&&(e=MACH.getSectionNumber("__cstring"),bDetected=MACH.findSignature(MACH.getSectionFileOffset(e),MACH.getSectionFileSize(e),"5a49475f44454255475f434f4c4f52")),sLang="Zig",result()}meta("compiler","Zig")

================================================
FILE: dbs_min/db/MACH/compiler_gcc.4.sg
================================================
function detect(){return MACH.isLibraryPresent("libgcc_s.1.dylib")&&(sOptions="C/C++",bDetected=1),sLang="C/C++",result()}meta("compiler","gcc")

================================================
FILE: dbs_min/db/MACH/library_Carbon.3.sg
================================================
function detect(){return(MACH.isLibraryPresent("Carbon")||MACH.isLibraryPresent("CarbonCore"))&&(bDetected=1),result()}meta("library","Carbon")

================================================
FILE: dbs_min/db/MACH/library_Cocoa.3.sg
================================================
function detect(){return MACH.isLibraryPresent("Cocoa")&&(bDetected=1),result()}meta("library","Cocoa")

================================================
FILE: dbs_min/db/MACH/library_QT.3.sg
================================================
function getVersion(){var e=MACH.getLibraryCurrentVersion("QtCore")
return(e>>16&255)+"."+(e>>8&255)+"."+(255&e)}function detect(){return MACH.isLibraryPresent("QtCore")&&(sVersion=getVersion(),bDetected=1),result()}meta("library","QT")

================================================
FILE: dbs_min/db/MACH/library_WebKit.3.sg
================================================
function detect(){return MACH.isLibraryPresent("WebKit")&&(bDetected=1),result()}meta("library","WebKit")

================================================
FILE: dbs_min/db/MACH/library_java.3.sg
================================================
function detect(){return(MACH.isLibraryPresent("libjava.dylib")||MACH.isLibraryPresent("libjvm.dylib"))&&(bDetected=1),sLang="Java",result()}meta("library","Java Runtime")

================================================
FILE: dbs_min/db/MACH/packer_UPX.2.sg
================================================
function detect(){var e
return 2==MACH.getNumberOfSections()&&-1!=(e=MACH.findString(0,MACH.getSize(),"$Id: UPX"))&&(sVersion=MACH.getString(e+9,4),bDetected=1),result()}meta("packer","UPX")

================================================
FILE: dbs_min/db/MACH/packer_Virbox.2.sg
================================================
function detect(){return-1!=MACH.getSectionNumber("__vdata")&&(sVersion="Virbox Protector",bDetected=1),result()}meta("packer","Virbox")

================================================
FILE: dbs_min/db/MACHOFAT/_MACHOFAT.0.sg
================================================
function detect(){return MACHOFAT.isVerbose()&&(sName=MACHOFAT.getOperationSystemName(),sVersion=MACHOFAT.getOperationSystemVersion(),sOptions=MACHOFAT.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","macOS")

================================================
FILE: dbs_min/db/MACHOFAT/_init
================================================
var File=MACHOFAT,X=MACHOFAT

================================================
FILE: dbs_min/db/MACHOFAT/converter_lipo.2.sg
================================================
function detect(){return bDetected=1,result()}meta("converter","lipo")

================================================
FILE: dbs_min/db/MFC
================================================
var aMFC
aMFC||!PE||(aMFC=PE.isLibraryPresentExp(/^MFC(\d+?)(u?)(d?)\.dll/i))||PE.section[".data"]&&PE.isSignatureInSectionPresent(PE.section[".data"].Number,"'CMFCComObject'")&&(aMFC=1)

================================================
FILE: dbs_min/db/MSDOS/ACE.6.sg
================================================
function detect(){return detect_ACE(0),result()}includeScript("ACE")

================================================
FILE: dbs_min/db/MSDOS/Adys_COM2EXE.1.sg
================================================
function detect(){return MSDOS.compare("'Ady'27",28)&&(bDetected=1),result()}meta("converter","Ady`s COM2EXE")

================================================
FILE: dbs_min/db/MSDOS/Adys_Glue.2.sg
================================================
function detect(){return MSDOS.compareEP("2E........0E1FBF....33DB33C0AC")?(sVersion="1.10",bDetected=1):MSDOS.compareEP("2E8C06....0E0733C08ED8BE....BF....FCB9....56F3A51E075F")&&(sVersion="0.10",bDetected=1),result()}meta("protector","Ady`s Glue")

================================================
FILE: dbs_min/db/MSDOS/Anti-hack_encryption_system.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$bd....33c08ec026c706........268c0e....8b46..26a3....268c0e....0e07")&&(sOptions="by Rezaul Kabir //Shuvro",bDetected=1),result()}meta("protector","Anti-hack encryption system")

================================================
FILE: dbs_min/db/MSDOS/Aztec_C-86.4.sg
================================================
function detect(){return MSDOS.compareEP("bd....85ed75..8cdd2e8c1e....8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5")?(sVersion="3.40",sOptions="1988",bDetected=1):MSDOS.compareEP("bd....85ed75..b8....e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc2")?(sVersion="3.40b",sOptions="1986",bDetected=1):MSDOS.compareEP("bd....85ed75..8cdd8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5268c1e....b1..d3e3")||MSDOS.compareEP("bd....85ed75..b8....50e8....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")||MSDOS.compareEP("bd....85ed75..b8....509a........8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")||MSDOS.compareEP("bd....85ed75..b0..e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")?(sVersion="5.2a",sOptions="1992",bDetected=1):(MSDOS.compareEP("b8....8ed82e80........ba....75..e8....3d....75..e9$$$$8cc38edb2e891e....be....8a0c80f9..74..80f9..7e")||MSDOS.compareEP("eb$$3d....74..eb$$2ec606......502e891e....2e890e....2e8916....8cd82ea3....8cc02ea3....2e8936"))&&(sVersion="3.20X",bDetected=1),result()}meta("compiler","Aztec C-86")

================================================
FILE: dbs_min/db/MSDOS/BlackWolf_Protection.2.sg
================================================
function detect(){return MSDOS.compareEP("061e0e0e071fbe....b9....871481c2....53e8")&&(sOptions="1996 by p.q.",bDetected=1),result()}meta("protector","BlackWolf Protection")

================================================
FILE: dbs_min/db/MSDOS/Black_fist.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$061ee8....1f072ea1....2e8b1e....8cd12e2b0e....fa8ed1fb5053cb")&&(sOptions="1993",bDetected=1),result()}meta("packer","BlacK FiST")

================================================
FILE: dbs_min/db/MSDOS/Borland_C.4.sg
================================================
function detect(){var e,D=0
return MSDOS.compareEP("FB")&&(D=1),MSDOS.compareEP("BA....2E8916....B430CD218B2E02008B1E2C008EDA",D)?(e=MSDOS.readWord(MSDOS.getEntryPointOffset(D+1)),D=MSDOS.addressToOffset(e),bDetected=1):MSDOS.compareEP("8CCA2E8916....B430CD218B2E02008B1E2C008EDAA3")&&(e=MSDOS.readWord(MSDOS.getEntryPointOffset(22)),D=MSDOS.addressToOffset(0,e-120),bDetected=1),-1!=(D=MSDOS.findString(D,64," - Copyright "))&&(sVersion=MSDOS.getString(D+13,4),MSDOS.compare("43",D-1)?(sName="Turbo C","(c) "==sVersion&&(sVersion=MSDOS.getString(D+17,4))):MSDOS.compare("'Turbo'",D-9)?sName="Turbo C/C++":"1991"==sVersion?sVersion="3.1":"1994"==sVersion&&(sVersion="4.X"),bDetected=1),MSDOS.compareEP("b4..cd103c..74..b8....cd10ba....2e8916....8b2e....8b1e....8eda8c06....891e....892e....a1")||MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8")?(sVersion="1991",bDetected=1):MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c43e....8bc78bd8")?(sVersion="1988",bDetected=1):MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......C7..........E8....C4......8bc78bd8b9....26........75")||MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......8cd22bea8b3e....81ff....73..bf....893e....b1")?(sName="Turbo C",sVersion="1988",bDetected=1):MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......53E8....0733FF2BDB8BC3B9....FCF2AEE3..4326......75..80")?(sName="Turbo C",sVersion="1990",bDetected=1):MSDOS.compareEP("FBBA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681")||MSDOS.compareEP("FB8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681")||MSDOS.compareEP("BA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........8ec333c0b9....8bf88bd82681......75")?(sName="Turbo C",sVersion="1987",bDetected=1):MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706")?(sName="Turbo C",sVersion="1988",bDetected=1):MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......E8")?(sName="Turbo C",sVersion="1990",bDetected=1):MSDOS.compareEP("8cd8bb....8edb8cd38bccfa8e16....bc....fbe8....fa8ed38be1fbea")&&(sName="Turbo C",sVersion="1988",bDetected=1),sLang=-1!==sName.indexOf("C++")?"C":"C++",result()}meta("compiler","Borland C/C++")

================================================
FILE: dbs_min/db/MSDOS/Borland_Pascal.4.sg
================================================
function detect(){if(MSDOS.compareEP("9AFFFF00009AFFFF00005589E531C09AFFFF0000")?(sVersion="7.0*",bDetected=1):MSDOS.compareEP("B8....BB....8ED08BE38CD88EC00E1FA1....25....A3....E8....833E......75")?(sVersion="7.0*",sOptions="Protected Mode",bDetected=1):MSDOS.compareEP("B8....8ED88C......8CD38CC02BD88BC405....C1....03D8B4..CD210E")?(sVersion="7.0*",bDetected=1):MSDOS.compareEP("9a########ba....8eda8c06....33ed8bc405....b1..d3e88cd203c2a3....a3")?(sVersion="7.0",bDetected=1):MSDOS.compareEP("9a########ba....8eda8c06....33ede8....e8....8bc405....b1..d3e88cd203c2a3....a3....0306....a3....a3....a3....a3....8e06....26a1....a3....c706")?(sVersion="6.0",bDetected=1):MSDOS.compareEP("9a########06ba....8eda268b3e....8ec25b8bef83ed..1eb8....8ed8b9....2bc8d1e1")||MSDOS.compareEP("9a########ba....8eda8c06....8bc405....a3....8c16....05....b1..d3e88cd203c2a3....a3")||MSDOS.compareEP("9a########ba....8edae8....8c06....33ed8bc405....b1..d3e88cd203c2c706")||MSDOS.compareEP("9a########5589e50ee8$$$$5589e583ec..31c0")?(sVersion="6.0-7.0",bDetected=1):MSDOS.compareEP("9a########ba....8eda8c06....8bc405....b1..d3e88cd203c2a3....a3....26a1....2d....a3....c706")?(sVersion="4.0-6.0",sOptions="1987",bDetected=1):MSDOS.compareEP("9a########54583bc475..9c585080cc..509d9c589d80e4..75..bb....e8....b8....cd21ba....8eda")?(sVersion="6.0-7.0",sOptions="1992 by Borland & Eagle Performance Software",bDetected=1):(MSDOS.compareEP("9a........5589e5bf....0e57e8$$$$f9")||MSDOS.compareEP("9a########b8....8ed88c06....cb")||MSDOS.compareEP("9a########ba....8eda8c06....b430cd2186c43d....73..0e1f")||MSDOS.compareEP("31ed9a########2e8e1e....b451cd21891e....803e......74..f706........74..e8"))&&(sName="Turbo Pascal",sVersion="6.0-7.0",bDetected=1),MSDOS.compareEP("9a########f860f972..8bdc36c51f83c3..807f....74..807f"))sName="Turbo Pascal",sVersion="6.0-7.0",bDetected=1
else if(MSDOS.compareEP("9A0000")){var e=MSDOS.readWord(MSDOS.getEntryPointOffset(3)),e=MSDOS.addressToOffset(e)
if(-1!=(e=MSDOS.findSignature(e,Math.min(1024,MSDOS.getSize()-e),"'Portions Copyr    ight (c) 1983,9'..' Borland'"))){switch(MSDOS.getString(e+29,1)){case"0":sVersion="5.0",sName="Turbo Pascal"
break
case"1":sVersion="6.0",sName="Turbo Pascal"
break
case"2":sVersion="7.0"}bDetected=1}}return sLang="Pascal",result()}meta("compiler","Borland Pascal")

================================================
FILE: dbs_min/db/MSDOS/Borland_RTM.0a.sg
================================================
function getBLVersion(){var e="",r=MSDOS.findString(0,MSDOS.getSize(),"RTM loader version")
return e=-1!=r?(e=MSDOS.getString(r+19)).substr(0,e.indexOf(" ")):e}function detect(){var e
return MSDOS.compareEP("b8....8ed8b8....bb....8ed08be38926....0626......8ec0263b......74..e9")&&(sVersion="1.0-1.5",bDetected=1),bDetected&&(e=getBLVersion())&&(sVersion=e),result()}meta("extender","Borland RTM DPMI loader")

================================================
FILE: dbs_min/db/MSDOS/Borland_TDS.5.sg
================================================
function detect(){var e,t
return MSDOS.compareOverlay("FB52")&&(t=MSDOS.getOverlayOffset(),e=MSDOS.readByte(t+2),t=MSDOS.readByte(t+3),e=(10*(e>>4)+(15&e)).toString(),t=(10*(t>>4)+(15&t)).toString(),sVersion=t+"."+e,sOptions="TDS",bDetected=1),result()}meta("debug","Borland TLINK Symbol Table Present")

================================================
FILE: dbs_min/db/MSDOS/Borland_TLINK.5.sg
================================================
function detect(){var e=MSDOS.readWord(30)
return 251==(255&e)&&(sVersion=((e>>8)/16).toFixed(1),bDetected=1),result()}meta("linker","Borland TLINK")

================================================
FILE: dbs_min/db/MSDOS/CSCRYPT_Pro.2.sg
================================================
function detect(){return MSDOS.compareEP("8d36....565f81ef....b8....81ef....81c0....81f7....2e2935474781c6....e9")&&(sVersion="3.30/386",sOptions="1995-97 by Christian Schwarz",bDetected=1),result()}meta("protector","CSCRYPT Pro")

================================================
FILE: dbs_min/db/MSDOS/Concurrent_Small_C.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed826a1....2d....80fc..72..9090b8....b1..d3e0fa8cdb8ed38be050fbb8....2d....d3e08bd8fec7fec73b..72..9090")&&(sVersion="1.0",sOptions="1996 by Andy Yuen",bDetected=1),sLang="C",result()}meta("compiler","Concurrent Small C")

================================================
FILE: dbs_min/db/MSDOS/CopyQM_SFX.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$b8....8ec0a1....26a3....268c1e")&&MSDOS.compareOverlay("'TX'")&&(sVersion="3.24",sOptions="1996 by Sydex",bDetected=1),result()}meta("sfx","CopyQM SFX")

================================================
FILE: dbs_min/db/MSDOS/Crypt_(Dismember).2.sg
================================================
function detect(){return MSDOS.compareEP("1E8CDA83....8EDA8EC2BB....BA....85D274..B4..33FF33F6B9....AC32C4C0....02..2E........AAE2")?(sVersion="1.3",bDetected=1):MSDOS.compareEP("0E179C58F6....74..E9....1EB0..E6..8CDA83....8EDA8EC2BB....BA....85D274..B4..33FF33F6B9")||MSDOS.compareEP("0E179C58F6....74..EB$$b0..e6..33c9e2..b430cd213c..73..33c00650cb")?(sVersion="1.7",bDetected=1):(MSDOS.compareEP("fa061e8cdd83c5..2e012e....2e012e....e8....e8....1f072e8e16....2e8b26....fb2eff2e")||MSDOS.compareEP("e9$$$$bf....8bf7acad918ae157ac32c4f6d0d0c412e1aae2"))&&(sVersion="2.0",bDetected=1),result()}meta("cryptor","Cryptor by Dismember")

================================================
FILE: dbs_min/db/MSDOS/Crypt_(LightShow).2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$eb$$8cc8fa8ed0bc....fb8cc0bb....83e8..8ed833f64b8ccd8cc02ea3....33c08ec026a1....2ea3....26a1")?(sVersion="1.21",bDetected=1):MSDOS.compareEP("eb$$8cc883e8..8ed833f68ccb8cc02ea3....2bc08ec08bf8b9....26ff36....26ff36....26894d..26895d..b9")?(sVersion="1.15",bDetected=1):MSDOS.compareEP("e9$$$$eb$$8cc8fa8ed0bc....8cc0bb....83e8..8ed833f64b8ccd8cc02ea3....5333c08ec0268c0e....26c706........1f")?(sVersion="1.20",bDetected=1):MSDOS.compareEP("eb$$8cc8fa8ed0bc....fb8cc0bb....83e8..8ed833f64b8ccd8cc02ea3....33c08ec026a1....2ea3....26a1")?bDetected=1:MSDOS.compareEP("eb$$2e8b36....2e8974..8ccb8cc02e8944..2bc08ec08ed88bf82e8b4c..81c1....6a..ff36....ff36....894d..895d")&&(sVersion="1.11",sOptions="1994",bDetected=1),result()}meta("protector","Crypt by LightShow //ECLIPSE")

================================================
FILE: dbs_min/db/MSDOS/DAEMON_Protect.2.sg
================================================
function detect(){return MSDOS.compareEP("60609C8CC932C9E30C520F014C24FE5A83C20C8B1A9D61")&&(sVersion="0.6.7",bDetected=1),result()}meta("protector","DAEMON Protect")

================================================
FILE: dbs_min/db/MSDOS/DOS32_loader.0a.sg
================================================
function detect(){return MSDOS.compareEP("8cd88ccb2bd88bc4b1..d3e803d843b4..cd218e06....8cd80e1fa3....a3....a3....fc33c033ffeb")&&(sVersion="3.3",sOptions="1995 by Adam Seychell",bDetected=1),result()}meta("loader","DOS32 loader")

================================================
FILE: dbs_min/db/MSDOS/DOS_16M.0a.sg
================================================
function detect(){return MSDOS.compareEP("bf....8ed781c4....be....2bf73689......8bc6b1..d3e04836a3....be....468936....8cc32bdef7dbb44acd21368c......1607fcbf....b9....2bcf33c0")?(sOptions="1991 by Rational Systems, Inc.",bDetected=1):MSDOS.compareEP("bf....8ec78ed7bc....368c......ff36....268f......be....ac8ad8b7..88388b3e....4f8ec726a1....36f726....4836a3....8e06....33c08bc8f7d18bf8f2ae26")?(sOptions="1994 by Tenberry Software Inc.",bDetected=1):MSDOS.compareEP("bf....8ec78ed7bc....368c1e....ff36....368f06....be....ac8ad8b7..88388b3e....4f8ec726a1....36f726....4836a3....8e06....33c08bc8f7d18bf8f2ae26")?(sOptions="1995 by Tenberry Software",bDetected=1):MSDOS.compareEP("bf....8ec78ed7bc....368c1e....ff36....368f06....be....ac8ad8b7..883816078b3e....4f8ec726a1....36f726....4836a3....8e06....33c08bc8f7d18bf8f2ae26")?(sOptions="1994 by Rational Systems, Inc.",bDetected=1):MSDOS.compareEP("bf....8ec78ed7bc....368c1e....1607be....ac98508b3e....4f8ec726a1....c1e0..4836a3....8e06....33c08bc8f7d18bf8f2ae26")?(sOptions="1993 by Rational Systems, Inc.",bDetected=1):MSDOS.compareEP("bf....8ed781c4....be....2bf7368926....368926....8bc6b1..d3e04836a3....be....468936....8cc32bdef7dbb4..cd21")?(sOptions="1989 by Rational Systems, Inc.",bDetected=1):MSDOS.compareEP("BF....8ED781C4....BE....2BF78BC6B1..D3E04836A3....368926....BE....468936....8CC32BDEF7DBB4..CD21368C")&&(sOptions="1987-1992 by Rational Systems, Inc.",bDetected=1),result()}meta("extender","DOS/16M DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/DOS_32A.0a.sg
================================================
function detect(){return MSDOS.compareEP("fb0e1f8c1e....8c06....8c16....26a1....a3....fce8....e8....e8....8cd0268b36....05")?(sVersion="R9-07.0101.2011",sOptions="1996-98, 2002 by Narech Koumar (Supernar Systems, Ltd.)",bDetected=1):MSDOS.compareEP("0e1f8cc08cd3a3....2bd88bc4d1e8d1e8")?(sVersion="R8-07.0101.0076",sOptions="1996-98, 2002 by Narech Koumar (Supernar Systems, Ltd.)",bDetected=1):MSDOS.compareEP("0e1f8c1e....8c06....8c16....26a1....a3....fbfce8")&&(sVersion="04-20-06",sOptions="1996-2006 by Narech Koumar (Supernar Systems, Ltd.)",bDetected=1),result()}meta("extender","DOS/32A DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/Digital_Research_C.4.sg
================================================
function detect(){return MSDOS.compareEP("eb$$0e17bc....a1....8cdb0e1f891e....a3....8cc80306....a3....b9....2bdb8bf3bf....8cc803050306")&&(sVersion="1.1",sOptions="1983",bDetected=1),sLang="C",result()}meta("compiler","Digital Research C")

================================================
FILE: dbs_min/db/MSDOS/Disk_eXPress.1.sg
================================================
function detect(){return MSDOS.compareOverlay("be9b8710415302")&&MSDOS.compareEP("fca3....891e....49890e....bb....8c1f83e4..8967..b8....50")&&(sOptions="1991-93 by Albert J. Shan",bDetected=1),result()}meta("sfx","Disk eXPress")

================================================
FILE: dbs_min/db/MSDOS/EMMXXXX0_check.0a.sg
================================================
function detect(){return MSDOS.compareEP("b8....cd213c..73..0e1fba....b409cd210633c050cb8cd88ccbfabc....8ed3fbfc8ec3bf....be....b9....fc")&&(bDetected=1),result()}meta("extender","EMMXXXX0 check by Symantec")

================================================
FILE: dbs_min/db/MSDOS/EXETools_COM2EXE.1.sg
================================================
function detect(){return MSDOS.compareEP("e800005d83ed..8cda2e8996....83c2..8eda8ec22e0196....60bb....ba....85d274..b4..33ff33f6b9....ac")&&(bDetected=1),result()}meta("converter","EXETools COM2EXE")

================================================
FILE: dbs_min/db/MSDOS/EXE_Manager.2.sg
================================================
function detect(){return MSDOS.compareEP("b4301e06cd212ea3....bf....b9....33c02e....47e2..2e3b06....74..b8....cd1033c050cb")?(sVersion="3.0",sOptions="1994 by Solar Designer",bDetected=1):MSDOS.compareEP("1e54583bc475..b43006cd212ea3....bf....8befb9....33c02e030547e2")&&(sVersion="4.0",sOptions="1996 by Solar Designer",bDetected=1),result()}meta("protector","EXE Manager")

================================================
FILE: dbs_min/db/MSDOS/EXE_Packer.2.sg
================================================
function detect(){return(MSDOS.compareEP("1E068CC383....2E........B9....8CC88ED88BF14E8BFE")||MSDOS.compareEP("EB$$1E068CC383....0E1F011E....011E....BE....B9....FCAD3BC174"))&&(sVersion="7.0",bDetected=1),result()}meta("packer","EXE Packer")

================================================
FILE: dbs_min/db/MSDOS/EXE_encryption.2.sg
================================================
function detect(){return MSDOS.compareEP("501e068cc88ed88ec0e8....5b81eb....2ae4be....03f3882446fec40ae475..8b87....ba....f7e28987")&&(sOptions="1992 by E.Akulow",bDetected=1),result()}meta("protector","EXE encryption")

================================================
FILE: dbs_min/db/MSDOS/Eliashim's_CodeTrack.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$502e8c06....33c08ec02ef606......74..26ff36")&&(bDetected=1),result()}meta("protector","Eliashim's CodeTrack")

================================================
FILE: dbs_min/db/MSDOS/File_Shield.1.sg
================================================
function detect(){return MSDOS.compareEP("50b430cd213c..7d..e9....e8$$$$b8....bb....b9....ba....cd212ec706........81fb....75..2ec706........2e8916")?(sVersion="1.2",sOptions="by McAfee",bDetected=1):MSDOS.compareEP("501eeb$$2ea1....2e8b1e....2e8b0e....ba....2e8916....e8$$$$535051cd12")&&(sVersion="1.5",sOptions="by McAfee",bDetected=1),result()}meta("immunizer","File Shield")

================================================
FILE: dbs_min/db/MSDOS/Fitted_Modula-2.4.sg
================================================
function detect(){return MSDOS.compareEP("9a########558bec2e8e1e....a1....d1c873..8be55dca0000")&&(sVersion="2.0a",sOptions="1988",bDetected=1),result()}meta("compiler","Fitted Modula-2")

================================================
FILE: dbs_min/db/MSDOS/GFX_to_EXE.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$2ea1....3c..74..be....bd....8ccabf....83e7..bb....c1eb..03d32e8b1e....2e8b0e....8eda3c..75..30253c")&&(sVersion="2.0",sOptions="by t-Rex",bDetected=1),result()}meta("converter","GFX to EXE")

================================================
FILE: dbs_min/db/MSDOS/GamBit_Pro_Library.1.sg
================================================
function detect(){return MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06")&&MSDOS.compareOverlay("'RS'000102")&&(sOptions="1994 by Nikita Ltd.",bDetected=1),result()}meta("installer","GamBit Pro Library")

================================================
FILE: dbs_min/db/MSDOS/GameWizard_DOS_Extender.0a.sg
================================================
function detect(){return MSDOS.compareEP("b430cd2186c43d....73..ba....e8....ba....b1..d3ea8cc803d08edafa8ed2bc....fb2e8916....2e8c06....368c0e....2e8c16....e8")&&(bDetected=1),result()}meta("extender","GameWizard DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/Graphic_WorkShop.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$2ec706........b8....a9....74..25....bb....2bd8432e011e....e8")&&(sVersion="6.0-7.1",sOptions="by Alchemy Mindworks Inc.",bDetected=1),result()}meta("self-displayer","Graphic WorkShop")

================================================
FILE: dbs_min/db/MSDOS/Guardian_Angel.2.sg
================================================
function detect(){return(MSDOS.compareEP("068cc88ed88ec0fc......8be8e4210c..eb")||MSDOS.compareEP("068CC88ED88EC0FCBF....EB")||MSDOS.compareEP("068CC88ED88EC0FCBB....EB")||MSDOS.compareEP("068CC88ED88EC0FCBE....EB"))&&(sVersion="1.0",bDetected=1),result()}meta("protector","Guardian Angel")

================================================
FILE: dbs_min/db/MSDOS/H+BEDV_SelfCheck.1.sg
================================================
function detect(){return MSDOS.compareEP("1e0e1ffcbe....33d233dbb9....ac3287....3084....0294....80d6..fec3e2..3b16....75..b8....cd213d....8bc374..b430cd21ba")?(sVersion="1.74-2.41",sOptions="1993-94 by H+BEDV Datentechnik GmbH",bDetected=1):MSDOS.compareEP("1e0e1fb8....cd213d....8bc374..b430cd21ba....3c..b8....72..fcbe....33d233dbb9....ac3287....3084....0294....80d6..fec3e2")&&(sVersion="1.10",sOptions="1993 by H+BEDV Datentechnik GmbH",bDetected=1),result()}meta("immunizer","H+BEDV SelfCheck")

================================================
FILE: dbs_min/db/MSDOS/Header_Changer.2.sg
================================================
function detect(){return MSDOS.compareEP("8cdb81c3....53bb....53501e068cdb81c3....53bb")&&(sOptions="by Shay Lev Ary",bDetected=1),result()}meta("other","Header Changer")

================================================
FILE: dbs_min/db/MSDOS/Hi-Tech_C.4.sg
================================================
function detect(){return MSDOS.compareEP("fcba....b1..d3ea8cc803c28ed88ed0268b1e....4b2bd8b8....f7c3....75..d3e38bc38be0be....b9....2bce32c0")&&(sVersion="3.06",sOptions="1984-87 by HI-TECH Software",bDetected=1),sLang="C",result()}meta("compiler","Hi-Tech C")

================================================
FILE: dbs_min/db/MSDOS/HyperLOCK_386.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$fabf....b0..b9....2e8a2581ff....72..2e3005472ac4")&&(sVersion="1.00",sOptions="1993 by Jayeson Lee-Steere",bDetected=1),result()}meta("protector","HyperLOCK 386")

================================================
FILE: dbs_min/db/MSDOS/IBM_PC_Pascal.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed88c06....fa8ed0268b1e....2bd881fb....7e..bb....d1e3")?(sVersion="2.00",sOptions="1984",bDetected=1):MSDOS.compareEP("b8....8ed88bd08c06....268b1e....891e....2bd8f7c3....75..b1..d3e3")?(sVersion="2.05",sOptions="1987",bDetected=1):MSDOS.compareEP("ba....b4..b0..8cc98ed9cd21")?(sVersion="2.00",sOptions="1984",bDetected=1):MSDOS.compareEP("b8....8ed88c06....ba....d1eab9....2bcad1ea")?(sVersion="1.00",sOptions="1981",bDetected=1):MSDOS.compareEP("2e8e1e....8cd08cdb2bc3d1e0")&&(sVersion="2.02",sOptions="1987",bDetected=1),sLang="Pascal",result()}meta("compiler","IBM PC Pascal")

================================================
FILE: dbs_min/db/MSDOS/John_Socha_Library.3.sg
================================================
function detect(){return MSDOS.compareEP("bb....8edb2e891e....8d06....25....fa8ed38be0fb26a1....a3....b430cd21a2....8826....3c..73..8d16....b409cd2133c05006cb")&&(sVersion="1986 Peter Norton Computing, Inc.",bDetected=1),result()}meta("library","John Socha Library")

================================================
FILE: dbs_min/db/MSDOS/Khrome_Crypt.2.sg
================================================
function detect(){return MSDOS.compareEP("B9....B8....EB..80....EB..EB..EB..66..........66")&&(sVersion="0.3",bDetected=1),result()}meta("protector","Khrome Crypt")

================================================
FILE: dbs_min/db/MSDOS/LSI_C.4.sg
================================================
function detect(){return(MSDOS.compareEP("b8....8ed0bc....368c......b430cd2136......8a......32ff438e......161f33ffb9....32c0fceb")||MSDOS.compareEP("b8....8ec00617bc....268c......b430cd2126a3....fcbe....8a0e....32edbf....f3a426......47"))&&(bDetected=1),result()}meta("compiler","LSI C-86")

================================================
FILE: dbs_min/db/MSDOS/L_O_V_E__FORTH.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$fc2e8c1e....8cc88ec08ed8bb....e8....bb....e8....bb....e8....bb....e8....8bec2b2e")?(sVersion="1.29",sOptions="1988-92 by Homer Seywerd, Wolodymyr R. Elehew and Peter Cav",bDetected=1):MSDOS.compareEP("fcbb....e8$$$$8b8f....09c974..8cd88cda0387....0397....1e068ed88ec28bf98bf14f4efdf3a4")&&(sVersion="1.20",sOptions="1988-92 by Homer Seywerd, Wolodymyr R. Elehew and Peter Cav",bDetected=1),result()}meta("compiler","L.O.V.E. FORTH")

================================================
FILE: dbs_min/db/MSDOS/Lahey_Fortran.4.sg
================================================
function detect(){return MSDOS.compareEP("EA########dbe3fcb8....8ed88c06....54583bc474..c606......d92e....eb")&&(sOptions="1984-91 by Lahey Computer Systems Inc.",bDetected=1),sLang="Fortran",result()}meta("compiler","Lahey Fortran")

================================================
FILE: dbs_min/db/MSDOS/Lattice_C.4.sg
================================================
function detect(){return MSDOS.compareEP("fab8....8ed8b8....8ed0bc....90fb")||MSDOS.compareEP("fab8....8ed8b8....8ed02e8b26....fbb8....a3....8c06....26a1....a3....be")?(sVersion="3.0",bDetected=1):MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be02e8c06....fbbb....b4..cd2173..e9")||MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8cd88cc92bc1b1..d3c0a3....8126........25....a3....33c0")?(sVersion="3.00",bDetected=1):MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb8....a3....8c06....26a1....a3")||MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be0fbbb....b4..cd21ba....72")?(sVersion="2.00",bDetected=1):MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb430cd210ac075..b8....a3....8c06")||MSDOS.compareEP("fa8cc78cd68bccba....8ec2268e16....bc....fb8ec75651501e06")?(sVersion="2.1",bDetected=1):MSDOS.compareEP("fcb8....8ed88926....8306......06fa8ed081c4....fbc706........c606......33c0a2....a2....b8....2d....a3....03c4")?(sVersion="6.0",bDetected=1):MSDOS.compareEP("fcb8....8ed88926....8306......fa8ed081c4....fbc706........b8....a3....a3....bb....2bd8")?(sVersion="6.0",MSDOS.compareEP("891e....03dc",43)&&(sOptions="overlay"),bDetected=1):MSDOS.compareEP("8cc88ed8ba....b409cd21b8....8ed8ba....b409cd21bb....8b178b4f..8ed9b409cd21b8....cd21cb")?(sVersion="3.30",sOptions="driver",bDetected=1):MSDOS.compareEP("fa8cdeb9....8ed98926....8c16....8936....8bec8b46..a3....8b46..a3....fbfca1....0bc075..40a3....8cd8")||MSDOS.compareEP("8bec8b5e..8b46..2ea3....2e891e....c746......8b46..8b5e..8cc78cd68bccba....8ec2268e16....bc....8bd0")?(sVersion="3.00",sOptions="overlay",bDetected=1):MSDOS.compareEP("b8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3891e....b8....a3....0633c0508bec")?(sVersion="1.00",bDetected=1):MSDOS.compareEP("fab8....8ed88ed08c06....268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec")?(sVersion="1.02",bDetected=1):MSDOS.compareEP("fc508cc00bc05874..b8....8ed88cc0a3....2906....8b1e....b4..cd2126a1....a3....8cc0a3....c706........268a1e")||MSDOS.compareEP("eb$$fafcb8....8ed88cc0a3....2906....a3....c706........8b1e....b4..cd2126a1....a3....268a1e....26c606")?(sVersion="3.30",bDetected=1):MSDOS.compareEP("e8$$$$fc268b36....bf....2e8c06....8ec732c0b430cd21fc8cd93c..73..b0..26a2....33ed33db8edb8b07d1e8")||MSDOS.compareEP("e8$$$$8cc78cd68bcc83c1..2e8c06....ba....8ec2268e16....bc....5651501e57b8....8ed833ff26f685......75")?(sVersion="2.00",bDetected=1):MSDOS.compareEP("fabe....8b14b8....8ed8b8....8ed0bc....8916....fbb430cd210ac075..b8....a3....8c06....803e......7c")?(sVersion="2.1",bDetected=1):MSDOS.compareEP("fafcb8....8ed88f06....8f06....8becc446..a3....8c06....8b46..2b46..a3....8b46..a3....8e46..8b5e..b8....8ed0")?(sVersion="2.1",sOptions="overlay",bDetected=1):(MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be0fbbb....b44acd21ba....73..e9")||MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8c06....268e06....8c06....c706........b8....a3"))&&(sVersion="2.1-3.0",bDetected=1),sLang="C",result()}meta("compiler","Lattice C")

================================================
FILE: dbs_min/db/MSDOS/Logitech_Modula-2.4.sg
================================================
function detect(){return MSDOS.compareEP("8cdb83c3..8cc88ec0bf....33c0268a05473c..74..3c..74..03f08b0c03cb890ceb..26c5358cd903cb8ed983c7..eb..b8....03c350b8....5033c0")&&(sVersion="3.00",sOptions="Aug 1987",bDetected=1),result()}meta("compiler","Logitech Modula-2")

================================================
FILE: dbs_min/db/MSDOS/Meridian_Ada.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed89a........558bec5583ec..168d46..509a........894e..895e..83fb..75..83f9..75")?(MSDOS.compareEP("9a",43)?sVersion="1993":MSDOS.compareEP("33c050ba....521ebe....569a",43)&&(sVersion="1991"),bDetected=1):(MSDOS.compareEP("b8....8ed89a########04..2bc0f3508a46..83e0")||MSDOS.compareEP("b8....8ed89a########515006b8....8ec0b9....b8....8bf8fcf3ab075859cb")||MSDOS.compareEP("b8....8ed89a########e8$$$$c8......57561eb8....8ed868....9a")||MSDOS.compareEP("b8....8ed89a########8c06....8c16....8926....a1....a3....8b16....8916....8c06....9a"))&&(sVersion="1988",bDetected=1),result()}meta("compiler","Meridian Adavantage ADA")

================================================
FILE: dbs_min/db/MSDOS/Meridian_Pascal.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....501f9a########8926....8926....8c16....8c16....8c06....8c06....9a........c706")&&(sOptions="1985-1988 by Meridian Software Systems, Inc.",bDetected=1),MSDOS.compareEP("b8....8ed89a########8c06....8c16....8926....a1....a3....a1....a3....a1....a3")?(sOptions="1985-1988 by Meridian Software Systems, Inc.",bDetected=1):MSDOS.compareEP("b8....8ed89a########558bec5583ec..8c06....8c16....8926....cd..8946..f646")&&(sOptions="1985 by Meridian Software Systems, Inc.",bDetected=1),sLang="Pascal",result()}meta("compiler","Meridian Pascal")

================================================
FILE: dbs_min/db/MSDOS/MetaWare_High_C.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....50b8....50cbeb$$bd....2e8e1e....26a1....a3....8cd805....268b1e....3bc376..2bd8b1..d3e3eb..26a3....938cc02bd8b44acd212bdb8cd8fa8ed08be3fbc706........c706")?(sVersion="1983-1986",bDetected=1):MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....26a1....2d....bb....fa8ed08be3fbc706........c706........bb....3bc373..2bd8b1..d3e3011e....011e....2e8e1e....9c0654582bc4d1f8")?(sVersion="1983-1988",bDetected=1):MSDOS.compareEP("eb$$fa6633e42e8e16....bc....6633f66633ff6633c92e8e1e....be....2e8e06....bf....b9....e8")?(sVersion="1983-1990",bDetected=1):MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....26a1....2d....bb....fa8ed08be3fbc706........c706........bb")||MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....268b......b1..4b891e....b8....05....3bc376..8bc3ba....2bc2d3e0")?(sVersion="1983-1986",bDetected=1):MSDOS.compareEP("eb$$bd....2e8e1e....268b1e....b1..4b891e....b8....05....3bc376..8bc350a3....a3....2bd8b1..d3c38cc12bc1")&&(sVersion="1983-1985",bDetected=1),sLang="C",result()}meta("compiler","MetaWare High C")

================================================
FILE: dbs_min/db/MSDOS/MetaWare_Professional_Pascal.4.sg
================================================
function detect(){return MSDOS.compareEP("b8000050b8....50cbeb..e8....2bc050e8....c3....bd....2e8e")||MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....26a1....2d....bb....fa8ed08be3fb")||MSDOS.compareEP("eb$$bd....2e8e1e....26a1....2d....bb....fa8ed08be3fb")?(sVersion="1983-1986",bDetected=1):MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8cd805....268b1e....3bc376..2bd8b1..d3e3eb")&&(sVersion="1983-1988",bDetected=1),sLang="Pascal",result()}meta("compiler","MetaWare Professional Pascal")

================================================
FILE: dbs_min/db/MSDOS/Micro_Focus_Cobol.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$e9$$$$e8....8edac606......b8....0306....8ed28be08c0e....4a8bc28706....2bd0e8")&&(sVersion="1981, 1985 by Micro Focus Ltd",bDetected=1),MSDOS.compareEP("e8....51e8$$$$8bf0e8$$$$061e5657558bece8....72..a1....8be55d5f5e1f07c3")&&(sVersion="4.5",bDetected=1),sLang="Cobol",result()}meta("compiler","Micro Focus Cobol")

================================================
FILE: dbs_min/db/MSDOS/Micro_Focus_DOS_extender.0a.sg
================================================
function detect(){return MSDOS.compareEP("eb$$b8....8ed854583bc475..0f01e0a8..74..e8....75..2e800e......eb..c8......0f014e..80")&&(sVersion="1993 by Micro Focus Ltd",bDetected=1),result()}meta("extender","Micro Focus DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_Basic.4.sg
================================================
function detect(){return MSDOS.compareEP("eb$$0e1fb8....e8....8eda938a170ad274..b4..cd2143eb..b8....cd21")?(sVersion="7.10",bDetected=1):(MSDOS.compareEP("9a########591fa1....1e510e1ffc3d....74..e9....b430cd213c..73..e9$$$$ba....0e1fb409cd21b8....cd21")||MSDOS.compareEP("e9$$$$8cc88ed8e8....8a170ad274..b4..cd2143eb..b2..b4..cd21"))&&(sVersion="5.60",sOptions="1986",bDetected=1),sLang="Basic",result()}meta("compiler","Microsoft Basic")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_C.4.sg
================================================
function detect(){return MSDOS.compareEP("b430cd213c..73..33c00650cbbf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f")?(sName+=" Quick C",sVersion="2.5X",sOptions="1990",bDetected=1):MSDOS.compareEP("fc8cc02ea3....8ed8a1....2ea3....2ea3....be....ac32e403f0c6....b8....8ec02680........75")?(sName+=" Quick C",sVersion="2.51a",sOptions="1990",bDetected=1):MSDOS.compareEP("b430cd213c..73..b8....50e8....92b409cd21cd20bf")||MSDOS.compareEP("b430cd213c..73..b8....50900ee8....92b409cd21cd20bf")||MSDOS.compareEP("b430cd213c..73..b8....509a........92b409cd21cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..33c050")?(sName+=" C/C++",sVersion="1986",bDetected=1):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf072..8bf0fa8ed781c4....fb73")?(sName+=" Quick C",sVersion="1987-89",bDetected=1):MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..e9....81e4....3689......3689......8bc6b1")?(sName+=" C/C++",sVersion="1985",bDetected=1):MSDOS.compareEP("fab8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec")?(sName+=" C/C++",sVersion="1.04",bDetected=1):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73")&&(sName+=" Quick C",MSDOS.compareEP("81",54)?(sVersion="1.0",sOptions="1987"):MSDOS.compareEP("83",54)?(sVersion="2.00",sOptions="1989"):MSDOS.compareEP("8b",54)&&(sVersion="2.X",sOptions="1989"),bDetected=1),result()}meta("compiler","Microsoft")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_C_Library.3.sg
================================================
function detect(){return MSDOS.compareEP("fa8cc78cd68bccba....8ec2268e16....bc....fb8ec75651501e062e8c06....b8....8ed8e8....b8....8ec08cc8262b06....26a3....803e")?(sVersion="1986",bDetected=1):MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f0ee8....33c0500ee8....b8....cd21")?(sVersion="1985",bDetected=1):MSDOS.compareEP("061e33c08ed88b1e....a1....8ec0268b47..3d....75..ba....1f07e9....1f07be....ac0ac074..e8....72")&&(sName+=" (possibly)",sVersion="1986",bDetected=1),result()}meta("library","Microsoft C Library")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_Fortran.4.sg
================================================
function detect(){return MSDOS.compareEP("b430cd213c..73..9a########558becb8....501eb8....50b8....509a")&&(sVersion="1987",bDetected=1),sLang="Fortran",result()}meta("compiler","Microsoft Fortran")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_Quick_Basic.4.sg
================================================
function detect(){return MSDOS.compareEP("1e071e2e8e1e....b430cd2150812e........8b36....ad91ade3..3d....72..3d....73..ba....eb..0bc075..c706........c706........33c99a")?bDetected=1:MSDOS.compareEP("e9$$$$8cda83c2..8edaa1....0e1ffc3d....74..e9....b430cd213c..73..e9$$$$ba....0e1fb409cd21b8....cd21")?(sVersion="2.0",bDetected=1):MSDOS.compareEP("9a########591fa1....1e510e1ffc")?(sVersion="3.0",bDetected=1):MSDOS.compareEP("eb$$0e1fb8....509a........8eda938a170ad274..b4..cd2143eb")?(sVersion="4.5",bDetected=1):MSDOS.compareEP("9a########591fa0....1e51063c..74")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("bf....a1....2ea3....2bc73d....72..b8....fa8ed781c4....fb969f2e8826....9683e4")?(sVersion="4.0",bDetected=1):MSDOS.compareEP("9a########06ba....8eda268b3e....8ec257b9....be....bf....0e1ffcf3a4b1")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("b8....8ed88c06....fa8ed0bc....fbb430cd21a3....3c..75..06b4..cd218c06....b9")&&(sVersion="4.X",bDetected=1),sLang="Basic",result()}meta("compiler","Microsoft Quick Basic")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_Quick_Pascal.4.sg
================================================
function detect(){return MSDOS.compareEP("b0..9a########50b430cd213c..73..cd20b8....8ed88c06....c706........8c0e....58545b3bdc74..0ac074..be....e8....32c0e9")&&(sVersion="1.0-1.08",sOptions="1989",bDetected=1),sLang="Pascal",result()}meta("compiler","Microsoft QuickPascal")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_RTL.3.sg
================================================
function detect(){return MSDOS.compareEP("b430cd213c..73..cd208cc18cd32bd981c3....b4..cd2172..8cd6bf....2bf7b1..d3e6fa8ed703e6fb")?bDetected=1:MSDOS.compareEP("1e068cc88ed88cc0a3....83c0..a3....b430cd213c..73..b8....8ed8b8....ea........e8....e8....e8....8e")?(sVersion="1992",bDetected=1):MSDOS.compareEP("b430cd213c..73..cd20bf....b8....03c405....b1..d3e88bf0fa8ed781c4....fb73..161f9a........33c0509a")?(sVersion="1987",bDetected=1):MSDOS.compareEP("2e8c06....2e8c1e....bb....8edb1ee8....1f8b1e....0bdb74..8cd18bd4fa8ed3bc....fb5351521ee8....1f5a")||MSDOS.compareEP("2e8c1e....bb....8edb1ee8....1f8b1e....0bdb74..8cd18bd4fa8ed3bc....fb5351521ee8....1f5a")||MSDOS.compareEP("1eb8....8ed8b430cd213c..73..ba....e8....0633c050cb")||MSDOS.compareEP("1e069a########502e8c06....2ea1....2e0b06....75..26a1....2ea3....26a1....2ea3....58cb")?(sVersion="1990",bDetected=1):MSDOS.compareEP("b8....cd212e8816....b2..b8....cd21b4..cd218edbb8....83e8..8ec033f633ffb9....fcf3a5bb")||MSDOS.compareEP("b4..cd218edbb8....83e8..8ec033f633ffb9....fcf3a5bb")?(sVersion="1992",bDetected=1):MSDOS.compareEP("8cd03d....75..8cd83d....75..8ccab8....e8....e9....8cdb8ccab8....e8....eb..908cd83d")?(sVersion="1990",bDetected=1):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f")?(sVersion="1988",bDetected=1):(MSDOS.compareEP("b4..cd213c..73..33c00650cb86e03d....b0..72..bf....8b36....2bf781fe....72..be")||MSDOS.compareEP("bf....8edffa8ed781c4....fb33dbb8....cd210bdb74..881e....883e....8816....8836....b8"))&&(sVersion="1992",bDetected=1),result()}meta("library","Microsoft RTL")

================================================
FILE: dbs_min/db/MSDOS/Microsoft_RTL_(Clipper).3.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$1e06fc8cc88ed88c06....b430cd2186e0a3....e8....891e....890e....b8....bb....e8....071fc3")&&(sVersion="1988",bDetected=1),result()}meta("library","Microsoft RTL (CLIPPER 5.01)")

================================================
FILE: dbs_min/db/MSDOS/MultiLoop_Protection.2.sg
================================================
function detect(){return MSDOS.compareEP("1e06b8....8ec0b0..b9....be....2e300404..46e2")&&(sOptions="1992 by J&A",bDetected=1),result()}meta("protector","MultiLoop Protection")

================================================
FILE: dbs_min/db/MSDOS/Netware_loader.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$b8....cd213c..72..a1....3d....75..a1....3d....75..e9$$$$1e8cc88ed833c08ec0268b1e....891e")&&(bDetected=1),result()}meta("loader","Netware loader")

================================================
FILE: dbs_min/db/MSDOS/PDC_Prolog.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed88cc6bb....8ec3bb....268b178ec6b9....8bdad3eb8cd003d88cc02bd843b44acd2173..b0..b44ccd21")&&(sOptions="1992 by Prolog Development Center",bDetected=1),sLang="Visual Prolog",result()}meta("compiler","PDC Prolog")

================================================
FILE: dbs_min/db/MSDOS/PK_sig.1.sg
================================================
function detect(){return MSDOS.compareEP("c706....'PK'8cd805....50b8....50cb")&&(bDetected=1),result()}meta("other","PK signature")

================================================
FILE: dbs_min/db/MSDOS/PROPACK_SFX.1.sg
================================================
function detect(){return MSDOS.compareEP("558bec83ec..8c5e..e8....be....e8....b80030cd21ba....0e3c..72..a1....8ec033ff33c0b9....f2aeae75..fec0af75..5a8bd7061f")&&(sVersion="2.18",bDetected=1),result()}meta("sfx","PROPACK SFX")

================================================
FILE: dbs_min/db/MSDOS/Pacific_C.4.sg
================================================
function detect(){return(MSDOS.compareEP("fcb8....8ed826a1....488bd881eb....ba....3bd372..8bda2bc3b9....d3e048488ed38be0")||MSDOS.compareEP("fcc516....b8....8ed88ed0268b1e....4b2bd8b8....f7c3")||MSDOS.compareEP("fc8d16....b8....8ed826a1....488bd881eb....ba....3bd372..8bda2bc3b9....d3e048488ed38be0"))&&(sVersion="7.51",sOptions="1984-91 by HI-TECH Software",bDetected=1),sLang="C",result()}meta("compiler","Pacific C")

================================================
FILE: dbs_min/db/MSDOS/Panda_immunizer.1.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$5d81ed....2e8c8e....2e8c86....fc268e06....33ff32c0b9....f2ae26803d..75..83c7..2e89be")&&(sOptions="by Panda Software",sVersion="2.10s",bDetected=1),result()}meta("immunizer","Artemis Professional")

================================================
FILE: dbs_min/db/MSDOS/Pascal_MT+86.4.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$8cc82e0306....2e0306....2e0306....2e0306....3b06....76..2ea1....2d....2ea3....3d....7f..1ee8")?(sVersion="3.1",sOptions="1982 by Digital Research, Inc.",bDetected=1):MSDOS.compareEP("e8$$$$8cc82e0306....2e0306....2e0306....2e0306....3b06....76..1ee8")&&(sVersion="3.01",sOptions="1982 by Digital Research, Inc.",bDetected=1),sLang="Pascal",result()}meta("compiler","Pascal/MT+86")

================================================
FILE: dbs_min/db/MSDOS/Phar_Lap.0a.sg
================================================
function detect(){return MSDOS.compareEP("eb$$8cd88ec0b8....8ed8c706........b8....2d....3bc476..c706........8f06....8f06....58a3....a3....a3....8cd88d1e....8ed0")?(sVersion="1986-93 (C5S2S2P6)",bDetected=1):MSDOS.compareEP("eb$$8cd88ec0b8....8ed8bb....8cc02bd881c3....b44acd2173..e9....8d06....05....8cdb8ed38be0fcb8....8ec033c033db33c9")?(sVersion="1986-91 (C5S2S2PJ)",bDetected=1):MSDOS.compareEP("b8....50b8....50cb")?(sVersion="1986-91 (C3S2S2P8)",bDetected=1):MSDOS.compareEP("eb$$bd....2e8e1e....26a1....a3....268b1e....b1..8cdab8....05....3bc376..8bc32bc23d....76..b8....d3e0bb....891e....c706")||MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8d06....a3....9d06....a3....8d06....a3....8cd88d1e....8ed08be3bb....26891e....8cc02bd8")?(sVersion="1986-89 (C5S2S2P6)",bDetected=1):MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....268b1e....b1..4b891e....b8....05....3bc376..8bc3ba....2bc2d3e0c706........c706")?(sVersion="1986-89 (C5S2S2P7)",bDetected=1):MSDOS.compareEP("b8....8ed8b8....cd21a3....3c..7d..b4..ba....8edaba....cd2106b8....50cb")&&(sVersion="1986-89 (C5S2S2PN)",bDetected=1),result()}meta("extender","Phar Lap DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/RAR.6.sg
================================================
function detect(){detect_RAR(0)}includeScript("rar-file")

================================================
FILE: dbs_min/db/MSDOS/REC_small.1.sg
================================================
function detect(){return MSDOS.compareEP("8cd81ee8$$$$83c0..5fb9....81ef....87ef408ed82bdbb2..0017424383fb..75..e2")?(sVersion="1.2",sOptions="by Ralf Roth",bDetected=1):MSDOS.compareEP("8cd81ee8$$$$5d83c0..81ed....b9....408ed82bdbb2..0017fec24383fb..75..e2")?(sVersion="1.01",sOptions="by Ralf Roth",bDetected=1):MSDOS.compareEP("8cd81ee8000083c0..5db9....81ed....408ed82bdbb2..0017fec24383fb..75..e2")?(sVersion="1.02",sOptions="by Ralf Roth",bDetected=1):MSDOS.compareEP("b9....8cd883c0..fa8bdc8cd7bc....44408ed02be4b2..8bec0056..424483fc..75..e2")&&(sVersion="1.05",sOptions="by Ralf Roth",bDetected=1),result()}meta("protector","REC.small")

================================================
FILE: dbs_min/db/MSDOS/REC_small_AV.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$8cd81ee8$$$$83c0..5fb9....81ef....87ef408ed82bdbb2..0017424383fb..75..e2")?(sVersion="1.03",sOptions="by Ralf Roth",bDetected=1):MSDOS.compareEP("eb$$8cd81ee8$$$$83c0..5fb9....81ef....87ef408ed82bdbb2..001702d34383fb..75..e2")&&(sVersion="4.01",sOptions="by Ralf Roth",bDetected=1),result()}meta("immunizer","REC.small")

================================================
FILE: dbs_min/db/MSDOS/RLE_com-packer.2.sg
================================================
function detect(){return MSDOS.compareEP("60be....bf....8b0e....f3a4be....bf....57b9....f3a4c3")&&(sOptions="by NOP/PC",bDetected=1),result()}meta("packer","RLE com-packer")

================================================
FILE: dbs_min/db/MSDOS/RM_FORTRAN.4.sg
================================================
function detect(){return MSDOS.compareEP("fc1eb8....8ed89a........81ec....8becc706........c706........33ffbe....b8....8ec0b9....f3a5897e..b8....ab8cdb8ec3bb")&&(bDetected=1),sLang="Fortran",result()}meta("compiler","RM/FORTRAN")

================================================
FILE: dbs_min/db/MSDOS/RTLink_VM_Manager.0a.sg
================================================
function detect(){return MSDOS.compareEP("9a########1e069a........2e8c06....8cc88ed852ba....b0..9a........5afcb8....2b06....d1e0")&&(bDetected=1),result()}meta("extender",".RTLink VM Manager")

================================================
FILE: dbs_min/db/MSDOS/RTPatch_SFX.1.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$8ccb8edb8c06....a3....8cc00106....0106....fd26a1....bb....b1..d3eb2bc38ec0bf....83e7..8bf7b9....d1e9f3a5fc")&&(sVersion="3.20",bDetected=1),result()}meta("sfx","RTPatch SFX")

================================================
FILE: dbs_min/db/MSDOS/Realia_Cobol.4.sg
================================================
function detect(){return MSDOS.compareEP("9a########9a########3c..75..8ed38be22bdb2bd2cb")&&(sVersion="4.X",sOptions="1984-92 by Realia, Inc.",bDetected=1),sLang="Cobol",result()}meta("compiler","Realia Cobol")

================================================
FILE: dbs_min/db/MSDOS/Realia_SPITBOL.4.sg
================================================
function detect(){return MSDOS.compareEP("2e8c1e....fc8ccaa1....0e1ffe06....a3....0116....b9....be....ad0bc074..03c28944..e2..8e06....bf....b1..b0..f3ae")&&(sVersion="3.6",sOptions="1983-84 by Realia, Inc.",bDetected=1),result()}meta("compiler","Realia SPITBOL")

================================================
FILE: dbs_min/db/MSDOS/SHOW_IT.1.sg
================================================
function detect(){return MSDOS.compareEP("bf....32db2e8a150ad274..b4..cd214780fa..75..fec380fb..75..32db53b4..cd16b4..cd165b75")&&(sVersion="1.2",sOptions="converted to exe",bDetected=1),result()}meta("self-displayer","SHOW IT")

================================================
FILE: dbs_min/db/MSDOS/Self_UnStuffer.2.sg
================================================
function detect(){return MSDOS.compareEP("86e303e9ace3$$1000e3$$00e40ec400e3")&&MSDOS.compareOverlay("0101'Aladdin'")&&(sVersion="1.1",sOptions="by Aladdin Systems, Inc.",bDetected=1),result()}meta("sfx","Self UnStuffer")

================================================
FILE: dbs_min/db/MSDOS/Small_C.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed826a1....2d....80fc..72..b8....b1..d3e0fa8cdb8ed38be050fbb8....2d....d3e08bd8fec73bdc72..b8....50e8")?(sVersion="2.2",sOptions="1982-88 by J. E. Hendrix",bDetected=1):MSDOS.compareEP("b8....8ed826a1....2d....3d....72..b8....b1..d3e0fa8cdb8ed38be050fbb8....2d....d3e08bd881c3....3bdc72..b8....cd21")&&(sVersion="2.1",sOptions="1982-88 by J. E. Hendrix",bDetected=1),sLang="C",result()}meta("compiler","Small C")

================================================
FILE: dbs_min/db/MSDOS/StonyBrook_Pascal.4.sg
================================================
function detect(){return MSDOS.compareEP("31ED9A........5589E581EC....B8....0E509A........BE....1E0EBF....1E071FFC")?(sVersion="7.0",bDetected=1):MSDOS.compareEP("31ed9a........5589e5b8....50ff1e")?(sVersion="6.13",bDetected=1):MSDOS.compareEP("31ed9a........5589e581ec....16078dbe....b9....31c0fcf3ab1e07")?(sVersion="6.12",bDetected=1):MSDOS.compareEP("31ed9a........5589e59a........c706........c706........e8")?(sVersion="6.1G",bDetected=1):MSDOS.compareEP("31ed9a........5589e583ec..9a........9a")&&(sVersion="6.14",bDetected=1),sLang="Pascal",result()}meta("compiler","StonyBrook Pascal+")

================================================
FILE: dbs_min/db/MSDOS/Sydex_SFX.1.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ec0b430cd2186e0ba....3d....72..a1....26a3....bf....8a1d32ff47883926893e....268c1e....8cd88cc3")&&(sOptions="1994 by Sydex, Inc.",bDetected=1),MSDOS.compareEP("b8....8ec0e8....ba....3d....b8....72..e8....26a3....26890e....268916....8cd88cc381c3....2bd88ec0b4..cd21")&&MSDOS.compareOverlay("'SXD'00")&&(sOptions="1997 by Sydex, Inc.",bDetected=1),result()}meta("sfx","Sydex SFX")

================================================
FILE: dbs_min/db/MSDOS/Topspeed_Modula.4.sg
================================================
function detect(){return MSDOS.compareEP("e90000fc2bedbc....b8....8ed88c06....26a1....a3....54583bc4b8....75..b430cd213c..74..3c..77..b8....8cdbe8....86c4a3....8e06")?(sVersion="2.0",bDetected=1):MSDOS.compareEP("1eba....8eda8b0e....8b36....ff36....5053a1....48ba....8eda890e....8936....a3....c706........2ea1....a3")||MSDOS.compareEP("1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....58c706........c706")||MSDOS.compareEP("1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....c706........58c706")||MSDOS.compareEP("fc1eba....8eda8b0e....8b36....ff36....50a1....ba....8eda890e....8936....a3....58c706........c706")?(sName+=" RTL",sOptions="1989 by JPI",bDetected=1):MSDOS.compareEP("ea########2e8c1e....fc2ef706........74..e8....eb..b8....ba....0e1fcd212bc02ef706........74")?(sVersion="2.0",sOptions="by JPI",bDetected=1):MSDOS.compareEP("ea########2e8c1e....fc2bc08cd3ba....8ec2bf....b9....f3ab423bd372..508becffe0")?(sVersion="1.17",sOptions="by JPI",bDetected=1):MSDOS.compareEP("ea########8cdb2e8e1e....891e....fc2ef706........74..2bc02e8e1e....ff36....8cd3ba....8ec2bf....b9....f3ab423b..72")&&(sOptions="by JPI",bDetected=1),sLang="Modula",result()}meta("compiler","Topspeed Modula")

================================================
FILE: dbs_min/db/MSDOS/UR_FORTH.4.sg
================================================
function detect(){return MSDOS.compareEP("fc2e8c06....2e8e1e....e8$$$$b430cd213c..73..e8")&&(sVersion="1.03",sOptions="1986-88 by Laboratory Microsystems, Inc.",bDetected=1),result()}meta("compiler","UR/FORTH")

================================================
FILE: dbs_min/db/MSDOS/Unknown_cryptors.2.sg
================================================
function detect(){return MSDOS.compareEP("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8")?(sVersion="#01",bDetected=1):MSDOS.compareEP("e9$$$$b9....b3..be....bf....acfec332c3aae2")?(sVersion="#02",sOptions="exe 0-relocs crypt",bDetected=1):MSDOS.compareEP("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07")?(sVersion="#03",bDetected=1):MSDOS.compareEP("9090e9$$$$8cd88be8b8....8be08ccb8edb8ec3bf....892de8....8cc88ed88ec01e33db8edbbb....81eb....8b071f1ebb")?(sVersion="#04",bDetected=1):MSDOS.compareEP("eb$$be....bf....2e89352eff26")?(sOptions="protector",sVersion="#05",bDetected=1):MSDOS.compareEP("bf....b8....fa8ed08be7fb1e1eb8....0e500e501efc8cd08ec0be....8cc806b9....578ed8f3a5cb")?(sOptions="Russ",sVersion="#06",bDetected=1):MSDOS.compareEP("........0e1f8b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb")?(sOptions="Aidstest",sVersion="#07",bDetected=1):MSDOS.compareEP("e9$$$$e8$$$$bb....e8$$$$29c9e8$$$$e8$$$$e9$$$$8ed9e9$$$$870feb$$e8$$$$eb$$51eb$$eb$$29dbe8$$$$bf....e9$$$$e8$$$$871de8$$$$53eb$$b3..b7..bf....2e8a05")?(sOptions="by Matrix Technologies",sVersion="#08",bDetected=1):MSDOS.compareEP("bd....50060ee8$$$$065733ff570e1f07be....b9....8004..46e2..b1..ac268a1d04..aa80eb..885c..e2")?(sOptions="SYN!",sVersion="#09",bDetected=1):MSDOS.compareEP("e9$$$$eb$$bf....e9$$$$26f6e8$$$$e9$$$$8edee8$$$$8735e8$$$$56e9")?(sOptions="by Matrix Technologies",sVersion="#10",bDetected=1):MSDOS.compareEP("b3..060e1f8b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb")?(sOptions="Aidstest",sVersion="#11",bDetected=1):MSDOS.compareEP("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2")&&(sVersion="#12",bDetected=1),result()}meta("cryptor","Unknown cryptor")

================================================
FILE: dbs_min/db/MSDOS/Upper_Deck_Forth.4.sg
================================================
function detect(){return MSDOS.compareEP("fc2e8c06....b8....cd213c..73..b4..2e8e1e....ba....cd212eff36....33c050cb")&&(sVersion="2.00",sOptions="1990, 1991 by Upper Deck Systems",bDetected=1),result()}meta("compiler","Upper Deck Forth")

================================================
FILE: dbs_min/db/MSDOS/Visual_Cobol.4.sg
================================================
function detect(){return MSDOS.compareEP("9a########061fbe....b9....ac3cff75..e2..ad8ed88b0e....8ed08be1eb")&&(sVersion="3.3",sOptions="1993 by mbp Software & Systems",bDetected=1),sLang="Cobol",result()}meta("compiler","Visual COBOL (XO)")

================================================
FILE: dbs_min/db/MSDOS/WWPACK_mutator.2.sg
================================================
function detect(){return MSDOS.compareEP("8cc981c1....51b9....510606b1..51b1..8cd383eb..5351fc8cd5b8....8cca03d0be....33ff4d8ec58edab1..f3a54a4879")?(sVersion="1.0",sOptions="by Barthazi Andras",bDetected=1):MSDOS.compareEP("8cc981c1....51b9....5106068ccab8....03d0b1..518cd383eb..53b1..51fc8cd5be....33ff4d8ec58eda4ab9....50")?(sOptions="by MR WiCKED",bDetected=1):MSDOS.compareEP("81ce....1bf78a....80fa..2a95....fc03f633f281e6....1e10ea0e1f00d20e0732b4....21da2efe06")?(sOptions="1996 by van Hauser",bDetected=1):MSDOS.compareEP("8ccab8....03d08cc981c1....51b9....510606b1..518cd383eb..53b1..51fc8cd5be....33ff4d8ec58eda4ab9....50")||MSDOS.compareEP("8cd383eb..8cc981c1....51b9....510606b1..51fc8cd5b1..5351b8....8cca")||MSDOS.compareEP("8cc981c1....51b9....51b1..068cd30651b1..b8....8cca03d0fc")||MSDOS.compareEP("8cc981c1....51b9....510606fc8cd5b1..51b1..8cd383eb..5351")||MSDOS.compareEP("8cc981c1....51b9....fc8cd5510606b1..51b1..8cd383eb..5351")?(sVersion="3.04a",sOptions="by Boogie",bDetected=1):MSDOS.compareEP("f9be....81ee....2e80b4......eb")?(sVersion="1.1c",bDetected=1):MSDOS.compareEP("061e0e0e071fb430cd2186e03d....73..cd20eb$$eb$$5055528cd2fa50b8....58eb")?(sOptions="REC by R0SE",bDetected=1):MSDOS.compareEP("8cc98cd383eb..81c1....51b9....510606b1..518ccafc8cd5b1..5351b8")?(sVersion="1.0",sOptions="by Barthazi Andras",bDetected=1):MSDOS.compareEP("......81......2e80..")&&(sOptions="by unknown",bDetected=1),result()}meta("protector","WWPACK mutation engine")

================================================
FILE: dbs_min/db/MSDOS/Whitesmiths_C.4.sg
================================================
function detect(){return MSDOS.compareEP("be....8cd18cd83bc175..a3....e9....8bde8a0f81e1....03d9d1e941ff3783eb..e2..8bf48cd936890e....8cd18ed98c06....8c06")?(sVersion="3.3",sOptions="1988 by Whitesmiths, Ltd. and Cosmic, Sarl",bDetected=1):MSDOS.compareEP("be....8cdb8cd03bc374..8a0c81e1....03f1d1e941ff3483ee..e2..8bf4b9....8ed9")&&(sVersion="3.2",sOptions="1987 by Whitesmiths, Ltd",bDetected=1),sLang="C",result()}meta("compiler","Whitesmiths C (dos86)")

================================================
FILE: dbs_min/db/MSDOS/Window_book.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$e8$$$$fc5e8cda8b1e....bd....8edd8ec5b9....bf....2bcf33c02ea3....41d1e9f3ab891e....8916....8ec2bb....03dd")?-1!=MSDOS.findSignature(MSDOS.getOverlayOffset(),2e3,"1a1a7bf7")&&(sVersion="4.20",bDetected=1):MSDOS.compareEP("e9$$$$e8$$$$fc5e8cdaa1....bd....8edd8ec5a3....b9....bf....2bcf33c02ea3....d1e9f3ab8916....8ec2bb....a1....03c7")&&-1!=MSDOS.findSignature(MSDOS.getOverlayOffset(),2e3,"1a1a7bf7")&&(bDetected=1),result()}meta("other","Window book")

================================================
FILE: dbs_min/db/MSDOS/Wizardy_protection.1.sg
================================================
function detect(){return MSDOS.compareEP("2eff16....e9")&&(bDetected=1),result()}meta("protector","Wizardy protection")

================================================
FILE: dbs_min/db/MSDOS/WordPerfect_EXEPack.2.sg
================================================
function detect(){return MSDOS.compareEP("958cc005....0e1fa3....0306....8ec08b0e....8bf94f8bf7fdf3a48b16....50b8....50cb")&&(bDetected=1),result()}meta("packer","WordPerfect EXEPack")

================================================
FILE: dbs_min/db/MSDOS/XOPEN+_Protection.2.sg
================================================
function detect(){return MSDOS.compareEP("8cca8cdd8eda81ea....8916....ba....8eddea")&&(sOptions="1994",bDetected=1),result()}meta("protector","XOPEN+ Protection")

================================================
FILE: dbs_min/db/MSDOS/Zbikowski_C.4.sg
================================================
function detect(){return(MSDOS.compareEP("ba....8cd32bdab1..d3e3fa8ed203e3fbfc8b1e....8bc32bc2a9....74..8bda80c7..33c0eb..b1..d3e02d....36a3")||MSDOS.compareEP("ba....8cd32bdab1..d3e3fa8ed203e3fbbe....8b1e....36891e....33ff8bc70bdb74..b9....8ec3f2ae"))&&(sOptions="1983 by Mark Zbikowski (Microsoft Corp.)",bDetected=1),sLang="C",result()}meta("compiler","Zbikowski C")

================================================
FILE: dbs_min/db/MSDOS/Zip.6.sg
================================================
function detect(){detect_Zip(0)}includeScript("zip-file")

================================================
FILE: dbs_min/db/MSDOS/Zortech(Symantec)_C.4.sg
================================================
function detect(){return MSDOS.compareEP("fafcb8....8ed88c......268b......891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....80ff..73..ba....e9....fbb430cd21a3")?(sVersion="2.10 - 3.0r1*, 4.0",bDetected=1):MSDOS.compareEP("fafcb8....8ed88ed08ec0bc....33c050e8....eb")?(sVersion="2.10 - 3.0r1, 4.0",bDetected=1):MSDOS.compareEP("fafcb8....8ed0bc....b8....8ed88c06....660fb7c066c1e0..ba")||MSDOS.compareEP("fafcb8....8ed88ed0bc....2e8c06....33d21e2e8e1e....be....8a0e....32ede3")||MSDOS.compareEP("fafcb8....8ed8bb....81c3....8ed08be3fb8becbe....268a0c4632ed8bd9")?(sVersion="3.0",sOptions="1991",bDetected=1):MSDOS.compareEP("fafcb8....8ed88ed0bc....b4..cd214b891e....8cc0a3....b8....cd21")||MSDOS.compareEP("fafcb8....8ed833c08ed88bf8bb....b9....b8....8905")?(sVersion="2.10 - 3.0r1, 4.0",bDetected=1):MSDOS.compareEP("fab8....8ed8a3....8c06....268b......891e....8bd82b1e....891e....268b......891e....2bd881fb....72..bb....8bd003d34289")?(sVersion="2.0",bDetected=1):MSDOS.compareEP("fab8....8ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd0")?(sVersion="2.00",sOptions="1989 by Walter Bright",bDetected=1):MSDOS.compareEP("fab8....dbe38ed88c06....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....81fb....77")||MSDOS.compareEP("eb$$fab8....05....b9....d3e88cc903c18ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd8")?(sVersion="4.0",bDetected=1):(MSDOS.compareEP("e8$$$$fc06b8....cd21bf....8cc98ed9be....b9....f3")||MSDOS.compareEP("fafcb8....8ed8bb....81c3....8ed08be38becfb8cc0a3....be....268b04a3....8b36")||MSDOS.compareEP("fafcb8....8ed88c06....8ed0bc....fbba....e8....b8....cd2186c4"))&&(bDetected=1),sLang="C",result()}meta("compiler","Zortech/Symantec C")

================================================
FILE: dbs_min/db/MSDOS/Zurenava_DOS_Extender.0a.sg
================================================
function detect(){return MSDOS.compareEP("be....bf....b9....56fcf3a55fe9")&&(sVersion="0.45",bDetected=1),result()}meta("extender","Zurenava DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/_LE.0.sg
================================================
function detect(){return MSDOS.isLE()&&(bDetected=1),result()}meta("type","LE")

================================================
FILE: dbs_min/db/MSDOS/_LX.0.sg
================================================
function detect(){return MSDOS.isLX()&&(bDetected=1),result()}meta("type","LX")

================================================
FILE: dbs_min/db/MSDOS/_MSDOS.0.sg
================================================
function detect(){return MSDOS.isVerbose()&&(sName=MSDOS.getOperationSystemName(),sVersion=MSDOS.getOperationSystemVersion(),sOptions=MSDOS.getOperationSystemOptions(),"Unknown"===sName&&(sName="DOS-like"),bDetected=1),result()}meta("operation system","MS-DOS")

================================================
FILE: dbs_min/db/MSDOS/_NE.0.sg
================================================
function detect(){return MSDOS.isNE()&&(bDetected=1),result()}meta("type","NE")

================================================
FILE: dbs_min/db/MSDOS/_init
================================================
var File=MSDOS,X=MSDOS
MSDOS.getBaseOffset=function(e){return 0==arguments.length&&(e=0),(MSDOS.readWord(8)<<4)+e},MSDOS.addressToOffset=function(e,t){return 1==arguments.length&&(t=0),t+=e<<4,MSDOS.getBaseOffset(1048575&t)},MSDOS.AddressToOffset=function(){MSDOS.addressToOffset.apply(this,arguments)},MSDOS.getEntryPointOffset=function(e){return 0==arguments.length&&(e=0),MSDOS.addressToOffset(MSDOS.readWord(22),MSDOS.readWord(20))+e},MSDOS.getNEOffset=function(e){return 0==arguments.length&&(e=0),MSDOS.readDword(60)+e}

================================================
FILE: dbs_min/db/MSDOS/anti-tracing_add-on.1.sg
================================================
function detect(){return MSDOS.compareEP("fc33d28ec2bf....abab8ccb33ff81eb....53bb....531e0733dbcb")&&(bDetected=1),result()}meta("protector","anti-tracing add-on")

================================================
FILE: dbs_min/db/MSDOS/compiler_ASIC-Basic.4.sg
================================================
function detect(){return(MSDOS.compareEP("b8....8ed88ec033dbb4..cd108916....cc901ebf....8cc82d....8ed833c98a0e....83f9..72..b9....26be....fc")||MSDOS.compareEP("b8....8ed88ec033dbb4..cd108916....1ebf....8cc82d....8ed833c98a0e....83f9..72..b9....26be....fc"))&&(sVersion="5.0",sOptions="1994 by David Visti of 80_20 Software",bDetected=1),result()}meta("compiler","ASIC-Basic")

================================================
FILE: dbs_min/db/MSDOS/compiler_Ada89.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$8cda8cc939d173$$1e0e1fb4..b0..ba....cd21b4..b0..ba....cd211f8cd9b8....8b1e....8ed88ec0")&&(sOptions="1989 by RR Software, Inc.",bDetected=1),result()}meta("compiler","Ada89")

================================================
FILE: dbs_min/db/MSDOS/compiler_ApBasic.4.sg
================================================
function detect(){return MSDOS.compareEP("eb$$8cc02ea3....268b36....8cc88ed88ec08cc82e0106....2e0106....2ea1....2e8b16....33db2e")?(sVersion="1.2",sOptions="1987-89 by Comptech Software, Inc.",bDetected=1):MSDOS.compareEP("eb$$8cc02ea3....268b36....8cc88ed88ec08cc82e0106....2e0106....e8....2ea1....2e8b16....33db2e")&&(sOptions="1991 by Comptech Software, Inc.",bDetected=1),result()}meta("compiler","ApBasic")

================================================
FILE: dbs_min/db/MSDOS/compiler_BAT2EXEC.4.sg
================================================
function detect(){return MSDOS.compareEP("eb$$fcbd....8b....8b......8b......b44acd21a1....8986....8b9e....ffe3")?(sVersion="1.5",bDetected=1):MSDOS.compareEP("fcbd....8b....8b......8b......b44acd21a1....8986....8b9e....ffe3")&&(sVersion="1.2",bDetected=1),result()}meta("compiler","BAT2EXEC")

================================================
FILE: dbs_min/db/MSDOS/compiler_BSTAR_FORTH.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$8c0e....8c0e....a1....a3....e8....a3....a1....a3....e8....a3....a1....a3....e8....e8....8b0e....e3..1e8e06....a1")&&(sVersion="0.0",bDetected=1),result()}meta("compiler","BSTAR_FORTH(16)")

================================================
FILE: dbs_min/db/MSDOS/compiler_BatLite.4.sg
================================================
function detect(){return MSDOS.compareEP("eb$$e8....bb....8bf3031e....891e....81fb....73..bb....8bfb891e....031e....81c3....8be3b1..d3eb43")&&(sOptions="1991-95 by Pieter A. Hintjens (COM2EXE converted)",bDetected=1),result()}meta("compiler","BatLite")

================================================
FILE: dbs_min/db/MSDOS/compiler_BetterBASIC.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$fa2ec706........2e8c1e....b8....05....b1..d3e805....bb....83c3..d3eb8cc98ed1bc....2ec706........03c88ed903cb8ec1")&&(sOptions="1984-86 by Summit Software Technology Inc.",bDetected=1),result()}meta("compiler","BetterBASIC")

================================================
FILE: dbs_min/db/MSDOS/compiler_CII-C.4.sg
================================================
function detect(){return(MSDOS.compareEP("eb$$dbe3fcb8....8ed88c06....26a1....3b06....76..2b06....8cdf81c7....3bf873..8bc7be....3bf0")||MSDOS.compareEP("dbe3fcb8....8ed88c06....26a1....3b06....76..2b06....be....3bf073..2bc63b06....72..3b06")||MSDOS.compareEP("eb$$dbe3fcb8....8ed88c06....26a1....3b06....76..2b06....be....3bf073..2bc63b06....72..3b06")||MSDOS.compareEP("eb$$dbe3fcb8....8ed88c06....9c58a9....75..26a1....3b06....76..2b06....8cdf81c7....3bf8"))&&(bDetected=1),sLang="C",result()}meta("compiler","CII-C")

================================================
FILE: dbs_min/db/MSDOS/compiler_Easy!-C.4.sg
================================================
function detect(){return MSDOS.compareEP("9c55568ccd83c5..8db6....56be....56cb")&&(sOptions="1993 by Flight Technologys",bDetected=1),sLang="C",result()}meta("compiler","Easy!-C")

================================================
FILE: dbs_min/db/MSDOS/compiler_GRASP.4.sg
================================================
function detect(){return MSDOS.compareEP("8cd88ec0b8....8ed88c06....8c16....8926....26a1....3b06....77..e9....2b06....8cdf81c7....3bf873..8bc7")?(sVersion="4.00e - 5.0",sOptions="1993 by John Bridges",bDetected=1):MSDOS.compareEP("8cd88ec0b8....8ed88c06....26a1....3b06....77..e9....2b06....8cdf81c7....3bf873..8bc7")&&(sVersion="4.0b",sOptions="1991 by John Bridges",bDetected=1),result()}meta("compiler","GRASP Interpreter")

================================================
FILE: dbs_min/db/MSDOS/compiler_MegaBasic.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$1eff36....ff36....8cc88ed88ec02e8f06....2e8f06....2e8f06....2e8c0e....b430cd213c..ba....73..e8....2eff36....33c050cb")&&(sVersion="4.00",sOptions="1991-94 by Kristofer Sweger",bDetected=1),sLang="Basic",result()}meta("compiler","MegaBasic")

================================================
FILE: dbs_min/db/MSDOS/compiler_MegaBasic1.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$b9....33f633ff1607fcf3a5368c1e....a1....161fa3....e8....bc....b430cd21a2....0ac074..86e0")?(sVersion="5.40",sOptions="1985-87 by Christopher Cochran",bDetected=1):MSDOS.compareEP("e8$$$$b8....cd21360806....84c074..8bf886e08bd0d40a86c4360906....86c48ac48ae6d50a")?(sVersion="5.812",sOptions="1994 by Christopher Cochran",bDetected=1):MSDOS.compareEP("e8$$$$b430cd21360806....0ac074..86e08bd0d40a86c4360906....86c48ac48ae6d50a")?(sVersion="5.73",sOptions="1992 by Christopher Cochran",bDetected=1):(MSDOS.compareEP("e9$$$$b9....33f633ff1607fcf3a5368c1e....161fe8....bc....b430cd21a2....0ac074..86e0")||MSDOS.compareEP("e9$$$$b9....33f633ff1607fcf3a5268c1e....161fe8....bc....0e1fba....b8....cd21ba....b8"))&&(sOptions="1985 by Christopher Cochran",bDetected=1),sLang="Basic",result()}meta("compiler","MegaBasic")

================================================
FILE: dbs_min/db/MSDOS/compiler_PCC.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$368c1e....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....368b1e....36031e....83c3..3be375..8be0368926....b430cd213c..72..36c606......c606")?(sVersion="1.2",sOptions="by Mark DeSmet (C Ware Corporation)",bDetected=1):MSDOS.compareEP("e9$$$$368c1e....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....368b1e....36031e....83c3..3be375..8be0368926....b430cd213c..72..36c606......36a2....c606")?(sVersion="3.X",sOptions="1984-86 by Mark DeSmet (C Ware Corporation)",bDetected=1):MSDOS.compareEP("e9$$$$368c1e....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....8be0c606......c606......b9....be....468a84....3c..74..3c..75..b8....50")?(sVersion="2.X",sOptions="1984-86 by Mark DeSmet (C Ware Corporation)",bDetected=1):MSDOS.compareEP("e9$$$$368c1e....a1....36a3....a1....8cd32bc377..e9....483d....72..b8....b1..d3e03bc473..e9....368b1e....36031e....83c3..3be375..8be0368926")&&(sVersion="3.1",sOptions="1984-86 by Mark DeSmet (C Ware Corporation)",bDetected=1),sLang="C",result()}meta("compiler","PCC (DeSmet C)")

================================================
FILE: dbs_min/db/MSDOS/compiler_Power_C.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....05....b1..d3e88cca03c28b0e....8cdb8ed8891e....890e....8ec0ba....1e8cc88ed8b8....cd21588ed8bf....33c0")&&(sVersion="2.0.X",sOptions="1989-91 by Mix Software",bDetected=1),sLang="C",result()}meta("compiler","Power C")

================================================
FILE: dbs_min/db/MSDOS/compiler_SP-FORTH.4.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed88bec81c5....c746......e8$$$$8b46..25....0d....cd218b46..83ed..8946..c3")&&(sVersion="2.5.13",bDetected=1),MSDOS.compareEP("b8....8ed88bec81c5....c746......e8$$$$e8$$$$8bc583ed..8946..c3")&&(sVersion="2.5.X",sOptions="1994",bDetected=1),result()}meta("compiler","SP-FORTH")

================================================
FILE: dbs_min/db/MSDOS/compiler_Symantec_BASIC.4.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$1e060e1f9a........8c06....33c08ec026a1....a3....26a1....a3....ba....b0..9a........fa26c706........268c0e....fb071fc3")&&(sVersion="1.1a",sOptions="1993",bDetected=1),sLang="Basic",result()}meta("compiler","Symantec BASIC")

================================================
FILE: dbs_min/db/MSDOS/compiler_Topspeed_C.4.sg
================================================
function detect(){return(MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....ba....8eda890e....8936....a3....58")||MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....c706........58"))&&(sVersion="2.0",sOptions="1989 by JPI",bDetected=1),sLang="C",result()}meta("compiler","Topspeed C")

================================================
FILE: dbs_min/db/MSDOS/compiler_Turbo_Basic.4.sg
================================================
function detect(){return(MSDOS.compareEP("2E8C......2EC706........E8....E8")||MSDOS.compareEP("faba....8ec28ed2bc....fb8bfc32edbe....8a0e....8bc12bf94f81e7....268c1e....8be78ec2fcf3a48eda8bf7bb....9150"))&&(sVersion="1.0",sOptions="1987",bDetected=1),result()}meta("compiler","Turbo Basic")

================================================
FILE: dbs_min/db/MSDOS/compiler_Turbo_Prolog.4.sg
================================================
function detect(){return MSDOS.compareEP("fab8....8ed8b8....a3....8ed0bc....fb8c06....268e06....8c06....b8....a3....9a")&&(sVersion="2.0",sOptions="1986-88",bDetected=1),sLang="Prolog",result()}meta("compiler","Turbo Prolog")

================================================
FILE: dbs_min/db/MSDOS/compiler_WATCOM.4.sg
================================================
function detect(){var e,c
return MSDOS.compareEP("E9....'WATCOM C'")||MSDOS.isSignaturePresent(0,Math.min(2048,MSDOS.getSize()),"'WATCOM C'")?bDetected=1:MSDOS.isLE()?(c=MSDOS.getNEOffset(),e=MSDOS.readDword(c+128),c=MSDOS.readDword(c+28),MSDOS.compare("EB..'WATCOM C'",e+c)&&(bDetected=1)):MSDOS.compareEP("e9$$$$fbb9....8ec126bb....83c3..80e3..26891e....268c1e....01e383c3..80e3..8ed189dc26891e....89dad1ea")?(sName="Open Watcom C/C++16",sVersion="2002 by Sybase, Inc.",bDetected=1):MSDOS.compareEP("e9$$$$fbb9....8ec1bb....83c3..80e3..26891e....268c1e")?(sName="Open Watcom C/C++16",sVersion="1988-2002 by Sybase, Inc.",bDetected=1):MSDOS.compareEP("8cd8bb....8edb8b1e....0bdb74..8cd18bd4fa8ed3bc....fb50535152a3....e8....5a595b580bdb74..fa8ed18be2fb")?(sName+="/C++",sVersion="1990 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....fa8cc88ed0bc....fb2ec706........b8....cd213c..72..2e830e......e8....8bd8")?(sName+="/C++",sVersion="1991 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea1....2e0306....fa8ed0bc....fbb8....b1..d3e874..33c054593bcc75..9cb9")?(sVersion="1992 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8d06....a3....8d06....a3....8d06....a3....8cd88d1e....8ed08be3bb....26891e")?(sName+=" 386",sVersion="1990 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....fa8cc88ed0bc....fbe8....8bd8e8....2ea2....fa")?(sVersion="1990 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("faba....8eda8916....8c06....8c0e....b8....a3....b8....a3....8ed28be0fb0633c9518becbe....268b04a3....8ec28e1e")?(sVersion="1988 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....2e8c1e....fa8cc88ed0bc....fbe8....8bd8fa2e8e16")?(sVersion="1992 by WATCOM Systems Inc.",bDetected=1):MSDOS.compareEP("EB....00'*** NULL assignment detected'00'")&&(sName="Open Watcom C/C++16",sVersion="2.0",bDetected=1),sLang=-1!==sName.indexOf("C++")?"C":"C++",result()}meta("compiler","WATCOM C")

================================================
FILE: dbs_min/db/MSDOS/compiler_WPFORTH.4.sg
================================================
function detect(){return MSDOS.compareEP("bd....bc....b8....0e5b81c3....8ed3ffe0")&&(sVersion="1.0",sOptions="1993 by Albert Chan",bDetected=1),result()}meta("compiler","WPFORTH")

================================================
FILE: dbs_min/db/MSDOS/compiler_djgpp.4.sg
================================================
function detect(){return MSDOS.compare("'go32stub'",512)?(sVersion="2",bDetected=1):MSDOS.isSignaturePresent(0,Math.min(8192,MSDOS.getSize()),"'StubInfoMagic!!'")&&(sVersion="1",bDetected=1),result()}meta("compiler","djgpp")

================================================
FILE: dbs_min/db/MSDOS/compiler_muLISP-87.4.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$eb$$8cc88ed88ed0bc....a3....b8....cd21891e....8c06....a0....5084c075..b8....8ec026803e......75..26c416....8cc1")?(sName+="-87",sOptions="1983-1989 by Soft Warehouse, Inc.",bDetected=1):MSDOS.compareEP("e9$$$$eb$$8cc88ed88ed0bc....a3....b8....cd21891e....8c06....b8....cd21891e....8c06....ba....b8....cd21a0....5084c0")&&(sName+="-90",sOptions="1983-1990 by Soft Warehouse, Inc.",bDetected=1),sLang="LISP",result()}meta("compiler","muLISP")

================================================
FILE: dbs_min/db/MSDOS/converter_EXE2COM.1.sg
================================================
function detect(){return MSDOS.compareEP("b3..b9....33d2be....8bfeac32c3aa494332e403d0e3..eb")?(sVersion="9.50a",bDetected=1):MSDOS.compareEP("e9$$$$92be....bf....fca5a48ccb83c3..b9....ad97011de2")?(sOptions="1996 by EM-Phaser",bDetected=1):MSDOS.compareEP("e9$$$$e9$$$$8cca81c2....3b16....76..ba....b409cd21cd20")?(sOptions="generic, type 2",bDetected=1):MSDOS.compareEP("e9$$$$bf....be....a5a48cda83c2..50b4..bb....cd21580116....81c2....8ed2")&&(sOptions="0-Relocs by dR.No //ViP",bDetected=1),result()}meta("converter","EXE2COM")

================================================
FILE: dbs_min/db/MSDOS/converter_FromBAT.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$be....bf....bb....c604..b9....fe04803c..77..c644....b80629cd21be....3c..74..8a04880743e2")&&(sOptions="1991 by Clockwork Software",bDetected=1),result()}meta("converter","FromBAT")

================================================
FILE: dbs_min/db/MSDOS/converter_GRABBER.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$fc8cdb8cc88ed8a3....8ec3891e....8b1e....b1..d3e383c3..b44acd2173..eb")?(sVersion="6.30-6.31",sOptions="1991 by G. A. Monroe",bDetected=1):MSDOS.compareEP("eb$$fc8cdbb8....8ed8a3....8ec3891e....8b1e....b1..d3e383c3..b44acd2172..b8")?(sVersion="6.32",sOptions="1991 by G. A. Monroe",bDetected=1):MSDOS.compareEP("e9$$$$fc8cdb8cc88ed88ec0891e....e8")?(sVersion="3.70-3.87",sOptions="1991 by G. A. Monroe",bDetected=1):MSDOS.compareEP("eb$$fc8cdbb8....8ed88ec3891e....a3....8b1e....b1..d3e383c3..b44acd2173..b4")&&(sVersion="3.91-3.94",sOptions="1991-92 by G. A. Monroe",bDetected=1),result()}meta("converter","GRABBER")

================================================
FILE: dbs_min/db/MSDOS/converter_com2exe.2.sg
================================================
function detect(){return MSDOS.compareEP("b8....50c3")?(sVersion="9.50",bDetected=1):MSDOS.compareEP("16179c58f6c4..74..faeb")?(sName="COM -> EXE",sOptions="1993 by R.Roth",bDetected=1):MSDOS.compareEP("fcbe....bf....b9....f3a568....c3")?(sVersion="2.1",sOptions="1997 by X-HACKS Group",bDetected=1):MSDOS.compare("02000000fffff0fffeff....0001f0ff1c00000000000000",8)?(sOptions="by Stefan Esser",bDetected=1):MSDOS.compare("040000100010f0fffeff00000001f0ff..000000",8)?(sOptions="by MasterBall Systems",bDetected=1):MSDOS.compare("02000000fffff0fffeff00000001f0ff1c0000000000924b",8)?(sOptions="by Tnarchistic KA0T",bDetected=1):MSDOS.compare("0200....fffff0fffeff00000001f0ff1c00000000000000",8)?(sOptions="by Fabrice Bellard",bDetected=1):MSDOS.compare("02000000fffff0fffeff00000001f0ff1c00000020202020",8)?(sOptions="by cINOgEN",bDetected=1):MSDOS.compare("0500aaaafffff0fffeff00000001f0ff1c00000000000000",8)?(sOptions="by COMSEC",bDetected=1):MSDOS.compare("0400aaaaffff0000feff00000001f0ff4000000053545542",8)?(sOptions="by DblStar Software",bDetected=1):MSDOS.compare("0200aaaafffff0fffeff00000001f0ff0000454c49544500",8)?(sOptions="by Elite x",bDetected=1):MSDOS.compare("02000010fffff0fffeff00000001f0ff1c00000000000000",8)?(sOptions="by HENDRX",bDetected=1):MSDOS.compare("02000000fffff0fffeff00000001f0ff1c0000004d455353",8)?(sOptions="MESS /E",bDetected=1):MSDOS.compare("0200aaaafffff0ff000000000001f0ff1c00000050484158",8)?(sOptions="by PHaX",bDetected=1):MSDOS.compare("2000aa00ffffaaaa00aa00000001f0ff0000000000000000",8)?(sOptions="SCRb2e",bDetected=1):MSDOS.compare("02008f0daaaaf0fffeff00000001f0ff1c0000000000524f",8)?(sOptions="by Rose",bDetected=1):MSDOS.compare("0200d70dfffff0fffeff00000001f0ff1c00005472696c6c",8)?(sOptions="by Trills nT",bDetected=1):MSDOS.compare("02000000fffff0ff000000000001f0ff1c00000000000000",8)?(sOptions="UNP x",bDetected=1):MSDOS.compare("04000100fffff0fffeffaaaaaa0200001c000000aa020000",8)?(sVersion="1.0",sOptions="Comvert",bDetected=1):MSDOS.compare("18000000fffff0fffeff00000001f0ff1c00000020202020",8)?(sOptions="WWPACK",bDetected=1):MSDOS.compare("0200....fffff0ff648400000001f0ff1c00000000000000",8)&&(sOptions="by unknown",bDetected=1),result()}meta("converter","com2exe")

================================================
FILE: dbs_min/db/MSDOS/cryptor_EXE-Cryptor.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1fe8$$$$8cc9bb....83c5..5e2ead1e2e81")?(sOptions="1993-1995 by Rolle&Schild",bDetected=1):MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1ffa8bec8c4e..c746......fe0e")?(sOptions="1993 by Rolle&Schild",bDetected=1):MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1ffa8bec8c4e..c746......fe0e....f972..ba....0e1fbb....8b0e")?(sOptions="1992 by RKT-LANDMARK",bDetected=1):MSDOS.compareEP("e9$$$$1e062e8c06....fc0e1f8926....8306......fa8c0e....fe0e....f972..ba....0e1fbb")&&(sOptions="by RKT-LANDMARK",bDetected=1),result()}meta("cryptor","EXE-Cryptor")

================================================
FILE: dbs_min/db/MSDOS/cryptor_TUCCRYP.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$2e8c06....8cca8ec28edab4..ba....cd218cda2ea1....2bd08edabb....2e8b0e....b2..51b9....8a0732c28807fec280")?(sVersion="2+",sOptions="George Stark",bDetected=1):MSDOS.compareEP("eb$$2e8c06....8cca8ec28edab4..ba....cd218cda2ea1....2bd08edabb....2ea1....ba....f7e28bc8")&&(sName="TUC cryPack",sVersion="1.0",sOptions="George Stark",bDetected=1),result()}meta("cryptor","TUCCRYP")

================================================
FILE: dbs_min/db/MSDOS/cryptor_deep-CRyPTer.2.sg
================================================
function detect(){return MSDOS.compareEP("..E9....E8....598BE981......81......BE....8D......66....66....8D......8BD78BDF")&&(sVersion="0.1c",bDetected=1),result()}meta("cryptor","deep-CRyPTer")

================================================
FILE: dbs_min/db/MSDOS/dos_extender.0a.sg
================================================
function detect(){return MSDOS.compareEP("0e1f8cc6b4..50bb....cd2173..58cd2172..03de8bebb8....cd21065356b8....cd2f0bc075")?(sVersion="1991",bDetected=1):MSDOS.compareEP("0e1f06b4..50bb....cd2173..58cd2172..8cc003d88bebb8....cd210653b8....cd2f0bc075")&&(sVersion="1992",bDetected=1),result()}meta("extender","dos extender by Doug Huffman")

================================================
FILE: dbs_min/db/MSDOS/dos_extender1.0a.sg
================================================
function detect(){return MSDOS.compareEP("fafc0e1fe8....8cc0660fb7c066c1e0..6667a3........66b8........66c1e0..6667a3........66670905........66670905")&&(sVersion="1994 by TRAN (Thomas Pytel)",bDetected=1),result()}meta("extender","DOS protected mode extender")

================================================
FILE: dbs_min/db/MSDOS/dos_extender2.0a.sg
================================================
function detect(){return MSDOS.compareEP("bc....bb....438cc02bd8b4..cd2173..9a........0e1feb")?(sVersion="1986-90 by Ergo Computing, Inc.",bDetected=1):MSDOS.compareEP("b8....8ed0bc....bb....8cc02bd843b4..cd21b8....8ed8c606......b8....8ed88cc0a3")&&(sVersion="1986-91 by Ergo Computing, Inc.",bDetected=1),result()}meta("extender","DOS extender")

================================================
FILE: dbs_min/db/MSDOS/extender_Blinker.0a.sg
================================================
function detect(){return MSDOS.isNE()?MSDOS.compare("'BLINKER'",MSDOS.getBaseOffset(24))&&(bDetected=1,0<(nOffset=MSDOS.getNEOffset(-4608)))&&-1!=(nOffset=MSDOS.findString(nOffset,4608,"Blinker "))&&(sVersion=MSDOS.getString(nOffset+8,4)):(MSDOS.compareEP("e8$$$$558bec5053515256571e06fc8cc88ed8e8....bf....8845..8c")||MSDOS.compareEP("e8$$$$1e06fc8cc88ed8e8....bf....8845..8c1e....c41e....891d"))&&(bDetected=1),result()}meta("extender","Blinker")

================================================
FILE: dbs_min/db/MSDOS/extender_CWSDPMI.0a.sg
================================================
function detect(){return MSDOS.compareEP("8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7")?(sVersion="0.90+ (r4)",sOptions="1997 by Charles W. Sandmann",bDetected=1):MSDOS.compareEP("e8$$$$8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7")?(sVersion="0.90+ (6b)",sOptions="2001 by Charles W. Sandmann",bDetected=1):MSDOS.compareEP("ba....8eda8cd32bdac1e3..8ed203e38c06....fcb430cd213c0373..b0..ba....e9")&&(sName+=" (ELFstub)",sVersion="1.00",bDetected=1),result()}meta("extender","CWSDPMI")

================================================
FILE: dbs_min/db/MSDOS/extender_CauseWay_DOS_Extender.6.sg
================================================
function detect(){return MSDOS.compareEP("fa161f26a1....83e8..8ed0fb061607be....8bfeb9....f3a407368c......8bd88cca3603......368b......fd8bc53d....76")?(sVersion="3.1X-3.4X",bDetected=1):MSDOS.compareEP("eb$$8be88cc60e1f8cc005....0106....b8....cd213c..73..b8....cd21803e......74..8cc005....0306....268b16....3bc273..8ec0a1....33ff")&&(sVersion="2.64, 3.25",bDetected=1),result()}meta("extender","CauseWay DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_DOS32.0a.sg
================================================
function detect(){return MSDOS.compareEP("0e1ffc9c5b8bc380f4..509d9c583ae775..ba....b409cd21b44ccd218c06....26a1....a3")?(sVersion="3.3",sOptions="1995 by Adam Seychell",bDetected=1):MSDOS.compareEP("0e1f068c06....26a1....a3....8ec06633ff6633c96649fc32c0f2ae26380575..83c7")?(sVersion="3.0",sOptions="by Adam Seychell",bDetected=1):MSDOS.compareEP("0e1ffc9c5b8bc380f4..509d9c5838fc75..ba....b409cd21b44ccd21")&&(sVersion="3.5c rev6",sOptions="1995 by Adam Seychell",bDetected=1),result()}meta("extender","DOS32")

================================================
FILE: dbs_min/db/MSDOS/extender_DOS4G.0a.sg
================================================
function detect(){return MSDOS.isSignaturePresent(0,Math.min(1024,MSDOS.getSize()),"'DOS/4G'")?bDetected=1:(MSDOS.isSignaturePresent(0,Math.min(1024,MSDOS.getSize()),"'DOS4GW'")||MSDOS.isSignaturePresent(MSDOS.getNEOffset()-1024,1024,"'dos4gw'"))&&(sName+="W",bDetected=1),result()}meta("extender","DOS/4G")

================================================
FILE: dbs_min/db/MSDOS/extender_DOSX16.0a.sg
================================================
function detect(){return MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6")?bDetected=1:MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....81eb....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6")?(sVersion="type 1",sOptions="CodeView",bDetected=1):MSDOS.compareEP("eb$$b430cd213c0372..e8$$$$56571e060e1fb8....cd213c0372..77..80fc..72..b452cd2126a1....3d")?(sVersion="type 2",sOptions="CodeView",bDetected=1):MSDOS.compareEP("eb$$8cc8fa8ed0bc....fb0e1f8c06....c406....a3....8c06....e8....b8....b1..d3e805....a3....e8")?(sVersion="type 3",sOptions="CodeView",bDetected=1):MSDOS.compareEP("eb$$b8....8ed88c06....8ed0bc....50bb....b44acd21588ec0")&&(sVersion="type 4",bDetected=1),result()}meta("extender","DOSX16")

================================================
FILE: dbs_min/db/MSDOS/extender_EMX.0a.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed88c06....e8....e8....e8....e8")?(sVersion="0.8f-0.9d",bDetected=1):MSDOS.compareEP("b8....8ed88cd88ed0bc....e8....3c..72..26a1")&&(sVersion="0.8f",bDetected=1),result()}meta("extender","EMX DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_Go32Stub.0a.sg
================================================
function detect(){return MSDOS.compareEP("0e1f8c1e....8c06....fcb430cd21")?(sVersion="2.0",bDetected=1):(MSDOS.compareEP("68....1fbd....9081ed....8c06....fcb430cd21")||MSDOS.compareEP("ba....8eda8cd32bdac1e3..8ed203e3bd....81ed....8c06....fcb430cd21")||MSDOS.compareEP("fc0e1fb4..bb....b9....ba....cd21061e07bf....b9....30c0f3aa07e9"))&&(sVersion="2.02T",bDetected=1),result()}meta("extender","Go32Stub DOS-Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_PMODE.0a.sg
================================================
function detect(){return MSDOS.compare("'PMODE/W v'",85)?(sVersion=MSDOS.getString(94,4),bDetected=1):MSDOS.compareEP("fc1607bf....8bf757b9....f3a5061e071f5fbe....060ea4ad8be8b2..1eb8....50cb")&&(sVersion="1.12-1.33",sOptions="1994-1997 by Daredevil and Tran.",bDetected=1),result()}meta("extender","PMODE/W")

================================================
FILE: dbs_min/db/MSDOS/extender_PRO32.0a.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$8cc82ea3....fa6633f68eeeb8....8ed8b9....66658b0466890483c6..e2..6633c0bb")&&(sVersion="1.7",sOptions="1996-99 by Dieter Pawelczak",bDetected=1),result()}meta("extender","PRO32 Protected Mode DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_RSX.0a.sg
================================================
function detect(){return MSDOS.compareEP("8cc2b8....8ed88ec08ed0bc....8916....e8....b44ccd21")&&(bDetected=1),result()}meta("extender","RSX DPMI DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_Stub-386.0a.sg
================================================
function detect(){return MSDOS.compareEP("0e1f8c06....b430cd213c..73..b8....eb..c606......c606......c606......c606......9a")&&(sOptions="1997 by LADsoft",bDetected=1),result()}meta("extender","Stub-386 DPMI DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_TMTSTUB.0a.sg
================================================
function detect(){return MSDOS.compareEP("b462cd218bc38ccb538edb8c0e....8c0e....8c0e....2bd8bd....03ddc1e5..b44acd2173..ba....e9")&&(sVersion="0.31",sOptions="32bit WDOSX-based DOS-extender and loader by Rustam Gadeyev",bDetected=1),result()}meta("extender","TMTSTUB DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_WDOSX.0a.sg
================================================
function detect(){return MSDOS.compare("'WDOSX'",52)&&(sVersion=MSDOS.getString(58,4),sOptions="1996-1999 by Michael Tippach",bDetected=1),result()}meta("extender","WDos/X")

================================================
FILE: dbs_min/db/MSDOS/extender_WDOSX32.0a.sg
================================================
function detect(){return MSDOS.compareEP("bc....fcbf....ba....e8....b8....abe8....ba....e8....b0..aabe....bf....89faac3c..75..e8....57444f53584c45")&&(bDetected=1),result()}meta("extender","WDOSX32")

================================================
FILE: dbs_min/db/MSDOS/extender_XMLOD.0a.sg
================================================
function detect(){return MSDOS.compareEP("8cd805....8ed88ed0bc....90908d06....ffd0")?(sOptions="1991 by IGC, Inc.",bDetected=1):MSDOS.compareEP("fa8cd805....8ed88ed0bc....90908d1e....c1eb..03c333f6268b5c")&&(sVersion="1992",bDetected=1),result()}meta("extender","XMLOD DOS-Extender")

================================================
FILE: dbs_min/db/MSDOS/extender_Xtender.0a.sg
================================================
function detect(){return MSDOS.compareEP("0e1fe8$$$$e8$$$$b8....9c5b80e7..539d9c5980e5..80fd..74..4080cf..539d9c5980e5..74..40668bdc66")&&(sVersion="1.04.36037",sOptions="by vyc/sophtXS",bDetected=1),result()}meta("extender","Xtender DOS Extender")

================================================
FILE: dbs_min/db/MSDOS/immunizer_CPAV.1.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$5b81eb....50515256578beb1e2ec6........268e......061fb9....bf....8bc7eb")&&(sVersion="1992-1993",bDetected=1),result()}meta("immunizer","Central Point Anti-Virus")

================================================
FILE: dbs_min/db/MSDOS/immunizer_F-XLOCK.1.sg
================================================
function detect(){return MSDOS.compareEP("505050535152561e8bdc8cd805....368947..36c747......8e1e....33db8b07433d....74..75..43833f..75..4343")&&(sVersion="1.16",bDetected=1),result()}meta("immunizer","F-XLOCK")

================================================
FILE: dbs_min/db/MSDOS/immunizer_Oyster.1.sg
================================================
function detect(){return MSDOS.compareEP("061e55565752515350e8$$$$508cc805....8ed858c3")&&(sVersion="3.01 1991-95 by BEST",bDetected=1),result()}meta("immunizer","Oyster")

================================================
FILE: dbs_min/db/MSDOS/immunizer_PGPROT.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$2ea3....2e8c1e....2e8c06....0e1f8cc00106....0106....26ff36....0732c033ffb9....f2ae26803d..75..47")&&(bDetected=1),result()}meta("immunizer","PGPROT Antivirus Vaccine")

================================================
FILE: dbs_min/db/MSDOS/immunizer_Palladix.1.sg
================================================
function detect(){return MSDOS.compareEP("2e8c1e....b8....cd2172..3c..72..b8....cd218cc08ed88bd3b8....cd218cc88ed8b8....ba....cc8cc88ed88ec0be....8bfe")&&(bDetected=1),result()}meta("immunizer","Palladix Virus Protector")

================================================
FILE: dbs_min/db/MSDOS/immunizer_TTW.1.sg
================================================
function detect(){return MSDOS.compareEP("ab33c08bd88bc889c28bf889c6db52..e9")&&(sOptions="1994-95 by TTW Inc.",bDetected=1),MSDOS.compareEP("d88b....c2....89c6071fcb")&&(sOptions="1994-95 by TTW Inc.",bDetected=1),result()}meta("immunizer","TTW")

================================================
FILE: dbs_min/db/MSDOS/joiner_TurboChainer.1.sg
================================================
function detect(){return MSDOS.compareEP("ba....8eda8cd32bdad1e3d1e3d1e3d1e3fa8ed203e3fbb8....8ed81efc8d06....83c0..501ebe....8cc08ed8075f8b0c32ed5146f3a4591f")&&(sVersion="1.03",bDetected=1),result()}meta("joiner","TurboChainer")

================================================
FILE: dbs_min/db/MSDOS/joiner_V-Load.1.sg
================================================
function detect(){return MSDOS.compareEP("33f62ef606......74..0e588bd881e3....75..b1..d3e02bf0d3ee065b0e582bc3b1..bb....8bd3d3eb81e2")&&(sVersion="0.9c1",bDetected=1),result()}meta("joiner","V-Load")

================================================
FILE: dbs_min/db/MSDOS/library_ParsecCollection.1.sg
================================================
function detect(){return MSDOS.compareOverlay("0D0A41205041525345432050726F64756374696F6E")&&(sOptions="EOF",bDetected=1),result()}meta("library","Parsec Collection")

================================================
FILE: dbs_min/db/MSDOS/loader_32stub.0a.sg
================================================
function detect(){return MSDOS.compareEP("8cc88ed88c1e....8c06....8c06....8c06....8bdc83c3..d1ebd1ebd1ebd1eb8cd003d82b1e....b8....cd21")&&(sOptions="by Borland",bDetected=1),result()}meta("loader","32stub for PE files")

================================================
FILE: dbs_min/db/MSDOS/mbp_SHRINK.2.sg
================================================
function detect(){return MSDOS.compareEP("061e508cc005....2e0106....2e0106....8bd02e0306....2ea3....2e8b3e....8ed80355..8955..8b3d0bff74")&&(sOptions="by mbp Software & Systems",bDetected=1),result()}meta("packer","mbp SHRINK")

================================================
FILE: dbs_min/db/MSDOS/other_AutoHack.1.sg
================================================
function detect(){return MSDOS.compareEP("0e1fb409ba....cd21fa8e06....be....8b0e....83f9..74..fdd1e1")&&(bDetected=1),result()}meta("other","AutoHack addition")

================================================
FILE: dbs_min/db/MSDOS/other_Coderunner.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$e8$$$$fc5e8cdaa1....bd....8edd8ec5a3....b9....bf....2bcf33c02ea3....41d1e9f3ab8916")||MSDOS.compareEP("e9$$$$e8$$$$fc5e8cda8b1e....bd....8edd8ec5b9....bf....2bcf33c02ea3....41d1e9f3ab891e")?(sOptions="1989 by Micro Systems Software, Inc.",bDetected=1):MSDOS.compareEP("e9$$$$e8$$$$fc5e8cdaa1....bd....8edd8ec5a3....b9....bf....2bcf33c02ea3....d1e9f3ab8916")&&(sOptions="1992 by OP",bDetected=1),result()}meta("other","CodeRunneR")

================================================
FILE: dbs_min/db/MSDOS/other_DemoMaker.2.sg
================================================
function detect(){return MSDOS.compareEP("be....ad8ed833f6b8....8ec0bf....b9....ac3c..75..3a0474..e2..b8....8ed8b409ba....cd21b8....cd21")&&(sVersion="1.55",sOptions="1993-94 by R.Janorkar",bDetected=1),result()}meta("other","DemoMaker")

================================================
FILE: dbs_min/db/MSDOS/overlay_overlays.6.sg
================================================
function detect(){if(MSDOS.compareOverlay("....'-lh'..2d")||MSDOS.compareOverlay("....'-lz'..2d"))switch(sName="LHA archive",MSDOS.readByte(MSDOS.getOverlayOffset()+5)){case 48:case 49:case 50:case 51:case 52:case 53:case 54:case 100:case 115:bDetected=1}else MSDOS.compareOverlay("60ea")?(sName="ARJ archive",bDetected=1):MSDOS.compareOverlay("'ZOO'............'Archive'")?(bDetected=1,sName="ZOO archive"):MSDOS.compareOverlay("4c0103")?(bDetected=1,sName="COFF executable"):MSDOS.compareOverlay("0101'Aladdin'")?(sName="Self UnStuffit data",sVersion="1.1",sOptions="by Aladdin Systems, Inc.",bDetected=1):MSDOS.compareOverlay("7f'ELF'010101")?(sName="ELF executable",bDetected=1):MSDOS.compareOverlay("................'BSA'")?(sName="BSN archive",bDetected=1):MSDOS.compareOverlay("'W4'")?(sName="W4 executable",bDetected=1):MSDOS.compareOverlay("fef2fc")?(sName="FOXPRO archive",bDetected=1):MSDOS.compareOverlay("'SXD'00")?(sName="Sydex archive",bDetected=1):MSDOS.compareOverlay("'RS'000102")?(sName="GamBit Pro Library archive",bDetected=1):MSDOS.compareOverlay("'PK'0304")&&(sName="ZIP archive",bDetected=1)
return result()}meta("overlay","")

================================================
FILE: dbs_min/db/MSDOS/packer_32LiTe.2.sg
================================================
function detect(){return MSDOS.compareEP("1E060E1F0E07BE....BF....8BCFFC57F3A48CC80106....C333FF")&&(bDetected=1),result()}meta("packer","32LiTe")

================================================
FILE: dbs_min/db/MSDOS/packer_AINEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("a1....2d....8ed0bc....8cd836a3....05....36a3....2ea1....8ad4b1..d2eafec9d3e08cd336")?(sVersion="2.1",bDetected=1):MSDOS.compareEP("0e07b9....be....33fffcf3a4a1....2d....8ed0bc....8cd836......05....36......2e")?(sVersion="2.3",bDetected=1):MSDOS.compareEP("a1....2d....8ed0bc....8cd836a3....05....36a3....2ea1....8ad4b1..d2ead3e08cd3368b2e....2e032e....fdfeca")&&(sVersion="2.22",bDetected=1),result()}meta("packer","AINEXE")

================================================
FILE: dbs_min/db/MSDOS/packer_AVPACK.2.sg
================================================
function detect(){return MSDOS.compareEP("501E0E1F160733F68BFEB9....FCF3A506BB....53CB")?(sVersion="1.20",bDetected=1):(MSDOS.compareEP("EB$$501E0E1F160733F68BFEB9....FCF3A506BB....53CB")||MSDOS.compareEP("e9$$$$8cda0316....8bda0316....3b16....76..ba....b409cd21cd208cd28bccfa8ed3bc....fb5251501e53b8"))&&(bDetected=1),result()}meta("packer","AVPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_Amisetup.1.sg
================================================
function detect(){return MSDOS.compareEP("b8....50b8....501e8cc88ed8e8$$$$9c5b81e3....539d9c5b81e3....81fb....74..c3")&&(sOptions="by Robert Muchsel",bDetected=1),result()}meta("packer","Amisetup loader")

================================================
FILE: dbs_min/db/MSDOS/packer_COMPACK.2.sg
================================================
function detect(){return MSDOS.compareEP("BE....E8....5D83....55505351520E070E1F8BCE")?(sVersion="4.5",bDetected=1):MSDOS.compareEP("BD....50068CCB03DD8CD24B8EDBBE....BF....8EC2B9....F3A54A4D75")&&(sVersion="5.1",bDetected=1),result()}meta("packer","COMPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_CRYPACK.2.sg
================================================
function detect(){return MSDOS.compareEP("EB..061E8CD805....8ED833DB0E0733FFBE....8A0726....32C48807473BFE")&&(sVersion="3.0",bDetected=1),result()}meta("packer","CRYPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_Compress-EXE.2.sg
================================================
function detect(){return MSDOS.compareEP("9c508cdb53530e1f83c3..33ff8ec38bd3015d..015d..b9....be....fc32e4ac3c..77")&&(sVersion="1.0",sOptions="1990 by W.ZhongHua",bDetected=1),result()}meta("packer","Compress-EXE")

================================================
FILE: dbs_min/db/MSDOS/packer_DIET.2.sg
================================================
function detect(){return MSDOS.compareEP("BF....3BFC72..B44CCD21BE....B9....FDF3A5FC")?(sVersion="1.00/1.00d",bDetected=1):MSDOS.compareEP("FC061E0E8CC801......BA....03............................00000000")?(sVersion="1.00d",bDetected=1):MSDOS.compareEP("fc061e0e8cc80106....ba....03c28bd805....8edb8ec033f633ffb9....f3a54b484a79..8ec38ed8be....ad8be8b2..ea")?(sVersion=MSDOS.compareEP("64",55)?"1.10a/1.20":"1.00",bDetected=1):MSDOS.compareEP("BE....BF....B9....3BFC72..B44CCD21FDF3A5FC")?(sVersion="1.02b/1.10a/1.20",bDetected=1):MSDOS.compareEP("F89C061E5756525153500EFC8CC8BA....03D052")?(sVersion="1.44/1.45f",bDetected=1):MSDOS.compareEP("F99CEB$$061e5756525153500efc8cc82e0106....ba....03c28bd805....8edb8ec033f633ff")?(sVersion="1.43/1.44",bDetected=1):MSDOS.compareEP("F99CEB$$061e5756525153500efc8cc8ba....03d052ba....52ba....03c28bd805....8edb")?(sVersion="1.45f",bDetected=1):MSDOS.compareEP("061e0efc8cc80106....ba....03c28bd805....8edb8ec033f633ffb9....f3a54b484a79")?(sVersion="1.44b",bDetected=1):MSDOS.compareEP("bd....1e068ccb03dd8cd24b8edbbe....bf....8ec2b9....f3a54a4d")&&(sVersion="1.45d",bDetected=1),result()}meta("packer","DIET")

================================================
FILE: dbs_min/db/MSDOS/packer_DSHIELD.2.sg
================================================
function detect(){return MSDOS.compareEP("06E8....5E83EE..16179C58B9....25....2E")&&(bDetected=1),result()}meta("packer","DSHIELD")

================================================
FILE: dbs_min/db/MSDOS/packer_DexEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("8b2e....2e8c0e....2e8c0e....83ed..8ed5bc....501eba....f91bea8ec58cc805....8ed80e06fc33f68bfe8adeb1..d3e2d2ebb8....74..b9....f3a5")&&(sVersion="2.1",sOptions="by Kaljevic Dejan",bDetected=1),result()}meta("packer","DexEXE")

================================================
FILE: dbs_min/db/MSDOS/packer_EXECUTRIX.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$0e1fa3....8c1e....8c1e....268b......89......8ccbb8....05....05....2bc3a3....8cd01e5b2bc3a3....b430cd21")&&(sOptions="by Knowledge Dynamics Corp",bDetected=1),result()}meta("packer","EXECUTRIX-COMPRESSOR")

================================================
FILE: dbs_min/db/MSDOS/packer_EXEPACK.2.sg
================================================
function detect(){if(MSDOS.compareEP("8cc005....0e1fa3....0306....8ec08b0e....8bf94f8bf7fdf3a4")){switch(MSDOS.readByte(18)<<8|MSDOS.readByte(20)){case 16:sVersion="3.65"
break
case 39184:sVersion="4.00"
break
case 5392:sVersion="4.03"
break
case 18:case 274:sVersion="4.06"
break
case 20:case 11536:case 31760:sVersion="4.00 - 4.06"
break
case 33808:sVersion="4.0x (possibly)"}bDetected=1}else MSDOS.compareEP("428cc005....0e1fa3....0306....8ec08b0e....8bf94f8bf7fdf3a4")||MSDOS.compareEP("..52428be88cc005....0e1fa3....0306....8ec0..0e....8bf94f8bf7fdf3a4")?(0==MSDOS.readByte(18)&&16==MSDOS.readByte(20)&&(sVersion="3.65"),bDetected=1):MSDOS.compareEP("8be88cc0......0e1fa3....0306....8ec08b0e........4f8bf7fdf3a4")?(16==MSDOS.readByte(20)?sVersion="3.69":0==MSDOS.readByte(18)&&18==MSDOS.readByte(20)&&(sVersion="5.31.009"),bDetected=1):MSDOS.compareEP("8be88cc0......0e1fa3....0306....06b8....06008b....8bf7fdf3a450b8....50cb")?(sVersion="5.31.009",bDetected=1):MSDOS.compareEP("8bc6f7d0d3e88cda2bd073..8cd82bd2d3e003f08eda8bc7")&&(sVersion="3.65",bDetected=1)
return result()}meta("packer","EXEPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_ExeLITE.2.sg
================================================
function detect(){return MSDOS.compareEP("fc8cc80106....ba....03c28bd805....8edb8ec033ff33f6b9....f3a5484b4a75..8ec38ed8be")?(sVersion="1.00",bDetected=1):MSDOS.compareEP("b8....bb....0e5a03c20e5053cb")&&(bDetected=1),result()}meta("packer","ExeLITE")

================================================
FILE: dbs_min/db/MSDOS/packer_LGLZ.2.sg
================================================
function detect(){return MSDOS.compareEP("fc1e060e8cc80106....ba....03c28bd805....8edb8ec033f633ffb9....f3a54b484a79..8ec38ed8be....ad95b2..ea")&&(sVersion="1.04",sOptions="by G.Lyapko",bDetected=1),result()}meta("packer","LGLZ")

================================================
FILE: dbs_min/db/MSDOS/packer_LZEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb")?(sVersion="0.91, 1.0",bDetected=1):MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3b4..31edfdac01c5aae2")?(sVersion="0.90",bDetected=1):MSDOS.compareEP("50060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb")||MSDOS.compareEP("50060e1f8b36....83e6..8bfe8bced1e9418cdb031e....8ec3fdf3a553b8....50cb")?(sVersion="0.91c",bDetected=1):MSDOS.compareEP("50060e1f8b0e....8bf14e8cdb89f703......8ec3fdf3a4b8....5350cb")?(sVersion="0.91",sOptions="1990",bDetected=1):MSDOS.compareEP("0e1f068b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("0e1f8b0e....89ce504e8cdb0689f7031e....fd8ec3f3a453b8....50cb")?(sVersion="?.?",bDetected=1):MSDOS.compareEP("060e1f8b0e....8bf14e8bfe8cdb031e....8ec3fdf3a453b8....50cb")||MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb031e....fd8ec3f3a453b8....50cb")?(sVersion="1.0a",bDetected=1):MSDOS.compareEP("8cd805....2e0106....2eff2e")&&(sVersion="1.00a",sOptions="suspicious, look like a trick",bDetected=1),result()}meta("packer","LZEXE")

================================================
FILE: dbs_min/db/MSDOS/packer_MSLite.1.sg
================================================
function detect(){return MSDOS.compareEP("538cd315....8beceb$$b8....ffe0")&&(sVersion="2.3",sOptions="1998 by A.Cheng //Mercury Soft",bDetected=1),result()}meta("packer","MSLite")

================================================
FILE: dbs_min/db/MSDOS/packer_Optlink.2.sg
================================================
function detect(){return MSDOS.compareEP("87c0eb$$fc8c..83c2..5216070e1f0116....0116....33f633ffb9....f3a506b8....50cb")||MSDOS.compareEP("87c006571e56525153509cfc8cc283c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")||MSDOS.compareEP("87c0eb$$8cda83c2..5216070e1f0116....0116....33f633ffb9....f3a506b8....50cb")||MSDOS.compareEP("87c0fc8cda83c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("87c0555657525153509cfc8cda83c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")?(sOptions="prepacked",sVersion="1.0",bDetected=1):MSDOS.compareEP("bf....8edffa8ed781c4....fbb430cd21a2....8826....3c..73..8d16....b409cd2133c05006cb")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("87c08cda83c2..16070e1f0116....0116....33f633ffb9....f3a506b8....50bd....cb")&&(bDetected=1),result()}meta("packer","Optlink")

================================================
FILE: dbs_min/db/MSDOS/packer_PGMPAK.2.sg
================================================
function detect(){return MSDOS.compareEP("fa1e1750b430cd213c..73..b44ccd21fcbe....bf....e8....e8....bb....ba....8ac38bf3")&&(sVersion="0.13",bDetected=1),MSDOS.compareEP("1e1750b430cd213c..73..b44ccd21fcbe....bf....e8....e8....bb....ba....8ac38bf3")&&(sVersion="0.15",bDetected=1),result()}meta("packer","PGMPAK")

================================================
FILE: dbs_min/db/MSDOS/packer_PKEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("fa50535152565755061e8cc88bd88ed80106....0106....0306....33f68ec006e8")&&(sOptions="1994 by D.Usov",bDetected=1),result()}meta("packer","PKEXE")

================================================
FILE: dbs_min/db/MSDOS/packer_PKLITE.2.sg
================================================
function detect(){var e
return MSDOS.compare("'PKLITE'",30)||MSDOS.compare("'PKlite'",30)?(e=MSDOS.readByte(29),sVersion=(7&e)+"."+("0"+MSDOS.readByte(28)).slice(-2),8&e&&(sOptions="Extra compression"),16&e&&(sOptions=sOptions.append("Multi-segment file")),bDetected=1):MSDOS.compareEP("1FB409BA....CD21B8....CD21")?(sVersion="1.50",sOptions="CRC check",bDetected=1):MSDOS.compareEP("50B8....BA....05....3B060200")?(sVersion="1.50",bDetected=1):MSDOS.compareEP("B8....BA....05....3B060200")?(sVersion="1.12-1.13",bDetected=1):MSDOS.compareEP("b8....ba....05....2d....fa8ed0fb2d....8ec050b9....33ff57be....fc565706518cc88ec0")?(sVersion="1.12",sOptions="extra compression",bDetected=1):MSDOS.compareEP("ba....b8....05....3B06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")||MSDOS.compareEP("b8....05....3B06....72..cd20b9....2d....8ed02d....8ec006ba....be....33ff571e571feb")?(sVersion="1.1X",bDetected=1):MSDOS.compareEP("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.12, 1.20",bDetected=1):MSDOS.compareEP("50532b06....0a06....8b1e....5b58b8....ba....8cdb03d83b1e....73..83eb..fa8ed3bc....fb")?(sVersion="1.05",bDetected=1):MSDOS.compareEP("8cd805....ba....903b06....72..b409ba....cd21cd20")?(sVersion="1.15",bDetected=1):MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")?(sVersion="1.03-1.05",bDetected=1):MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..908ec353b9....33ff57be....90fcf3a5cb")?(sVersion="1.03",sOptions="type 2",bDetected=1):MSDOS.compareEP("2e8c1e....8b1e....8cda81c2....3bda72..81eb....83eb..fa8ed3bc....fbfdbe....8bfe8ccab9....03d1")?(sVersion="1.00c",bDetected=1):MSDOS.compareEP("b8....ba....3b06....73..2d....8ed02d....518ec050b9....33ff57be....fcf3a5")&&(sName+=" [hacked] by Shay Lev Ary",bDetected=1),result()}meta("packer","PKLITE")

================================================
FILE: dbs_min/db/MSDOS/packer_PKTINY.2.sg
================================================
function detect(){return MSDOS.compareEP("2ec606......2ec606......2ec606......e9")&&(sVersion="1.0",sOptions="by Thomas Monkemeier",bDetected=1),result()}meta("packer","PKTINY")

================================================
FILE: dbs_min/db/MSDOS/packer_PMWLite.2.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$fc1633c033db8ec026c406....26813e........75..26813e........74..26891e....26891e....07c3")&&(sVersion="1.33",sOptions="by Daredevil & Tran",bDetected=1),result()}meta("packer","PMWLite")

================================================
FILE: dbs_min/db/MSDOS/packer_PRO-PACK.2.sg
================================================
function detect(){return MSDOS.compareEP("0e8cd38ec38cca8eda8b......8bf183....8bfed1..fdf3a553b8....508b")?(sVersion="2.13-2.14",bDetected=1):MSDOS.compareEP("8cd38ec38cca8eda8b0e....8bf183ee..8bfed1..fdf3a553b8....508b......cb")&&(sVersion="2.08",bDetected=1),result()}meta("packer","PRO-PACK")

================================================
FILE: dbs_min/db/MSDOS/packer_Pack.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$2e8c1e....2e8c06....8cc383c3..2e891e....8cc88ed8505351525657061eb462cd212e891e....b4..33db4bcd21")&&(sVersion="1.0",sOptions="1987 by K.Kokkonen",bDetected=1),result()}meta("packer","Pack")

================================================
FILE: dbs_min/db/MSDOS/packer_Packers.2.sg
================================================
function detect(){return MSDOS.compareEP("fd1e0e81de....89f63bf23ab0....03f433f003f333f781d6....0e28de1a72..00d62250..1250..81e6....07")?(sOptions="by mARQUIS dE sOIRPE //mDS/uCF",bDetected=1):MSDOS.compareEP("e800005e83c6..90b9....8cd805....2ec43c8cc303d88ec326010583c6..e2")&&(sName="relocation packer",sOptions="by The DoP",bDetected=1),result()}meta("packer","Packer")

================================================
FILE: dbs_min/db/MSDOS/packer_RERP.2.sg
================================================
function detect(){return MSDOS.compareEP("fc1e068cc383c3..0e1fbe....b9....ad3bc175..ad3bc174..03c38ec0ad8bf826011deb")&&(sVersion="0.02",bDetected=1),result()}meta("packer","RERP")

================================================
FILE: dbs_min/db/MSDOS/packer_RIXEPACK.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$fc2e8c1e....8cc88ed8a3....8cc34b8ec326031e....81eb....0306....05....3bc3")&&(sOptions="1986, 1990 by RIX SoftWorks, Inc.",bDetected=1),result()}meta("packer","RIXEPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_RJcrush.2.sg
================================================
function detect(){return MSDOS.compareEP("06FC8CC8BA....03D052BA....52BA....03C28BD805....8EDB8EC033F633FFB9")&&(sVersion="1.00",bDetected=1),result()}meta("packer","RJcrush")

================================================
FILE: dbs_min/db/MSDOS/packer_Relpack.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$2e8c1e....2e8c06....8cc383c3..8cc88ed8be....fcad3d........ad3d........03c38ec0ad")&&(sVersion="1.0",sOptions="by TurboPower Software",bDetected=1),result()}meta("packer","Relpack")

================================================
FILE: dbs_min/db/MSDOS/packer_SCRNCH.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$bb....b44acd2181eb....73..ba....b9....e9$$$$0e1fb440bb....cd21b8....cd21")&&(sVersion="1.02",sOptions="by Graeme W. McRae",bDetected=1),result()}meta("packer","SCRNCH")

================================================
FILE: dbs_min/db/MSDOS/packer_SEA-AXE.2.sg
================================================
function detect(){return MSDOS.compareEP("fcbc....0e1fe8....26a1....8b1e....2bc38ec0b1..d3e38bcbbf....8bf7f3a5bf....0657cb")?bDetected=1:MSDOS.compareEP("fcbc....0e1fa3....e8....a1....8b1e....2bc38ec0b1..d3e38bcbbf....8bf7f3a5bf....0657cb")&&(sVersion="2.0",bDetected=1),result()}meta("packer","SEA-AXE")

================================================
FILE: dbs_min/db/MSDOS/packer_Scramb.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$e8$$$$5b0e1f81eb....8bc305....508bc803d12bfac3")&&(sVersion="1.20",bDetected=1),result()}meta("packer","Scramb")

================================================
FILE: dbs_min/db/MSDOS/packer_Shrinker.2.sg
================================================
function detect(){return MSDOS.compareEP("bb....ba....81c3....b8....b1..d3e803c38cd9498ec12603......2bc872..fa8ed3bc....fb")&&(sVersion="3.0",sOptions="1997 by A.S.M.",bDetected=1),result()}meta("packer","Shrinker")

================================================
FILE: dbs_min/db/MSDOS/packer_TSCRUNCH.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$061e55575652515350161f0e078bf4bf....b9....fcf3a4b430cd213c0373..be....e9")&&(sOptions="by Clarion software",bDetected=1),result()}meta("packer","TSCRUNCH")

================================================
FILE: dbs_min/db/MSDOS/packer_Tenth_Planet.2.sg
================================================
function detect(){return MSDOS.compareEP("50068cca8edabe....fcad95ad9303da8ec38b0c8bf14e8bfefdf3a4b8....0650cb")&&(sOptions="1996",bDetected=1),result()}meta("packer","Tenth Planet Soft packer")

================================================
FILE: dbs_min/db/MSDOS/packer_TinyProg.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")||MSDOS.compareEP("e8$$$$eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")?(sVersion="3.X",bDetected=1):MSDOS.compareEP("eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")?(sVersion="3.X",sOptions="modified",bDetected=1):MSDOS.compareEP("83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff")?(sVersion="3.X",bDetected=1):MSDOS.compareEP("e9$$$$2ec606......e9$$$$83ec..83e4..8bec50be............8cd28cd803....33c275..fc8ec233ff")&&(sVersion="3.X",sOptions="modified",bDetected=1),result()}meta("packer","TinyProg")

================================================
FILE: dbs_min/db/MSDOS/packer_Tinyprot.2.sg
================================================
function detect(){return MSDOS.compareEP("061e575650535152bd....0e1f8cc005....8ec0be....8b44..8cc103c18944..06b8....cd21891e....8c06....b8....cd21891e....8c06....07ba....b8....45cd21cd01")?bDetected=1:MSDOS.compareEP("18..00..eb$$83ec..83e4..8bec50be....0336....8cd28cd80344..33c275..fc")&&(sVersion="1.0c-e",sOptions="1996 by I.Hakszer",bDetected=1),result()}meta("packer","TinyProt")

================================================
FILE: dbs_min/db/MSDOS/packer_UCEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("501e0e1ffc33f6e8....160733f633ffb9....f3a506b8....50cb")?(sVersion="2.3",sOptions="1996 by A.Cadach",bDetected=1):MSDOS.compareEP("501e0e1ffc2bf6e8....16072bf68bfeb9....f3a406b8....50cb")?(sVersion="2.4",sOptions="1996 by A.Cadach",bDetected=1):MSDOS.compareEP("501e0e1ffc160733f633ffb9....f3a506b8....50cb")&&(sVersion="3.0",sOptions="1996 by A.Cadach",bDetected=1),result()}meta("packer","UCEXE")

================================================
FILE: dbs_min/db/MSDOS/packer_UPX.2.sg
================================================
function getUPXVersion(e){var t="",e=MSDOS.findString(0,e,"$Id: UPX")
return t=-1!==e?MSDOS.getString(e+9,4):t}function detect(){return(sVersion=getUPXVersion(Math.min(8192,MSDOS.getSize())))?bDetected=1:(MSDOS.compareEP("..............fcb430cd213c03")?(sVersion="3.X",bDetected=1):MSDOS.compareEP("B9....BE....89F71EA9....8CC805....8ED805....8EC0FDF3A5FC2E........73..92AFAD0E0E")?(sVersion="0.82",bDetected=1):MSDOS.compareEP("8CCBB9....BE....89F71EA9....8D......8ED805....8EC0FDF3A5FC")?(sVersion="0.20-0.60",bDetected=1):MSDOS.isSignaturePresent(0,Math.min(128,MSDOS.getSize()),"'UPX!'")?bDetected=1:MSDOS.compareEP("f99cb9....be....89f71ea9....8cc805....8ed805....8ec0fdf3a5fc2e........73..92afad0e0e")?(sVersion="?.??",bDetected=1):MSDOS.compareEP("8ccb8dbf....57b9....ba....be....89f71e1ea9....8d87....8daf....8ed88ec5fdf3a5fc")&&(sVersion="0.05",bDetected=1),bDetected&&(sUPXVersion=getUPXVersion(MSDOS.getSize()))&&(sVersion=sUPXVersion)),result()}meta("packer","UPX")

================================================
FILE: dbs_min/db/MSDOS/packer_WWPACK.2.sg
================================================
function detect(){return MSDOS.compare("'WWP'",28)?(MSDOS.compareEP("B8....8CCA03D08CC981C1....51")?MSDOS.compareEP("6A..06068CD383....536A..FC",14)?(sVersion="3.00",sOptions="Extractable"):MSDOS.compareEP("33C9B1..510606BB....538CD3",14)?(sVersion="3.02",sOptions="Extractable"):MSDOS.compareEP("BB....53",20)?sVersion="3.03":MSDOS.compareEP("B1..518CD3",20)&&(sVersion="3.05c4",sOptions="Modified"):MSDOS.compareEP("BE....BA....BF....B9....8CCD8EDD81ED....06068BDD2BDA8BD3FC")?(sVersion="3.00",sOptions="Relocations pack"):MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA1E8EDB011533C02EAC")?(sVersion="3.02",sOptions="Relocations pack"):MSDOS.compareEP("0305....B8....8CCA03D08CC981C1....51B9....510606B1..518CD3")&&(sVersion="3.05c4",MSDOS.compareEP("1A",3)?sOptions="Extractable":MSDOS.compareEP("1B",3)&&(sOptions="Unextractable"),MSDOS.compareEP("C0",2)?sOptions=sOptions.append("Password check","Virus shield"):MSDOS.compareEP("80",2)?sOptions=sOptions.append("Password check"):MSDOS.compareEP("40",2)&&(sOptions=sOptions.append("Virus shield"))),bDetected=1):MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA")?(sVersion="3.04/3.05",sOptions="Relocations pack",bDetected=1):MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..518cd383eb..53b1")?(sVersion="3.05beta P",bDetected=1):MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606fc8cd5b1..51b1..8cd3")||MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..51fc8cd5b1..8cd3")?(sVersion="3.0x P",bDetected=1):MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606bb....538cd383eb..53b1")?(sVersion="3.03 PU",bDetected=1):MSDOS.compareEP("b8....8cca03d08cc981c1....5133c9b1..510606bb....538cd383eb..53b1")?(sVersion="3.02, 3.02a P",bDetected=1):MSDOS.compareEP("b8....8cca03d0fc8cd58cc981c1....51b9....510606b1..51b1..8cd383eb..53514d")?(sVersion="3.04 PR",sOptions="Relocations pack",bDetected=1):MSDOS.compareEP("fa1e8ed8b8....cd218ed98bd3b8....cd211fe800005a83c2..87d4ffe4")?(sVersion="3.05 PU",bDetected=1):MSDOS.compareEP("b8....8cca03d08cc981c1....516a..06068cd383eb..536a..fc8cd5be....33ff")?(sVersion="3.0 P",bDetected=1):MSDOS.compareEP("be....ba....bf....b9....8ccd8edd81ed....06068bdd2bda8bd3fc8ec3")?(sVersion="3.0",sOptions="Relocations pack",bDetected=1):MSDOS.compareEP("ba....faf9............72..0633c98ec1bf....ab8bc6ab07e8....5a")?(sVersion="3.03 PU",sOptions="Relocations pack modified",bDetected=1):MSDOS.compareEP("faba....f8bb....b9....73..0633c98ec1bf....ab8bc6ab07e8....5a")?(sVersion="3.03 PU",sOptions="Relocations pack",bDetected=1):MSDOS.compareEP("b8....8cca03d08ccd81c5....55b9....510606b1..518cd383eb..53b1..51fc8cd5be....33ff")&&(sVersion="3.05c PU",bDetected=1),result()}meta("packer","WWPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_XPACK.2.sg
================================================
function detect(){return MSDOS.compareEP("8becfa33c08ed0bc....2e8f06....2e8f06....eb$$0ebb....535feb$$178be5fb48d1e8eb")&&(sVersion="1.52",bDetected=1),MSDOS.compareEP("e90000e9$$$$2ec706........8beceb$$2ec606......eb009a")&&(sVersion="1.0j",bDetected=1),MSDOS.compareEP("b8....15....8beceb$$b8....ffe0")&&(sVersion="1.65, 1.66",bDetected=1),MSDOS.compareEP("b8....15....813e........e8$$$$e8$$$$eb$$1e0e1f8beceb")&&(sVersion="1.67.l",bDetected=1),MSDOS.compareEP("b8....15....eb$$b8....ffe0")&&(sVersion="1.67j",bDetected=1),MSDOS.compareEP("8beceb$$b8....ffe0")&&(sVersion="1.65b2",bDetected=1),MSDOS.compareEP("e9$$$$8beceb$$b8....ffe0")&&(sVersion="1.44",bDetected=1),result()}meta("packer","XPACK")

================================================
FILE: dbs_min/db/MSDOS/packer_ZIPSCRUB.2.sg
================================================
function detect(){return(MSDOS.compareEP("8cc88ed88cc381c3....891e....8bc30306....8ec08b0e....8bf14e8bfefdf3a450b8....50cb")||MSDOS.compareEP("8cc88ed88cc381c3....8bc30306....8ec08b0e....8bf14e8bfefdf3a450b8....50cb"))&&(bDetected=1),result()}meta("packer","ZIPSCRUB relocations compressor")

================================================
FILE: dbs_min/db/MSDOS/packer_aPACK.2.sg
================================================
function detect(){return MSDOS.compareEP("1E068CCBBA....03DAFC33F633FF4B8EDB8D......8EC0B9....F3A54A75..8EC38ED833FFBE....05....0E50")?(sVersion="0.90-0.99,XE_1.3-1.4",bDetected=1):MSDOS.compareEP("1E068CCBBA....03DA8D87....FC33F633FF484B8EC08EDBB9....F3A54A75..8EC38ED833FFBE....05....0E50")?(sVersion="0.82",bDetected=1):MSDOS.compareEP("8cc88ed805....8ec050be....33fffcb2..bd....33c950a4ffd5")?(sVersion="0.94",sOptions="-m -d",bDetected=1):MSDOS.compareEP("8cc880c4..8ec0fcb9....be....8bfe57f3a55fbe....06ba....521e078ed8cb")?(sVersion="0.82-0.94",sOptions="converted to exe",bDetected=1):MSDOS.compareEP("1e060e1f0e07be....bf....8bcffc57f3a4c3")?(sVersion="0.98, 0.99",sOptions="-t",bDetected=1):MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffcb6..bd....ffd5")?(sVersion="0.69-0.74",sOptions="-t",bDetected=1):MSDOS.compareEP("be....bf....8bcffc57f3a4c3")?(sVersion="0.98-0.99 small",bDetected=1):MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffcb6..bd....8bde83e6..c1eb..8cd803c38ed8")?(sVersion="0.73-0.74 big",bDetected=1):MSDOS.compareEP("0e1f0e07be....bf....8bcffc57f3a4c3")?(sVersion="0.98",bDetected=1):MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffcb2..bd....33c950a4")?(sVersion="0.96",sOptions="-m",bDetected=1):MSDOS.compareEP("1e06ba....8ccb03dafc33f633ff4b8edb8d87....8ec0b9....f3a54a75..8ec38ed833ffbe....05....0e506a..cb")?(sVersion="0.90-0.99",bDetected=1):MSDOS.compareEP("8cc88ed805....8ec050be....33fffcb6..bd....ffd5")?(sVersion="0.73-0.82",sOptions="-d",bDetected=1):MSDOS.compareEP("1e068cc88ed805....8ec0be....33fffcb6..bd....ffd5")?(sVersion="0.58",sOptions="type 2",bDetected=1):MSDOS.compareEP("1e068cc88ed805....8ec050be....33fffc8cc82e0106....b2..bd....33c9")&&(sVersion="0.98, 0.99",sOptions="-m -h",bDetected=1),result()}meta("packer","aPACK")

================================================
FILE: dbs_min/db/MSDOS/patcher_Patchers.1.sg
================================================
function detect(){return MSDOS.compareEP("b409ba....cd21ba....cd21b8....ba....cd2173..b409ba....cd21ba....cd21cd20a3....b409ba....cd21")?(sName="CrAcKeR",sVersion="0.2a",sOptions="by Deu$",bDetected=1):MSDOS.compareEP("b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb")&&(sOptions="by Mr. KIM",bDetected=1),result()}meta("patcher","Patcher")

================================================
FILE: dbs_min/db/MSDOS/protector_$pirit.2.sg
================================================
function detect(){return MSDOS.compareEP("E8....F9E8....B4..CD212D....13F2E8....2A01F5E9")||MSDOS.compareEP("ACB4..CD2106B4..CD21079FE8....FC90")||MSDOS.compareEP("123fe8$$$$e4..900c..36e6..ba....f9525289d126b8....36b5..3ecd16fd5a")?(sVersion="1.5",bDetected=1):MSDOS.compareEP("ac03d9e8$$$$e4..fb0c..fbe6..90ba....5252fd89d1b8....30ed2ecd16905a87d190b8....fb86cdf530ed3ecd16f95ac3")?(sOptions="$UPD 2.1 1996 by Night $pirit",bDetected=1):MSDOS.compareEP("1c..3a1fe8....f5e8....fde8....04..9035....f8f6dff9d0d5fdfbfcc3")||MSDOS.compareEP("e8$$$$e4210c1ae6212eb9....2e51f85189c9f8b8....b5..2ecd163659fdfd87c986cd3eb5..2eb8....f9cd1659c3")?bDetected=1:(MSDOS.compareEP("e8$$$$ba....f8ec0c..36eef5b8....50f950269089c128edf9b8....cd165887c1b8....f886e93e30ed36cd1658fdc3")||MSDOS.compareEP("e8$$$$ba....fbec0c..eeb9....51512efd89c9fdb8....b5..3ecd165987c9b8....86e9b5..f8cd1659f9c3")||MSDOS.compareEP("e8$$$$e4212e0c..e6212eb9....5151fd89c93eb5..fcb8....fbcd162e5987c926b8....fd")||MSDOS.compareEP("e8$$$$26e421f80c..e621f98d1e....53365389d93e30edb8....cd165b")||MSDOS.compareEP("91221db4..cd21d2d1e9$$$$b4..cd21a6e8")||MSDOS.compareEP("b4..cd21b4..cd21e8$$$$ba....ec900c..26ee8d0e....51fd51")||MSDOS.compareEP("95e8$$$$fbba....3eecfc0c..3eeefb8d0e....51512687c9b8....28ed26cd162e59fdfb87c9b8....fd88e9f8b5..cd1626592ec3"))&&(sVersion="1.5",bDetected=1),result()}meta("protector","$pirit")

================================================
FILE: dbs_min/db/MSDOS/protector_ABKprot.2.sg
================================================
function detect(){return MSDOS.compareEP("B430CD2186E03D....73..9C8CC0065B595153BA....87F256CF0E1F0E07")&&(sVersion="1.0",bDetected=1),result()}meta("protector","ABKprot")

================================================
FILE: dbs_min/db/MSDOS/protector_AEP.2.sg
================================================
function detect(){return MSDOS.compareEP("E8$$$$E4212EA3....33C08BD85DB9....50B8....E6210FA9E6..538BDFE42123D84B0FA14B66")&&(sVersion="1.00",bDetected=1),result()}meta("protector","AEP")

================================================
FILE: dbs_min/db/MSDOS/protector_ALEC.2.sg
================================================
function detect(){return MSDOS.compareEP("c1ed..1346..2e391cb9....f981c1....bb....81c3....2ec007..431346..4975..8e0000d518de3701e2c8......330ce8")||MSDOS.compareEP("b9....81c1....bb....81c3....71..908a24402e802f..4372..90")?(sVersion="1.3",sOptions="1996 by rANDOM //UCF",bDetected=1):MSDOS.compareEP("b9....81c1....84221a24bf....81c7....2e3856..408422")&&(sVersion="1.6",sOptions="1996 by rANDOM //UCF",bDetected=1),result()}meta("protector","ALEC")

================================================
FILE: dbs_min/db/MSDOS/protector_ANTI-TRACE.2.sg
================================================
function detect(){return MSDOS.compareEP("2ec606......eb$$e9$$$$8cd805....50b8....5033c0cb")&&(sVersion="1.0",sOptions="by Oren Maurice",bDetected=1),result()}meta("protector","ANTI-TRACE")

================================================
FILE: dbs_min/db/MSDOS/protector_AVAST_CRC-Check.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$8cc82e0306....502eff36....CB")&&(sVersion="7.70",sOptions="1999",bDetected=1),result()}meta("protector","AVAST CRC-CHECK")

================================================
FILE: dbs_min/db/MSDOS/protector_Aluwain.2.sg
================================================
function detect(){return MSDOS.compareEP("8BEC1EE8....9D5E")&&(sVersion="8.09",bDetected=1),result()}meta("protector","Aluwain")

================================================
FILE: dbs_min/db/MSDOS/protector_Anti-LAME.2.sg
================================================
function detect(){return MSDOS.compareEP("060e07bb....31c09090b9....268a0730e0268807fec443e2..078cc005....05....50b8....50b8....50c3")&&(sOptions="by [ptPower",bDetected=1),result()}meta("protector","Anti-LAME")

================================================
FILE: dbs_min/db/MSDOS/protector_Antilame.2.sg
================================================
function detect(){return MSDOS.compareEP("fd2ad01e03fa33fe81d7....2efe06....12d30e0e0780f6..1f85fe33ff1216....b2..81d2....84e2ba....d1c232f7")&&(sVersion="1.0b",sOptions="by Phantomlord",bDetected=1),result()}meta("protector","Antilame")

================================================
FILE: dbs_min/db/MSDOS/protector_Bitlok.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$b430cd213c..72..2e8c1e....8cdb83c3..2e011e....0e1feb$$33c0eb$$bf....eb$$b9....eb$$51eb$$2bcf")?(sVersion="3.1",sOptions="by Yellow Rose Software Workgroup",bDetected=1):MSDOS.compareEP("fa8ccc8ed4bc....9c51525657550e1f2e8c06....2ec606......0e07be....b9....b0..e3")?(sName="BITLOK-7NT",sVersion="11/13/93-04/22/95",sOptions="by Mr. Lei (Yellow Rose Co.)",bDetected=1):MSDOS.compareEP("fa8ccc8ed4bc....9c51525657550e1f2e8c06....0e07be....b9....b0..e3")&&(sName="BITLOK-7NT",sVersion="05/21/93",sOptions="by Mr. Lei (Yellow Rose Co.)",bDetected=1),result()}meta("protector","BITLOK")

================================================
FILE: dbs_min/db/MSDOS/protector_Bunny.2.sg
================================================
function detect(){return MSDOS.compareEP("fae9$$$$8cc02ea3....8cd82ea3....8cd02ea3....8bc42ea3....8cc88ed88ec08ed0bc....e8")&&(sVersion="4.1",sOptions="1993 by M.Bunjes",bDetected=1),result()}meta("protector","Bunny")

================================================
FILE: dbs_min/db/MSDOS/protector_CC.2.sg
================================================
function detect(){return MSDOS.compareEP("b8....ba....3be073..b409ba....cd21b8....cd218bdc81eb....83e3..fcbe....8bfbb9....f3a48bc3b1..d3e88cc903c15033c050cb")?(sVersion="1.0",sOptions="1991 by B.Vorontsov",bDetected=1):MSDOS.compareEP("ba....b430cd213c..73..33c00650cbb9....b8....eb$$05....fc80c4..eb")&&(sVersion="2.61 Beta",sOptions="by UniHackers",bDetected=1),result()}meta("protector","CC")

================================================
FILE: dbs_min/db/MSDOS/protector_CEPexe.2.sg
================================================
function detect(){return MSDOS.compareEP("8cdd0e070e1fbf....be....b9....fcf3a41f5f8f..8f....8f....8c....8f....8f....595f5e8cc88ec08ed8ea")&&(bDetected=1),result()}meta("protector","CEPexe")

================================================
FILE: dbs_min/db/MSDOS/protector_CERBERUS.2.sg
================================================
function detect(){return MSDOS.compareEP("9C2BED8C....8C....FAE4..88....1607BF....8EDD9BF5B9....FCF3A5")&&(sVersion="2.0",bDetected=1),result()}meta("protector","CERBERUS")

================================================
FILE: dbs_min/db/MSDOS/protector_COMCRYPT.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$b9....be....89f70e1f0e07bb....fcad31d8abe2")?bDetected=1:MSDOS.compareEP("e9$$$$eb$$5053575152061e572e8b36....81c6....8a5c..2e881e....8a5c")&&(sVersion="1.0b",bDetected=1),result()}meta("protector","COMCRYPT")

================================================
FILE: dbs_min/db/MSDOS/protector_COMPROTECT.2.sg
================================================
function detect(){return MSDOS.compareEP("b8....15....72..8ac4bb....50515253555657061e50b8....58eb")&&(sVersion="2.10",sOptions="1988-95 by Ralph Roth (converted to exe)",bDetected=1),result()}meta("protector","COMPROTECT")

================================================
FILE: dbs_min/db/MSDOS/protector_CONVOY.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$2e8c06....2ea3....b8....cd2f3c..75..b8....ba....0e1fcd21b8....cd21")?(sOptions="1993 by ELIAS Copy-Protection System",bDetected=1):MSDOS.compareEP("e9$$$$2e8c06....2ea3....e8$$$$5056571e062e8b3e....2e8106........2e893e....0e0733c08ed833f6b9")&&(sVersion="3.2",sOptions="1993 by ELIAS Copy-Protection System",bDetected=1),result()}meta("protector","CONVOY++")

================================================
FILE: dbs_min/db/MSDOS/protector_CRYPTEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("EB..8BDCEB..EA........01EA83FC..74..EB")||MSDOS.compareEP("eb$$8bdceb$$bc....eb$$83fc..74..eb$$cd20eb$$8be3")?(sVersion="1.04",bDetected=1):MSDOS.compareEP("2e8c1e....eb$$fa50b8....58eb$$eb$$8bdceb$$bc....eb$$83fc..eb$$74..fa")&&(sVersion="1.01b",sOptions="1996 by DoP",bDetected=1),result()}meta("protector","CRYPTEXE")

================================================
FILE: dbs_min/db/MSDOS/protector_China Locker.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$fc2e891e....2e890e....2e8916....2e8936....2e893e....2e8c16....2e8926....2e8c1e....90909090")&&(sVersion="1995.02.02",sOptions="by China Locker Software",bDetected=1),result()}meta("protector","China Locker")

================================================
FILE: dbs_min/db/MSDOS/protector_Ciphator.2.sg
================================================
function detect(){return MSDOS.compareEP("9393E8$$$$586A..0E68....CF")&&(sVersion="4.6",bDetected=1),result()}meta("protector","Ciphator")

================================================
FILE: dbs_min/db/MSDOS/protector_Codesafe.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$5033c08ec02ef606......74..26ff36....061e07e8....07268f06....fb2e8c1e....26ff36....268f06")&&(sOptions="by EliaShim Ltd",bDetected=1),result()}meta("protector","Codesafe")

================================================
FILE: dbs_min/db/MSDOS/protector_ComProtector.2.sg
================================================
function detect(){return MSDOS.compareEP("E9....E8....5E8BEE81......8D......B9....F61446E2..4B")?(sVersion="1.0b",bDetected=1):MSDOS.compareEP("E9....B9....BB....BF....2E....34..FEC8C0....2E....2E....2E....4743E2")&&(sVersion="1.0",bDetected=1),result()}meta("protector","ComProtector")

================================================
FILE: dbs_min/db/MSDOS/protector_ComprEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("fc1e068cdd83c5..89e8ba....8b1e....29d3538ed88ec331f631ffb9....f3a540434a75..b8....50cb")&&(sVersion="1.0",sOptions="by Tom Torfs",bDetected=1),result()}meta("protector","ComprEXE")

================================================
FILE: dbs_min/db/MSDOS/protector_Copy_Protector.2.sg
================================================
function detect(){return(MSDOS.compareEP("2EA2....5351521E06B4..1E0E1FBA....CD211F")||MSDOS.compareEP("E9....505351521E0657E8....5F83EF..B4..1E0E1F"))&&(sVersion="2.0",bDetected=1),result()}meta("protector","Copy Protector")

================================================
FILE: dbs_min/db/MSDOS/protector_Copylock_PC.2.sg
================================================
function detect(){return(MSDOS.compareEP("0e1fb9....bf....8135....83c7..e2")||MSDOS.compareEP("0e1f8c1e....8c06....1e07bf....33f6")||MSDOS.compareEP("0e1fb9....bf........83c7..e2")||MSDOS.compareEP("0e1fb9....bf............83c7..e2")||MSDOS.compareEP("0e1f8cc0a3....90909090909090909090a1"))&&(sOptions="1990 by Rob Northen Computing",bDetected=1),result()}meta("protector","Copylock PC")

================================================
FILE: dbs_min/db/MSDOS/protector_CrAcKeR.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$be....8bfe5633c0be....ac02e081fe....72..5eac34..aa81fe....72")&&(sVersion="0.2a",sOptions="by Deu$",bDetected=1),result()}meta("protector","CrAcKeR")

================================================
FILE: dbs_min/db/MSDOS/protector_CrackStop.2.sg
================================================
function detect(){return MSDOS.compareEP("B4..BB....B9....8BECCD21FAFC03....05....FFE0")?(sVersion="1.X",bDetected=1):MSDOS.compareEP("bd....be....ffe6")&&(sVersion="1.0b",bDetected=1),result()}meta("protector","CrackStop")

================================================
FILE: dbs_min/db/MSDOS/protector_Cruncher.2.sg
================================================
function detect(){return MSDOS.compareEP("2E........2E......B430CD213C0373..BB....8EDB8D......B409CD210633C050CB")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Cruncher")

================================================
FILE: dbs_min/db/MSDOS/protector_CryExe.2.sg
================================================
function detect(){return MSDOS.compareEP("E9$$$$E9$$$$E9$$$$BB....E8$$$$31EDEB$$8EDDEB$$872FE8$$$$E8$$$$55E9$$$$E9$$$$31C0EB$$EB$$E8")&&(sVersion="4.0",bDetected=1),result()}meta("protector","CryExe")

================================================
FILE: dbs_min/db/MSDOS/protector_CryptCom.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$be....56b9....c704....c644....8134....4646e2..31f631c9c3")&&(sVersion="2.0",sOptions="by Nowhere Man",bDetected=1),result()}meta("protector","CryptCom")

================================================
FILE: dbs_min/db/MSDOS/protector_CrypteXeC.2.sg
================================================
function detect(){return(MSDOS.compareEP("FD25....E8....3EBA....EC0C..26EE..B9....5151..87C9")||MSDOS.compareEP("06b4..cd2107e8....acac3ee8....d7e9"))&&(sVersion="1.01",bDetected=1),result()}meta("protector","CrypteXeC")

================================================
FILE: dbs_min/db/MSDOS/protector_Crypto-box.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$9c50520e538bec2e892e....1e06b8....8bf80e07b8....8ed82e8b1e....8b078bf0")&&(bDetected=1),result()}meta("protector","Crypto-box")

================================================
FILE: dbs_min/db/MSDOS/protector_DCREXE.2.sg
================================================
function detect(){return(MSDOS.compareEP("e8$$$$52e8$$$$5a83c2..ffe2")||MSDOS.compareEP("e8$$$$53e8$$$$5b83c3..ffe3"))&&(sVersion="2.0",sOptions="by LuCe",bDetected=1),result()}meta("protector","DCREXE")

================================================
FILE: dbs_min/db/MSDOS/protector_DMC.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$2e8c16....2e8926....2ea3....8cc88ed0bc....2ea1....505351525657551e060e1f8c06....a1")&&(sVersion="3.5",sOptions="by Adlersparre & Associates",bDetected=1),result()}meta("protector","DMC")

================================================
FILE: dbs_min/db/MSDOS/protector_Deeper.2.sg
================================================
function detect(){return MSDOS.compareEP("90e9$$$$e8000059fa8bdc36c747......36837f....75..fb66fafb8be981ed....81e9....be....8dbe....668b05668904")&&(sVersion="1.0c",bDetected=1),MSDOS.compareEP("90e9$$$$e80000fa8bdc36c747......36837f....75..fb598be981ed....81e9....be....8dbe....668b05668904")&&(sVersion="1.0a",bDetected=1),result()}meta("protector","Deeper")

================================================
FILE: dbs_min/db/MSDOS/protector_E-PROT.2.sg
================================================
function detect(){return MSDOS.compareEP("81f8....be....90bd....2e8076....454e75")&&(sVersion="1.0.3",sOptions="2000 by MasterBall Systems, Inc.",bDetected=1),result()}meta("protector","E-PROT 386+")

================================================
FILE: dbs_min/db/MSDOS/protector_EEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("B430CD213C0373..BA1F000E1FB409CD21B8FF4CCD21")?(sVersion="1.12",sOptions="1994 by F.P.Budzyn",bDetected=1):MSDOS.compareEP("b430cd213c..73..0e1fb409ba....cd21b8....cd21")?(sOptions="1994 by F.P.Budzyn",bDetected=1):MSDOS.compareEP("33c08ed806be....bf....b9....fcf3a5b4..cd21")&&(sVersion="1.11",sOptions="1994 by F.P.Budzyn",bDetected=1),result()}meta("protector","EEXE")

================================================
FILE: dbs_min/db/MSDOS/protector_EPW.2.sg
================================================
function detect(){return MSDOS.compareEP("06571e5655525153502e8c......8cc005....2ea3....8ed8a1")?(sVersion="1.2",bDetected=1):MSDOS.compareEP("06571E5655525153502E8C0608008CC083")?(sVersion="1.30",bDetected=1):MSDOS.compareEP("e9$$$$06571e565552515350bb....81c3....2e8b078ccb03c305....50b8....50cb")&&(sVersion="1.20",bDetected=1),result()}meta("protector","EPW")

================================================
FILE: dbs_min/db/MSDOS/protector_ETS.1.sg
================================================
function detect(){return MSDOS.compareEP("60061eeb$$bf....8cc82e8985....2e8b8d....8ec02e8bbd....e8")&&(sVersion="1.0",sOptions="by Da BLoB / MAFiA",bDetected=1),result()}meta("protector","ETS (ENCRYPT THE SHiT)")

================================================
FILE: dbs_min/db/MSDOS/protector_EXE-Crypt.2.sg
================================================
function detect(){return MSDOS.compareEP("90eb$$2e8c......2e89......8cc88ed0bc....1e060e1f8cc005....8ec01ee8....1f8cc3be....2e8b......83....74")&&(sVersion="1.00",bDetected=1),result()}meta("protector","EXE-Crypt")

================================================
FILE: dbs_min/db/MSDOS/protector_EXE-Protect.2.sg
================================================
function detect(){return MSDOS.compareEP("e800005d81ed....1e06..1fb4..8db6....b9....8a1446cd21909090")&&(sOptions="by Phrozen Crew",bDetected=1),result()}meta("protector","EXE-Protect")

================================================
FILE: dbs_min/db/MSDOS/protector_EXEGUARD.2.sg
================================================
function detect(){return MSDOS.compareEP("BA....BF....EB$$E8$$$$53BB....EB$$EB$$5B0E075051535653BB....EB")&&(sVersion="1.3",bDetected=1),result()}meta("protector","EXEGUARD")

================================================
FILE: dbs_min/db/MSDOS/protector_EXEHigh.2.sg
================================================
function detect(){return MSDOS.compareEP("8cca8b2e....8eda8c06....8cda2bea8b3e....81ff....73..bf....893e....81c7....033e....b1..d3ef47d3e7fa")&&(sVersion="1.01",sOptions="by NoddegamrA",bDetected=1),result()}meta("protector","EXEHigh")

================================================
FILE: dbs_min/db/MSDOS/protector_EXETools.2.sg
================================================
function detect(){return(MSDOS.compareEP("e800005d83ed..1e8cda83c2..8eda8ec2bb....ba....85d274..b4..33ff33f6b9....ac32c4c0c4")||MSDOS.compareEP("68....68....68....be....bf....57b9....f3a4c3"))&&(sVersion="2.1 /E",bDetected=1),result()}meta("protector","EXETools")

================================================
FILE: dbs_min/db/MSDOS/protector_Encriptor.2.sg
================================================
function detect(){return MSDOS.compareEP("EB..B9....BE....BF....ACD0C8AAE2..BE....BF....ACAA")&&(sVersion="1.00c",bDetected=1),result()}meta("protector","Encriptor")

================================================
FILE: dbs_min/db/MSDOS/protector_Enkryptonator.2.sg
================================================
function detect(){return MSDOS.compareEP("1e1eb430cd21b4..3c..73..cd21be....e8....e8....e8....1f07e9")&&(bDetected=1),result()}meta("protector","Enkryptonator")

================================================
FILE: dbs_min/db/MSDOS/protector_ExeCode.2.sg
================================================
function detect(){return MSDOS.compareEP("E9$$$$FA8CC302DF5033C02E8C16....2E8926....8ED0BC....BE....B9....33FF2EC706........32DBB0..E664AC")?(sVersion="1.0",sOptions="1995 by Balazs Scheidler",bDetected=1):MSDOS.compareEP("E9$$$$8be8ba....b409cd212ea1....8cc303c3b1..2e8b1e....f7c3....74..83c3..d3eb2e891e....be....bf....b9....f3a5")&&(sVersion="1.0 unregistered",sOptions="1995 by Balazs Scheidler",bDetected=1),result()}meta("protector","ExeCode")

================================================
FILE: dbs_min/db/MSDOS/protector_ExeLock.2.sg
================================================
function detect(){return MSDOS.compareEP("068CC88EC0BE....26....34..26....4681......75..40B3..B3..F3")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("ba....bf....eb$$e8$$$$53bb....eb$$eb$$5beb$$0633c08ec0b8....26a3....268c0e....075052faba....b0..ee")&&(sVersion="1.0X",sOptions="by ST!LLS0N",bDetected=1),result()}meta("protector","EXELock666")

================================================
FILE: dbs_min/db/MSDOS/protector_FACRYPT.2.sg
================================================
function detect(){return MSDOS.compareEP("B9....B3..33D2BE....8BFEAC32C3AA494332E403D0E3")&&(sVersion="1.0",bDetected=1),result()}meta("protector","FACRYPT")

================================================
FILE: dbs_min/db/MSDOS/protector_FSE.2.sg
================================================
function detect(){return MSDOS.compareEP("607d..7a..d1ce89f68bf601fb8bf731f781c7....f8f8")?(sVersion="0.6",bDetected=1):MSDOS.compareEP("60d1cef533de33c8c7c6....d1cee9$$$$fbf98bd029c131db")||MSDOS.compareEP("607d..7a..d1ce89f68bf601fb8bf731f781c7....f8e8")?(sVersion="0.6+",bDetected=1):MSDOS.compareEP("60b3..b7..7e..f5d1c2fb81e9....c7c0....bd....81c5....d1ce33c4fd79..e9")?(sVersion="0.5",bDetected=1):MSDOS.compareEP("eb$$6025....eb$$eb$$8cc0fa66c1cc..eb$$44bc....eb$$2ea3....66c1cc..e9")?(sVersion="0.4+",bDetected=1):MSDOS.compareEP("60fff08fc603f6b1..b5..fff18fc2f8e9")?(sVersion="0.55",bDetected=1):MSDOS.compareEP("60cefd33db81c3....81f3....81c3....fd45eb")?(sVersion="0.5c",bDetected=1):MSDOS.compareEP("607c..79..81ef....cc7f..8bc82bc103d431db81c3....fb81ea....e9")?(sVersion="0.5c02",bDetected=1):MSDOS.compareEP("6033f131c731f78bd9be....d1cf31c1c7c3....d1c3fd8bf8fb33c7bf....d1c7")?(sVersion="0.5c04",bDetected=1):MSDOS.compareEP("60be....c7c5....c7c3....c7c2....81f2....2e319a....33d62e8bba....31ef")?(sVersion="0.5s",bDetected=1):MSDOS.compareEP("6031fbce29f6c7c7....d1c333dfe8....76..c8......e8")?(sVersion="0.6",bDetected=1):MSDOS.compareEP("60fdd1c3f533ebc7c3....87d389d79705....7c..e9")||MSDOS.compareEP("6072..fbe9$$$$03cee9$$$$b9....d1c981f1....8bd9d1cf")?(sVersion="0.61+",bDetected=1):MSDOS.compareEP("6089f731fffbb8....03e9c7c1....47f9fceb")||MSDOS.compareEP("60be....c7c3....2e3198....81c3....81c6....8bfe01df75..e9")?(sVersion="0.62",bDetected=1):MSDOS.compareEP("60fff08fc2f9bf....fb31da8bf42bdef5f971..03f0c7c3....87dd")||MSDOS.compareEP("60c7c6....b8....bf....bb....2e81b1........81f6....81c3....81c7....05....75..543e51")?(sVersion="0.63",bDetected=1):(MSDOS.compareEP("60fc81f3....f5be....fde9$$$$2be84a8bd129d9")||MSDOS.compareEP("6033d9c7c1....7c..c7c6....75..76..bd....2bcd31c2")||MSDOS.compareEP("60c7c5....c7c6....bf....31f62e31ab")||MSDOS.compareEP("60c7c7....c7c3....c7c5....2e31ab....2e31bb....81c5"))&&(sVersion="0.5",bDetected=1),result()}meta("protector","FSE by ZeNiX Yang //pCE'98")

================================================
FILE: dbs_min/db/MSDOS/protector_GA-Header.2.sg
================================================
function detect(){return MSDOS.compareEP("8cd02ea3....2e8926....8cc88ed0bc....061e0e1fbe....b8....8ec0bf....b9")&&(sVersion="1.00",bDetected=1),result()}meta("protector","GA-Header")

================================================
FILE: dbs_min/db/MSDOS/protector_GOAT.1.sg
================================================
function detect(){return sOptions="1996 by Martin Overton //ChekWARE",(MSDOS.compareEP("5051568bc033c0904149813c....75..83f9..75..0bc033c058595eb8")||MSDOS.compareEP("515056528bc233d2f7e04149813c....75..3d....73..0bc933d259585e5ab8")||MSDOS.compareEP("1650525351564a33db74..434b813c....74..81f9....75..0bd2b8....8ed85e585a5b5917b8"))&&(bDetected=1),result()}meta("protector","GOAT")

================================================
FILE: dbs_min/db/MSDOS/protector_HACKSTOP.2.sg
================================================
function detect(){return MSDOS.compareEP("FABD....FFE56A49480C..E4..3F983F")?(sVersion="1.00",bDetected=1):MSDOS.compareEP("B430CD2186E03D....73..B42FCD21B0..B44CCD2150B8....58EB")?(sVersion="1.10/1.11",bDetected=1):MSDOS.compareEP("B430CD2186E03D000373..B42FCD21B42ACD21B42CCD21B0FFB44CCD2150B8....58EB")?(sVersion="1.10p1",bDetected=1):MSDOS.compareEP("B430CD2186E03D....73..B4..CD21B0..B44CCD2153BB....5BEB")?(sVersion="1.11c",bDetected=1):MSDOS.compareEP("B430CD2186E03D....73..B0..B4..CD2150B8....58EB$$EB$$b8....CD2150B2..B8....CD21")?(sVersion="1.00",bDetected=1):MSDOS.compareEP("521eb430cd2186e03d....73..cd200e1fb4..e8")?(sVersion="1.11f-1.12s",bDetected=1):MSDOS.compareEP("FABD....D4854E32EBEB")?(sVersion="1.13",bDetected=1):MSDOS.compareEP("fabd....ffe5")?(sVersion="1.13cs",sOptions="converted to exe",bDetected=1):MSDOS.compareEP("52B8....1ECD2186E03D....73..CD200E1FB409E8....24..EA")?(sVersion="1.13",bDetected=1):MSDOS.compareEP("FABE....050C00071D4A461E16FDAC44........F16D84D33D....CFAFFB34DB33..........D0D6....92B4249E")?(sVersion="1.17",bDetected=1):MSDOS.compareEP("52BA....5AEB..9A........30CD21......FD02....CD200E1F52BA....5AEB")?(sVersion="1.18",bDetected=1):MSDOS.compareEP("52BA....5AEB..9A........30CD21......D602....CD200E1F52BA....5AEB")?(sVersion="1.19s",bDetected=1):MSDOS.compareEP("52B430CD2152FA..FB3D....EB..CD200E1FB409E8")?(sVersion="1.11f",sOptions="modified",bDetected=1):MSDOS.compareEP("53bb....5beb$$eb$$9c1e52b430cd2186c43d....73..cd200e1f53bb....5beb")?(sVersion="1.20",bDetected=1):MSDOS.compareEP("1e52B8....cd2186c43d....73..cd2052ba....5aeb")?(sVersion="1.18s",bDetected=1):MSDOS.compareEP("5d1eb430cd2186e03d....73..cd200e1fb409e8")?(sVersion="1.11gs",bDetected=1):MSDOS.compareEP("e8$$$$3adb74..b8014ccd21eb..b430cd21fa8bec8b46..05....ffe0")?(sVersion="1.17 regged",bDetected=1):MSDOS.compareEP("521ee9$$$$0e1fb409e8$$$$5acd211f5a53bb....5beb$$eb$$e8$$$$e8$$$$52ba....5aeb")?(sVersion="1.11f",bDetected=1):MSDOS.compareEP("b8....521ecd2186e03d....73..cd200e1fb4..e8$$$$5acd211f5a53bb....5beb")?(sVersion="1.12cs",bDetected=1):MSDOS.compareEP("50b8....58eb$$eb$$9c1e52b430cd2186c43d....73..cd200e1f50")?(sVersion="1.19/386",bDetected=1):MSDOS.compareEP("9c5751e8$$$$e8$$$$5fb9....b8....2e87052e3185....47d1c8e2")?(sVersion="1.20/386",bDetected=1):MSDOS.compareEP("b430cd2186e03d....73..b0..b44ccd2150b8....58eb")&&(sVersion="0.97.6-0.99b",bDetected=1),result()}meta("protector","HackStop")

================================================
FILE: dbs_min/db/MSDOS/protector_HASP.2.sg
================================================
function detect(){return(MSDOS.compareEP("e9$$$$e800005d81ed....2ea3....8cd82ea3....05....2ea3....2e0306....2ea3....2e833e......75..e8")||MSDOS.compareEP("e9$$$$e800005d81ed....2ea3....8cd82ea3....83c0..2ea3....2e0306....2ea3....2e833e......75..e8"))&&(bDetected=1),result()}meta("protector","HASP Key Envelope")

================================================
FILE: dbs_min/db/MSDOS/protector_HEALTH.2.sg
================================================
function detect(){return MSDOS.compareEP("1EE8....2E8C06....2E893E....8BD7B8....CD218BD80E1FE8....0657A1....26")&&(sVersion="5.1",bDetected=1),result()}meta("protector","HEALTH")

================================================
FILE: dbs_min/db/MSDOS/protector_HaSPeX-Protect.2.sg
================================================
function detect(){return MSDOS.compareEP("fa8cc88ed88cd38bd48ed0bc....b9....8bf44444fdad35....50eb")&&(sOptions="1996",bDetected=1),result()}meta("protector","HaSPeX-Protect")

================================================
FILE: dbs_min/db/MSDOS/protector_Hardlock.2.sg
================================================
function detect(){return MSDOS.compareEP("2ec6........be....bf....b9....2ea1....d1e92e8b1d2e31052e030402e12bc6d0c403c34683ef")&&(sOptions="dongle envelope by Aladdin",bDetected=1),result()}meta("protector","Hardlock")

================================================
FILE: dbs_min/db/MSDOS/protector_Inertia.2.sg
================================================
function detect(){return(MSDOS.compareEP("505351525657551e060eb8....500e5805....5031c050cb")||MSDOS.compareEP("505351525657551e8cc88ed8be....8cc3011e....8cc92bcb83e9..33db8cc005....8ed8"))&&(bDetected=1),result()}meta("protector","Inertia encryption")

================================================
FILE: dbs_min/db/MSDOS/protector_Int01-Destroyer.2.sg
================================================
function detect(){return MSDOS.compareEP("fc33d28ec2bf....abab8cca33ff81ea....52ba....521e0733d2cb")&&(sOptions="1994",bDetected=1),result()}meta("protector","Int01-Destroyer")

================================================
FILE: dbs_min/db/MSDOS/protector_Ironthorn.2.sg
================================================
function detect(){return MSDOS.compareEP("9ce80000581e5704..bf....5feb$$ffd0")&&(sVersion="1.0:2000",sOptions="modified HackStop 1.19 by ReDragon",bDetected=1),result()}meta("protector","Ironthorn")

================================================
FILE: dbs_min/db/MSDOS/protector_JAM.2.sg
================================================
function detect(){return MSDOS.compareEP("50061607BE....8BFEB9....FDFAF32EA5FB06BD....55CB")&&(sVersion="2.21",bDetected=1),result()}meta("protector","JAM")

================================================
FILE: dbs_min/db/MSDOS/protector_JmCryptExe.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$e9$$$$1e068cd805....8ed88ec02e0106....2e0106....8be82ea1....2e8b0e")?(sVersion="0.7i",bDetected=1):MSDOS.compareEP("e9$$$$e9$$$$2e8c1e....e8$$$$530633db8ec3bb....268e47..bb....26813f....74..e9")?(sVersion="0.7",bDetected=1):MSDOS.compareEP("e9$$$$2e8c1e....8cc88ed806a1....8ec08b1e....b4..cd210773..e9")&&(sVersion="0.7?",bDetected=1),result()}meta("protector","JmCryptExe")

================================================
FILE: dbs_min/db/MSDOS/protector_Joke.2.sg
================================================
function detect(){return MSDOS.compareEP("bb....e8....bd....2863..53454ee8....9893928a80....52cb")&&(sOptions="by SEN",bDetected=1),result()}meta("protector","Joke fileheader")

================================================
FILE: dbs_min/db/MSDOS/protector_KeyMaker.2.sg
================================================
function detect(){return MSDOS.compareEP("fc0e1f8706....871e....870e....8716....8736....873e....872e....268b07a3....8cc0a3....8cc88ec08edaf3a5")&&(sVersion="3.0",sOptions="1998 by TIME Software",bDetected=1),result()}meta("protector","KeyMaker")

================================================
FILE: dbs_min/db/MSDOS/protector_Kvetch.2.sg
================================================
function detect(){return MSDOS.compareEP("bb....ba....0e1f068cd005....8ec00efc8bcbd1e133ffd1e18bf7d1e1f3a5b8....0650cb")?(sVersion="1.X",sOptions="1992 by Tal Nevo",bDetected=1):MSDOS.compareEP("ba....bb....060e0e1f8cd005....8ec08bcbd1e1d1e1d1e133ff8bf7fcf3a506b8....50cb")&&(sVersion="1.02c",sOptions="1992 by Tal Nevo",bDetected=1),result()}meta("protector","Kvetch")

================================================
FILE: dbs_min/db/MSDOS/protector_LOCK.2.sg
================================================
function detect(){return MSDOS.compareEP("b430cd21faba....2e8006......80ea..2e8816....e8$$$$2ec606......fbbf....b9....0e072e8a0534..aae2")&&(sVersion="1.1",sOptions="by Psycho //ENiAC",bDetected=1),result()}meta("protector","LOCK")

================================================
FILE: dbs_min/db/MSDOS/protector_LOCK91.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$8cc88ed88ec08cd8a3....a1....2906....e421500c..24..e621e8")&&(sOptions="dongle envelope",bDetected=1),result()}meta("protector","LOCK91")

================================================
FILE: dbs_min/db/MSDOS/protector_LamerStop.2.sg
================================================
function detect(){return MSDOS.compareEP("E8....05....CD2133C08EC026......2E......26......2E......BA....FA")&&(sVersion="1.0c",bDetected=1),result()}meta("protector","LamerStop")

================================================
FILE: dbs_min/db/MSDOS/protector_LockTite+.2.sg
================================================
function detect(){return MSDOS.compareEP("8cc88ed88cc381c3....8bc30306....8ec08b0e....8bf14e8bfefdf3a450b8....50cb")&&(bDetected=1),result()}meta("protector","LockTite+")

================================================
FILE: dbs_min/db/MSDOS/protector_MEGALITE.2.sg
================================================
function detect(){return MSDOS.compareEP("B8....BA....05....3B2D73..72..B409BA....CD21CD90")&&(sVersion="1.20a",bDetected=1),result()}meta("protector","MEGALITE")

================================================
FILE: dbs_min/db/MSDOS/protector_MESS.2.sg
================================================
function detect(){return MSDOS.compareEP("....................B9....F3..ACE3..EB..BA....B409CD21CD20..............................B430CD213C0277")?(sVersion="1.07",bDetected=1):MSDOS.compareEP("........FAB9....F326ACE3..EB$$1E0E1FBA....81EA....B409CD211FB44CCD21")?(sVersion="1.20",bDetected=1):MSDOS.compareEP("........FA545b3bdc75..eb$$9c5b81cb....5381e3....75..9d9c5825....75..1e0e1f")?(sVersion="1.29",bDetected=1):MSDOS.compareEP("........FAb9....f326ace3..eb$$1e0e1fba....b409cd211fb44ccd21")?(sVersion="1.X",bDetected=1):MSDOS.compareEP("'MESS'b9....83c4..f326ace3..eb$$ba....b409cd21cd20")?(sVersion="1.07",bDetected=1):MSDOS.compareEP("'MESS'fa545b3bdc75..eb$$9c5b81cb....539d9c5825....75..1e0e1fba....b409cd211f")?(sVersion="1.25",bDetected=1):MSDOS.compareEP("'MESS'b9....83c4..f326ace3..eb")&&(sVersion="1.14",bDetected=1),result()}meta("protector","MESS")

================================================
FILE: dbs_min/db/MSDOS/protector_Maker.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$558bec9ceb$$505351525657061eb8....cd210653eb$$b8....cd2106531e1e0e1f8ccab1..eb")&&(sVersion="3.0",sOptions="1992 by PST",bDetected=1),result()}meta("protector","Maker (CDAT)")

================================================
FILE: dbs_min/db/MSDOS/protector_Mandrake.2.sg
================================================
function detect(){return MSDOS.compareEP("b8....8ed8b8....8ec0e8$$$$bb....b9....b8....2bc1568bf0268a3488305ee2..b4..b7..cd10")&&(sOptions="by H.P.G. Soft",bDetected=1),result()}meta("protector","Mandrake")

================================================
FILE: dbs_min/db/MSDOS/protector_MutaWWP.2.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$5e8bd683ea..83c6..060e1e0e1f33ff8cd383eb..8ec3b9....f3a45805....500e5333c951cb")&&(sVersion="1.0",sOptions="by Stefan Esser",bDetected=1),result()}meta("protector","MutaWWP")

================================================
FILE: dbs_min/db/MSDOS/protector_Mutate.2.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$58e9$$$$2ec606......eb$$1eeb$$50eb$$33c0f872..eb")?(sVersion="1.1 (16,20.05.1996)",sOptions="1996 by PReDaToR 666",bDetected=1):MSDOS.compareEP("33c0eb$$83e8..e9$$$$2e802e......eb$$1eeb$$50eb$$33c0f872..eb")?(sVersion="1.1 (18.05.1996)",sOptions="1996 by PReDaToR 666",bDetected=1):MSDOS.compareEP("e9$$$$f8e9$$$$2e8006......eb$$1eeb$$50e9$$$$33c0f873..e9")&&(sVersion="1.1 (20.05.1996)",sOptions="1996 by PReDaToR 666",bDetected=1),result()}meta("protector","Mutate")

================================================
FILE: dbs_min/db/MSDOS/protector_NOCLIP.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$ff26....9c5053518cd8a3")&&(sVersion="4.X",sOptions="by TD Technologia Digital",bDetected=1),result()}meta("protector","NOCLIP")

================================================
FILE: dbs_min/db/MSDOS/protector_NOTA.2.sg
================================================
function detect(){return MSDOS.compareEP("eb$$061e33c08ed8be....0e07bf....b9....fcf3a41f8cd3be....8bd48ed6bc....8bf436c744......36c744......8ed38be2ba....e8")&&(sVersion="1.1",sOptions="1990 by Novitex",bDetected=1),result()}meta("protector","NOTA")

================================================
FILE: dbs_min/db/MSDOS/protector_NTShell.2.sg
================================================
function detect(){return MSDOS.compareEP("2e8c1e....8cca8eda8ec2fa8ed2bc....fbe80000eb$$b9....5e8bfeeb")?(sVersion="4.0",sOptions="by Mr. ZhouHui",bDetected=1):MSDOS.compareEP("2e8c06....8cc88ed8fa8ed0bc....fbff36....268b1e....8ec333ffb9")&&(sVersion="2.01",sOptions="by Mr. ZhouHui",bDetected=1),result()}meta("protector","NTShell")

================================================
FILE: dbs_min/db/MSDOS/protector_Nodebug.2.sg
================================================
function detect(){return MSDOS.compareEP("fcbe....b9....31d22ead01c2e2")&&(sVersion="1.0 part 2",sOptions="by JVP",bDetected=1),result()}meta("protector","Nodebug")

================================================
FILE: dbs_min/db/MSDOS/protector_Novex.2.sg
================================================
function detect(){return MSDOS.compareEP("0e1f06b8....bb....0e07cd012ea1....263947..070675..2ec606......eb..06f8b8....cd212e891e....2e8c06....b8")&&(bDetected=1),result()}meta("protector","Novex Key Envelope")

================================================
FILE: dbs_min/db/MSDOS/protector_Overlay.2.sg
================================================
function detect(){return MSDOS.compareEP("fa8cc283c2..2e0116....8cc82bc22e8b0e....8bea8bf8be....8bc103c903c881c1....03c18ad983e3..2e0387")&&(sVersion="3.0",bDetected=1),result()}meta("protector","Overlay")

================================================
FILE: dbs_min/db/MSDOS/protector_PACKWIN.2.sg
================================================
function detect(){return MSDOS.compareEP("8cc0fa8ed0bc....fb060e1f2e8b0e....8bf14e8bfe8cdb2e031e....8ec3fdf3a453b8....50cb")&&(sVersion="1.0",sOptions="by Yellow Rose",bDetected=1),result()}meta("protector","PACKWIN")

================================================
FILE: dbs_min/db/MSDOS/protector_PC-Guard.2.sg
================================================
function detect(){return MSDOS.compareEP("b8....fcfdb9....be....f82e180cf5fcfc74..fccc")?(sVersion="3.05 PRO",sOptions="1994/97 by Ceklic Blagoje //COMSEC",bDetected=1):MSDOS.compareEP("2bdb81cb....f8fdbf....2bd281ca....f52e291dfcf7d3fdfccc")?(sVersion="3.05",sOptions="1994/97 by Ceklic Blagoje //COMSEC",bDetected=1):(MSDOS.compareEP("bb....f5b9....fcfdbe....fdfc2e190cfcfdf8f7d9d1d9f8f8")||MSDOS.compareEP("be....fcb9....fdf5f5ba....fc2e102cf8d1d1d1c9f7d9")||MSDOS.compareEP("33db81c3....f8fdbe....f8f5fcba....f52e111cfcfd72"))&&(sVersion="3.XX",sOptions="by Ceklic Blagoje //COMSEC",bDetected=1),result()}meta("protector","PC-Guard")

================================================
FILE: dbs_min/db/MSDOS/protector_PCOM.2.sg
================================================
function detect(){return MSDOS.compareEP("be....b9....2e8a0434..2e880446e2")&&(sVersion="2.8b2, 2.8b3 -e -i",sOptions="1999",bDetected=1),result()}meta("protector","PCOM")

================================================
FILE: dbs_min/db/MSDOS/protector_PROTECT.2.sg
================================================
function detect(){for(var e,c=[0,0,0,0,0,0],r=0,a=MSDOS.OffsetToVA(MSDOS.getEntryPointOffset()),t=0;t<80;){t++
var s=MSDOS.readByte(MSDOS.VAToOffset(a))
if(253!=s&&30!=s&&14!=s&&7!=s&&31!=s&&252!=s||(c[r]=s,r++),6==r)break
a=MSDOS.getDisasmNextAddress(a)}return(compareArrays([253,30,14,14,7,31],c)||compareArrays([253,30,14,7,14,31],c)||compareArrays([252,30,14,31,14,7],c)||compareArrays([252,30,14,14,31,7],c)||compareArrays([30,253,14,7,14,31],c)||compareArrays([30,253,14,14,7,31],c)||compareArrays([30,252,14,31,14,7],c)||compareArrays([30,252,14,14,31,7],c))&&(sVersion="5.5",bDetected=1),MSDOS.compareEP("1e0e0e1f07")||MSDOS.compareEP("1e0e0e071f")||MSDOS.compareEP("1e0e1f0e07")?186!=(e=MSDOS.readByte(MSDOS.getEntryPointOffset()+5))&&187!=e&&189!=e&&190!=e&&191!=e&&232!=e||(sVersion="5.0",sOptions="type 1",bDetected=1):MSDOS.compareEP("5053515657061e0e1f")?(sVersion="5.0",sOptions="type 2",bDetected=1):MSDOS.compareEP("0e071e0e1f")?186!=(e=MSDOS.readByte(MSDOS.getEntryPointOffset()+5))&&187!=e&&189!=e&&190!=e&&191!=e||(sVersion="4.1",bDetected=1):MSDOS.compareEP("8cdb0e0e1f07b9....e800005e81c6....89f7ac34..aae2")?(sVersion="4.0",bDetected=1):MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ed8fafcbe....0e07")?(sVersion="3.1",bDetected=1):MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ec0fafc26a1....2ea3....26a1")?(sVersion="3.0",bDetected=1):MSDOS.compareEP("e8$$$$1e068cc88ed88ec0be....8bfeb9....ac")?(sVersion="2.0",bDetected=1):MSDOS.compareEP("e8$$$$1e068cc88ed88ec02ec606")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("8cd805....50b8....501e068cda83c2..b9....be....0e1fad8bd8ad03c28ec0260117e2")?(sOptions="relocpacker",sVersion="1.0",bDetected=1):MSDOS.compareEP("1eb430cd213c..73..cd20be....e8....e8")&&(sVersion="6.0",bDetected=1),result()}meta("protector","PROTECT! EXE"),includeScript("read")

================================================
FILE: dbs_min/db/MSDOS/protector_PVAC.2.sg
================================================
function detect(){return MSDOS.compareEP("33c08ed806be....bf....b9....fcf3a5bf....b2..fa8926....bc....8bf42e8a0402c2a3....a3....8cdb")&&(sVersion="1.04",sOptions="(1993) by Fernando Papa Budzyn",bDetected=1),result()}meta("protector","PVAC")

================================================
FILE: dbs_min/db/MSDOS/protector_PassEXE.2.sg
================================================
function detect(){return MSDOS.compareEP("061E0E0E071FBE....B9....871481......EB..C7......840087......FB1F584A")&&(sVersion="2.0",bDetected=1),result()}meta("protector","PassEXE")

================================================
FILE: dbs_min/db/MSDOS/protector_Pksmart.2.sg
================================================
function detect(){return MSDOS.compareEP("ba....8cc88bc803c281c1....51b9....511e8cd38d6f..55b1..51fc4bbe....33ff8ed88ec3b1..f3a5484a79..0e078edb33f633ffcb")&&(sVersion="1.0b",sOptions="by Alex",bDetected=1),result()}meta("protector","Pksmart")

================================================
FILE: dbs_min/db/MSDOS/protector_ProtEXE.2.sg
================================================
function detect(){for(var e=MSDOS.getEntryPointOffset(),r=0;r<20;){switch(r++,MSDOS.readByte(e)){case 233:var c,e=32767<(c=MSDOS.readWord(e+1))?e-(65535-c)+2:e+c+3
break
case 232:e=32767<(c=MSDOS.readWord(e+1))?e-(65535-c)+2:e+c+3
break
case 235:e=127<(c=MSDOS.readByte(e+1))?e-(255-c)+1:e+c+2}var t=MSDOS.readByte(e)
if((187==t||190==t||191==t)&&MSDOS.compare("0600",e+1)){sVersion="3.10-3.11",bDetected=1
break}if(187!=t&&190!=t&&191!=t&&233!=t&&232!=t&&235!=t)break}return MSDOS.compareEP("9c9c5825....509d9c5825....3d....74..9c5825....0d....509d9c5825....74..ba....b0..eb")?(sVersion="2.11",bDetected=1):MSDOS.compareEP("9c505351525657551e06fcb8....cd2184c075..cd20a8..04..eb$$eb$$ba....ec0c..eb")&&(sVersion="3.0",sOptions="by T.Torfs",bDetected=1),result()}meta("protector","ProtEXE")

================================================
FILE: dbs_min/db/MSDOS/protector_Protector.2.sg
================================================
function detect(){return MSDOS.compareEP("'FCP/IV'bc....c3",-6)&&(sOptions="by FCP/IV (Future Crew)",bDetected=1),result()}meta("protector","Protector")

================================================
FILE: dbs_min/db/MSDOS/protector_Quadru-Lock.2.sg
================================================
function detect(){return MSDOS.compareEP("9c508cda5252bb....8cc8488ed805....8ec0b9....8bf12bf38bfefdf3a44050ffd1")&&(bDetected=1),result()}meta("protector","Quadru-Lock")

================================================
FILE: dbs_min/db/MSDOS/protector_R-Crypt.2.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$68....60bf....b9....b0..2e3005fec047e2..61c706........c606")&&(sVersion="0.91, 0.93",bDetected=1),result()}meta("protector","R-Crypt")

================================================
FILE: dbs_min/db/MSDOS/protector_REC.2.sg
================================================
function detect(){return MSDOS.compareEP("061eb430cd213c..73..33c00650cbbf....8b36....2bf781fe....eb$$52ba....5aeb")?(sVersion="0.33-0.35",bDetected=1):MSDOS.compareEP("061e52b8....1ecd2186e03d....73..cd200e1fb4..e8$$$$5acd21")?(sVersion="0.24-0.32",bDetected=1):MSDOS.compareEP("061eb430cd213c..73..33c00650cb")?(sVersion="0.40c2",bDetected=1):MSDOS.compareEP("061e53bb....5beb$$eb$$eb$$2ec606")&&(sVersion="0.40.5, 0.40.6",bDetected=1),result()}meta("protector","REC")

================================================
FILE: dbs_min/db/MSDOS/protector_RHC.2.sg
================================================
function detect(){return MSDOS.compareEP("8cd8ba....8eda8ec2a3....b8....cd10b8....8ec0be....bb....b9....518bfbb9....b4..acabe2")&&(sVersion="1.99.test",sOptions="1999 by Rowdy",bDetected=1),result()}meta("protector","RHC")

================================================
FILE: dbs_min/db/MSDOS/protector_ROSETINY.2.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$53bb....5beb$$eb$$582d....50061e5751e8$$$$e8$$$$5fb9....b8....2e87052e3145..47d1c8e2")?bDetected=1:MSDOS.compareEP("eb$$5053b430cd2186e03d....73..cd2006502bc08ec08506....b8....eb")&&(sVersion="0.95",bDetected=1),result()}meta("protector","RoseTiny")

================================================
FILE: dbs_min/db/MSDOS/protector_SSI-Lock.2.sg
================================================
function detect(){return MSDOS.compareEP("1e0e1fba....b4..cd211f2bc00650cb")?(sVersion="3.0 (overlay)",sOptions="1991, 1992 by Software Security, Inc.",bDetected=1):MSDOS.compareEP("2e8c06....2e8c1e....0e1f8c06....892e....893e....8936....8916....890e....891e....a3....9c5825....a3....fb0e1f")&&(sVersion="3.0",sOptions="1991, 1992 by Software Security, Inc.",bDetected=1),result()}meta("protector","SSI-Lock")

================================================
FILE: dbs_min/db/MSDOS/protector_Secure.2.sg
================================================
function detect(){var e
return MSDOS.compareEP("8CC805....50B8....50B0..068CD20683....50B0..52FC508CD28CCDBB....03EB4A8EDD8EC24DB9....33FFBE....AD35....ABE2")||MSDOS.compareEP("8CC805....50B8....50CB")?(sVersion="2.1b",bDetected=1):MSDOS.compareEP("e8$$$$fa4c904c81f3....56be....5eeb$$eb$$81f3....444490fb5bf7c2....eb$$53b9....eb")?(sVersion="0.29",bDetected=1):MSDOS.compareEP("e8")&&(e=MSDOS.readWord(MSDOS.getEntryPointOffset()+1)+MSDOS.getEntryPointOffset()+3,-1!=MSDOS.findSignature(e,MSDOS.getSize()-e,"2e8037..43e2f9"))&&(sVersion="0.19",bDetected=1),result()}meta("protector","Secure")

================================================
FILE: dbs_min/db/MSDOS/protector_SelfChk.2.sg
================================================
function detect(){return MSDOS.compareEP("1e1eb430cd21b44c3c..73..cd21be....e8....e8....b8....1f07e9....0e0e1f07fcc3")&&(sVersion="1.21",sOptions="1999 by Tsahi Chitin",bDetected=1),result()}meta("protector","SelfChk")

================================================
FILE: dbs_min/db/MSDOS/protector_Shrink.2.sg
================================================
function detect(){return MSDOS.compareEP("509CFCBE....BF....57B9....F3A48B......BE....BF....F3A4C3")?(sVersion="1.0",bDetected=1):MSDOS.compareEP("E9....509CFCBE....8BFE8CC805....8EC00657B9")&&(sVersion="2.0",bDetected=1),result()}meta("protector","Shrink")

================================================
FILE: dbs_min/db/MSDOS/protector_SnoopStop.2.sg
================================================
function detect(){return MSDOS.compareEP("..E9....EB..20......73..20....411A05")&&(sVersion="1.15",bDetected=1),result()}meta("protector","SnoopStop")

================================================
FILE: dbs_min/db/MSDOS/protector_SuckStop.2.sg
================================================
function detect(){return MSDOS.compareEP("EB......BE....B430CD21EB..9B")?(sVersion="1.11",bDetected=1):MSDOS.compareEP("'KAOT'58eb$$be....b430cd21eb$$3c..77..cd204e75..6a..0e6a..fec3cf")?(sVersion="1.11r",sOptions="1997 by KA0T //N0Ps",bDetected=1):MSDOS.compareEP("'KAOT'5ceb$$be....b430cd21eb$$3c..77..cd204e75..c706........1e6a..0fa1")?(sVersion="1.10r",sOptions="1997 by KA0T //N0Ps",bDetected=1):MSDOS.compareEP("'KAOT'5ceb$$be....b430cd21eb$$3c..77..cd204e75..6a..0e6a..fec3cf")?(sOptions="1997 by KA0T //N0Ps",bDetected=1):MSDOS.compareEP("3a324a1d....fb37fb1d....1d....be....81ee....6a..593a32")&&(sVersion="1.0",sOptions="1997 by KA0T //N0Ps",bDetected=1),result()}meta("protector","SuckStop")

================================================
FILE: dbs_min/db/MSDOS/protector_TCEC.2.sg
================================================
function detect(){return MSDOS.compareEP("e4640c..e66466fae800005d81ed....b8....8bd48da6....b9....8bdc2ec00f..2e30072e000f44e2")?(sVersion="3.59r5",sOptions="by ThE CLERiC! //LZ0, EVD",bDetected=1):MSDOS.compareEP("54434543b9....83c4..33c0509df326ace3..eb")&&(sVersion="3.55",sOptions="by ThE CLERiC! //LZ0, EVD",bDetected=1),result()}meta("protector","TCEC")

================================================
FILE: dbs_min/db/MSDOS/protector_TraceLock.2.sg
================================================
function detect(){return MSDOS.compareEP("1e06e8$$$$0e0e1f07b4..b9....be....8bfefcac32c4d2c802e1aae2..b8....35....8706....c3")&&(sVersion="0.9",bDetected=1),result()}meta("protector","TraceLock")

================================================
FILE: dbs_min/db/MSDOS/protector_Trap.2.sg
================================================
function detect(){return MSDOS.compareEP("e800005b83c3..908bd3e8$$$$5b2e803f..74..90908bdab9....eb")?(sVersion="1.21",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("8cd0bb....8ed333c98ed0b9....eb$$e2..33d2")?(sVersion="1.18",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("8cd0bb....8ed333d28ed0b9....eb$$e2..33d2")?(sVersion="1.X",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("b9....eb$$e2$$eb..90cd20e2")?(sVersion="1.15",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("e800005b83c3..908bd3e8$$$$5b2e803f..74..90908bdab9....2ec0")?(sVersion="1.20",sOptions="1998 by Christoph Gabler",bDetected=1):MSDOS.compareEP("05....eb$$bb....81ebfa..85f9eb$$eb$$39fbeb")?(sVersion="1.22",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("81ea....eb$$b9....81c1....39d0bb....85c3b9....f505....bb....ba....81c2")?(sVersion="1.23",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("eb$$39c281c3....eb$$81c3....39cc81ea....39e2b9....85da39e9eb")?(sVersion="1.24",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("8cd1ba....8ed233d28ed18bcaeb")?(sVersion="1.13",sOptions="by Christoph Gabler",bDetected=1):MSDOS.compareEP("e8$$$$5d81ed....458cd68bfc0f23c70f23ceb0..e6..fa0e17")?(sVersion="1.26b1",sOptions="2000 by Christoph Gabler",bDetected=1):MSDOS.compareEP("8cd1ba....8ed233d28ed18bcab9....eb")&&(sVersion="1.14",sOptions="by Christoph Gabler",bDetected=1),result()}meta("protector","Trap")

================================================
FILE: dbs_min/db/MSDOS/protector_Un2pack.2.sg
================================================
function detect(){return MSDOS.compareEP("9cba....2d....81e1....81f3....b4..9db8....ba....8cdb03d83b1e....73..83eb..fa8ed3bc")&&(sVersion="2.0",sOptions="1994 by The CCS-Productions",bDetected=1),result()}meta("protector","Un2pack")

================================================
FILE: dbs_min/db/MSDOS/protector_UnPackStop.2.sg
================================================
function detect(){var e
return MSDOS.compareEP("3670..b8....81c0....bb....43e8....5f83c7..0e570656cbbe....eb")?(sVersion="0.9X",sOptions="by Szaszi (Szabo Laszlo)",bDetected=1):MSDOS.compareEP("68....c3")?(e=MSDOS.readWord(MSDOS.getEntryPointOffset()+1)-32,MSDOS.compare("bf....e2..a541b9....2e31154747e2",e)?(sVersion="0.95",sOptions="by Szaszi (Szabo Laszlo)",bDetected=1):MSDOS.compare("b9....39fe2e31154747eb",e)&&(sVersion="0.95 freeware",sOptions="by Szaszi (Szabo Laszlo)",bDetected=1)):MSDOS.compareEP("4e46555dbb....70..b8....81c0....4c44cd213efc268b2e....8ec5")||MSDOS.compareEP("b8....40bb....4be8$$$$be....eb$$5f83c7..0e570656cb")?(sVersion="0.94",sOptions="by Szaszi (Szabo Laszlo)",bDetected=1):MSDOS.compareEP("424a5159bb....4bb8....404a42cd2190fc")&&(sVersion="0.96",sOptions="by Szaszi (Szabo Laszlo)",bDetected=1),result()}meta("protector","UnPackStop")

================================================
FILE: dbs_min/db/MSDOS/protector_XDOC.2.sg
================================================
function detect(){return MSDOS.compareEP("2e8c16....eb00ea....ffff")&&(sVersion="1.20",bDetected=1),result()}meta("protector","XDOC")

================================================
FILE: dbs_min/db/MSDOS/protector_aPatch.2.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$fde8$$$$ffc75e83ee..e8$$$$5d8176......c646....eb$$ffe5")&&(sVersion="0.05-0.33",bDetected=1),result()}meta("protector","aPatch")

================================================
FILE: dbs_min/db/MSDOS/protector_cramble.2.sg
================================================
function detect(){return MSDOS.compareEP("E9....609CFC..................01..012A..FF")&&(sVersion="0.2b3",bDetected=1),result()}meta("protector","cramble")

================================================
FILE: dbs_min/db/MSDOS/protector_iLUCRYPT.2.sg
================================================
function detect(){return MSDOS.compareEP("8becfac746......4c4cc3fbbf....b8....2e3105d1c84f")?(sVersion="4.01X",sOptions="by Christian Schwarz",bDetected=1):MSDOS.compareEP("bf....b8....2e3105d1c84f81ff....73..b7..df53..961e")&&(sVersion="4.017",sOptions="by Christian Schwarz",bDetected=1),result()}meta("protector","iLUCRYPT")

================================================
FILE: dbs_min/db/MSDOS/protector_nbuild.2.sg
================================================
function detect(){return MSDOS.compareEP("B9....BB....C0....80....43E2")&&(sVersion="1.0",bDetected=1),result()}meta("protector","nbuild")

================================================
FILE: dbs_min/db/MSDOS/runtime_VROOMM.4.sg
================================================
function detect(){return MSDOS.compareOverlay("46424f56")&&(bDetected=1),result()}meta("runtime","VROOMM (Virtual Real-time Object-Oriented Memory)")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_ANS2ALL.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$be....bf....b9....8ccd81ed....8bdd83eb..8bd3fcfa909090909090")&&(sVersion="0.9beta",sOptions="by ZeroCoder //XG",bDetected=1),result()}meta("self-displayer","ANS2ALL")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_GIFEXE.1.sg
================================================
function detect(){return MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06")&&MSDOS.compareOverlay("'GIF87a'")&&MSDOS.isSignaturePresent(MSDOS.getSize()-6,6,"'GIFEXE'")&&(sVersion="1.0",sOptions="1990, 1991 by Steve Enns and Dan Magosse",bDetected=1),result()}meta("self-displayer","GIFEXE")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_RELETTER.1.sg
================================================
function detect(){return MSDOS.compareEP("e9$$$$bc....bf....bb....8a0784c075..e9....438a073c..74..3c..74..89da438a073c..74")&&(sVersion="1.0",sOptions="1993 by Hans J. Baer (converted to exe)",bDetected=1),result()}meta("self-displayer","RELETTER")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_SimplyWare.1.sg
================================================
function detect(){var e
return MSDOS.compareEP("b8....8ed88c06....fa8ed0bc....fbb430cd21a3....0650b434cd218c06....8bc3485b86df81fb")&&(e=MSDOS.getOverlayOffset(),-1!=MSDOS.findSignature(e-4096,4096,"'Simply Docs Viewer'")?(sName="Simply Docs Viewer",sVersion="3.0",sOptions="1990-94 by SimpleWare",bDetected=1):MSDOS.compareOverlay("'Simply Help!'")&&(sName="Simply Help! TSR Viewer",sOptions="1990-94 by SimpleWare",bDetected=1)),result()}meta("self-displayer","")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_TXT2COM.1.sg
================================================
function detect(){return MSDOS.compareEP("e8$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7")?(sVersion="1.1",sOptions="1987 by Keith P. Graham",bDetected=1):MSDOS.compareEP("8d26....e8$$$$b4..cd103c..74..c706........c706........3c..74..3c..74..8d16....b409cd21cd20c706")&&(sVersion="2.06",sOptions="1989 by Keith P. Graham",bDetected=1),result()}meta("self-displayer","TXT2COM + generic com2exe")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_TXTmaker.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$b4..33dbcd1080fc..74..b0..eb$$b44ccd21")&&(sVersion="1.22",sOptions="1991 by Jack A. Orman",bDetected=1),result()}meta("self-displayer","TXTmaker")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_Txt2Exe.1.sg
================================================
function detect(){return MSDOS.compareEP("8cc88ed88cc08ed0bc....b4..cd10a2....3c..74..268a1e....0e07")&&(sVersion="4.01",sOptions="1996 by Wang Lisan",bDetected=1),result()}meta("self-displayer","Txt2Exe")

================================================
FILE: dbs_min/db/MSDOS/self-displayer_self-displayer.1.sg
================================================
function detect(){return MSDOS.compareEP("b8....cd10b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb")&&(sOptions="1997 //d4c",bDetected=1),result()}meta("self-displayer","Unknown")

================================================
FILE: dbs_min/db/MSDOS/sfx_ARC.1.sg
================================================
function detect(){return MSDOS.compareEP("8CC88CDB8ED88EC089......2BC3A3....89......BE....B9....BF....BA....FCAC32C28AD8")?(sVersion="1.10",sOptions="1986-89 by Wayne Chin and Vernon D. Buerg",bDetected=1):MSDOS.compareEP("558bec83ec..32c02ea2....2ea2....2ea2....8cd78ec78d7e..be....fcac3c..74..3c..76..3c..75..ac")||MSDOS.compareEP("558bec83ec..a1....2ea3....2ec606......8cd78ec78d7e..be....fcac3c..74..3c..76..3c..75..ac")?(sOptions="1988-89 by NoGate Consulting",bDetected=1):MSDOS.compareEP("bb....8edb8c06....c706........8cd02bc3b9....d3e003c4fa8ed38be0fb05....b9....d3e8408cd303c3a3")&&(sVersion="7.1",sOptions="1990 by System Enhancement Associates (SEA), Inc.",bDetected=1),result()}meta("sfx","ARC SFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_ARJ.1.sg
================================================
function detect(){return MSDOS.compare("'RJSX'",28)?(sVersion="old",bDetected=1):MSDOS.isSignaturePresent(0,Math.min(1e3,MSDOS.getSize()),"'aRJsfX'")&&(bDetected=1),result()}meta("sfx","ARJ")

================================================
FILE: dbs_min/db/MSDOS/sfx_ChSFX.1.sg
================================================
function getChSFXVersion(){var e="",$=MSDOS.findString(0,Math.min(256,MSDOS.getSize()),"ChSFX")
return e=-1!=$?(e=MSDOS.getString($+6)).replace(/\s+$/,""):e}function detect(){return(MSDOS.compareEP("ba....e8$$$$1e0e1fe8$$$$52568bf2fcb4..eb$$ac0ac075")||MSDOS.compareEP("8d16....e8$$$$1e0e1fe8$$$$52568bf2fcb4..eb$$ac0ac075"))&&(sVersion=getChSFXVersion(),bDetected=1),result()}meta("sfx","CHZ SFX (ChSFX)")

================================================
FILE: dbs_min/db/MSDOS/sfx_EXARJ.1.sg
================================================
function detect(){return MSDOS.compareEP("fcbb....e8....b430cd218bd8063c..72..8e06....33c08bf8b9....f2aeae75..40af061f8bd775..e8")&&(sOptions="1994 by Jakub Jelinek",bDetected=1),result()}meta("sfx","EXARJ small")

================================================
FILE: dbs_min/db/MSDOS/sfx_ICE.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$be....8bfe8b0e....8b16....b8....50fcad33c2ab8bd0e2")&&(sVersion="1.0",bDetected=1),result()}meta("sfx","ICE SFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_LH.1.sg
================================================
function detect(){return MSDOS.compare("'LH'27's SFX '",36)&&(bDetected=1),result()}meta("sfx","LH")

================================================
FILE: dbs_min/db/MSDOS/sfx_LHA.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")?(sVersion="2.05L, 2.10-2.13, 2.55",bDetected=1):MSDOS.compareEP("eb$$fcbc....8cc805....8ec0e8....bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8")?(sVersion="2.13",bDetected=1):MSDOS.compareEP("eb$$00fcbc....8cc805....8ec0eb$$bb....e8....061fb430cd218bd81e3c..72..368e06....33c08bf8b9....f2aeae")?(sVersion="2.13S",sOptions="converted to exe",bDetected=1):MSDOS.compareEP("e9$$$$fcbc....8cc805....8ec0b8....cd21be....268816....26c706........ac")&&(sVersion="1.13L",sOptions="converted to exe",bDetected=1),result()}meta("sfx","LHA SFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_LHarc.1.sg
================================================
function detect(){return MSDOS.compareEP("eb$$fcbc....bb....e8....8cc82e0306....8ed88ec005....2e3b06....76..bb....e9....bf....33d28bc2b9....d1e873..35....e2..abfec275..be....bf....b8....ba....2e3a24")?(sVersion="1.13S, 1.13L",bDetected=1):MSDOS.compareEP("e9$$$$fcbc....bb....e8....8cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")?(sVersion="1.14c",bDetected=1):MSDOS.compareEP("e9$$$$fcbc....e8....9090908cc805....8ec0b8....cd21be....268816....26c706........ace8....74..263a06")?bDetected=1:MSDOS.compareEP("eb$$0d....fcbc....bb....e8....8cc82e0306....8ed88ec005....2e3b06....76..bb....e9")&&(sVersion="1.14c",bDetected=1),result()}meta("sfx","LHarc SFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_PKSFX.1.sg
================================================
function detect(){return MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf0")&&MSDOS.compareOverlay("1a")&&(sOptions="ARC",bDetected=1),result()}meta("sfx","PKSFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_PKZIP-SFX.1.sg
================================================
function detect(){return MSDOS.compareEP("fc2e8c......a1....8ccb81c3....3bc372..2d....2d....fabc....8ed0fb2d....a3....8ec0e8....a1")&&(sVersion="1.1(1989-90)",bDetected=1),result()}meta("sfx","PKZIP-SFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_PKZIP_mini-sfx.1.sg
================================================
function detect(){return MSDOS.compareEP("b9....bf....2bcf32c0f3aab430cd21a3....8926....e8....b8....e8....e8")&&(sVersion="2.04c(1992)",bDetected=1),MSDOS.compareEP("b8....a3....bf....b9....2bcf32c0f3aab430cd21a3....a1....a3....e8....b8")&&(sVersion="1.1(1990)",bDetected=1),result()}meta("sfx","PKZIP mini-sfx")

================================================
FILE: dbs_min/db/MSDOS/sfx_SFX.1.sg
================================================
function detect(){return MSDOS.compareEP("fc1e8a1e....16070e1f33d2e8....bd....885e..8f46..bf....33d28bc2b9....d1e873..35....e2..abfec275..be....e8")&&(sVersion="3.33",sOptions="(LHA archive) by LARC",bDetected=1),result()}meta("sfx","SFX")

================================================
FILE: dbs_min/db/MSDOS/sfx_ZOO.1.sg
================================================
function detect(){return MSDOS.compareEP("ba....2e8916....8b2e....8eda8c06....b8....8cda05....83c3..8ed28be0e8")&&MSDOS.compareOverlay("'ZOO'............'Archive'")&&(bDetected=1),result()}meta("sfx","ZOO SFX")

================================================
FILE: dbs_min/db/MSDOS/unknown_immunizer.1.sg
================================================
function detect(){return MSDOS.compareEP("be....e9$$$$501e06b8....cd21fc80fc..75..3c..75..b4..cd213c")?(sOptions="type 1",bDetected=1):MSDOS.compareEP("be....8e06....8cdd31ff8bc7b9....f2aeae75..af061f")&&(sOptions="type 2",bDetected=1),result()}meta("immunizer","unknown immunizer")

================================================
FILE: dbs_min/db/MSDOS/virus.1.sg
================================================
function detect(){return MSDOS.compareEP("e8....5e83ee..b8....cd213d....75..0e1f81c6....bf....b9....fcf3a4061f06b8....50cb")?(sName="TaiPan.438",bDetected=1):MSDOS.compareEP("e9$$$$9090be....8bfee8$$$$5081c7....b9....b8....902e31054790e2")&&(sName="Burglar.1150",bDetected=1),result()}meta("virus","")

================================================
FILE: dbs_min/db/NE/_NE.0.sg
================================================
function detect(){return NE.isVerbose()&&(sName=NE.getOperationSystemName(),sVersion=NE.getOperationSystemVersion(),sOptions=NE.getOperationSystemOptions(),bDetected=1),result()}meta("operation system","Windows")

================================================
FILE: dbs_min/db/NE/_init
================================================
var File=NE,X=NE

================================================
FILE: dbs_min/db/NE/compiler_Borland_C++.1.sg
================================================
function detect(){return NE.compareEP("53510633c0509a........5807595b9a........0bc075..e9")?(sOptions="1994 type 1",bDetected=1):NE.compareEP("893e....56571e510656e3..1e33c050519a........91e3")?(sOptions="1994 type 2",bDetected=1):NE.compareEP("53510633c050e8....5807595b9a........0bc075..e9")?(sOptions="1993 type 1",bDetected=1):NE.compareEP("b8....8ed853510633c0509a........5807595b9a........0bc075..e9")?(sOptions="1993 type 2",bDetected=1):NE.compareEP("893e....56571e510656e3..1e33c05051900ee8....91e3")&&(sOptions="1991",bDetected=1),result()}meta("compiler","Borland C++")

================================================
FILE: dbs_min/db/NE/compiler_Borland_Pascal.1.sg
================================================
function detect(){return NE.compareEP("9a........9a........9a........9a........9a........5589e56a..9a........ff36....bf....1e5768....9a")&&(sVersion="7.1",bDetected=1),result()}meta("compiler","Borland Pascal")

================================================
FILE: dbs_min/db/NE/compiler_Watcom_C.1.sg
================================================
function detect(){return NE.compareEP("e9$$$$9a........0bc074..8c06....5756065352891e....8c06....2bc0509a")||NE.compareEP("e9$$$$b9....51b9....51b9....51b9....5153508cd18bdc83c3..8cd2b8....ea")||NE.compareEP("e9$$$$535152565706558becb9....51b9....51b9....51b9....5153508cd18bdc83c3..8cd2b8....9a")?(sOptions="1991",bDetected=1):NE.compareEP("e9$$$$9a........0bc075..e9....8c06....575606535253be....8936....8c1e....268a078804")?(sOptions="1993",bDetected=1):NE.compareEP("eb$$9a........09c075..e9....8c06....5756065352891e....8c06....29c0509a")||NE.compareEP("eb$$5351525657065589e553508cd189e383c3..8cd23eb8....9a")?(sName="Watcom C/C++16",sOptions="1995",bDetected=1):NE.compareEP("e9$$$$535152565706558bec53508cd18bdc83c3..8cd2b8")?(sOptions="1992",bDetected=1):NE.compareEP("eb$$535152565706558bec53508cd18bdc83c3..8cd2b8")?(sName="Open Watcom C/C++16 for OS/2",sOptions="2002",bDetected=1):NE.compareEP("eb$$9a........0bc075$$8c06....575606535253be")&&(sName="Open Watcom C/C++16 for Windows",sOptions="2002",bDetected=1),sLang=-1!==sName.indexOf("C++")?"C":"C++",result()}meta("compiler","Watcom C")

================================================
FILE: dbs_min/db/NE/game_engine_DirectorPlayer.1.sg
================================================
function detect(){return NE.compareOverlay("140002004d11650000000200c0252500")&&(sVersion="1.0-3.0",bDetected=1),result()}meta("game engine","Director Player")

================================================
FILE: dbs_min/db/NE/installer_CoktelVisionInstaller.1.sg
================================================
function detect(){return NE.compareOverlay("65000300ea010400fa0c0300e6010400")&&(bDetected=1),result()}meta("installer","Coktel Vision")

================================================
FILE: dbs_min/db/NE/installer_Setup-Specialist.1.sg
================================================
function detect(){return NE.compareEP("eb$$53510633c0509a........5807595b9a........0bc075..e9")?(sOptions="1995-1998 by Thilo-Alexander Ginkel",bDetected=1):NE.compareEP("eb$$53510633c050900ee8....5807595b9a........0bc075..e9")&&(sOptions="1995-1997 by Thilo-Alexander Ginkel",bDetected=1),result()}meta("installer","Setup-Specialist")

================================================
FILE: dbs_min/db/NE/library_MS_RTL.4.sg
================================================
function detect(){return NE.compareEP("fca3....891e....49890e....bb....8c1f83e4..8967..b8....508967..f7d0508967..8967..8926....1e68....1e68....9a")?(sOptions="1990 type 1",bDetected=1):NE.compareEP("558bec508bc416509a........5886e0a3....1e68....1e68....9a")?(sOptions="1988 type 1",bDetected=1):NE.compareEP("fc8926....8926....8c1e....49890e....a3....891e")?(sOptions="1988 type 2",bDetected=1):NE.compareEP("fc8926....49890e....a3....891e....1e68....1e68....9a")?(sOptions="1988 type 3",bDetected=1):NE.compareEP("c8......57561eb8....8ed89a")?(sOptions="1990 type 2",bDetected=1):NE.compareEP("c8......5756bb....8ec326a3....9a")&&(sOptions="1990 type 3",bDetected=1),result()}meta("library","MS RTL")

================================================
FILE: dbs_min/db/NE/sfx_ARC_SFX.1.sg
================================================
function detect(){return NE.compareEP("a3....891e....890e....8b0e....bb....e8....72..8b0e....bb....e8....73..b9....890e....bb....e8")&&(sOptions="1991 by SEA, Inc.",bDetected=1),result()}meta("sfx","ARC SFX")

================================================
FILE: dbs_min/db/NE/sfx_PKZIP-SFX.1.sg
================================================
function detect(){return NE.compareEP("fca3....891e....49890e....bb....8c1f83e4..8967..b8....508967..f7d0508967..8967..8926....508bc416509a")&&(sOptions="1989-91 by PKWARE Inc.",bDetected=1),result()}meta("sfx","PKZIP-SFX")

================================================
FILE: dbs_min/db/NE/sfx_Sydex_SFX.1.sg
================================================
function detect(){return NE.compareEP("b8....8ec0e8....ba....3d....72..e8....26a3....26890e....268916....68....1ee8....83c4..ba....85c074")&&(sOptions="1995 by Sydex, Inc.",bDetected=1),result()}meta("sfx","Sydex SFX")

================================================
FILE: dbs_min/db/NPM/_NPM.0.sg
================================================
function detect(){return NPM.isVerbose()&&(sType="operation system",sName=NPM.getOperationSystemName(),sVersion=NPM.getOperationSystemVersion(),sOptions=NPM.getOperationSystemOptions(),bDetected=1),result()}meta("format","NodeJS package")

================================================
FILE: dbs_min/db/NPM/_init
================================================
var File=NPM,X=NPM

================================================
FILE: dbs_min/db/NPM/language_JavaScript.5.sg
================================================
function detect(){return NPM.isArchiveRecordPresentExp("(.*?).js")&&(bDetected=1),result()}meta("language","JavaScript")

================================================
FILE: dbs_min/db/NPM/language_TypeScript.5.sg
================================================
function detect(){return NPM.isArchiveRecordPresentExp("(.*?).ts")&&(bDetected=1),result()}meta("language","TypeScript")

================================================
FILE: dbs_min/db/NPM/package_PackageName.1.sg
================================================
function detect(){var e=NPM.getPackageJsonRecord("name")
return e&&(sName=e,sVersion=NPM.getPackageJsonRecord("version"),bDetected=1),result()}meta("package","")

================================================
FILE: dbs_min/db/PDF/_PDF.0.sg
================================================
function detect(){return sName=PDF.getFileFormatName(),sVersion=PDF.getFileFormatVersion(),sOptions=PDF.getFileFormatOptions(),bDetected=1,result()}meta("format","PDF")

================================================
FILE: dbs_min/db/PDF/_init
================================================
var File=PDF,X=PDF

================================================
FILE: dbs_min/db/PDF/converter_markdown-pdf.3.sg
================================================
function detect(){return PDF.compare("'%PDF-1.4'0A'1 0 obj'0A'<<'0A'/Title ('FEFF')'0A'/Creator ('FEFF')'0A'/Producer ('FEFF00'Q'00't'00' '00'5'00'.'00'5'00'.'00'1)'")&&(sVersion="11.0.0",bDetected=1),result()}meta("converter","markdown-pdf")

================================================
FILE: dbs_min/db/PDF/converter_mdpdf.3.sg
================================================
function detect(){return PDF.compare("'%PDF-1.4'0A'%'D3EBE9E10A'1 0 obj'0A'<</Title '++0A'/Creator (Mozilla/5.0 '5C'(Windows NT 10.0; Win64; x64'5C') AppleWebKit/537.36 '5C'(KHTML, like Gecko'5C') HeadlessChrome/138.0.0.0 Safari/537.36)'0A'/Producer (Skia/PDF m138)")&&(sVersion="3.1.0",bDetected=1),result()}meta("converter","mdpdf")

================================================
FILE: dbs_min/db/PDF/format_HeaderComment.2.sg
================================================
function detect(){var e=PDF.getHeaderCommentAsHex()
e&&_setResult("complier","HeaderComment",e,"")}meta("format","pdf")

================================================
FILE: dbs_min/db/PDF/format_PersonalData.5.sg
================================================
function detect(){for(var t=PDF.getStringValuesByKey("/Author"),e=0;e<t.length;e++)_setResult("personal data","Author","",t[e])}meta("format","pdf")

================================================
FILE: dbs_min/db/PDF/format_RTSN_secure.1.sg
================================================
function detect(){-1!=PDF.findSignature(0,PDF.getSize(),"'obj'0D'<< '0D'/Filter /RTSN_secure '0D'/V 1 '0D'/pw (BLUEMOON)'0D'>> '0D'endobj'")&&_setResult("protector","RTSN_secure","1.0","")}meta("format","pdf")

================================================
FILE: dbs_min/db/PDF/format_Tools.2.sg
================================================
function detect(){for(var e=PDF.getStringValuesByKey("/Creator"),t=0;t<e.length;t++)_setResult("tool","Creator",PDF.getHeaderCommentAsHex(),e[t])
for(var r=PDF.getStringValuesByKey("/Producer"),t=0;t<r.length;t++)_setResult("tool","Producer",PDF.getHeaderCommentAsHex(),r[t])}meta("format","pdf")

================================================
FILE: dbs_min/db/PE/ACE.6.sg
================================================
function detect(){return detect_ACE(0),result()}includeScript("ACE")

================================================
FILE: dbs_min/db/PE/Cab.6.sg
================================================
function cab_resource(e){for(var r=0;r<PE.resource.length;r++)if(detect_Cab(PE.resource[r].Offset,PE.resource[r].Size,e))return!0
return!1}function detect(e){if(!detect_Cab(PE.getOverlayOffset(),PE.getOverlaySize(),e)&&!cab_resource(e)){var r=PE.section[".rsrc"]
if(r&&r.FileOffset>r.VirtualSize)for(var t=(t=r.FileOffset+r.VirtualSize)+511&-512;!detect_Cab(t,r.FileSize,e)&&t>r.FileOffset&&!_isStop();)t-=512}return result()}includeScript("cab")

================================================
FILE: dbs_min/db/PE/Microsoft.6.sg
================================================
function detect(){var i="",r="",v="",e="",s="",o="",n="",c="",A="",p="",t="",C="",E="",a="",P="",h="",$="",m="",O="",l="",y=""
function R(){return PE.findString(PE.section[0].FileOffset,PE.getSize(),".NETCoreApp,Version=v")}function V(i){i=(i=(i=PE.getString(i).split("=")[1])&&"v"!==i[0]&&7<i.length?"":i).substr(1)
return File.cleanString(i)}PE.isNet()?(-1!=(B=PE.findString(PE.section[0].FileOffset,PE.getSize()-PE.getOverlaySize(),".NETFramework,Version=v"))?(E=".NET Framework",(a=String(V(B)))&&4<=a.length&&"4"!==a[1]&&"3"!==a[1]&&"2"!==a[1]&&"."!==a[2]&&isNaN(Number(a[3]))&&(a="")):PE.isRichSignaturePresent()&&PE.isTLSPresent()&&-1!=(B=R())&&PE.compare("18",B-1)&&"v4.0"===PE.getNETVersion().substr(0,4)&&(E=".NET Core",2<=(a=V(B)).length)&&isNaN(Number(a[1]))&&(a=""),a=File.cleanString(a),E=PE.isSignaturePresent(0,PE.getSize(),"'.NETCoreApp'")?".NET Core":E||".NET Framework",B=(B=File.cleanString(PE.getNETVersion())).substring(1,B.length),a+=(a?", ":"")+"CLR "+B,PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....00000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000")&&(i="Microsoft Linker")):(B=!1,(S=PE.section[".rdata"])&&PE.isFunctionPresent("LoadLibraryExW")&&PE.isFunctionPresent("ShellExecuteW")&&-1!==PE.findString(S.FileOffset,S.FileSize,"__clrcall")&&(PE.isSignatureInSectionPresent(S.Number,"002E004E0045005400200043006F00720065")||PE.isSignatureInSectionPresent(S.Number,"2E004E00450054002000520075006E00740069006D006500"))&&(a="Loader"),S="DotNetRuntimeDebugHeader",M=(F=PE.section[1])&&(PE.isExportFunctionPresent(S)||PE.compare("48 8d 05",F.FileOffset)&&(PE.section[".managed"]||PE.section.hydrated)),(a=PE.compareEP("48")&&PE.compare("90",PE.getEntryPointOffset()-1)&&PE.isRichSignaturePresent()&&-1!==PE.getExportSection()&&6<=PE.getNumberOfSections()&&((M||PE.isSignatureInSectionPresent(F.Number,"'System.' %% %% %% %% %% %%")&&(PE.isSignatureInSectionPresent(F.Number,"'DOTNET_' %%")||PE.isSignatureInSectionPresent(F.Number,"'D'00'O'00'T'00'N'00'E'00'T'00'_'")))&&(B=!0,P=M?"debug":"release",".text"!==PE.section[0].Name||".rdata"!==F.Name&&".managed"!==F.Name||!PE.isDll()&&1===PE.getNumberOfExports()&&PE.getExportFunctionName(0)!==S)&&(P=P.append("modified")),-1!=(M=R()))?V(M):a)===""&&P===""||(E=".NET "+(B?"Native":"Core")),B&&_setLang("Native MSIL/C#"))
var F=!1,d=0
if((msvcRuntimeLibrary=PE.isLibraryPresentExp(/^MSVCR/i))&&(d=PE.isLibraryFunctionPresent(msvcRuntimeLibrary[0],"__wgetmainargs")),PE.is64())PE.compareEP("4883EC2885D248895C243048896C243848897424408BDA488BE9498BF0751E3915")||PE.compareEP("4883EC5848895C247048897C247866813D")||PE.compareEP("4883EC3848895C245048897C2458FF15")||PE.compareEP("488BC44881EC........4889581848897820488D4888FF15")?(s="14.00",F=!0):(PE.compareEP("4883EC28E8........4883C428E9$$$$$$$$48895C24")||PE.compareEP("4883EC28E8........E8........4883C428C3")||PE.compareEP("48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8")||PE.compareEP("4C894424188954241048894C24084883EC28837C2438017505E8"))&&(s="16.00",F=!0)
else if(PE.compareEP("558BEC51C745FC01000000837D0C007510833D"))sOptions=PE.compareEP("00",-4)?m.append("libcd"):PE.compareEP("00",-8)?m.append("libcmtd"):m.append("msvcrtd"),s="12.00",F=!0
else if(PE.compareEP("558BEC538B5D08568B750C578B7D1085F67509833D"))o=PE.compareEP("CA",-1)?o.append("libc"):PE.compareEP("59",-7)?o.append("libcmt"):o.append("msvcrt"),s="12.00",F=!0
else if(PE.compareEP("558BEC6AFF68........68........64A100000000506489250000000083")){switch(PE.readByte(PE.getEntryPointOffset()+31)){case 16:L=PE.compareEP("83",107)?(o=o.append("libc"),116):(o=o.append("libcmt"),133),PE.compareEP("E8",L)&&(o=o.append("wmain"),--L),PE.compareEP("FF",L+25)&&(o=o.append("glob"))
break
case 32:o=o.append("msvcrt"),d&&(o=o.append("wmain")),PE.compareEP("FF",109)&&(o=o.append("glob"))
break
case 88:L=PE.compareEP("33",87)?(o=o.append("libc"),116):(o=o.append("libcmt"),134),PE.compareEP("E8",L)&&(o=o.append("wWinMain"))
break
case 104:o=o.append("msvcrt"),PE.compareEP("5F",45)&&(o=o.append("wWinMain"))
break
case 144:o=o.append("libcd"),PE.compareEP("E8",241)&&(o=o.append("wWinMain"))
break
case 148:o=o.append("msvcrtd"),PE.compareEP("83",233)&&(o=o.append("wWinMain"))
break
case 164:L=PE.compareEP("00",125)?(o=o.append("libcd"),160):(o=o.append("libcmtd"),179),PE.compareEP("E8",L)&&(o=o.append("wWinMain"))
break
case 224:switch(PE.readByte(PE.getEntryPointOffset()+38)){case 184:o=o.append("libcd"),PE.compareEP("E8",241)&&(o=o.append("wmain"))
break
case 199:o=o.append("msvcrtd"),d&&(o=o.append("wmain")),PE.compareEP("FF",121)&&(o=o.append("glob"))}break
case 232:o=o.append("libcd")
break
case 240:L=PE.compareEP("00",125)?(o=o.append("libcd"),160):(o=o.append("libcmtd"),179),PE.compareEP("E8",L)&&(o=o.append("wmain"),--L),PE.compareEP("FF",L+25)&&(o=o.append("glob"))}s="11.00-13.10",F=!0}else if(PE.compareEP("6A0C68........E8........33C0408945E48B750C33FF3BF7750C393D")){switch(PE.readByte(PE.getEntryPointOffset()-1)){case 192:o=o.append("libc")
break
case 0:o=o.append("libcmt")}s="13.10",F=!0}else if(PE.compareEP("6A..68........E8........66813D"))s="13.10",F=!0
else if(PE.compareEP("6A..68........E8........BF940000008BC7E8")){var g,L=0
switch(PE.readByte(PE.getEntryPointOffset()+1)){case 24:g="wmain",L=197
break
case 96:g="wWinMain",L=199}L&&(PE.compareEP("6A",L)?(o=o.append("libcmt"),L+=62):(o=o.append("libc"),L+=69),PE.compareEP("E8",L))&&(o=o.append(g)),s="13.10",F=!0}else if(PE.compareEP("8BFF558BEC837D0C017505E8"))o=PE.compareEP("8B",16)?o.append(PE.compareEP("E8",74)?"libcmtd":"msvcrtd"):o.append(PE.compareEP("8B",35)?"libcmt":"msvcrt"),s="15.00-16.00",F=!0
else if(PE.compareEP("8BFF558BECE8......00E8......005DC3")){switch(PE.readByte(PE.getEntryPointOffset()+58)){case 136:o=o.append("msvcrtd","wWinMain"),s="15.00"
break
case 140:o=o.append("msvcrtd"),s="15.00"
break
case 144:o=o.append("msvcrtd"),d&&(o=o.append("wWinMain")),s="16.00"
break
case 148:o=o.append("libcmtd"),PE.compareEP("52",145)&&(o=o.append("wWinMain")),s="15.00"
break
case 152:o=o.append("libcmtd"),PE.compareEP("6A",645)&&(o=o.append("wWinMain")),s="16.00"
break
case 228:o=o.append("msvcrtd"),d&&(o=o.append("wmain")),PE.compareEP("FF",-155)&&(o=o.append("glob")),s="15.00-16.00"
break
case 232:o=o.append("libcmtd"),s=PE.compareEP("E8",92)?(PE.compareEP("E8",184)&&(o=o.append("wmain"),d=1),"15.00"):(PE.compareEP("E8$$$$$$$$8BFF558BEC83EC10",213)&&(o=o.append("wmain"),d=1),"16.00"),d?PE.compareEP("10",-6)&&(o=o.append("glob")):PE.compareEP("CC",-2)&&(o=o.append("glob"))}F=!0}else PE.compareEP("E8......00E9$$$$$$$$6A..68........E8")?(S=PE.getEntryPointOffset(),S+=10+~~PE.readDword(S+6),PE.compare("10",S+1)?(o=o.append("msvcrt"),d&&(o=o.append("wmain")),PE.compareEP("FF",-48)&&(o=o.append("glob"))):PE.compare("33DB",S+12)?(o=o.append("msvcrt"),(PE.compare("89",S+53)||PE.compare("E0",S+60))&&(o=o.append("wWinMain"))):PE.compare("3935",S+14)?(o=o.append("libcmt"),PE.compareEP("E8$$$$$$$$8B",-150)&&(o=o.append("wmain")),PE.compareEP("FF",-163)&&(o=o.append("glob"))):PE.compare("8D4598",S+12)?(o=o.append("libcmt"),PE.compareEP("51",15)&&(o=o.append("wWinMain"))):PE.compare("33F68975FC",S+12)?(o=o.append("libcmt"),PE.compare("E8",S+170)&&(o=o.append("wWinMain"))):PE.compare("B8'MZ'",S+12)&&(o=o.append("libcmt"),PE.compare("E8",S+149)&&(o=o.append("wmain"),--S),PE.compare("FF",S+174))&&(o=o.append("glob")),s="15.00-16.00",F=!0):PE.compareEP("64A100000000558BEC6AFF68")?F=!0:PE.compareEP("64A100000000506489250000000083C4A8535657")?(s="11.00",F=!0):PE.compareEP("535657BB........8B......553BFB75")||PE.compareEP("56E8........8BF0E8........68........68........E8........6A..68........56E8")?(s="8.00",F=!0):PE.compareEP("53B8........8B......565785DB5575")?(s="10.20",F=!0):PE.compareEP("558BEC83EC4456FF15........6A018BF0FF15")||PE.compareEP("558BEC83EC4456FF15........8BF08A063C22")||PE.compareEP("558D6C....81EC........8B45..83F801560F84........85C00F84")?(s="12.00",F=!0):PE.compareEP("558BEC538B5D08568B750C85F6578B7D10")?(s="13.00",F=!0):PE.compareEP("833D........00741A68........E8........85C059740BFF742404FF15........59E8........68........68........E8........85C059597554565768........E8........BE........8BC6BF")||PE.compareEP("6A1468........E8........BB94000000536A008B..........FFD750FF..........8BF085F6750A6A12E8........59EB18891E56FF..........5685C0751450FFD750FF..........B8")||PE.compareEP("8BFF558BEC538B5D08568B750C85F6578B7D100F84....000083FE01")||PE.compareEP("8BFF558BEC538B5D08568B750C85F6578B7D107509833D........00EB2683FE01740583FE027522A1........85C07409575653FFD085C0740C575653E8......FF85C0750433C0EB4E575653E8......FF83FE0189450C750C85C07537575053E8......FF85F6740583FE037526575653E8......FF85C0750321450C837D0C007411A1........85C07408575653FFD089450C8B450C5F5E5B5DC20C00")||PE.compareEP("558BEC83EC10A1........8365F8008365FC005357BF4EE640BB3BC7BB0000FFFF740D85C37409F7D0A3........EB60568D45F850FF15........8B75FC3375F8FF15........33F0FF15........33F0FF15........33F08D45F050FF15........8B45F43345F033F03BF77507BE4FE640BBEB0B85F375078BC6C1E0100BF08935........F7D68935........5E5F5BC9C3")?(s="14.00",F=!0):PE.compareEP("558BEC83EC245356578965F8")&&(F=!0)
F&&(e="Microsoft Visual C/C++"),PE.isRichSignaturePresent()&&(i="Microsoft Linker")
for(var B,S,_,b,M=PE.isLibraryPresentExp(/^MFC(\d+?)(u?)(d?)\.dll/i),x=(M&&($=(M[1]/10).toFixed(1),M[2]&&(m="Unicode"),M[3]&&(m=m.append("debug")),h="MFC"),PE.isDeepScan()&&h==String()&&(B=PE.section[".data"])&&PE.isSignatureInSectionPresent(B.Number,"'CMFCComObject'")&&(h="MFC",m="static"),PE.isNet()?PE.isNetObjectPresent("Microsoft.VisualBasic")&&(p="VB.NET",vbDetected=!0):PE.isLibraryPresentExp(/^MSVBVM60(\.DLL)?/i)?(p="Microsoft Visual Basic",t="6.0",C=getVbOptions()):PE.isLibraryPresentExp(/^MSVBVM50(\.DLL)?/i)?(p="Microsoft Visual Basic",t="5.0",C=getVbOptions()):PE.isLibraryPresentExp(/^VB40032(\.DLL)/i)&&(p="Microsoft Visual Basic",t="4.0"),t&&(PE.isLibraryPresentExp(/^(VB40032|MSVBVM[56]0)$/i)||"6.0"===t&&!PE.isRichSignaturePresent())&&(C=C.append("modified/patched")),""),W="",z="",u="",j="",Z="",H="",U="",X="",f="",q="",J="",G=PE.getNumberOfRichIDs()-1;0<=G;G--){var T,k,D,I,K,N,Q,w=PE.getRichID(G)
1<w&&(N="",T="",K=I=D=k=0,(w={2:{isLinker:1,richVersion:"5.10"},4:{isLinker:1,richVersion:"6.00"},7:{isBasic:1,richVersion:"5.00",richOptions:"Native"},8:{isCompiler:1,richVersion:"11.00",richOptions:"C/C++"},9:{isBasic:1,richVersion:"6.00",richOptions:"Native"},10:{isCompiler:1,richVersion:"12.00",richOptions:"C"},11:{isCompiler:1,richVersion:"12.00",richOptions:"C++"},14:{isMasm:1,richVersion:"6.13"},15:{isMasm:1,richVersion:"7.01"},16:{isLinker:1,richVersion:"5.11"},18:{isMasm:1,richVersion:"6.14",richOptions:"MMX2 support"},19:{isLinker:1,richVersion:"5.12"},21:{isCompiler:1,richVersion:"12.00",richOptions:"C/std"},22:{isCompiler:1,richVersion:"12.00",richOptions:"C++/std"},23:{isCompiler:1,richVersion:"12.00",richOptions:"C/book"},24:{isCompiler:1,richVersion:"12.00",richOptions:"C++/book"},27:{isBasic:1,richVersion:"7.00",richOptions:"Native"},28:{isCompiler:1,richVersion:"13.00",richOptions:"C"},29:{isCompiler:1,richVersion:"13.00",richOptions:"C++"},30:{isLinker:1,richVersion:"6.10"},32:{isLinker:1,richVersion:"6.01"},34:{isBasic:1,richVersion:"6.10",richOptions:"Native"},35:{isCompiler:1,richVersion:"12.10",richOptions:"C"},36:{isCompiler:1,richVersion:"12.10",richOptions:"C++"},37:{isLinker:1,richVersion:"6.20"},40:{isLinker:1,richVersion:"6.21"},42:{isMasm:1,richVersion:"6.15"},43:{isCompiler:1,richVersion:"13.00",richOptions:"LTCG/C"},44:{isCompiler:1,richVersion:"13.00",richOptions:"LTCG/C++"},45:{isMasm:1,richVersion:"6.20"},47:{isBasic:1,richVersion:"6.20",richOptions:"Native"},48:{isCompiler:1,richVersion:"12.20",richOptions:"C"},49:{isCompiler:1,richVersion:"12.20",richOptions:"C++"},50:{isCompiler:1,richVersion:"12.20",richOptions:"C/std"},51:{isCompiler:1,richVersion:"12.20",richOptions:"C++/std"},52:{isCompiler:1,richVersion:"12.20",richOptions:"C/book"},53:{isCompiler:1,richVersion:"12.20",richOptions:"C++/book"},57:{isCompiler:1,richVersion:"13.00",richOptions:"C/std"},58:{isCompiler:1,richVersion:"13.00",richOptions:"C++/std"},60:{isLinker:1,richVersion:"6.22"},61:{isLinker:1,richVersion:"7.00"},64:{isMasm:1,richVersion:"7.00"},65:{isCompiler:1,richVersion:"13.00",richOptions:"POGO_I_C"},66:{isCompiler:1,richVersion:"13.00",richOptions:"POGO_I_CPP"},67:{isCompiler:1,richVersion:"13.00",richOptions:"POGO_O_C"},68:{isCompiler:1,richVersion:"13.00",richOptions:"POGO_O_CPP"},71:{isLinker:1,richVersion:"7.10p"},75:{isMasm:1,richVersion:"7.10p"},76:{isCompiler:1,richVersion:"13.10p",richOptions:"C"},77:{isCompiler:1,richVersion:"13.10p",richOptions:"C++/book"},78:{isCompiler:1,richVersion:"13.10p",richOptions:"C/std"},79:{isCompiler:1,richVersion:"13.10p",richOptions:"C++/std"},80:{isCompiler:1,richVersion:"13.10p",richOptions:"LTCG/C"},81:{isCompiler:1,richVersion:"13.10p",richOptions:"LTCG/C++"},82:{isCompiler:1,richVersion:"13.10p",richOptions:"POGO_I_C"},83:{isCompiler:1,richVersion:"13.10p",richOptions:"POGO_I_C"},84:{isCompiler:1,richVersion:"13.10p",richOptions:"POGO_O_C"},85:{isCompiler:1,richVersion:"13.10p",richOptions:"POGO_O_CPP"},86:{isLinker:1,richVersion:"6.24"},90:{isLinker:1,richVersion:"7.10"},95:{isCompiler:1,richVersion:"13.10",richOptions:"C"},96:{isCompiler:1,richVersion:"13.10",richOptions:"C++/book"},97:{isCompiler:1,richVersion:"13.10",richOptions:"C/std"},98:{isCompiler:1,richVersion:"13.10",richOptions:"C++/std"},99:{isCompiler:1,richVersion:"13.10",richOptions:"LTCG/C"},100:{isCompiler:1,richVersion:"13.10",richOptions:"LTCG/C++"},101:{isCompiler:1,richVersion:"13.10",richOptions:"POGO_I_C"},102:{isCompiler:1,richVersion:"13.10",richOptions:"POGO_I_C"},103:{isCompiler:1,richVersion:"13.10",richOptions:"POGO_O_C"},104:{isCompiler:1,richVersion:"13.10",richOptions:"POGO_O_CPP"},109:{isCompiler:1,richVersion:"14.00",richOptions:"C"},110:{isCompiler:1,richVersion:"14.00",richOptions:"C++/book"},111:{isCompiler:1,richVersion:"14.00",richOptions:"C/std"},112:{isCompiler:1,richVersion:"14.00",richOptions:"C++/std"},113:{isCompiler:1,richVersion:"14.00",richOptions:"LTCG/C"},114:{isCompiler:1,richVersion:"14.00",richOptions:"LTCG/C++"},115:{isCompiler:1,richVersion:"14.00",richOptions:"POGO_I_C"},116:{isCompiler:1,richVersion:"14.00",richOptions:"POGO_I_C"},117:{isCompiler:1,richVersion:"14.00",richOptions:"POGO_O_C"},118:{isCompiler:1,richVersion:"14.00",richOptions:"POGO_O_CPP"},120:{isLinker:1,richVersion:"8.00"},125:{isMasm:1,richVersion:"8.00"},128:{isCompiler:1,richVersion:"14.00",richOptions:"CVTCIL/C"},129:{isCompiler:1,richVersion:"14.00",richOptions:"CVTCIL/C++"},130:{isCompiler:1,richVersion:"14.00",richOptions:"LTCG/MSIL"},131:{isCompiler:1,richVersion:"15.00",richOptions:"C"},132:{isCompiler:1,richVersion:"15.00",richOptions:"C++"},133:{isCompiler:1,richVersion:"15.00",richOptions:"C/std"},134:{isCompiler:1,richVersion:"15.00",richOptions:"C++/std"},135:{isCompiler:1,richVersion:"15.00",richOptions:"CVTCIL/C"},136:{isCompiler:1,richVersion:"15.00",richOptions:"CVTCIL/C++"},137:{isCompiler:1,richVersion:"15.00",richOptions:"LTCG/C"},138:{isCompiler:1,richVersion:"15.00",richOptions:"LTCG/C++"},139:{isCompiler:1,richVersion:"15.00",richOptions:"LTCG/MSIL"},140:{isCompiler:1,richVersion:"15.00",richOptions:"POGO_I_C"},141:{isCompiler:1,richVersion:"15.00",richOptions:"POGO_I_C"},142:{isCompiler:1,richVersion:"15.00",richOptions:"POGO_O_C"},143:{isCompiler:1,richVersion:"15.00",richOptions:"POGO_O_CPP"},145:{isLinker:1,richVersion:"9.00"},149:{isMasm:1,richVersion:"9.00"},157:{isLinker:1,richVersion:"10.00"},158:{isMasm:1,richVersion:"10.00"},170:{isCompiler:1,richVersion:"16.00",richOptions:"C"},171:{isCompiler:1,richVersion:"16.00",richOptions:"C++"},172:{isCompiler:1,richVersion:"16.00",richOptions:"CVTCIL/C"},173:{isCompiler:1,richVersion:"16.00",richOptions:"CVTCIL/C++"},174:{isCompiler:1,richVersion:"16.00",richOptions:"LTCG/C"},175:{isCompiler:1,richVersion:"16.00",richOptions:"LTCG/C++"},176:{isCompiler:1,richVersion:"16.00",richOptions:"LTCG/MSIL"},177:{isCompiler:1,richVersion:"16.00",richOptions:"POGO_I_C"},178:{isCompiler:1,richVersion:"16.00",richOptions:"POGO_I_C"},179:{isCompiler:1,richVersion:"16.00",richOptions:"POGO_O_C"},180:{isCompiler:1,richVersion:"16.00",richOptions:"POGO_O_CPP"},186:{isLinker:1,richVersion:"10.10"},187:{isMasm:1,richVersion:"10.10"},188:{isCompiler:1,richVersion:"16.10",richOptions:"C"},189:{isCompiler:1,richVersion:"16.10",richOptions:"C++"},190:{isCompiler:1,richVersion:"16.10",richOptions:"CVTCIL/C"},191:{isCompiler:1,richVersion:"16.10",richOptions:"CVTCIL/C++"},192:{isCompiler:1,richVersion:"16.10",richOptions:"LTCG/C"},193:{isCompiler:1,richVersion:"16.10",richOptions:"LTCG/C++"},194:{isCompiler:1,richVersion:"16.10",richOptions:"LTCG/MSIL"},195:{isCompiler:1,richVersion:"16.10",richOptions:"POGO_I_C"},196:{isCompiler:1,richVersion:"16.10",richOptions:"POGO_I_C"},197:{isCompiler:1,richVersion:"16.10",richOptions:"POGO_O_C"},198:{isCompiler:1,richVersion:"16.10",richOptions:"POGO_O_CPP"},204:{isLinker:1,richVersion:"11.00"},205:{isMasm:1,richVersion:"11.00"},206:{isCompiler:1,richVersion:"17.00",richOptions:"C"},207:{isCompiler:1,richVersion:"17.00",richOptions:"C++"},208:{isCompiler:1,richVersion:"17.00",richOptions:"CVTCIL/C"},209:{isCompiler:1,richVersion:"17.00",richOptions:"CVTCIL/C++"},210:{isCompiler:1,richVersion:"17.00",richOptions:"LTCG/C"},211:{isCompiler:1,richVersion:"17.00",richOptions:"LTCG/C++"},212:{isCompiler:1,richVersion:"17.00",richOptions:"LTCG/MSIL"},213:{isCompiler:1,richVersion:"17.00",richOptions:"POGO_I_C"},214:{isCompiler:1,richVersion:"17.00",richOptions:"POGO_I_C"},215:{isCompiler:1,richVersion:"17.00",richOptions:"POGO_O_C"},216:{isCompiler:1,richVersion:"17.00",richOptions:"POGO_O_CPP"},222:{isLinker:1,richVersion:"12.00"},223:{isMasm:1,richVersion:"12.00"},224:{isCompiler:1,richVersion:"18.00",richOptions:"C"},225:{isCompiler:1,richVersion:"18.00",richOptions:"C++"},226:{isCompiler:1,richVersion:"18.00",richOptions:"CVTCIL/C"},227:{isCompiler:1,richVersion:"18.00",richOptions:"CVTCIL/C++"},228:{isCompiler:1,richVersion:"18.00",richOptions:"LTCG/C"},229:{isCompiler:1,richVersion:"18.00",richOptions:"LTCG/C++"},230:{isCompiler:1,richVersion:"18.00",richOptions:"LTCG/MSIL"},231:{isCompiler:1,richVersion:"18.00",richOptions:"POGO_I_C"},232:{isCompiler:1,richVersion:"18.00",richOptions:"POGO_I_C"},233:{isCompiler:1,richVersion:"18.00",richOptions:"POGO_O_C"},234:{isCompiler:1,richVersion:"18.00",richOptions:"POGO_O_CPP"},240:{isLinker:1,richVersion:"12.10"},241:{isMasm:1,richVersion:"12.10"},242:{isCompiler:1,richVersion:"18.10",richOptions:"C"},243:{isCompiler:1,richVersion:"18.10",richOptions:"C++"},244:{isCompiler:1,richVersion:"18.10",richOptions:"CVTCIL/C"},245:{isCompiler:1,richVersion:"18.10",richOptions:"CVTCIL/C++"},246:{isCompiler:1,richVersion:"18.10",richOptions:"LTCG/C"},247:{isCompiler:1,richVersion:"18.10",richOptions:"LTCG/C++"},248:{isCompiler:1,richVersion:"18.10",richOptions:"LTCG/MSIL"},249:{isCompiler:1,richVersion:"18.10",richOptions:"POGO_I_C"},250:{isCompiler:1,richVersion:"18.10",richOptions:"POGO_I_C"},251:{isCompiler:1,richVersion:"18.10",richOptions:"POGO_O_C"},252:{isCompiler:1,richVersion:"18.10",richOptions:"POGO_O_CPP"},258:{isLinker:1,richVersion:"14.00"},259:{isMasm:1,richVersion:"14.00"},260:{isCompiler:1,richVersion:"19.00",richOptions:"C"},261:{isCompiler:1,richVersion:"19.00",richOptions:"C++"},262:{isCompiler:1,richVersion:"19.00",richOptions:"CVTCIL/C"},263:{isCompiler:1,richVersion:"19.00",richOptions:"CVTCIL/C++"},264:{isCompiler:1,richVersion:"19.00",richOptions:"LTCG/C"},265:{isCompiler:1,richVersion:"19.00",richOptions:"LTCG/C++"},266:{isCompiler:1,richVersion:"19.00",richOptions:"LTCG/MSIL"},267:{isCompiler:1,richVersion:"19.00",richOptions:"POGO_I_C"},268:{isCompiler:1,richVersion:"19.00",richOptions:"POGO_I_C"},269:{isCompiler:1,richVersion:"19.00",richOptions:"POGO_O_C"},270:{isCompiler:1,richVersion:"19.00",richOptions:"POGO_O_CPP"}}[w])&&(k=w.isLinker||0,D=w.isCompiler||0,I=w.isMasm||0,K=w.isBasic||0,N=w.richVersion||"",T=w.richOptions||""),w=N+"."+PE.getRichVersion(G),(k&&"14.00"==N||I&&"14.00"==N||D&&"19.00"==N)&&(Q=25e3<(N=PE.getRichVersion(G))?N<25506?10:N<25830?11:N<26128?12:N<26428?13:N<26726?14:N<26926?15:N<27508?16:N<27702?20:N<27905?21:N<28105?22:N<28314?23:N<28610?24:N<28805?25:N<29110?26:N<29333?27:N<30133?28:N<30401?29:N<30818?30:N<31114?31:N<31424?32:N<31721?33:N<32019?34:N<32323?35:N<32532||N<32543||N<32822?36:N<33130?37:N<33520?38:N<33811?39:N<34120?40:N<34436?41:N<34808?42:N<35e3?43:N<35224?44:N<36e3?50:51:0)&&(k||I?w="14."+Q+"."+N:D&&(w="19."+Q+"."+N)),k?W<w&&(x="Microsoft Linker",W=w,z=T):D?j<w&&(u="Microsoft Visual C/C++",j=w,Z=T):I?U<w&&(H="MASM",U=w,X=T):K&&q<w&&(f="Visual Basic",q=w,J=T))}x&&(i=x,r=W,v=z),f?(p=f,t=q,C=J):u?(e=u,s=j,o=Z):H&&(n=H,c=U,A=X),PE.isDeepScan()&&u==""&&3<=PE.section.length&&(S="'Microsoft Visual C++ Runtime Library'",PE.isSignatureInSectionPresent(0,S)||PE.isSignatureInSectionPresent(1,S)||PE.isSignatureInSectionPresent(2,S))&&(e="Microsoft Visual C/C++"),PE.isVerbose()&&u==""&&PE.isLibraryPresent("msvcrt.dll")&&(_=PE.getMajorLinkerVersion(),b=PE.getMinorLinkerVersion(),3<=_)&&_<=14&&b<40&&(e="Microsoft Visual C/C++"),(i=PE.isVerbose()&&(h&&(e==""&&(e="Microsoft Visual C/C++"),i=="")&&(i="Microsoft Linker"),e||f||n)&&i==""&&(_=PE.getMajorLinkerVersion(),b=PE.getMinorLinkerVersion(),3<=_)&&_<=14&&b<40?"Microsoft Linker":i)&&r==""&&(_=PE.getMajorLinkerVersion(),b=PE.getMinorLinkerVersion(),3<=_)&&_<=14&&b<40&&(r=PE.getCompilerVersion()),e&&i&&(F=r.match(/\d+\.\d+/gm))&&(O="Microsoft Visual Studio",l={"6.00":"6.0","7.00":"2002","7.10":"2003","8.00":"2005","9.00":"2008","10.00":"2010","11.00":"2012","12.00":"2013","14.00":"2015","14.10":"2017, 15.0-15.2",14.11:"2017, 15.3",14.12:"2017, 15.5",14.13:"2017, 15.6",14.14:"2017, 15.7",14.15:"2017, 15.8",14.16:"2017, 15.9","14.20":"2019, 16.0",14.21:"2019, 16.1",14.22:"2019, 16.2",14.23:"2019, 16.3",14.24:"2019, 16.4",14.25:"2019, 16.5",14.26:"2019, 16.6",14.27:"2019, 16.7-16.8",14.28:"2019, 16.9-16.10",14.29:"2019, 16.11","14.30":"2022, 17.0",14.31:"2022, 17.1",14.32:"2022, 17.2",14.33:"2022, 17.3",14.34:"2022, 17.4",14.35:"2022, 17.5",14.36:"2022, 17.6",14.37:"2022, 17.7",14.38:"2022, 17.8",14.39:"2022, 17.9.1","14.40":"2022, 17.10",14.41:"2022, 17.11",14.42:"2022, 17.12",14.43:"2022, 17.13",14.44:"2022, 17.14","14.50":"2026, 18.0-18.3",14.51:"2026, 18.4"}[F]||""),"6.14.8444"==c&&"5.12.8078"==r&&(O="MASM32",l="8-11"),p?(_setLang("VB"+(-1!==p.indexOf(".NET")?".NET":"")),_setResult("compiler",p,t,C)):e?(_isResultPresent("compiler","Rust")||(-1!==o.indexOf("C++")||-1!==o.indexOf("CPP")?_setLang("C++"):"C"==o||-1!==o.indexOf("/C")||-1!==o.indexOf("_C")?_setLang("C"):_setLang("C/C++")),_isResultPresent("compiler",e)||_setResult("compiler",e,s,o)):n&&(_setLang("ASMx"+(PE.is64()?"64":"86")),_setResult("compiler",n,c,A)),E&&(PE.isNetObjectPresent("FSharp.Core")&&_setLang("F#"),_isLangDetected()||_setLang("MSIL/C#"),_setResult("library",E,a,P)),h&&_setResult("library",h,$,m),i&&_getNumberOfResults("linker")<1&&_setResult("linker",i,r,v),O&&l&&_setResult("tool",O,l,y)}function getVbOptions(){var i,r,e,s=""
return s=0!==PE.getNumberOfSections()&&(r=PE.section[0],-1!==(i=-1===(i=PE.findDword(r.FileOffset,r.FileSize,557138518))?PE.findDword(r.FileOffset,r.FileSize,557204054):i)&&(r=PE.readDword(i+48),-1!==(e=PE.VAToOffset(r))))?0===PE.readDword(e+32)?"P-Code":"Native":s}

================================================
FILE: dbs_min/db/PE/Microsoft_Class_Installer.1.sg
================================================
function detect(){if(PE.compareEP("64A1........558BEC6A..68........68........50648925........83EC..5356578965..FF15"))for(var e=0;e<PE.resource.length&&!bDetected;e++)280==PE.resource[e].Type&&PE.compare("'PK'0304",PE.resource[e].Offset)&&(sVersion="4.X",sOptions="zip",bDetected=1)
return result()}meta("installer","Microsoft Class Installer for Java")

================================================
FILE: dbs_min/db/PE/Microsoft_Compound-based_installer.1.sg
================================================
function detect(){return PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c05568........64ff3064892033c05568")&&PE.compareOverlay("d0cf11e0a1b11ae1")&&(bDetected=1),result()}meta("installer","Microsoft Compound-based installer (MSI)")

================================================
FILE: dbs_min/db/PE/Microsoft_Help.1.sg
================================================
function detect(){return PE.isSectionNamePresent(".its")&&(bDetected=1),result()}meta("other","Microsoft Help (compiled) (.hxs)")

================================================
FILE: dbs_min/db/PE/Microsoft_JScript.6.sg
================================================
function detect(){return PE.isNetObjectPresent("Microsoft.JScript.Vsa")&&(bDetected=1),sLang="JavaScript",result()}meta("compiler","JScript")

================================================
FILE: dbs_min/db/PE/_FixDetects.9.sg
================================================
function detect(){removeFalsePositive({falsePositive:{packer:"AHpacker"},ifPresents:{packer:"ExE Pack"}}),removeFalsePositive({falsePositive:{linker:"Turbo Linker"},ifPresents:{linker:"Microsoft Linker"}}),removeFalsePositive({falsePositive:{tool:"Borland Delphi"},ifPresents:{tool:"Microsoft Linker"}}),removeFalsePositive({falsePositive:{compiler:"FASM",language:"ASMx86"},ifPresents:{packer:"Simple Pack"}}),_isResultPresent("compiler","Microsoft Visual C/C++")&&1<_getNumberOfResults("compiler")&&(_removeResult("compiler","Microsoft Visual C/C++"),1<_getNumberOfResults("language"))&&_isLangPresent("C/C++")&&_removeResult("language","C/C++"),_isLangPresent("MSIL/C#")&&_isResultPresent("tool","Microsoft Visual Studio")&&(_removeResult("language","MSIL/C#"),_setLang("C#"))}function removeFalsePositive(e){var s=e.falsePositive,i=e.ifPresents,r="",t=""
for(o in s)if(s.hasOwnProperty(o)){t=s[r=o]
break}var o,l="",a=""
for(o in i)if(i.hasOwnProperty(o)){a=i[l=o]
break}_isResultPresent(r,t)&&_isResultPresent(l,a)&&_removeResult(r,t)}

================================================
FILE: dbs_min/db/PE/_NetCompilersLibs.4.sg
================================================
function detect(){var e
PE.isNetObjectPresent("dnlib")&&PE.isNetObjectPresent("ModuleDef")&&_setResult("library","dnlib","",""),PE.isNetObjectPresent("Mono.Cecil")&&_setResult("library","Mono.Cecil","",""),PE.isNetObjectPresent("AsmResolver")&&_setResult("library","AsmResolver","",""),PE.isNetObjectPresent("System.CodeDom.Compiler")&&(e="",PE.isNetObjectPresent("CSharpCodeProvider")&&(e="C#"),PE.isNetObjectPresent("VBCodeProvider")&&(e+=(e?" + ":"")+"VB.NET"),PE.isNetObjectPresent("JScriptCodeProvider")&&(e+=(e?" + ":"")+"JScript"),e)&&_setResult("library","CodeDom Compiler","",e)}

================================================
FILE: dbs_min/db/PE/_PE.0.sg
================================================
function detect(){var e
return PE.isVerbose()&&(sName=PE.getOperationSystemName(),sOptions=PE.getOperationSystemOptions(),bDetected=1,e=PE.section[".rossym"],sVersion=e&&1107298306==e.Characteristics?"React OS, 0.3+":PE.getOperationSystemVersion()),result()}meta("operation system","Windows")

================================================
FILE: dbs_min/db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg
================================================
const PE_Cached={},logType={warning:-2,about:-1,nothing:0,any:1,net:2},heurLabel="HEUR"
var lastOffsetDetected="0x00"
function detect(){return stubForWrongEnvironment()||stubForLegacyEngines()?null:main()}function main(){initializeCache(),PE.isHeuristicScan()?(PE.isVerbose()||log(logType.warning,'To get the full heuristic scan result use "--verbose"'),log(logType.about,"Generic Heuristic Analysis by DosX (@DosX_dev)"),log(logType.nothing,"Scanning has begun!"),(PE_Cached.isDotNet?(scanForObfuscations_NET(),scanForAntiAnalysis_NET):scanForObfuscations_Native)(),scanForPackersAndCryptors_NET_and_Native(),scanForLicensingSystems_NET_and_Native(),scanForBadFileFormat_NET_and_Native(),scanForDebugData_NET_and_Native(),scanForMaliciousCode_NET_and_Native(),PE.isVerbose()&&(scanForLanguagesAndCompilers_NET_and_Native(),scanForInterestingMarkers_NET_and_Native()),log(logType.nothing,"Scan completed.")):log(logType.warning,"Heuristic scan is disabled. Use '--heuristicscan' to enable"),unloadCache()}function stubForLegacyEngines(){return void 0===PE.getNetAssemblyName&&(stdout(">>> Update DIE Engine to 3.20 and higher for using Heuristic-analyzer by DosX <<<"),!0)}function stubForWrongEnvironment(){return"undefined"==typeof PE?(stdout(">>> Wrong environment! 'PE' is undefined. Check DIE-engine for correct installation <<<"),!0):(PE.isHeuristicScan()&&PE.isVerbose()&&!_getNumberOfResults("operation system")&&stdout(">>> Script is running outside the environment! Are you in debug mode? <<<"),!1)}function stdout(e){if("object"==typeof console)console.warn(e)
else if("object"==typeof File)_setResult("~warning",e,"","")
else{if("function"!=typeof _error)throw e
_error(e)}}function initializeCache(){var e,t={isArchX86:isArchX86,isCppClrLikeApp:isCppClrLikeApp,isVbNetStandardLibraryPresent:isVbNetStandardLibraryPresent,isJscriptNetStandardLibraryPresent:isJscriptNetStandardLibraryPresent,firstEpAsmInstruction:getFirstEpAsmInstruction,is64bit:PE.is64,isDotNet:PE.isNet,isDynamicLinkLibrary:PE.isDll,isNetGlobalCctorPresent:PE.isNetGlobalCctorPresent,isRichSignaturePresent:PE.isRichSignaturePresent,numberOfSections:PE.getNumberOfSections,numberOfRichIDs:PE.getNumberOfRichIDs,numberOfUnmanagedResources:PE.getNumberOfResources,numberOfUnmanagedImports:PE.getNumberOfImports,numberOfUnmanagedExports:PE.getNumberOfExports,indexOfImportsSection:PE.getImportSection,indexOfExportsSection:PE.getExportSection,nameOfNetAssemblyName:PE.getNetAssemblyName,nameOfNetModuleName:PE.getNetModuleName}
for(e in t){var i=t[e]
i?PE_Cached[e]=i():stdout(">>> PE API function '"+e+"' is undefined! <<<")}}function unloadCache(){PE_Cached=void 0}function scanForObfuscations_NET(){log(logType.nothing,"Scanning for obfuscation...")
var e="",t=!1,i=!1,i=(PE_Cached.isDynamicLinkLibrary||(PE_Cached.isVbNetStandardLibraryPresent?isAllNetReferencesMissing(["Main","main","MAIN","MyApplication"])&&(i=!0):isAllNetReferencesMissing(["Main","main","main@","<Main>$","mainCRTStartup","wWinMainCRTStartup","_WinMainCRTStartup"])&&(i=!0),i&&log(logType.net,'No "Main" method found')),i&&(e="Modified managed EP"),!1),n=(!PE_Cached.isNetGlobalCctorPresent||PE_Cached.isCppClrLikeApp||isUnpackagedWindowsAppSdkLinked()||(log(logType.net,"Global constructor detected!"),i=!0),i&&(e=addOption(e,"CLR constructor")),!1),r=["~","Strings","US","GUID","Blob"]
if(!PE_Cached.isDynamicLinkLibrary&&1<PE_Cached.numberOfSections&&!PE_Cached.isCppClrLikeApp)for(var s=0;s<r.length;s++)if(!PE.isSignatureInSectionPresent(0,"00'#"+r[s]+"'00")){n=!0
break}n&&(e=addOption(e,"Strange EP position"))
var i=!1,i=(PE_Cached.isDynamicLinkLibrary||PE_Cached.isCppClrLikeApp||(!PE_Cached.is64bit&&PE_Cached.isArchX86?"JMP"!==getFirstEpAsmOpCode()&&(-1!==PE.VAToOffset(PE.getAddressOfEntryPoint())?log(logType.net,"Very strange EP pattern: "+getEpAsmPattern(!0,4).split("|").join(" .. ")):log(logType.net,"No native entry point"),i=!0):0!==PE.VAToOffset(PE.getAddressOfEntryPoint())&&(i=!0)),i&&(e=addOption(e,"Modified native EP")),!1),i=(-1===PE.findSignature(PE.getDosStubOffset(),PE.getDosStubSize(),"'This program cannot be run in DOS mode.'")&&(log(logType.net,"DOS-stub modified!"),i=!0),i&&(e=addOption(e,"Modified DOS")),!1),o=(1===PE_Cached.numberOfSections&&(log(logType.net,"Only one section found!"),i=!0),i&&(e=addOption(e,"Only one section")),!1),a="_-=+~!@#$%^&*()\"№;%:?*():;,/\\|'`<>.0123456789"
if(PE_Cached.numberOfSections>(PE_Cached.isCppClrLikeApp?10:6)||!PE.section[".text"])o=!0
else for(var l=0;l<PE_Cached.numberOfSections&&!o;l++){var d=PE.getSectionName(l)
if("."!==d[0]&&d.length<3){o=!0
break}for(var c=0;c<a.length&&!o;c++)-1!==d.substr(1,d.length).indexOf(a[c])&&(o=!0)
isAsciiString(d)||(o=o||!0)}o&&(e=addOption(e,"Strange sections"))
for(var u=!1,l=0;l<PE_Cached.numberOfUnmanagedResources&&!u;l++){var g=PE.getResourceNameByNumber(l)
!g||isAsciiString(g)&&!isNameObfuscated(g)||(log(logType.net,"Strange unmanaged resource name: "+g),u=!0)}u&&(e=addOption(e,"Strange unmanaged resources"))
var i=!1,P=((i=10<PE_Cached.numberOfSections?!0:i)&&(e=addOption(e,"Too many sections")),new NetOpCodes),i=!1,p=P.ldc_i4+P.ldc_i4+P.xor+P.ldc_i4,p=(validateNetByteCode(p)&&(validateNetByteCode(p+(P.setStrict(P.bne_un_s,"09")+P.ldc_i4_2+P.stloc_0+P.sizeof+P.add))||validateNetByteCode(p+(P.bne_un+P.ldc_i4+P.stloc+P.sizeof+P.add))||validateNetByteCode(p+(P.bne_un+P.ldc_i4_2+P.stloc_s+P.sizeof+P.add)))&&(log(logType.net,"Int confusion detected! Offset: "+lastOffsetDetected),i=!0),i&&(e=addOption(e,"Int confusion")),!1),i=(isAllNetReferencesPresent(["System.Reflection","GetILGenerator","BeginInvoke","EndInvoke","OpCode"])&&(validateNetObject("Ldarg_0")||validateNetObject("CreateDelegate"))&&!isFrameworkComponent()&&(log(logType.net,"Virtualization-like behavior detected!"),p=!0),p&&(e=addOption(e,"Virtualization")),!1),p=((i=isAllNetReferencesPresent(["GetTypeFromHandle","BinaryReader","CreateDelegate","MakeByRefType","DynamicMethod"])&&!isFrameworkComponent()?!0:i)&&(e=addOption(e,"Calls encrypt")),!1),i=((p=validateNetObject("SuppressIldasmAttribute")?!0:p)&&(e=addOption(e,"Anti-ILDASM")),!1),p=((validateSignature("'Form'******00'Form'******00'Form'******00")||validateNetObject("Form0"))&&(log(logType.net,"File may be protected by de4dot!"),i=!0),i&&(e=addOption(e,"Anti-de4dot")),!1),i=((validateNetByteCode(P.setStrict(P.ldftn,"** ?? 00 0A")+P.setStrict(P.calli,"** 00 00 11"))||validateNetByteCode(P.ldelem_i+P.setStrict(P.calli,"** 00 00 11")))&&(log(logType.net,"Calli invokes detected! Offset: "+lastOffsetDetected),p=!0),p&&(e=addOption(e,"Calli invokes")),!1),p=((validateNetByteCode(P.nop+P.setStrict(P.ldftn,"** 00 00 06")+P.stelem_i)||validateNetByteCode(P.nop+P.setStrict(P.ldftn,"** 00 00 0A")+P.stelem_i)||validateNetByteCode(P.setStrict(P.ldftn,"** 00 00 0A")+P.setStrict(P.calli,"** 00 00 11")))&&(log(logType.net,"Ldftn pointers method-obfuscation detected! Offset: "+lastOffsetDetected),i=!0),i&&(e=addOption(e,"Ldftn pointers")),!1),E=((validateNetByteCode(P.nop+P.ldloc_0+P.ldc_i4+P.mul+P.ldc_i4+P.xor+P.br_s+P.nop+P.ldloc_0+P.ldc_i4+P.mul+P.ldc_i4+P.xor+P.br_s)||validateNetByteCode(P.ldc_i4+P.ldc_i4+P.xor+P.dup+P.stloc_0+P.ldc_i4_3+P.rem_un+P.switch__nobody)||validateNetByteCode(P.setStrict(P.ldc_i4,"00 00 00 00")+P.br+P.br+P.ldloc)||validateNetByteCode(P.ldsfld+P.brfalse+P.pop+P.setStrict(P.ldc_i4,"01 00 00 00")+P.br+P.nop)||validateNetByteCode(P.setNullValue(P.ldc_i4)+P.ldsfld+P.brtrue+P.pop+P.ldc_i4+P.br)||validateNetByteCode(P.stloc+P.ldloc+P.joinNoBodyAndValue(P.switch__nobody,"** ** ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00","switch__nobody")+P.ldc_i4+P.br)||validateNetByteCode(P.ldc_i4_3+P.joinNoBodyAndValue(P.switch__nobody,"01 00 00 00 F6 FF FF FF")+P.ldc_i4_1+P.brtrue_s+P.ldtoken+P.pop)||validateNetByteCode(P.setNullValue(P.ldc_i4)+P.stloc+P.br+P.nop+P.ldloc+P.setStrict(P.ldc_i4,"01 00 00 00")+P.ceq+P.brfalse)||validateNetByteCode(P.setNullValue(P.ldc_i4)+P.stloc+P.br+P.nop+P.ldloc+P.ldc_i4+P.ceq+P.brfalse)||validateNetByteCode(P.ldc_i4+P.br+P.ldloc_s+P.ldc_i4_s+P.ldc_i4_0+P.stelem_i1+P.ldc_i4+P.br)||validateNetByteCode(P.ldc_i4+P.ldc_i4+P._unknown+P.ldc_i4+P._unknown+P.stloc_0+P.nop+P.ldloc_0+P.ldc_i4+P.ldc_i4+P._unknown+P.ldc_i4+P._unknown+P.ceq+P.brfalse_s)||validateNetByteCode(P.setStrict(P.stloc_s,"05")+P.nop+P.ldloc_s+P._unknown+P.ceq+P.brfalse_s+P._unknown+P.setStrict(P.stloc_s,"05")+P.nop+P.ldloc_s+P._unknown+P.ceq+P.brfalse_s)||validateNetByteCode(P.ldloc_0+P.setStrict(P.ldc_i4,"?? ** ** **")+P._unknown+P.stloc_0+P.ldloc_0+P.setStrict(P.ldc_i4,"?? ** ** **")+P.xor+P.stloc_0)||validateNetByteCode(P.setStrict(P.ldc_i4,"?? ** ** **")+P._unknown+P.stloc_0+P.setStrict(P.ldftn,"** ?? ?? ??")))&&(log(logType.net,"Control flow obfuscation detected! Offset: "+lastOffsetDetected),p=!0),p&&(e=addOption(e,"Ctrl flow")),PE.findSignature(PE.getDosStubOffset()+PE.getDosStubSize(),PE.getSize()-PE.getOverlaySize(),"'<Module>'00**")+8),m=!1
if((PE.compare("00**00**00",E)||PE.compare("00****00****00****00",E)||PE.compare("00******00******00******00",E)||PE.compare("00********00********00********00",E)||PE.compare("00****00****00",E)||PE.compare("00****00**00",E)||PE.compare("00**00****00",E))&&(log(logType.net,"Short names detected! (mask)"),m=!0),!m&&PE.compare("00**00",E))for(var h=0,S="QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm",l=1;l<S.length&&!m;l++)PE.isNetObjectPresent(S[l])&&(log(logType.net,'Short name found: "'+S[l]+'" ('+h+"/20)"),h++),20===h&&(m=!0)
m&&(e=addOption(e,"Short names"))
for(var f=!1,_="",l=0;l<300;l++){var y=PE.readByte(E+l).toString(16)
"0"===y&&(y+="0"),_=_+y+" "}for(var b="",C=replaceAllInString(_,"00 ","20 20 20 ").split(" "),l=0;l<C.length;l++)b+=String.fromCharCode(parseInt(C[l],16))
for(var M=b.split("   "),x=0,X=validateNetObject("<PrivateImplementationDetails>"),l=0;l<M.length&&!f;l++){var v=M[l]
if(X&&40===v.length)break;-1===v.indexOf("<")&&!/^([0-9A-F]{64})$/.test(v)&&isNameObfuscated(v)&&x++,2<x&&(f=!0)}f&&(e=addOption(e,"Bad namings"))
for(var i=!1,p=((validateNetUnicodeString(" is tampered.")||validateNetUnicodeString("ping 127.0.0.1 > nul")||validateNetUnicodeString('/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "')||validateNetUnicodeString(P.ldloc_s+P.ldc_i4_0+P.ldloc_s+P.ldc_i4_0+P.ldelem_u4+P.ldloc_s+P.ldc_i4_0+P.ldelem_u4+P._unknown+P.stelem_i4+P.ldloc_s+P.ldc_i4_1+P.ldloc_s+P.ldc_i4_1+P.ldelem_u4+P.ldloc_s+P.ldc_i4_1+P.ldelem_u4+P._unknown+P.stelem_i4+P.ldloc_s+P.ldc_i4_2+P.ldloc_s+P.ldc_i4_2+P.ldelem_u4+P.ldloc_s+P.ldc_i4_2+P.ldelem_u4+P._unknown+P.stelem_i4+P.ldloc_s+P.ldc_i4_3+P.ldloc_s+P.ldc_i4_3+P.ldelem_u4+P.ldloc_s+P.ldc_i4_3+P.ldelem_u4+P._unknown+P.stelem_i4+P.ldloc_s+P.ldc_i4_4+P.ldloc_s+P.ldc_i4_4+P.ldelem_u4+P.ldloc_s+P.ldc_i4_4+P.ldelem_u4+P._unknown+P.stelem_i4)||validateNetByteCode(P.ldloc_s+P._unknown+P.shr_un+P.ldloc_s+P.ldc_i4_s+P.shl+P.or+P.stloc_s+P.ldloc_s+P._unknown+P.shr_un+P.ldloc_s+P.ldc_i4_s+P.shl+P.or+P.stloc_s+P.ldloc_s+P._unknown+P.shr_un+P.ldloc_s+P.ldc_i4_s+P.shl+P.or+P.stloc_s))&&(log(logType.net,"Anti-tamper detected!"),i=!0),i&&(e=addOption(e,"Anti-tamper")),!1),i=PE.findSignature(PE.getDosStubOffset()+PE.getDosStubSize(),PE.getSize()-PE.getOverlaySize(),"00'<Module>'00"),O=(-1!==i&&-1!==(O=PE.findSignature(i+10,PE.getSize()-PE.getOverlaySize(),"'<Module>'"))&&0!==PE.readByte(O+8)&&(log(logType.net,"Fake <Module> detected! Offset: 0x"+Number(O).toString(16)),p=!0),p&&(e=addOption(e,"Fake .cctor name")),!1),N=(-1===i&&(log(logType.net,"It seems that the .cctor is missing. Bad PE format!"),O=!0),O&&(e=addOption(e,"Bad .cctor format")),!1),w=[P.add,P.sub,P.mul,P.div,P.xor,P.shr,P.shl,P.or,P.not,P.and],V=[P.ldc_i4+P.ldc_i4+"%s"+P.stloc,P.ldc_i4+P.ldc_i4+"%s"+P.ldsfld,P.ldc_i4+P.ldc_i4+"%s"+P.ldc_i4+P.add,P.ldloc_1+P.ldc_i4+P.ldc_i4+"%s"+P.ldc_i4+P.ldc_i4,P.ldloc+P.ldc_i4+P.ldc_i4+P.ldc_i4+"%s"+P.stelem_i1,P.ldc_i4+P.ldc_i4+"%s"+P.br_s],A=0;A<V.length&&!N;A++)for(var H=V[A],k=0;k<w.length&&!N&&(0!==k||validateNetByteCode(replaceAllInString(H,"%s",P._unknown)));k++)validateNetByteCode(replaceAllInString(H,"%s",w[k]))&&(log(logType.net,"Math mutations detected! Offset: "+lastOffsetDetected),N=!0)
N&&(e=addOption(e,"Math mutations"))
var p=!1,i=(PE_Cached.isVbNetStandardLibraryPresent&&!isFrameworkComponent()&&validateNetObject("Resources")&&!validateGlobalUnicodeString(".Resources")&&(log(logType.net,"It appears that the strings are hidden/encrypted and can be loaded dynamically."),p=!0),p&&(e=addOption(e,"Strings encryption")),!1),O=(validateNetByteCode(P.ldc_i4+P.not)&&(validateNetByteCode(P.ldc_i4+P.not+P.neg+P.not+P.neg+P.not+P.neg+P.not+P.neg)||validateNetByteCode(P.ldc_i4+P.not+P.not+P.neg+P.neg+P.not+P.not)||validateNetByteCode(P.ldc_i4+P.not+P.neg+P.not+P.not+P.neg+P.neg)||validateNetByteCode(P.ldc_i4+P.not+P.neg+P.not+P.neg+P.not+P.not)||validateNetByteCode(P.ldc_i4+P.not+P.neg+P.not+P.neg+P.not+P.neg))&&(log(logType.net,"Math inversions detected, offset "+lastOffsetDetected),i=!0),i&&(e=addOption(e,"Math inversions")),!1),$=(validateNetByteCode(P.setStrict(P.calli,"FF FF FF FF")+P.setStrict(P.sizeof,"FF FF FF FF"))&&(log(logType.net,"Invalid OpCodes detected, offset "+lastOffsetDetected),O=!0),O&&(e=addOption(e,"Invalid OpCodes")),!1),j=""
const D=[{lib:"haspdnert.dll",name:"SafeNet Sentinel LDK"},{lib:"AgileDotNet.VMRuntime.dll",name:"Agile"},{lib:"Xerin.Runtime.dll",name:"XerinFuscator"},{lib:"CliSecureRd64.dll",name:"CliSecure"},{lib:"CliSecureRd.dll",name:"CliSecure"},{lib:"Protect32.dll",name:"ILProtector"},{lib:"Protect64.dll",name:"ILProtector"},{lib:"OneVM.Runtime.dll",name:"OneVM"},{lib:"MRuntime3.dll",name:"Maxtocode"},{lib:"Attick.dll",name:"Maxtocode"},{lib:"HVMRuntm.dll",name:"DNGuard"}]
for(l=0;l<D.length;l++){var I=D[l],R=I.lib,I=I.name
if(validateNetObject(R)||validateNetObject(R.substring(0,R.length-4))){log(logType.net,I+" runtime detected!"),$=!0,j=I
break}}D=void 0,$&&(e=addOption(e,j+" runtime"))
for(var T=["Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode","CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute","SecureTeam.Attributes.ObfuscatedByAgileDotNetAttribute","Xenocode.Client.Attributes.AssemblyAttributes","SmartAssembly.Attributes.PoweredByAttribute","ObfuscatedByAgileDotNetAttribute","NineRays.Obfuscator.Evaluation","ObfuscatedByCliSecureAttribute","BabelObfuscatorAttribute","AsStrongAsFuckAttribute","ProtectedByDotnetsafer","Macrobject.Obfuscator","DotfuscatorAttribute","CodeWallTrialVersion","ConfusedByAttribute","ObfuscatedByGoliath","NETSpider.Attribute","NineRays.Obfuscator","PoweredByAttribute","RustemSoft.Skater","Beds-Protector","BabelAttribute","MRuntime3.dll","YanoAttribute","EMyPID_8234_","ZYXDNGuarder","SkiDzEX","Sixxpack","____KILL","Reactor"],F=!1,p=!1,G=0,U="",B=0;B<T.length;B++)if(validateNetObject(T[B])&&(U=T[B],1<++G)){F=!0
break}F?e=addOption(e,"Fake signatures"):(1===G&&(log(logType.net,'Watermark (Attribute) found: "'+U+'"'),p=!0),p||!(validateSignature("'Obfuscated'")||validateSignature("'obfuscated'")||validateSignature("'ByAttribute'")||validateSignature("'ObfuscatorAttribute'")||validateNetObject("ObfuscationAttribute"))||isFrameworkComponent()||(p=!0)),p&&(e=addOption(e,"Watermark"))
var i=!1,O=PE_Cached.nameOfNetAssemblyName,p=PE_Cached.nameOfNetModuleName,W=((O=0===O.indexOf("Interop.")?O.substring(8,O.length):O)===getFileNameWithoutExtension(p)&&O!==p||(i=!0,PE_Cached.isJscriptNetStandardLibraryPresent&&"JScript Module"===p&&(i=!1)),i&&(e=addOption(e,"Modified build info")),["SafeNet Sentinel LDK .NET","Xenocode Postbuild","Smart Assembly","Dotfuscator","Babel .NET","Spices.Net","Maxtocode","FISH .NET","CliSecure","CodeWall","CodeVeil","Sixxpack","DNGuard","Goliath","Agile","Yano"]),L=["Quest PowerGUI","DataAnubis","NsPack","ASPack"],z=["Sentinel SuperPro dongle reference","Unikey/Activator dongle reference","Eutron SmartKey dongle reference","SenseLock dongle reference","Hardlock dongle reference","WIBU Key dongle reference","Wizzkey dongle reference","SoftLok dongle reference","NetHASP dongle reference"]
if(F){for(l=0;l<W.length;l++)_removeResult("protector",W[l])
for(l=0;l<L.length;l++)_removeResult("cryptor",L[l]),_removeResult("packer",L[l])
for(l=0;l<z.length;l++)_removeResult("protection",z[l])}(t=0!=e.length?!0:t)&&_setResult("~protection","Obfuscation","",PE.isVerbose()?e:"")}function scanForAntiAnalysis_NET(){log(logType.nothing,"Scanning for anti-analysis tricks...")
for(var e="",t=!1,i=!1,n="Debugger",r="get_IsAttached",s="IsLogging",n=((i=((validateNetObject(n)||validateNetUnicodeString(n))&&(validateNetObject(r)||validateNetUnicodeString(r)||validateNetObject(s)||validateNetUnicodeString(s))||validateNetObject("CheckRemoteDebuggerPresent")||validateNetObject("IsDebuggerPresent")||validateNetObject("NtRemoveProcessDebug")||validateNetObject("NtQueryInformationProcess"))&&!isFrameworkComponent()?!0:i)&&(e=addOption(e,"Anti-debug")),!1),o=((n=!isFrameworkComponent()&&validateNetObject("VirtualProtect")&&(isAllNetReferencesPresent(["System.Runtime.InteropServices","Marshal","GetHINSTANCE","IntPtr","op_Explicit"])||isAllNetReferencesPresent(["System.Diagnostics","memcpy","IntPtr","get_MainModule","get_BaseAddress"])||isAllNetReferencesPresent(["System.Runtime.InteropServices","Marshal","GetHINSTANCE","IntPtr","CopyBlock","InitBlock"]))?!0:n)&&(e=addOption(e,"Anti-dump")),["dnspy","dnSpy","DNSPY"]),a=!1,l=0;l<o.length&&!a;l++){var d=o[l];(validateGlobalUnicodeString(d)||validateSignature("'"+d+"'"))&&(a=!0)}a&&(e=addOption(e,"Anti-dnSpy"))
for(var c=["ilspy","ilSpy","ILSpy","ILSPY"],u=!1,l=0;l<c.length&&!u;l++){var g=c[l];(validateGlobalUnicodeString(g)||validateSignature("'"+g+"'"))&&(u=!0)}u&&(e=addOption(e,"Anti-ILSpy"))
var r=validateSignature("'GetModuleHandle'"),P=["sbiedll.","SbieDll.","SBIEDLL."],p=!1
if(r)for(l=0;l<P.length&&!p;l++){var E=P[l];(PE.isNetObjectPresent("IsSandboxiePresent")||validateGlobalUnicodeString(E)||validateSignature("'"+E+"'"))&&(p=!0)}p&&(e=addOption(e,"Anti-SandBoxie"))
var m=["cmdvrt32.","cmdvrt64.","CMDVRT32.","CMDVRT64."],h=!1
if(r)for(l=0;l<m.length&&!h;l++){var S=m[l];(PE.isNetObjectPresent("IsComodoSandboxPresent")||validateGlobalUnicodeString(S)||validateSignature("'"+S+"'"))&&(h=!0)}h&&(e=addOption(e,"Anti-Comodo"))
var f=["SxIn.","SXIn."],_=!1
if(r)for(l=0;l<f.length&&!_;l++){var y=f[l];(PE.isNetObjectPresent("IsQihoo360SandboxPresent")||validateGlobalUnicodeString(y)||validateSignature("'"+y+"'"))&&(_=!0)}_&&(e=addOption(e,"Anti-Qihoo 360"))
var b=["cuckoomon.","CUCKOOMON."],C=!1
if(r)for(l=0;l<b.length&&!C;l++){var v=b[l];(PE.isNetObjectPresent("IsCuckooSandboxPresent")||validateGlobalUnicodeString(v)||validateSignature("'"+v+"'"))&&(C=!0)}C&&(e=addOption(e,"Anti-Cuckoo"))
s=!1,i="wine_get_unix_file_name",(s=r&&(validateGlobalUnicodeString(i)||validateSignature("'"+i+"'"))?!0:s)&&(e=addOption(e,"Anti-Wine")),n=!1;(t=0!=(e=(n=validateNetUnicodeString("vmware")||validateNetUnicodeString("VirtualBox")||validateNetUnicodeString("VMBusHID")||validateGlobalUnicodeString("WDAGUtilityAccount")?!0:n)?addOption(e,"Anti-VM"):e).length?!0:t)&&_setResult("~protection","Anti analysis","",PE.isVerbose()?e:"")}function isCppClrLikeApp(){return PE_Cached.isDotNet&&PE_Cached.isRichSignaturePresent&&PE.isLibraryPresent("KERNEL32.DLL")&&PE_Cached.isNetGlobalCctorPresent}function isUnpackagedWindowsAppSdkLinked(){return PE.isNetObjectPresent("AutoInitialize")&&PE.isNetObjectPresent("InitializeWindowsAppSDK")}function NetOpCodes(){this.dup="25",this.nop="00",this.pop="26",this.add="58",this.add_ovf="D6",this.add_ovf_un="D7",this.div="5B",this.div_un="5C",this.mul="5A",this.mul_ovf="D8",this.mul_ovf_un="D9",this.neg="65",this.rem="5D",this.rem_un="5E",this.sub="59",this.sub_ovf="DA",this.sub_ovf_un="DB",this.and="5F",this.not="66",this.or="60",this.shl="62",this.shr="63",this.shr_un="64",this.xor="61",this.ceq="FE01",this.cgt="FE02",this.cgt_un="FE03",this.clt="FE04",this.clt_un="FE05",this.ldc_i4_m1="15",this.ldc_i4="20????????",this.ldc_i4_0="16",this.ldc_i4_1="17",this.ldc_i4_2="18",this.ldc_i4_3="19",this.ldc_i4_4="1A",this.ldc_i4_5="1B",this.ldc_i4_6="1C",this.ldc_i4_7="1D",this.ldc_i4_8="1E",this.ldc_i4_s="1F??",this.ldc_i8="21????????????????",this.ldc_r4="22????????",this.ldc_r8="23????????????????",this.ldnull="14",this.ldarg="FE09????",this.ldarg_0="02",this.ldarg_1="03",this.ldarg_2="04",this.ldarg_3="05",this.ldarg_s="0E??",this.starg_s="10??",this.ldarga="FE0A????",this.ldarga_s="0F??",this.starg="FE0B????",this.ldloca="FE09????",this.ldloca_s="12??",this.ldloc="FE0C????",this.ldloc_0="06",this.ldloc_1="07",this.ldloc_2="08",this.ldloc_3="09",this.ldloc_s="11??",this.stloc="FE0E????",this.stloc_0="0A",this.stloc_1="0B",this.stloc_2="0C",this.stloc_3="0D",this.stloc_s="13??",this.ldfld="7B????????",this.ldflda="7C????????",this.ldsfld="7E????????",this.ldsflda="7F????????",this.stfld="7D????????",this.stsfld="80????????",this.ldelem="A3????????",this.ldelem_i="97",this.ldelem_i1="90",this.ldelem_i2="92",this.ldelem_i4="94",this.ldelem_i8="96",this.ldelem_r4="98",this.ldelem_r8="99",this.ldelem_ref="9A",this.ldelem_u1="91",this.ldelem_u2="93",this.ldelem_u4="95",this.ldelema="8F????????",this.ldlen="8E",this.newarr="8D????????",this.stelem="A4????????",this.stelem_i="9B",this.stelem_i1="9C",this.stelem_i2="9D",this.stelem_i4="9E",this.stelem_i8="9F",this.stelem_r4="A0",this.stelem_r8="A1",this.stelem_ref="A2",this.ldind_i="4D",this.ldind_i1="46",this.ldind_i2="48",this.ldind_i4="4A",this.ldind_i8="4C",this.ldind_r4="4E",this.ldind_r8="4F",this.ldind_ref="50",this.ldind_u1="47",this.ldind_u2="49",this.ldind_u4="4B",this.stind_i="DF",this.stind_i1="52",this.stind_i2="53",this.stind_i4="54",this.stind_i8="55",this.stind_r4="56",this.stind_r8="57",this.stind_ref="51",this.beq="3B????????",this.beq_s="2E??",this.bge="3C????????",this.bge_s="2F??",this.bge_un="41????????",this.bge_un_s="34??",this.bgt="3D????????",this.bgt_s="30??",this.bgt_un="42????????",this.bgt_un_s="35??",this.ble="3E????????",this.ble_s="31??",this.ble_un="43????????",this.ble_un_s="36??",this.blt="3F????????",this.blt_s="32??",this.blt_un="44????????",this.blt_un_s="37??",this.bne_un="40????????",this.bne_un_s="33??",this.br="38????????",this.br_s="2B??",this.break_="01",this.brfalse="39????????",this.brfalse_s="2C??",this.brtrue="3A????????",this.brtrue_s="2D??",this.call="28????????",this.calli="29????????",this.callvirt="6F????????",this.jmp="27????????",this.ldtoken="D0????????",this.ldftn="FE06????????",this.ldvirtftn="FE07????????",this.leave="DD????????",this.leave_s="DE??",this.ret="2A",this.switch__nobody="45",this.box="8C????????",this.castclass="74????????",this.ckfinite="C3",this.conv_i="D3",this.conv_i1="67",this.conv_i2="68",this.conv_i4="69",this.conv_i8="6A",this.conv_ovf_i="D4",this.conv_ovf_i_un="8A",this.conv_ovf_i1="B3",this.conv_ovf_i1_un="82",this.conv_ovf_i2="B5",this.conv_ovf_i2_un="83",this.conv_ovf_i4="B7",this.conv_ovf_i4_un="84",this.conv_ovf_i8="B9",this.conv_ovf_i8_un="85",this.conv_ovf_u="D5",this.conv_ovf_u_un="8B",this.conv_ovf_u1="B4",this.conv_ovf_u1_un="86",this.conv_ovf_u2="B6",this.conv_ovf_u2_un="87",this.conv_ovf_u4="B8",this.conv_ovf_u4_un="88",this.conv_ovf_u8="BA",this.conv_ovf_u8_un="89",this.conv_r_un="76",this.conv_r4="6B",this.conv_r8="6C",this.conv_u="E0",this.conv_u1="D2",this.conv_u2="D1",this.conv_u4="6D",this.conv_u8="6E",this.isinst="75????????",this.mkrefany="C6????????",this.refanytype="FE1D",this.refanyval="C2????????",this.sizeof="FE1C????????",this.unbox="79????????",this.unbox_any="A5????????",this.cpblk="FE17",this.cpobj="70????????",this.initblk="FE18",this.initobj="FE15????????",this.ldobj="71????????",this.ldstr="72????????",this.localloc="FE0F",this.newobj="73????????",this.stobj="81????????",this.endfilter="FE11",this.endfinally="DC",this.rethrow="FE1A",this._throw="7A",this.constrained="FE16????????",this.no_="FE19??",this.readonly="FE1E",this.unaligned="FE12??",this.volatile="FE13",this._unknown="**",this._any="??",this.arglist="FE00",this.setStrict=function(e,t){e=removeWhitespaces(e),t=removeWhitespaces(t)
var i=e.indexOf("??"),n=-1!==i,i=n?e.substring(0,i):e
return n&&e.substring(i.length).length!=t.length&&_error("The size of the input values does not match."),i+t},this.setNullValue=function(e){return-1===e.indexOf("??")&&_error("Instruction does not have a body to overwrite the value."),replaceAllInString(e,"??","00")},this.joinNoBodyAndValue=function(e,t,i){return e&&"string"==typeof e||_error("Invalid opcode provided."),t&&"string"==typeof t||_error("Invalid value provided."),-1!==e.indexOf("??")&&_error("Opcode contains wildcards. Use setStrict() instead."),i&&"string"==typeof i&&-1===i.indexOf("__nobody")&&_error("joinNoBodyAndValue should only be used with '__nobody' opcodes (variable-length instructions)."),e+removeWhitespaces(t)}}function removeWhitespaces(e){return e&&"string"==typeof e?e.replace(/\s+/g,""):""}function replaceAllInString(e,t,i){return e&&"string"==typeof e?t&&"string"==typeof t?("string"!=typeof i&&(i=""),e.split(t).join(i)):e:""}function clearSectionName(e){return e&&"string"==typeof e?e.replace(/[\x00-\x1F\x7F-\x9F]/g,"").trim():""}function isAsciiString(e){return!(!e||"string"!=typeof e)&&/^[\x20-\x7E]+$/.test(e)}function getFileNameWithoutExtension(e){var t
return e&&"string"==typeof e?-1===(t=e.lastIndexOf("."))?e:e.substring(0,t):""}function scanForPackersAndCryptors_NET_and_Native(){log(logType.nothing,"Scanning for packers and cryptors...")
var e="",M=!1,t=!1
if(PE_Cached.isDotNet){var i=!1
if(!isFrameworkComponent()&&"System.dll"!==PE_Cached.nameOfNetModuleName&&isAllNetReferencesPresent(["System.Reflection","get_EntryPoint","Assembly","Invoke","Load"])&&(i=!0,e="Assembly invoke"),findAndMark("System.Security.Cryptography",!1)!="")for(var n,x=["TripleDESCryptoServiceProvider","RSACryptoServiceProvider","DSACryptoServiceProvider","DESCryptoServiceProvider","AesCryptoServiceProvider","Rfc2898DeriveBytes","TripleDES","Rijndael","ECDsaCng","AesAEAD","Aes192Cbc","Aes256Cbc","Aes128Cbc","AesManaged","AesCng","RC2CryptoServiceProvider","RNGCryptoServiceProvider"],r=0;r<x.length;r++)t||(o=findAndMark(n=x[r],!0),i&&o.length&&(log(logType.net,"Crypto class present: "+n),t=!0,e=addOption(e,n)))
if(findAndMark("System.IO.Compression",!1).length)for(var X=["DeflateStream","GZipStream"],r=0;r<X.length;r++){var s=X[r],o=findAndMark(s,!0)
if(i&&o.length){log(logType.net,"Compression class present: "+s),t&&(e=addOption(e,s))
break}}var a=!1;(validateNetObject("RunPE")||validateNetObject("PELoader")||validateNetObject("CMemoryExecute")||validateNetObject("GetProcAddress")&&validateNetUnicodeString("WriteProcessMemory")&&validateNetUnicodeString("VirtualAllocEx")&&validateNetUnicodeString("ZwUnmapViewOfSection")||(validateNetObject("WriteProcessMemory")||validateNetObject("NtWriteVirtualMemory"))&&(validateNetObject("ZwUnmapViewOfSection")||validateNetObject("NtUnmapViewOfSection"))&&(validateNetObject("CreateProcess")||validateNetObject("NtCreateProcess")||validateNetObject("CreateProcessA")||validateNetObject("CreateProcessW"))&&validateNetObject("VirtualAllocEx"))&&(log(logType.net,"RunPE-like behavior detected!"),a=!0),a&&(e=addOption(e,"RunPE"))}var l=!1
if(!PE_Cached.isDynamicLinkLibrary&&PE.isOverlayPresent()){for(var d=["'Rar!'","'PK'03","';!@Install@!UTF-8!'","'7z'BCAF271C","efbbbf';!@Install@!UTF-8!'"],c=0;c<d.length;c++)PE.compareOverlay(d[c])&&(log(logType.nothing,"SFX overlay pattern: "+d[c]),l=!0)
if(!l&&!PE_Cached.isDotNet){var u=["83EC..5657FF15........8BF08D4424..50C74424..........FF15........8A068B3D........3C..75..56FFD7","E9$$$$$$$$558BEC81EC........830D..........5356576A..33DBBF........68........895D..881D","558BEC83EC..56FF15........8BF08A003C..75..84C074..803E..74..46803E..75..803E..75..46EB","6A..33C0505050FF15........50E8$$$$$$$$55B8........8BECE8........53B9........5657BE","6A..68........E8........66813D............75..A1........81B8................75..","558BEC83EC..565733FFFF15........8BF0897D..8D45..50FF15........8A063C..75..56FF15","51526A..2EFF15........506A..6A..2EFF15........50E8........502EFF15........5A59C3","558BEC81EC........535657FF15........A3........FF15........A1........6625....3D","558BECB8........E8........5356BE........578D45..5633DB5053FF15........85C00F84","A1........C1E0..A3........575133C0BF........B9........3BCF76..2BCFFCF3AA595F","558BEC83C4..5356E8$$$$$$$$E8........6A..E8........8905........E8........8905","FF15........B1..380874..B1..4080....74..380874..4080....75..80....74..4033","53FF15........B3..38..74..80C3..4033D28A083ACA74..3ACB74..408A083ACA75","558BEC83C4..535657E8........E8........33C05568........64FF30648920E8","53FF15........B3..38..74..80C3..8A48..4033D23ACA74..3ACB74..8A48..40","E8$$$$$$$$53BB........E8........85C074..33D28A1083FA..75..40EB","FFFE2A002A002A006D0065007300730061006700650073002A002A002A00","E8$$$$$$$$558BEC83C4..B8........53","8A48014033D23ACA740A3ACB74068A4801"]
if(PE.isSectionNamePresent("_winzip_")&&(l=!0),PE_Cached.isArchX86)for(var g=0;g<u.length;g++)PE.compareEP(u[g])&&(log(logType.nothing,'EP like SFX: "'+u[g]+'"'),l=!0)}}l&&(e=addOption(e,"SFX"))
for(var P,w=!1,V=["53565755488D35........488DBE","B8........68........64","60..................E8","33C08BC068........68","74..E9........60E8","EB0668........C39C","93071F05....8ED0BC","60BE........8DBE","B8........6A..68","BE........AD8BF8","68........9C60E8","53558BE833DBEB60","E8000000005D81ED","BD........C745","57565351524150","B8........5064","8CCBBA....03DA","B8........669C","E8........53","8CC0FA8ED0BC","B8........60","8B44240456","1E068CC88E","1E068CCBBA","EB..9C60E8","9C60E8CA","60FCBED4","60EB..5D","60EB..E8","64FF35","6033C0","669C60","EB..60","60E8","6068","9C60"],H=0;H<V.length&&!w;H++)PE_Cached.isArchX86&&(P=V[H],PE.compareEP(P))&&(log(logType.nothing,'EP like a packer: "'+P+'"'),w=!0)
w&&(e=addOption(e,"EntryPoint"))
var p,$=!1
if(PE_Cached.isArchX86)switch(p=getFirstEpAsmOpCode()){case"PUSHAL":case"PUSHA":case"PUSHF":case"POPA":log(logType.nothing,'"'+p+'" at EP'),$=!0}else switch(p=getFirstEpAsmOpCode()){case"POP":case"STMDB":case"LDMIA":case"STMFD":case"LDMFD":log(logType.nothing,'"'+p+'" at EP'),$=!0}$&&(e=addOption(e,p[0].toUpperCase()+p.toLowerCase().substring(1,p.length)+" at EP"))
a=!1
if(!PE_Cached.isDynamicLinkLibrary&&1<PE_Cached.numberOfSections){for(var E=-1,m=-1,r=1;-1==E;r++)E=PE.OffsetToVA(PE.getSectionFileOffset(PE_Cached.numberOfSections-r))
E<=(m=PE.getAddressOfEntryPoint())&&(log(logType.nothing,"EP address (0x"+m.toString(16)+") more than last section address (0x"+E.toString(16)+")"),a=!0)}a&&(e=addOption(e,"Last section EP"))
for(var m=!1,a=(PE_Cached.isArchX86?(h=getAsmOpCode(PE_Cached.firstEpAsmInstruction),PE_Cached.isDynamicLinkLibrary||!a||PE.compareEP("E8 00 00 00 00")||"CALL"!==h&&"JMP"!==h||(log(logType.nothing,"Strange "+h.toLowerCase()+" at EP to address: "+PE_Cached.firstEpAsmInstruction.split(" ")[1].toLowerCase()),m=!0)):(h=getAsmOpCode(PE_Cached.firstEpAsmInstruction),PE_Cached.isDynamicLinkLibrary||!a||"B"!==h&&"BL"!==h&&"BX"!==h&&"BLX"!==h||(log(logType.nothing,"Strange "+h.toLowerCase()+" at EP to address: "+PE_Cached.firstEpAsmInstruction.split(" ")[1].toLowerCase()),m=!0)),m&&(e=addOption(e,"Strange "+h.toLowerCase()+" at EP")),!1),m=validateImportHashes([["UPX","0.59-0.93",0,3573402289,0],["UPX","0.94-1.93",0,491858330,0],["UPX","1.94-2.03",0,[3006365830,930654905],0],["UPX","2.90-3.XX",0,4084592131,0],["UPX","2.90-3.XX",-1,4147632211,0],["UPX","3.91+",-1,[2191542524,1430918984],0],["PESpin",null,2,3573402289,0],["NsPack",null,0,4084592131,0],["NsPack","3.X",0,2249268809,0],["ASPack","1.XX-2.XX",0,309523547,0],["ASPack",null,0,4000227700,0],["MKFPACK",null,0,1119086585,0],["MPRESS",null,0,391052164,0],["Packman","0.0.0.1",0,391052164,0],["Packman","1.0",0,1762093699,0],["PECompact","0.90-0.91",-1,3198424785,0],["PECompact","0.92-0.94",-1,2469473326,0],["PECompact","0.97-0.971b",-1,3869934741,0],["PECompact","1.10b7-1.34",-1,3837858565,0],["PECompact","1.30-1.40",0,2603812333,0],["PECompact","1.40-1.84",0,3428526652,0],["PECompact","2.40-3.XX",0,642960975,0],["PECompact","2.40-3.XX",-1,3683629941,0],["tElock","1.0",-1,85542647,0],["tElock","0.98",0,911341197,0],["JDPACK","2.00",0,3221412622,0],["CRINKLER",null,0,185475007,0],["XComp","0.97-0.98",-1,3927860964,0],["XPack",null,-1,[717508050,1813449395],0],["kkrunchy",null,0,689473049,0],["ANDPakk2","0.18",-1,689473049,0],["RLPack","1.1-1.2",0,1540478739,0],["RLPack","1.16+",0,1753837915,0],["Petite","2.2",-1,1642411650,0],["bambam","0.1-0.4",0,3048297421,0],["py2exe",null,2,3851452410,0],["py2exe",null,-1,3309619794,0],["MEW",null,0,2267106898,0],["nPack","1.1+",0,3129734334,0],["CExe","1.0a",0,3707200722,0],["PE-PACK","1.0",0,2765710967,0],["BoxedApp",null,0,1644609730,0],["VPacker","0.02.X",0,3955473552,0],["PKLITE32","1.1",0,[1646205435,3993289522],0],["PKLITE32","1.1",1,407189991,0],["PeX","0.99",0,1606377432,0],["XComp",null,0,1271213687,0],["Fatpack",null,0,1948535057,0],["Yoda's Crypter","1.X",-1,319005979,1],["EXECryptor","1.4-1.5",-1,3521008565,1],["EXECryptor","2.X",-1,4112197655,1],["Amber",null,-1,2546409553,1],["Lumy",null,-1,2182506965,1],["ASProtect","1.XX-2.XX",0,309523547,2],["Shrinker","3.2",0,[2997241944,361427664,1239984671],2],["Shrinker","3.5",0,[3924428881,860141917,1482721523],2],["Enigma","1.00-3.60",0,3221412622,2],["Enigma","2.XX",0,3717389840,2],["Enigma","3.70+",0,3494672976,2],["PCGUARD","5.04-5.05",0,[1511431290,185280869],2],["Vbs To Exe",null,1,[734392825,10102889,1518135254,3843270269,1298528546],2],["eXPressor","1.2",-1,[1723030638,854869612],2],["eXPressor","1.3",-1,[2451374720,4112431720,3162820105],2],["eXPressor","1.4.5.X",0,[1115166379,1013996718,1292034195,2508889762],2],["eXPressor","1.5.0.X",-1,[2059058010,2513049060,3175209504],2],["eXPressor","1.6",-1,3394828812,2],["eXPressor","1.6",0,817627193,2],["eXPressor","1.6.1",0,2776181286,2],["eXPressor","1.6.1",-1,1224725337,2],["VMProtect","1.70",-1,536023103,2],["VMProtect","2.0.3-2.13",-1,2635247955,2],["VMProtect","3.0.0",-1,508887233,2],["VMProtect","3.0.9",-1,3321588299,2],["VMProtect","3.2.0-3.5.0",-1,1554684359,2],["VMProtect","3.6.0+",-1,[1725970772,3672765808],2],["YodasProtector","1.0b",-1,319005979,2],["ASM Guard","2.XX+",-1,4058043963,2],["Themida","2.XX-3.XX",0,1073532042,2],["Themida",null,0,2912404739,2],[".NET Reactor",null,0,2529070630,2],[".NET Reactor",null,1,3033375535,2],["Bat To Exe Converter",null,0,1923271268,2],["Vbs To Exe Converter",null,0,405449832,2],["DNGuard",null,0,943924593,2],["DNGuard","4.9+",0,2583213454,2],["obfus.h",null,-1,49575711,2],["Crunch","1.0-2.0",0,1633052125,2],["Private EXE Protector",null,0,3634034317,2],["CodeVirtualizer",null,4,1337911843,2],["PELock",null,0,[1857615601,3849451285],2],["PELock","2.X",0,3781729660,2],["CrypToCrack","0.9.X",0,2334702414,2],["DBPE",null,0,[807065429,859859683],2],["Virbox",null,0,3874160781,2],["Quick Batch File Compiler",null,-1,879780090,2],["CodeVeil",null,0,3536358044,2]]),h=(null!=m&&(S=m[1],log(logType.nothing,"Imports hash like "+m[0]+(S?" (version "+S+")":"")),a=!0),a&&(e=addOption(e,"Imports like "+m[0]+(S?" (v"+m[1]+")":""))),!1),S=validateSectionNames([["DBPE",null,"        "],["Themida","2.XX","   "],["Themida","3.XX",[".imports",".loadcon",".themida",".winlice"]],["Themida",null,[".stub01","WinLicen",".v-lizer","Themida "]],["PEBundle",null,/^(PEB|peb)undle$/],["DZA Patcher",null,"yoda"],["UPX",null,/^UPX[0-3]$/],["VMProtect",null,/^\.vmp[0-3]$/],[".NET Reactor","2.XX",".reacto"],["ACProtect",null,".perplex"],["ANDpakk2",null,"ANDpakk2"],["ASM Guard","2.XX",[".asmg","ASMGUARD"]],["ASPack","1.08-2.XX",".adata"],["ASPack","2.XX",".aspack"],["ASPack",null,/^(\.)?ASPack$/],["Alienyze",null,".alien"],["BoxedApp",null,".bxpck"],["CodeVirtualizer",null,".vlizer"],["Enigma",null,/^\.enigma[12]$/],["Eronana",null,".packer"],["MPRESS",null,/^\.MPRESS[12]$/],["NsPack",null,[/^(\.)?nsp[01]$/,/^PE[Pp][01]$/,".Packer!"]],["PE Diminisher",null,".teraphy"],["PE-SHiELD",null,"PESHiELD"],["PECompact",null,[/^PEC2(MO)?$/,/^pec(1)?$/]],["PELock",null,["PELOCKnt",".pelock"]],["Petite",null,/^(\.)?petite$/],["SecuROM",null,[/^\.cms_[dt]$/,".securom",".dsstext"]],["StarForce","3.X",[".sforce3",".brick"]],["Wise Installer",null,".wise"],["Gentee Installer",null,".gentee"],["Nullsoft Installer",null,".ndata"],["WiX Installer",null,".wixburn"],["BeRoEXEPacker",null,["packerBY","bero^fr "]],["Warbird",null,"?g_Encry"],["YodasCrypter","1.X","yC"],["eXPressor",null,/^\.ex_(cod|rsc)$/],["kkrunchy",null,"kkrunchy"],["tElock",null,"UPX!"],["Private EXE Protector",null,[".-PEP-",".TRIAL!",".const"]],["AtomPePacker",null,".ATOM"],["ExeStealth",null,"ExeS"],["RLPack",null,[".RLPack",".packed"]],["RLPack",null,"Obsidium"],["BattlEye",null,/^\.be[0-2]$/],["YodasProtector","1.0b",[".y0da",".yP"]],["obfus.h",null,".obfh"],["Windows PE Packer by Chenzs108",null,".shell"],["SoftSentry",null,[/^_(stext|rdata|data|idata|rsrc|reloc)$/,".prdata"]],["PE Lock Phantasm","1.X","DINGBOY"],["XComp",null,/^\.XComp(0)?$/],["XVolkolak",null,".xvlk"],["NetShield",null,"!Sugar"],["Fatpack",null,".fpack  "],["Safengine Shielden",null,".sedat"],["Inquartos Obfuscator",null,".inq"],["WinUPack",null,[".ByDwing",".Upack"]],["Xenocode Postbuild",null,".xcpad"],["Alloy",null,".alloy32"],["Crinkler",null,"lz32.dll"],["Crunch","2.0","BitArts"],["CrypToCrack",null,".ccp3p"],["DxPack","1.0",["coderpub",".reloc1"]],["EXE Pack",null,"!EPack"],["FishPE Shield",null,".FishPE"],["FishPE",null,".FISHEP"],["G!X Protector",null,".g!x"],["JDPack",null,".jdpack"],["Krypton",null,["krypton","YADO","_!_!_!_"]],["MEW",null,"MEW"],["MaskPE",null,".MaskPE"],["Morphnah","1.0.X",".nah"],["NakedPacker",null,/^\.naked[12]$/],["NativeCryptor",null,/^(NATIVES|CONFIG|(F)?CRYPT)~$/],["NeoLite",null,".neolite"],["PE-PACK","1.0","PEPACK!!"],["Perplex",null,".perplex"],["RLP",null,".rlp"],["ORiEN","2.XX",".loader"],["SC Pack",null,".scpack"],["SVK Protector",null,["SVKP",/\.svkp( )?/]],["SafeNet",null,/^\.AKS[1-3]$/],["Shrinker",null,".shrink1"],["Simple Pack",null,".spack"],["Software Compress",null,"SoftComp"],["StarForce","4.X-5.X",".ps4"],["VCL",null,".vcl"],["VirtualizeProtect",null,"VProtect"],["WWPack",null,".WWPACK"],["WWPack32",null,".WWP32"],["dePack","1.3.5",".depack"],["hmimys","1.3","hmimys"],["nPack",null,".nPack"],["yzPack",null,".yzpack2"],["NeoLite",null,".neolit"],["bambam",null,".bedrock"],["WibuKey",null,".wibu"],["Wibu CodeMeter",null,/^__wibu0[01]$/],["AverCryptor","1.0-1.02",[".avc",".Polyene"]],["Huan",null,".huan"],["Morphnah","1.0.X",".nah"],["TSULoader",null,".tsustub"],["RPCrypt",null,/^\.R(Cryptor|PCrypt)$/],["ExE Pack",null,["!EPack",".!ep"]],["XerinFuscator",null,".Xerin"],["AZProtect 0001",null,"AZPR0001"],["ExeShield",null,".shield"],["XPack",null,/^\.XPack(0)?$/],["KByS",null,".shoooo"],["HyperTech Crackproof",null,"peC"],["Byfron",null,/^\.byfron(1)?$/],["DYAMAR","1.3.X",/^\.dyamar[CD]$/],["Alcatraz",null,".0Dev"],["Squishy",null,"logicoma"],["DragonArmor","0.0.4.1",/^(\.)?DAStub$/],["EXECrypt","1.0","CRPT"],["N-Code","0.2",[".pepsi","n-coded",".vrs"]],["NoodleCrypt","2.X",[".Ncryo  ",".De-vir "]],["TheArk",null,["30cm",".tw"]],["Virbox",null,/^\.v(data[1-9]|irbox[1-9]?)$/],["ElecKey",null,".sstb"],["PKLITE32","1.1",".pklstb"],[".BJFnt","1.X",".BJFnt"],["Goliath",null,".GOLIATH"],["PE Encrypt",null,[".ice",".lea"]],["PECRYPT32",null,".ficken"],["PolyCrypt","2.8",/^sec[0-9]$/],["RCryptor",null,/^(\.)?RCryptor$/],["SDProtector",null,".data "],["Shielden",null,".sedata"],["SimbiOZ",null,".ximera"],["LARP","2.X","SnD "],["DalKrypt","1.X",".DalKiT"],["Fish PE","1.2-1.4",".PEDATA"],["NoobyProtect (Safengine)",null,"SE"],["KeySec",null,".ksec"],["Lumy",null,".lumy"],["TomatoX",null,".tomato"],["PwdProtect",null,".pwdprot"],["ID Application",null,/^\.Prt(1)?$/],["PETetris",null,"PETETRIS"]].concat([["Enigma",/^(\.)?enigma$/i],["UPX",[/^\.upx/i,/^upx/]],["VMProtect",/^(\.)?vmp$/i],["MPRESS",/^mpress/i],["Denuvo",/denuvo/i],["Themida",".Themida"]].map(function(e){return["fake "+e[0],null,e[1]]})).concat([["a packer",null,[/p(a)?ck|sh(e)?ll|exe|^\.pe/i,/^PE/]],["a cryptor",null,[/crypt|crpt|stub|enc|inj/i,/stb/]],["a protector",null,[/(?!^prot$)prot|safe|lock|sec|virt|obf|guard|sh(ie)?ld/i,/DRM|drm/]]])),f="",f=(null!=S&&(f=S[1],log(logType.nothing,"Sections like "+S[0]+(f?" (v"+f+")":"")),h=!0),h&&(e=addOption(e,"Sections like "+S[0]+(f?" (v"+S[1]+")":""))),!1),_=validateResourceNames([["Bat To Exe Converter",null,/^(?=[0-9A-F]{40}$)(?=.*[0-9])(?=.*[A-F])[0-9A-F]{40}$/],["Fatpack",null,"FPACK"],["Quick Batch File Compiler",null,"PLATFORMTARGETS"],["ScriptCryptor",null,"AOPT"],["ExeStealth",null,"TN"],[".NET Reactor",null,"__"],["SoftEntry",null,"SENTRYABORTDLG"],["ASM Guard",null,"ASMG.DLL"],["UPX Protector",null,"SCAREBYTE"],["Vbs To Exe",null,"B"],["QQProtect",null,"QQPROTECT"]]),y="",f=(null!=_&&(y=_[1],log(logType.nothing,"Resources like "+_[0]+(y?" (v"+y+")":"")),f=!0),f&&(e=addOption(e,"Resources like "+_[0]+(y?" (v"+y+")":""))),!1),_=PE.getSectionNameCollision("0","1"),j=(_.length&&(log(logType.nothing,'Section names collision: "'+clearSectionName(_)+'"'),f=!0),f&&(e=addOption(e,'Sections collision ("'+clearSectionName(_)+'")')),!1),b={},r=0;r<PE_Cached.numberOfSections&&!j;r++){var C=PE.getSectionName(r)
b[C]=(b[C]||0)+1,1<b[C]&&(log(logType.nothing,'Section names repeating: "'+clearSectionName(C)+'"'),j=!0)}b=void 0,j&&(e=addOption(e,"Section names repeating"))
for(var G=!1,v=-1,O=0;O<PE_Cached.numberOfSections&&!G;O++)v=O,7.4<PE.calculateEntropy(PE.getSectionFileOffset(v),PE.getSectionFileSize(v))&&(log(logType.any,"Section #"+v+' ("'+clearSectionName(PE.getSectionName(v))+'") entropy: '+PE.calculateEntropy(PE.getSectionFileOffset(v),PE.getSectionFileSize(v))),G=!0)
G&&(e=addOption(e,"Section #"+v+' ("'+clearSectionName(PE.getSectionName(v))+'") compressed'))
for(var U=[".bss","BSS",".tls","hydrated"],W=!1,N=-1,A=!1,k=!1,O=0;O<PE_Cached.numberOfSections&&!W;O++){var D,N=O;-1===U.indexOf(PE.getSectionName(N))&&((0===(D=PE.section[N]).FileOffset||D.FileOffset>PE.getSize()-PE.getOverlaySize())&&(A=!0),(0===D.FileSize||D.FileSize>PE.getSize()-PE.getOverlaySize())&&(k=!0),W=A||k)&&log(logType.any,"Section #"+N+' ("'+clearSectionName(PE.getSectionName(N))+'") has wrong '+(A?"offset (0x"+D.FileOffset.toString(16)+")":"")+(A&&k?", ":"")+(k?"size (0x"+D.FileSize.toString(16)+")":""))}W&&(e=addOption(e,"Section #"+N+' ("'+clearSectionName(PE.getSectionName(N))+'") has wrong '+(A?"offset":"")+(A&&k?" and ":"")+(k?"size":"")))
for(var z=!1,K=0,Z="",q=0,Y="",I={},r=0;r<PE_Cached.numberOfSections&&!z;r++){var R,T=r;-1===U.indexOf(PE.getSectionName(T))&&0!==(R=PE.section[T].FileOffset)&&(void 0===I[R]?I[R]=[T]:(log(logType.any,"Section #"+I[R][0]+' ("'+clearSectionName(PE.getSectionName(I[R][0]))+'") and #'+T+' ("'+clearSectionName(PE.getSectionName(T))+'") have one offset: 0x'+R.toString(16)),K=I[R][0],q=T,Z=clearSectionName(PE.getSectionName(K)),Y=clearSectionName(PE.getSectionName(q)),z=!0))}I=void 0,z&&(e=addOption(e,"Section #"+K+' ("'+Z+'") and #'+q+' ("'+Y+'") have one offset'))
for(var y=!1,f=(PE.isOverlayPresent()&&100<=PE.getOverlaySize()&&PE.compareOverlay("'MZ'")&&(log(logType.any,"PE signature at overlay detected"),y=!0),y&&(e=addOption(e,"PE at overlay")),!1),J=(!(y||l||PE.isSigned())&&PE.isOverlayPresent()&&(_=PE.calculateEntropy(PE.getOverlayOffset(),PE.getOverlaySize()),150<PE.getOverlaySize()&&7<_||PE.getOverlaySize()>PE.getSize()-PE.getOverlaySize())&&(log(logType.any,"Overlay size: "+PE.getOverlaySize()+" bytes; Entropy: "+_),f=!0),f&&(e=addOption(e,"Strange overlay")),!1),r=0;r<PE_Cached.numberOfUnmanagedResources&&!J;r++){var Q=PE.getResourceOffsetByNumber(r)
PE.compare("'MZ'",Q)&&(log(logType.any,"PE signature in resources detected"),J=!0)}J&&(e=addOption(e,"PE in resources"))
var y=!1,ee=((y=(!PE_Cached.isDynamicLinkLibrary||!PE.section[".rdata"]&&!PE.isSectionNamePresent(".rsrc"))&&7.3<PE.calculateEntropy(0,PE.getSize()-PE.getOverlaySize())?!0:y)&&(e=addOption(e,"High entropy")),!1),F={}
if(!_isResultPresent("linker","Turbo Linker"))for(r=0;r<PE_Cached.numberOfUnmanagedImports&&!ee;r++){var B=PE.getImportLibraryName(r)
F[B]=(F[B]||0)+1,3<=F[B]&&(log(logType.nothing,'Recurring import name: "'+B+'"'),ee=!0)}if(F=void 0,ee&&(e=addOption(e,"Recurring import names")),a&&!_getNumberOfResults("packer")&&!_getNumberOfResults("cryptor")&&!_getNumberOfResults("protector")&&!_getNumberOfResults("protection")){var L=""
switch(m[4]){case 0:L="packer"
break
case 1:L="cryptor"
break
case 2:L="protector"
break
case 3:L="protection"}L&&(_="",f=!1,m[1]?_=m[1]:h&&!/^(a [pc]|fake )$/.test(S[0])&&(m[0]===S[0]?S[1]&&(_=S[1]):f=!0),_setResult("~"+L,m[0]+(f?"-like":""),_,"Suspicion only"))}(M=0!=e.length?!0:M)&&_setResult("~"+(t?"cryptor":"packer"),"Generic","",PE.isVerbose()?e:"")}function scanForLicensingSystems_NET_and_Native(){log(logType.nothing,"Scanning for licensing systems...")
for(var e="",t=!1,i=(PE_Cached.isDotNet&&(o=!1,(o=validateNetObject("CheckLicense")||validateNetObject("set_License")||validateNetObject("Licensing")?!0:o)&&(e="DotNET methods"),o=!1,(o=validateNetObject("LicenseProviderAttribute")?!0:o)&&(e=addOption(e,"Provider attribute")),o=!1,o=!!validateNetObject("LicenseManager")||o)&&(e=addOption(e,"License manager")),!1),n=["nter serial ","erial key "," activate "," trial ","rong activation","rong licens","icense expire","valid license","icense key"," full version"," purchase a "],r=0;r<n.length;r++){var s=n[r]
if(PE.isSignaturePresent(0,PE.getSize(),"'"+s+"'")||PE.isSignaturePresent(0,PE.getSize(),"'"+generateUnicodeSignatureMask(s)+"'")){i=!0
break}}i&&(e=addOption(e,"Strings"))
var o=!1;(t=0!=(e=(o=PE.isLibraryPresentExp(/(Core\\Activation|Activation64)/i)?!0:o)?addOption(e,"Denuvo DRM"):e).length?!0:t)&&_setResult("~licensing","Contains","",PE.isVerbose()?e:"")}function scanForBadFileFormat_NET_and_Native(){log(logType.nothing,"Scanning for corrupted data...")
var e="",t=!1,i=!1,i=((i=PE.isEntryPointCorrect()?i:!0)&&(e=addOption(e,"EntryPoint")),!1),i=((i=PE.isSectionAlignmentCorrect()?i:!0)&&(e=addOption(e,"Section alignment")),!1),i=((i=PE.isFileAlignmentCorrect()?i:!0)&&(e=addOption(e,"File alignment")),!1),i=((i=PE.isHeaderCorrect()?i:!0)&&(e=addOption(e,"Header")),!1),i=((i=PE.isRelocsTableCorrect()?i:!0)&&(e=addOption(e,"Relocs")),!1),i=((i=PE.isImportTableCorrect()?i:!0)&&(e=addOption(e,"IAT")),!1),i=((i=PE_Cached.isDynamicLinkLibrary&&!PE.isExportTableCorrect()?!0:i)&&(e=addOption(e,"EAT")),!1),i=((i=PE.isResourcesTableCorrect()?i:!0)&&(e=addOption(e,"Resources")),!1),i=((i=!PE_Cached.isDotNet&&isNetMetaDataPresent()&&0==PE_Cached.numberOfUnmanagedImports?!0:i)&&(e=addOption(e,"DotNET headers/meta")),!1);(t=0!=(e=(i=PE_Cached.isDotNet&&!isAsciiString(PE.getNETVersion())?!0:i)?addOption(e,"DotNET CLR version"):e).length?!0:t)&&_setResult("~corrupted data","Generic","",PE.isVerbose()?e:"")}function scanForDebugData_NET_and_Native(){log(logType.nothing,"Scanning for debug data...")
for(var e="",t=!1,i=!1,n=-1,r=0;r<PE_Cached.numberOfSections&&!i;r++){var n=r,s=PE.getSectionName(r);/(debug|^\.stab(str)?$)/i.test(s)&&(log(logType.any,'Debug section detected: "'+clearSectionName(PE.getSectionName(n))+'"'),i=!0)}i&&(e="Section #"+n+' ("'+clearSectionName(PE.getSectionName(n))+'")')
var o=!1,o=(!PE_Cached.isDotNet&&PE.isExportFunctionPresent("DotNetRuntimeDebugHeader")&&(log(logType.any,".NET Native debug symbols detected"),o=!0),o&&(e=addOption(e,"DotNET runtime header")),!1),o=(!PE_Cached.isDynamicLinkLibrary&&PE.isExportFunctionPresent("main")&&(log(logType.any,'The "--export-all-symbols" linker option was probably used'),o=!0),o&&(e=addOption(e,"Symbols exported")),!1),a=PE.findSignature(PE.getDosStubOffset()+PE.getDosStubSize(),PE.getSize()-PE.getOverlaySize(),"%% %% %% '.pdb' 00"),l=0,d=""
if(-1!==a){for(r=a;0<r;r--)if(0===PE.readByte(r)){l=r+1
break}null!==(d=(d=255<(d=PE.getString(l,256)).length?d.substring(0,255)+" . . .":d).replace(/[\n\r]/g,"")).match(/^[a-zA-Z]:\\/)&&(log(logType.any,'PDB absolute path: "'+d+'"'),o=!0)}o&&(e=addOption(e,"Absolute PDB path"))
var a=!1,c="",o=(d&&"."!==d[0]&&!o&&(c=validateSignature("00 52 53 44 53")?"Embedded":"Portable",log(logType.any,c+' PDB name: "'+d+'"'),a=!0),a&&(e=addOption(e,c+" PDB (release)")),!1)
PE_Cached.isDotNet&&validateNetObject("costura.costura.pdb.compressed")&&(log(logType.any,"Costura embedded PDB detected"),o=!0),(t=0!=(e=o?addOption(e,"Costura.Fody embedded PDB"):e).length?!0:t)&&_setResult("~debug data","Contains","",PE.isVerbose()?e:"")}function isVbNetStandardLibraryPresent(){return PE.isNetObjectPresent("Microsoft.VisualBasic")}function isJscriptNetStandardLibraryPresent(){return PE.isNetObjectPresent("Microsoft.JScript")}function isFrameworkComponent(){var e,t
return!(!PE_Cached.isDotNet||!PE_Cached.isDynamicLinkLibrary||PE_Cached.isNetGlobalCctorPresent)&&(e=PE_Cached.nameOfNetAssemblyName,t=PE_Cached.nameOfNetModuleName,6<=e.length)&&"System"===e.substring(0,6)&&t===e+".dll"}function validateSignature(e){var t=PE.findSignature(PE.getDosStubOffset()+PE.getDosStubSize(),PE.getSize()-PE.getOverlaySize(),e),i=-1!=t
return i&&(lastOffsetDetected="0x"+Number(t).toString(16),log(logType.any,"Pattern found: "+e)),i}function validateNetByteCode(e){for(var t=0;t<PE_Cached.numberOfSections;t++){var i=PE.getSectionFileOffset(t),n=PE.getSectionFileSize(t),i=PE.findSignature(i,i+n,e)
if(-1!=i)return lastOffsetDetected="0x"+Number(i).toString(16),log(logType.net,"ByteCode detected: "+e),!0}return!1}function validateNetObject(e){var t=PE.isNetObjectPresent(e)
return t&&log(logType.net,"Object present: "+e),t}function validateNetUnicodeString(e){var t=PE.isNetUStringPresent(e)
return t&&log(logType.net,'String present: "'+e+'"'),t}function validateGlobalUnicodeString(e){var t=-1!=PE.findSignature(PE.getDosStubOffset()+PE.getDosStubSize(),PE.getSize()-PE.getOverlaySize(),generateUnicodeSignatureMask(e))
return t&&log(logType.nothing,'Unicode string found: "'+e+'"'),t}function generateUnicodeSignatureMask(e){for(var t="",i=0;i<e.length;i++)t+=(0!=i?"00":"")+"'"+e[i]+"'"
return t}function isAllNetReferencesMissing(e){for(var t=0;t<e.length;t++)if(PE.isNetObjectPresent(e[t]))return!1
return!0}function isAllNetReferencesPresent(e){for(var t=0;t<e.length;t++)if(!PE.isNetObjectPresent(e[t]))return!1
return!0}function findAndMark(e,t){return PE.isSignatureInSectionPresent(0,"00'"+e+"'"+(t?"00":""))?e:""}function isNameObfuscated(e){if(e&&0!==e.length)if(-1!==e.indexOf(" "))for(var t=e.split(/\s+/),i=0;i<t.length;i++){var n=t[i]
if(0==i&&n.match(/^[A-Z]{3,}/))return!1
if(isTokenObfuscated(n))return log(logType.nothing,'Obfuscated string segment: "'+n+'" in "'+e+'"'),!0}else for(var r=0;r<e.length;r+=20){var s=e.substring(r,r+20)
if(isTokenObfuscated(s))return log(logType.nothing,'Obfuscated string chunk: "'+s+'" in "'+e+'"'),!0}return!1}function isTokenObfuscated(e){if(!e||e.length<7)return!1
if(e.match(/^\d{4}[-\/\.]\d{4}$/)||e.match(/^\d{1,2}[-\/\.]\d{1,2}[-\/\.]\d{2,4}$/)||e.match(/^\d{4}[-\/\.]\d{1,2}[-\/\.]\d{1,2}$/))return!1
if(e.match(/^v?\d+(\.\d+){1,4}$/i))return!1
if(e.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i))return!1
if(e.match(/^0x[0-9a-f]+$/i))return!1
if(e.match(/^\d+(\.\d+)?(bytes?|[kmgt]b)$/i))return!1
if(e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/))return!1
if(e.match(/^[A-Z]{2,}[0-9]{1,3}$/))return!1
if(e.match(/^\d{6,12}$/))return!1
if(e.match(/^[Vv]\d{1,2}\.\d{1,4}/))return!1
if(e.match(/(buildbot|builder|jenkins|gitlab|runner|relclient|steam|win32|win64|x64|x86)/i))return!1
for(var t={digits:0,lower:0,upper:0,special:0,transitions:0},i=[],n=0;n<e.length;n++){var r=e[n],s=i[i.length-1],r="0"<=r&&r<="9"?(t.digits++,"digit"):"a"<=r&&r<="z"?(t.lower++,"lower"):"A"<=r&&r<="Z"?(t.upper++,"upper"):(t.special++,"special")
i.push(r),s&&s!==r&&t.transitions++}var o=e.length,a=t.lower+t.upper
if(.6<t.transitions/o&&4<=t.digits)return!0
if(e.match(/^(?:[a-z]\d){4,}$/i))return!0
if(e.match(/^(?=\d|[a-z])(?=.*[a-z]\d[a-z])(?=(?:.*\d){4,})/i))return!0
if(e.match(/^[0-9a-f]{8,}$/i)&&!e.match(/^(dead|beef|cafe|babe|fade|deed|feed|face|decade|deface)$/i))return!0
if(e.match(/(.{2,3})\1{2,}/))return!0
if(e.match(/(?:[a-z]+\d+){4,}/i)&&4<=t.digits)return!0
if(e.match(/(?:[a-z]\d{3,}){2,}/i))return!0
if(e.match(/[bcdfghjklmnpqrstvwxz]{6,}/i)&&!e.match(/str|chr|thr|sch|scr|spr/i)&&!e.match(/([bcdfghjklmnpqrstvwxz])\1/i))return!0
for(var l={},n=0;n<e.length;n++){var d=e[n].toLowerCase()
if(-1!=="bcdfghjklmnpqrstvwxz".indexOf(d)&&(l[d]=(l[d]||0)+1,5<=l[d])&&e.length<15)return!0}if(e.match(/qwerty|asdfgh|zxcvbn|yuiop|hjkl|cvbnm|poiuy|lkjh/i))return!0
for(var c=0,n=1;n<e.length;n++){var u=e[n],g=e[n-1];("0"<=u&&u<="9"&&("a"<=g&&g<="z"||"A"<=g&&g<="Z")||("a"<=u&&u<="z"||"A"<=u&&u<="Z")&&("0"<=g&&g<="9"))&&c++}return 8<=c||7<=t.digits||4<=t.digits&&.4<t.digits/o||5<=t.digits&&3<=t.lower&&3<=t.upper||6<=t.digits&&5<=t.lower||5<=a&&5<=t.digits&&0===t.upper&&t.lower===a}function scanForObfuscations_Native(){log(logType.nothing,"Scanning for obfuscation...")
for(var e="",t=!1,i=!1,n=(1===PE_Cached.numberOfSections&&(log(logType.any,"Only one section found!"),i=!0),i&&(e=addOption(e,"Only one section")),!1),r="-=+~!@#$%^&*()\"№;%:?*():;,/\\|'`<> ",s=0;s<PE_Cached.numberOfSections&&!n;s++){var o=PE.getSectionName(s),a=((o.length<3||/^.\d.+/.test(o)&&".00cfg"!==o||" "===o[0])&&(n=!0),!1)
if(_isResultPresent("linker","GNU linker ld (GNU Binutils)"))if(PE.isSectionNamePresent(".build-id"))a=!0
else for(var l=1;l<10&&!a;l++)-1!=o.indexOf("/"+l)&&(a=!0)
if(a){n=!1
break}for(l=0;l<r.length&&!n;l++)-1!==o.indexOf(r[l])&&(n=!0)
isAsciiString(o)||(n=n||!0)}n&&(e=addOption(e,"Strange sections"))
var i=!1,d=!1
if(0===PE.getDosStubSize())i=!0
else for(var c=["This program cannot be run in DOS mode.","This program must be run under Windows","This program must be run under Win32","This program must be run under Win64","This program requires Win32","This is a Windows NT character-mode executable"],d=!0,l=0;l<c.length&&d;l++)PE.isSignaturePresent(PE.getDosStubOffset(),PE.getDosStubSize(),"'"+c[l]+"'")&&(d=!1)
i?e=addOption(e,"Missing DOS"):d&&(e=addOption(e,"Custom DOS"))
for(var u=!1,s=0;s<PE_Cached.numberOfUnmanagedImports&&!u;s++){var g=PE.getImportLibraryName(s).toLowerCase()
!(4<g.length&&"."===g[g.length-4]||!(u=!0))}u&&(e=addOption(e,"No extension import"))
for(var P=!1,s=0;s<PE_Cached.numberOfUnmanagedImports&&!P;s++){var p=PE.getImportLibraryName(s).toLowerCase()
4<p.length&&"ntoskrnl.exe"!==p&&".exe"===p.substr(p.length-4,4)&&(P=!0)}P&&(e=addOption(e,"EXE in imports"))
for(var E=!1,s=0;s<PE_Cached.numberOfUnmanagedResources&&!E;s++)-1===PE.getResourceOffsetByNumber(s)&&(E=!0)
E&&(e=addOption(e,"Unreadable resources"))
var i=!1,i=((i=PE_Cached.isDynamicLinkLibrary&&PE.isExportFunctionPresentExp(/^(Start|main|_start|(w)?WinMain|EntryPoint)$/)?!0:i)&&(e=addOption(e,"EXE as DLL")),!1),i=((i=0<PE_Cached.numberOfSections&&".text"!==PE.section[0].Name&&".textbss"!==PE.section[0].Name&&(PE.isSectionNamePresent(".text")||PE.isSectionNamePresent(".textbss"))&&".code"===PE.section[0]?!0:i)&&(e=addOption(e,'".text" section is not first')),!1),m=!1,i=(-1!==PE_Cached.indexOfImportsSection||PE_Cached.isDynamicLinkLibrary?-1===PE_Cached.indexOfImportsSection||PE_Cached.numberOfUnmanagedImports||(m=!0):i=!0,i?e=addOption(e,"No IAT"):m&&(e=addOption(e,"Empty IAT")),!1),m=((i=PE_Cached.isDynamicLinkLibrary&&PE.getAddressOfEntryPoint()&&-1===PE_Cached.indexOfImportsSection&&-1===PE_Cached.indexOfExportsSection?!0:i)&&(e=addOption(e,"No IAT and EAT")),!1),h=!1,S=(!i&&PE_Cached.isDynamicLinkLibrary&&(-1===PE_Cached.indexOfExportsSection&&PE.getAddressOfEntryPoint()?m=!0:-1!==PE_Cached.indexOfExportsSection&&0===PE_Cached.numberOfUnmanagedExports&&(h=!0)),m?e=addOption(e,"No EAT"):h&&(e=addOption(e,"Empty EAT")),!1)
if(PE_Cached.isArchX86){var i=["MOV ESI, ESI","XCHG EAX, EAX","XCHG EBX, EBX","XCHG ECX, ECX","XCHG EDX, EDX","XCHG EDI, EDI","LEA EAX, [EAX]","LEA ESI, [ESI]","LEA ESI, CS:[ESI]"],m=["MOV RSI, RSI","XCHG RAX, RAX","XCHG RBX, RBX","XCHG RCX, RCX","XCHG RDX, RDX","XCHG RDI, RDI","LEA RAX, [RAX]","LEA RSI, [RSI]","LEA RSI, CS:[RSI]"],M=["XCHG AX, AX","XCHG BX, BX","XCHG CX, CX","XCHG DX, DX","XCHG SI, SI","XCHG DI, DI","XCHG BP, BP"].concat(PE_Cached.is64bit?m:i)
if("NOP"===getFirstEpAsmOpCode())S=!0
else for(s=0;s<M.length&&!S;s++)PE_Cached.firstEpAsmInstruction===M[s]&&(S=!0)}else{var h=["NOP","MOV R0, R0","MOV R1, R1","MOV R2, R2","MOV R3, R3","MOV R4, R4","MOV R5, R5","MOV R6, R6","MOV R7, R7","MOV R8, R8","MOV R9, R9","MOV R10, R10","MOV R11, R11","MOV R12, R12","MOV R13, R13","MOV R14, R14","MOV R15, R15"],m=["NOP","MOV X0, X0","MOV X1, X1","MOV X2, X2","MOV X3, X3","MOV X4, X4","MOV X5, X5","MOV X6, X6","MOV X7, X7","MOV W0, W0","MOV W1, W1","MOV W2, W2","MOV W3, W3"],x=PE_Cached.is64bit?m:h
if("NOP"===getFirstEpAsmOpCode())S=!0
else for(s=0;s<x.length&&!S;s++)PE_Cached.firstEpAsmInstruction===x[s]&&(S=!0)}S&&(e=addOption(e,"Nop at EP"))
var f=!1
if(PE_Cached.isArchX86&&!PE_Cached.isDynamicLinkLibrary)for(s=0;s<32&&!f;s++){if(!(b=getAsmInstructionByIndex(s)))break
if("CALL"===getAsmOpCode(b)){for(var _=PE.getAddressOfEntryPoint(),X=0;X<s;X++)_=PE.getDisasmNextAddress(_)
var w=PE.VAToOffset(_)
PE.compare("E8 00 00 00 00",w)&&(log(logType.any,"Stack-push address near EP found at offset: 0x"+w.toString(16)),f=!0)}}f&&(e=addOption(e,"Stack-push address near EP"))
var y=!1
if(PE_Cached.isArchX86&&!PE_Cached.isDynamicLinkLibrary)for(var b,s=0;s<15&&!y;s++){if(!(b=getAsmInstructionByIndex(s)))break
"CPUID"===getAsmOpCode(b)&&(log(logType.any,"CPUID near EP found at instruction index: "+s),y=!0)}y&&(e=addOption(e,"Cpuid near EP"))
for(var i=!1,m=(PE.isTLSPresent()&&(PE_Cached.isArchX86?(/^INT( )?3$/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction))||/^RET( \d+)?$/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction)))&&(i=!0):(/^BKPT/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction))||/^BRK/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction))||/^RET/.test(getAsmOpCode(PE_Cached.firstEpAsmInstruction))||/^BX( )?LR$/.test(PE_Cached.firstEpAsmInstruction))&&(i=!0)),i&&(e=addOption(e,"TLS hidden EP")),!1),h=((m=PE_Cached.isArchX86&&(PE.compareEP("EB $$ EB")||PE.compareEP("EB $$ E9")||PE.compareEP("E9 ## ## ## ## EB")||PE.compareEP("E9 ## ## ## ## E9"))?!0:m)&&(e=addOption(e,"Proxy jmp at EP")),!1),C=((h=S||-1===getEpAsmPattern(!0,5).indexOf(getInstructionsAsmPattern(["NOP","NOP"]))?h:!0)&&(e=addOption(e,"Nop EP padding")),!1),v=-1,O=-536870912,V=32|O,s=0;s<PE_Cached.numberOfSections&&!C;s++){var H=PE.section[s].Characteristics;(H&O)!=O&&(H&V)!=V||(C=!0,v=s)}C&&(e=addOption(e,"Section #"+v+' ("'+clearSectionName(PE.getSectionName(v))+'") has RWX'))
for(var N=!1,A=-1,$=PE.getAddressOfEntryPoint()-PE.getImageBase(),s=0;s<PE_Cached.numberOfSections&&!N;s++){var j=PE.getSectionVirtualAddress(s),G=PE.getSectionVirtualSize(s)
j<=$&&$<j+G&&(A=s,PE.compare("00 00 00",PE.getSectionFileOffset(A)))&&(N=!0)}N&&(e=addOption(e,"EP-section #"+A+' ("'+clearSectionName(PE.getSectionName(A))+'") zero padding'))
var i=!1,m=((i=20<PE_Cached.numberOfSections?!0:i)&&(e=addOption(e,"Too many sections")),!1),i=(_isResultPresent("linker","Turbo Linker")||(h=getOptHeaderOffset()+(PE_Cached.is64bit?112:96)+96,-1!==PE_Cached.indexOfImportsSection&&0===PE.read_int32(h)&&(m=!0)),m&&(e=addOption(e,"IAT directory empty")),!1),k=((i=PE.isSectionNamePresentExp(/^\.[xp]data$/)&&(h=getOptHeaderOffset()+(PE_Cached.is64bit?136:120),0===PE.read_int32(h))&&0===PE.read_int32(h+4)?!0:i)&&(e=addOption(e,"Exceptions directory empty")),!1)
if(0<PE_Cached.numberOfUnmanagedExports)for(s=0;s<PE_Cached.numberOfUnmanagedExports&&!k;s++){var D=PE.getExportFunctionName(s)
D&&(/^\d/.test(D)||!isAsciiString(D)||!isItemMangled(D)&&isNameObfuscated(replaceAllInString(D,"_"," ")))&&(k=!0)}k&&(e=addOption(e,"Strange exports"))
for(var I=!1,U="=~!@#$%^&*()\"№;%:?*():;,|'`<> ",s=0;s<PE_Cached.numberOfUnmanagedImports&&!I;s++){var R=PE.getImportLibraryName(s)
if(isAsciiString(R))for(var T=0;T<U.length&&!I;T++)isAsciiString(R)&&-1===R.indexOf(U[T])||(I=!0)
else 0!==R.indexOf("MZ")&&(I=!0)}I&&(e=addOption(e,"Strange imports"))
for(var F=!1,s=0;s<PE_Cached.numberOfUnmanagedResources&&!F;s++){var B=PE.getResourceNameByNumber(s)
!B||isAsciiString(B)&&!isNameObfuscated(B)||(log(logType.any,"Strange resource name: "+B),F=!0)}F&&(e=addOption(e,"Strange resources"))
m=!1,(m=0===PE.getMajorLinkerVersion()&&0===PE.getMinorLinkerVersion()?!0:m)&&(e=addOption(e,"Zero linker version")),h=!1,(h=isNetMetaDataPresent()&&0<PE_Cached.numberOfUnmanagedImports?!0:h)&&(e=addOption(e,"DotNET meta")),i=!1
if((i=PE.isFunctionPresent("_CorExeMain")||PE.isFunctionPresent("_CorDllMain")?!0:i)&&(e=addOption(e,"DotNET runtime attach")),PE.section[".asmg"]||PE.section.ASMGUARD)for(var L=0;L<3;L++)_removeResult("packer",["UPX","MPRESS","EP:MPRESS"][L]);(t=0!=e.length?!0:t)&&_setResult("~protection","Generic","",PE.isVerbose()?e:"")}function isArchX86(){switch(PE.getOperationSystemOptions().split(",")[0]){case"I386":case"AMD64":return!0
case"ARM":case"ARMNT":case"THUMB":return!1
default:return}}var _patternSplitter="|"
function getEpAsmPattern(e,t){for(var i=_patternSplitter,n=PE.getAddressOfEntryPoint(),r=0;r<t;r++){1<=r&&(n=PE.getDisasmNextAddress(n))
var s=PE.getDisasmString(n)
i+=(e?getAsmOpCode(s):s)+_patternSplitter}return i}var epAsmInstructions=[]
function getAsmInstructionByIndex(e){if(void 0!==epAsmInstructions[e])return epAsmInstructions[e]
for(var t=PE.getAddressOfEntryPoint(),i=0;i<=e;i++)if(1<=i&&(t=PE.getDisasmNextAddress(t)),void 0===epAsmInstructions[i]&&(epAsmInstructions[i]=PE.getDisasmString(t)),i===e)return epAsmInstructions[e]}function getInstructionsAsmPattern(e){return _patternSplitter+(Array.isArray(e)?e.join(_patternSplitter):e)+_patternSplitter}function getFirstEpAsmInstruction(){return getAsmInstructionByIndex(0)}function getAsmOpCode(e){return-1!==e.indexOf(" ")?e.split(" ")[0]:e}function getFirstEpAsmOpCode(){return getAsmOpCode(PE_Cached.firstEpAsmInstruction)}function isItemMangled(e){return!(e.length<=5)&&("?"===e[0]&&(-1!==e.indexOf("@@")||"?"===e[1])||"_Z"===e.substring(0,2)||"@"===e[0]&&-1!==e.indexOf("$")||"$"===e[0]&&("s"===e[1]||"S"===e[1]))}function getManglerInfoByMangledItem(e){if(isItemMangled(e))return"?"===e[0]?{compiler:"Microsoft Visual C++",language:"C++"}:"_Z"===e.substring(0,2)?{compiler:"MinGW",language:"C++"}:"@"===e[0]&&-1!==e.indexOf("$")?{compiler:"Borland C++",language:"C++"}:"$"!==e[0]||"s"!==e[1]&&"S"!==e[1]?void 0:{compiler:"Swift",language:"Swift"}}function getNameOfMangledItem(e){if(isItemMangled(e)){if("?"===e[0]){if("?"!==e[1])return e.split("?")[1].split("@")[0]
if("?"===e[1]){if("$"===e[2])return e.split("$")[1].split("@")[0]
if(-1!==e.indexOf("?$")){var t=e.match(/\?\?\d\?\$([^@]+)@/)
if(t)return t[1]}if("_"===e[2])if(3<=(g=e.split("?")).length)return 1<(a=g[2].split("@")[0]).length&&/[EGR]/.test(a[1])?a:0===(t=a.substring(2)).indexOf("_")?t.substring(1):t
if(/[0-9A-D]/.test(e[2]))if(3<=(g=e.split("?")).length)return 1===(a=g[2].split("@")[0]).length&&/[0-9A-D]/.test(a[0])?{2:"operator_new",3:"operator_delete",4:"operator_assign",5:"operator_shift_left",6:"operator_shift_right",8:"operator_equal",9:"operator_not_equal",A:"operator_subscript",B:"operator_not",C:"operator_cast",D:"operator_cast_const"}[a[0]]||"operator_unknown":a.substring(1)
if(3<=(g=e.split("?")).length)return 0<(o=g[2].split("@")[0]).length&&/[0-9A-D]/.test(o[0])?o.substring(1):o}}if("_Z"===e.substring(0,2))if("S"===e[2]&&"t"===e[3]){t=e.match(/_ZSt(\d+)(.+)/)
if(t)return t[2].substring(0,parseInt(t[1],10))}else if("N"===e[2]){for(var i=[],n=e.substring(3);0<n.length&&"E"!==n[0]&&/^\d/.test(n);){var r=n.match(/^(\d+)/)
if(!r)break
var s=parseInt(r[1],10),r=r[1].length
if(!(n.length>=r+s))break
var o=n.substring(r,r+s)
i.push(o),n=n.substring(r+s)}if(0<i.length)return i[i.length-1]}else{var a=e.match(/_Z(\d+)(.+)/)
if(a)return t=parseInt(a[1],10),a[2].substring(0,t)}if("@"===e[0]){if(2===(g=e.split("@")).length)return g[1].split("$")[0]
if(3<=g.length)return"$bctr"===(a=g[2].split("$")[0])?g[1]:"$bdtr"===a?"~"+g[1]:a}if("$"===e[0]&&("s"===e[1]||"S"===e[1])){var l=2,d=[]
for(var c=50;l<e.length&&0<c--;){var u=e[l]
if(/^\d/.test(u)){m=E=void 0
P=(p=l)>=(P=e).length||!/^\d/.test(P[p])||!(m=P.substring(p).match(/^(\d+)/))||(E=parseInt(m[1],10),p+(m=m[1].length)+E>P.length)?null:{name:P.substring(p+m,p+m+E),nextPos:p+m+E}
if(P){d.push(P.name),l=P.nextPos
continue}}if(!/^[xqyz]/.test(u)){if(/^[a-zA-Z]$/.test(u)){p=l+1<e.length?e[l+1]:""
if("S"===u&&/^[a-zA-Z]/.test(p)){m=l+2<e.length?e[l+2]:""
if(/^[a-z]$/.test(m)){E=l+3<e.length?e[l+3]:""
if(/^\d/.test(E)){l+=3
continue}}if(/^\d/.test(m)){l+=2
continue}}if(/^\d/.test(p)){l++
continue}}break}for(l++;l<e.length&&/^[xqyzd_0-9]/.test(e[l]);)l++}if(0<d.length)return d[d.length-1]
if(l<e.length&&"S"===e[l]&&l+1<e.length){var t=e.substring(l,l+2),g={Sa:"Array",Sb:"Bool",Sc:"UnicodeScalar",Sd:"Double",Sf:"Float",Sg:"Optional",Sh:"Set",Si:"Int",SL:"Collection",Sl:"Slice",Sm:"Mirror",Sn:"Numeric",So:"ObjectiveC",Sp:"UnsafePointer",Sq:"Optional",SR:"Sequence",Sr:"UnsafeRawPointer",Ss:"String",SS:"String",St:"Range",ST:"Equatable",Su:"UInt",Sv:"UnsafeRawBufferPointer",Sw:"UnsafeBufferPointer",Sx:"Strideable",SY:"RawRepresentable",Sy:"RawRepresentable",Sz:"BinaryInteger",SD:"Dictionary",SE:"Encodable",SH:"Hashable",Sk:"KeyPath",SK:"KeyPath"}
if(g[t])return g[t]}}var P,p,E,m}return e}function validateImportHashes(e){for(var t=0;t<e.length;t++){var i=e[t][2],n=e[t][3]
if(Array.isArray(n)){for(var r=0;r<n.length;r++)if(PE.isImportPositionHashPresent(i,n[r]))return e[t]}else if(PE.isImportPositionHashPresent(i,n))return e[t]}return null}function validateSectionNames(e){for(var t=0;t<e.length;t++){var i=e[t][2]
if(Array.isArray(i)){for(var n=0;n<i.length;n++)if("string"==typeof i[n]&&PE.isSectionNamePresent(i[n])||i[n]instanceof RegExp&&PE.isSectionNamePresentExp(i[n]))return e[t]}else if("string"==typeof i&&PE.isSectionNamePresent(i)||i instanceof RegExp&&PE.isSectionNamePresentExp(i))return e[t]}return null}function validateResourceNames(e){for(var t=0;t<e.length;t++){var i=e[t][2]
if(Array.isArray(i)){for(var n=0;n<i.length;n++)if("string"==typeof i[n]&&PE.isResourceNamePresent(i[n])||i[n]instanceof RegExp&&PE.isResourceNamePresentExp(i[n]))return e[t]}else if("string"==typeof i&&PE.isResourceNamePresent(i)||i instanceof RegExp&&PE.isResourceNamePresentExp(i))return e[t]}return null}function getOptHeaderOffset(){return PE.read_int32(60)+4+20}function isNetMetaDataPresent(){var e,t=getOptHeaderOffset(),t=PE_Cached.is64bit?(e=t+108,t+224):(e=t+92,t+208)
return!(t+8>PE.getSize()||e+4>PE.getSize()||PE.read_int32(e)<15||(e=PE.read_int32(t),t=PE.read_int32(t+4),0===e)||0===t)}function isCompilerDetected(){return 0<_getNumberOfResults("compiler")||0<_getNumberOfResults("~compiler")}function isLinkerDetected(){return 0<_getNumberOfResults("linker")||0<_getNumberOfResults("~linker")}function scanForLanguagesAndCompilers_NET_and_Native(){log(logType.nothing,"Scanning for programming language...")
for(var e=_isLangPresent("C/C++"),t=[["C++","cpp"],["Rust","rs"],["Java","jar"],["Python","pyd"],["Kotlin","kt"]],i=0;i<t.length;i++){var n=t[i][0],r=t[i][1]
PE.isSignaturePresent(0,PE.getSize(),"%% %% %% %% %% %% %% %% '."+r+"' 00")&&(log(logType.any,"Lines of ."+r+" files ("+n+") detected"),_setLangByHeur(n))}!_isLangDetected("C++")&&PE.isSignaturePresent(0,PE.getSize(),"%% %% %% %% %% %% %% %% %% %% '.c' 00")&&(log(logType.any,"Lines of .c files (C) detected (not a C++)"),_setLangByHeur("C"))
for(i=0;i<PE_Cached.numberOfUnmanagedResources;i++){var s=PE.getResourceOffsetByNumber(i)
if(-1!==s){s=PE.getString(s,64)
if("object"===s.split(" ")[0]&&-1!==s.indexOf(": ")){_setLangByHeur("Object Pascal")
break}}}for(var o=!1,a=!1,i=0;i<PE_Cached.numberOfUnmanagedImports;i++){for(var l=PE.getImportLibraryName(i).toLowerCase(),d=0;d<PE.getNumberOfImportThunks(i)&&!o;d++){var c=PE.getImportFunctionName(i,d)
isItemMangled(c)&&(log(logType.any,'Mangler detected -> "'+l+'", at function "'+getNameOfMangledItem(c)+'"'),g=!1,isCompilerDetected()||(P=getManglerInfoByMangledItem(c))&&(_setResult("~compiler",P.compiler,"",""),_isLangDetected()||_setLangByHeur(P.language),"C++"!==P.language)&&(g=!0),o=!g)}-1===l.indexOf("++")&&-1===l.indexOf("cpp")&&-1===l.indexOf("msvcp")||(log(logType.any,'C++ library present -> "'+l+'"'),o=!0),-1===l.indexOf("msvcr")&&-1===l.indexOf("crtdll")||(log(logType.any,'C library present -> "'+l+'"'),a=!0)}for(var u=0;u<PE_Cached.numberOfUnmanagedExports&&!o;u++){var g,P,p=PE.getExportFunctionName(u)
p&&isItemMangled(p)&&(log(logType.any,'Mangler detected at exported item "'+getNameOfMangledItem(p)+'"'),g=!1,isCompilerDetected()||(P=getManglerInfoByMangledItem(p))&&(_setResult("~compiler",P.compiler,"",""),_isLangDetected()||_setLangByHeur(P.language),"C++"!==P.language)&&(g=!0),o=!g)}if(!isCompilerDetected()&&PE_Cached.isRichSignaturePresent)for(var E=0;E<PE_Cached.numberOfRichIDs;E++){var m=PE.getRichID(E),h=PE.getRichVersion(E),S=PE.getRichCount(E)
if(13===m&&9782===h&&1===S){_setResult("~compiler","Microsoft Visual Basic","6.0",""),_setLangByHeur("VB")
break}if(259===m){_setResult("~compiler","MASM","","")
break}}if(!isCompilerDetected())for(var f=[".text$mn",".rdata$zzzdbg",".rtc$IAA",".rtc$IZZ",".rtc$TAA",".rtc$TZZ","il2cpp"],i=0;i<f.length;i++)if(PE.isSectionNamePresent(f[i])){_setResult("~compiler","IL2CPP Technology","",""),_setLangByHeur("Native MSIL/C#")
break}var _,y=!a&&!o,b=PE.getMajorLinkerVersion(),C=PE.getMinorLinkerVersion(),v=(isCompilerDetected()||isLinkerDetected()||PE_Cached.isDotNet||(v=PE.section[".eh_frame"],_=PE.section[".build-id"],v||_||!(PE_Cached.isRichSignaturePresent||PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....00000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000")||PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")||PE.isSectionNamePresent(".00cfg"))?v||_||PE.isSectionNamePresent(".CRT")&&PE.isSectionNamePresent(".rdata")&&PE.isSectionNamePresent(".xdata")&&PE.isSectionNamePresent(".idata")&&(PE.isSectionNamePresent(".tls")||PE.isSectionNamePresent(".bss"))||PE.isSectionNamePresent(".buildid")?(_setResult("~compiler","MinGW","",""),!_isLangDetected()&&y&&_setLangByHeur("C/C++")):PE.isSectionNamePresent(".flat")&&!o&&(_setResult("~compiler","FASM","",""),_setLangByHeur("ASMx"+(PE_Cached.is64bit?"64":"86"))):((PE.isSectionNamePresent(".gfids")||PE.isSectionNamePresent(".giats")||PE.isSectionNamePresent(".gljmp"))&&_setResult("~tool","Microsoft Visual Studio","",""),_setResult("~linker","Microsoft Linker",0!==b?b+"."+C:"",""),_setResult("~compiler","Microsoft Visual C/C++","",""),!_isLangDetected()&&y&&(isNetMetaDataPresent()?_setLangByHeur("MSIL/C/C++"):_setLangByHeur("C/C++")))),PE.section[".rdata"])
v&&e&&PE.isSignaturePresent(v.FileOffset,v.FileSize,generateUnicodeSignatureMask("Visual C++"))&&(log(logType.any,"Embedded Visual C++ Runtime detected."),o=!0),o||e&&PE.isSignaturePresent(0,PE.getSize()-PE.getOverlaySize(),"' C++ '")?_setLangByHeur("C++"):!_isLangPresent("C++")&&a&&(PE.isFunctionPresent("_iob")||PE.isFunctionPresent("printf")||PE.isFunctionPresent("malloc")||PE.isFunctionPresent("memset"))?_setLangByHeur("C"):PE.isLibraryPresentExp(/^api-ms-win-crt*/i)||PE.isSectionNamePresent(".msvcjmc")?_setLangByHeur("C/C++"):_isLangDetected()||_getNumberOfResults("compiler")||PE_Cached.isDotNet||_getNumberOfResults("protector")||_getNumberOfResults("cryptor")||_getNumberOfResults("~cryptor")||_getNumberOfResults("packer")||_getNumberOfResults("~packer")||_setLangByHeur("ASMx"+(PE_Cached.is64bit?"64":"86"))}function _setLangByHeur(e){log(logType.any,e+" language detected!"),_setLang(e,heurLabel)}function addOption(e,t){return e&&(e+=" + "),e+=t}function log(e,t){if(t){/\r|\n|\t/.test(t)&&(t=t.replace(/[\r\n\t]+/g," ").replace(/\s+/g," ").trim())
var i=""
switch(-2!==e&&(i=heurLabel),-2<e&&0!==e&&(i+="/"),e){case-2:i="!"
break
case-1:i+="About"
break
case 1:i+="Any"
break
case 2:i+=".NET"}"undefined"!=typeof _log?_log("["+i+"] "+t):_error("Unable to write log message")}}function scanForMaliciousCode_NET_and_Native(){log(logType.nothing,"Scanning for malicious code...")
var e,t=[],i="May be infected, be careful!"
if(PE_Cached.isDotNet){for(var n,r=["System.Diagnostics","System.IO.Compression","user32","kernel32","ntdll"],s=0,o=0;o<r.length;o++)n="00'"+r[o]+"'00",PE.isSignatureInSectionPresent(0,n)&&s++
if(PE.isSignatureInSectionPresent(0,"00'System.Net.Sockets'00")&&2<=s)for(var a=[{type:"NjRAT",edition:"0.7D Green Edition",references:["w","System.Drawing","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","capGetDriverDescriptionA","kernel32","KERNEL32.DLL","ntdll","user32","GetWindowText","EnumChildWindows","SendMessage","GetWindowTextLength","user32.dll","winmm.dll"],isVbNet:!0},{type:"NjRAT",edition:"0.7D Lime Edition",references:["Stub","System.Drawing","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","capGetDriverDescriptionA","kernel32","ntdll","NtSetInformationProcess","user32","MapVirtualKey","ToUnicodeEx","GetKeyboardState","user32.dll","wintrust.dll"],isVbNet:!0},{type:"NjRAT",edition:"0.7D",references:["Stub","System.Drawing","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","capGetDriverDescriptionA","kernel32","ntdll","NtSetInformationProcess","user32","MapVirtualKey","ToUnicodeEx","GetKeyboardState","user32.dll"],isVbNet:!0},{type:"NjRAT",edition:"0.11G-0.12G",references:["k","System.Drawing","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","capGetDriverDescriptionA","kernel32","ntdll","NtsetInformationProcess","user32","MapVirtualKey","ToUnicodeEx","GetKeyboardState","GetForegroundWindow","GetWindowTextLengthA","GetAsyncKeyState","user32.dll"],isVbNet:!0},{type:"NjRAT",edition:"0.7D Danger Edition",references:["Stub","System.Drawing","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","capGetDriverDescriptionA","Kernel32.dll","KERNEL32.DLL","user32","GetWindowText","EnumChildWindows","GetForegroundWindow","SendMessage","GetWindowTextLength","SetWindowPos","user32.dll","winmm.dll"],isVbNet:!0},{type:"NjRAT",edition:"0.7D Golden Edition",references:["Stub","System.Drawing","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","kernel32","Kernel32.dll","ntdll","NtSetInformationProcess","user32","user32.dll","GetForegroundWindow","GetWindowTextA","winmm.dll"],isVbNet:!0},{type:"XWorm",edition:"3.0-5.0",references:["System.Core","System.Drawing","System.Management","System.Windows.Forms","System.Runtime.InteropServices","avicap32.dll","capCreateCaptureWindowA","kernel32.dll","SetThreadExecutionState","user32.dll","GetForegroundWindow","GetWindowText"],isVbNet:!0},{type:"VenomRAT",edition:"6.X",references:["Microsoft.CSharp","System.Core","System.Drawing","System.Management","System.Windows.Forms","System.Runtime.InteropServices","kernel32.dll","SetThreadExecutionState","ntdll.dll","RtlSetProcessIsCritical","user32.dll","GetWindowText","GetForegroundWindow"],isVbNet:!0},{type:"RevengeRAT",edition:"0.3",references:["System.Management","System.Windows.Forms","avicap32.dll","capGetDriverDescriptionA","kernel32","psapi","EmptyWorkingSet","user32","GetWindowText"],isVbNet:!0},{type:"Webremote TorCT",edition:void 0,references:["System.Windows.Forms","avicap32.dll","capGetDriverDescriptionA","capCreateCaptureWindowA","user32","SendMessage","SetWindowPos","DestroyWindow","user32.dll","GetForegroundWindow","GetWindowText"],isVbNet:!0},{type:"NjRAT",edition:void 0,references:["System.Drawing","System.Windows.Forms","GetForegroundWindow","System.Runtime.InteropServices","System.Security.Cryptography","GetWindowText","avicap32.dll","A","kl","OK"],isVbNet:!0},{type:"NjRAT",edition:void 0,references:["System.Drawing","System.Windows.Forms","GetForegroundWindow","System.Runtime.InteropServices","System.Security.Cryptography","GetWindowText","avicap32.dll","A","kl","USB"],isVbNet:!0}],l=0;l<a.length;l++){for(var d=a[l],c=!0,u=0;u<d.references.length&&c;u++)n="00'"+d.references[u]+"'00",PE.isSignatureInSectionPresent(0,n)||(c=!1)
if(c&&(!d.isVbNet||PE_Cached.isVbNetStandardLibraryPresent)){t.push({type:d.type,version:d.edition||"",details:""})
break}}var g="??"+(g=generateUnicodeSignatureMask("|'|'|")+"00").substring(2,g.length)
0===t.length&&("w"===PE_Cached.nameOfNetAssemblyName||"w.exe"===PE_Cached.nameOfNetModuleName||"k"===PE_Cached.nameOfNetAssemblyName||"k.exe"===PE_Cached.nameOfNetModuleName||PE.isNetObjectPresent("njLogger")||PE.isNetUStringPresent("|PWD| ")||PE.isSignatureInSectionPresent(0,g))&&t.push({type:"NjRAT",version:"",details:""}),0===t.length&&PE.isNetObjectPresent("avfucker")&&t.push({type:"RAT Injector",version:"",details:""}),0!==t.length||"AsyncClient"!==PE_Cached.nameOfNetAssemblyName&&"AsyncClient.exe"!==PE_Cached.nameOfNetModuleName&&!PE.isNetObjectPresent("Pastebin")||t.push({type:"AsyncRAT",version:"",details:""}),0!==t.length||!PE.isNetObjectPresent("ClientLoaderForm")&&"NanoCore Client"!==PE_Cached.nameOfNetAssemblyName||t.push({type:"NanoCore RAT",version:"",details:""}),0!==t.length||"Orcus.exe"!==PE_Cached.nameOfNetModuleName&&!PE.isNetObjectPresent("Orcus.Connections")||t.push({type:"Orcus RAT",version:"1.3-1.9.1",details:""}),0===t.length&&"Client.exe"===PE_Cached.nameOfNetModuleName&&PE.isNetObjectPresent("System.Security.Cryptography.X509Certificates")&&t.push({type:"Liberium RAT",version:"",details:""}),0===t.length&&PE.isNetObjectPresent("button_unlock_Click")&&t.push({type:"Liberium WinLocker",version:"",details:""}),0===t.length&&"Kheir.exe"===PE_Cached.nameOfNetModuleName&&t.push({type:"jnRAT",version:"",details:""}),0===t.length&&"QatarC.exe"===PE_Cached.nameOfNetModuleName&&t.push({type:"Qatar RAT",version:"1.2",details:""}),0===t.length&&"Client.exe"===PE_Cached.nameOfNetModuleName&&PE.isNetObjectPresent("fusion")&&t.push({type:"DarkRAT",version:"",details:""}),0===t.length&&PE.isNetObjectPresent("tosuck")&&t.push({type:"ICARUS Evil Worm RAT",version:"",details:""}),0===t.length&&PE.isNetObjectPresent("isVM_by_wim_temper")&&t.push({type:"NonEuclid RAT",version:"",details:""}),0===t.length&&PE.isNetObjectPresent("LZLoader")&&PE.isNetObjectPresent("Injector")&&t.push({type:"Imminent Monitor RAT",version:"",details:""}),0===t.length&&(PE.isSignatureInSectionPresent(0,"00"+generateUnicodeSignatureMask(" RAT")+"00 **")||PE.isNetObjectPresent("AntiTaskManager")||PE.isNetObjectPresent("BlockAvSites")||PE.isNetObjectPresent("UpdaterEXE")||PE.isNetObjectPresent("System.Net.Sockets")&&PE.isNetObjectPresent("GetForegroundWindow")&&PE.isNetObjectPresent("GetWindowText")&&(PE.isSignatureInSectionPresent(0,generateUnicodeSignatureMask("AntivirusProduct"))||PE.isSignatureInSectionPresent(0,generateUnicodeSignatureMask("DisableTaskMgr")))||PE.isNetObjectPresent("GetForegroundWindow")&&PE.isNetObjectPresent("GetWindowText")&&PE.isNetObjectPresent("NtSetInformationProcess"))&&t.push({type:"RAT",version:"",details:"General signs"})}0===t.length&&(PE.isNetObjectPresent("potentiallyVulnerablePasswords")||PE.isNetObjectPresent("ScanGeckoBrowsersPaths")||PE.isNetObjectPresent("ScannedWallets")||PE.isNetObjectPresent("GetPasswords")||PE.isNetObjectPresent("ScanSteam")||PE.isNetObjectPresent("GetCookies"))&&t.push({type:"Stealer",version:"",details:"General signs"}),0===t.length&&PE.isSectionNamePresent(".rmnet")&&t.push({type:"Ramnit",version:"",details:"infected"}),0===t.length&&PE_Cached.isArchX86&&PE.compareEP("558B EC83 C4 E033 C089 45 E089 45 E889 45 E489 45 ECB8 54 80 40 00E8 12 BE FF FF33 C05568 20 82 40 0064 FF 3064 89 20B8 A8 91 40 00B9 0B 00 00 00")&&t.push({type:"Neshta",version:"",details:"infected"}),0===t.length&&PE_Cached.isArchX86&&PE.compareEP("68 .. .. .. ..68 00 00 00 0068 .. .. .. ..E8 .. .. .. ..83 C4 0C68 00 00 00 00")&&(g="",PE.isImportPositionHashPresent(0,2994531744)&&PE.isImportPositionHashPresent(1,2810025820)?g="1.0":PE.isImportPositionHashPresent(0,502033476)&&PE.isImportPositionHashPresent(1,4058866520)&&(g="1.2"),g)&&t.push({type:"ConsoleDevil RAT",version:g,details:""}),0===t.length&&PE_Cached.isArchX86&&PE.compareEP("B8 00 04 40 00FF D06A 00")&&PE.isImportPositionHashPresent(0,3174455850)&&t.push({type:"Poison Lvy RAT",version:"",details:""}),0===t.length&&PE.isExportFunctionPresent("Ip")&&t.push({type:"Gh0st RAT",version:"",details:""}),(0===t.length&&PE.isImportPositionHashPresent(0,4084592131)&&PE.isImportPositionHashPresent(1,1615048040)&&PE.isImportPositionHashPresent(2,1239987933)||PE.isImportPositionHashPresent(0,391052164)&&PE.isImportPositionHashPresent(1,1258175057)&&PE.isImportPositionHashPresent(2,1033520080))&&t.push({type:"DarkComet RAT",version:"5.3",details:""}),0===t.length&&1===PE_Cached.numberOfUnmanagedImports&&(e=g=!1,PE.isImportPositionHashPresent(0,539780712)?g=!0:PE.isImportPositionHashPresent(0,614375123)&&(e=g=!0),g)&&t.push({type:"BitRAT",version:"",details:e?"Tor":""}),(0===t.length&&PE.isImportPositionHashPresent(0,2568978330)&&PE.isImportPositionHashPresent(1,882244769)||PE.isImportPositionHashPresent(0,2105065721)&&PE.isImportPositionHashPresent(1,1266076431))&&t.push({type:"Furax RAT",version:"",details:""}),0===t.length&&PE.isImportPositionHashPresent(0,1113591535)&&PE.isSignatureInSectionPresent(0,"'Octopus'")&&t.push({type:"Octopus RAT",version:"",details:""}),(0===t.length&&1===PE_Cached.numberOfUnmanagedImports&&PE.isImportPositionHashPresent(0,111168790)||4<PE_Cached.numberOfUnmanagedImports&&PE.isImportPositionHashPresent(0,2803470731)&&PE.isImportPositionHashPresent(-1,2676805574))&&t.push({type:"Biorante",version:"1.X",details:""}),0===t.length&&PE.isImportPositionHashPresent(0,3006365830)&&PE.isImportPositionHashPresent(1,1033520080)&&PE.isImportPositionHashPresent(7,4088555341)&&t.push({type:"Smart RAT",version:"1.0.X",details:""}),0===t.length&&1===PE_Cached.numberOfUnmanagedImports&&PE.isImportPositionHashPresent(0,459450912)&&t.push({type:"Ace RAT",version:"1.X",details:""}),0===t.length&&1===PE_Cached.numberOfUnmanagedImports&&PE_Cached.isRichSignaturePresent&&PE.isImportPositionHashPresent(0,762281608)&&t.push({type:"Aquates RAT",version:"1.0",details:""}),0===t.length&&"��50"===PE.section[0].Name&&t.push({type:"Exception RAT",version:"1.0",details:""}),0===t.length&&!PE_Cached.isRichSignaturePresent&&PE.isImportPositionHashPresent(0,3174455850)&&(g="",PE.isImportPositionHashPresent(1,248520579)?g="1.0":PE.isImportPositionHashPresent(1,4023696997)?g="1.2-1.3":PE.isImportPositionHashPresent(1,1477655120)&&(g="1.4-1.5.X"),g)&&t.push({type:"Bozok RAT",version:g,details:""}),0!==t.length||PE_Cached.isRichSignaturePresent||(e="",PE.isImportPositionHashPresent(0,4229993903)?e="0.0.1":PE.isImportPositionHashPresent(0,2345157726)&&(e="0.2"),e&&PE.isSignatureInSectionPresent(0,"'Aqua'")&&t.push({type:"Aqua RAT",version:e,details:""})),(0===t.length&&PE.isImportPositionHashPresent(0,2422509254)&&PE.isImportPositionHashPresent(1,429705986)&&PE.isImportPositionHashPresent(2,1269980471)||PE.isImportPositionHashPresent(0,1102215680)&&PE.isImportPositionHashPresent(1,1453959748)&&PE.isImportPositionHashPresent(2,1269980471)||PE.isImportPositionHashPresent(0,3326727301)&&PE.isImportPositionHashPresent(1,4075199253)&&PE.isImportPositionHashPresent(2,1269980471)||PE.isImportPositionHashPresent(0,3799964685)&&PE.isImportPositionHashPresent(1,497382926)&&PE.isImportPositionHashPresent(2,1115135284)||PE.isImportPositionHashPresent(0,1033520080)&&PE.isImportPositionHashPresent(1,3264172003)&&PE.isImportPositionHashPresent(2,1562107340)||PE.isImportPositionHashPresent(0,4084592131)&&PE.isImportPositionHashPresent(1,1033520080)&&PE.isImportPositionHashPresent(2,3264172003)&&(PE.isImportPositionHashPresent(3,1562107340)||PE.isImportPositionHashPresent(3,2719365508)))&&t.push({type:"Babylon RAT",version:"",details:""}),0===t.length&&PE.isImportPositionHashPresent(0,1369422246)&&PE.isImportPositionHashPresent(1,1767251880)&&PE.isImportPositionHashPresent(2,3869932869)&&t.push({type:"Sinique RAT",version:"1.0",details:""}),0===t.length&&PE.isImportPositionHashPresent(1,1562107340)&&(g="",PE.isImportPositionHashPresent(0,4195209253)?g="1.2.X":PE.isImportPositionHashPresent(0,2017850469)&&(g="1.4"),g)&&t.push({type:"NetWire RAT",version:g,details:""}),0===t.length&&PE.isImportPositionHashPresent(0,4066093359)&&PE.isImportPositionHashPresent(1,4148211208)&&PE.isImportPositionHashPresent(2,3124367634)&&t.push({type:"Remcos RAT",version:"",details:""}),0===t.length&&!PE_Cached.isRichSignaturePresent&&20===PE_Cached.numberOfUnmanagedImports&&PE.isImportPositionHashPresent(9,1376149806)&&PE.isImportPositionHashPresent(16,4088555341)&&PE.isImportPositionHashPresent(19,2883482619)&&t.push({type:"Daleth RAT",version:"1.0",details:""}),0===t.length&&!PE_Cached.isRichSignaturePresent&&31===PE_Cached.numberOfUnmanagedImports&&PE.isImportPositionHashPresent(0,3479190141)&&PE.isImportPositionHashPresent(-1,33665726)&&PE.isImportPositionHashPresent(-1,1017252086)&&t.push({type:"Syndrome RAT",version:"4.3.X",details:""}),0===t.length&&!PE_Cached.isRichSignaturePresent&&PE.isTLSPresent()&&(PE.isImportPositionHashPresent(18,3286185320)&&PE.isSignatureInSectionPresent(0,"'lock_text'00")||PE.isImportPositionHashPresent(4,3286185320)&&PE.isImportPositionHashPresent(5,1646979334))&&t.push({type:"Amp WinLocker",version:"Sumhex Edition",details:""}),0===t.length&&"Max"===PE.getVersionStringInfo("ProductName")&&t.push({type:"Max Spyware",version:"",details:""})
for(var P=["TVoAAAAAA","TVqQAA","TVpQAA","TVp4AA"],p=0;p<P.length;p++){var E=P[p]
if(validateGlobalUnicodeString(E)||validateSignature("'"+E+"'")){t.push({type:"Base64 payload",version:"",details:i})
break}}(PE_Cached.isDotNet&&("stub"===PE_Cached.nameOfNetAssemblyName.toLowerCase()||0===PE_Cached.nameOfNetModuleName.toLowerCase().indexOf("stub.")||-1!==PE_Cached.nameOfNetAssemblyName.toLowerCase().indexOf("crypted")||-1!==PE_Cached.nameOfNetModuleName.toLowerCase().indexOf("crypted")||-1!==PE_Cached.nameOfNetAssemblyName.toLowerCase().indexOf("payload")||-1!==PE_Cached.nameOfNetModuleName.toLowerCase().indexOf("payload")||isNameObfuscated(PE_Cached.nameOfNetAssemblyName)||isNameObfuscated(PE_Cached.nameOfNetModuleName)||/(^tmp|\.tmp$)/.test(PE_Cached.nameOfNetModuleName))||0===PE.getVersionStringInfo("OriginalFilename").toLowerCase().indexOf("stub.")||0===PE.getVersionStringInfo("InternalName").toLowerCase().indexOf("stub.")||(function(){for(var e=["Comments","CompanyName","FileDescription","ProductName","LegalCopyright","LegalTrademarks","OriginalFilename","InternalName"],t=0;t<e.length;t++)if(isNameObfuscated(PE.getVersionStringInfo(e[t])))return 1})())&&t.push({type:"Anomalous build info",version:"",details:i}),(PE.isResourceNamePresentExp(/^(STUB|SERVER)(\.[A-Z]{3})?$/)||PE.isResourceNamePresentExp(/(PAYLOAD|SHELLCODE|INJECT|CRYPTED)/))&&t.push({type:"Anomalous resources",version:"",details:i})
for(var m=0;m<t.length;m++){var h=t[m]
_setResult("~malware",h.type,h.version,h.details)}}function scanForInterestingMarkers_NET_and_Native(){log(logType.nothing,"Scanning for interesting markers...")
for(var e="",t=!1,i=!1,n=0;n<PE_Cached.numberOfUnmanagedResources&&!i;n++)"__GDF_XML"===PE.getResourceNameByNumber(n)&&PE.isSignaturePresent(PE.getResourceOffsetByNumber(n),PE.getResourceSizeByNumber(n),generateUnicodeSignatureMask("GameDefinitionFile"))&&(i=!0);(t=0!=(e=i?"GDF Schema":e).length?!0:t)&&_setResult("~marker","Contains","",PE.isVerbose()?e:"")}

================================================
FILE: dbs_min/db/PE/_init
================================================
var File=PE,X=PE
function Section(e,t,i,r,n,s,o){this.Number=e,this.Name=t,this.VirtualSize=i,this.VirtualAddress=r,this.FileSize=n,this.FileOffset=s,this.Characteristics=o}PE.getEntryPointSignature=function(e,t){return PE.getSignature(PE.nEP+e,t)},PE.getGeneralOptionsEx=function(){return sResult=PE.getGeneralOptions(),PE.isConsole()&&(sResult=sResult.append("console")),/requireAdministrator/.test(PE.getManifest())&&(sResult=sResult.append("admin")),sResult=PE.isSignedFile()?sResult.append("signed"):sResult},PE.isLibraryPresentExp=function(e){for(var t=null,i=0;i<PE.getNumberOfImports();i++)if(t=PE.getImportLibraryName(i).match(e)){t[-1]=i,t[0]=PE.getImportLibraryName(i).toLowerCase()
break}return t},PE.isExportFunctionPresentExp=function(e){for(var t=null,i=0;i<PE.getNumberOfExportFunctions();i++)if(t=PE.getExportFunctionName(i).match(e)){t[-1]=i,t[0]=PE.getExportFunctionName(i)
break}return t},PE.isSectionNamePresentExp=function(e){for(var t=null,i=0;i<PE.getNumberOfSections();i++)if(t=PE.getSectionName(i).match(e)){t[-1]=i,t[0]=PE.getSectionName(i)
break}return t},PE.isResourceNamePresentExp=function(e){for(var t=null,i=0;i<PE.getNumberOfResources();i++)if(t=PE.getResourceNameByNumber(i).match(e)){t[-1]=i,t[0]=PE.getResourceNameByNumber(i)
break}return t},PE.nLastSection=PE.getNumberOfSections()-1,PE.section=[]
for(var i=0;i<=PE.nLastSection;i++)PE.section[i]=new Section(i,PE.getSectionName(i),PE.getSectionVirtualSize(i),PE.getSectionVirtualAddress(i),PE.getSectionFileSize(i),PE.getSectionFileOffset(i),PE.getSectionCharacteristics(i)),PE.section[i].Name&&+(name=PE.section[i].Name).toString()!=name&&(PE.section[name]=PE.section[i])
function Resource(e,t,i,r,n,s){this.Number=e,this.Id=t,this.Name=i,this.Offset=r,this.Size=n,this.Type=s}PE.section[-1]=new Section(-1,"\0",0,0,0,PE.getSize(),0),-1==PE.nLastSection&&(PE.section[0]=PE.section[-1]),PE.resource=[]
for(var name,i=0;i<PE.getNumberOfResources();i++)PE.resource[i]=new Resource(i,PE.getResourceIdByNumber(i),PE.getResourceNameByNumber(i),PE.getResourceOffsetByNumber(i),PE.getResourceSizeByNumber(i),PE.getResourceTypeByNumber(i)),PE.resource[i].Name&&(+(name=PE.resource[i].Name)).toString()!=name&&(PE.resource[name]=PE.resource[i])

================================================
FILE: dbs_min/db/PE/archive_7z.6.sg
================================================
function detect(){var e=PE.getOverlayOffset()
return PE.compareOverlay("';!@Install@!UTF-8!'")||PE.compareOverlay("efbbbf';!@Install@!UTF-8!'")?PE.isSignaturePresent(e,8192,"'7z'BCAF271C")&&(sVersion="SFX",bDetected=1):PE.compare("'7z'BCAF271C",e)&&(sVersion=PE.readByte(e+6)+"."+PE.readByte(e+7)).match(/^\d+\.\d+$/)&&(bDetected=1),result()}meta("archive","7-Zip")

================================================
FILE: dbs_min/db/PE/arj.6.sg
================================================
function detect(){return detect_ARJ(0),result()}includeScript("arj")

================================================
FILE: dbs_min/db/PE/compiler_BatchToApp.6.sg
================================================
function detect(){return bDetected=PE.isNetObjectPresent("GeneratedWithBatchToApp")&&PE.isNetUStringPresent("Unable to execute."),sLang="Batch",result()}meta("compiler","BatchToApp")

================================================
FILE: dbs_min/db/PE/compiler_BeRo_Tiny_Pascal.6.sg
================================================
function detect(){return PE.compareEP("E9........' Compiled by: BeRoTinyPascal - (C) Copyright 2006, Benjamin '27'BeRo'27' Rosseaux '")&&(bDetected=1),sLang="Pascal",result()}meta("compiler","BeRo Tiny Pascal")

================================================
FILE: dbs_min/db/PE/compiler_Borland_C++.6.sg
================================================
function detect(){var e
return 2==(bDetected=bBorlandC)&&(sVersion="1999",bDetected=1),bDetected&&(e=PE.resource.DVCLAL,PE.resource.PACKAGEINFO||e)&&(sVersion="Builder",e)&&(nOffset=PE.getResourceNameOffset("DVCLAL"),PE.compare("A28CDF987B3C3A7926713F090F2A2517",nOffset)?sOptions="Professional":PE.compare("23785D23B6A5F31943F3400226D111C7",nOffset)?sOptions="Standard":PE.compare("263D4F38C28237B8F3244203179B3A83",nOffset)&&(sOptions="Enterprise")),sLang="C++",result()}meta("compiler","Borland C++"),includeScript("Borland")

================================================
FILE: dbs_min/db/PE/compiler_Cygwin32.4.sg
================================================
function detect(){return PE.compareEP("5589E583EC04833D")&&(bDetected=1),result()}meta("compiler","Cygwin32")

================================================
FILE: dbs_min/db/PE/compiler_DECFortran.4.sg
================================================
function detect(){var e
return PE.isSectionNamePresent(".data")&&(e=PE.section[".data"],-1!=PE.findString(e.FileOffset,e.FileSize,"DEC Fortran RTL Message Catalog"))&&(sVersion="14-Jul-1999",bDetected=1),sLang="Fortran",result()}meta("compiler","DEC Visual Fortran (Windows)")

================================================
FILE: dbs_min/db/PE/compiler_DMD.6.sg
================================================
function detect(){var e,t,i
if(!PE.isNet())return PE.isSectionNamePresent(".minfo")&&PE.isSectionNamePresent("._deh")&&(bDetected=1),t=e=-1,(i=PE.section[".rdata"])&&(e=i.FileOffset,t=i.FileSize),bDetected||i&&PE.isDeepScan()&&-1!=PE.findSignature(e,t,"'core.sys.windows.dll'")&&-1!=PE.findSignature(e,t,"'string.d'")&&(bDetected=1),bDetected&&i&&(-1==(i=PE.findString(e,t,"This program will continue, but will not operate when using DMD "))||-1!=(sVersion=PE.getString(i-7,5)).indexOf(".")&&1==sVersion.split(".")[0].length||(sVersion="")),sLang="D",result()}meta("compiler","DMD")

================================================
FILE: dbs_min/db/PE/compiler_DarkBASIC.4.sg
================================================
function detect(){return PE.isOverlayPresent()&&PE.isSignaturePresent(PE.getOverlayOffset(),2048,"'dbprocore.dll'")&&(bDetected=1),sLang="DarkBASIC",result()}meta("compiler","DarkBASIC Professional")

================================================
FILE: dbs_min/db/PE/compiler_Delphi.4.sg
================================================
function getVersion(){if(PE.isNet()){if(sOptions=".NET",PE.isNetObjectPresent("Borland.Vcl.Types"))sVersion="8"
else if(PE.isNetObjectPresent("Borland.Eco.Interfaces"))sVersion="8 Eco WinForm"
else if(PE.isNetObjectPresent("Borland.Delphi.System")&&PE.isNetObjectPresent("WinForm"))sVersion="8 WinForm"
else if(PE.isNetObjectPresent("Borland.Delphi.Units"))sVersion="2005"
else{if(!PE.isNetObjectPresent("Borland.Studio.Delphi"))return!1
sName="Embarcadero Delphi",sVersion="XE*"}return!0}for(var e,s,r,i,t,n,o=PE.section[0].FileOffset,a=PE.section[0].FileSize,E=o,c=a,P=!1,l=PE.is64()?8:4;0<c&&-1!=(E=PE.findSignature(E,c,"0708'TControl'"));){if(s=PE.readDword(E+10),-1!=(e=PE.VAToOffset(s))&&o<=e&&e<o+a){switch(t=PE.readDword(e-10*l),r=PE.readDword(e-10*l-11*l),t){case 0:1953384711==r?sVersion="3":1330906996==r&&(sVersion="2")
break
case 180:sVersion="C++ Builder"
break
case 276:sVersion="4"
break
case 288:sVersion="5"
break
case 296:sVersion="6 CLX"
break
case 300:sVersion="7 CLX"
break
case 312:sVersion="Kylix"
break
case 348:case 352:sVersion=1074790400==r||1048576==r?"7":"6"
break
case 356:sVersion="2005"
break
case 400:sVersion="2006"
break
default:420==(t=PE.readDword(e-13*l))?(sName="Embarcadero Delphi",sVersion="2009"):428==t?(i=PE.resource.PACKAGEINFO)&&(E=i.Offset,c=i.Size,sVersion=PE.isSignaturePresent(E,c,"'ExcUtils'")?(sName="Embarcadero Delphi","XE"):PE.isSignaturePresent(E,c,"'StrUtils'")?(sName="Embarcadero Delphi","2010"):(sName="Embarcadero Delphi","2010 or XE")):436==t?(sName="Embarcadero Delphi",sVersion="XE2-XE4"):752==t||760==t?(sName="Embarcadero Delphi",sVersion="XE2"):444==t?(sName="Embarcadero Delphi",sVersion="XE5-XE6",P=!0):8==l&&(760==(t=PE.readDword(e-16*l))?(sName="Embarcadero Delphi",sVersion="XE3-X4"):776==t&&(sName="Embarcadero Delphi",sVersion="XE5-XE6",P=!0))}if(sVersion&&!P)return!0}c=a-(++E-o+1)}if(PE.resource.PACKAGEINFO){if(E=PE.resource.PACKAGEINFO.Offset,c=PE.resource.PACKAGEINFO.Size,PE.isSignaturePresent(E,c,"'System.SysUtils'")?(sName="Embarcadero Delphi",sVersion="XE2-XE6",P=!0):PE.isSignaturePresent(E,c,"'ExcUtils'")?(sName="Embarcadero Delphi",sVersion="XE"):PE.isSignaturePresent(E,c,"'StrUtils'")?(sName="Embarcadero Delphi",sVersion="2009-2010"):PE.isSignaturePresent(E,c,"'ImageHlp'")?sVersion="2006":PE.isSignaturePresent(E,c,"'SysInit'")&&(sVersion="6-7 or 2005"),sVersion&&!P)return!0}else if(-1!=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Borland\\Delphi"))return sVersion="2-3",!0
return!!P&&((n=PE.section[".rdata"])&&-1!=(n=PE.findString(n.FileOffset,n.FileSize,"Embarcadero Delphi for Win"))&&(n=PE.getString(n+46,4),sVersion="28.0"==n?"XE7":"29.0"==n?"XE8":"30.0"==n?"10 Seattle":"31.0"==n?"10.1 Berlin":"32.0"==n?"10.2 Tokyo":"33.0"==n?"10.3 Rio":"34.0"==n?"10.4 Sydney":"35.0"==n?"11.0 Alexandria":"36.0"==n?"12.0 Athens":"12.X Athens++"),!0)}function detect(){if(!bBorlandC)return PE.resource.PACKAGEINFO&&(bDetected=1,getVersion()),PE.resource.DVCLAL?(bDetected=1,getVersion(),nOffset=PE.getResourceNameOffset("DVCLAL"),PE.compare("A28CDF987B3C3A7926713F090F2A2517",nOffset)?sOptions="Professional":PE.compare("23785D23B6A5F31943F3400226D111C7",nOffset)?sOptions="Standard":PE.compare("263D4F38C28237B8F3244203179B3A83",nOffset)&&(sOptions="Enterprise")):PE.resource.TMAINFORM?(bDetected=1,getVersion()):PE.isNet()?getVersion()&&(bDetected=1):PE.compare("0A06'string'",PE.section[0].FileOffset)?(sVersion="2",bDetected=1):-1!=PE.findSignature(PE.section[0].FileOffset,100,"07'Boolean'")||-1!=PE.findSignature(PE.section[0].FileOffset,100,"06'String'")?(bDetected=1,getVersion()):PE.findSignature(PE.section[0].FileOffset,256,"FF25........8BC0FF25........8BC0")&&getVersion()&&(bDetected=1),sLang="Object Pascal (Delphi)",result()}meta("compiler","Borland Delphi"),includeScript("Borland")

================================================
FILE: dbs_min/db/PE/compiler_EuroASM.4.sg
================================================
function detect(){return PE.isNet()||PE.isTLSPresent()||PE.isRichSignaturePresent()||1!==PE.getMajorLinkerVersion()||0!==PE.getMinorLinkerVersion()||0!==PE.getImageOptionalHeader("CheckSum")||(PE.compare("89000100000004002100FFFF05000002618A00000000400000000000000000000000000000000000000000000000000000000000000000000000900000000E1FBA0E00B409CD21B8084CCD21",2)?(sVersion="20180508-20190402",bDetected=1):PE.compare("89000100000004002100FFFF05000002BFA200000000400000000000000000000000000000000000000000000000000000000000000000000000900000000E1FBA0E00B409CD21B8084CCD21",2)?(sVersion="20240831+",bDetected=1):PE.compare("'This program was launched in DOS but it requires Windows.'",78)&&(bDetected=1)),sLang="ASMx"+(PE.is64()?"64":"86"),result()}meta("compiler","EuroASM")

================================================
FILE: dbs_min/db/PE/compiler_Excelsior_JET.4.sg
================================================
function detect(){for(var e=0,t=0;t<=PE.nLastSection;t++){var a=PE.section[t].FileOffset,i=PE.section[t].Name
if(".jidata"==i?PE.isSignaturePresent(a,16,"'JIMP'")&&++e:".jedata"==i?PE.isSignaturePresent(a,16,"'JEXP'")&&++e:".config"==i&&++e,3==e){bDetected=1
break}}return sLang="Java",result()}meta("compiler","Excelsior JET")

================================================
FILE: dbs_min/db/PE/compiler_FASM.4.sg
================================================
function detect(){return bFASM&&(sVersion=PE.getCompilerVersion(),bDetected=1,2<PE.getMajorLinkerVersion())&&(sVersion+="*"),sLang="ASMx"+(PE.is64()?"64":"86"),result()}meta("compiler","FASM"),includeScript("FASM")

================================================
FILE: dbs_min/db/PE/compiler_FreeBasic.6.sg
================================================
function detect(){if(!PE.isNet())return PE.isSectionNamePresent(".CRT")&&PE.isLibraryPresent("msvcrt.dll")&&(sVersion="MinGW",bDetected=PE.is64()?PE.compareEP("48")&&PE.isSignatureInSectionPresent(0,"564889CE534889D34883EC28E8........4885C074..48893048895808488958104883C4285B5EC3"):PE.compareEP("83")&&PE.isSignatureInSectionPresent(0,"5383EC088B5C2414E8........85C074..8B542410895804895808891083C4085BC20800")),!bDetected&&PE.compareEP("E8....0000E801000000C35589E5")&&(sVersion="0.11+"),sLang="FreeBASIC",result()}meta("compiler","FreeBASIC")

================================================
FILE: dbs_min/db/PE/compiler_Free_Pascal.6.sg
================================================
function detect(){var e
return PE.compareEP("E8006E00005589E58B7D0C8B750889F88B5D1029")||PE.compareEP("E8006E00005589E58B7D0C8B750889F88B5D1029",19)?(sVersion="0.99.10",bDetected=1):PE.compareEP("C605........01E8....0000C605........00E8....000050E800000000FF25........55")?(sVersion="1.0.10",sOptions="win32 console",bDetected=1):PE.compareEP("C605........00E8....000050E800000000FF25........5589E5")?(sVersion="1.0.10",sOptions="win32 GUI",bDetected=1):PE.compareEP("5589E5C605........00E8........5531ED89E0A3........668CD5892D")?(sVersion="1.0.4",bDetected=1):PE.compareEP("C605........005589E55356578B7D08893D........8B7D0C893D........8B7D10893D")?(sVersion="1.0.4",sOptions="DLL",bDetected=1):PE.compareEP("5589E5C605........00E8........6A0064FF350000000089E0A3")||PE.compareEP("C605........01E874000000C605........00E86800000050E800000000FF25........90")?(sVersion="2.0.0",bDetected=1):PE.compareEP("5589E5C605........0168........6AF6E8........50E8")?(sVersion="2.6.0",bDetected=1):PE.compareEP("C605..........E8$$$$$$$$5589E5C605..........E8........5531ed89e0A3........668cd5892d........dbe3d9")&&(sVersion="1.0.2",bDetected=1),bFPC&&(-1!==(e=PE.findString(nOffset,4132,"FPC "))&&(sVersion=PE.getString(e+4)),bDetected=1,-1!=PE.getResourceNameOffset("LAZ_PIC_DIALOG_TEMPLATE"))&&(sOptions="Lazarus"),sLang="Pascal",result()}meta("compiler","Free Pascal"),includeScript("FPC")

================================================
FILE: dbs_min/db/PE/compiler_Go.4.sg
================================================
function detect(){return bDetected=0,PE.section[".symtab"]?(bDetected=1,PE.compareEP("488d742408488b3c24488d0510000000ffe0cccccccccccccccccccccccccccc")||PE.compareEP("83ec0c8b44240c8d5c241089442404895c2408c70424ffffffffe901000000cc")?sVersion="1.7.X-1.9.X":PE.compareEP("e90bd8ffffcccccccccccccccccccccc8b5c240464c705340000000000000089")||PE.compareEP("e92bc7ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")?sVersion="1.10":PE.compareEP("e98bc8ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")||PE.compareEP("e90bd9ffffcccccccccccccccccccccc8b5c240464c705340000000000000089")?sVersion="1.10.X":PE.compareEP("e98bdbffffcccccccccccccccccccccc8b5c240464c705340000000000000089")||PE.compareEP("e9dbc5ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")?sVersion="1.11-1.11.X":PE.compareEP("e9ebc5ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")||PE.compareEP("e99bdbffffcccccccccccccccccccccc8b5c240464c705340000000000000089")?sVersion="1.12 or 1.12.2-1.12.9":PE.compareEP("e98bc4ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")||PE.compareEP("e99bdaffffcccccccccccccccccccccc8b5c240464c705340000000000000089")?sVersion="1.12.1":PE.compareEP("e92bc5ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")||PE.compareEP("e9cbdaffffcccccccccccccccccccccc8b5c240464c705340000000000000089")?sVersion="1.13 or 1.13.2":PE.compareEP("e9cbc3ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")||PE.compareEP("e9cbd9ffffcccccccccccccccccccccc8b5c240464c705340000000000000089")?sVersion="1.13.1 or 1.13.3-9":PE.compareEP("e9cbd8ffffcccccccccccccccccccccc8b5c240464c705340000000000000089")||PE.compareEP("e9cbc1ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c")?sVersion="1.14 or 1.14.X":PE.compareEP("e9....ffffcccccccccccccccccccccc51488b01488b7110488b490865488b3c2530000000c7476800000000")||PE.compareEP("e9....ffffcccccccccccccccccccccc8b5c240464c705340000000000000089e58b4b0489c8c1e00229c489e78b7308fcf3")?sVersion="1.X":PE.compareEP("e9....ffffcccccccccccccccccccccc83ec28895c241c896c241089742414897c2418890424894c2404e8")||PE.compareEP("e9$$$$$$$$488b3c24488d742408e9$$$$$$$$4889f84889f34883ec284883e4f0")?sVersion="1.18.X-1.24.0":PE.isSignatureInSectionPresent(0,"ff20'Go build ID: '")?sVersion="1.15.0+":bDetected=0):PE.isSignatureInSectionPresent(0,"ff20'Go build ID: '")&&(sVersion="1.15.0+",bDetected=1),sLang="Go",result()}meta("compiler","Go")

================================================
FILE: dbs_min/db/PE/compiler_IBM_VisualAge_C.6.sg
================================================
function detect(){return PE.compareEP("558bec68........64ff35........648925........83ec0457e8$$$$$$$$dbe3c3")?(sVersion="4.0",bDetected=1):PE.compareEP("83ec..837c24....75..ff15........85c075..33c0e8")||PE.compareEP("83ec..837c24....75..e8........85c00f85........33c0e8")?(sVersion="4.0",sOptions="DLL",bDetected=1):PE.compareEP("535783ec..e8........ff15........b8........e8........85c075..83c4..b8")?(sVersion="3.5",bDetected=1):PE.compareEP("558bec68........64ff35........648925........e8........ff15........83ec04b8........e8$$$$$$$$b801000000c3")?(sVersion="3.6",bDetected=1):PE.compareEP("558bec8b45..83f8..74..85c074..eb..6a006a006a00ff15")&&(sOptions="1996",bDetected=1),sLang="C/C++",result()}meta("compiler","IBM VisualAge C/C++")

================================================
FILE: dbs_min/db/PE/compiler_IBM_VisualAge_COBOL.6.sg
================================================
function detect(){return PE.compareEP("558bec81ec........e8$$$$$$$$558becb8........2d........8b40..c9c3")?(sVersion="2.0",bDetected=1):PE.compareEP("558bec68........64ff35........648925........e8........e8")&&(sVersion="2.2",bDetected=1),sLang="COBOL",result()}meta("compiler","IBM VisualAge COBOL")

================================================
FILE: dbs_min/db/PE/compiler_IBM_VisualAge_PL_I.6.sg
================================================
function detect(){return PE.compareEP("558bfc83e4..8bec33c08d15........8d0d........515250e8")&&(sVersion="2.0",bDetected=1),result()}meta("compiler","IBM VisualAge PL/I")

================================================
FILE: dbs_min/db/PE/compiler_Intel_C.6.sg
================================================
function detect(){if(!PE.isNet())return PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..463c..74..84c074..8a46..463c..75..803e..75..46eb")?bDetected=1:PE.compare("'Intel(R) C++ Compiler for 32-bit applications'",1230)&&(sVersion=(sVersion=PE.getString(1285,8))&&-1!==sVersion.indexOf(" ")?sVersion.split(" ")[0]:"",bDetected=1),sLang="C/C++",result()}meta("compiler","Intel C/C++")

================================================
FILE: dbs_min/db/PE/compiler_Kotlin.4.sg
================================================
function detect(){var t
if(!PE.isNet())return(t=PE.section[".rdata"])&&PE.isSignaturePresent(t.Offset,512,"6B006F0074006C0069006E0078002E00630069006E007400650072006F007000")&&(bDetected=1),sLang="Kotlin",result()}meta("compiler","Kotlin")

================================================
FILE: dbs_min/db/PE/compiler_LCC-Win32.4.sg
================================================
function detect(){if(!PE.isNet())return PE.compareEP("64a1........5589e56a..68........68........506489..........83ec..53565789")&&(sVersion="1.3",bDetected=1),sLang="C",result()}meta("compiler","LCC-Win32")

================================================
FILE: dbs_min/db/PE/compiler_LDC.6.sg
================================================
function detect(){return PE.isSectionNamePresent(".minfo")&&!PE.isSectionNamePresent("._deh")&&(bDetected=1),sLang="D",result()}meta("compiler","LDC")

================================================
FILE: dbs_min/db/PE/compiler_LLVM.6.sg
================================================
function detect(){return(PE.section[".buildid"]||PE.compare("'LLD PDB.'",2599))&&(sOptions="LLD compiled",bDetected=1),sLang="C/C++",result()}meta("compiler","LLVM")

================================================
FILE: dbs_min/db/PE/compiler_Lahey_Fortran_90.4.sg
================================================
function detect(){return PE.compareEP("eb$$b8........a3........c705................6a..e8$$$$$$$$558becff75..e8........595dc3")?(sVersion="1994",sOptions="by Lahey Computer Systems Inc.",bDetected=1):PE.compareEP("558bec8b45..83e8..72..74..4874..4874..eb..68........e8........59e8")&&(sVersion="2001",sOptions="by Lahey Computer Systems Inc.",bDetected=1),sLang="Fortran",result()}meta("compiler","Lahey Fortran 90")

================================================
FILE: dbs_min/db/PE/compiler_MinGW.6.sg
================================================
function getMinGWVersion(){var e,t,i="",r=PE.section[".rdata"]
return!r||(e=r.FileOffset,r=r.FileSize,i=-1!=(t=PE.findString(e,r,"GCC: "))?PE.getString(t,128):i)||-1!=(t=PE.findString(e,r,"gcc-"))&&(i=(i=PE.getString(t)).substring(0,i.indexOf("/"))),i}function detect(){var e,t
return!(bDetected=2==PE.getMajorLinkerVersion()&&(t=PE.getMinorLinkerVersion(),!bFPC)&&(t<=30||36==t||41==t||44==t||56==t)&&PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000000000'PE'0000")&&(!PE.isSectionNamePresent(".rsrc")||(t=PE.section[".rsrc"])&&!PE.isSignaturePresent(t.FileOffset+t.FileOffset-512,512,"'Microsoft Corp.'"))?!0:bDetected)&&PE.compareEP("5589e583ec..e8$$$$$$$$5589e583ec..5383c4..68........e8........83c4..e8........e8........e8........83c4")&&(sVersion="2.9X",bDetected=1),bDetected?sVersion=getMinGWVersion():(t=PE.section[".buildid"],e=PE.section[".rdata"],!(bDetected=e?PE.isSignaturePresent(e.FileOffset,256,"'mingw'"):bDetected)&&t&&e&&(bDetected=PE.isSignaturePresent(e.FileOffset,e.FileSize,"'Mingw'"))),bDetected&&!PE.isOverlayPresent()?sOptions="stripped":bDetected||(PE.isOverlayPresent()?PE.compareOverlay("'.file' 00 00 00")&&(bDetected=1):(t=PE.section[".eh_frame"])&&1073741888&t.Characteristics&&(bDetected=1)),sLang="C/C++",result()}meta("compiler","MinGW"),includeScript("FPC")

================================================
FILE: dbs_min/db/PE/compiler_Nim.4.sg
================================================
function detect(){var i,e=PE.section[".rdata"]
return!PE.isRichSignaturePresent()&&e&&PE.isLibraryPresentExp(/^msvcrt/i)&&(i=e.FileOffset,e=e.FileSize,-1===PE.findString(i,e,"io.nim")&&-1===PE.findString(i,e,"fatal.nim")||(bDetected=1)),sLang="Nim",result()}meta("compiler","Nim")

================================================
FILE: dbs_min/db/PE/compiler_Pelles_C.6.sg
================================================
function detect(){return PE.compareEP("5589E56AFF68........68........64FF35000000006489250000000083EC0C")&&(bDetected=1),sLang="C",result()}meta("compiler","Pelles C")

================================================
FILE: dbs_min/db/PE/compiler_PerlApp.1.sg
================================================
function detect(){if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..8365....6a..ff15"))for(var e=0;e<PE.getNumberOfResources();e++)if(("232"==PE.resource[e].Type||"BFS"==PE.resource[e].Name)&&PE.compare("ff'BFS'01",PE.resource[e].Offset)){bDetected=1
break}return sLang="Perl",result()}meta("compiler","PerlApp")

================================================
FILE: dbs_min/db/PE/compiler_PowerBASIC.4.sg
================================================
function detect(){return PE.compareEP("558bec535657bb........662ef705............0f85........6a..ff15........e8........c783")&&(bDetected=1),sLang="Basic",result()}meta("compiler","PowerBASIC")

================================================
FILE: dbs_min/db/PE/compiler_PureBasic.4.sg
================================================
function detect(){for(var e,t=!1,r=1;r<PE.getNumberOfSections()&&!t;r++)1610612768==PE.section[r].Characteristics&&(t=!0)
return!!t&&(PE.is64()?PE.compareEP("4883EC..49C7C0........4831D248B9................E8........4831C9E8")&&(sVersion="4.X-6.X",bDetected=1):PE.compareEP("68....0000680000000068......00E8......0083C40C6800000000E8......00A3")?(sVersion="4.X-6.X",bDetected=1):PE.compareEP("837C24080175..8B442404A3........E8")&&(sVersion="4.X",bDetected=1),PE.isSectionNamePresent(".drectve")&&(e=PE.getSectionNumber(".drectve"),PE.isSignatureInSectionPresent(e,"'pb_datapointer'"))&&(sVersion="6.X",sOptions="gcc",bDetected=1),bDetected||"KERNEL32.dll"!==PE.getImportLibraryName(0)||(e=PE.section[".rdata"])&&(bDetected=-1!==PE.findSignature(e.FileOffset,5120,"1415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F30313233")),sLang="PureBasic",result())}meta("compiler","PureBasic")

================================================
FILE: dbs_min/db/PE/compiler_RADBasic.6.sg
================================================
function detect(){var e
return!(bDetected=PE.compareEP(PE.is64()?"48 83 EC":"E8")&&"CloseHandle"===PE.getImportFunctionName(0,0)&&(e=PE.section[".rdata"])&&PE.isSignatureInSectionPresent(e.Number,"'RADBasic'")?!0:bDetected)&&PE.isResourceNamePresent("RADBASICAPPICON")&&(bDetected=1),sLang="VB",result()}meta("compiler","RAD Basic")

================================================
FILE: dbs_min/db/PE/compiler_RealBasic.4.sg
================================================
function detect(){var e,t
return PE.isOverlayPresent()&&(e=PE.getOverlayOffset(),t=PE.getOverlaySize(),PE.isResourceGroupNamePresent("PICKLE"))&&-1!==PE.findString(e,t,"REALbasic.Point")&&-1!==PE.findString(e,t,"Xojo.Introspection")&&(bDetected=1),sLang="Basic",result()}meta("compiler","REALbasic (by Xojo.com)")

================================================
FILE: dbs_min/db/PE/compiler_RosASM.4.sg
================================================
function detect(){return bRosASM&&(sVersion=PE.getCompilerVersion(),sOptions=PE.getGeneralOptionsEx(),bDetected=1,3<PE.getMajorLinkerVersion())&&(sVersion+="*"),sLang="ASMx"+(PE.is64()?"64":"86"),result()}meta("compiler","RosASM"),includeScript("RosASM")

================================================
FILE: dbs_min/db/PE/compiler_Rust.4.sg
================================================
function detect(){var e=PE.section[".rdata"]
return PE.isTLSPresent()&&e&&PE.section._RDATA&&-1!=PE.findSignature(e.FileOffset,e.FileSize,"4C6F63616C5C527573744261636B74726163654D75746578")&&-1!=PE.findSignature(e.FileOffset,e.FileSize,"'/rust'")&&(bDetected=1),sLang="Rust",result()}meta("compiler","Rust")

================================================
FILE: dbs_min/db/PE/compiler_SpASM.4.sg
================================================
function detect(){return bSpASM&&(sVersion=PE.getCompilerVersion(),sOptions=PE.getGeneralOptionsEx(),bDetected=1,3<PE.getMajorLinkerVersion())&&(sVersion+="*"),_sLang="ASMx"+(PE.is64()?"64":"86"),result()}meta("compiler","SpASM"),includeScript("SpASM")

================================================
FILE: dbs_min/db/PE/compiler_Swift.6.sg
================================================
function detect(){if(!PE.isNet()&&!PE.isRichSignaturePresent())return PE.isLibraryPresentExp(/^swift/)&&(bDetected=1,PE.isLibraryPresent("swiftCRT.dll"))&&(sOptions="dynamic"),15<PE.getNumberOfSections()&&PE.isSectionNamePresentExp(/^.sw5/)&&(sVersion="5.X",bDetected=1),sLang="Swift",sLangVersion=sVersion,result()}meta("compiler","Swift")

================================================
FILE: dbs_min/db/PE/compiler_Symantec_C.6.sg
================================================
function detect(){return PE.compareEP("83ec08535556578b7c24..8b7424..8b6c24..ff15........894424..a9........74..807c24")&&(sVersion="7.2",sOptions="DLL",bDetected=1),sLang="C/C++",result()}meta("compiler","Symantec C/C++")

================================================
FILE: dbs_min/db/PE/compiler_TASM32.4.sg
================================================
function detect(){return bTASM32&&(2==PE.getMajorLinkerVersion()&&25==PE.getMinorLinkerVersion()&&(sVersion="5.x"),bDetected=1),sLang="ASMx86",result()}meta("compiler","TASM32"),includeScript("Borland"),includeScript("TASM32")

================================================
FILE: dbs_min/db/PE/compiler_Virtual_Pascal.4.sg
================================================
function detect(){return PE.compareEP("b9........b8........e8$$$$$$$$83ec..fc51e8")&&(sVersion="2.1",bDetected=1),sLang="Pascal",result()}meta("compiler","Virtual Pascal")

================================================
FILE: dbs_min/db/PE/compiler_Visual_Objects.4.sg
================================================
function detect(){return PE.compare("'This Visual Objects application cannot be run in DOS mode'",786)&&(sVersion="2.XX",bDetected=1),sLang="Visual Objects",result()}meta("compiler","Visual Objects")

================================================
FILE: dbs_min/db/PE/compiler_Visual_Prolog.4.sg
================================================
function detect(){return PE.compareEP("558bec57dbe3d92d........68........e8........8325..........75..6a..eb..33c066a1........50e8........8038")&&(sVersion="5.2",bDetected=1),sLang="Visual Prolog",result()}meta("compiler","Visual Prolog")

================================================
FILE: dbs_min/db/PE/compiler_Watcom.6.sg
================================================
function detect(){return PE.compare("'his is a Windows '",79)||-1!=PE.findString(PE.getEntryPointOffset(),32,"watcom")?bDetected=1:PE.compareEP("e9$$$$$$$$5351525589e583ec..b8........e8........a1........83c0..24..31d229c489e18b1d")?(sOptions="1995 by Watcom International",bDetected=1):PE.compareEP("e9$$$$$$$$535657558b7c24..8b7424..8b6c24..83fe..0f87........89f02eff")||PE.compareEP("e9$$$$$$$$535657558b7424..8b7c24..8b6c24..83ff..0f87........89f82eff")?(sVersion="1995",bDetected=1):PE.compareEP("e9$$$$$$$$535589e583ec..b8........e8........a1........83c0..24..29c489e38b15")?(sVersion="1995 EXE32, console",bDetected=1):PE.compareEP("e9$$$$$$$$535152565783ec..e8........a3........894424..8d4424..31dbe8")?(sVersion="1995",bDetected=1):PE.compareEP("e9$$$$$$$$535657558b7424..8b7c24..8b6c24..83ff..0f87........2eff")?(sVersion="2000",bDetected=1):PE.compareEP("c705................e9$$$$$$$$5351525589e583ec..b8........e8........a1........83c0..24..31d229c489e1")&&(sVersion="1995",bDetected=1),sLang="C/C++",result()}meta("compiler","Watcom C/C++")

================================================
FILE: dbs_min/db/PE/compiler_WutaoEPL.6.sg
================================================
function detect(){var e=PE.section[".ecode"]
return e&&PE.compare("'WTNE / MADE BY E COMPILER - WUTAO '",e.FileOffset)&&(sVersion="4.X",bDetected=1),sLang="Easy (EPL)",result()}meta("compiler","Wutao Easy Compiler")

================================================
FILE: dbs_min/db/PE/compiler_Xbase.4.sg
================================================
function detect(){var e
if(!PE.isNet())return(e=PE.section[".xpp"])&&(bDetected=PE.findString(e.FileOffset,e.FileSize,"XBPEXCEPTION")),PE.isLibraryPresent("XBTBase1.dll")&&(sOptions="Runtime",bDetected=1),sLang="Xbase++",result()}meta("compiler","Xbase++ Native Code Compiler")

================================================
FILE: dbs_min/db/PE/compiler_Zig.4.sg
================================================
function detect(){var e
return PE.compare("'MZ'78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.0000'PE'0000")&&(e=PE.section[".rdata"])&&PE.isDeepScan()&&(bDetected=-1!==PE.findSignature(e.FileOffset,e.FileSize,"5A00490047005F00440045004200550047005F0043004F004C004F005200")),sLang="Zig",result()}meta("compiler","Zig")

================================================
FILE: dbs_min/db/PE/compiler_tcc.6.sg
================================================
function detect(){var e,t,s
if(!PE.isNet())return t=e=!1,s=PE.isLibraryPresent("msvcrt.dll"),!PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000'PE'0000")||"6.0"!=PE.getCompilerVersion()||PE.section[".reloc"]||PE.section[".tls"]||PE.section[".rdata"]||PE.section[".rsrc"]||(_setResult("linker","TCC Linker","6.0",""),e=!0),s&&PE.compareEP(PE.is64()?"554889e54881ec........b8........8945..b8........4989c24c89d1e8":"5589e581ec........908d45..50e8........83c4..b8........8945..b8........50e8........83c4")&&(t=!0),(bDetected=e||t?!0:bDetected)&&!t&&PE.compareEP("5589E581EC........90E8")&&(sVersion="legacy",t=!0),bDetected&&(s||(sOptions="no std"),t||(sOptions=sOptions.append("no init"))),sLang="C",result()}meta("compiler","Tiny C")

================================================
FILE: dbs_min/db/PE/compiler_twinBASIC.6.sg
================================================
function detect(){if(!PE.isNet())return PE.isRichSignaturePresent()||(PE.isImportPositionHashPresent(0,3264172003)&&PE.isImportPositionHashPresent(1,1066087170)||PE.isResourceNamePresent("TWINBASIC.ICO"))&&(bDetected=1,PE.is64())&&(sVersion="Professional/Ultimate"),sLang="twinBASIC",result()}meta("compiler","twinBASIC")

================================================
FILE: dbs_min/db/PE/cryptor_Amber.2.sg
================================================
function detect(){return PE.isImportPositionHashPresent(-1,2546409553)&&PE.compareEP(PE.is64()?"48 83 EC .. 48 8B 05 .. .. .. .. C7 00 .. .. .. .. E8 .. .. .. .. E8 .. .. .. .. 90 90 48 83 C4":"83 EC 0C C7 05 94 53 40 00 01 00 00 00 E8 9E 02 00 00 83 C4 0C E9 A6 FC FF FF 8D B6 00 00 00 00 83 EC 0C C7 05 94 53 40 00 00 00 00 00 E8 7E 02 00 00 83 C4 0C E9 86 FC FF FF 8D B6 00 00 00 00 83 EC 1C 8B 44 24 20 89 04 24 E8 1D 12 00 00 85 C0 0F 94 C0 83 C4 1C 0F B6 C0 F7 D8 C3 90 90 90 55 89 E5 83")&&(bDetected=1),result()}meta("cryptor","Amber")

================================================
FILE: dbs_min/db/PE/cryptor_AverCryptor.2.sg
================================================
function detect(){if(PE.compareEP("60E8000000005D81ED........8BBD........8B8D........B8")){switch(bDetected=1,PE.readByte(PE.getEntryPointOffset()+65)){case 250:sVersion="1.0"
break
case 247:sVersion="1.02"}PE.isSectionNamePresent(".avc")||(sOptions="modified")}return result()}meta("cryptor","AverCryptor")

================================================
FILE: dbs_min/db/PE/cryptor_BattleshipCrypter.2.sg
================================================
function detect(){return PE.compareEP("6818144000E8F0FFFFFF0000000000003000000038000000000000007A88CD659A43264D8DF747BE8615237F")&&(sVersion="1.0",bDetected=1),result()}meta("cryptor","Battleship Crypter")

================================================
FILE: dbs_min/db/PE/cryptor_CronosCrypter.1.sg
================================================
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"43 72 6F 6E 6F 73 2D 43 72 79 70 74 65 72")&&(bDetected=1),result()}meta("cryptor","CronosCrypter")

================================================
FILE: dbs_min/db/PE/cryptor_CryptEngine_MalwareCryptor.2.sg
================================================
function detect(){return PE.isNetObjectPresent("Inject")&&PE.isNetUStringPresent("EntryPoint")&&PE.isNetUStringPresent("Invoke")&&PE.isNetUStringPresent("Load")&&(sVersion="NET-MalwareCryptor",bDetected=1),result()}meta("cryptor","CryptEngine")

================================================
FILE: dbs_min/db/PE/cryptor_Duals_eXe_Encryptor.2.sg
================================================
function detect(){if(PE.compareEP("558BEC81EC00050000E8000000005D81ED0E")){switch(PE.readWord(PE.getEntryPointOffset()+18)){case 776:sVersion="1.0"
break
case 1082:sVersion="1.0b"}bDetected=1}return result()}meta("cryptor","Duals eXe Encryptor")

================================================
FILE: dbs_min/db/PE/cryptor_EXECryptor.2.sg
================================================
function detect(){if(!PE.isNet()){if(PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8")?(sVersion="2.0/2.1",sOptions="protected IAT",bDetected=1):PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84")?(sVersion="2.0/2.1",bDetected=1):PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15")?(sVersion="2.1.17",bDetected=1):PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68")?(sVersion="2.2.4",bDetected=1):PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9")?(sVersion="2.2.6",sOptions="minimum protection",bDetected=1):PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81")?(sVersion="2.2.6",sOptions="DLL/minimum protection",bDetected=1):PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8")?(sVersion="2.2/2.3",sOptions="compressed code",bDetected=1):PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8")?(sVersion="2.2/2.3",sOptions="protected IAT",bDetected=1):PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000")?(sVersion="2.3.9",sOptions="compressed resources",bDetected=1):PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84")?(sVersion="2.3.9",sOptions="minimum protection",bDetected=1):PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9")?(sVersion="2.3.9",sOptions="DLL/compressed resources",bDetected=1):PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1")?(sVersion="2.3.9",sOptions="DLL/minimum protection",bDetected=1):PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889")?(sVersion="2.XX",sOptions="compressed resources",bDetected=1):PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A")?(sVersion="2.XX",sOptions="max. compressed resources",bDetected=1):PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1")?(sVersion="1.3.0.45",bDetected=1):PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4")?(sVersion="1.4X-1.5X",bDetected=1):PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3")?(sVersion="1.5X",bDetected=1):PE.compareEP("83C6148B55FCE9..FFFFFF")||PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1")?(sVersion="2.1X",bDetected=1):PE.compareEP("FFE0E804000000FFFFFFFF5EC300")?(sVersion="2.2X",bDetected=1):PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F")&&(bDetected=1),!bDetected){var e=PE.section.length
if(3<e&&2==PE.getNumberOfImports()&&1==PE.getNumberOfImportThunks(1)&&"MessageBoxA"==PE.getImportFunctionName(1,0))for(var E=1;E<3;E++)if(PE.getImportSection()==e-E&&0==PE.section[e-E-1].FileSize){sVersion=4<e?"2.4X":"2.X",bDetected=1
break}}return result()}}meta("cryptor","EXECryptor")

================================================
FILE: dbs_min/db/PE/cryptor_Huan.1.sg
================================================
function detect(){return PE.isSectionNamePresent(".huan")&&(bDetected=1),result()}meta("cryptor","Huan")

================================================
FILE: dbs_min/db/PE/cryptor_KCryptor.2.sg
================================================
function detect(){return PE.compareEP("558bec83ec..53565733db53ff15........8b3d........8945..b8........ff30be........56e8........68........6a..e8........83c4..6a..68........5753ffd0")&&(sVersion="0.11",bDetected=1),result()}meta("cryptor","K!Cryptor")

================================================
FILE: dbs_min/db/PE/cryptor_Kryptonit.2.sg
================================================
function detect(){return nOffset=147,PE.compareEP("558BEC")&&PE.compare("'Krypton'",nOffset)&&(sVersion="0.1-0.2",bDetected=1),result()}meta("cryptor","Kryptonite")

================================================
FILE: dbs_min/db/PE/cryptor_LimeCrypter.2.sg
================================================
function detect(){if(PE.isNet()){if(bDetected=1,validateReferences(isPositive=!0,references=["System.Security.Cryptography","System.Collections.Generic","System.Resources","System.Reflection"]))return void(bDetected=0)
PE.isSignatureInSectionPresent(0,"3c50726976617465496d706c656d656e746174696f6e44657461696c733e7b........................................................................7d")&&PE.isSignatureInSectionPresent(0,"24........................................................................")&&PE.isNetObjectPresent("<Initialize>o__SiteContainer0")&&PE.isNetObjectPresent("$$method0x6000005-1")&&PE.isNetObjectPresent("Assembly")&&PE.isNetObjectPresent("Rfc2898DeriveBytes")&&PE.isNetObjectPresent("AES_Decrypt")&&PE.isNetObjectPresent("<>p__Site1")&&!PE.isNetObjectPresent("Chainski")||(bDetected=0)}return result()}function validateReferences(e,t){for(var i=0;i<t.length;i++){var r="00'"+t[i]+"'00"
if(1==e){if(!PE.isSignatureInSectionPresent(0,r))return!0}else if(PE.isSignatureInSectionPresent(0,r))return!0}return!1}meta("cryptor","LimeCrypter")

================================================
FILE: dbs_min/db/PE/cryptor_NativeCryptor_by_DosX.2.sg
================================================
function detect(){return bDetected=3<=PE.getNumberOfSections()&&PE.compareOverlay("'7stgc_hdr'00"),result()}meta("cryptor","NativeCryptor by DosX")

================================================
FILE: dbs_min/db/PE/cryptor_PEUnion.2.sg
================================================
function detect(){var e
PE.isNet()||(bDetected=1,PE.is64()&&(bDetected=0),validateNativeImports(isPositive=!0,references=[[e="kernel32.dll","GetProcAddress"],[e,"ExitProcess"],[e,"GetModuleFileNameA"],[e,"GetComputerNameA"],[e,"VirtualAllocExNuma"],["shlwapi.dll","PathFindFileNameA"]])&&(bDetected=0),3==PE.getNumberOfSections()&&PE.compareEP("E8??????006A00FF15A4????00C3")&&PE.isSectionNamePresent(".rsrc")&&PE.isSectionNamePresent(".idata")&&PE.isSectionNamePresent(".text")&&-1!=PE.findString(PE.section[".rsrc"].FileOffset,PE.section[".rsrc"].FileSize,"</assembly>")&&PE.getSectionVirtualSize(1)+PE.getSectionVirtualSize(2)<PE.getSectionVirtualSize(0)&&PE.isSignatureInSectionPresent(1,"00'Shlwapi.dll'00")||(bDetected=0),sOptions+="RunPE"),PE.isNet()&&(bDetected=1,validateReferences(isPositive=!0,references=["kernel32.dll","LoadLibraryA","GetProcAddress","System.Runtime.InteropServices","System.Runtime.CompilerServices","System.IO","System.Reflection","System.Resources","System.Collections.Generic","System.Core","System.Linq","IEnumerable`1","<>c__DisplayClass1","Func`2"],section=0)&&(bDetected=0),PE.isNetObjectPresent("BeginInvoke")||PE.isNetObjectPresent("EndInvoke"))&&(sOptions+="Invoke"),sVersion="4.0"}function validateReferences(e,t,i){for(var r=0;r<t.length;r++){var n="00'"+t[r]+"'00"
if(1==e){if(!PE.isSignatureInSectionPresent(i,n))return!0}else if(PE.isSignatureInSectionPresent(i,n))return!0}return!1}function validateNativeImports(e,t){for(var i=0;i<t.length;i++){var r=t[i],n=r[0],r=r[1]
if(1==e){if(!PE.isLibraryFunctionPresent(n,r))return!0}else if(PE.isLibraryFunctionPresent(n,r))return!0}return!1}meta("cryptor","PEUnion")

================================================
FILE: dbs_min/db/PE/cryptor_RCryptor.2.sg
================================================
function detect(){return PE.compareEP("90589050908B00903C5090580F8567D6EF115068")?(sVersion="1.??",bDetected=1):PE.compareEP("8B042483E84F68........FFD0")?(sVersion="1.1",bDetected=1):PE.compareEP("558BEC8B44240483E84F68........FFD0585950")?(sVersion="1.3/1.4",bDetected=1):PE.compareEP("6183EF4F6068........FFD7")?(sVersion="1.3b",bDetected=1):PE.compareEP("832C244F68........FF542404834424044F")?(sVersion="1.5",bDetected=1):PE.compareEP("33D068........FFD2")?(sVersion="1.6",bDetected=1):PE.compareEP("8BC70304242BC78038500F851B8B1FFF68")?(sVersion="1.6b/1.6c",bDetected=1):PE.compareEP("60906161807FF04590600F851B8B1FFF68")?(sVersion="1.6d",bDetected=1):PE.compareEP("F7D183F1FF6A00F7D183F1FF810424........F7D183F1FF")&&(PE.compareEP("E8",24)&&(sOptions="Hide EP"),sVersion="2.0",bDetected=1),bDetected&&!PE.isSectionNamePresentExp(/^(\.)?RCryptor$/)&&(sOptions="modified"),result()}meta("cryptor","RCryptor")

================================================
FILE: dbs_min/db/PE/cryptor_RDG_Tejon_Crypter.2.sg
================================================
function detect(){return PE.compareEP("6850171001E8EEFFFFFF000000000000300000003800000100000000B365D0B8919CE145AA1BEEE0C80467EE")&&(sVersion="0.7",bDetected=1),result()}meta("cryptor","RDG Tejon Crypter")

================================================
FILE: dbs_min/db/PE/cryptor_ReXCrypter.2.sg
================================================
function detect(){var e
return PE.isNet()&&(0===(e=PE.getNetAssemblyName()).indexOf("ReXStub ")&&((e=e.split(" ")[1])&&e.length<5&&(sVersion="1.0-2.0, stub "+e),bDetected=1),bDetected||PE.isNetObjectPresent("GetConsoleWindow")&&PE.isNetObjectPresent("LoadInMem")&&(sVersion="custom stub",bDetected=1)),result()}meta("cryptor","ReXCrypter")

================================================
FILE: dbs_min/db/PE/cryptor_Stones_PE_Encryptor.2.sg
================================================
function detect(){if(PE.compareEP("555756525153E8........5D8BD581ED........2B95........83EA0B8995")){switch(PE.getEntryPointSignature(35,2)){case"8DB5":sVersion="1.0"
break
case"0195":sVersion="1.13"}bDetected=1}else PE.compareEP("535152565755E8........5D81ED........FF95........B8........03C52B85")&&(sVersion="2.0",bDetected=1)
return result()}meta("cryptor","Stone's PE Encryptor")

================================================
FILE: dbs_min/db/PE/cryptor_Virogen_Crypt.2.sg
================================================
function detect(){return PE.compareEP("9c55e8$$$$$$$$e8000000008b2c2481ed........83c4..c3")&&(sVersion="0.75",bDetected=1),result()}meta("cryptor","Virogen Crypt")

================================================
FILE: dbs_min/db/PE/cryptor_XorCryptor.2.sg
================================================
function detect(){return/^[A-Za-z]{10,31}$/.test(PE.getNetAssemblyName())&&PE.isNetObjectPresent("LateIndexGet")&&PE.isNetUStringPresent("System.Reflection.Assembly")&&PE.isNetUStringPresent("EntryPoint")&&PE.isNetUStringPresent("Load")&&PE.isNetUStringPresent("Invoke")&&(bDetected=1),result()}meta("cryptor","XorCryptor")

================================================
FILE: dbs_min/db/PE/cryptor_Yodas_Crypter.2.sg
================================================
function detect(){if(PE.compareEP("60E8000000005D81ED........E8A1000000E8D1000000E885010000F785"))sVersion="1.0",bDetected=1
else if(PE.compareEP("60E8000000005D81ED........B9....00008DBD........8BF7")){switch(PE.readWord(PE.getEntryPointOffset()+14)){case 158:sVersion="1.1"
break
case 2427:sVersion="1.2"
break
default:sVersion="1.X"}bDetected=1}else PE.compareEP("558BEC53565760E8000000005D81ED")?PE.compareEP("E803000000EB01",19)?(sVersion="1.0b",bDetected=1):PE.compareEP("B9",19)&&(sVersion="1.3",bDetected=1):PE.compareEP("558BEC81ECC00000005356578DBD40FFFFFFB930000000B8CCCCCCCCF3AB60")&&(sVersion="1.3",bDetected=1)
return result()}meta("cryptor","Yoda's Crypter")

================================================
FILE: dbs_min/db/PE/custom_sfx_installers.1.sg
================================================
function detect(){var e,s
if(PE.compareEP("558bec6aff68........68........64a1........50648925........83ec..535657")){if(PE.compareOverlay("....'-lh5-'"))sName="Toxsoft SFX",bDetected=1
else if(-1!==PE.findSignature(PE.getOverlayOffset(),256,"'MSCF'"))sName="Webest SFX",sVersion="1.0",bDetected=1
else if(PE.compareOverlay("a6d6b210"))sType="installer",sName="Sax Software installer",bDetected=1
else if(PE.compareOverlay("'Win_Sfx_For_Windows_'"))sName="XZIP-SFX",sOptions="by Netzip",bDetected=1
else if(0<PE.getNumberOfResources())for(var a=0;a<PE.resource.length&&!bDetected;a++)PE.compare("'SZDD'88",PE.resource[a].Offset)&&(sType="installer",sName="custom installer with SZDD-archives",bDetected=1)}else PE.compareEP("558bec81ec........5333db53ff15........a3........891d........891d........e8........391d")?PE.compareOverlay("'PK'0304")&&(sType="sfx",sName="ZIP-SFX",sOptions="by Ashampoo",bDetected=1):PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")?0<PE.getNumberOfResources()&&PE.compare("5d00008000........000000000000",PE.resource[0].Offset)&&(sType="installer",sName="Microsoft Windows update",bDetected=1):PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")?PE.compareOverlay("........00020200")&&(e=PE.getOverlayOffset(),s=PE.readWord(e),PE.compare("'SDLSOPKG'",e+s))&&(sType="installer",sName="SysDev Laboratories",bDetected=1):PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d")&&PE.compareOverlay("'PK'0304")&&(sType="sfx",sName="ZIP-SFX",sOptions="by Aeco Systems",bDetected=1)
return result()}meta("sfx")

================================================
FILE: dbs_min/db/PE/debug_data.5.sg
================================================
function detectUnknownDebugData(e,t){var a
t<2||(21243===PE.readWord(e)?(t=PE.readByte(e+2),a=PE.readByte(e+3),t=(10*(t>>4)+(15&t)).toString(),a=(10*(a>>4)+(15&a)).toString()+"."+t,t=PE.readWord(e+14),_setResult("debug data","Borland TDS",a,t?t+" symbols":"")):PE.compare("'FB09'",e)?_setResult("debug data","Borland TDS","","Delphi TDS"):PE.compare("'FB0A'",e)&&_setResult("debug data","Borland TDS","","C++ TDS"))}function detect(){for(var e=PE.getNumberOfDebugDataRecords(),t=0;t<e;t++){var a=PE.getDebugDataType(t)
"UNKNOWN"===a?detectUnknownDebugData(PE.getDebugDataOffset(t),PE.getDebugDataSize(t)):_setResult("debug data",a,"","")}}

================================================
FILE: dbs_min/db/PE/dotnet_only/about.txt
================================================
Scripts for .NET files only will be located here (PE.isNet() == true)

================================================
FILE: dbs_min/db/PE/emulator_Wine.3.sg
================================================
function detect(){return PE.compare("'Wine'",64)&&(sVersion="1.X",bDetected=1),result()}meta("emulator","Wine")

================================================
FILE: dbs_min/db/PE/engine_AGS.1.sg
================================================
function detect(){return PE.compareOverlay("434c49421a..00")&&(bDetected=1),result()}meta("engine","Adventure Game Studio (AGS)")

================================================
FILE: dbs_min/db/PE/format_AutoHotKey.3.sg
================================================
function detect(){var e
return PE.resource[">AUTOHOTKEY SCRIPT<"]?(sVersion=PE.getFileVersion(),bDetected=1):-1!==(e=PE.getManifest()).indexOf("AutoHotkey")&&e.match(/(\n?)<assemblyIdentity.*?(\n?).*version(.*?)(\n?)name=\"AutoHotkey\"/)&&(aVersion=e.match(/version=\"(.*?)\" ?name=\"AutoHotkey/),sVersion=aVersion[1],bDetected=1),result()}meta("format","Compiled AutoHotKey")

================================================
FILE: dbs_min/db/PE/format_AutoIt.3.sg
================================================
function detect(){return PE.isResourceNamePresent("SCRIPT")||PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")&&PE.compareOverlay("a3484bbe986c4aa9")?(sVersion="3.XX",bDetected=1):"Compiled AutoIt Script"==PE.getVersionStringInfo("FileDescription")&&(sVersion=PE.getFileVersionMS(),bDetected=1),result()}meta("format","AutoIt")

================================================
FILE: dbs_min/db/PE/game_engine_Atlas.3.sg
================================================
function detect(){return"Atlas Game Engine"==PE.getVersionStringInfo("ProductName")&&(bDetected=1),result()}meta("game engine","Atlas")

================================================
FILE: dbs_min/db/PE/game_engine_DEV7.3.sg
================================================
function detect(){return"Dev7 VM v1.30b"==PE.getVersionStringInfo("ProductName")?(sVersion="1.30b",bDetected=1):"Loader 7 v1.10a"==PE.getVersionStringInfo("ProductName")?(sVersion="1.10a",bDetected=1):"Dev7 VM v1.30a"==PE.getVersionStringInfo("ProductName")?(sVersion="1.30a",sOptions="Антошка 3",bDetected=1):"Dev7 VM v1.30"==PE.getVersionStringInfo("ProductName")&&(sVersion="1.30",bDetected=1),result()}meta("game engine","DEV7")

================================================
FILE: dbs_min/db/PE/game_engine_Director.3.sg
================================================
function detect(){return PE.isExportFunctionPresent("_FindEmbeddedMovie")||PE.isExportFunctionPresent("_GetCurrentEmbeddedMovie")?(sVersion="7.0-7.0.2",bDetected=1):"Copyright © 1985-1996 Macromedia, Inc."==PE.getVersionStringInfo("LegalCopyright")?(sVersion="5.0-5.0.1",bDetected=1):"Copyright © 1985-1997 Macromedia, Inc."==PE.getVersionStringInfo("LegalCopyright")?(sVersion="6.0-6.5",bDetected=1):"Director 8 Shockwave Studio"==PE.getVersionStringInfo("ProductName")?(sVersion="8.0",sOptions="Shockwave Studio",bDetected=1):"Director 8.5 Shockwave Studio"==PE.getVersionStringInfo("ProductName")?(sVersion="8.5",sOptions="Shockwave Studio",bDetected=1):"Copyright © 1985-2002 Macromedia, Inc."==PE.getVersionStringInfo("LegalCopyright")?(sVersion="9.0",bDetected=1):"Copyright © 1985-2003 Macromedia, Inc."==PE.getVersionStringInfo("LegalCopyright")?(sVersion="10.0",bDetected=1):"Director MX 2004"==PE.getVersionStringInfo("ProductName")?(sVersion="10.1",sOptions="MX 2004",bDetected=1):"Director 11.3"==PE.getVersionStringInfo("ProductName")?(sVersion="11.0.3",bDetected=1):"Director 11.5"==PE.getVersionStringInfo("ProductName")?(sVersion="11.5",bDetected=1):"12.0.1 Development"==PE.getVersionStringInfo("ProductVersion")&&(sVersion="12.0.1",sOptions="Development build",bDetected=1),result()}meta("game engine","Director")

================================================
FILE: dbs_min/db/PE/game_engine_Godot.3.sg
================================================
function detect(){return"Godot Engine"==PE.getVersionStringInfo("FileDescription")&&(bDetected=1),result()}meta("game engine","Godot")

================================================
FILE: dbs_min/db/PE/game_engine_Wintermute.3.sg
================================================
function detect(){return"Wintermute Engine Runtime"==PE.getVersionStringInfo("FileDescription")&&(bDetected=1),result()}meta("game engine","Wintermute")

================================================
FILE: dbs_min/db/PE/game_engine_XPAT.3.sg
================================================
function detect(){return"Xpat Runtime Engine"===PE.getVersionStringInfo("FileDescription")&&(sVersion="1.0.0.1",sOptions="1995",bDetected=1),result()}meta("game engine","XPAT")

================================================
FILE: dbs_min/db/PE/game_engine_Xash.3.sg
================================================
function detect(){var e=PE.section[".data"]
return e&&-1!=PE.findString(e.FileOffset,e.FileSize,"Xash Error")&&-1!=PE.findString(e.FileOffset,e.FileSize,"xash.dll")&&-1!=PE.findString(e.FileOffset,e.FileSize,"Unable to load the xash.dll")&&(bDetected=1),result()}meta("game engine","Xash3D")

================================================
FILE: dbs_min/db/PE/installer_ACCAStore.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1")&&0<PE.getNumberOfResources()&&-1!==PE.getResourceNameOffset("METRO_INFO")&&(sVersion="1.9.4.0",bDetected=1),result()}meta("installer","ACCAStore")

================================================
FILE: dbs_min/db/PE/installer_AOLSetup.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..535657")&&PE.compareOverlay("'RS'")&&(sVersion="by America Online",bDetected=1),result()}meta("installer","AOLSetup")

================================================
FILE: dbs_min/db/PE/installer_Acronis_installer.1.sg
================================================
function detect(){return PE.compareOverlay("'PK'0304")&&(PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15")||PE.compareEP("6a..68........e8$$$$$$$$68........64a1........508b4424..896c24..8d6c24..2be05356578b45..8965..508b45..c7")||PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74")||PE.compareEP("558bec8b45..8b4d..8b55..83f8..75..8915........894d..8945..8955..5de9")||PE.compareEP("8b4424..83f8..8b4c24..8b5424..75..8915........894c24..894424..895424..e9")||PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))&&(sOptions="ZIP",bDetected=1),result()}meta("installer","Acronis installer")

================================================
FILE: dbs_min/db/PE/installer_Actual_Installer.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3")&&PE.compareOverlay("....................'MSCF'00")&&(sVersion="1.0.0.0",bDetected=1),result()}meta("installer","Actual Installer")

================================================
FILE: dbs_min/db/PE/installer_Adobe_FlashPlayer_downloader.1.sg
================================================
function detect(){return PE.compareEP("B8......005064FF3500")&&PE.isOverlayPresent()&&"Adobe Download Manager"==PE.getVersionStringInfo("InternalName")&&(sVersion="2.0",sOptions="PECompact",bDetected=1),result()}meta("installer","Adobe FlashPlayer downloader")

================================================
FILE: dbs_min/db/PE/installer_Adobe_installers.1.sg
================================================
function detect(){var e
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")){for(var r=0;r<PE.resource.length;r++)if(3284==PE.resource[r].Type&&-1!=PE.findSignature(PE.resource[r].Offset,6,"'7z'BCAF271C")){sName+=" Reader Installer",sOptions="7zip sfx",bDetected=1
break}}else PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")?PE.compareOverlay("'^OPT'")&&-1!=(e=PE.findString(PE.getOverlayOffset(),80,"^ARC"))&&PE.compare("1f8b08",e+4)&&(sName+=" SVG Installer",sOptions="gzip",bDetected=1):PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")&&PE.resource[0]&&-1!=PE.findSignature(PE.resource[0].Offset,6,"'7z'BCAF271C")&&(sName+=" WebInstaller",sOptions="7zip sfx",bDetected=1)
return result()}meta("installer","Adobe")

================================================
FILE: dbs_min/db/PE/installer_Advanced_installer.1.sg
================================================
function detect(){return PE.compareOverlay("2f30ee1f5e4ee51e")?(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")||PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7")||PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc83bcf75..b9........eb"))&&(bDetected=1):PE.compareOverlay("d0cf11e0a1b11ae1")?(PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7")||PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))&&(bDetected=1):PE.isSignaturePresent(PE.getSize()-80,80,"'ADVINSTSFX'")?PE.compareEP("558bec837d....75..e8$$$$$$$$8b0d........5657bf........be........3bcf74")||PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")?bDetected=1:PE.compareEP("558bec837d....75..e8........ff75..ff75..ff75..e8........83c4..5d")&&(sVersion="12.6.1",bDetected=1):PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")?"[GeneralOptions]"==PE.read_unicodeString(PE.getOverlayOffset()+2,16)&&(bDetected=1):PE.compareOverlay("c885'CP'd8e3")&&PE.compareEP("558bec837d....75..e8........ff75..ff75..ff75..e8........83c4..5d")&&(sVersion="16.3.0.0",bDetected=1),result()}meta("installer","Advanced Installer")

================================================
FILE: dbs_min/db/PE/installer_Adveractive.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("'10JP'")&&(bDetected=1),result()}meta("installer","Adveractive")

================================================
FILE: dbs_min/db/PE/installer_Aeco_installer.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d........83ec..8901")&&PE.compareOverlay("'EWETAR DATA FILE!! VER 1.00 <<<>>>'")&&(sVersion="1.0",bDetected=1),result()}meta("installer","Aeco Systems installer")

================================================
FILE: dbs_min/db/PE/installer_Alchemy_Mindworks_installer.1.sg
================================================
function detect(){if(PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf")&&0<PE.getNumberOfResources())for(var e=0;e<PE.resource.length&&!bDetected;e++)PE.compare("504b0304",PE.resource[e].Offset)&&(bDetected=1)
return result()}meta("installer","Alchemy Mindworks installer")

================================================
FILE: dbs_min/db/PE/installer_Astrum.1.sg
================================================
function detect(){if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&-1!=PE.isOverlayPresent())for(var e=0;e<PE.getNumberOfResources();e++)if(77==PE.resource[e].Type&&-1!=PE.findSignature(PE.resource[e].Offset,320,"'AstrumInstallWizard'")){bDetected=1
break}return result()}meta("installer","Astrum")

================================================
FILE: dbs_min/db/PE/installer_AutoPlay_Media_Studio.1.sg
================================================
function detect(){var e
return PE.compareOverlay("0b0bafaf0b0ba4")&&(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb")&&(sVersion="8.X",bDetected=1),PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc8"))&&(sVersion="7.5.X",bDetected=1),bDetected&&(e=PE.getFileVersion().replace(/\.0\.0$/,""))&&(sVersion=e),result()}meta("installer","AutoPlay Media Studio")

================================================
FILE: dbs_min/db/PE/installer_Autodesk_Self-Extract.1.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7d0")&&PE.compareOverlay("'00000000000000BD00000000000000010000000000000001'",6560)&&(bDetected=1),result()}meta("installer","Autodesk Self-Extract")

================================================
FILE: dbs_min/db/PE/installer_AutorunProEnterprise.1.sg
================================================
function detect(){var e=PE.section[".rsrc"]
return e&&PE.isSectionNamePresent("CODE")&&-1!==PE.findString(e.FileOffset,e.FileSize,"9AutoRunObjects")&&-1!==PE.findString(e.FileOffset,e.FileSize,"AutoRunObjects")&&(bDetected=1),result()}meta("installer","Autorun Pro Enterprise")

================================================
FILE: dbs_min/db/PE/installer_AutorunProEnterpriseII.1.sg
================================================
function detect(){var e=PE.section[".rsrc"],t=PE.section.CODE
return e&&t&&(bDetected=-1!==PE.findString(t.FileOffset,t.FileSize,"TAutoRunProjectX")&&-1!==PE.findString(e.FileOffset,e.FileSize,"AutoRunObjects")),result()}meta("installer","Autorun Pro Enterprise II")

================================================
FILE: dbs_min/db/PE/installer_BitRock_Installer.1.sg
================================================
function detect(){return(bDetected=PE.compareOverlay("........'.eh_frame'00")&&(PE.compareEP("60be........8dbe........c787................5789e58d9c24........31c05039dc75..46465368")||PE.compareEP("83ec..c70424........ff15........e8........8d7426..8dbc27........a1........ffe0"))?!0:bDetected)||/BitRock/.test(PE.getManifest())&&(bDetected=1),result()}meta("installer","BitRock Installer")

================================================
FILE: dbs_min/db/PE/installer_Bytessence_Install_Maker.1.sg
================================================
function detect(){return PE.compareOverlay("'$_BIM_CONFIG_START_$'")&&(PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68")?(sVersion="5.40",bDetected=1):PE.compareEP("4883ec..49c7c0........4831d248b9................e8........4831c9e8........488905........4d31c048c7c2........4831c9e8........488905........48b8")&&(sVersion="5.40",sOptions="x64",bDetected=1)),result()}meta("installer","Bytessence Install Maker")

================================================
FILE: dbs_min/db/PE/installer_CNetX.1.sg
================================================
function detect(){if(PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..4684c074..3c..75"))for(var e=0;e<PE.resource.length&&!bDetected;e++)PE.compare("784b0304",PE.resource[e].Offset)&&(sOptions="modified ZIP",bDetected=1)
return result()}meta("installer","CNetX")

================================================
FILE: dbs_min/db/PE/installer_CSDD_installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")&&0<PE.getNumberOfResources()&&(PE.resource[0].Name="1",PE.compare("ec7c7f7c",PE.getResourceOffsetByNumber(0)))&&(sVersion="1.1",bDetected=1),result()}meta("installer","CSDD's")

================================================
FILE: dbs_min/db/PE/installer_CZ_installer.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3")&&0<PE.getNumberOfResources()&&-1!=PE.getResourceNameOffset("CZ_STORAGE")&&(bDetected=1),result()}meta("installer","CZ installer")

================================================
FILE: dbs_min/db/PE/installer_Calibre_installer.1.sg
================================================
function detect(){return PE.resource.EXTRA&&100663296<PE.section[".rsrc"].FileSize&&"calibre"==PE.getVersionStringInfo("ProductName")&&(sVersion=PE.getVersionStringInfo("FileVersion"),sOptions=".LZ Archive",bDetected=1),result()}meta("installer","Calibre Portable Installer")

================================================
FILE: dbs_min/db/PE/installer_Chaos_Software_installer.1.sg
================================================
function detect(){return PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b..........48836424....48bf................483bc774")&&PE.compareOverlay("276327631226097513180178")&&(bDetected=1),result()}meta("installer","Chaos Software installer")

================================================
FILE: dbs_min/db/PE/installer_ClickTeam.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&(PE.compareOverlay("'wwgT)'")||PE.compareOverlay("..120100....0000"))&&(bDetected=1),result()}meta("installer","ClickTeam")

================================================
FILE: dbs_min/db/PE/installer_Codegear_Installer.1.sg
================================================
function detect(){return PE.compareEP("60be........8dbe........5783cd..eb$$8b1e83ee..11db72..b8........01db75..8b1e")&&PE.compareOverlay("........'GRCSETUPINFORMATION'")&&(bDetected=1),result()}meta("installer","Codegear Installer")

================================================
FILE: dbs_min/db/PE/installer_CreateInstall.1.sg
================================================
function detect(){return PE.compareEP("558BEC81EC200200005356576A00FF15........68........894508FF15........85C074276A00A1........50FF15")?bDetected=1:PE.compareEP("81EC0C0400005356575568605040006A016A00FF15........8BF0FF15........3DB7000000750F56FF15")?PE.compareOverlay("02060a0405fd59")&&(sVersion="2003.3.5",bDetected=1):PE.compareOverlay("'aWAW'")&&(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")||PE.compareEP("68........ff15........0bc074..e8"))&&(bDetected=1),result()}meta("installer","CreateInstall")

================================================
FILE: dbs_min/db/PE/installer_CrypKey_Installer.1.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$5668........e8........8bf068........56e8........a3........68........56e8........a3........68........56e8........a3........68........56e8........a3........68........56e8")&&PE.compareOverlay("'CK16'")&&(bDetected=1),result()}meta("installer","CrypKey")

================================================
FILE: dbs_min/db/PE/installer_DeployMaster.1.sg
================================================
function detect(){return PE.compareEP("558bec81c4........5333c08985........8985........b8........e8........33c05568........64ff30")&&PE.compareOverlay("'BZh91'")&&(sVersion="2.8.0",bDetected=1),result()}meta("installer","DeployMaster")

================================================
FILE: dbs_min/db/PE/installer_DesktopX_Installer.1.sg
================================================
function detect(){if(PE.compareEP("6a..68........6a..6a..ff15........50e8........50ff15"))for(var e=0;e<PE.resource.length;e++)630!=PE.resource[e].Type&&726!=PE.resource[e].Type&&678!=PE.resource[e].Type&&774!=PE.resource[e].Type||PE.compare("'PK'0304",PE.getResourceOffsetByNumber(e))&&(bDetected=1)
return result()}meta("installer","DesktopX Installer")

================================================
FILE: dbs_min/db/PE/installer_Eschalon_installer.1.sg
================================================
function detect(){return PE.compareEP("558bec81c4........53565733c08985........8985........e8$$$$$$$$e8$$$$$$$$31d28d")&&PE.compareOverlay("'EPSF'")&&(sVersion=PE.getFileVersion().replace(/\.0\.0$/,""),bDetected=1),result()}meta("installer","Eschalon Installer")

================================================
FILE: dbs_min/db/PE/installer_Excelsior_Installer.1.sg
================================================
function detect(){return PE.compareEP("83ec..53555657e8........6a..5b391d........8bf37e..8b3d........a1........8b....8a08")&&PE.compareOverlay("'ExcelsiorII1'")&&(bDetected=1),result()}meta("installer","Excelsior Installer")

================================================
FILE: dbs_min/db/PE/installer_FDM_Installer.1.sg
================================================
function detect(){return PE.compareOverlay("'###FDMDATA###'")&&(bDetected=1,PE.compareEP("558BEC6AFF6820714000682C364000"))&&(sVersion="1.0"),result()}meta("installer","FDM Installer")

================================================
FILE: dbs_min/db/PE/installer_GPInstall.1.sg
================================================
function detect(){return PE.compareOverlay("........'SPIS'1a'LH5'")&&(sOptions="SPIS LH5",PE.compareEP("558bec83c4..5333c08945..b8........e8........33c05568........64ff30648920ba........33c0e8")||PE.compareEP("558bec83c4..53565733c08945..b8........e8........33c05568........64ff30648920ba........33c0e8")||PE.compareEP("558bec33c951515151515151535657b8........e8........33c05568........64ff30648920ba........33c0"))&&(bDetected=1),result()}meta("installer","GPInstall")

================================================
FILE: dbs_min/db/PE/installer_Gentee_Installer.1.sg
================================================
function detect(){return PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15")?(-1!=PE.findSignature(PE.getOverlayOffset(),128,"'GEA'")||0<PE.getNumberOfResources()&&PE.compare("'GEA'",PE.getResourceNameOffset("SETUP_TEMP")))&&(bDetected=1):PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")?-1==PE.findSignature(PE.getOverlayOffset(),128,"'GEA'")&&-1==PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".data")),128,"'gentee'")||(bDetected=1):(PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56")&&-1!=PE.compareOverlay("'OWS9G1'",11)||PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15"))&&(bDetected=1),result()}meta("installer","Gentee Installer")

================================================
FILE: dbs_min/db/PE/installer_Ghost_Installer.1.sg
================================================
function detect(){return PE.compareEP("60be........8dbe........c787................5783cd..eb")&&PE.compareOverlay("c0dececb8d8d8d8d")&&(sOptions="xored MSCF, mask: 8D",sVersion="1.0.0.0",bDetected=1),result()}meta("installer","Ghost Installer")

================================================
FILE: dbs_min/db/PE/installer_Gremlin_Patcher.1.sg
================================================
function detect(){if(PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15"))for(var e=0;e<PE.resource.length;e++)if(9942==PE.resource[e].Type&&PE.findSignature(PE.resource[e].Offset,256,"'SZDD'")){sOptions="SZDD",bDetected=1
break}return result()}meta("installer","Gremlin Software Patcher/Updater")

================================================
FILE: dbs_min/db/PE/installer_I-D_Media_installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")&&PE.compareOverlay("'XXataDfOnigeB'")&&(sVersion="1.0.0.13",bDetected=1),result()}meta("installer","I-D Media installer")

================================================
FILE: dbs_min/db/PE/installer_IDM_Installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")&&PE.compareOverlay("2a330000da050000fec1cd666ebccf01fec1cd666ebccf0100..............78da")&&(sOptions="zlib",bDetected=1),result()}meta("installer","Internet Download Manager Installer")

================================================
FILE: dbs_min/db/PE/installer_INTENIUM.1.sg
================================================
function detect(){return PE.compareOverlay("'stgc_hdr'")&&(sVersion=PE.getFileVersion(),bDetected=1),result()}meta("installer","INTENIUM")

================================================
FILE: dbs_min/db/PE/installer_Inno_Setup_Module.1.sg
================================================
function getVersionAndOptions(e){e=PE.getString(e)
sVersion=e.substring(0,e.indexOf(")")),/\(u\)/.test(e)?sOptions=sOptions.append("unicode"):/\(a\)/.test(e)&&(sOptions=sOptions.append("ANSI"))}function getVersion(e){if(PE.section[e]){var t=PE.section[e].FileOffset,e=PE.section[e].FileSize
if(e<16384){var n=PE.findString(t,e,"Inno Setup Setup Data")
if(-1!=n)return getVersionAndOptions(n+23),!0
if(-1!=(n=PE.findSignature(t,e,"'i1.'............'32'1A")))return sVersion=PE.getString(n+1).replace(/-.*/,""),!0}}return!1}function detect(){var e
return PE.compareOverlay("'zlb'1A")||PE.compareOverlay("'idska32'1A")?(getVersion("DATA")||getVersion(".data"),bDetected=1):"InUn"==PE.getString(48,4)&&(sOptions="uninstall",-1!=(e=PE.findString(PE.getOverlayOffset(),Math.min(256,PE.getOverlaySize()),"Inno Setup Messages"))&&(getVersionAndOptions(e+21),bDetected=1),bDetected||-1!=(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Inno Setup version"))&&(getVersionAndOptions(e+19),bDetected=1),bDetected||(getVersion("DATA")||getVersion(".data"))&&(bDetected=1)),bDetected||(PE.compareOverlay("'Inno Setup Messages'")?(sOptions="uninstall",getVersionAndOptions(PE.getOverlayOffset()+21),bDetected=1):PE.compareOverlay("'Inno Setup Setup Data'")&&(getVersionAndOptions(PE.getOverlayOffset()+23),bDetected=1)),PE.compareOverlay("78da")?(sOptions="zlib",(PE.compareEP("558bec83c4..53565733c08945..8945")||PE.compareEP("558bec83c4..e8........e8........e8"))&&(bDetected=1)):PE.compareOverlay("'Inno'",52)&&(sOptions="with stub",bDetected=1),bDetected||PE.isNet()&&"This installation was built with Inno Setup."==PE.getVersionStringInfo("Comments")&&(bDetected=1),result()}meta("installer","Inno Setup Module")

================================================
FILE: dbs_min/db/PE/installer_Instalit.1.sg
================================================
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))for(var e=0;e<PE.resource.length&&!bDetected;e++)854==PE.resource[e].Type||808==PE.resource[e].Type||884==PE.resource[e].Type?(sVersion="7.10.11, x32",bDetected=1):686!=PE.resource[e].Type&&640!=PE.resource[e].Type||(sVersion="6.59.09, x32",bDetected=1)
return result()}meta("installer","Instalit")

================================================
FILE: dbs_min/db/PE/installer_Install4j_installer.1.sg
================================================
function detect(){return PE.compareOverlay("d513e4e801000000")&&(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774")||PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774"))&&(bDetected=1),result()}meta("installer","Install4j Installer")

================================================
FILE: dbs_min/db/PE/installer_InstallAnywhere.1.sg
================================================
function detect(){return PE.compareEP("60BE........8DBE0070FDFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB7507")?(sVersion="6.1",bDetected=1):PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15........8b4e..890d")||PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b..........488365....48bb................483bc375")?PE.compareOverlay("5b3e")&&-1!=PE.findSignature(PE.getOverlayOffset(),1280,"'PK'0304")&&(sOptions="zip",bDetected=1):PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")&&PE.compareOverlay("5b3e")&&-1!=PE.findSignature(PE.getOverlayOffset(),1280,"'PK'0304")&&(sOptions="zip",bDetected=1),result()}meta("installer","InstallAnywhere")

================================================
FILE: dbs_min/db/PE/installer_InstallShield.1.sg
================================================
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")){if(PE.isOverlayPresent())nOffset=PE.readByte(PE.getOverlayOffset())+PE.getOverlayOffset()+12,PE.compare("135d658c",nOffset)?(sVersion="3.X",bDetected=1):PE.compare("'PK'0304",nOffset)&&(sVersion="3.X",sOptions="zip",bDetected=1)
else for(var e=0;e<PE.resource.length;e++)if(3e3==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){sVersion="2.X",bDetected=1
break}PE.isSectionNamePresent("_cabinet")&&(bDetected=1)}else PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")?-1!==PE.findSignature(PE.getOverlayOffset(),256,"'InstallShield Native Installer'")?(sName+=" Java Edition",bDetected=1):-1!==PE.findSignature(PE.getOverlayOffset(),256,"'setup.class'")&&(sName+=" Java Edition",sVersion="3.X",bDetected=1):PE.compareEP("558BEC83EC4456FF15........8BF085F675086AFFFF15........8A06578B3D")?bDetected=1:PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d2")?-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(8192,PE.getOverlaySize()),"'ISc('")&&(sVersion="19.X",bDetected=1):PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7")?-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(8192,PE.getOverlaySize()),"'ISSetupStream'")&&(sVersion="18.X",bDetected=1):PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc7")?-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(65536,PE.getOverlaySize()),"'ISc('")&&(sVersion="25.X",bDetected=1):PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")?PE.compareOverlay("'ISSetupStream'")&&(sVersion="29.X",bDetected=1):PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")&&PE.compareOverlay("'ISSetupStream'")&&(sVersion="19.X",bDetected=1)
return"InstallShield"!=PE.getVersionStringInfo("ProductName").substr(0,13)&&"InstallShield Software Corporation"!=PE.getVersionStringInfo("CompanyName")||(sVersion=PE.getVersionStringInfo("FileVersion").replace(/, /g,".").trim(),bDetected=1),bDetected||/InstallShield/.test(PE.getManifest())&&(bDetected=1),result()}meta("installer","InstallShield")

================================================
FILE: dbs_min/db/PE/installer_InstallUs.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8........a1........8b00ba........e8........8b0d........a1........8b008b15")&&-1!==PE.findSignature(PE.getOverlayOffset(),4096,"'SPIS'1a'LZH'")&&(sOptions="SPIS LZH",bDetected=1),result()}meta("installer","InstallUs")

================================================
FILE: dbs_min/db/PE/installer_Install_Factory.1.sg
================================================
function detect(){return PE.compareOverlay("a7870800")&&PE.compareEP("5589e55383ec..55b8........505068........64ff35........648925........83ec..83e4..68")&&(bDetected=1),result()}meta("installer","Install Factory")

================================================
FILE: dbs_min/db/PE/installer_LucasArts_Update_Installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("'1CNT'")&&(bDetected=1),result()}meta("installer","LucasArts Update Installer")

================================================
FILE: dbs_min/db/PE/installer_Miktex_Installer.1.sg
================================================
function detect(){return PE.compareEP("e9$$$$$$$$4883ec..e8$$$$$$$$e9$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..488365")&&PE.compareOverlay("'TARTARTARTARTART'")&&(sOptions="tar",bDetected=1),result()}meta("installer","MiKTeX Installer")

================================================
FILE: dbs_min/db/PE/installer_Mioplanet_installer.1.sg
================================================
function detect(){return PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8")&&PE.compareOverlay("'[(*|*)]MZ'")&&(bDetected=1),result()}meta("installer","Mioplanet installer")

================================================
FILE: dbs_min/db/PE/installer_Morton_installer.1.sg
================================================
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))for(var e=0;e<PE.resource.length;e++)if(856==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){sOptions="SZDD",bDetected=1
break}return result()}meta("installer","Morton Software Installer")

================================================
FILE: dbs_min/db/PE/installer_Multimedia_Fusion_Installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965")&&PE.compareOverlay("'wwwwI'874712")&&(bDetected=1),result()}meta("installer","Multimedia Fusion Installer")

================================================
FILE: dbs_min/db/PE/installer_Myriad_Install.1.sg
================================================
function detect(){return PE.compareEP("5589e5535683ec..55b8........505068........64ff35........648925........68........e8")&&-1!=PE.findSignature(PE.getOverlayOffset(),256,"01006215")&&(bDetected=1),result()}meta("installer","Myriad Install")

================================================
FILE: dbs_min/db/PE/installer_NOS_Installer.1.sg
================================================
function detect(){return PE.compareEP("50e8000000005b81eb........b9........2bd98bf381eb........8bfb81eb........575156e8........83c4..8bab........8d2c2b4d8a4d..80f9..74..83ed..8bd32b53")&&(PE.compareOverlay("'PK??NOS_PO'")||PE.compareOverlay("'NOS_PO'"))&&(bDetected=1),PE.compareEP("e8$$$$$$$$58bb........8bb3........8d0433488a0880f9..74..83e8..8b108bb3........03f38dbb........578bca2bce5156")&&(bDetected=1),result()}meta("installer","NOS Installer")

================================================
FILE: dbs_min/db/PE/installer_Nullsoft_Scriptable_Install_System.1.sg
================================================
function detect(){if(!PE.isNet()){var e=PE.getOverlayOffset(),e=(PE.compareOverlay("EFBEADDE'Null'..'oftInst'",4)||PE.compareOverlay("EFBEADDE'nsisinstall'")||PE.isOverlayPresent()&&((e+=PE.readDword(e))+4>=PE.getSize()||!PE.compare("EFBEADDE'Null' %% 'oftInst'",e+4))&&(e=0),e&&PE.isOverlayPresent()&&(e+=28,sOptions=PE.compare("5D0000..00",e)?sOptions.append("lzma","solid"):PE.compare("5D0000....00",e+4)?sOptions.append("lzma"):PE.compare("8",e+3)?sOptions.append(s(e+4)):sOptions.append(s(e),"solid"),bDetected=1),PE.getManifest().match(/Null[sS]oft Install System v?(.*?)</))
if(e)sVersion=e[1],bDetected=1
else if(PE.compareEP("558BEC83EC2C535633F657568975DC8975F4BBA49E4000FF1560704000BFC0B24000"))sVersion="1.XX",bDetected=1
else if(PE.compareEP("558BEC81EC....000056576A..BE........598DBD"))sVersion="1.3X",bDetected=1
else if(PE.compareEP("83EC5C53555657FF15"))sVersion="1.X",bDetected=1
else if(PE.compareEP("83EC0C535657FF15....40000")){switch(PE.readWord(PE.getEntryPointOffset()+8)){case 33068:sVersion="1.98"
break
case 4276:sVersion="2.0a0"
break
default:sVersion="1.XX"}bDetected=1}else if(PE.compareEP("83EC0C53555657FF15..7040008B35..92400005E803000089442414B320FF152C704000"))sVersion="2.0b2/2.0b3",bDetected=1
else if(PE.compareEP("83EC14836424040053555657C644241320FF1530704000BE00207A00"))sVersion="2.0b4",bDetected=1
else if(PE.compareEP("83EC1053555657C7442414....400033EDC644241320FF152C704000")){switch(PE.readWord(PE.getEntryPointOffset()+11)){case 37360:sVersion="2.0b4"
break
case 37488:sVersion="2.0 RC2"}bDetected=1}else PE.compareEP("83EC0C53555657C7442410........33DBC644241420FF15........53FF15")?(sVersion="2.0",bDetected=1):PE.compareEP("83EC2053555633DB57895C2418C7442410........C644241420FF15")?(sVersion="2.06",bDetected=1):PE.compareEP("558bec83ec..535633f657568975..8975..bb........ff15........bf........68........5750a3........ff15")&&(sVersion="0.98",bDetected=1)
return result()}function s(e){return 49==PE.readByte(e)&&PE.readByte(e+1)<14?"bzip2":"zlib"}}meta("installer","Nullsoft Scriptable Install System")

================================================
FILE: dbs_min/db/PE/installer_O'Setup95.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("'FILE'")&&(sOptions="Celtech Software",bDetected=1),result()}meta("installer","O'Setup95")

================================================
FILE: dbs_min/db/PE/installer_PCInstall.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("'[20/20]'")&&(bDetected=1),result()}meta("installer","PCInstall")

================================================
FILE: dbs_min/db/PE/installer_PIMP.1.sg
================================================
function detect(){return PE.compareEP("558bec81ec........56576a..be........598dbd........f3a56a..33c0598dbd........f3ab8d85........68........33f65056ff")&&PE.compareOverlay("'PIMPFILE'00")&&(bDetected=1),result()}meta("installer","PIMP Installer")

================================================
FILE: dbs_min/db/PE/installer_PackageForTheWeb.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")&&PE.compareOverlay("....0000dcedbd")&&(sOptions="InstallShield",bDetected=1),result()}meta("installer","PackageForTheWeb")

================================================
FILE: dbs_min/db/PE/installer_Pantaray_QSetup.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3")&&(PE.compareOverlay("970300000201")?(sVersion="10.0.0.X",bDetected=1):PE.compareOverlay("370700000201")&&(sVersion="11.0.0.X",bDetected=1),-1!==PE.findSignature(PE.getOverlayOffset(),1024,"'|http:'")&&(sVersion="6.0.0.0",bDetected=1),-1!==PE.findSignature(PE.getOverlayOffset(),1024,"'|www.'"))&&(sVersion="8.0.0.0",bDetected=1),result()}meta("installer","Pantaray QSetup")

================================================
FILE: dbs_min/db/PE/installer_Paquet_Builder.1.sg
================================================
function detect(){return PE.compareEP("5589e56a..68........68........64ff35........648925........83ec..83ec..5356578965..68")&&PE.compareOverlay("'PB'................................'7z'")&&(sOptions="7zip",bDetected=1),result()}meta("installer","Paquet Builder")

================================================
FILE: dbs_min/db/PE/installer_Quick_Install.1.sg
================================================
function detect(){return PE.compareEP("558bec68........64ff35........648925........83ec0457e8$$$$$$$$dbe3c3")&&PE.isSectionNamePresent("txt0")&&(sOptions="by Snow Storm Software",bDetected=1),result()}meta("installer","Quick Install")

================================================
FILE: dbs_min/db/PE/installer_RNsetup.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")&&0<PE.getNumberOfResources()&&(PE.resource[0].Name="Archive",PE.compare("'.rzt'",PE.getResourceOffsetByNumber(0)))&&(sVersion="6.0",bDetected=1),result()}meta("installer","RNsetup")

================================================
FILE: dbs_min/db/PE/installer_SCE_installer.1.sg
================================================
function detect(){if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))for(var e=0;e<PE.resource.length;e++)if(PE.compare("789c",PE.resource[e].Offset)){sOptions="zlib",bDetected=1
break}return result()}meta("installer","Silver Creek Entertainment")

================================================
FILE: dbs_min/db/PE/installer_STATICSUP.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("67155234ff4d3642")&&(bDetected=1),result()}meta("installer","STATICSUP")

================================================
FILE: dbs_min/db/PE/installer_Setup-Specialist.1.sg
================================================
function detect(){return PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15")&&PE.compareOverlay("'TGCF'")&&(sVersion="4.0.X",bDetected=1),result()}meta("installer","Setup-Specialist")

================================================
FILE: dbs_min/db/PE/installer_Setup_Factory.1.sg
================================================
function detect(){return PE.compareEP("558BEC6AFF68..61400068..43400064A1000000005064892500000000")?(sVersion=PE.compareEP("90614000",6)?"6.0.0.3":"6.X",bDetected=1):PE.compareOverlay("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7")?PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0a3........eb")?(sVersion="8.0",bDetected=1):PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb")?(sVersion="9.0",bDetected=1):PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0488905........eb")&&(sVersion="9.5",bDetected=1):PE.compareOverlay("e0e1e2e3e4e5e6")&&(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")?(sVersion="5.0",bDetected=1):PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&(sVersion="4.02",bDetected=1)),bDetected&&0<=PE.getVersionStringInfo("Comments").indexOf("Trial")&&(sOptions="Trial"),result()}meta("installer","Setup Factory")

================================================
FILE: dbs_min/db/PE/installer_SfxCA.1.sg
================================================
function detect(){return PE.compareOverlay("'MSCF'00000000")&&(PE.compareEP("48895c24..48897424..574883ec..498bf88bda488bf183fa..75..e8........4c8bc7")?(sVersion="3.8, by Outercurve Foundation",bDetected=1):PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")&&(sVersion="3.10, by Outercurve Foundation",bDetected=1)),result()}meta("installer","Sfx Custom Action")

================================================
FILE: dbs_min/db/PE/installer_Smart_Install_Maker.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3")&&(PE.compareOverlay("'Smart Install Maker v'")?(sVersion=PE.getString(PE.getOverlayOffset()+23),bDetected=1):PE.compareOverlay("..........87000001........5d0000800000")&&(bDetected=1)),result()}meta("installer","Smart Install Maker")

================================================
FILE: dbs_min/db/PE/installer_Sony_Windows_Installer.1.sg
================================================
function detect(){return PE.compareOverlay("'UM'030a00")&&(PE.compareEP("4883ec..e8$$$$$$$$48895c....574883ec..488b..........48836424....48bf................483bc774")||PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774"))&&(bDetected=1),result()}meta("installer","Sony Windows Installer")

================================================
FILE: dbs_min/db/PE/installer_Spoon_Installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&(PE.compareOverlay("'BZh91AY&SY'")?(sOptions="BZIP2",bDetected=1):PE.compareOverlay("']'00008000")&&(sOptions="Lzma",bDetected=1),4244334==PE.getAddressOfEntryPoint())&&(sVersion="11 2005"),result()}meta("installer","Spoon Installer")

================================================
FILE: dbs_min/db/PE/installer_Squirrel.1.sg
================================================
function detect(){var e=PE.getVersionStringInfo("SquirrelAwareVersion")
return e&&("1"==(sVersion=e)&&(sVersion="1.0.0-1.9.1"),bDetected=1),result()}meta("installer","Squirrel")

================================================
FILE: dbs_min/db/PE/installer_SwiftView_installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")&&PE.compareOverlay("'This is the end of the executable'")&&(sVersion="6.1",bDetected=1),result()}meta("installer","SwiftView Inc. installer")

================================================
FILE: dbs_min/db/PE/installer_Synactis_In-The-Box_Installer.1.sg
================================================
function detect(){return 694448==PE.getAddressOfEntryPoint()?PE.compareEP("558bEC83C4F0B8")&&PE.compareOverlay("'['")&&(sVersion="4.0",sOptions="zip sfx",bDetected=1):PE.compareEP("'All In-The-Box Installer'",96)&&(sOptions="zip sfx",bDetected=1),result()}meta("installer","Synactis In-The-Box Installer")

================================================
FILE: dbs_min/db/PE/installer_Tarma_Installer.1.sg
================================================
function detect(){return PE.compareOverlay("'tiz1'........78da")&&(sOptions="zlib",PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..e8")||PE.compareEP("60be........8dbe........5783cd..eb"))&&(bDetected=1),PE.isSectionNamePresent(".tsustub")&&PE.isSectionNamePresent(".tsuarch")&&(PE.compareEP("558bec81ec........535633db5766899d........895d..895d..ff15")?(sName="Tarma InstallMate",sVersion="9.0",bDetected=1):PE.compareEP("48895c24..48896c24..48897424..574881ec........66836424....33f633ffff15........488d8c24........8bd8ff15")&&(sName="Tarma InstallMate",sVersion="9.0",sOptions="x64",bDetected=1)),result()}meta("installer","Tarma Installer")

================================================
FILE: dbs_min/db/PE/installer_Themepak.1.sg
================================================
function detect(){return PE.compareEP("558bec81ec........535657c745..........ff75..64ff35........648925........8d45")&&(bDetected=1),result()}meta("installer","THEMEPAK")

================================================
FILE: dbs_min/db/PE/installer_UFI_installer.1.sg
================================================
function detect(){return PE.compareEP("558BEC")&&PE.resource.BINFILE&&PE.resource.BINFILE_2&&(sVersion="1.X, Flash",bDetected=1),result()}meta("installer","UFI installer")

================================================
FILE: dbs_min/db/PE/installer_VMWare.1.sg
================================================
function detect(){var e
return PE.compareOverlay("'RWMV'")&&(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")||PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")||PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0")||PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))&&(sName+=" Installation Launcher",bDetected=1),PE.isOverlayPresent()&&PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")&&(e=Math.min(PE.getOverlaySize(),256),-1!=PE.findString(PE.getOverlayOffset(),e,"BZh91AY&")?(sName+=" Software Installer",sOptions="bzip2",bDetected=1):-1!=PE.findSignature(PE.getOverlayOffset(),e,"d0cf11e0a1b11ae1")&&(sName+=" Software Installer",sOptions="MS Compound",bDetected=1)),bDetected&&(sVersion=PE.getFileVersion()),result()}meta("installer","VMWare")

================================================
FILE: dbs_min/db/PE/installer_Vise.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&(PE.compareOverlay("'ESIV'")||PE.compare("'SIVM'",61440))&&(bDetected=1),result()}meta("installer","Vise")

================================================
FILE: dbs_min/db/PE/installer_WiX_Toolset_installer.1.sg
================================================
function detect(){return PE.compareOverlay("'MSCF'00000000")&&(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")||PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc774..85c674..f7")||PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7")?bDetected=1:PE.isSectionNamePresent(".wixburn")&&(sVersion="1.0",bDetected=1)),result()}meta("installer","WiX Toolset Installer")

================================================
FILE: dbs_min/db/PE/installer_WinRAR_Installer.1.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$558bec83c4..b8........53")?PE.compareOverlay("'***messages***'")&&(bDetected=1):PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f")?PE.compareOverlay("'Rar!'1a")&&(bDetected=1):PE.compareEP("e8$$$$$$$$558bec83ec..68........68........e8........59598945..837d")&&PE.compareOverlay("'PK'0304")&&(bDetected=1),PE.compareOverlay("fffe2a002a002a006d0065007300730061006700650073002a002a002a00")&&(sOptions="Unicode",PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488365....48bb................488b05........483bc375")||PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))&&(sVersion="5.X",bDetected=1),result()}meta("installer","WinRAR Installer")

================================================
FILE: dbs_min/db/PE/installer_Winamp_Installer.1.sg
================================================
function detect(){return PE.compareEP("81ec........a1........8b0d........8b15........53894424..a1........894c24..8a0d........555657894424..884c24..b9")&&(sVersion="1.0",sOptions="1997-98 by Nullsoft, Inc.",bDetected=1),result()}meta("installer","Winamp Installer")

================================================
FILE: dbs_min/db/PE/installer_Windows_Installer.1.sg
================================================
function detect(){for(var e,r=0;r<PE.resource.length;r++)PE.compare("D0CF11E0A1B11AE1",PE.resource[r].Offset)&&-1!=(e=PE.findString(PE.resource[r].Offset,PE.resource[r].Size,"Windows Installer"))&&((e=PE.getString(e).match(/ XML \((.*?)\)/))&&(sOptions="XML",sVersion=e[1]),bDetected=1)
return result()}meta("installer","Windows Installer")

================================================
FILE: dbs_min/db/PE/installer_Wise_Installer.1.sg
================================================
function detect(){var e
return 80<PE.getOverlaySize()?(e=PE.getOverlayOffset()+77,(PE.readDword(e)==PE.getSize()||PE.isSectionNamePresent(".WISE")||PE.compareEP("558bec81ec........5356576a..ff15........ff15........8bf08975..8a063c..0f85........8a46..46")||PE.compareEP("558bec81ec........5356576a..5e6a..8975..ff15........ff15........8bf8897d..8a073c..0f85........8a47..47"))&&(bDetected=1)):PE.compareEP("81ec........535556576a..ff15........33db895c24..895c24..895c24..895c24..895c24..ff15........8a08894424")&&PE.isSectionNamePresent(".WISE")&&(sOptions="CAB",bDetected=1),PE.compareEP("558bec81ec........53565733f6466a..8975..ff15........ff15........8bf88a07")&&-1!=PE.findSignature(PE.getOverlayOffset(),4096,"'Wise Installation Wizard...'")&&(bDetected=1),PE.isSectionNamePresent(".WISE")&&-1!=PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".WISE")),4096,"'Wise Installation Wizard...'")&&(bDetected=1),PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&(-1!=PE.findSignature(PE.getOverlayOffset(),4096,"504b0304")?(sOptions="ZIP",bDetected=1):PE.compareOverlay("'MSCF'0000")&&(sOptions="CAB",bDetected=1)),PE.compareEP("558bec81ec........538d85........5633db57be........565053ff15........568d85........5050ff15........538d8d........536a..536a..68........51ff15")&&(bDetected=1),PE.compareEP("558bec81ec........538d85........565733f6")&&(bDetected=1),PE.compareEP("558bec81ec........5356be........578d85........5633db5053")&&PE.compare("'GLB'00",PE.getSectionFileOffset(PE.getSectionNumber(".data"))+16)&&(bDetected=1),result()}meta("installer","Wise Installer")

================================================
FILE: dbs_min/db/PE/installer_Xoreax_installer.1.sg
================================================
function detect(){if(PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c055"))for(var e=0;e<PE.getNumberOfResources();e++)if("RT_RCDATA"==PE.resource[e].Type&&PE.compare("5d0000",PE.resource[e].Offset)){bDetected=1
break}return result()}meta("installer","Xoreax Installer")

================================================
FILE: dbs_min/db/PE/installer_distutils.1.sg
================================================
function detect(){return PE.compareOverlay("'[metadata]'")&&(PE.compareEP("e8........e9$$$$$$$$6a5868........e8........33f68975..8d45..50ff15........6a..5f897d..b8........663905........75")?(sVersion="2.6",bDetected=1):PE.compareEP("6a..68........e8........33db895d..538b3d........ffd766........75..8b48..03c88139........75..0fb7")&&(sVersion="2.5",bDetected=1)),result()}meta("installer","distutils")

================================================
FILE: dbs_min/db/PE/installer_sqx.1.sg
================================================
function detect(){var e=PE.section[".data"]
return PE.compareEP("558bec83ec44")&&e&&1!=PE.findString(e.FileOffset,e.FileSize,"SFX kann nicht gestartet werden")&&(bDetected=1),result()}meta("installer","SQX Archive Installer 2002")

================================================
FILE: dbs_min/db/PE/joiner_Celesty_File_Binder.1.sg
================================================
function detect(){return PE.compareEP("E8261F0000E989FEFFFF8BFF558BEC83EC208B450856576A0859BE0C9240008D7DE0F3A58945F88B450C5F8945FC5E85C074")?(sVersion="1.0",sOptions="static",bDetected=1):PE.compareEP("E896040000E963FDFFFF8BFF558BEC81EC28030000A3E8514000890DE45140008915E0514000891DDC5140008935D8514000893DD4514000668C1500")&&(sVersion="1.0",sOptions="dynamic",bDetected=1),sLang="C++",result()}meta("joiner","Celesty File Binder")

================================================
FILE: dbs_min/db/PE/joiner_ExeSplitter.1.sg
================================================
function detect(){return PE.compareEP("E99502000064A1000000008338FF74048B00EBF78B4004C3558BECB8000000008B750881E60000FFFF")?(sVersion="1.2",bDetected=1):PE.compareEP("E8000000005D81ED........E866FEFFFF55508D9D........538D9D")||PE.compareEP("E9FE010000..............000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073766345723031312E746D7000")?(sVersion="1.3",sOptions="Split Method",bDetected=1):PE.compareEP("E8000000005D81ED........B9........8D85........80306640E2FA8F98676666")&&(sVersion="1.3",sOptions="Split+Crypt Method",bDetected=1),result()}meta("joiner","ExeSplitter")

================================================
FILE: dbs_min/db/PE/joiner_FreeJoiner.1.sg
================================================
function detect(){return PE.compareEP("9087FF9090B92B000000BA........83C2039087FF9090B9040000009087FF9033C9C705")?(sVersion="1.5.1",bDetected=1):PE.compareEP("E846FDFFFF50E80C000000FF25........FF25........FF25........FF25........FF25")?(sVersion="1.5.2 Stub engine 1.6",bDetected=1):PE.compareEP("E833FDFFFF50E80D000000CCFF25........FF25........FF25........FF25........FF25")?(sVersion="1.5.3 Stub engine 1.7",bDetected=1):PE.compareEP("86D69086F2B9936008FE9086D69086F2B99D13450186D69086F281C2936008FE33C9B930744D")?(sVersion="1.5.3 Stub engine 1.7.1",bDetected=1):PE.compareEP("558BEC83C4F086FF680001000068........6A00E8F30100008AC06A0068800000006A036A00")?(sVersion="Small build 014/015",bDetected=1):PE.compareEP("E8....FFFF6A00E80D000000CCFF25........FF25........FF25........FF25........FF25")?(sVersion="Small build 014-020",bDetected=1):PE.compareEP("558BEC83C4F086FF86DB86FF680001000068........6A00E8FF0100008AE46A0068800000006A03")?(sVersion="Small build 017",bDetected=1):PE.compareEP("E8E1FDFFFF6A00E80C000000FF25........FF25........FF25........FF25........FF25")?(sVersion="Small build 023",bDetected=1):PE.compareEP("5032C48AC358E8DEFDFFFF6A00E80D000000CCFF25........FF25........FF25........FF25")?(sVersion="Small build 029",bDetected=1):PE.compareEP("5032..668BC358E8..FDFFFF6A00E80D000000CCFF25........FF25........FF25........FF25")?(sVersion="Small build 031/032",bDetected=1):PE.compareEP("506633C3668BC158E8ACFDFFFF6A00E80D000000CCFF25........FF25........FF25........FF25")?(sVersion="Small build 033",bDetected=1):PE.compareEP("5133CB86C959E89EFDFFFF6687DB6A00E80C000000FF25........FF25........FF25........FF25")&&(sVersion="Small build 035",bDetected=1),result()}meta("joiner","FreeJoiner")

================================================
FILE: dbs_min/db/PE/joiner_MicroJoiner.1.sg
================================================
function detect(){return PE.compareEP("BE........BB........33ED83EE04392E7411")?(sVersion="1.1",bDetected=1):PE.compareEP("BF........83EC308BECE8C8FFFFFFE8C3FFFFFF")?(sVersion="1.5",bDetected=1):PE.compareEP("33C0648B38488BC8F2AFAF8B1F6633DB66813B")?(sVersion="1.6",bDetected=1):PE.compareEP("BF........8D5F216A0A586A04596057E88E000000")&&(sVersion="1.7",bDetected=1),result()}meta("joiner","MicroJoiner")

================================================
FILE: dbs_min/db/PE/joiner_N-Joiner.1.sg
================================================
function detect(){return PE.compareEP("6A0068........68........6A00E8140000006A00E813000000CCFF25........FF25........FF25........FF25")&&(sVersion="0.1",bDetected=1),result()}meta("joiner","N-Joiner")

================================================
FILE: dbs_min/db/PE/joiner_OxiJoiner.2.sg
================================================
function detect(){var e=PE.section[".rsrc"]
return PE.compareEP("e85c000000a30b3040006a00e868000000a313304000e86a000000a3703c40006a0aff350b3040006a00ff3513304000e8eaf4ffff6a00e813000000ccff257c204000ff2508204000ff250c204000ff")&&e&&-1!==PE.findString(e.FileOffset,e.FileSize,"PAPADDING")&&(bDetected=1),result()}meta("joiner","OxiJoiner")

================================================
FILE: dbs_min/db/PE/joiner_RJoiner.1.sg
================================================
function detect(){return PE.compareEP("558BEC81EC0C0200008D85F4FDFFFF56506804010000FF15")?(sVersion="1.2",bDetected=1):PE.compareEP("558BEC81EC0C0100008D85F4FEFFFF56506804010000FF15")?(sVersion="1.2a",bDetected=1):PE.compareEP("E803FDFFFF6A00E80C000000FF25........FF25........FF25")&&(bDetected=1),result()}meta("joiner","RJoiner")

================================================
FILE: dbs_min/db/PE/joiner_SFXRun.1.sg
================================================
function detect(){return PE.compareEP("ff15........8038..75..8a48..4080f9..74..84c975..eb..408a0880f9..74..80f9..74")&&(sVersion="1.1",sOptions="1999 by Sergey Sorokin",bDetected=1),result()}meta("joiner","SFXRun")

================================================
FILE: dbs_min/db/PE/joiner_inPEct.1.sg
================================================
function detect(){return PE.compareEP("E8000000005D5583C5208BF58BFEB9......00BA........AD8BD833C2C1C20703D3ABE2F3")&&(sVersion="1.1",bDetected=1),result()}meta("joiner","inPEct")

================================================
FILE: dbs_min/db/PE/library_16Edit.4.sg
================================================
function detect(){return PE.isLibraryPresent("16Edit.dll")&&(bDetected=1),result()}meta("library","16Edit")

================================================
FILE: dbs_min/db/PE/library_7z.4.sg
================================================
function detect(){return(PE.isLibraryPresentExp(/^7z/)||PE.isLibraryPresentExp(/lib7z/i))&&(bDetected=1),result()}meta("library","7-Zip")

================================================
FILE: dbs_min/db/PE/library_AMD_FSR.4.sg
================================================
function detect(){return PE.is64()&&(PE.isLibraryPresentExp(/^ffx_fsr2/i)?sVersion="2.X":PE.isExportFunctionPresent("ffxFsr2ContextCreate")?(sOptions="static",sVersion="2.X"):PE.isLibraryPresentExp(/^ffx_fsr3/i)?sVersion="3.X":PE.isExportFunctionPresent("ffxFsr3UpscalerContextCreate")?(sOptions="static",sVersion="3.X"):PE.isLibraryPresentExp(/^ffx_fsr/i)||PE.isLibraryPresentExp(/fidelityfx/i)?bDetected=1:PE.isExportFunctionPresentExp(/^ffxFsr/)&&(sOptions="static")),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),result()}meta("library","AMD FSR")

================================================
FILE: dbs_min/db/PE/library_AMD_GraphicalServices.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^amd_ags_x(86|64)/i)&&(bDetected=1),result()}meta("library","AMD Graphical Services")

================================================
FILE: dbs_min/db/PE/library_ASIPort.4.sg
================================================
function detect(){return PE.compareOverlay("35394a50")&&(sVersion="1.0",sOptions="Director Engine",bDetected=1),result()}meta("library","ASIPort")

================================================
FILE: dbs_min/db/PE/library_AjaxMin.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AjaxMin")&&(bDetected=1),result()}meta("library","AjaxMin")

================================================
FILE: dbs_min/db/PE/library_Alibaba_CloudSDK.4.sg
================================================
function detect(){return PE.isNetObjectPresent("aliyun-net-sdk-ram")&&(bDetected=1),result()}meta("library","Alibaba Cloud SDK")

================================================
FILE: dbs_min/db/PE/library_Amazon_CloudWatch.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.CloudWatch")&&(bDetected=1),result()}meta("library","Amazon CloudWatch")

================================================
FILE: dbs_min/db/PE/library_Amazon_CloudWatchLogs.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.CloudWatchLogs")&&(bDetected=1),result()}meta("library","Amazon CloudWatchLogs")

================================================
FILE: dbs_min/db/PE/library_Amazon_DynamoDB.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.DynamoDBv2")&&(sVersion="2, 3.X-4.X",bDetected=1),result()}meta("library","Amazon DynamoDB")

================================================
FILE: dbs_min/db/PE/library_Amazon_ElasticComputeCloudService.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.EC2")&&(bDetected=1),result()}meta("library","Amazon Elastic Compute Cloud Service")

================================================
FILE: dbs_min/db/PE/library_Amazon_Glue.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.Glue")&&(bDetected=1),result()}meta("library","Amazon Glue")

================================================
FILE: dbs_min/db/PE/library_Amazon_Kinesis.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.Kinesis")&&(bDetected=1),result()}meta("library","Amazon Kinesis")

================================================
FILE: dbs_min/db/PE/library_Amazon_Lambda.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.Lambda")&&(bDetected=1),result()}meta("library","Amazon Lambda")

================================================
FILE: dbs_min/db/PE/library_Amazon_RelationalDatabaseService.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.RDS")&&(bDetected=1),result()}meta("library","Amazon Relational Database Service")

================================================
FILE: dbs_min/db/PE/library_Amazon_SecretsManager.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.SecretsManager")&&(bDetected=1),result()}meta("library","Amazon SecretsManager")

================================================
FILE: dbs_min/db/PE/library_Amazon_SecurityToken.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.SecurityToken")&&(bDetected=1),result()}meta("library","Amazon Security Token Service")

================================================
FILE: dbs_min/db/PE/library_Amazon_ServicesSDK.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.Core")&&(bDetected=1),result()}meta("library","Amazon Services SDK")

================================================
FILE: dbs_min/db/PE/library_Amazon_SimpleEmail.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.SimpleEmail")&&(sVersion="2, 3.X-4.X",bDetected=1),result()}meta("library","Amazon SimpleEmail")

================================================
FILE: dbs_min/db/PE/library_Amazon_SimpleQueueService.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.SQS")&&(bDetected=1),result()}meta("library","Amazon Simple Queue Service")

================================================
FILE: dbs_min/db/PE/library_Amazon_SimpleStorageService.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.S3")&&(bDetected=1),result()}meta("library","Amazon Simple Storage Service")

================================================
FILE: dbs_min/db/PE/library_Amazon_SingleSignOn.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.SSO")&&(bDetected=1),result()}meta("library","Amazon Single Sign-On")

================================================
FILE: dbs_min/db/PE/library_Amazon_X-Ray.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AWSSDK.XRay")&&(bDetected=1),result()}meta("library","Amazon X-Ray")

================================================
FILE: dbs_min/db/PE/library_AngleSharp.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AngleSharp")&&(bDetected=1),result()}meta("library","AngleSharp")

================================================
FILE: dbs_min/db/PE/library_Antlr.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Antlr3.Runtime")?(sVersion="3.X",bDetected=1):PE.isNetObjectPresent("Antlr4.Runtime")&&(sVersion="4.X",bDetected=1),result()}meta("library","Antlr")

================================================
FILE: dbs_min/db/PE/library_AppleSoftwareUpdate.4.sg
================================================
function detect(){return PE.isLibraryPresent("SoftwareUpdateFiles.dll")&&(bDetected=1),result()}meta("library","Apple Software Update")

================================================
FILE: dbs_min/db/PE/library_Argon2.4.sg
================================================
function detect(){return PE.isFunctionPresent("argon2_hash")?bDetected=1:PE.isExportFunctionPresent("argon2_hash")&&(sOptions="static",bDetected=1),result()}meta("library","Argon2")

================================================
FILE: dbs_min/db/PE/library_AtMsg32.4.sg
================================================
function detect(){return PE.isLibraryPresent("AtMsg32.dll")&&(bDetected=1),result()}meta("library","AtMsg32")

================================================
FILE: dbs_min/db/PE/library_Atlantic.4.sg
================================================
function detect(){return PE.isLibraryPresent("Atlantic.dll")&&(bDetected=1),result()}meta("library","VEGAS Atlantic Component")

================================================
FILE: dbs_min/db/PE/library_Authorwave.4.sg
================================================
function detect(){return PE.compareOverlay("'PCRS'afbcadac16000000f8")&&(bDetected=1),result()}meta("library","Adobe Authorware")

================================================
FILE: dbs_min/db/PE/library_Autofac.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Autofac")&&(bDetected=1),result()}meta("library","Autofac IoC Container")

================================================
FILE: dbs_min/db/PE/library_BenchmarkDotNet.4.sg
================================================
function detect(){return PE.isNetObjectPresent("BenchmarkDotNet")&&(bDetected=1),result()}meta("library","BenchmarkDotNet")

================================================
FILE: dbs_min/db/PE/library_Boost.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/libboost/i)&&(bDetected=1),result()}meta("library","Boost")

================================================
FILE: dbs_min/db/PE/library_BrotliSharpLib.4.sg
================================================
function detect(){return PE.isNetObjectPresent("BrotliSharpLib")&&(bDetected=1),result()}meta("library","BrotliSharpLib")

================================================
FILE: dbs_min/db/PE/library_CUDA-Driver.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^nvcuda/i)&&(bDetected=1),result()}meta("library","CUDA Driver")

================================================
FILE: dbs_min/db/PE/library_Castle.Net.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Castle.Core")&&(bDetected=1),result()}meta("library","Castle")

================================================
FILE: dbs_min/db/PE/library_ChilkatNativeLib.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ChilkatNativeLib")&&(bDetected=1),result()}meta("library","ChilkatNativeLib")

================================================
FILE: dbs_min/db/PE/library_Chromium_Embedded_Framework.4.sg
================================================
function detect(){return PE.isLibraryPresent("libcef.dll")&&(bDetected=1),result()}meta("library","Chromium Framework")

================================================
FILE: dbs_min/db/PE/library_Chromium_WebView.4.sg
================================================
function detect(){return(PE.isLibraryPresent("chrome_elf.dll")||PE.isSectionNamePresent("CPADinfo"))&&(bDetected=1),result()}meta("library","Chromium WebView")

================================================
FILE: dbs_min/db/PE/library_CliWrap.4.sg
================================================
function detect(){return PE.isNetObjectPresent("CliWrap")&&(bDetected=1),result()}meta("library","CliWrap")

================================================
FILE: dbs_min/db/PE/library_ClosedXML.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ClosedXML")&&(bDetected=1),result()}meta("library","ClosedXML")

================================================
FILE: dbs_min/db/PE/library_CodeBase.4.sg
================================================
function detect(){return PE.isExportFunctionPresent("??4l4linkSt@@QAEAAU0@ABU0@@Z")&&(sVersion="4.0",sOptions="static",bDetected=1),result()}meta("library","CodeBase")

================================================
FILE: dbs_min/db/PE/library_CommandLineParser.4.sg
================================================
function detect(){return PE.isNetObjectPresent("CommandLine")&&PE.isNetObjectPresent("ParseArguments")&&(bDetected=1),result()}meta("library","CommandLineParser")

================================================
FILE: dbs_min/db/PE/library_Costura.Fody.4.sg
================================================
function detect(){return PE.isNetGlobalCctorPresent()&&(PE.isNetObjectPresent("costura.costura.dll.compressed")||PE.isNetUStringPresent("costura.costura.dll.compressed"))&&(bDetected=1),result()}meta("library","Costura.Fody")

================================================
FILE: dbs_min/db/PE/library_Crc32_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Crc32.NET")&&(bDetected=1),result()}meta("library","Crc32.NET")

================================================
FILE: dbs_min/db/PE/library_Crc_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Crc")&&(PE.isNetObjectPresent("CrcBase")||PE.isNetObjectPresent("Crc32Base"))&&PE.isNetObjectPresent("Crc32")&&PE.isNetObjectPresent("ComputeHash")&&(bDetected=1),result()}meta("library","Crc.NET")

================================================
FILE: dbs_min/db/PE/library_CsvHelper.4.sg
================================================
function detect(){return PE.isNetObjectPresent("CsvHelper")&&(bDetected=1),result()}meta("library","CsvHelper")

================================================
FILE: dbs_min/db/PE/library_D3DRM.4.sg
================================================
function detect(){return PE.isLibraryPresent("D3DRM.DLL")&&(bDetected=1),result()}meta("library","Direct3D Retained Mode")

================================================
FILE: dbs_min/db/PE/library_D3DXOF.4.sg
================================================
function detect(){return PE.isLibraryPresent("d3dxof.dll")&&(bDetected=1),result()}meta("library","D3DXOF")

================================================
FILE: dbs_min/db/PE/library_Dapper.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Dapper")&&(bDetected=1),result()}meta("library","Dapper")

================================================
FILE: dbs_min/db/PE/library_DeepCloner.4.sg
================================================
function detect(){return PE.isNetObjectPresent("DeepCloner")&&(bDetected=1),result()}meta("library","DeepCloner")

================================================
FILE: dbs_min/db/PE/library_Direct2D.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^d2d*/i)&&(bDetected=1),result()}meta("library","Direct2D")

================================================
FILE: dbs_min/db/PE/library_Direct3D.4.sg
================================================
function detect(){for(var e=0,t=/d3dx?(\d+)/i,r=0;r<PE.getNumberOfImports();r++)(m=PE.getImportLibraryName(r).match(t))&&/^\d+$/.test(m[1])&&Number(m[1])>e&&(e=Number(m[1]))
for(var m,r=0;r<PE.getNumberOfExportFunctions();r++)(m=PE.getExportFunctionName(r).match(t))&&/^\d+$/.test(m[1])&&Number(m[1])>e&&(e=Number(m[1]))
return 0<e?(sVersion=String(e),bDetected=1):PE.isLibraryPresentExp(/^d3d/i)&&(bDetected=1),result()}meta("library","Direct3D")

================================================
FILE: dbs_min/db/PE/library_DirectDraw.4.sg
================================================
function detect(){return PE.isLibraryPresent("DDRAW.DLL")&&(bDetected=1),result()}meta("library","DirectDraw")

================================================
FILE: dbs_min/db/PE/library_DirectInput.4.sg
================================================
function detect(){return PE.isLibraryPresent("DINPUT.DLL")&&(bDetected=1),result()}meta("library","DirectInput")

================================================
FILE: dbs_min/db/PE/library_DirectSound.4.sg
================================================
function detect(){return PE.isLibraryPresent("DSOUND.DLL")&&(bDetected=1),result()}meta("library","DirectSound")

================================================
FILE: dbs_min/db/PE/library_DirectX.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^dxgi/i)&&(bDetected=1),result()}meta("library","DirectX Graphics")

================================================
FILE: dbs_min/db/PE/library_DirectorAPI.4.sg
================================================
function detect(){return PE.compareOverlay("..304a50")&&(bDetected=1),result()}meta("library","Director API")

================================================
FILE: dbs_min/db/PE/library_Discord.Net.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Discord.Net.Core")&&(bDetected=1),result()}meta("library","Discord.Net")

================================================
FILE: dbs_min/db/PE/library_DnsClient.NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("DnsClient")&&(bDetected=1),result()}meta("library","DnsClient.NET")

================================================
FILE: dbs_min/db/PE/library_Dryloc.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Dryloc")&&(bDetected=1),result()}meta("library","Dryloc IoC Container")

================================================
FILE: dbs_min/db/PE/library_EAX_Unified.4.sg
================================================
function detect(){return PE.isLibraryPresent("EAX.dll")&&(bDetected=1),result()}meta("library","EAX Unified")

================================================
FILE: dbs_min/db/PE/library_EcmaScript_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("EcmaScript.NET")&&(bDetected=1),result()}meta("library","EcmaScript.NET")

================================================
FILE: dbs_min/db/PE/library_Edit_Dev.4.sg
================================================
function detect(){return PE.isLibraryPresent("edit_dev.dll")&&(sOptions="DEV6",sVersion="ADI4",bDetected=1),result()}meta("library","Edit_Dev")

================================================
FILE: dbs_min/db/PE/library_ElectronApp.4.sg
================================================
function detect(){var e=PE.section.CPADinfo
return e&&PE.isSectionNamePresent(".00cfg")&&(bDetected=PE.findString(e.FileOffset,e.FileSize,"daPC")),result()}meta("library","Electron package")

================================================
FILE: dbs_min/db/PE/library_EpicGames.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^EOSSDK/)&&(bDetected=1),result()}meta("library","Epic Games Services")

================================================
FILE: dbs_min/db/PE/library_ExcelDataReader.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ExcelDataReader")&&(bDetected=1),result()}meta("library","ExcelDataReader")

================================================
FILE: dbs_min/db/PE/library_ExcelNumberFormat.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ExcelNumberFormat")&&(bDetected=1),result()}meta("library","ExcelNumberFormat")

================================================
FILE: dbs_min/db/PE/library_ExifLibNet.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ExifLibrary")&&(bDetected=1),result()}meta("library","ExifLibrary")

================================================
FILE: dbs_min/db/PE/library_FAAD.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/libfaad/i)&&(bDetected=1),result()}meta("library","FAAD")

================================================
FILE: dbs_min/db/PE/library_FFmpeg.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/ffmpeg/i)&&(bDetected=1),result()}meta("library","FFmpeg")

================================================
FILE: dbs_min/db/PE/library_FastExpressionCompiler.4.sg
================================================
function detect(){return PE.isNetObjectPresent("FastExpressionCompiler")&&(bDetected=1),result()}meta("library","FastExpressionCompiler")

================================================
FILE: dbs_min/db/PE/library_FastMember.4.sg
================================================
function detect(){return PE.isNetObjectPresent("FastMember")&&(bDetected=1),result()}meta("library","FastMember")

================================================
FILE: dbs_min/db/PE/library_FastRsync_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("FastRsync")&&(bDetected=1),result()}meta("library","FastRsync.NET")

================================================
FILE: dbs_min/db/PE/library_Fastenshtein.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Fastenshtein")&&(bDetected=1),result()}meta("library","Fastenshtein")

================================================
FILE: dbs_min/db/PE/library_Fasterflect.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Fasterflect")&&(bDetected=1),result()}meta("library","Combres Optimizer")

================================================
FILE: dbs_min/db/PE/library_FlashPlayer.1.sg
================================================
function detect(){return PE.compareEP("83....56FF15........8BF08A063C..75..8A....463C..74..84C074..8A....463C..75..80....75..46EB..3C..7E..8A")?(sVersion=PE.getFileVersion(),bDetected=1):PE.compareEP("83....56FF15........8BF08A063C..75..8A....463C..74..84C075..3c..75..46eb..3c..76..8da4")?(sVersion="8.0",bDetected=1):PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..463c..74..84c074..8a46..463c..75..803e..75..46eb")&&(PE.compareOverlay("'CWS'")||PE.compareOverlay("'FWS'"))&&(sVersion="7.0",bDetected=1),result()}meta("library","Flash Player")

================================================
FILE: dbs_min/db/PE/library_FluentValidation.4.sg
================================================
function detect(){return PE.isNetObjectPresent("FluentValidation")&&(bDetected=1),result()}meta("library","FluentValidation")

================================================
FILE: dbs_min/db/PE/library_Fox_Pro.4.sg
================================================
function detect(){for(var t=0;t<=PE.nLastSection;t++){var e=PE.findString(PE.section[t].FileOffset,512,"VisualFoxProRuntime.");-1!=e&&(sVersion=PE.getString(e+20)+".0",bDetected=1)}return result()}meta("library","FOXPRO")

================================================
FILE: dbs_min/db/PE/library_FusionCache.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ZiggyCreatures.FusionCache")&&(bDetected=1),result()}meta("library","FusionCache")

================================================
FILE: dbs_min/db/PE/library_FuzzySharp.4.sg
================================================
function detect(){return PE.isNetObjectPresent("FuzzySharp")&&(bDetected=1),result()}meta("library","FuzzySharp")

================================================
FILE: dbs_min/db/PE/library_GitLabApiClient.4.sg
================================================
function detect(){return PE.isNetObjectPresent("GitLabApiClient")&&(bDetected=1),result()}meta("library","GitLabApiClient")

================================================
FILE: dbs_min/db/PE/library_GoldSrc.3.sg
================================================
function detect(){var e=PE.section[".data"]
return e&&-1!==PE.findString(e.FileOffset,e.FileSize,"VENGINE_")&&-1!==PE.findString(e.FileOffset,e.FileSize,"VFileSystem")&&PE.findString(e.FileOffset,e.FileSize,"_API_VERSION")&&(bDetected=1,e=PE.findString(e.FileOffset,e.FileSize,"_API_VERSION"),sOptions="API v"+PE.getString(e+12,e+3)),result()}meta("library","GoldSrc")

================================================
FILE: dbs_min/db/PE/library_Google_APIs.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("Google.Apis")||PE.isNetObjectPresent("Google.Apis.Auth")||PE.isNetObjectPresent("Google.Apis.Core"))&&(bDetected=1),result()}meta("library","Google APIs")

================================================
FILE: dbs_min/db/PE/library_Google_ProtoBuf.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LibNoise")&&(bDetected=1),result()}meta("library","Google ProtoBuf")

================================================
FILE: dbs_min/db/PE/library_Harmony.4.sg
================================================
function detect(){return PE.isNetObjectPresent("0Harmony")&&(bDetected=1),result()}meta("library","Harmony")

================================================
FILE: dbs_min/db/PE/library_HtmlAgilityPack.4.sg
================================================
function detect(){return PE.isNetObjectPresent("HtmlAgilityPack")&&(bDetected=1),result()}meta("library","Html Agility Pack")

================================================
FILE: dbs_min/db/PE/library_Humanizer.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Humanizer")&&(bDetected=1),result()}meta("library","Humanizer")

================================================
FILE: dbs_min/db/PE/library_ImageSharp.4.sg
================================================
function detect(){return PE.isNetObjectPresent("SixLabors.ImageSharp")&&(bDetected=1),result()}meta("library","ImageSharp")

================================================
FILE: dbs_min/db/PE/library_Intel_IPP.4.sg
================================================
function detect(){return PE.isSectionNamePresent("IPPCODE")&&PE.isSectionNamePresent("IPPDATA")&&(bDetected=1),result()}meta("library","Intel IPP")

================================================
FILE: dbs_min/db/PE/library_Intel_TBB.4.sg
================================================
function detect(){return PE.isLibraryPresent("tbb.dll")&&(bDetected=1),result()}meta("library","Intel TBB")

================================================
FILE: dbs_min/db/PE/library_Intel_XeSS.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/(lib|ig)xess/)&&(bDetected=1),result()}meta("library","Intel XeSS")

================================================
FILE: dbs_min/db/PE/library_Irony.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Irony")&&(bDetected=1),result()}meta("library","Irony")

================================================
FILE: dbs_min/db/PE/library_LCL.5.sg
================================================
function detect(){var e
return bFPC&&-1!=(e=PE.findSignature(PE.section[0].FileOffset,PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize(),"'LCLVersion' ?? ?? %% '.' %%"))&&(sVersion=PE.getString(e+12),bDetected=1),result()}includeScript("FPC"),meta("library","LCL")

================================================
FILE: dbs_min/db/PE/library_LINQKit.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LinqKit")&&(bDetected=1),result()}meta("library","LINQKit")

================================================
FILE: dbs_min/db/PE/library_LZMA.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/liblzma/i)&&(bDetected=1),result()}meta("library","LZMA")

================================================
FILE: dbs_min/db/PE/library_LazyCache.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LazyCache")&&(bDetected=1),result()}meta("library","LazyCache")

================================================
FILE: dbs_min/db/PE/library_Lego1.4.sg
================================================
function detect(){return PE.isLibraryPresent("Lego1.dll")?(sVersion="release",bDetected=1):PE.isLibraryPresent("Lego1d.dll")&&(sVersion="debug",bDetected=1),result()}meta("library","Lego1")

================================================
FILE: dbs_min/db/PE/library_LibLog.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LibLog")&&(bDetected=1),result()}meta("library","LibLog")

================================================
FILE: dbs_min/db/PE/library_LibNoise.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LibNoise")&&(bDetected=1),result()}meta("library","MoLibNoise")

================================================
FILE: dbs_min/db/PE/library_LibPhoneNumber_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("PhoneNumbers")&&(bDetected=1),result()}meta("library","LibPhoneNumber.NET")

================================================
FILE: dbs_min/db/PE/library_LibSassBuilder.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LibSassBuilder")&&(bDetected=1),result()}meta("library","LibSassBuilder")

================================================
FILE: dbs_min/db/PE/library_LibVLCSharp.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("LibVLCSharp")||PE.isNetObjectPresent("LibVLCSharp.Shared"))&&(bDetected=1),result()}meta("library","LibVLCSharp")

================================================
FILE: dbs_min/db/PE/library_LiteDB.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LiteDB")&&(bDetected=1),result()}meta("library","LiteDB")

================================================
FILE: dbs_min/db/PE/library_LoadServ.4.sg
================================================
function detect(){return PE.isLibraryPresent("LoadServ.dll")&&(sOptions="DEV6",sVersion="Adibou2",bDetected=1),result()}meta("library","LoadServ")

================================================
FILE: dbs_min/db/PE/library_Lua_Runtime.4.sg
================================================
function detect(){var e
return PE.isLibraryPresentExp(/^lua5/i)?(sLang="Lua",sVersion="5.X",bDetected=1):PE.isExportFunctionPresentExp(/^lua(L)?_/)&&(sOptions="static",bDetected=1,e=PE.section[".rdata"])&&-1!==(e=PE.findSignature(e.FileOffset,e.FileSize,"'Lua ' %% '.' %%"))&&(sVersion=PE.getString(e+4,3)),result()}meta("library","Lua Runtime")

================================================
FILE: dbs_min/db/PE/library_MacroMix.4.sg
================================================
function detect(){var t=PE.section.MacroMix
return t&&1610612768&t.Characteristics&&(sOptions="Director Engine",bDetected=1),result()}meta("library","MacroMix")

================================================
FILE: dbs_min/db/PE/library_MailKit.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MailKit")&&(bDetected=1),result()}meta("library","MailKit")

================================================
FILE: dbs_min/db/PE/library_ManagedCuda.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ManagedCuda")&&(bDetected=1),result()}meta("library","ManagedCuda")

================================================
FILE: dbs_min/db/PE/library_Mapster.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Mapster")&&(bDetected=1),result()}meta("library","Mapster")

================================================
FILE: dbs_min/db/PE/library_Markdig.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Markdig")&&(bDetected=1),result()}meta("library","Markdig")

================================================
FILE: dbs_min/db/PE/library_MassTransit.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MassTransit")&&(bDetected=1),PE.isNetObjectPresent("MassTransit.AmazonSQS")&&(sVersion="AmazonSQS",bDetected=1),result()}meta("library","MassTransit")

================================================
FILE: dbs_min/db/PE/library_MediatR.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MediatR")&&(bDetected=1),result()}meta("library","MediatR")

================================================
FILE: dbs_min/db/PE/library_MemoryPack.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MemoryPack")&&PE.isNetObjectPresent("MemoryPack.Core")&&(bDetected=1),result()}meta("library","MemoryPack Serializer")

================================================
FILE: dbs_min/db/PE/library_MessagePack.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MessagePack")&&(bDetected=1),result()}meta("library","MessagePack Serializer")

================================================
FILE: dbs_min/db/PE/library_Microsoft_AzureSDK.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Azure.Core")&&(bDetected=1),result()}meta("library","Microsoft Azure SDK")

================================================
FILE: dbs_min/db/PE/library_Microsoft_Azure_SDK.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Azure.Core")&&(bDetected=1),result()}meta("library","Microsoft Azure SDK")

================================================
FILE: dbs_min/db/PE/library_Microsoft_C_Runtime.4.sg
================================================
function detect(){return(PE.isLibraryPresent("vcruntime140.dll")||PE.isLibraryPresent("vcruntime140_1.dll"))&&(sOptions="dynamic",bDetected=1),result()}meta("library","Microsoft C/C++ Runtime")

================================================
FILE: dbs_min/db/PE/library_Microsoft_Edge_WebView.4.sg
================================================
function detect(){return(PE.isLibraryPresent("WebView2Loader.dll")||PE.isLibraryPresent("msedge_elf.dll")||PE.isNetObjectPresent("Microsoft.Web.WebView2")||PE.isNetObjectPresent("Microsoft.Web.WebView2.WinForms")||PE.isNetObjectPresent("Microsoft.Web.Wpf"))&&(bDetected=1),result()}meta("library","Microsoft Edge Chromium WebView")

================================================
FILE: dbs_min/db/PE/library_Microsoft_NET_Runtime.4.sg
================================================
function detect(){return PE.isLibraryPresent("coreclr.dll")&&(bDetected=1,sVersion="5.XX+"),result()}meta("library",".NET Core runtime")

================================================
FILE: dbs_min/db/PE/library_Microsoft_OpenAPI.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Microsoft.OpenApi")&&(bDetected=1),result()}meta("library","Microsoft OpenAPI")

================================================
FILE: dbs_min/db/PE/library_MilesSoundSystem.4.sg
================================================
function detect(){return PE.isLibraryPresent("mss32.dll")&&(bDetected=1),result()}meta("library","Miles Sound System")

================================================
FILE: dbs_min/db/PE/library_MimeKit.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MimeKit")&&(PE.isNetObjectPresent("MimeKitLite")&&(sVersion="Lite"),bDetected=1),result()}meta("library","MimeKit")

================================================
FILE: dbs_min/db/PE/library_MongoDB.NET.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("MongoDB")||PE.isNetObjectPresent("MongoDB.Driver")||PE.isNetObjectPresent("MongoDB.Driver.Core")||PE.isNetObjectPresent("MongoDB.Analyzer"))&&(bDetected=1),PE.isNetObjectPresent("MongoDB.AspNetCore.OData")&&(sVersion="ASP.NET Core",bDetected=1),result()}meta("library","MongoDB.NET Driver")

================================================
FILE: dbs_min/db/PE/library_MonkeyCache.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MonkeyCache")&&(bDetected=1),result()}meta("library","MonkeyCache")

================================================
FILE: dbs_min/db/PE/library_Moq.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Moq")&&PE.isNetObjectPresent("DownloadExists")&&(bDetected=1),result()}meta("library","Moq")

================================================
FILE: dbs_min/db/PE/library_NJsonSchema.4.sg
================================================
function detect(){return PE.isNetObjectPresent("NJsonSchema")&&(bDetected=1),result()}meta("library","NJsonSchema")

================================================
FILE: dbs_min/db/PE/library_NSubstitute.4.sg
================================================
function detect(){return PE.isNetObjectPresent("NSubstitute")&&(bDetected=1),result()}meta("library","NSubstitute")

================================================
FILE: dbs_min/db/PE/library_NUnit.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("NUnit")||PE.isNetObjectPresent("nunit.framework"))&&(bDetected=1),result()}meta("library","NUnit")

================================================
FILE: dbs_min/db/PE/library_Nerdbank.Streams.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Nerdbank.Streams")&&(bDetected=1),result()}meta("library","Nerdbank.Streams")

================================================
FILE: dbs_min/db/PE/library_Newtonsoft.Json.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Newtonsoft.Json")&&(bDetected=1),result()}meta("library","Newton Json")

================================================
FILE: dbs_min/db/PE/library_Ninject.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Ninject")&&(bDetected=1),result()}meta("library","Ninject")

================================================
FILE: dbs_min/db/PE/library_NodaTime.4.sg
================================================
function detect(){return PE.isNetObjectPresent("NodaTime")&&(bDetected=1),result()}meta("library","NodaTime")

================================================
FILE: dbs_min/db/PE/library_Nvidia_DLSS.4.sg
================================================
function detect(){var e
return(PE.isLibraryPresentExp(/^nvngx_dlss|\.dlss(\.|_)/i)||(PE.isLibraryPresentExp(/^d3d/i)||PE.isLibraryPresentExp(/^physx/i))&&(e=PE.section[".rdata"])&&PE.isSignaturePresent(e.FileOffset,e.FileSize,"%% 'DLSS' %%"))&&(bDetected=1),result()}meta("library","Nvidia DLSS")

================================================
FILE: dbs_min/db/PE/library_Nvidia_PhysX.4.sg
================================================
function detect(){return PE.is64()&&PE.section[".rdata"]&&PE.isLibraryPresentExp(/^physx/i)&&(bDetected=1),result()}meta("library","Nvidia PhysX")

================================================
FILE: dbs_min/db/PE/library_Nvidia_Streamline.4.sg
================================================
function detect(){return PE.isLibraryPresent("sl.interposer.dll")&&(bDetected=1),result()}meta("library","Nvidia Streamline")

================================================
FILE: dbs_min/db/PE/library_OodleCompression.4.sg
================================================
function detect(){var e=PE.isLibraryPresentExp(/^oo2core_\d{1,2}_win/i)
return e?((e=String(e).split("_")[1])&&(sVersion=e),bDetected=1):PE.isExportFunctionPresentExp(/^OodleLZ/)&&(sOptions="static",bDetected=1),result()}meta("library","Oodle Compression")

================================================
FILE: dbs_min/db/PE/library_OpenAI.4.sg
================================================
function detect(){return PE.isNetObjectPresent("OpenAI")&&(bDetected=1),result()}meta("library","OpenAI SDK")

================================================
FILE: dbs_min/db/PE/library_OpenAL.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/openal/i)&&(bDetected=1),result()}meta("library","OpenAL")

================================================
FILE: dbs_min/db/PE/library_OpenCL.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/opencl/i)&&(bDetected=1),result()}meta("library","OpenCL")

================================================
FILE: dbs_min/db/PE/library_OpenCV.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("OpenCvSharp")||PE.isLibraryPresentExp(/^opencv/i))&&(bDetected=1),result()}meta("library","OpenCV")

================================================
FILE: dbs_min/db/PE/library_OpenColorIO.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^OpenColorIO/i)&&(bDetected=1),result()}meta("library","OpenColorIO")

================================================
FILE: dbs_min/db/PE/library_OpenGL.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/opengl/i)?bDetected=1:PE.isExportFunctionPresentExp(/^ANGLE(GetDisplayPlatform|ResetDisplayPlatform)/)&&(sVersion="ANGLE",sOptions="static",bDetected=1),result()}meta("library","OpenGL")

================================================
FILE: dbs_min/db/PE/library_OpenIddict.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("OpenIddict.Client")||PE.isNetObjectPresent("OpenIddict.Abstractions"))&&(bDetected=1),result()}meta("library","OpenIddict")

================================================
FILE: dbs_min/db/PE/library_OpenSSL.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/libssl|libcrypto/i)&&(bDetected=1),result()}meta("library","OpenSSL")

================================================
FILE: dbs_min/db/PE/library_OpenTelemetry.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("OpenTelemetry")||PE.isNetObjectPresent("OpenTelemetry.Api"))&&(bDetected=1),result()}meta("library","OpenTelemetry")

================================================
FILE: dbs_min/db/PE/library_OpusAudio.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^(opus(enc)?\.)|(ms|lib)opus|bass(_)?opus/i)?bDetected=1:PE.isExportFunctionPresentExp(/^opus_(de|en)code/)&&(sOptions="static",bDetected=1),result()}meta("library","Opus Audio")

================================================
FILE: dbs_min/db/PE/library_PdfPig.4.sg
================================================
function detect(){return PE.isNetObjectPresent("UglyLoad.PdfPig")&&(bDetected=1),result()}meta("library","PdfPig")

================================================
FILE: dbs_min/db/PE/library_Perfolizer.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Perfolizer")&&(bDetected=1),result()}meta("library","Perfolizer")

================================================
FILE: dbs_min/db/PE/library_Perl.3.sg
================================================
function detect(){var e
if(PE.isDll())return(e=PE.isLibraryPresentExp(/perl(5)_?(\d\d*)/i))&&(bDetected=1,sVersion=e[1]+"."+e[2],sLang="Perl"),PE.isExportFunctionPresentExp("Perl_sv_bless|perl_parse")?(bDetected=1,sVersion=getPerlVersion(),sLang="Perl",_setResult("library","Perl Runtime",sVersion,"")):result()}function getPerlVersion(){for(var e=["'erl5' %% '.dll'","'erl5' %% %% '.dll'","'erl5_' %% '.dll'","'erl5_' %% %% '.dll'"],r=PE.getExportSection(),t="",n=-1,i=0;i<e.length&&!(-1<(n=PE.findSignature(PE.section[r].FileOffset,PE.getSize(),e[i])));++i);if(0<n){var l=PE.getString(n,12)
if(!(l=l.match(/(5)_?(\d\d*)/)))return t
t=l[1]+"."+l[2],l=findPatchVersion(9<Number(l[2])?"'5.' %% %% '.' %% ":"'5.' %% '.' %%")
0<l&&(t+="."+l)}return t}function findPatchVersion(e){for(var r,t=0,n=PE.getSize(),i=0;-1!=(r=PE.findSignature(t,n,e));){var l=PE.getString(r,12),t=r+l.length;(l=l.match(/5\.\d\d*\.(\d\d*)/))&&l[1]>i&&(i=l[1])}return i}meta("library","Perl5 xs")

================================================
FILE: dbs_min/db/PE/library_Plivo.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Plivo")&&(bDetected=1),result()}meta("library","Plivo")

================================================
FILE: dbs_min/db/PE/library_Polly.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("Polly")||PE.isNetObjectPresent("Polly.Core"))&&(bDetected=1),result()}meta("library","Polly")

================================================
FILE: dbs_min/db/PE/library_PortAudio.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^portaudio_x(86|64)/i)&&(bDetected=1),result()}meta("library","PortAudio")

================================================
FILE: dbs_min/db/PE/library_Python.4.sg
================================================
function detect(){var e=PE.isLibraryPresentExp(/^python(\d)(\d+)/i),e=(e&&(sVersion=e[1]+"."+e[2],bDetected=1),PE.isLibraryPresentExp(/^libpython(\d.\d)/i))
return e&&(sVersion=e[1],bDetected=1),sLang="Python",sLangVersion=sVersion,result()}meta("library","Python")

================================================
FILE: dbs_min/db/PE/library_QMixer.4.sg
================================================
function detect(){return PE.isLibraryPresent("QMDX.DLL")&&(bDetected=1),result()}meta("library","QMixer")

================================================
FILE: dbs_min/db/PE/library_Qt.4.sg
================================================
function detect(){return aQt&&(sVersion=(sVersion=(sVersion=PE.getPEFileVersion(PE.getFileDirectory()+"/"+aQt[0]))||("The Qt Company Ltd"!=PE.getVersionStringInfo("ProductName")&&"Qt5"!=PE.getVersionStringInfo("ProductName")?sVersion:PE.getPEFileVersion(PE.getFileDirectory()+"/"+ownName)))||(aQt[3]||aQt[1])+".X",aQt[2]&&(sOptions="debug"),bDetected=1),!aQt&&PE.section[".rdata"]&&-1!=PE.findString(PE.section[".rdata"].FileOffset,PE.section[".rdata"].FileSize,"QWidget")&&(sOptions="static",bDetected=1),result()}meta("library","Qt"),includeScript("QtFramework")

================================================
FILE: dbs_min/db/PE/library_RADVideoTools.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^(binkw|bink2|video_bink)/i)&&(bDetected=1),result()}meta("library","RAD Video Tools")

================================================
FILE: dbs_min/db/PE/library_RNNoise.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/rnnoise/i)||PE.isFunctionPresent("rnnoise_init")?bDetected=1:PE.isExportFunctionPresentExp(/^rnnoise_/)&&(sOptions="static",bDetected=1),result()}meta("library","RNNoise Noise Suppressor")

================================================
FILE: dbs_min/db/PE/library_RabbitMQ.4.sg
================================================
function detect(){return PE.isNetObjectPresent("RabbitMQ.Client")&&(bDetected=1),result()}meta("library","RabbitMQ")

================================================
FILE: dbs_min/db/PE/library_RamlToOpenApiConverter.4.sg
================================================
function detect(){return PE.isNetObjectPresent("RamlToOpenApiConverter")&&(bDetected=1),result()}meta("library","RamlToOpenApiConverter")

================================================
FILE: dbs_min/db/PE/library_RestSharp.4.sg
================================================
function detect(){return PE.isNetObjectPresent("RestSharp")&&(bDetected=1),result()}meta("library","RestSharp HTTP")

================================================
FILE: dbs_min/db/PE/library_SDL.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^sdl2/i)?sVersion="2":PE.isLibraryPresentExp(/^sdl3/i)?sVersion="3":PE.isLibraryPresentExp(/^sdl/i)&&(bDetected=1),bDetected=bDetected||Boolean(sVersion),result()}meta("library","SDL")

================================================
FILE: dbs_min/db/PE/library_ScePad.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^libscepad/i)&&(bDetected=1),result()}meta("library","PlayStation Controller SDK")

================================================
FILE: dbs_min/db/PE/library_ScriptHookV.4.sg
================================================
function detect(){return PE.isLibraryPresent("ScriptHookV.dll")&&(bDetected=1),result()}meta("library","ScriptHookV for GTA V")

================================================
FILE: dbs_min/db/PE/library_Scrutor.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Scrutor")&&(bDetected=1),result()}meta("library","Scrutor")

================================================
FILE: dbs_min/db/PE/library_SecretRabbitCode.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^libsamplerate/i)||PE.isFunctionPresent("src_set_ratio")?bDetected=1:(PE.isExportFunctionPresent("src_set_ratio")||PE.isExportFunctionPresent("src_simple")||PE.isExportFunctionPresent("src_is_valid_ratio"))&&(sOptions="static",bDetected=1),result()}meta("library","Secret Rabbit Code")

================================================
FILE: dbs_min/db/PE/library_Serilog.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Serilog")&&(bDetected=1),result()}meta("library","Serilog")

================================================
FILE: dbs_min/db/PE/library_SharpCompress.4.sg
================================================
function detect(){return PE.isNetObjectPresent("SharpCompress")&&(bDetected=1),result()}meta("library","SharpCompress")

================================================
FILE: dbs_min/db/PE/library_SharpZipLib.4.sg
================================================
function detect(){return PE.isNetObjectPresent("SharpZipLib")&&(bDetected=1),result()}meta("library","SharpZipLib Compression")

================================================
FILE: dbs_min/db/PE/library_Sigil.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Sigil")&&(bDetected=1),result()}meta("library","Sigil Helper")

================================================
FILE: dbs_min/db/PE/library_SkiaSharp.4.sg
================================================
function detect(){return PE.isNetObjectPresent("SkiaSharp")?(sVersion="Mono-based",bDetected=1):PE.isLibraryPresentExp(/^libskiasharp/i)&&(sVersion="Native",bDetected=1),result()}meta("library","SkiaSharp")

================================================
FILE: dbs_min/db/PE/library_Smacker.4.sg
================================================
function detect(){return PE.isLibraryPresent("smackw32.dll")&&(bDetected=1),result()}meta("library","RAD Game Tools Smacker API")

================================================
FILE: dbs_min/db/PE/library_SmartHeap.4.sg
================================================
function detect(){return PE.isLibraryPresent("SHW32.dll")&&(bDetected=1),result()}meta("library","SmartHeap")

================================================
FILE: dbs_min/db/PE/library_Snappier.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Snappier")&&(bDetected=1),result()}meta("library","Snappier Compression")

================================================
FILE: dbs_min/db/PE/library_Spectre.Console.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Spectre.Console")&&(bDetected=1),result()}meta("library","Spectre.Console")

================================================
FILE: dbs_min/db/PE/library_Stackify.4.sg
================================================
function detect(){return PE.isNetObjectPresent("StackifyLib")&&(bDetected=1),result()}meta("library","Stackify")

================================================
FILE: dbs_min/db/PE/library_Starkbank_ECDSA.4.sg
================================================
function detect(){return PE.isNetObjectPresent("StarkbankEcdsa")&&(bDetected=1),result()}meta("library","Starkbank ECDSA")

================================================
FILE: dbs_min/db/PE/library_Steam.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^steam/i)&&(bDetected=1),result()}meta("library","Steam")

================================================
FILE: dbs_min/db/PE/library_Swashbuckle.AspNetCore.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Swashbuckle.Core")&&(bDetected=1),result()}meta("library","Swashbuckle.AspNetCore")

================================================
FILE: dbs_min/db/PE/library_TNTSI.4.sg
================================================
function detect(){return PE.isLibraryPresent("TNTSI.dll")&&(bDetected=1),result()}meta("library","TNTSI")

================================================
FILE: dbs_min/db/PE/library_Tabula.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Tabula")&&(bDetected=1),result()}meta("library","Tabula")

================================================
FILE: dbs_min/db/PE/library_Telegram.Bot.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Telegram.Bot")&&(bDetected=1),result()}meta("library","Telegram.Bot")

================================================
FILE: dbs_min/db/PE/library_Twilio.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Twilio")&&(bDetected=1),result()}meta("library","Twilio REST Helper")

================================================
FILE: dbs_min/db/PE/library_Twilio_SendGrid.4.sg
================================================
function detect(){return PE.isNetObjectPresent("SendGrid")&&(bDetected=1),result()}meta("library","Twilio SendGrid")

================================================
FILE: dbs_min/db/PE/library_UAParser.4.sg
================================================
function detect(){return PE.isNetObjectPresent("UAParser")&&(bDetected=1),result()}meta("library","UAParser")

================================================
FILE: dbs_min/db/PE/library_Unity.4.sg
================================================
function detect(){return(PE.isLibraryPresent("UnityPlayer.dll")||PE.isExportFunctionPresent("UnityMain"))&&(bDetected=1),PE.isExportFunctionPresent("il2cpp_alloc")&&(sLang="Native MSIL/C#",sOptions="IL2CPP",bDetected=1,_setResult("compiler","IL2CPP Technology","","")),result()}meta("library","Unity Engine")

================================================
FILE: dbs_min/db/PE/library_VFW.4.sg
================================================
function detect(){return PE.isLibraryPresent("MSVFW32.dll")&&(bDetected=1),result()}meta("library","Video for Windows (VFW)")

================================================
FILE: dbs_min/db/PE/library_Vorbis.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/vorbis/i)&&(bDetected=1),result()}meta("library","Vorbis")

================================================
FILE: dbs_min/db/PE/library_Vulkan.4.sg
================================================
function detect(){return(PE.isLibraryPresentExp(/[V|v]ulkan/i)||PE.isExportFunctionPresentExp(/VULKAN/))&&(bDetected=1),result()}meta("library","Vulkan")

================================================
FILE: dbs_min/db/PE/library_WF.Guna.UI2.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Guna.UI2")&&PE.isNetObjectPresent("Guna.UI2.WinForms")&&(sVersion="2.0",bDetected=1),result()}meta("library","Guna UI")

================================================
FILE: dbs_min/db/PE/library_WF.Krypton.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ComponentFactory.Krypton.Toolkit")&&(bDetected=1),result()}meta("library","Krypton UI")

================================================
FILE: dbs_min/db/PE/library_WF.MetroFramework.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MetroFramework")&&(bDetected=1),result()}meta("library","MetroFramework UI")

================================================
FILE: dbs_min/db/PE/library_WF.ReaLTaiizor.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ReaLTaiizor")&&(bDetected=1),result()}meta("library","ReaLTaiizor UI")

================================================
FILE: dbs_min/db/PE/library_WF_WPF.MaterialSkin.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MaterialSkin")&&(bDetected=1),result()}meta("library","MaterialSkin UI")

================================================
FILE: dbs_min/db/PE/library_WPF.AvalonEdit.4.sg
================================================
function detect(){return PE.isNetObjectPresent("AvalonEdit")&&(bDetected=1),result()}meta("library","AvalonEdit")

================================================
FILE: dbs_min/db/PE/library_WPF.ControlzEx.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ControlzEx")&&(bDetected=1),result()}meta("library","ControlzEx UI")

================================================
FILE: dbs_min/db/PE/library_WPF.MahApps_Metro.4.sg
================================================
function detect(){return PE.isNetObjectPresent("MahApps.Metro")&&(bDetected=1),result()}meta("library","MahApps Metro UI")

================================================
FILE: dbs_min/db/PE/library_WebActivatorEx.4.sg
================================================
function detect(){return PE.isNetObjectPresent("WebActivatorEx")&&(bDetected=1),result()}meta("library","WebActivator")

================================================
FILE: dbs_min/db/PE/library_WinSparkle.4.sg
================================================
function detect(){return PE.isLibraryPresent("WinSparkle.dll")&&(bDetected=1),result()}meta("library","WinSparkle")

================================================
FILE: dbs_min/db/PE/library_WwiseAudioEngine.4.sg
================================================
function detect(){return PE.isFunctionPresent("g_pAKPluginList")?bDetected=1:PE.isExportFunctionPresent("g_pAKPluginList")&&(sOptions="static",bDetected=1),result()}meta("library","Wwise Audio Engine")

================================================
FILE: dbs_min/db/PE/library_XLive.4.sg
================================================
function detect(){return PE.isLibraryPresent("xlive.dll")&&(bDetected=1),result()}meta("library","Xbox Live")

================================================
FILE: dbs_min/db/PE/library_XPatFC.4.sg
================================================
function detect(){return PE.isLibraryPresent("XpatFC.dll")&&(bDetected=1),result()}meta("library","XPatFC")

================================================
FILE: dbs_min/db/PE/library_Xerces-CPP.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^xerces/i)&&(bDetected=1),result()}meta("library","Xerces-C++ XML Parser")

================================================
FILE: dbs_min/db/PE/library_Xojo.4.sg
================================================
function detect(){return PE.section.xojoinit&&(PE.section.xojoplgn&&(sOptions=sOptions.append("plugins")),PE.isLibraryPresent("XojoGUIFramework64.dll")?sVersion="x64":PE.isLibraryPresent("XojoGUIFramework32.dll")&&(sVersion="x86"),bDetected=1),result()}meta("library","Xojo")

================================================
FILE: dbs_min/db/PE/library_YUICompressor_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Yahoo.Yui.Compressor")&&(bDetected=1),result()}meta("library","YUICompressor.NET")

================================================
FILE: dbs_min/db/PE/library_YamlDotNet.4.sg
================================================
function detect(){return PE.isNetObjectPresent("YamlDotNet")&&(bDetected=1),result()}meta("library","YamlDotNet")

================================================
FILE: dbs_min/db/PE/library_ZstdSharp.4.sg
================================================
function detect(){return PE.isNetObjectPresent("ZstdSharp")&&(bDetected=1),result()}meta("library","ZstdSharp")

================================================
FILE: dbs_min/db/PE/library_Zydis.4.sg
================================================
function detect(){return PE.isLibraryPresent("zydis.dll")&&(bDetected=1),result()}meta("library","Zyan Disassembler")

================================================
FILE: dbs_min/db/PE/library_combres.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Combres")&&(bDetected=1),result()}meta("library","Combres Optimizer")

================================================
FILE: dbs_min/db/PE/library_curl.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/libcurl/i)?bDetected=1:PE.isExportFunctionPresentExp(/^curl_easy_/)&&(sOptions="static",bDetected=1),result()}meta("library","Curl")

================================================
FILE: dbs_min/db/PE/library_discord-rpc.4.sg
================================================
function detect(){return PE.isLibraryPresent("discord-rpc.dll")&&(bDetected=1),result()}meta("library","Discord RPC")

================================================
FILE: dbs_min/db/PE/library_dotless.4.sg
================================================
function detect(){return PE.isNetObjectPresent("dotless.Core")&&(bDetected=1),result()}meta("library","dotless")

================================================
FILE: dbs_min/db/PE/library_expat_xml_parser.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^libexpat/i)&&(bDetected=1),result()}meta("library","Expat XML Parser")

================================================
FILE: dbs_min/db/PE/library_gRPC_NET.4.sg
================================================
function detect(){return PE.isNetObjectPresent("Grpc.Core.Api")&&(bDetected=1),result()}meta("library","gRPC.NET")

================================================
FILE: dbs_min/db/PE/library_iMuse.4.sg
================================================
function detect(){return PE.isLibraryPresent("iMUSE.dll")&&(bDetected=1),result()}meta("library","iMuse")

================================================
FILE: dbs_min/db/PE/library_java.3.sg
================================================
function detect(){var e
return 64<PE.getOverlaySize()&&-1!=PE.findString(PE.getOverlayOffset(),64,"META-INF/MANIFEST.MF")&&-1!=(e=PE.getResourceSection())&&PE.isSignatureInSectionPresent(e,"'Java Runtime Environment'")&&(bDetected=1),sLang="Java",result()}meta("library","Java")

================================================
FILE: dbs_min/db/PE/library_libfvad.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/fvad\./i)?bDetected=1:PE.isExportFunctionPresentExp(/^fvad_/)&&(sOptions="static",bDetected=1),result()}meta("library","libfvad")

================================================
FILE: dbs_min/db/PE/library_libpng.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^libpng/i)&&(bDetected=1),result()}meta("library","libpng")

================================================
FILE: dbs_min/db/PE/library_log4net.4.sg
================================================
function detect(){return PE.isNetObjectPresent("log4net")&&(bDetected=1),result()}meta("library","log4net")

================================================
FILE: dbs_min/db/PE/library_lz4net.4.sg
================================================
function detect(){return PE.isNetObjectPresent("LZ4")&&(bDetected=1),result()}meta("library","lz4net")

================================================
FILE: dbs_min/db/PE/library_nClam.4.sg
================================================
function detect(){return PE.isNetObjectPresent("nClam")&&(bDetected=1),result()}meta("library","nClam")

================================================
FILE: dbs_min/db/PE/library_rlottie.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^rlottie/i)?bDetected=1:PE.isExportFunctionPresentExp(/^(\?|_)+.{6,}rlottie/)&&(sOptions="static",bDetected=1),result()}meta("library","rlottie")

================================================
FILE: dbs_min/db/PE/library_sqlite.4.sg
================================================
function detect(){var e,t=PE.isLibraryPresentExp(/sqlite\d+/i)
return t?((e=/sqlite(\d+)/i.exec(t))&&(sVersion=e[1]),bDetected=1):(t=PE.isExportFunctionPresentExp(/sqlite\d+/i))?(sOptions="static",(e=/sqlite(\d+)/i.exec(t))&&(sVersion=e[1]),bDetected=1):PE.isLibraryPresentExp(/sqlite|sqlmin|sqllang|sqltses|sqldk/i)&&(bDetected=1),!bDetected&&PE.isNet()&&PE.isNetObjectPresent("SQLite-net")&&(sName+="-net",bDetected=1),result()}meta("library","SQLite")

================================================
FILE: dbs_min/db/PE/library_wxWidgets.5.sg
================================================
function detect(){return 1==aWx?(sOptions="static",bDetected=1):aWx&&(sVersion=(aWx[2]/10).toFixed(1),aWx[1]&&(sOptions="universal"),aWx[3]&&(sOptions=sOptions.append("unicode")),aWx[4]&&(sOptions=sOptions.append("debug")),bDetected=!0),result()}meta("library","wxWidgets"),includeScript("wxWidgets")

================================================
FILE: dbs_min/db/PE/library_xUnit.net.4.sg
================================================
function detect(){return(PE.isNetObjectPresent("xunit.core")||PE.isNetObjectPresent("xunit.assert")||PE.isNetObjectPresent("xunit.analyzers"))&&(bDetected=1),result()}meta("library","xUnit.net")

================================================
FILE: dbs_min/db/PE/library_zlib.4.sg
================================================
function detect(){return PE.isLibraryPresentExp(/^zlib*/)&&(bDetected=1),result()}meta("library","zlib")

================================================
FILE: dbs_min/db/PE/linkers.6.sg
================================================
function detect(){sVersion=PE.getCompilerVersion(),PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'0000000000000'PE'0000")?(e=PE.getMajorLinkerVersion(),r=PE.getMinorLinkerVersion(),2==e?55==r?(sName="LCC Linker",sVersion+="*",sLang="C",bDetected=1):r<=40||56==r?(sName="GNU Linker ld (GNU Binutils)",56==r&&(sVersion+="*"),bDetected=1):50==r&&(sName="Polink",sVersion+="*",bDetected=1):1==e&&3==r&&(sName="LCC Linker",bDetected=1)):PE.compare("'This program must be run under Win'....0D0A24..00",80)?(sName="Turbo Linker","2.25"==sVersion&&PE.isSectionNamePresent(".tls")&&(sLang="Object Pascal (Delphi)"),bDetected=1):PE.compare("FB..'jr'",30)?(sName="Turbo Linker",sVersion=(PE.readByte(31)/16).toFixed(1),PE.compare("'32STUB'",512)&&(sOptions=sOptions.append("RTM32")),bDetected=1):PE.compare("'his is a Windows '",79)?(sName="Watcom Linker",sVersion+="*",bDetected=1):PE.compare("'MZ'6c000100000002000000ffff000000000000110000004000000000000000'Win'....' Program!\r\n\b409ba0001cd21b44ccd2160000000'GoLink, GoAsm www.GoDevTool.com'00")&&(sName="GoLink",bDetected=1)
var e=PE.getMajorLinkerVersion(),r=PE.getMinorLinkerVersion()
return 2==e&&18==r?(sName="Watcom Linker",bDetected=1):2==e&&52==r?(sName="PowerBASIC Linker",sLang="Basic",bDetected=1):255==e&&255==r?(sName="IBM VisualAge",bDetected=1):7==e&&32==r&&(sName="Symantec C/C++",sVersion="7.2",bDetected=1),"Borland Linker"==sName&&15<PE.getMajorLinkerVersion()&&(sVersion+="*"),(bFASM||bRosASM||bSpASM||bFPC)&&(bDetected=0),result()}meta("linker"),includeScript("FASM"),includeScript("RosASM"),includeScript("SpASM"),includeScript("FPC")

================================================
FILE: dbs_min/db/PE/marker_AMD_PowerXpress.5.sg
================================================
function detect(){return PE.isExportFunctionPresent("AmdPowerXpressRequestHighPerformance")?bDetected=1:PE.isExportFunctionPresent("NoAmdPwrXpressRequestHighPerformance")&&(sOptions="Disabled",bDetected=1),result()}meta("marker","AMD PowerXpress")

================================================
FILE: dbs_min/db/PE/marker_Nvidia_Optimus.5.sg
================================================
function detect(){return PE.isExportFunctionPresent("NvOptimusEnablement")?bDetected=1:PE.isExportFunctionPresent("NoNvOptimEnablement")&&(sOptions="Disabled",bDetected=1),result()}meta("marker","Nvidia Optimus")

================================================
FILE: dbs_min/db/PE/native_only/about.txt
================================================
Scripts for Native files only will be located here (PE.isNet() == false)

================================================
FILE: dbs_min/db/PE/other_Dolphin_VM.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")&&PE.compareOverlay("'IST'00")&&(sVersion="5.0",sOptions="2003 by Object Arts",bDetected=1),result()}meta("other","Dolphin Virtual Machine")

================================================
FILE: dbs_min/db/PE/other_FileSplit_Self-Merger.2.sg
================================================
function detect(){return PE.compareEP("56576a..ff15........8bf8ff15........8a088b35........80f9..75..50ffd68a0884c974..80f9..75..50ffd6")&&(bDetected=1),result()}meta("other","Partridgesoft FileSplit Self-Merger")

================================================
FILE: dbs_min/db/PE/other_GSplit.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0")&&0<PE.getNumberOfResources()&&(nOffset=PE.getResourceNameOffset("ENG"),PE.compare("'GS'",nOffset))&&(sVersion="3.0",bDetected=1),result()}meta("other","GSplit Self-Uniting")

================================================
FILE: dbs_min/db/PE/packer_32LiTe.2.sg
================================================
function detect(){return PE.compareEP("6006FC1E07BE........6A0468........68")&&(sVersion="0.03a",bDetected=1),result()}meta("packer","32LiTe")

================================================
FILE: dbs_min/db/PE/packer_AHpacker.2.sg
================================================
function detect(){var e="!EPack"
return PE.compareEP("6068........B8........FF1068........50B8........FF1068........6A40FFD08905")&&PE.section[0].Name!==e&&PE.section[PE.nLastSection].Name!==e&&(sVersion="0.1",bDetected=1),result()}meta("packer","AHpacker")

================================================
FILE: dbs_min/db/PE/packer_ANDpakk.2.sg
================================================
function detect(){return PE.compareEP("60FCBED4004000BF001000015783CDFF33C9F9EB05A402DB75058A1E4612DB72F4")?(sVersion="2.0.06",bDetected=1):1==PE.getNumberOfSections()&&1==PE.getNumberOfImports()&&2==PE.getNumberOfImportThunks(0)&&"ANDpakk2"==PE.section[0].Name&&(sVersion="2.X",bDetected=1),result()}meta("packer","ANDpakk")

================================================
FILE: dbs_min/db/PE/packer_ASDPack.2.sg
================================================
function detect(){return PE.compareEP("8B442404565753E8CD010000C30000000000000000000000000010000000")?(sVersion="2.0",bDetected=1):1===PE.getNumberOfImports()&&3===PE.getNumberOfSections()&&"Kernel32.dll"===PE.getImportLibraryName(0)&&PE.isImportPositionHashPresent(0,911341197)&&(bDetected=1),result()}meta("packer","ASDPack")

================================================
FILE: dbs_min/db/PE/packer_ASPack.2.sg
================================================
function getASPackVersion(e){if(PE.compare("60E8000000005D81ED........B8........03C5",e))sVersion="1.00b-1.07b"
else if(PE.compare("60EB..5DEB..FF..........E9",e))sVersion="1.08.00-1.08.02"
else if(PE.compare("60E8000000005D............BB........03DD",e))sVersion="1.08.03"
else if(PE.compare("60E8000000005D81ed........BB........01eb",e))sVersion="1.08.X",sOptions="possibly"
else if(PE.compare("60E841060000EB41",e))sVersion="1.08.04"
else if(PE.compare("60EB..5DFFE5E8........81ED........BB........03DD2B9D",e))sVersion="1.08.X"
else if(PE.compare("60E870050000EB4C",e))sVersion="2.000"
else if(PE.compare("60E872050000EB4C",e))sVersion="2.001"
else if(PE.compare("60E872050000EB3387DB9000",e))sVersion="2.1"
else if(PE.compare("60E93D040000",e))sVersion="2.11"
else if(PE.compare("60E802000000EB095D5581ED39394400C3E93D040000",e))sVersion="2.11b"
else if(PE.compare("60E802000000EB095D5581ED39394400C3E959040000",e))sVersion="2.11c-2.11d"
else if(PE.compare("60E802000000EB095D55",e))sVersion="2.11d"
else if(PE.compare("60E803000000E9EB045D4555C3E801",e))sVersion="2.12-2.42"
else if(PE.compare("9060E8$$$$$$$$5D4555C3",e))sVersion="2.12b"
else{if(!PE.compare("60e8$$$$$$$$8b2c2481ed........c3",e)&&!PE.compare("9060e8$$$$$$$$8b2c2481ed........c3",e))return!1
sVersion="2.1X-2.39"}return!0}function detect(){var e=PE.getEntryPointOffset()
return-1!=e&&(getASPackVersion(e)?bDetected=1:(PE.compareEP("7500E9")?(e+=3,bDetected=1):PE.compareEP("907500E9")?(e+=4,bDetected=1):PE.compareEP("90907500E9")||PE.compareEP("90750190E9")||PE.compareEP("907501FFE9")?(e+=5,bDetected=1):PE.compareEP("9090907500E9")||PE.compareEP("9090750190E9")?(e+=6,bDetected=1):PE.compareEP("909090750190E9")&&(e+=7,bDetected=1),bDetected&&(e=PE.RVAToOffset(PE.OffsetToRVA(e)+4+~~PE.readDword(e)),bDetected=getASPackVersion(e)))),bDetected||PE.section[".aspack"]&&PE.section[".adata"]&&(sVersion="2.12-2.XX",bDetected=1),result()}meta("packer","ASPack")

================================================
FILE: dbs_min/db/PE/packer_Advanced_BAT_to_EXE_Converter.2.sg
================================================
function detect(){return PE.compareEP("558BEC6AFF68")&&PE.compareOverlay("..02020202363A38393a")&&(sVersion="2.X-4.X",bDetected=1),sLang="Batch",result()}meta("packer","Advanced BAT to EXE Converter")

================================================
FILE: dbs_min/db/PE/packer_AlushPacker.2.sg
================================================
function detect(){var e
return 2<PE.getNumberOfImports()&&PE.isRichSignaturePresent()&&PE.isLibraryPresentExp(/vcruntime140/i)&&"VirtualProtect"===PE.getImportFunctionName(0,0)&&"GetCurrentProcess"===PE.getImportFunctionName(0,1)&&"GetModuleHandleA"===PE.getImportFunctionName(0,2)&&"MultiByteToWideChar"===PE.getImportFunctionName(0,3)&&"FlushInstructionCache"===PE.getImportFunctionName(0,4)&&((e=PE.section[".packed"])||(e=PE.section[PE.getNumberOfSections()-1],sOptions="modified"),PE.compare("00 ** ?? 00",e.FileOffset))&&(bDetected=1),result()}meta("packer","AlushPacker")

================================================
FILE: dbs_min/db/PE/packer_Anskya_NTPacker_Generator.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4F053B8881D0010E8C7FAFFFF6A0A68201E0010A11431001050")&&(bDetected=1),result()}meta("packer","Anskya NTPacker Generator")

================================================
FILE: dbs_min/db/PE/packer_AtomPePacker.2.sg
================================================
function detect(){return PE.is64()&&PE.compareEP("4053574883EC**65488B1C25........FF15**......BA........41B8........488BC8")&&(sOptions=PE.isSectionNamePresent(".ATOM")?"x64 stub":"modified",bDetected=1),result()}meta("packer","AtomPePacker")

================================================
FILE: dbs_min/db/PE/packer_BatToExe.2.sg
================================================
function detect(){if(PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68........e8........a3"))for(var e=0;e<PE.getNumberOfResources()&&!bDetected;e++)"RT_RCDATA"==PE.resource[e].Type&&(bDetected=PE.compare("78 9c 63 60 18 05 23 19 00 00 02 00 00 01",PE.resource[e].Offset))
return sLang="Batch",result()}meta("packer","Bat To Exe")

================================================
FILE: dbs_min/db/PE/packer_BatToExeConverter.2.sg
================================================
function detect(){return(PE.isImportPositionHashPresent(0,1923271268)||PE.isImportPositionHashPresent(0,721219391))&&PE.compareEP(PE.is64()?"48 83 EC .. 49 C7 C0 .. .. .. .. 48 31 D2 48 B9 .. .. .. .. .. .. .. .. E8 .. .. .. .. 48 31 C9 E8 .. .. .. .. 48 89 05 .. .. .. ..":"68 .. .. .. .. 68 .. .. .. .. 68 .. .. .. .. E8 .. .. .. .. 83 C4 .. 68 .. .. .. .. E8 .. .. .. .. A3 .. .. .. ..")&&(bDetected=1),sLang="Batch",result()}meta("packer","Bat To Exe Converter")

================================================
FILE: dbs_min/db/PE/packer_BeRoEXEPacker.2.sg
================================================
function detect(){var e=PE.compareEP("837C2408010F85")?11:0
return PE.compareEP("60BE........BF........FCB28033DBA4B302E8",e)?(sVersion="1.00",sOptions="LZBRR"):PE.compareEP("60BE........BF........FCAD8D1C07B0803BFB733BE8",e)?(sVersion="1.00",sOptions="LZBRS"):PE.compareEP("6068........68........68........E8........BE........B9")?(sVersion="1.00",sOptions="LZMA"):PE.compareEP("BA........8DB2........8B46..85C0745103C28B7E..8B1E85DB75028BDF03DA03FA525750FF15")?sVersion="1.00":PE.compareEP("6068........68......0068........e8..040000..................00")?(sVersion="1.00",sOptions="LZMA"):PE.compareEP("60e8000000005e81c6....0000bf........6081ec0804000089e357fc31c0b4")?(sVersion="1.00",sOptions="CTX1"):PE.compareEP("60c8940c0060fcbe........ad8945fc33c0f7d08945f8f7d0b408b923030000")?(sVersion="1.00",sOptions="LZBRA"):PE.compare("52c3'(C)BeRo!PE'0000",2)&&(bDetected=1),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),result()}meta("packer","BeRoEXEPacker")

================================================
FILE: dbs_min/db/PE/packer_BoxedApp.2.sg
================================================
function detect(){var e,t
return PE.isTLSPresent()&&(e=PE.section[".bxpck"],!(bDetected=e&&2<PE.getNumberOfSections()&&(t=PE.section[e.Number+1])&&".main"===t.Name?!0:bDetected)&&2===PE.getNumberOfImports()&&PE.compareEP("C200000000000000000000000000000000")&&(sOptions="modified",bDetected=1),bDetected)&&e&&PE.isSignatureInSectionPresent(e.Number,"2000640065006D006F0020")&&(sVersion="demo"),result()}meta("packer","BoxedApp")

================================================
FILE: dbs_min/db/PE/packer_CExe.2.sg
================================================
function detect(){return PE.compareEP("558BEC81EC0C02....56BE........8D85F8FEFFFF56506A..FF15........8A8DF8FEFFFF33D284C98D85F8FEFFFF7416")&&(sVersion="1.0a",bDetected=1),result()}meta("packer","CExe")

================================================
FILE: dbs_min/db/PE/packer_CICompress.2.sg
================================================
function detect(){return PE.compareEP("6A046800100000FF35........6A00FF15........A3........97BE........E8710000003B05")&&(sVersion="1.0",bDetected=1),result()}meta("packer","CICompress")

================================================
FILE: dbs_min/db/PE/packer_Cxfreeze.2.sg
================================================
function detect(){var e=PE.section[".rdata"]
return e&&(bDetected=-1!==PE.findString(e.FileOffset,e.FileSize,"Unable to change DLL search path!")&&PE.isSignaturePresent(e.FileOffset,e.FileSize,"25006C0073005C006C00690062005C006C006900620072006100720079002E007A00690070003B0025006C0073005C006C0069006200")&&-1!==PE.findString(e.FileOffset,e.FileSize,"Out of memory creating sys.path!")&&-1!==PE.findString(e.FileOffset,e.FileSize,"Unable to calculate directory of executable!")),sLang="Python",result()}meta("packer","CX_Freeze")

================================================
FILE: dbs_min/db/PE/packer_DxPack.2.sg
================================================
function detect(){if(PE.compareEP("60E8........5D8BFD81ED........2BB9........81EF........83BD..........0F84")){switch(PE.readByte(PE.getEntryPointOffset()+32)){case 185:sVersion="1.0"
break
case 189:sVersion="0.86"}bDetected=1}else PE.compareEP("EB03C20C00558BEC81EC00100000B80000....B900100000BA0000....89")&&(sVersion="1.0",bDetected=1)
var e=PE.section.coderpub
return bDetected&&!e?sOptions="modified":!bDetected&&e&&(PE.compareEP("558BEC")||PE.compareEP("880D........CC"))&&(bDetected=1),result()}meta("packer","DxPack")

================================================
FILE: dbs_min/db/PE/packer_EXE32Pack.2.sg
================================================
function detect(){return PE.compareEP("3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB7401BE5D8BD581ED")&&(sVersion="1.4X",bDetected=1),result()}meta("packer","Exe32Pack")

================================================
FILE: dbs_min/db/PE/packer_ExE_Pack.2.sg
================================================
function detect(){return PE.compareEP("6068........B8........FF1068........50B8........FF1068........6A40FFD08905")?"!EPack"==PE.section[0].Name&&(sVersion="1.0-1.2",bDetected=1):PE.compareEP("9090909061B8........FFE0558BEC60558B75088B7D0CE802000000EB048B1C24C381C3")||PE.compareEP("33C08BC068........68........E8")?(sVersion="1.4 lite final",bDetected=1):".!ep"==PE.section[PE.nLastSection].Name&&(sVersion="1.4",bDetected=1),result()}meta("packer","ExE Pack")

================================================
FILE: dbs_min/db/PE/packer_FSG.2.sg
================================================
function detect(){return PE.compareEP("BE........BF........BB........53BB........B280")?sVersion="1.31":PE.compareEP("BB........BF........BE........53E80A00000002D275058A164612D2")?sVersion="1.0":PE.compareEP("BB........BF........BE........FCB2808A064688074702D275058A16")?sVersion="1.1":PE.compareEP("EB02CD2003..8D..80....00..................EB02")?(sVersion="1.10",sOptions="Watcom C/C++ EXE"):PE.compareEP("80E9A1C1C11368E4167546C1C1055EEB019D6864863746EB028CE05FF7D0")||PE.compareEP("EB0102EB02CD20B8........EB0155BEF400000013DF13D80FB638D1F3F7")?(sVersion="1.10",sOptions="WinRAR-SFX"):PE.compareEP("EB02CD202BC868........EB021EBB5EEB02CD2068B12B6E37405B0FB6C9")?(sVersion="1.10",sOptions="Borland C++ 1999"):PE.compareEP("23CAEB025A0DE8020000006A3558C1C910BE........0FB6C9EB02CD20BB")?(sVersion="1.10",sOptions="Borland C++"):PE.compareEP("2BC2E802000000954A598D3D52F12AE8C1C81CBE2E....18EB02ABA003F7")||PE.compareEP("EB012EEB02A555BB........87FE8D05AACEE063EB0175BA5ECEE063EB02")?(sVersion="1.10",sOptions="Borland Delphi/Borland C++"):PE.compareEP("EB02CD20EB02CD20EB02CD20C1E618BB........EB0282B8EB01108D05F4")?(sVersion="1.10",sOptions="Borland Delphi/Microsoft Visual C++/ASM"):PE.compareEP("C1C810EB010FBF03746677C1E91D6883....77EB02CD205EEB02CD202BF7")||PE.compareEP("1BDBE8020000001A0D5B68........E801000000EA5A58EB02CD2068F400")?(sVersion="1.10",sOptions="Borland Delphi/Microsoft Visual C++"):PE.compareEP("EB0156E802000000B2D9596880..4100E8020000006532595EEB02CD20BB")?(sVersion="1.10",sOptions="Borland Delphi 2.0"):PE.compareEP("F7D80FBEC2BE........0FBEC9BF083B6507EB02D829BBECC59AF8EB0194")?(sVersion="1.10",sOptions="MASM32/TASM32/Microsoft Visual Basic"):PE.compareEP("03F723FE33FBEB02CD20BB........EB0186EB0190B8F400000083EE052B")?(sVersion="1.10",sOptions="MASM32/TASM32"):PE.compareEP("EB01DBE80200000086435E8D1DD075CF83C1EE1D6850..8F83EB023D0F5A")?(sVersion="1.10",sOptions="MASM32"):PE.compareEP("EB0209940FB7FF68........81F68E0000005BEB0211C28D05F400000047")?(sVersion="1.10",sOptions="Microsoft Visual Basic/MASM32"):PE.compareEP("C1CB10EB010FB90374F6EE0FB6D38D0583....EF80F3F62BC1EB01DE6877")?(sVersion="1.10",sOptions="Microsoft Visual Basic 5.0/6.0"):PE.compareEP("2C711BCAEB012AEB01658D3580....0080C98480C968BBF4000000EB01EB")?(sVersion="1.10",sOptions="Microsoft Visual C++ 4.X/LCC Win32 1.X"):PE.compareEP("33D20FBED2EB01C7EB01D88D0580......EB02CD20EB01F8BEF4000000EB")?(sVersion="1.10",sOptions="Microsoft Visual C++ 5.0/6.0"):PE.compareEP("E8010000005A5EE802000000BADD5E03F2EB0164BB........8BFAEB01A8")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/7.0/ASM"):PE.compareEP("0BD08BDAE80200000040A05AEB019DB8........EB02CD2003D38D35F400")||PE.compareEP("87FEE80200000098CC5FBB80....00EB02CD2068F4000000E801000000E3")||PE.compareEP("F7D84049EB02E00A8D3580......0FB6C2EB019C8D1DF4000000EB013C80")||PE.compareEP("F7DB80EABFB92F4067BAEB010168AF..A7BA80EA9D58C1C2092BC18BD768")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/7.0"):PE.compareEP("F7D0EB02CD20BEBB741CFBEB02CD20BF3B....FBC1C10333F7EB02CD2068")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/ASM"):PE.compareEP("03DEEB01F8B8........EB02CD206817A0B3ABEB01E8590FB6DB680BA1B3")||PE.compareEP("91EB02CD20BF50BC046F91BED0....6FEB02CD202BF7EB02F0468D1DF400")||PE.compareEP("C1CE10C1F60F68........2BFA5B23F98D15........E801000000B65E0B")||PE.compareEP("E8010000000E59E8010000005858BE........EB0261E968F4000000C1C8")||PE.compareEP("EB014D83F64C68........EB02CD205BEB012368481C2B3AE80200000038")||PE.compareEP("EB02AB35EB02B5C68D05........C1C211BEF4000000F7DBF7DB0FBE38E8")||PE.compareEP("EB02CD20..CF....80....00................00")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0"):PE.compareEP("C1F007EB02CD20BE........1BC68D1DF40000000FB606EB02CD208A160F")?(sVersion="1.20",sOptions="Borland C++"):PE.compareEP("0FBEC1EB010E8D35C3BEB622F7D16843....22EB02B5155FC1F11533F780")?(sVersion="1.20",sOptions="Borland Delphi/Borland C++"):PE.compareEP("0FB6D0E8010000000C5AB8........EB0200DE8D35F4000000F7D2EB020E")?(sVersion="1.20",sOptions="Borland Delphi/Microsoft Visual C++"):PE.compareEP("33C22CFB8D3D7E45B480E8020000008A45586802..8C7FEB02CD205E80C9")?(sVersion="1.20",sOptions="MASM32/TASM32"):PE.compareEP("EB02CD20EB01918D35........33C26883937E7D0CA45B23C36877937E7D")?(sVersion="1.20",sOptions="Microsoft Visual C++ 6.0/7.0"):PE.compareEP("C1E006EB02CD20EB0127EB0124BE........49EB01998D1DF4000000EB01")?(sVersion="1.20",sOptions="Microsoft Visual C++ 6.0"):PE.compareEP("BB........BF........BE........53BB........B280A4B680FFD373F9")?sVersion="1.31":PE.compareEP("BE........AD93AD97AD5696B280A4B680FF1373")?sVersion="1.33":PE.compareEP("BE........AD97AD569683CD..EB")?sVersion="1.3.3":PE.compareEP("8725........619455A4B6..FF13")&&(sVersion="2.0"),bDetected=bDetected||Boolean(sVersion),result()}meta("packer","FSG")

================================================
FILE: dbs_min/db/PE/packer_Fatpack.2.sg
================================================
function detect(){return!PE.isNet()&&PE.is64()&&PE.isTLSPresent()&&1===PE.getNumberOfImports()&&PE.isImportPositionHashPresent(0,1948535057)&&(bDetected=1,6===PE.getNumberOfSections()&&0<PE.getNumberOfResources()?(sOptions="resources payload",PE.isResourceNamePresent("FPACK")||(sOptions=sOptions.append("modified"))):5===PE.getNumberOfSections()?(sOptions="section payload",".fpack  "!==PE.section[PE.nLastSection].Name&&(sOptions=sOptions.append("modified"))):sVersion="custom"),result()}meta("packer","Fatpack")

================================================
FILE: dbs_min/db/PE/packer_HTML_executable.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3")?PE.compareOverlay("'GHE32'")&&(bDetected=1):PE.compareEP("558becb9........6a..6a..4975..535657b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3")&&PE.compareOverlay("'HEEG'")&&(bDetected=1),sLang="HTML",result()}meta("packer","HTML Executable")

================================================
FILE: dbs_min/db/PE/packer_JDPack.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D8BD581ED........2B95........81EA06......8995........83BD")?(sVersion="1.01",bDetected=1):PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000......E801000000")&&(sVersion="2.00",bDetected=1),result()}meta("packer","JDPack")

================================================
FILE: dbs_min/db/PE/packer_KByS.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005E83EE0A8B0603C28B08894EF383EE0F56528BF0ADAD03C28BD86A04BF00100000")?(sVersion="0.28b",bDetected=1):PE.compareEP("68........E801000000C3C3608B7424248B7C2428FCB28033DBA4")||PE.compareEP("B8........BA........03C2FFE0........60E800000000")?(sVersion="0.28",bDetected=1):PE.compareEP("68........90b8........c3608b7424..8b7c24")&&(sVersion="0.28b",bDetected=1),result()}meta("packer","KByS")

================================================
FILE: dbs_min/db/PE/packer_MEW.2.sg
================================================
function detect(){return PE.compareEP("33C0e9$$$$$$$$be........ac91ad95ad92ad515687f297fcb2..33dba4b3..ff55")?(sVersion="1.0",bDetected=1):PE.compareEP("E9........000000020000000C")?(sVersion="SE 1.0",bDetected=1):PE.compareEP("E9......FF0C")||PE.compareEP("e9$$$$$$$$be........8bdeadad50ad97b2")?(sVersion="SE 1.1-1.2",bDetected=1):PE.compareEP("BE5B00....AD91AD9353AD96565FACC0C0")?bDetected=1:PE.compareEP("2BC0E9D090FFFF6AE0E8382B23700EA31C504018186824511007E565F8E8AF7022DD15D8023B558B00EC535756817D0C1060")&&(sVersion="10 1.0",bDetected=1),result()}meta("packer","MEW")

================================================
FILE: dbs_min/db/PE/packer_MPRESS.2.sg
================================================
function detect(){switch(PE.getString(46,13)){case"It's .NET EXE":case"Win32 .EXE.\r\n":case"Win64 .EXE.\r\n":case"Win32 .DLL.\r\n":case"Win64 .DLL.\r\n":var e=PE.findString(496,16,"v");-1!=e&&(sVersion=PE.getString(e+1,511-e)),bDetected=1
break
default:sOptions="modified"}return bDetected||PE.isNet()||(PE.compareEP("575653515255e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")?(sVersion="0.71-0.75",bDetected=1):PE.compareEP("60e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")?(sVersion="0.77",bDetected=1):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc857498a4439..74..880431eb")?(sVersion="0.85-0.97",bDetected=1):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..74..880431eb")?(sVersion="1.27",bDetected=1):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..88043175")&&(sVersion="2.01-2.12",bDetected=1),PE.is64()&&(PE.compareEP("57565351524150e8$$$$$$$$488d05........488b304803f0482bc0488bfe66adc1e0..488bc8ad2bc84803f18bc8ffc98a4439..74..880431eb")?(sVersion="0.71-0.92",bDetected=1):PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857ffc98a4439..74..880431eb")?(sVersion="0.97",bDetected=1):PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857448bc1ffc98a4439..88043175")&&(sVersion="1.27-2.12",bDetected=1))),result()}meta("packer","MPRESS")

================================================
FILE: dbs_min/db/PE/packer_MoleBox.2.sg
================================================
function detect(){return PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15")||PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$8b4424..508b4424..50e8$$$$$$$$558bec83ec..5356576a..ff15")?(sVersion="2.3.3-2.6.4",bDetected=1):PE.compareEP("60e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15")?(sVersion="2.0.0-2.3.0",bDetected=1):PE.compareEP("eb$$b8........8338..74..50ff70..ff3050830424..e8$$$$$$$$558beca1........53568b75..85c0578bde75..6a..68........68........ff15")&&(sVersion="2.36",bDetected=1),result()}meta("packer","MoleBox")

================================================
FILE: dbs_min/db/PE/packer_Mystic_Compressor.2.sg
================================================
function detect(){return(PE.compareEP("558bec83ec..6a..ff35........6a..ff15........8d55..5268........68........ff15........6a..ff35")||PE.compareEP("558bec83c4..68........ff15........8945..68........ff75..ff15........8945..8d55..526a..68"))&&(bDetected=1),result()}meta("packer","Mystic Compressor")

================================================
FILE: dbs_min/db/PE/packer_NETZ.2.sg
================================================
function detect(){return PE.isNetObjectPresent("NetzStarter")&&PE.isSignatureInSectionPresent(0,"00'NetzStarter'00'netz'00")&&(bDetected=1),result()}meta("packer",".NETZ")

================================================
FILE: dbs_min/db/PE/packer_NOS_Packer.2.sg
================================================
function detect(){return PE.compareEP("50e8000000005b81eb........b9........2bd98bf381eb........8bfb81eb........575156e8........83c4..8bab........8d2c2b4d8a4d..80f9..74..83ed..8bd32b53")&&(bDetected=1),result()}meta("packer","NOS Packer")

================================================
FILE: dbs_min/db/PE/packer_NTPacker.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4E05333C08945E08945E48945E88945ECB8........E8....FFFF33C05568")?(sVersion="1.0",bDetected=1):PE.compareEP("4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00")&&(sVersion="2.0",bDetected=1),result()}meta("packer","NTPacker")

================================================
FILE: dbs_min/db/PE/packer_NTShell.2.sg
================================================
function detect(){return PE.compareEP("55e8........5d81ed........eb$$eb$$8d85........8dbd........eb$$8db5........eb$$8bcfeb$$2bc84ffdeb$$33dbeb$$8a07eb$$d2c8eb$$2a....eb$$E8")&&(sVersion="5.0",bDetected=1),result()}meta("packer","NTSHELL")

================================================
FILE: dbs_min/db/PE/packer_NakedPacker.2.sg
================================================
function detect(){return PE.compareEP("60FC0FB605............7531B8........2B05..............................05........A3........E89A000000A3")?(sVersion="1.0",sOptions="by BigBoote",bDetected=1):PE.isSectionNamePresent(".naked1")&&PE.compareEP("60")&&(bDetected=1),result()}meta("packer","NakedPacker")

================================================
FILE: dbs_min/db/PE/packer_NeoLite.2.sg
================================================
function detect(){return PE.compareEP("8B4424048D5424FC2305........E8........FF35........50FF25")||PE.compareEP("E9$$$$$$$$8B44....2305........E8$$$$$$$$5351525657C8......5081ED........8D..........B8........8B1D")||PE.compareEP("E9")&&(PE.compareEP("'NeoLite'",29)||PE.compareEP("'NeoLite'",33))?(sVersion="1.0",bDetected=1):PE.compareEP("E9A6000000")||PE.compareEP("8B4424042305........50E8........83C404FE05........0BC074")?(sVersion="2.0",bDetected=1):PE.compareEP("e9$$$$$$$$8b4424..8d5424..2e2305........e8........09c074..2eff35")||PE.compareEP("e9$$$$$$$$e9$$$$$$$$8b4424..8d5424..2e2305........e8........09c074..2eff35")?(sVersion="1.01",bDetected=1):PE.compareEP("e9$$$$$$$$e9$$$$$$$$8b4424..8d5424..2305........e8........ff35........50ff25")?bDetected=1:(PE.compareEP("e9$$$$$$$$8b4424..8d5424..2305........e8........ff35........50ff25")||PE.compareEP("e9$$$$$$$$8b4424..2305........e8........fe05........ffe0"))&&(sVersion="2.0",bDetected=1),result()}meta("packer","NeoLite")

================================================
FILE: dbs_min/db/PE/packer_NodeJS_Nexe.2.sg
================================================
function detect(){if(PE.isExportFunctionPresent("napi_wrap"))return bDetected=PE.isOverlayPresent()&&256<=PE.getOverlaySize()&&-1!==PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"nexe~~sentinel"),sLang="JavaScript",result()}meta("packer","nexe")

================================================
FILE: dbs_min/db/PE/packer_NodeJS_Pkg.2.sg
================================================
function detect(){if(PE.isExportFunctionPresent("napi_wrap"))return bDetected=PE.isOverlayPresent()&&256<=PE.getOverlaySize()&&-1!=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"pkg/prelude/bootstrap.js"),sLang="JavaScript",result()}meta("packer","pkg")

================================================
FILE: dbs_min/db/PE/packer_NsPack.2.sg
================================================
function getNSPackVersion(){0<PE.section[0].FileSize&&PE.section[0].FileOffset<512?sVersion="2.X":0==PE.section[0].FileSize&&512<=PE.section[0].FileOffset&&(sVersion="3.X")}function detect(){var e=PE.getNumberOfImportThunks(0)
return 6!=e||PE.getSizeOfCode()||"LoadLibraryA"==PE.getImportFunctionName(0,0)&&"GetProcAddress"==PE.getImportFunctionName(0,1)&&"VirtualProtect"==PE.getImportFunctionName(0,2)&&"VirtualAlloc"==PE.getImportFunctionName(0,3)&&"VirtualFree"==PE.getImportFunctionName(0,4)&&"ExitProcess"==PE.getImportFunctionName(0,5)&&(getNSPackVersion(),bDetected=1),bDetected||(PE.isLibraryPresent("mscoree.dll")&&"KERNEL32.dll"==PE.getImportLibraryName(0)&&"GetSystemInfo"==PE.getImportFunctionName(0,e-1)?(getNSPackVersion(),sOptions=".NET",bDetected=1):PE.isImportPositionHashPresent(0,2249268809)&&PE.isNetObjectPresent("nsnet")?(sVersion="3.X",bDetected=1):PE.compareEP("9c60e8..........83....8d8d........8039..0f..........c601..8bc5")?(sVersion="3.7",bDetected=1):PE.compareEP("9c60e8........5d83ed..8d9d........8a033c..74..8d9d........8a03")?(sVersion="3.1",bDetected=1):PE.compareEP("9c60e8........5d83ed..8d85........8338..0f..........c700........8bd5")?(sVersion="3.6",bDetected=1):PE.compareEP("9c60e8........5d83ed..8d85........8038..0f..........c600..8bd5")?(sVersion="3.5",bDetected=1):PE.compareEP("9c60e8........5db8........2be88db5........8a063c..74..8bf5")?(sVersion="2.9",bDetected=1):PE.compareEP("e9$$$$$$$$e9$$$$$$$$e9$$$$$$$$9c60e8........5db8........2be88db5........8b06")?(sVersion="2.3-2.9",bDetected=1):PE.compareEP("9c60e8........5d83ed..8d85........8038..74..8d85........8038..0f84........c600..8bd5")&&(sVersion="3.3",bDetected=1)),result()}meta("packer","NsPack")

================================================
FILE: dbs_min/db/PE/packer_Nuitka.2.sg
================================================
function detect(){var e,t=PE.section[".rdata"]
return t&&!PE.isRichSignaturePresent()&&(e=t.FileOffset,t=t.FileSize,-1!=PE.findString(e,t,"__nuitka_version__")?bDetected=1:-1!=PE.findString(e,t,"NUITKA_ONEFILE_PARENT")&&(sOptions="OneFile",bDetected=1)),sLang="Python",result()}meta("packer","Nuitka")

================================================
FILE: dbs_min/db/PE/packer_PACKWIN.2.sg
================================================
function detect(){return PE.compareEP("8CC0FA8ED0BC....FB060E1F2E........8BF14E8BFE8CDB2E........8EC3FDF3A453B8....50CB")&&(sVersion="1.01p",bDetected=1),result()}meta("packer","PACKWIN")

================================================
FILE: dbs_min/db/PE/packer_PE-PACK.sg
================================================
function detect(){return PE.compareEP("60E8000000005D83ed..80bd..........0f84........c685..........8bc52b..........89..........89")?(sVersion="0.99",bDetected=1):PE.compareEP("74..E9$$$$$$$$60E8........5D83ED..80............0F84........C685..........8BC52B..........89")&&(sVersion="1.0",bDetected=1),result()}meta("packer","PE-PACK")

================================================
FILE: dbs_min/db/PE/packer_PECompact.2.sg
================================================
function detect(){if(PE.compareEP("EB0668........C39C60BD........B902......B0908DBD........F3AA01AD........FFB5")?(sVersion="0.90-0.92",bDetected=1):PE.compareEP("EB0668........C39C60E8........5D555881ED........2B85........0185........50B902")?(sVersion="0.94",bDetected=1):PE.compareEP("EB$$9C60E8$$$$$$$$8BC483....938BE38B....81EB........87DD8B85........0185........66C785")?(sVersion="1.68-1.84",bDetected=1):PE.compareEP("eb$$9c60e8$$$$$$$$83c4..8b4424..50505b5d81ed........8b85........0185........66c785")||PE.compareEP("eb$$9c60e8$$$$$$$$5d555b81ed........8b85........0185........66c785")?(sVersion="1.00-1.3X",bDetected=1):PE.compareEP("33C08BC483C004938BE38B5BFC81")?(sVersion="1.84",bDetected=1):PE.compareEP("B8........05........5064FF350000000064892500000000CC90909090")?(sVersion="2.0 beta",bDetected=1):PE.compareEP("B8........80002840")?(sVersion="2.X beta version",bDetected=1):PE.compareEP("B8........5064FF35000000006489250000000033C08908'PECompact2'00")?(sVersion="3.02.2 or 3.03.21 beta",bDetected=1):PE.compareEP("B8........5064FF..........6489..........33C08908")?(sVersion="2.20-3.02",bDetected=1):PE.compareEP("B8........5064FF35000000006489250000000033C08908'PEC'")?(sVersion="2.X",PE.compareEP("32",27)&&(sOptions="Slim Loader"),bDetected=1):PE.compareEP("B8........5553515756528D98........8B5318528BE86A406800100000FF7304")?(sVersion="2.53-2.76",bDetected=1):PE.compareEP("B8........5064ff35........648925........33c0890800000000")?(sVersion="2.78a-3.11",bDetected=1):PE.compareEP("b8########b8........5553515756528d98")&&(bDetected=1),bDetected){var e=PE.findString(0,1536,"PEC2")
if(-1!=e){var s=PE.readDword(e+4)
switch(s){case 20206:sVersion="2.70"
break
case 20240:sVersion="2.78a"
break
case 20243:sVersion="2.79b1"
break
case 20245:sVersion="2.79bB"
break
case 20247:sVersion="2.79bD"
break
case 20252:sVersion="2.80b1"
break
case 20256:sVersion="2.80b5"
break
case 20261:sVersion="2.82"
break
case 20285:sVersion="2.92.0"
break
case 20288:sVersion="2.93b3"
break
case 20294:sVersion="2.96.2"
break
case 20295:sVersion="2.97b1"
break
case 20296:sVersion="2.98"
break
case 20300:sVersion="2.98.04"
break
case 20301:sVersion="2.98.05"
break
case 20302:sVersion="2.98.06"
break
case 20303:sVersion="2.99b"
break
case 20308:sVersion="3.00.2"
break
case 20312:sVersion="3.01.3"
break
case 20317:sVersion="3.02.1"
break
case 20318:sVersion="3.02.2"
break
case 20323:sVersion="3.03.5b"
break
case 20327:sVersion="3.03.9b"
break
case 20329:sVersion="3.03.10b"
break
case 20334:sVersion="3.03.12b"
break
case 20342:sVersion="3.03.18b"
break
case 20343:sVersion="3.03.19b"
break
case 20344:sVersion="3.03.20b"
break
case 20345:sVersion="3.03.21b"
break
case 20348:sVersion="3.03.23b"
break
default:s&&X.isVerbose()&&(sOptions="unknown magic: "+s)}}}else PE.isNet()&&(PE.isSignaturePresent(0,512,"00'PEC2XO'000000000000..0000..'.rsrc'00")||PE.isSignatureInSectionPresent(0,"'mscoree.dll'000000'CorBindToRuntimeEx'"))&&(sVersion="2.X-3.X",sOptions=".NET",bDetected=1)
return result()}meta("packer","PECompact")

================================================
FILE: dbs_min/db/PE/packer_PKLITE.2.sg
================================================
function detect(){return(PE.compareEP("68........68........68........e8$$$$$$$$558beca1")||PE.compareEP("68........68........B8........2b4424..50e8$$$$$$$$558beca1"))&&(sVersion="1.1",bDetected=1),result()}meta("packer","PKLITE32")

================================================
FILE: dbs_min/db/PE/packer_Pack_Master.2.sg
================================================
function detect(){return PE.compareEP("60E801000000E883C404E801000000E95D81ED........E804020000E8EB08EB02CD20FF24249A66BE4746")&&(sVersion="1.0",bDetected=1),result()}meta("packer","Pack Master")

================================================
FILE: dbs_min/db/PE/packer_Packanoid.2.sg
================================================
function detect(){return PE.compareEP("BF........BE........E89D000000B8........8B308B7804BB")&&(sVersion="1.0",bDetected=1),result()}meta("packer","Packanoid")

================================================
FILE: dbs_min/db/PE/packer_Packman.2.sg
================================================
function detect(){return PE.compareEP("0F85..FFFFFF8DB3........EB3D8B460C03C350FF5500568B36")||PE.compareEP("60E800000000588D..........8D..........8D")?(sVersion="0.0.0.1",bDetected=1):PE.compareEP("60E8000000005B8D5BC6011B8B138D73146A08590116AD4975FA")&&(sVersion="1.0",bDetected=1),result()}meta("packer","Packman")

================================================
FILE: dbs_min/db/PE/packer_PeX.2.sg
================================================
function detect(){return PE.compareEP("E9$$$$$$$$60e8$$$$$$$$83c404e8")&&(sVersion="0.99",bDetected=1),result()}meta("packer","PeX")

================================================
FILE: dbs_min/db/PE/packer_Petite.2.sg
================================================
function detect(){return PE.compareEP("9C60E8CA......03..04..05..06..07..08")||PE.compareEP("669C60E8$$$$$$$$582c..508bc88bd081c1........81c2........89208be15081")?(sVersion="1.2",bDetected=1):PE.compareEP("669C60508D8800F000008D90041600008BDC8BE1")?(sVersion="1.3",bDetected=1):PE.compareEP("669C60508BD803006854BC00006A00FF50148BCC")?(sVersion="1.4",bDetected=1):PE.compareEP("64FF350000000064892500000000669C60508BD8")?(sVersion="2.1-2.3",bDetected=1):PE.compareEP("B8........669C60508D..........68........83")?bDetected=1:PE.compareEP("B8........669C60508D88........8d90........8bdc8be168")?(sVersion="1.3, 1.3a",bDetected=1):PE.compareEP("B8........6A..68........64FF35........648925........669C6050")?(sVersion="2.1",bDetected=1):PE.compareEP("B8........68........64FF35........648925........669C6050")||PE.compareEP("b8........669c605033db8d90........68........833a..0f84........8b0a")?(sVersion="2.2",bDetected=1):PE.compareEP("b8........669c60508bd803..68........6a..ff50")?(sVersion="1.4-2.2",bDetected=1):PE.compareEP("B8........608DA8........68........6A40680030000068........6A00FF90........8944241CBB........8DB5........8BF850")&&(sVersion="2.X",bDetected=1),result()}meta("packer","Petite")

================================================
FILE: dbs_min/db/PE/packer_PyInstaller.2.sg
================================================
function detect(){if(!PE.isNet()){var e,t=PE.compareOverlay("78da")
t&&(e=PE.section[".rdata"])&&-1!=PE.findString(e.FileOffset,e.FileSize,"PyInstaller: FormatMessageW failed.")&&(bDetected=1)
for(var a,r=0;r<PE.getNumberOfResources()&&!bDetected;r++){var i=PE.getResourceSizeByNumber(r);(37019==i&&"20d36c0a435caad0ae75d3e5f474650c"==PE.calculateMD5(PE.getResourceOffsetByNumber(r),i)||38188==i&&"f6fbada22d6a6c07ef8fdaa504f117d5"==PE.calculateMD5(PE.getResourceOffsetByNumber(r),i))&&(sOptions=t?PE.section[".rdata"]?"modified":"packed":"custom",bDetected=1)}if(!bDetected&&t&&-1!=PE.findSignature(PE.getOverlayOffset(),PE.getOverlaySize(),"4d45490c0b0a0b0e")&&(sOptions="overlay",bDetected=1),bDetected)for(r=0;r<2&&!a;r++){var c=PE.findSignature(PE.getOverlayOffset(),PE.getOverlaySize(),"70 79 74 68 6F 6E'"+[2,3][r]+"'")
c&&-1!=PE.findString(c,15,".")&&(a=getPythonVersionByDll(PE.getString(c-1,15)))}return sLang="Python",sLangVersion=a,result()}}meta("packer","PyInstaller"),includeScript("python")

================================================
FILE: dbs_min/db/PE/packer_QuestPowerGUI.2.sg
================================================
function detect(){return bDetected=PE.isNetObjectPresent("Quest.PowerGUI.ScriptRunner"),sOptions=bDetected&&!PE.isConsole()?"Hide console":"",sLang="PowerShell",result()}meta("packer","Quest PowerGUI")

================================================
FILE: dbs_min/db/PE/packer_RLPack.2.sg
================================================
function detect(){var e=PE.compareEP("807C2408010F85")?11:0
return PE.compareEP("608BDDE8000000005D9532C095899D80000000B8",e)?(sVersion="0.7.3 beta",bDetected=1):PE.compareEP("60E8000000008D6424048B6C24FC8DB5........8D9D........33FF",e)?(sVersion="1.0 beta",bDetected=1):PE.compareEP("60E8000000008B2C2483C404",e)?(PE.compareEP("33FFEB",24+e)?(sVersion="1.11-1.14",sOptions="aPlib"):PE.compareEP("33FF6A",24+e)?(sVersion="1.11-1.14",sOptions="LZMA"):PE.compareEP("0000EB",29+e)?(sVersion="1.15-1.18",sOptions="aPlib"):PE.compareEP("00006A",29+e)?(sVersion="1.15-1.18",sOptions="LZMA"):PE.compareEP("33FFE8",55+e)?(sVersion="1.19-1.20",sOptions="aPlib"):PE.compareEP("33FF6A",55+e)?(sVersion="1.19-1.20",sOptions="LZMA"):PE.compareEP("EB0FFF",56+e)?(sVersion="1.17 Full Edition",sOptions="aPLib"):PE.compareEP("6A4068",51+e)?(sVersion="1.17 Full Edition",sOptions="LZMA"):PE.compareEP("33ffe8",60+e)&&(sVersion="1.21",sOptions="aPLib"),bDetected=1):1===PE.getNumberOfImports()&&PE.compareEP("60")&&PE.isSectionNamePresent(".RLPack")&&(bDetected=1),result()}meta("packer","RLPack")

================================================
FILE: dbs_min/db/PE/packer_SC_Pack.2.sg
================================================
function detect(){return PE.compareEP("558bec83c4..5356578d7d..50e8........5825........05........8945")&&(sVersion="0.2",bDetected=1),result()}meta("packer","SC Pack")

================================================
FILE: dbs_min/db/PE/packer_SecuPack.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4F053565733C08945F0B8CC3A4000E8E0FCFFFF33C05568EA3C400064FF306489206A0068800000006A036A006A")&&(sVersion="1.5",sOptions="Soft Stuttgart",bDetected=1),result()}meta("packer","SecuPack")

================================================
FILE: dbs_min/db/PE/packer_SerGreen_Appacker.2.sg
================================================
function detect(){return PE.isNet()&&PE.compareOverlay("'<SerGreen>'")&&(sVersion="1.XX",bDetected=1),result()}meta("packer","SerGreen Appacker")

================================================
FILE: dbs_min/db/PE/packer_SimplePackerByEronana.2.sg
================================================
function detect(){return PE.isSectionNamePresent(".packer")&&PE.compareEP("60 68 00 ?? ?? ?? E8 17 FC FF FF 89 45 FC 61 FF 65 FC 00 00 00 00 00 00 00 00 00")&&(bDetected=1),result()}meta("packer","Eronana")

================================================
FILE: dbs_min/db/PE/packer_Simple_Pack.2.sg
================================================
function detect(){return PE.compareEP("60e8$$$$$$$$5b8d5b..6a..ff93........89c58b7d..8d74....8dbe........8b86........09c075..8d83........506a..68........55ff93")?(sVersion="1.0",bDetected=1):PE.compareEP("60e8$$$$$$$$5b8d5b..bd........8b7d..8d74....8dbe........0fb776..4e8b47..09c074..0fb747..09c074..6a..68........ff77..6a..ff93")?(sVersion="1.2X",bDetected=1):(PE.compareEP("6050")||PE.compareEP("55"))&&PE.isSectionNamePresent(".spack")&&(bDetected=1),result()}meta("packer","Simple Pack")

================================================
FILE: dbs_min/db/PE/packer_Software_Compress.2.sg
================================================
function detect(){return PE.compareEP("E9BE000000608B7424248B7C2428FCB28033DBA4B302E86D0000")?(sVersion="1.2",bDetected=1):PE.compareEP("E800000000812C24AA1A41005DE800000000832C246E8B855D1A4100")&&(sVersion="1.4 LITE",bDetected=1),result()}meta("packer","Software Compress")

================================================
FILE: dbs_min/db/PE/packer_Squishy.2.sg
================================================
function detect(){return PE.isSectionNamePresent("logicoma")&&(bDetected=1),result()}meta("packer","Squishy")

================================================
FILE: dbs_min/db/PE/packer_TPP_Pack.2.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$5d81ed........60e8$$$$$$$$5883c0..ffe0")&&(bDetected=1),result()}meta("packer","TPP Pack")

================================================
FILE: dbs_min/db/PE/packer_TheArk.2.sg
================================================
function detect(){return PE.isSectionNamePresent("adr")&&PE.isSectionNamePresent("have")&&PE.isSectionNamePresent("30cm")&&PE.isSectionNamePresent(".tw")&&(bDetected=1),result()}meta("packer","TheArk")

================================================
FILE: dbs_min/db/PE/packer_UPX.2.sg
================================================
function isPatchedUPX(){var e,t=0,i=PE.getNumberOfImportThunks(0)
return t=1<i&&i<7&&PE.getSizeOfCode()&&PE.getSizeOfUninitializedData()&&2<PE.section.length&&0==PE.section[0].FileSize&&(e=0,"LoadLibraryA"==PE.getImportFunctionName(0,0)&&e++,"GetProcAddress"==PE.getImportFunctionName(0,1)&&e++,4==i&&("VirtualProtect"==PE.getImportFunctionName(0,2)&&e++,"ExitProcess"==PE.getImportFunctionName(0,3))&&e++,3<=i&&e<4&&("ExitProcess"==PE.getImportFunctionName(0,2)||PE.isDll()&&"VirtualProtect"==PE.getImportFunctionName(0,2))&&e++,6==i&&("VirtualProtect"==PE.getImportFunctionName(0,2)&&e++,"VirtualAlloc"==PE.getImportFunctionName(0,3)&&e++,"VirtualFree"==PE.getImportFunctionName(0,4)&&e++,"ExitProcess"==PE.getImportFunctionName(0,5))&&e++,t=2==e&&2==i||3==e&&3<=i||4==e&&4==i||6==e&&6==i||t)&&4120==PE.getAddressOfEntryPoint()?!1:t}function getUPXOptions(e){var t=PE.readByte(e+2),e=PE.readByte(e+3),i=""
switch(t){case 2:case 3:case 4:case 5:case 6:case 7:case 8:case 9:case 10:i="NRV"
break
case 14:i="LZMA"
break
case 15:i="zlib"}i&&(sOptions=sOptions.append(i),sOptions=8==e?sOptions.append("best"):sOptions.append("brute"))}function getUPXVersion(){var e=PE.findString(0,1024,"$Id: UPX "),t=PE.findString(0,1024,"UPX!");-1!=t&&getUPXOptions(t+4),(sVersion=(sVersion=-1!=e?PE.getString(e+9,4):sVersion)||-1==t?sVersion:PE.getString(t-5,4))&&+sVersion.toString()!=sVersion&&(sVersion=PE.is64()?"3.91+":"0.89+",sOptions="modified")}function detect(){if(!PE.isNet())return PE.is64()?PE.compareEP("53565755488D35........488DBE........57",PE.compareEP("4889")?24:0)&&(bDetected=1):PE.compareEP("60BE........8DBE........57",PE.compareEP("807C")?27:0)?bDetected=1:PE.compareEP("60e8000000005883e8..508db8........578db0........83cd..31db9090909001db75")&&(sVersion="0.70",bDetected=1),getUPXVersion(),(bDetected=sVersion?!0:bDetected)?sVersion?PE.isSectionNamePresent("UPX0")||(sOptions=sOptions.append("modified")):(PE.is64()&&(sVersion="3.91+"),sOptions="modified"):bDetected=isPatchedUPX(),result()}meta("packer","UPX")

================================================
FILE: dbs_min/db/PE/packer_VPacker.2.sg
================================================
function detect(){return PE.compareEP("60e8$$$$$$$$558bec83c4..5356578b45..83c0..8b008945..837d....75..e8........8945..e8........8b10")&&(sVersion="0.02.10",bDetected=1),result()}meta("packer","VPacker")

================================================
FILE: dbs_min/db/PE/packer_VbsToExeConverter.2.sg
================================================
function detect(){return PE.isImportPositionHashPresent(0,405449832)&&PE.compareEP(PE.is64()?"48 83 EC .. 49 C7 C0 .. .. .. .. 48 31 D2 48 B9 .. .. .. .. .. .. .. .. E8 .. .. .. .. 48 31 C9 E8 .. .. .. .. 48 89 05 .. .. .. ..":"68 .. .. .. .. 68 .. .. .. .. 68 .. .. .. .. E8 .. .. .. .. 83 C4 .. 68 .. .. .. .. E8 .. .. .. .. A3 .. .. .. ..")&&(bDetected=1),sLang="VBScript",result()}meta("packer","Vbs To Exe Converter")

================================================
FILE: dbs_min/db/PE/packer_WWPack32.2.sg
================================================
function detect(){return PE.compareEP("53558be833dbeb$$e8000000005d3e807d....0f84........6083ed..33c033c9")?(sVersion="1.XX",bDetected=1):PE.isDll()&&".WWP32"===PE.section[PE.nLastSection].Name&&(bDetected=1),result()}meta("packer","WWPack32")

================================================
FILE: dbs_min/db/PE/packer_WinUpack.2.sg
================================================
function detect(){if(PE.compareEP("BE........AD8BF895A533C033"))sVersion="0.1X/0.20/0.21/0.24 beta"
else if(PE.compareEP("BE........AD8BF86A0495A533C0AB"))sVersion="0.21 beta"
else if(PE.compareEP("BE........AD8BF895AD91F3A5ADB5"))sVersion="0.24-0.27 beta/0.28 alpha"
else if(PE.compareEP("BE........AD50FF7634EB7C4801"))switch(PE.readByte(PE.getEntryPointOffset()+62)){case 55:sVersion="0.37 beta"
break
case 56:sVersion="0.38 beta"
break
case 57:sVersion="0.39 final"
break
case 58:sVersion="0.399"}else PE.compareEP("6A07BE........AD8BF85995F3A5")?sVersion="0.22/0.23 beta":PE.compareEP("BE........AD50..AD91F3A5")?(sVersion="0.32 beta",sOptions="Patch"):PE.compareEP("BE........AD50..AD91..F3A5")||PE.compareEP("BE........AD50....AD91F3A5")?sVersion="0.32 beta":PE.compareEP("BE........AD50AD5066BE....6A..BF")?sVersion="0.34":PE.compareEP("BE........FF36E9C3000000")?sVersion="0.36 beta":PE.compareEP("60E809000000..................33C95E870E")?sOptions="Alt stub":PE.compare("4D5A4C6F61644C696272617279410000504500004C0102004B45524E454C3332")?sVersion="0.33":PE.compare("4D5A4B45524E454C33322E444C4C00004C6F61644C696272617279410000000047657450726F63416464726573730000")?sVersion="0.32":PE.compare("4D5A4B45524E454C33322E444C4C00005045")&&(bDetected=1)
return bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),result()}meta("packer","(Win)Upack")

================================================
FILE: dbs_min/db/PE/packer_Windows_PE_Packer_by_Chenzs108.2.sg
================================================
function detect(){var e
return!PE.is64()&&!PE.isNet()&&2<PE.getNumberOfSections()&&1===PE.getNumberOfImports()&&PE.isImportPositionHashPresent(0,309523547)&&PE.compareEP("60E8E10000002E0002000000000000")&&3758096448&(e=PE.section[PE.nLastSection]).Characteristics&&(bDetected=1,".shell"!==e.Name&&(sOptions="modified sections"),"Kernel32.dll"!==PE.getImportLibraryName(0))&&(sOptions+=(sOptions?" and ":"modified ")+"IAT"),result()}meta("packer","Windows PE Packer by Chenzs108")

================================================
FILE: dbs_min/db/PE/packer_XComp.2.sg
================================================
function detect(){return 1==PE.getNumberOfImports()&&PE.isImportPositionHashPresent(0,1271213687)&&PE.compareEP("68........9C60E8$$$$$$$$E8$$$$$$$$5B5D833B00")&&(bDetected=1),result()}meta("packer","XComp")

================================================
FILE: dbs_min/db/PE/packer_XPack.2.sg
================================================
function detect(){return 1==PE.getNumberOfImports()&&PE.isImportPositionHashPresent(0,1813449395)&&PE.compareEP("68........9C60E8$$$$$$$$E8$$$$$$$$5B5D833B00")&&(bDetected=1),result()}meta("packer","XPack")

================================================
FILE: dbs_min/db/PE/packer_aPack.2.sg
================================================
function detect(){return PE.compareEP("1E068CC88ED8......8EC050BE....33FFFCB6")?(sVersion="0.62",bDetected=1):PE.compareEP("1E068CCBBA....03DA8D......FC33F633FF484B8EC08EDB")?(sVersion="0.82",bDetected=1):PE.compareEP("1E068CC88ED805....8EC050BE....33FFFCB2..BD....33C950A4BB....3BF376")?(sVersion="0.98",sOptions="-m",bDetected=1):(PE.compareEP("8CCBBA....03DAFC33F633FF4B8EDB8D......8EC0B9....F3A54A75")||PE.compareEP("93071F05....8ED0BC....EA"))&&(sVersion="0.98b",bDetected=1),result()}meta("packer","aPack")

================================================
FILE: dbs_min/db/PE/packer_dePACK.2.sg
================================================
function detect(){return(PE.compareEP("eb$$6068........68........e8$$$$$$$$558bec60558b75..8b7d..e8........eb..8b1c24c3")||PE.compareEP("eb$$6090eb$$61b8........ffe0"))&&(bDetected=1),result()}meta("packer","dePack")

================================================
FILE: dbs_min/db/PE/packer_ezip.2.sg
================================================
function detect(){return PE.isOverlayPresent()&&PE.compareEP("E919320000E97C2A0000E919240000E9FF230000E91E2E0000E9882E0000E92C250000E9AE150000E9772B0000E987020000E9702E")&&(bDetected=1,sVersion="1.X"),result()}meta("packer","ezip")

================================================
FILE: dbs_min/db/PE/packer_hXOR.2.sg
================================================
function detect(){return PE.compareEP("5589e583ec18c7042402000000ff1538424100e8f8feffff908db426000000005589e583ec18c7042401000000ff1538424100e8d8feffff908db426000000005589e55383ec148b45088b008b003d")&&(sVersion="0.1",bDetected=1),result()}meta("packer","hXOR")

================================================
FILE: dbs_min/db/PE/packer_hmimys_PE-Pack.2.sg
================================================
function detect(){return PE.compareEP("E8000000005D83ED056A00FF95E10E00008985850E00008B583C03D881C3F8000000")?(sVersion="0.1",bDetected=1):PE.compareEP("5E83C664AD50AD5083EE6CAD50AD50AD50AD50AD50E8E707")?(sVersion="1.0",bDetected=1):PE.compareEP("E8$$$$$$$$5EAD50AD5097AD50AD50AD50E8C0010000AD50AD9387DEB9")?(sVersion="1.2",bDetected=1):PE.isSectionNamePresent("hmimys")&&PE.compareEP("E8")&&(sVersion="1.3",bDetected=1),result()}meta("packer","hmimys PE-Pack")

================================================
FILE: dbs_min/db/PE/packer_kkrunchy.2.sg
================================================
function detect(){return PE.compareEP("BD........C745..........B8........89450489455450C74510")?(sVersion="0.23 alpha 2",bDetected=1):PE.compareEP("BD........C745..........FF4D08C6450C058D7D1431C0B40489C1F3ABBF")?(sVersion="0.2X",bDetected=1):(PE.compareEP("bd........c7............fcff4d0831d28d7d30be")||PE.compare("'MZfarbrauschPE'"))&&(bDetected=1),bDetected&&!PE.isSectionNamePresent("kkrunchy")&&(sOptions="modified"),result()}meta("packer","kkrunchy")

================================================
FILE: dbs_min/db/PE/packer_mPack.2.sg
================================================
function detect(){return PE.compareEP("E90000000060E8140000005D81ED000000006A45E8A30000006800000000E85861E8AA0000004E")?(sVersion="0.0.2",bDetected=1):PE.compareEP("558BEC83....33C08945F0B8........E867C4FFFF33C05568........64FF306489208D55F033C0E893C8FFFF")&&(sVersion="0.0.3",bDetected=1),result()}meta("packer","mPack")

================================================
FILE: dbs_min/db/PE/packer_mkfPack.2.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$5b81eb........8b93........536a..68........526a..ff93........5b8bf08bbb........03fb5657e8........83c4..8d93........5253ffe6")&&(bDetected=1),result()}meta("packer","mkfPack")

================================================
FILE: dbs_min/db/PE/packer_nPack.2.sg
================================================
function detect(){if(PE.compareEP("833D..........7505E901000000C3E841000000B8........2B05........A3........E85E000000E8")){switch(PE.getEntryPointSignature(42,7)){case"E0010000E8EC06":sVersion="1.1.150.2006.Beta"
break
case"EC010000E8F806":sVersion="1.1.200.2006.Beta"
break
default:sVersion="1.1.XXX"}bDetected=1}else if(PE.compareEP("833D..........7505E901000000C3E846000000E873000000B8........2B05........A3........E89C000000E8")){switch(PE.readDword(PE.getEntryPointOffset()+47)){case 516:sVersion="1.1.250.2006.Beta"
break
case 557:sVersion="1.1.300.2006.Beta"
break
case 584:sVersion="1.1.800.2008.Beta"
break
default:sVersion="1.1.XXX"}bDetected=1}else PE.compareEP("833C24..0F84........8D6424")&&PE.isImportPositionHashPresent(0,3129734334)&&(bDetected=1)
return bDetected&&!PE.isSectionNamePresent(".nPack")&&(sOptions="modified"),result()}meta("packer","nPack")

================================================
FILE: dbs_min/db/PE/packer_netshrink.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"20fe2b136028........13..203b28136028........13..11..11..161f4028........26")||PE.isSignatureInSectionPresent(0,"20ad65133228........13..206866133228........13..11..11..161f4028........26")?(sVersion="2.01 Demo",sOptions="Encrypted/Password mode",bDetected=1):(PE.isSignatureInSectionPresent(0,"20b9059f0728........13..2066059f0728........13..11..11..161f4028........26")||PE.isSignatureInSectionPresent(0,"20e6ea19be28........13..2039ea19be28........13..11..11..161f4028........26"))&&(sVersion="2.01 Demo",bDetected=1)),result()}meta("packer",".netshrink")

================================================
FILE: dbs_min/db/PE/packer_ps2exe.2.sg
================================================
function detect(){return bDetected=PE.isNetUStringPresent("^-([^: ]+)[ :]?([^:]*)$"),sLang="PowerShell",result()}meta("packer","PS2EXE")

================================================
FILE: dbs_min/db/PE/packer_py2exe.2.sg
================================================
function detect(){for(var e=0;e<PE.getNumberOfResources();e++)if(PE.compare("12345678",PE.resource[e].Offset)){bDetected=1
break}return sLang="Python",result()}meta("packer","py2exe")

================================================
FILE: dbs_min/db/PE/packer_scr2exe.2.sg
================================================
function detect(){var e=PE.section[".rdata"]
return!PE.is64()&&PE.compareEP("E8........E9........8BFF558BEC83EC..5356")&&e&&-1!=PE.findString(e.FileOffset,e.FileSize,"Video created by SCREEN2EXE/SCREEN2SWF")&&(sVersion=PE.getFileVersion().split(", ").join("."),bDetected=1),result()}meta("packer","SCREEN2EXE/SCREEN2SWF")

================================================
FILE: dbs_min/db/PE/packer_yzPack.2.sg
================================================
function detect(){return PE.compareEP("6033C08D480750E2FD8BEC648B4030780C8B400C")?(sVersion="1.0-1.1",bDetected=1):PE.compareEP("4D5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")?(sVersion="1.2",bDetected=1):PE.compareEP("5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")?(sVersion="1.12",bDetected=1):PE.compareEP("25........6187CC5545455581EDCA00000055A4B302FF142473F833C9FF1424731833C0FF1424731FB3")&&(sVersion="2.0",bDetected=1),result()}meta("packer","yzPack")

================================================
FILE: dbs_min/db/PE/patcher_CodeFusion_Wizard.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..535657e8........e8........33c05568........64ff30648920e8........e8........a3........833d")&&PE.compareOverlay("'@._P-DATA_.@'")&&(bDetected=1),result()}meta("patcher","CodeFusion Wizard")

================================================
FILE: dbs_min/db/PE/patcher_PMaker.1.sg
================================================
function detect(){return PE.compareEP("68........e8........6a..e8........a3........8b58..03d80fb743..0fb74b..8d7c18..813f........74..83c7")&&(sVersion="0.9",bDetected=1),result()}meta("patcher","PMAKER")

================================================
FILE: dbs_min/db/PE/patcher_RPP.1.sg
================================================
function detect(){return PE.compareEP("68........c705................68........68........6a..6a..6a..6a..6a..6a..6a..68........e8")&&(sVersion="1.X",sOptions="by R!SC",bDetected=1),result()}meta("patcher","R!SC Process Patcher")

================================================
FILE: dbs_min/db/PE/patcher_RTPatch.1.sg
================================================
function detect(){return(PE.compareOverlay("4B2A9A")||PE.compareOverlay("4B2A84"))&&PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&(sVersion="10.50",bDetected=1),result()}meta("patcher","RTPatch")

================================================
FILE: dbs_min/db/PE/patcher_dUP.1.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68")&&0<PE.getNumberOfResources()&&(nOffset=PE.getResourceNameOffset("DLL"),PE.compare("a2",nOffset))&&(sVersion="2.0",bDetected=1),result()}meta("patcher","dUP diablo2oo2's Universal Patcher")

================================================
FILE: dbs_min/db/PE/patcher_simple_patch.1.sg
================================================
function detect(){return(PE.compareEP("33c040c2")||PE.compareEP("33c0c3")||PE.compareEP("b801000000c2"))&&(bDetected=1),result()}meta("patcher","simple patch")

================================================
FILE: dbs_min/db/PE/player_Power_Screen_Recorder.1.sg
================================================
function detect(){return PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8")&&-1!=PE.findSignature(PE.getSize()-1280,1280,"'xzjtlx'")&&(sVersion="6.X-7.X",sOptions="by www.tlxsoft.com",bDetected=1),result()}meta("player","Power Screen Recorder")

================================================
FILE: dbs_min/db/PE/protection_BattlEye.5.sg
================================================
function detect(){return".be"===PE.getSectionNameCollision("0","1")&&(PE.isLibraryPresentExp(/ntdll/)||PE.isFunctionPresent("CryptCATAdminAcquireContext"))&&PE.isSigned()&&(bDetected=1,PE.isSignaturePresent(0,PE.getSize()-PE.getOverlaySize(),"'https://cdn.battleye.com/%S/%s/%s'"))&&(sVersion="Launcher"),result()}meta("protection","BattlEye")

================================================
FILE: dbs_min/db/PE/protection_DS.Eutron_SmartKey_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
if(5e7<e&&(e=5e7),-1!==PE.findString(0,e,"skeydrv.dll"))bDetected=1
else for(var r,t=0;-1!==(r=PE.findString(t,e-t,"\\.\\"));)if(t=r+4,PE.compare("'eusk2'",t)||PE.compare("'Skey-'",t)||PE.compare("'SkeyDev'",t)){bDetected=1
break}return result()}meta("protection","Eutron SmartKey dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.HASP_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1!=PE.findString(0,e,"HASPDOSDRV")||-1!=PE.findString(0,e,"HASPUT16.DLL")?bDetected=1:(PE.isLibraryPresent("MSVBVM60.DLL")||PE.isLibraryPresent("MSVBVM50.DLL"))&&-1!==PE.findString(0,e,"haspvb32.dll")&&(sVersion="Visual Basic",bDetected=1),result()}meta("protection","HASP dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.Hardlock_dongle.5.sg
================================================
function detect(){for(var e,r=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize(),t=(5e7<r&&(r=5e7),0);-1!==(e=PE.findString(t,r-t,"\\.\\"));)if(t=e+4,PE.compare("'HARDLOCK.VXD'",t)||PE.compare("'FEnteDev'",t)){bDetected=1
break}return result()}meta("protection","Hardlock dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.MARX_Crypto-Box_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
if(5e7<e&&(e=5e7),-1!==PE.findString(0,e,"MARXDEV1.SYS"))bDetected=1
else for(var r,t=0;;){if(-1===(r=PE.findString(t,e-t,"\\.\\")))break
if(t=r+4,PE.compare("'MARXDEV'",t)||PE.compare("'Cb7Dev'",t)||PE.compare("'CB7'",t)||PE.compare("'CBUSB'",t)){bDetected=1
break}}return result()}meta("protection","MARX Crypto-Box dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.Matrix_Hardware_Lock_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1===PE.findString(0,e,"MxLPT_Sem")&&-1===PE.findString(0,e,"MxUSB_Sem")||(bDetected=1),result()}meta("protection","Matrix Hardware Lock dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.NetHASP_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1===PE.findString(0,e,"NETHASP_00112233445566zz")&&-1===PE.findString(0,e,"nethasp.ini")||(bDetected=1),result()}meta("protection","NetHASP dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.SenseLock_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1===PE.findString(0,e,"sense4.dll")&&-1===PE.findString(0,e,"S4Open")||(bDetected=1),result()}meta("protection","SenseLock dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.Sentinel_SuperPro_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1!==PE.findString(0,e,"RNBOspro")&&(bDetected=1),result()}meta("protection","Sentinel SuperPro dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.Sentinel_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
if(5e7<e&&(e=5e7),-1!==PE.findString(0,e,"SNTNLUSB"))bDetected=1
else for(var t,r=0;;){if(-1===(t=PE.findString(r,e-r,"\\.\\")))break
if(r=t+4,PE.compare("'SENTINEL.VXD'",r)||PE.compare("'SntnlUsb'",r)){bDetected=1
break}}return result()}meta("protection","Rainbow Sentinel dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.SoftLok_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1===PE.findSignature(0,e,"5c5c2e5c'MNXX'")&&-1===PE.findSignature(0,e,"5c5c2e5c'SoftLok'")||(bDetected=1),result()}meta("protection","SoftLok dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.Unikey_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
if(5e7<e&&(e=5e7),-1!==PE.findString(0,e,"SSIVDDP.DLL")||-1!==PE.findSignature(0,e,"5C004400650076006900630065005C005300530049005000440044005000"))bDetected=1
else for(var t,r=0;;){if(-1===(t=PE.findString(r,e-r,"\\.\\")))break
if(r=t+4,PE.compare("'SSIPDDP'",r)||PE.compare("'PIPE\\SSINetPipe'",r)){bDetected=1
break}}return result()}meta("protection","Unikey/Activator dongle reference")

================================================
FILE: dbs_min/db/PE/protection_DS.WIBU_Key_dongle.5.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize()
return 5e7<e&&(e=5e7),-1===PE.findString(0,e,"WIBUKEY")&&-1===PE.findString(0,e,"WkWin32.dll")&&-1===PE.findString(0,e,"WKWIN32.DLL")||(bDetected=1),result()}meta("protection","WIBU Key dongle reference")

================================================
FILE: dbs_min/db/PE/protection_HASP_HL_Protection.5.sg
================================================
function detect(){return PE.is64()?PE.compareEP("5750569C53515241504151488D05........488B304803F0482BC0488BFE66AD")&&(sVersion="1.X",sOptions="SRM",bDetected=1):PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........74..8b0d........51ff15")?(sVersion="4.X",sOptions="HL",bDetected=1):PE.compareEP("57565351E801000000..5805........508B3003F02BC08BFE66AD")?(sVersion="1.X",sOptions="SRM",bDetected=1):PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........0f84........a1........50ff15")&&(sVersion="1.X",sOptions="HL",bDetected=1),result()}meta("protection","HASP HL/SRM")

================================================
FILE: dbs_min/db/PE/protection_Microsoft_Warbird.2.sg
================================================
function detect(){return(bDetected=PE.section["?g_Encry"]&&PE.isFunctionPresent("NtQuerySystemInformation"))&&PE.findSignature(0,PE.getSize()-PE.getOverlaySize(),"'?g_EncryptedSegmentSystemCall_")&&(sOptions="VM"),result()}meta("protection","Microsoft Warbird")

================================================
FILE: dbs_min/db/PE/protection_Softlocx.1.sg
================================================
function detect(){return PE.compareEP("eb$$55e8000000005d81ed........8bc555609c2b85........8985........ff74")&&(sVersion="6.0",bDetected=1),result()}meta("protection","Softlocx")

================================================
FILE: dbs_min/db/PE/protection_SteamStub.5.sg
================================================
function detect(){return PE.compareEP("e800000000505351525657558b4424..2d........8bcc83e4..51515150e8........83c4..5959598be1894424..5d5f5e5a595b58c3")?bDetected=1:PE.compareEP("e8000000005053515256575541504151415241534154415541564157488b4c24..4881e9........488bc44883e4..50504883ec..e8........4883c4..5959")&&(sOptions="x64",bDetected=1),result()}meta("protection","SteamStub")

================================================
FILE: dbs_min/db/PE/protection_Wibu_Codemeter.1.sg
================================================
function detect(){for(var e=0,t=0;t<=PE.nLastSection;t++)if(PE.section[t].FileOffset,("__wibu00"==(sSection=PE.section[t].Name)||"__wibu01"==sSection)&&++e,2==e){bDetected=1
break}return result()}meta("protection","Wibu Codemeter")

================================================
FILE: dbs_min/db/PE/protection_obfus_h.5.sg
================================================
function detect(){return(PE.section[".obfh"]||PE.isExportFunctionPresent("WhatSoundDoesACowMake"))&&PE.isFunctionPresent("vsprintf")&&(bDetected=1),sLang="C",result()}meta("protection","obfus.h")

================================================
FILE: dbs_min/db/PE/protection_obfusheader_h.5.sg
================================================
function detect(){PE.section[".rdata"]&&PE.isFunctionPresent("LoadLibraryA")&&PE.isFunctionPresent("GetProcAddress")&&PE.isSignaturePresent(PE.section[0].FileOffset,PE.getSize()-PE.getOverlaySize(),"00 'Stop reversing the ' ** ** ** **")&&(bDetected=1)
var e=PE.section[".data"]
return e&&PE.compare("6162636465666768696A6B6C6D6E6F707172737475767778797A534C41494450",e.FileOffset)&&(sOptions="data consts",bDetected=1),bDetected&&PE.section[".vmp0"]&&(sOptions=sOptions.append("fake signs"),_removeResult("protector",["Enigma","SecuROM","Denuvo","Themida/Winlicense"])),sLang="C++",result()}meta("protection","obfusheader.h")

================================================
FILE: dbs_min/db/PE/protector_ACProtect.2.sg
================================================
function detect(){var e
return PE.compareEP("60F950E801000000..58584950E801000000..5858790466B9B872E801000000")?sVersion="1.09g":PE.compareEP("E801000000..83")?sVersion="1.41":PE.compareEP("6050E801000000..83")?sVersion="1.3X":PE.compareEP("60E801000000..83042406C3")?sVersion="1.4X":PE.compareEP("600F87020000001BF8E801000000..83042406C3")?sVersion="1.90g":PE.compareEP("68........68........C3C3")?sVersion="2.0.X":(e=PE.section[".perplex"])&&3758096480&e.Characteristics&&(sVersion="1.X"),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),result()}meta("protector","ACProtect")

================================================
FILE: dbs_min/db/PE/protector_AHTeam_EP_Protector.2.sg
================================================
function detect(){if(PE.compareEP("90")&&PE.compareEP("90FFE0",47))if(sVersion="0.3",bDetected=1,PE.compareEP("60E8........5EB9000000002BC0",50))sOptions="fake k.kryptor 9/kryptor a"
else if(PE.compareEP("6A0068........E8........BF",50))sOptions="fake Microsoft Visual C++ 7.0"
else switch(PE.getEntryPointSignature(50,14)){case"60E803000000E9EB045D4555C3E8":sOptions="fake ASPack 2.12"
break
case"60E801000000905D81ED00000000":sOptions="fake ASProtect 1.0"
break
case"538BD833C0A3000000006A00E800":sOptions="fake Borland Delphi 6.0-7.0"
break
case"FC5550E8000000005DEB01E360E8":sOptions="fake PCGuard 4.03-4.15"
break
case"EB03CD20C71EEB03CD20EA9CEB02":sOptions="fake PE Lock NT 2.04"
break
case"E8000000005B83EB05EB04524E44":sOptions="fake PE-Crypt 1.02"
break
case"60E800000000414E414B494E5D83":sOptions="fake PESHiELD 2.X"
break
case"B800000000680000000064FF3500":sOptions="fake PEtite 2.2"
break
case"9C608B442424E8000000005D81ED":sOptions="fake Spalsher 1.X-3.X"
break
case"535152565755E8000000005D81ED":sOptions="fake Stone's PE Encryptor 2.0"
break
case"60E8000000005D81ED06000000EB":sOptions="fake SVKP 1.3X"
break
case"E90000000060E8000000005883C0":sOptions="fake tElock 0.61"
break
case"EB16A85400004741424C4B434743":sOptions="fake VIRUS/I-Worm Hybris"
break
case"5F81EF00000000BE000040008B87":sOptions="fake VOB ProtectCD"
break
case"E8000000005D8100000000006A45":sOptions="fake Xtreme-Protector 1.05"
break
case"E912000000000000000000000000":sOptions="fake ZCode 1.01"}else PE.compareEP("55908bec906aff9090")&&(sVersion="0.3",sOptions="alt",bDetected=1)
return result()}meta("protector","AHTeam EP Protector")

================================================
FILE: dbs_min/db/PE/protector_ASM_Guard.2.sg
================================================
function detect(){return PE.isOverlayPresent()&&(PE.isSectionNamePresent("ASMGUARD")?(sVersion="2.XX",sOptions="shell mutation",bDetected=1):PE.isResourceNamePresent("NT.DLL")&&(bDetected=1)),result()}meta("protector","ASM Guard")

================================================
FILE: dbs_min/db/PE/protector_ASProtect.2.sg
================================================
function detect(){return PE.compareEP("6801......E801000000C3C3")?sVersion="1.23-2.56":PE.compareEP("68########9060e8$$$$$$$$5d4555c3")?sVersion="SKE 2.1-2.2":PE.compareEP("68########60e8$$$$$$$$5d4555c3")?sVersion="SKE 2.3-2.5":PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00......807D4D01750C8B74242883FE01895D4E75318D45535053FFB5ED0900008D453550E9820000000000000000000000000000000000")||PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00......807D4D01750C8B74242883FE01895D4E75318D45535053FFB5ED0900008D453550E98200000000000000000000000000000000")?sVersion="SKE 2.1/2.2":PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00......807D4D01750C8B74242883FE01895D4E75318D45535053FFB5E50B00008D453550E98200000000000000000000000000000000")?sVersion="SKE 2.3":PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00....00807D4D01750C8B74242883FE01895D4E75318D45535053FFB5DD0900008D453550E98200000000000000000000000000000000")?bDetected=1:PE.compareEP("60E801000000905D81ED........BB........03DD2B9D")?sVersion="1.0":PE.compareEP("60E9..05")?sVersion="1.1 BRS":PE.compareEP("60E9........9178797979E9")?sVersion="1.1 MTE":PE.compareEP("9060E9..04")?sVersion="1.1 MTEb":PE.compareEP("9060E81B......E9FC")?sVersion="MTEc":PE.compareEP("60E9..04....E9..............EE")||PE.compareEP("60E9$$$$$$$$81da........e8$$$$$$$$0fbffe0fbffd")?sVersion="1.1":PE.compareEP("6801......C3")?sVersion="1.2":PE.compareEP("9060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB........807D4D01750C8B74242883FE01895D4E75318D45535053FFB5D50900008D453550E98200000000000000000000000000000000")?sVersion="1.23 RC4 build 08.07":PE.compareEP("60E8........E9........05........B9........AD35........AB4975F6EB045D4555C3")&&(sVersion="1.1"),bDetected=bDetected||Boolean(sVersion),result()}meta("protector","ASProtect")

================================================
FILE: dbs_min/db/PE/protector_AT4RE.2.sg
================================================
function detect(){return PE.compareEP("0f3133c903c8eb$$0f312bc13d........0f83........e9$$$$$$$$b8........33f633db8a1c0680eb")&&(sVersion="1.0",bDetected=1),result()}meta("protector","AT4RE")

================================================
FILE: dbs_min/db/PE/protector_AZProtect_0001.2.sg
================================================
function detect(){return PE.compareEP("EB70FC608C804D110070258100400D91BB608C804D11007021811D610D810040CE608C804D11007025812581258125812961418131611D610040B730")&&(bDetected=1,PE.isSectionNamePresent("AZPR0001")||(sOptions="modified")),result()}meta("protector","AZProtect 0001")

================================================
FILE: dbs_min/db/PE/protector_AbyssMedia_ScriptCryptor.2.sg
================================================
function detect(){if(!PE.isNet()&&!PE.isRichSignaturePresent()&&PE.getNumberOfExports())return PE.isResourceNamePresent("AOPT")&&PE.isImportPositionHashPresent(0,3479190141)&&15===PE.getNumberOfImports()&&(bDetected=1),result()}meta("protector","ScriptCryptor")

================================================
FILE: dbs_min/db/PE/protector_ActiveMark.2.sg
================================================
function detect(){return PE.compareOverlay("00'TMSAMVOH'")?(sVersion="5.X",bDetected=1):PE.compareEP("8925........EB")&&(bDetected=1),result()}meta("protector","ActiveMARK")

================================================
FILE: dbs_min/db/PE/protector_Agile.2.sg
================================================
function detect(){return _getNumberOfResults("protector")<=2&&PE.isNetObjectPresent("ObfuscatedByAgileDotNetAttribute")&&(bDetected=1),result()}meta("protector","Agile")

================================================
FILE: dbs_min/db/PE/protector_Alcatraz.2.sg
================================================
function detect(){return PE.isSectionNamePresent(".0Dev")&&(bDetected=1),result()}meta("protector","Alcatraz")

================================================
FILE: dbs_min/db/PE/protector_Alienyze.2.sg
================================================
function detect(){return(bDetected=PE.compareEP("55 8b ec")&&!PE.getNumberOfImports()&&4<PE.getNumberOfSections()&&0==PE.getSectionFileOffset(0))&&PE.isSignaturePresent(0,PE.getSize(),"540068006900730020006D00650073007300610067006500200077006F006E002700740020006100")&&(sVersion="demo"),bDetected&&!PE.isSectionNamePresent(".alien")&&(sOptions="modified"),result()}meta("protector","Alienyze")

================================================
FILE: dbs_min/db/PE/protector_AntiDote.2.sg
================================================
function detect(){return PE.compareEP("E8BBFFFFFF84C0742F680401000068C02360006A00FF1508106000E840FFFFFF50")?(sVersion="1.0 Beta",bDetected=1):PE.compareEP("6869D60000E8C6FDFFFF6869D60000E8BCFDFFFF83C408E8A4FFFFFF84C074")?(sVersion="1.2 Beta",bDetected=1):PE.compareEP("e8$$$$$$$$e8000000005853515657508b1c2481")||PE.compareEP("EB1066623A432B2B484F4F4B90E9083290909090909090909090807C240801")?(sVersion="1.2 Demo",bDetected=1):PE.compareEP("6890030000E8C6FDFFFF6890030000E8BCFDFFFF6890030000E8B2FDFFFF50")?(sVersion="1.4 SE",bDetected=1):PE.compareEP("E8F7FEFFFF05CB220000FFE0E8EBFEFFFF05BB190000FFE0E8BD00000008B2")?(sVersion="1.2 Demo",bDetected=1):PE.compareEP("6895010000E8D0FDFFFF6895010000E8C3FDFFFF6890030000E8BCFDFFFF68")?(sVersion="1.4 osCE",bDetected=1):PE.compareEP("68....0000E8..FDFFFF68....0000E8..FDFFFF6890030000E8..FDFFFF")&&(sVersion="1.X",bDetected=1),result()}meta("protector","AntiDote")

================================================
FILE: dbs_min/db/PE/protector_Anticrack_Software.2.sg
================================================
function detect(){return(PE.compareEP("60..................E801000000............................................0000......04")||PE.compareEP("60................0000........................E801000000..83042406C3..........00"))&&(sVersion="1.09",bDetected=1),result()}meta("protector","AntiCrack Software Basic")

================================================
FILE: dbs_min/db/PE/protector_ArmDot.2.sg
================================================
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. ..")&&PE.isSignatureInSectionPresent(0,"20 .. .. .. .. FE 0C .. .. 3F .. .. 00 00 20 .. .. .. .. FE 0C .. .. 3D .. .. 00 00")&&(bDetected=1),result()}meta("protector","ArmDot")

================================================
FILE: dbs_min/db/PE/protector_Armadillo.2.sg
================================================
function detect(){if(PE.compareEP("60E8000000005D50510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D1595850510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08"))sVersion="3.X-9.X",bDetected=1
else if(PE.compareEP("558BEC83EC0C5356578B450850FF15........83C4048945FC8B45FC51B900080000B906000000"))sVersion="4.44a public build",bDetected=1
else if(PE.compareEP("E8E3400000E916FEFFFF6A0C68........E8441500008B4D0833FF3BCF762E6AE05833D2F7F13B"))sVersion="5.00",bDetected=1
else if(PE.compareEP("837C2408017505E8DE4B0000FF7424048B4C24108B54240CE8EDFEFFFF59C20C006A0C68"))sVersion="5.00",sOptions="DLL",bDetected=1
else if(PE.compareEP("6A..8BB5........C1E6048B85........2507....8079054883C8F84033C98A88........8B95........81E207....8079054A83CAF84233C08A82"))sVersion="2.XX",sOptions="CopyMem II",bDetected=1
else if(PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959586033C9"))sVersion="3.00",bDetected=1
else if(PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB"))sVersion="3.00a-3.70a",bDetected=1
else if(83==PE.getMajorLinkerVersion()&&82==PE.getMinorLinkerVersion()){for(var E=0;E<=PE.nLastSection;E++)if(PE.compare("'PDATA000'",PE.section[E].FileOffset)){sVersion="6.X-9.X"
break}sVersion||7<PE.section.length&&(sVersion="6.X-9.X"),bDetected=1}return result()}meta("protector","Armadillo")

================================================
FILE: dbs_min/db/PE/protector_Arxan.2.sg
================================================
function detect(){if(PE.is64()&&!PE.isNet())if(PE.compareEP("40 50 40 51 40 52 40 53 55 56 57 9C 48 83 EC 38 FC B8 01 00 00 00 B9 FF FF 00 00 E0 FE"))bDetected=1,sVersion="GuardIT ~2013"
else{var e=skipJumpsAndNops(PE.getEntryPointOffset()),e=PE.compare("48 83 EC 28 E8",e)?PE.OffsetToRVA(e)+PE.readSDword(e+5)+9:PE.OffsetToRVA(e)
if(-1!=e){for(var s=PE.OffsetToVA(PE.RVAToOffset(e)),t=0,r=0;r<32&&0===PE.getDisasmString(s).indexOf("PUSH");r++)t++,s=PE.getDisasmNextAddress(s)
if(3<t&&0===PE.getDisasmString(s).indexOf("LEA RSP,")){for(var s=PE.getDisasmNextAddress(s),E=0,r=0;r<32&&0===PE.getDisasmString(s).indexOf("MOVUPD");r++)E++,s=PE.getDisasmNextAddress(s)
0<E&&"PUSH 0X10"===PE.getDisasmString(s)&&"TEST RSP, 0XF"===PE.getDisasmString(PE.getDisasmNextAddress(s))&&(bDetected=1,sVersion="GuardIT ",sVersion+=t<14||E<16?"12.0+":"2014-2021")}}}return result()}function skipJumpsAndNops(e){for(var s=PE.OffsetToRVA(e);;){var t=PE.readByte(PE.RVAToOffset(s))
if(233===t)s+=PE.readSDword(PE.RVAToOffset(s+1))+5
else if(235===t)s+=PE.readSByte(PE.RVAToOffset(s+1))+2
else{if(144!==t)break
s++}}return PE.RVAToOffset(s)}meta("protector","Arxan")

================================================
FILE: dbs_min/db/PE/protector_BJFnt.2.sg
================================================
function detect(){return PE.compareEP("EB01EA9CEB01EA53EB01EA51EB01EA52EB01EA56")?(sVersion="1.1b",bDetected=1):PE.compareEP("EB0269B183EC04EB03CD20EBEB01EB9CEB01EBEB")?(sVersion="1.2 RC",bDetected=1):PE.compareEP("EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060")&&(sVersion="1.3",bDetected=1),result()}meta("protector",".BJFnt")

================================================
FILE: dbs_min/db/PE/protector_Babel_.NET.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("BabelObfuscatorAttribute")?(sVersion="1.0-2.X",bDetected=1):PE.isNetObjectPresent("BabelAttribute")&&(sVersion="3.X",bDetected=1),bDetected)&&PE.isNetObjectPresent("BabelAttribute")&&PE.isNetObjectPresent("BabelObfuscatorAttribute")&&(bDetected=0),result()}meta("protector","Babel .NET")

================================================
FILE: dbs_min/db/PE/protector_Berio.2.sg
================================================
function detect(){return PE.compareEP("909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090E9011200")?(sVersion="1.00 beta",bDetected=1):PE.compareEP("909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090E9017401")&&(sVersion="2.00 beta",bDetected=1),result()}meta("protector","Berio")

================================================
FILE: dbs_min/db/PE/protector_ByfronTech.2.sg
================================================
function detect(){for(var t=!1,e=!1,r=!1,n=!1,o=(PE.isExportFunctionPresent("run")&&(t=!0),PE.nLastSection);0<=o;o--){var c=PE.getSectionName(o),i=PE.getSectionCharacteristics(o)
".text"==c?e=!0:".byfron"==c&&1610612768==i?r=!0:".byfron1"==c&&33554496==i&&(n=!0)}return t&&!e&&(r||n)&&(bDetected=1),result()}meta("protector","Byfron Technologies")

================================================
FILE: dbs_min/db/PE/protector_ByteGuard.2.sg
================================================
function detect(){return PE.isNet()&&PE.isNetGlobalCctorPresent()&&(".text"===PE.section[0].Name||PE.isSectionNamePresent("UPX"))&&PE.isNetUStringPresent("C# version only supports level 1 and 3")&&PE.compareOverlay("%% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %% %%")&&(bDetected=1),result()}meta("protector","ByteGuard")

================================================
FILE: dbs_min/db/PE/protector_Cameyo.2.sg
================================================
function detect(){return PE.isOverlayPresent()&&PE.compareOverlay("'MZ'")&&"Cameyo Application Virtualization"==PE.getVersionStringInfo("ProductName")&&(sVersion=PE.getFileVersion(),bDetected=1),result()}meta("protector","Cameyo")

================================================
FILE: dbs_min/db/PE/protector_CliSecure.2.sg
================================================
function detect(){return PE.isNet()?PE.isNetObjectPresent("ObfuscatedByCliSecureAttribute")?(sVersion="4.0-5.X",bDetected=1):(PE.isNetObjectPresent("CliSecureRd.dll")||PE.isNetObjectPresent("CliSecureRd64.dll")||PE.isSignatureInSectionPresent(0,"'Cli'00'S'00'e'00'c'00'u'00'r'00'e'"))&&(bDetected=1):PE.compareEP("e9$$$$$$$$558bec81ec4c020000a1........33c58945f483")&&(sVersion="4.5",bDetected=1),result()}meta("protector","CliSecure")

================================================
FILE: dbs_min/db/PE/protector_Code-Lock.2.sg
================================================
function detect(){return PE.isLibraryPresent("CODE-LOCK.OCX")&&(bDetected=1),result()}meta("protector","Code-Lock")

================================================
FILE: dbs_min/db/PE/protector_CodeCrypt.2.sg
================================================
function detect(){if(PE.compareEP("E9........EB02833D58EB02FF1D5BEB020FC75F")){switch(PE.readDword(PE.getEntryPointOffset()+1)){case 709:sVersion="0.14b"
break
case 817:sVersion="0.15b"
break
case 814:sVersion=PE.compareEP("EB03FF1D34",20)?"0.164":"0.16b-0.163b"}bDetected=1}return result()}meta("protector","CodeCrypt")

================================================
FILE: dbs_min/db/PE/protector_CodeVeil.2.sg
================================================
function detect(){return PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8")?(sVersion="1.2",bDetected=1):PE.isNet()&&(PE.isNetObjectPresent("____KILL")?(sVersion="4.X",bDetected=1):PE.isNetUStringPresent("E_TamperDetected")&&(sVersion="3.X-4.X",bDetected=1)),result()}meta("protector","CodeVeil")

================================================
FILE: dbs_min/db/PE/protector_Code_Virtualizer.2.sg
================================================
function detect(){return PE.compareEP("609CFCE8000000005F81EF........8BC781C7........3B472C7502EB2E89472CB9A7000000EB0501448F")&&(sVersion="1.3.1.0",bDetected=1),result()}meta("protector","Code Virtualizer")

================================================
FILE: dbs_min/db/PE/protector_Codewall.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("CodeWallTrialVersion")||PE.isNetObjectPresent("CodeWallTrialVersion
")?(sVersion="4.X",sOptions="demo",bDetected=1):PE.isSignatureInSectionPresent(0,"9161d281........11..175813..11..11..32..28........11..6f........13..7e........2d..73")&&(sVersion="4.X",bDetected=1)),result()}meta("protector","CodeWall")

================================================
FILE: dbs_min/db/PE/protector_Confuser.2.sg
================================================
function getConfuserVersion(){var e="",t=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Confuser v")
return e=-1!==t?PE.getString(t+10):e}function detect(){var e
return PE.isNetObjectPresent("ConfusedByAttribute")?(e=getConfuserVersion(),sVersion=e||"1.X",bDetected=1):PE.isNet()&&2<=PE.section.length&&-1!=(e=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v"))&&(sVersion=PE.getString(e+12,7),sName="ConfuserEx",bDetected=1),0==PE.getNetAssemblyName().indexOf("вє∂ѕ ρяσтє¢тσя")?(sName="ConfuserEx",sVersion="Bed's mod",bDetected=1):bDetected&&PE.isNetObjectPresent("DotNetPatcherPackerAttribute")&&(sName="ConfuserEx",sVersion="DotNetPatcher mod",bDetected=1),result()}meta("protector","Confuser")

================================================
FILE: dbs_min/db/PE/protector_CopyMinder.2.sg
================================================
function detect(){return PE.compareEP("8325........EF6A00E8........E8........CCFF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25........FF25")&&(bDetected=1),result()}meta("protector","CopyMinder")

================================================
FILE: dbs_min/db/PE/protector_Crinkler.2.sg
================================================
function detect(){return PE.compareEP("B9........01C068........6A0058506A005F485DBB03000000BE........E9")?(sVersion="0.1-0.2",bDetected=1):PE.compareEP("B8........31DB43EB58")&&(sVersion="0.3-0.4",bDetected=1),result()}meta("protector","Crinkler")

================================================
FILE: dbs_min/db/PE/protector_Crunch.2.sg
================================================
function detect(){if(PE.compareEP("EB100000000000000000000000000000000055E800000000"))sVersion="4.0",bDetected=1
else if(PE.compareEP("EB1503000000060000000000000000000000680000000055E800000000"))sVersion="5.0",bDetected=1
else if(PE.compareEP("55E8........5D83ED068BC5556089AD........2B85")){switch(PE.getEntryPointSignature(32,2)){case"80BD":sVersion="1.0"
break
case"55BB":sVersion="2.0"}bDetected=1}return result()}meta("protector","Crunch")

================================================
FILE: dbs_min/db/PE/protector_CrypKey.2.sg
================================================
function detect(){return PE.compareEP("8B1D........83FB00750AE83C000000E8..0A00008B44240850E8..020000A1")?bDetected=1:PE.compareEP("E8........5883E805505F578BF781EF........83C639BA........8BDFB90B......8B06")?(sVersion="5.X-6.X",bDetected=1):PE.compareEP("E8........E8........83F80075076A00E8")?(sVersion="5.6.X",bDetected=1):PE.compareEP("833D........00753468........E8")?(sVersion="6.1X",bDetected=1):PE.compareEP("8b4424..50e8$$$$$$$$558bec81c4........5081c4........53c745")&&(sOptions="Core module",bDetected=1),result()}meta("protector","CrypKey")

================================================
FILE: dbs_min/db/PE/protector_CrypToCrack.2.sg
================================================
function detect(){return PE.compareEP("E801000000E8585B81E300FFFFFF66813B4D5A753784DB75338BF303....813E504500007526")?(sVersion="0.9.2",bDetected=1):PE.compareEP("5B81E300FFFFFF66813B4D5A75338BF303733C813E5045000075260FB746188BC869C0AD0B0000F7E02DAB5D414B69C9DEC0000003C1")&&(sVersion="0.9.3",bDetected=1),result()}meta("protector","CrypToCrack")

================================================
FILE: dbs_min/db/PE/protector_Cryptect.2.sg
================================================
function detect(){return(PE.compareEP("68........e8$$$$$$$$5052e9$$$$$$$$53660fcb560fb7df9c0fbff381d6........d2e7558bda57")||PE.compareEP("68........e8$$$$$$$$525166990fca999cf550c0de..d2d40fb7c3550fabe5f8565766"))&&(bDetected=1),result()}meta("protector","Cryptect")

================================================
FILE: dbs_min/db/PE/protector_CryptoObfuscator.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"000220....000a20ffffff0028........2a")||PE.isSignatureInSectionPresent(0,"0291203fffffff5f1f18620a067e........021758911f1062600a067e"))&&(sVersion="5.X",bDetected=1),result()}meta("protector","Crypto Obfuscator")

================================================
FILE: dbs_min/db/PE/protector_DBPE.2.sg
================================================
function detect(){if(PE.compareEP("9C5557565251539CFAE8........5D81ED5B5340..B0..E8........5E83C611B927......3006464975FA"))sVersion="1.53",bDetected=1
else if(PE.compareEP("9C6A10730BEB02C151E806......C41173F75BCD83C404EB0299EBFF0C247101E879E07A017583C4049DEB017568"))sVersion="2.10",bDetected=1
else if(PE.compareEP("EB$$9C5557565251539CE8........5D81ED")){switch(PE.readByte(PE.getEntryPointOffset()+92)){case 235:sVersion="2.10"
break
case 156:sVersion="2.33"}bDetected=1}return result()}meta("protector","DBPE")

================================================
FILE: dbs_min/db/PE/protector_DNGuard.2.sg
================================================
function detect(){var e
return PE.isNet()&&PE.isNetGlobalCctorPresent()?_getNumberOfResults("protector")<=1&&(PE.isNetObjectPresent("ZYXDNGuarder")||PE.isNetObjectPresent("HVMRuntm.dll")||PE.isSignatureInSectionPresent(0,"'A newer version of DNGuard Runtime library is needed to run this application.'"))&&(bDetected=1):PE.is64()?(e=PE.section[".rdata"])&&PE.isSignaturePresent(e.FileOffset,e.FileSize,"'DNGuard'")&&PE.isImportPositionHashPresent(0,943924593)&&PE.compareEP("48 83 EC 28 E8 07 AD")&&(bDetected=1):!PE.is64()&&PE.isImportPositionHashPresent(0,2583213454)&&(sVersion="4.9+",bDetected=1),result()}meta("protector","DNGuard")

================================================
FILE: dbs_min/db/PE/protector_DS.Sentinel_SuperPro.2.sg
================================================
function detect(){return PE.compareEP("68........6A016A00FF15........A3........FF15........33C93DB7000000A1")?(sVersion="6.4.0",sOptions="Automatic Protection",bDetected=1):PE.compareEP("A1........558B......85C074..85ED75..A1........5055FF15........8B0D")?(sVersion="6.4.1",sOptions="Automatic Protection",bDetected=1):PE.compareEP("A1........85C00F85........C705................33C050C70485................E8")&&(sVersion="6.4.5.0",sOptions="Automatic Protection",bDetected=1),result()}meta("protector","Sentinel SuperPro")

================================================
FILE: dbs_min/db/PE/protector_DYAMAR.2.sg
================================================
function detect(){return PE.isSectionNamePresentExp(/^\.dyamar[CD]$/)&&(sVersion="1.3.5",bDetected=1),result()}meta("protector","DYAMAR")

================================================
FILE: dbs_min/db/PE/protector_DZA_Patcher.2.sg
================================================
function detect(){return(PE.compareEP("EB08'5H40L1N'0060E8000000005D8BD581ED........2B95........83EA108995........8B442420250000FFFF")||PE.compareEP("BF........9968........68........5252525252525257E81501000085C0751C9952525752E8CB000000FF35"))&&(sVersion="1.3",bDetected=1),result()}meta("protector","DZA Patcher")

================================================
FILE: dbs_min/db/PE/protector_Daemon_Protect.2.sg
================================================
function detect(){return PE.compareEP("60609c8cc932c9e3$$9d6130e230e231c055e8")&&(sVersion="0.6.7",bDetected=1),result()}meta("protector","Daemon Protect")

================================================
FILE: dbs_min/db/PE/protector_DalKrypt.2.sg
================================================
function detect(){return PE.compareEP("68........5868........5F33DBEB0D8A140380EA0780F2048814034381FB........72EBFFE7")&&(sVersion="1.0",bDetected=1),result()}meta("protector","DalKrypt")

================================================
FILE: dbs_min/db/PE/protector_DeepSea.2.sg
================================================
function detect(){var e
return PE.isNet()&&-1!==(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"DeepSeaObfuscator"))&&(PE.compare("'Evaluation'",e+18)&&(sOptions="Evaluation",sVersion="4.X"),bDetected=1),result()}meta("protector","DeepSea")

================================================
FILE: dbs_min/db/PE/protector_Denuvo.2.sg
================================================
function detect(){if(!PE.isNet())return(PE.isSectionNamePresentExp(/\.(e|sr|x(p|d))data$/)||PE.isSectionNamePresent(".arch")||PE.isSectionNamePresent(".xtext")||PE.isSectionNamePresent(".xtls"))&&(PE.is64()?(PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")?(sVersion="1.0",bDetected=1):PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")?(sVersion="2.0a",bDetected=1):PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")?(sVersion="2.0b",bDetected=1):PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")?(sVersion="3.0a",bDetected=1):PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")?(sVersion="17.0",bDetected=1):PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")?(sVersion="3.0b",bDetected=1):PE.compareEP("47 61 6D 65 41 73 73 65 6D 62 6C 79 44 65 6E 75 76 6F 44 72 6D 2E 64 6C 6C")?(sOptions="Unity",bDetected=1):PE.isSignaturePresent(PE.section[0].FileOffset,PE.getSize()-PE.getOverlaySize(),"64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00")&&(bDetected=1),PE.isLibraryPresent("steam_api64.dll")&&(sOptions="Steam",bDetected=1),PE.isLibraryPresent("eossdk-win64-shipping.dll")&&(sOptions="Epic Games",bDetected=1)):(PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")?(sVersion="1.0",bDetected=1):PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")&&(sVersion="2.0",bDetected=1),PE.isLibraryPresent("steam_api.dll")&&(sOptions="Steam",bDetected=1),PE.isLibraryPresent("eossdk-win32-shipping.dll")&&(sOptions="Epic Game Store",bDetected=1),PE.isLibraryPresent("uplay_r1_loader.dll")&&(sOptions="uPlay",bDetected=1))),bDetected||(PE.isLibraryPresent("dbdata.dll")&&(sOptions="FIFA23 series",bDetected=1),PE.isLibraryPresent("uplay_r1_loader64.dll")&&(sOptions="uPlay",bDetected=1),PE.isLibraryPresentExp(/^Core\/Activation(64)?.dll$/)&&(sOptions="Origin",bDetected=1),PE.isExportFunctionPresent("GetDenuvoTicketLocation")&&(bDetected=1),PE.isExportFunctionPresent("GetDenuvoTimeTicketRequest")&&(bDetected=1)),PE.isExportFunctionPresentExp(/^ANTICHEAT_OBFUSCATE_.+_CODEMARKER$/)&&_setResult("marker","Denuvo","",""),result()}meta("protector","Denuvo")

================================================
FILE: dbs_min/db/PE/protector_DotFix_Nice_Protect.2.sg
================================================
function detect(){return PE.compareEP("E9FF000000608B7424248B7C2428FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8")?(sVersion="2.1-2.5",bDetected=1):PE.compareEP("60E8550000008DBD........68........033C248BF79068........9BDBE355DB04248BC7DB442404DEC1DB1C248B1C2466AD51DB04249090DA8D........DB1C24D1E129")||PE.compareEP("60be........8dbe........5783cd..eb$$619090505174..83c8..eb")?bDetected=1:PE.compareEP("e8$$$$$$$$eb$$5aeb$$524aeb$$eb$$b9........eb$$eb$$dd..eb$$803411..eb$$eb$$e2")?(sVersion="1.0-2.X",bDetected=1):PE.compareEP("60BE")&&PE.section["."]&&(bDetected=1),result()}meta("protector","DotFix NiceProtect")

================================================
FILE: dbs_min/db/PE/protector_Dotfuscator.2.sg
================================================
function detect(){return _getNumberOfResults("protector")<=2&&PE.isNetObjectPresent("DotfuscatorAttribute")&&(bDetected=1),result()}meta("protector","Dotfuscator")

================================================
FILE: dbs_min/db/PE/protector_DragonArmor.2.sg
================================================
function detect(){return PE.compareEP("BF........83C9FF33C068........F2AEF7D1495168........E8110A000083C40C68")&&(sVersion="0.0.4.1",bDetected=1),bDetected&&!PE.isSectionNamePresentExp(/^(\.)?DAStub$/)&&(sOptions="modified"),result()}meta("protector","DragonArmor")

================================================
FILE: dbs_min/db/PE/protector_ENIGMA.2.sg
================================================
function getEnigmaVersion(){var e,t,r,i,n,E,o,d=PE.nLastSection,P=PE.section[d].FileOffset,$=PE.section[d].FileSize,d=(0==$&&(P=PE.section[d-1].FileOffset,$=PE.section[d-1].FileSize),PE.findSignature(P,$,"000000'ENIGMA'"))
return-1!=d?(e=PE.readByte(d+9),t=PE.readByte(d+10),r=PE.readWord(d+11),i=PE.readWord(d+13),n=PE.readWord(d+15),E=PE.readWord(d+17),o=PE.readWord(d+19),d=PE.readWord(d+21),sVersion=e+"."+t+" build "+r+"."+i+"."+n+" "+E+":"+o+":"+d,!0):-1!=PE.findSignature(P,$,"'Enigma Protector'")&&(sVersion="5.X",!0)}function getEnigmaVersion4x(){var e,t,r,i,n,E,o=PE.nLastSection,d=PE.section[o-1].FileOffset,o=PE.section[o-1].FileSize,d=PE.findSignature(d,o,"000000'ENIGMA'")
return-1!=d&&(o=PE.readByte(d+9),e=PE.readByte(d+10),t=PE.readWord(d+11),r=PE.readWord(d+13),i=PE.readWord(d+15),n=PE.readWord(d+17),E=PE.readWord(d+19),d=PE.readWord(d+21),sVersion=o+"."+e+" build "+t+"."+r+"."+i+" "+n+":"+E+":"+d,!0)}function getEnigmaVersion_old1x(){var e=PE.nLastSection
return-1!=PE.findSignature(PE.section[e].FileOffset,PE.section[e].FileSize,"'ENIGMA'07' PROT'")&&(sVersion="v1.14",!0)}function getEnigmaVersion_old(){var e=PE.section[".data"]
if(e){var t=e.FileOffset
if(-1!=(t=PE.findString(t,e.FileSize,"Enigma protector v")))return sVersion=PE.getString(t+18,4),!0}return!1}function detect(){return PE.isNet()?PE.isSignatureInSectionPresent(0,"000000'ENIGMA'")&&(bDetected=1):(PE.is64()?(PE.compareEP("5051525355565741504151415241534154415541564157489C4881EC080000000FAE1C24E8000000005D")||PE.compareEP("eb$$60e8000000005d81ed........81ed........e9"))&&(getEnigmaVersion(),bDetected=1):PE.compareEP("558bec83c4..b8........e8........9a............e9$$$$$$$$60e8000000005d..ed")||PE.compareEP("60e8000000005d81ed........81ed........e9")||PE.compareEP("68........e8$$$$$$$$eb$$83c4..e9$$$$$$$$60e8000000005d81ed")||PE.compareEP("eb$$e9$$$$$$$$60e8000000005d81ed........81ed........e9")||PE.compareEP("e8$$$$$$$$83c4..e9$$$$$$$$60e8000000005d81ed........81ed........e9")?(getEnigmaVersion(),bDetected=1):PE.compareEP("60e8000000005d83....81ed")?(getEnigmaVersion_old(),bDetected=1):PE.compareEP("eb$$e9$$$$$$$$60e8000000005d83....81ed")&&(getEnigmaVersion_old1x(),getEnigmaVersion_old(),bDetected=1),bDetected||(1<PE.getNumberOfImports()&&1==PE.getNumberOfImportThunks(1)&&"MessageBoxA"==PE.getImportFunctionName(1,0)&&3758096448==PE.getSectionCharacteristics(0)&&getEnigmaVersion()||"enigma"==PE.getSectionNameCollision("1","2"))&&(bDetected=1),PE.compareEP("60648b2d........3e8b6d..3e8b6d..e8........bb........c3")&&(getEnigmaVersion4x(),bDetected=1)),result()}meta("protector","Enigma")

================================================
FILE: dbs_min/db/PE/protector_EXEFog.2.sg
================================================
function detect(){return(PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3")||PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5")||-1!=PE.findSignature(PE.getEntryPointOffset(),4096,"6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e"))&&(sVersion="1.1",bDetected=1),result()}meta("protector","ExeFog")

================================================
FILE: dbs_min/db/PE/protector_EXE_Password_Protector.2.sg
================================================
function detect(){return PE.compareEP("6A606810B54000E82E020000BF940000008BC7E822F4FFFF8965E88BF4893E56FF1510B040008B4E10890D00ED40008B4604")&&(sVersion="1.1",bDetected=1),result()}meta("protector","EXE Password Protector")

================================================
FILE: dbs_min/db/PE/protector_Eazfuscator.2.sg
================================================
function detect(){return bDetected=PE.isNet()&&PE.isSignaturePresent(PE.section[0].FileOffset,1024,"'fefef'")&&PE.isSignatureInSectionPresent(0,"00 E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 **"),result()}meta("protector","EazFuscator")

================================================
FILE: dbs_min/db/PE/protector_Elan_License_Manager.1.sg
================================================
function detect(){return PE.compareEP("8b4424..83f8..0f85........ff15........8b0d........a3........85c975..3c..75..a9")&&(sVersion="4.1.3",sOptions="1995 by Elan Computer Group, Inc.",bDetected=1),result()}meta("protector","Elan License Manager")

================================================
FILE: dbs_min/db/PE/protector_ElecKey.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"83c42068........68........c744240800000000ff15........50ff15........85c0a3")?(sOptions="AnyCPU",bDetected=1):PE.isSignatureInSectionPresent(0,"488b0dd2be01006641b83200488d917b070000ff15a040010033c9ff15b8400100488b")&&(sOptions="x64",bDetected=1)),bDetected||(PE.is64()?PE.compareEP("41504151515257535556E8000000005B48B8................482BD8488BEB")&&(sVersion="2.00.X",bDetected=1):PE.compareEP("515257535556E8000000005BB8........2BD8")&&(sVersion="2.00.X",bDetected=1)),result()}meta("protector","ElecKey")

================================================
FILE: dbs_min/db/PE/protector_Escargot.2.sg
================================================
function detect(){return PE.compareEP("EB08'(esc0.1)'6068")?(sVersion="0.1",bDetected=1):PE.compareEP("EB04'@0.1'6068")&&(sVersion="0.1 final",bDetected=1),result()}meta("protector","Escargot")

================================================
FILE: dbs_min/db/PE/protector_Excalibur.2.sg
================================================
function detect(){return PE.compareEP("e9$$$$$$$$60e8$$$$$$$$5861eb$$609c9c6a..73..eb")&&(sVersion="1.03",sOptions="by forgot/uS/DFCG",bDetected=1),result()}meta("protector","Excalibur")

================================================
FILE: dbs_min/db/PE/protector_ExeShield.2.sg
================================================
function detect(){return PE.compareEP("E8040000008360EB0C5DEB05")&&PE.compareOverlay("85c0")&&PE.isRichSignaturePresent()&&!PE.getNumberOfImports()&&(bDetected=1,PE.isSectionNamePresent(".shield")||(sOptions="modified")),result()}meta("protector","ExeShield")

================================================
FILE: dbs_min/db/PE/protector_ExeStealth.2.sg
================================================
function detect(){PE.compareEP("60E8000000005D81ED........B97B0900008BF7AC")?(sVersion="1.1",bDetected=1):PE.compareEP("6090EB22'ExeStealth'")?(sVersion="2.5",bDetected=1):PE.compareEP("EB0060EB00E8000000005D81ED")?(sVersion="2.70-2.71",bDetected=1):PE.compareEP("EB00EB2F'Shareware - ExeStealth'00")?(sVersion="2.72-2.73",sOptions="Shareware",bDetected=1):PE.compareEP("EB00EB17'Shareware - ExeStealth'00")?(sVersion="2.74",sOptions="Shareware",bDetected=1):PE.compareEP("906090E8000000005D81ED........B915000000")?(sVersion="2.75",bDetected=1):PE.compareEP("EB58'Shareware-Version ExeStealth'")?(sVersion="2.75a",sOptions="Shareware",bDetected=1):PE.compareEP("EB..'ExeStealth V2 Shareware '")?(sVersion="2.76",sOptions="Shareware",bDetected=1):PE.compareEP("EB65'ExeStealth V2 - www'")&&(sVersion="2.76",bDetected=1)
var e=PE.resource.TN
return!bDetected&&e&&(PE.compare("'MZ'",e.FileOffset)||PE.isSectionNamePresent("ExeS"))&&(bDetected=1),result()}meta("protector","ExeStealth")

================================================
FILE: dbs_min/db/PE/protector_Exe_Guarder.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4D05356578D75FC8B442430250000FFFF81384D5A900074072D00100000EBF18945FCE8C8FFFFFF2DB2040000")&&(sVersion="1.8",bDetected=1),result()}meta("protector","Exe Guarder")

================================================
FILE: dbs_min/db/PE/protector_Exe_Shield.2.sg
================================================
function detect(){if(PE.compareEP("EB0668....0600C39C60E8020000")){switch(PE.readWord(PE.getEntryPointOffset()+3)){case 8080:sVersion="1.7"
break
case 34548:sVersion="2.7"
break
case 34112:sVersion="2.7b"}bDetected=1}else PE.compareEP("60E8000000005D81ED........B9EB0800008DBD........8BF7AC......F8")?(sVersion="2.9",bDetected=1):PE.compareEP("558BEC53565760E8000000005D81ED........B9........81E9........8BD581C2")&&(sVersion="1.3RC",bDetected=1)
return result()}meta("protector","Exe Shield")

================================================
FILE: dbs_min/db/PE/protector_FISH_.NET.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"0800'FISH_NET'")||PE.isSignatureInSectionPresent(0,"'FISH.NET'"))&&(sVersion="1.X",bDetected=1),result()}meta("protector","FISH .NET")

================================================
FILE: dbs_min/db/PE/protector_FishPE_Shield.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4D05356578B451083C00C8B008945DC")||PE.compareEP("60E8EAFDFFFFFFD0C38D4000..0000002C000000")?(sVersion="1.12/1.16",bDetected=1):PE.compareEP("60E8........C390090000002C000000........C4030000BCA0000000400100")?(sVersion="1.0X",bDetected=1):PE.compareEP("60e8........61c3")&&PE.compareEP("60e8$$$$$$$$558bec81c470ffffff535657")&&(sVersion="2.0.1",bDetected=1),result()}meta("protector","FishPE Shield")

================================================
FILE: dbs_min/db/PE/protector_Fish_PE.2.sg
================================================
function detect(){return 2==PE.getNumberOfSections()&&0==PE.section[0].FileSize&&(PE.compareEP("60e8070000006168........c35e56")?(sVersion="1.2",bDetected=1):PE.compareEP("60e821000000eb$$6168........c35e56")?(sVersion="1.3",bDetected=1):PE.compareEP("60b8........ffd05a")&&(sVersion="1.4",bDetected=1)),result()}meta("protector","Fish PE")

================================================
FILE: dbs_min/db/PE/protector_FlashBack_Protector.2.sg
================================================
function detect(){return PE.compareEP("60609c8cc932c9e3$$9d6190609061eb$$558bec83c4..b8........e8")&&(sVersion="1.0",bDetected=1),result()}meta("protector","FlashBack")

================================================
FILE: dbs_min/db/PE/protector_G!X_Protector.2.sg
================================================
function detect(){return PE.compareEP("60EB05E8EB044000EBFAE80A000000")&&(sVersion="1.2",bDetected=1),result()}meta("protector","G!X Protector")

================================================
FILE: dbs_min/db/PE/protector_GameGuard.2.sg
================================================
function detect(){return PE.compareEP("31FF740661E9'JMP0'")&&(sVersion="2006.5.X.X",bDetected=1),result()}meta("protector","GameGuard")

================================================
FILE: dbs_min/db/PE/protector_Goats_PE_Mutilator.2.sg
================================================
function detect(){return PE.compareEP("E8EA0B0000......8B1C79F663D88D22B0BFF64908C302BD3B6C294613285D")&&(sVersion="1.6",bDetected=1),result()}meta("protector","Goat's PE Mutilator")

================================================
FILE: dbs_min/db/PE/protector_Goliath.2.sg
================================================
function detect(){return(bDetected=PE.isSectionNamePresent(".GOLIATH")&&(PE.isNetObjectPresent("ObfuscatedByGoliath")||PE.isSignatureInSectionPresent(0,"'.Goliath.NET.CodeShield.'"))?!0:bDetected)&&PE.isSignatureInSectionPresent(0,"20006500760061006C007500610074006500")&&(sOptions="demo"),result()}meta("protector","Goliath")

================================================
FILE: dbs_min/db/PE/protector_HASP.2.sg
================================================
function detect(){return PE.compareEP("6a..602eff35........2eff35........68........e8........6683c4..2eff35........2eff35........b8........83c0..50")&&(sOptions="1997 by Aladdin Knowledge Systems Ltd.",bDetected=1),0==PE.section[0].FileOffset&&0==PE.section[0].FileSize&&1==PE.getResourceSection()&&/manager/im.test(PE.getVersionStringInfo("ProductName"))&&(sVersion=PE.getVersionStringInfo("ProductVersion"),sOptions=PE.getVersionStringInfo("ProductName"),bDetected=1),result()}meta("protector","HASP Protection")

================================================
FILE: dbs_min/db/PE/protector_HackShield.2.sg
================================================
function detect(){var e,t=PE.section[PE.getImportSection()]
return t&&(e=t.FileOffset,t=t.FileSize,t=Math.min(t,8264),-1!=PE.findString(e,t,"TerminateHackShield"))&&(bDetected=1),result()}meta("protector","HackShield")

================================================
FILE: dbs_min/db/PE/protector_Hide&Protect.2.sg
================================================
function detect(){return(PE.compareEP("909090E9D8..050095..5300954A5000")||PE.compareEP("909090E9........0000000000000000"))&&(sVersion="1.016",bDetected=1),result()}meta("protector","Hide&Protect")

================================================
FILE: dbs_min/db/PE/protector_HidePE.2.sg
================================================
function detect(){return PE.compareEP("6006FC1E07BE909090906A04689010909068")?(sVersion="0.1",sOptions="32Lite 0.03"):PE.compareEP("6090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090EB02000090909004909090909090909090909090909090909090909090")?(sVersion="0.1",sOptions="ACProtect 1.09"):PE.compareEP("60E82A0000005D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB85")?(sVersion="0.1",sOptions="Armadillo 3.00"):PE.compareEP("9090909068........6764FF360000676489260000F190909090A8030000617508B801000000C20C006800000000C38B85260400008D8D3B0400005150FF95")?(sVersion="0.1",sOptions="ASPack 2.XX"):PE.compareEP("609090909090905D909090909090909090909003DD")?(sVersion="0.1",sOptions="ASProtect"):PE.compareEP("68########6f4067485e68........67494e68........50466f")?(sVersion="1.2",sOptions="ASProtect"):PE.compareEP("558BEC83C49090909068........9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090")?(sVersion="0.1",sOptions="Borland Delphi 3.0"):PE.compareEP("558BEC9090909068........9090909090909090909090909090909090909090909090909090909000FF90909090909090900001909090909090909090EB0400000001909090909090900001909090909090909090")?(sVersion="0.1",sOptions="Borland Delphi 5.0 KOL/MCK"):PE.compareEP("9090909068........6764FF360000676489260000F190909090538BD833C0A3090909006A00E8090900FFA309090900A109090900A30909090033C0A30909090033C0A309090900E8")?(sVersion="0.1",sOptions="Borland Delphi 6.0-7.0"):PE.compareEP("5360BD909090908D45908D5D90E8000000008D01")?(sVersion="0.1",sOptions="CD-Cops II"):PE.compareEP("90909090909090909090909090909090909090909090EB0B83EC10535657E8C4010085")?(sVersion="0.1",sOptions="CodeSafe 2.0"):PE.compareEP("55E80E0000005D83ED068BC5556089AD........2B8500000000")?(sVersion="0.1",sOptions="Crunch"):PE.compareEP("BE000140006A0559807E070074118B46909090909090909090909090909090909083C101")?(sVersion="0.1",sOptions="DEF 1.0"):PE.compareEP("60E8000000005D8BFD81ED909090902BB90000000081EF9090909083BD90909090900F8400000000")?(sVersion="0.1",sOptions="DxPack 1.0"):PE.compareEP("9CFE039060BE909041908DBE9010FFFF5783CDFFEB1090909090909090909090909090909090FE0B")?(sVersion="0.1",sOptions="ExeSmasher"):PE.compareEP("9090909068........6764FF360000676489260000F190909090BBD0014000BF00104000BE9090909053E80A00000002D275058A164612D2C3FCB280A46A025B")?(sVersion="0.1",sOptions="FSG 1.0"):PE.compareEP("BE90909000BF90909000BB9090900053BB90909000B280")?(sVersion="0.1",sOptions="FSG 1.31"):PE.compareEP("90909090909090909090909090909090909090909090EB0B83EC0C535657E8240200FF")?(sVersion="0.1",sOptions="Gleam 1.00"):PE.compareEP("60E8220000005D8BD581ED909090902B959090909081EA0690909089959090909083BD4500010001")?(sVersion="0.1",sOptions="JDPack 1.X/JDProtect 0.9"):PE.compareEP("64A1010000005589E56AFF68........689A10409050")?(sVersion="0.1",sOptions="LCC Win32 1.X"):PE.compareEP("5589E5535657837D0C017505E817909090FF7510FF750CFF7508A1")?(sVersion="0.1",sOptions="LCC Win32 DLL"):PE.compareEP("2CE8EB1A90905D8BC581EDF67390902B859090909083E8068985FF01ECAD")?(sVersion="0.1",sOptions="Lockless Intro Pack"):PE.compareEP("54E8000000005D8BC581EDF67340002B858775400083E806")?(sVersion="0.1",sOptions="LTC 1.3"):PE.compareEP("9090909068........6764FF360000676489260000F19090909083EC4456FF15248149008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0C")?(sVersion="0.1",sOptions="Macromedia Flash Projector 6.0"):PE.compareEP("E909000000000000020000000C90")?(sVersion="0.1",sOptions="MEW 11 SE 1.0"):PE.compareEP("68........E80A00000000000000000030000000")?(sVersion="0.1",sOptions="Microsoft Visual Basic 5.0-6.0"):PE.compareEP("9090909068........6764FF360000676489260000F1909090905A6890909090689090909052E99090FF")?(sVersion="0.1",sOptions="Microsoft Visual Basic 6.0 DLL"):PE.compareEP("558BEC6AFF68........68........64A10000000050E9")?(sVersion="0.1",sOptions="Microsoft Visual C++ 5.0+/MFC"):PE.compareEP("558BEC5190909001019090909068........90909090909090909090909000019090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909000019090909090")?(sVersion="0.1",sOptions="Microsoft Visual C++ 6.0/Debug Version"):PE.compareEP("9090909068........6764FF360000676489260000F190909090558BEC83EC50535657BE909090908D7DF4A5A566A58B")?(sVersion="0.1",sOptions="Microsoft Visual C++ 6.20"):PE.compareEP("558D6C010081EC000000008B459083F801560F840000000085C00F84")?(sVersion="0.1",sOptions="Microsoft Visual C++ 7.0 DLL"):PE.compareEP("5589E5E802000000C9C39090455845")?(sVersion="0.1",sOptions="MinGW GCC 2.X"):PE.compareEP("E9A60000009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090")?(sVersion="0.1",sOptions="Neolite 2.0"):PE.compareEP("9C60E8000000005DB8B38540002DAC8540002BE88DB500000000")?(sVersion="0.1",sOptions="NorthStar PE Shrinker 1.3"):PE.compareEP("60E801010000E883C404E801909090E95D81EDD3224090E804029090E8EB08EB02CD20FF24249A66BE4746909090909090909090909090909090909090909090909090909090909090909090909090909090909090")?(sVersion="0.1",sOptions="Pack Master 1.0/PEX Clone"):PE.compareEP("8B04249C60E8140000005D81ED0A45409080BD67444090900F8548FFED0A")?(sVersion="0.1",sOptions="PE Intro 1.0"):PE.compareEP("60E8110000005D83ED0680BDE0049090010F84F2FFCC0A")?(sVersion="0.1",sOptions="PE Pack 0.99"):PE.compareEP("525155576467A1300085C0780DE8070000005883C007C690C3")?(sVersion="0.1",sOptions="PE Protect 0.9"):PE.compareEP("9090909068........6764FF360000676489260000F190909090EB066890909090C39C60E80290909033C08BC483C004938BE38B5BFC81")?(sVersion="0.1",sOptions="PECompact 1.4+"):PE.compareEP("60E910000000EF4003A7078F071C375D43A704B92C3A")?(sVersion="0.1",sOptions="PENightMare 2 Beta"):PE.compareEP("60E82B0000009090909090909090909090909090909090909090909090909090909090909090909090909090909090CCCC")?(sVersion="0.1",sOptions="PESHiELD 0.25"):PE.compareEP("9090909068........6764FF360000676489260000F190909090B8009090006A00689090900064FF350000000064892500000000669C60508BD8030068")?(sVersion="0.1",sOptions="PEtite 2.X/level 0"):PE.compareEP("60E8010000005583C404E801000000905D81FFFFFF0001")?(sVersion="0.1",sOptions="PEX 0.99"):PE.compareEP("5589E5909090909090909090905090909090900001")?(sVersion="0.1",sOptions="REALBasic"):PE.compareEP("0BC00BC00BC00BC00BC00BC00BC00BC0BA........FFE2BAE0104000B868241A40890283C203B84000E8EE890283C2FDFFE22D3D5B20486964655045205D3D2D90000000")?(sVersion="0.1",sOptions="Ste@lth PE 1.01"):PE.compareEP("60E8000000005883E83D508DB8000000FF578DB0E8000000")?(sVersion="0.1",sOptions="UPX 0.6"):PE.compareEP("0BC00BC00BC00BC00BC00BC00BC00BC0")?(sVersion="0.1",sOptions="VBOX 4.3 MTE"):PE.compareEP("5589E583EC08909090909090909090909090909001FFFF0101010001909090909090909090909090909000010001000190900001")?(sVersion="0.1",sOptions="Video-Lan-Client"):PE.compareEP("363E268AC060E800000000")?(sVersion="0.1",sOptions="VOB ProtectCD 5"):PE.compareEP("E900000000909090905741")?(sVersion="0.1",sOptions="WATCOM C/C++ EXE"):PE.compareEP("608BF033DB83C30183C001")?(sVersion="0.1",sOptions="XCR 0.11"):PE.compareEP("E803000000EB019090")?(sVersion="0.1",sOptions="Yoda's Protector 1.02"):PE.compareEP("90909090909090909090909090909090EB06009090909090909090EB08E8900000006690909090909090909090909090909090909090909090909090909090905166909090599090909090909090909090909090909090909090EB0200009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090EB02E2909090EB088290909090909090909090909090909090909090909090909090909090EB020001")?(sVersion="0.1",sOptions="Morphine 1.2"):PE.compareEP("EB01EA9CEB01EA53EB01EA51EB01EA52EB01EA5690")?(sVersion="0.2",sOptions="BJFNT 1.1b"):PE.compareEP("EB0269B183EC04EB03CD20EBEB01EB9CEB01EBEB00")?(sVersion="0.2",sOptions="BJFNT 1.2"):PE.compareEP("EB1066623A432B2B484F4F4B90E990909090")?(sVersion="0.2",sOptions="Borland C++"):PE.compareEP("558BEC83C4B4B890909090E800000000E8000000008D4000")?(sVersion="0.2",sOptions="Borland Delphi DLL"):PE.compareEP("558BEC83C49053565733C08945F08945D48945D0E800000000")?(sVersion="0.2",sOptions="Borland Delphi Setup Module"):PE.compareEP("E912000000000000000000000000000000E9FBFFFFFFC3680000000064FF3500000000")?(sVersion="0.2",sOptions="ZCode 1.01"):PE.compareEP("..BA........B8........890283C204B8........890283C204B8........890283C2F8FFE2'\r\n-=[ HidePE by BHCorp ]=-'")&&(sVersion="1.01"),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),result()}meta("protector","HidePE by BGCorp")

================================================
FILE: dbs_min/db/PE/protector_HyperTech_Crackproof.2.sg
================================================
function detect(){return 0<PE.getNumberOfImports()&&"KeRnEl32.dLl"===PE.getImportLibraryName(0)&&(bDetected=1),result()}meta("protector","HyperTech Crackproof")

================================================
FILE: dbs_min/db/PE/protector_ILProtector.2.sg
================================================
function detect(){return bDetected=PE.isNet()&&PE.isNetGlobalCctorPresent()&&PE.isNetObjectPresent("Protect32.dll")&&PE.isNetObjectPresent("Protect64.dll"),result()}meta("protector","ILProtector")

================================================
FILE: dbs_min/db/PE/protector_ILUCRYPT.2.sg
================================================
function detect(){return PE.compareEP("8BECFAC746F7....4281FA....75F9FF66F7")?(sVersion="4.015",bDetected=1):PE.compareEP("8BECFAC7........4C4CC3FBBF....B8....2E....D1C84F81")&&(sVersion="4.018",bDetected=1),result()}meta("protector","ILUCRYPT")

================================================
FILE: dbs_min/db/PE/protector_IProtect.2.sg
================================================
function detect(){return PE.compareEP("EB33'.FUXLoadLibraryA'00")&&(sVersion="1.0",PE.compareEP("'FxLib.dll'00",19)?sOptions="FxLib.dll mode":PE.compareEP("'FxSub.dll'00",19)&&(sOptions="FxSub.dll mode"),bDetected=1),result()}meta("protector","IProtect")

================================================
FILE: dbs_min/db/PE/protector_Inquartos_Obfuscator.2.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$bb........e8$$$$$$$$e8$$$$$$$$33c064ff306489204bccc3")&&PE.isSectionNamePresent(".inq")&&(bDetected=1),result()}meta("protector","Inquartos Obfuscator")

================================================
FILE: dbs_min/db/PE/protector_IntelliProtector.2.sg
================================================
function detect(){var t=PE.section[PE.nLastSection].FileOffset
return PE.compare("E9........CC",t)&&-1!=(t=PE.findString(t,PE.section[PE.nLastSection].FileSize,"Protected by IntelliProtector"))&&(sVersion=PE.getString(t+30),bDetected=1),result()}meta("protector","IntelliProtector")

================================================
FILE: dbs_min/db/PE/protector_InxObfuscator.2.sg
================================================
function detect(){return PE.isNet()&&-1!=PE.findSignature(0,PE.getSize()-PE.getOverlaySize(),"0013'Inx .NET Obfuscator'0000")&&(bDetected=1),result()}meta("protector","Inx Obfuscator")

================================================
FILE: dbs_min/db/PE/protector_Jar2exe.1.sg
================================================
function detect(){return PE.compareOverlay("efbbbf")?-1!=PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"504B0304")&&(PE.compareEP("558BEC6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc881e1........890d")?(sOptions="x86",bDetected=1):PE.compareEP("4883ec..48895c24..48897c24..ff15........488bc833d241b8........ff15........488bd84885c075..b8........e9")?(sOptions="x64",bDetected=1):PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")&&(bDetected=1)):PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")&&PE.compareOverlay("504b0304")&&(bDetected=1),sLang="Java",result()}meta("protector","Jar2Exe")

================================================
FILE: dbs_min/db/PE/protector_KoiVM.2.sg
================================================
function detect(){return PE.isNet()&&_getNumberOfResults("protector")<=1&&((PE.isSignatureInSectionPresent(0,"'KoiVM'")||PE.isSignatureInSectionPresent(0,"'VMEntryRun'"))&&(bDetected=1),sVersion="2.0+"),result()}meta("protector","KoiVM")

================================================
FILE: dbs_min/db/PE/protector_Konekt_Protector.2.sg
================================================
function detect(){return PE.compareEP("fc5550e8$$$$$$$$5d50e8$$$$$$$$eb$$58eb$$40eb$$ffe0")&&(bDetected=1),result()}meta("protector","Konekt Protector")

================================================
FILE: dbs_min/db/PE/protector_Krypton.2.sg
================================================
function detect(){if(PE.compareEP("8B0C24E90A7C01..AD4240BDBE9D7A04"))sVersion="0.2",bDetected=1
else if(PE.compareEP("8B0C24E9C08D01..C13A6ECA5D7E796DB3645A71EA"))sVersion="0.3",bDetected=1
else if(PE.compareEP("54E8........5D8BC581ED........2B85")){switch(PE.getEntryPointSignature(21,3)){case"83E806":sVersion="0.4"
break
case"EB43DF":sVersion="0.5"}bDetected=1}return result()}meta("protector","Krypton")

================================================
FILE: dbs_min/db/PE/protector_LARP.2.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$5d81ed........830424..83c4..ff6424")&&(sVersion="2.0",bDetected=1),result()}meta("protector","LARP")

================================================
FILE: dbs_min/db/PE/protector_LDK.2.sg
================================================
function detect(){return 4==PE.getNumberOfSections()&&PE.isSectionNamePresent(".AKS1")&&PE.isSectionNamePresent(".AKS2")&&PE.isSectionNamePresent(".AKS3")&&PE.isSectionNamePresent(".rsrc")&&(bDetected=1),result()}meta("protector","SafeNet Sentinel LDK")

================================================
FILE: dbs_min/db/PE/protector_LDK_.NET.2.sg
================================================
function detect(){return PE.isNet()&&PE.isNetObjectPresent(".protect")&&PE.isNetObjectPresent("haspdnert.dll")&&(bDetected=1),result()}meta("protector","SafeNet Sentinel LDK .NET")

================================================
FILE: dbs_min/db/PE/protector_LameCrypt.2.sg
================================================
function detect(){return PE.compareEP("60669CBB........80B3........904B83FBFF75F3669D61")&&(sVersion="1.0",bDetected=1),result()}meta("protector","LameCrypt")

================================================
FILE: dbs_min/db/PE/protector_Laserlok.2.sg
================================================
function detect(){return PE.compareEP("eb$$eb$$5055e8$$$$$$$$5d508bc581ed........2d........3e2b85........3E8985........608d85........508d9d........2bd853")&&(bDetected=1),result()}meta("protector","Laserlok")

================================================
FILE: dbs_min/db/PE/protector_MSLRH.2.sg
================================================
function detect(){return PE.compareEP("EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060EB02C705EB02CD20E803000000E9EB04584050C3619D1FEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150")?(sVersion="0.32a",sOptions="fake .BJFNT 1.3"):PE.compareEP("60E802000000EB095D5581ED39394400C361EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458740475")?(sVersion="0.32a",sOptions="fake ASPack 2.11d"):PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00A002EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003")||PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB0073000061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586B")?(sVersion="0.32a",sOptions="fake ASPack 2.12"):PE.compareEP("3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB74019083C414EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")?(sVersion="0.32a",sOptions="fake EXE32Pack 1.3X"):PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000648F050000000083C40C5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")?(sVersion="0.32a",sOptions="fake Microsoft Visual C++"):PE.compareEP("558BEC538B5D08568B750C578B7D1085F65F5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458")?(sVersion="0.32a",sOptions="fake MSVC++ 6.0 DLL"):PE.compareEP("558BEC538B5D08568B750C5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB")?(sVersion="0.32a",sOptions="fake MSVC++ 7.0 DLL Method 3"):PE.compareEP("558BEC5657BF010000008B750C85F65F5E5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458740475")?(sVersion="0.32a",sOptions="fake MSVC++ DLL Method 4"):PE.compareEP("E9A6000000B07B4000786040007C60400000000000B03F000012624000'NeoLite Executable File Compressor\r\nCopyright (c) 1998'2C31")?(sVersion="0.32a",sOptions="fake Neolite 2.0"):PE.compareEP("9C60E8000000005DB8B38540002DAC8540002BE88DB5D3FEFFFF8B0683F80074118DB5DFFEFFFF8B0683F8010F84F1010000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874")?(sVersion="0.32a",sOptions="fake nSPack 1.3"):PE.compareEP("FC5550E8000000005DEB01E360E803000000D2EB0B58EB014840EB0135FFE0E761585DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A58")?(sVersion="0.32a",sOptions="fake PC-Guard 4.XX"):PE.compareEP("E8000000005B83EB05EB04'RND!'85C07302F70550E808000000EAFF58EB18EB010FEB02CD20EB03EACD205858EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB")?(sVersion="0.32a",sOptions="fake PE Crypt 1.02"):PE.compareEP("EB03CD20C71EEB03CD20EA9CEB02EB01EB01EB60EB03CD20EBEB01EBE803000000E9EB04584050C3EB03CD20EBEB03CD2003619D83C404EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83")?(sVersion="0.32a",sOptions="fake PE Lock NT 2.04"):PE.compareEP("9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802")?(sVersion="0.32a",sOptions="fake PEBundle 0.2-3.X"):PE.compareEP("9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD83BD9C38400001619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200000029")?(sVersion="0.32a",sOptions="fake PEBundle 2.0X-2.4X"):PE.compareEP("EB06682EA80000C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F904000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A")?(sVersion="0.32a",sOptions="fake PECompact 1.4X"):PE.compareEP("60E82B000000'\r\n\r\n\r\nRegistAred to: NON-COMMERCIAL!!\r\n\r\n\r'005861EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4087404")?(sVersion="0.32a",sOptions="fake PESHiELD 0.25"):PE.compareEP("B8........6A0068........64FF350000000064892500000000669C605083C40461669D648F050000000083C408EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB")?(sVersion="0.32a",sOptions="fake PEtite 2.1"):PE.compareEP("60E801000000E883C404E801000000E95D81EDFF22400061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83")?(sVersion="0.32a",sOptions="fake PEX 0.99"):PE.compareEP("60E8000000005D81ED0600000064A02300000083C50661EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4")?(sVersion="0.32a",sOptions="fake SVKP 1.11"):PE.compareEP("60BE00908B008DBE0080B4FF5783CDFFEB3A9090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB730B75198B1E83EEFC11DB7210586190EB05E8EB0440")?(sVersion="0.32a",sOptions="fake UPX 0.89.6-1.02/1.05-1.24"):PE.compareEP("53558be833dbeb$$e800000000582d........506033c9505850508be851fd2e2b84..........8bf02e03b4..........8bf8")?(sVersion="0.32a",sOptions="fake WWPack32 1.X"):PE.compareEP("60E8000000005D81EDF31D4000B97B0900008DBD3B1E40008BF7AC902C8AC0C078900462EB010061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")?(sVersion="0.32a",sOptions="fake Yoda's Cryptor 1.2"):PE.compareEP("60EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8")?sVersion="0.1-0.2":PE.compareEP("60D1CB0FCAC1CAE0D1CA0FC8EB01F1")?sVersion="0.31":PE.compareEP("EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003")?sVersion="0.32a":PE.compareEP("558bec5657bf........8b75..85f65f5e5deb$$eb$$eb$$e8$$$$$$$$e8$$$$$$$$eb$$83c4")&&(sVersion="0.31a"),bDetected=bDetected||Boolean(sVersion),result()}meta("protector","MSLRH")

================================================
FILE: dbs_min/db/PE/protector_MZ0oPE.2.sg
================================================
function detect(){return PE.compareEP("EBCA890383C30487FE32C0AE75FD87FE803EFF75E2465B83C304538B1B803FFF75C98BE56168")&&(sVersion="1.0.6b",bDetected=1),result()}meta("protector","MZ0oPE")

================================================
FILE: dbs_min/db/PE/protector_MaskPE.2.sg
================================================
function detect(){return PE.isSectionNamePresent(".MaskPE")&&PE.compareEP("60")&&PE.isSignaturePresent(PE.getEntryPointOffset(),256,"6160e8........8bc33e8b..40e8")&&(sVersion="2.0",bDetected=1),result()}meta("protector","MaskPE")

================================================
FILE: dbs_min/db/PE/protector_Maxtocode.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("Attick.dll")&&PE.isNetObjectPresent("CheckRuntime")?(sVersion="1.X",sOptions="Runtime",bDetected=1):PE.isSignatureInSectionPresent(0,"00'InfaceMax 'ffffff005f175920ffff00'toCode_interface'00")?(sVersion="1.X",bDetected=1):PE.isNetObjectPresent("MRuntime3.dll")&&(sVersion="3.X",bDetected=1)),result()}meta("protector","Maxtocode")

================================================
FILE: dbs_min/db/PE/protector_Metrowerks_CodeWarrior.2.sg
================================================
function detect(){return(PE.compareEP("5589E55356578B750C8B5D1083FE01740583FE0275125356FF7508E86EFFFFFF09C0750431C0EB215356FF7508E8")||PE.compareEP("5589E5535683EC4455B8FFFFFFFF505068........64FF35000000006489250000000068"))&&(sVersion="2.0",bDetected=1),result()}meta("protector","Metrowerks CodeWarrior")

================================================
FILE: dbs_min/db/PE/protector_Morphnah.2.sg
================================================
function detect(){return PE.compareEP("558bec87e55de9$$$$$$$$558bec83ec..5356576064a1........8b40..8945..64a1........c740")?(sVersion="1.0.7",bDetected=1):PE.section[".nah"]&&(PE.compareEP("60e8$$$$$$$$5d81ed........8bbd........8b8d........b8........01e88030..83f9..74..817f..........75..8b57")?(sVersion="1.0.2",bDetected=1):PE.compareEP("60e8$$$$$$$$5d81ed........31c04083f0..403d........75..be........eb..eb..8b85........83f8..75..31c001ee3d")?(sVersion="1.0.3",bDetected=1):PE.compareEP("eb$$608b4c....87d187d18b093bed")&&(sVersion="beta 2",bDetected=1)),result()}meta("protector","Morphnah")

================================================
FILE: dbs_min/db/PE/protector_N-Code.2.sg
================================================
function detect(){return PE.compareEP("9066be....6683fe..74..66b8....66be....6683fe..74..6683e8..66bb....6683c3..66436681fb....74..6683f8")&&(sVersion="0.2",bDetected=1),result()}meta("protector","N-Code")

================================================
FILE: dbs_min/db/PE/protector_N-Joy.2.sg
================================================
function detect(){if(PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")){switch(PE.readWord(PE.getEntryPointOffset()+33)){case 62959:sVersion="1.0"
break
case 62847:sVersion="1.1"
break
case 60103:sVersion="1.2"
break
case 59171:sVersion="1.3"}bDetected=1}return result()}meta("protector","N-Joy")

================================================
FILE: dbs_min/db/PE/protector_NET_Spider.2.sg
================================================
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"'Protected_By_Attribute'00'NETSpider.Attribute'")&&(sVersion="0.5-1.3",bDetected=1),result()}meta("protector",".NET Spider")

================================================
FILE: dbs_min/db/PE/protector_NTkrnl_Protector.2.sg
================================================
function detect(){return PE.compareEP("68........e8")&&1<=PE.nLastSection&&1==PE.getNumberOfImports()&&2==PE.getNumberOfImportThunks(0)&&"LoadLibraryA"==PE.getImportFunctionName(0,0)&&"GetProcAddress"==PE.getImportFunctionName(0,1)&&(PE.isSignatureInSectionPresent(1,"'http://www.ntcore.com  '")?(sVersion="0.1",bDetected=1):PE.isSignatureInSectionPresent(1,"'http://www.ntkrnl.com'")&&(sVersion="0.15",bDetected=1)),PE.compareEP("68........e8........c3")&&PE.compareEP("68########60e8$$$$$$$$5d4555c3")&&(bDetected=1),result()}meta("protector","NTkrnl Protector")

================================================
FILE: dbs_min/db/PE/protector_NetReactor.2.sg
================================================
function detect(){if(PE.section[".reacto"])0==PE.section[1].FileSize&&0==PE.section[2].FileSize&&0==PE.section[3].FileSize&&(sVersion="2.0-2.1",bDetected=1)
else if(PE.compareEP("558becb90f0000006a006a004975f951535657b8........e8"))sVersion="2.X-3.X",bDetected=1
else if(PE.resource.__&&PE.compareEP("e8$$$$$$$$8bff558bec83ec10"))PE.compareEP("e8........e9........6a0c68")?(sVersion="4.2",bDetected=1):PE.compareEP("e8........e9........8bff558bec83ec208b45085657")&&(sVersion="4.5-4.7",bDetected=1)
else if(PE.isNet()){if(PE.isSignatureInSectionPresent(0,"558becb90f0000006a006a004975f951535657b8........e8")?(sVersion="3.X",bDetected=1):2<=PE.section.length&&3221225536==PE.section[1].Characteristics&&PE.isSignatureInSectionPresent(1,"5266686E204D182276B5331112330C6D0A204D18229EA129611C76B505190158")&&(sVersion="4.8-4.9",bDetected=1),PE.isNetObjectPresent("NecroVM.Runtime"))return
PE.isSignatureInSectionPresent(0,"6D5F6973526561644F6E6C790B636F6D70617265496E666F0874657874496E666F076E756D496E666F0C6461746554696D65496E666F0863616C656E6461720A6D5F646174614974656D0963756C747572654944066D5F6E616D65116D5F757365557365724F76657272696465")&&(sVersion="6.X")
for(var e="",t=0;t<5;t++)e+="'m_'%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%00"
PE.isSignatureInSectionPresent(0,e)&&(sOptions=sOptions.append("Control Flow"),sVersion="6.X",bDetected=1),PE.isSignatureInSectionPresent(0,"'$$method0x'363030303331372D310024246D6574686F643078363030303333322D310024246D6574686F643078363030303333322D320024246D6574686F643078363030303334302D310024246D6574686F643078363030303334302D320024246D6574686F643078363030303335332D310024246D6574686F64")&&(sVersion="6.5",bDetected=1),PE.isNetGlobalCctorPresent()&&(PE.isNetObjectPresent("BinaryReader")&&PE.isNetObjectPresent("RSACryptoServiceProvider")&&PE.isSignatureInSectionPresent(0,"2000690073002000740061006D00700065007200650064002E00")?(sOptions=sOptions.append("Anti-tamper"),bDetected=1):PE.isNetObjectPresent("kernel32")&&PE.isSignatureInSectionPresent(0,"6B00650072006E0065006C002000")&&(bDetected=1)),PE.isNetObjectPresent("SuppressIldasmAttribute")&&(sOptions=sOptions.append("Anti-ILDASM")),PE.isSignatureInSectionPresent(0,"45007A006900720069007A0027007300200022002E004E00450054002000520065006100630074006F0072002200210020005400680069007300200061")&&PE.isNetObjectPresent("DateTime")&&(sOptions=sOptions.append("Demo"),bDetected=1)}return result()}meta("protector",".NET Reactor")

================================================
FILE: dbs_min/db/PE/protector_NetShield.2.sg
================================================
function detect(){return PE.isNet()&&PE.isSectionNamePresent("!Sugar")&&PE.isNetGlobalCctorPresent()&&(bDetected=1,PE.isNetObjectPresent("ConfusedByAttribute")&&(sOptions="Fake signs"),PE.isNetObjectPresent("SuppressIldasmAttribute")&&(sOptions=sOptions.append("Anti-ILDASM")),PE.isNetObjectPresent("Form200"))&&(sOptions=sOptions.append("Anti-de4dot")),result()}meta("protector","NetShield")

================================================
FILE: dbs_min/db/PE/protector_Ningishzida.2.sg
================================================
function detect(){return PE.compareEP("9C6096E8000000005D81ED........B9041B00008DBD........8BF7AC")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Ningishzida")

================================================
FILE: dbs_min/db/PE/protector_NoobyProtect.2.sg
================================================
function detect(){var e=PE.section[PE.getImportSection()]
return e&&"SE"==e.Name&&(sVersion="Safengine",bDetected=1),result()}meta("protector","NoobyProtect")

================================================
FILE: dbs_min/db/PE/protector_North_Star_PE_Shrinker.2.sg
================================================
function detect(){return PE.compareEP("9C60E8000000005DB8........2D........2BE88DB5")&&!PE.isSectionNamePresent("nsp0")&&(sVersion="1.3",bDetected=1),result()}meta("protector","North Star PE Shrinker")

================================================
FILE: dbs_min/db/PE/protector_ORiEN.2.sg
================================================
function detect(){if(PE.compareEP("E95D010000CED1CE..'\r\n--------------------------------------------\r\n- ORiEN executable files protection system -\r\n------ Created by A. Fisun, 1994-2003 ------\r\n------- WWW: http://zalexf.narod.ru/ -------\r\n-------- e-mail: zalexf@hotmail.ru ---------\r\n--------------'")){switch(PE.readByte(PE.getEntryPointOffset()+8)){case 206:sVersion="2.11"
break
case 205:sVersion="2.12"}bDetected=1}return result()}meta("protector","ORiEN")

================================================
FILE: dbs_min/db/PE/protector_Obfuscar.2.sg
================================================
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"0691066120AA00000061D29C0617580A")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Obfuscar")

================================================
FILE: dbs_min/db/PE/protector_Obfuscator_NET_2009.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isNetUStringPresent("Macrobject.Obfuscator")?bDetected=1:PE.isNetUStringPresent("Obfuscated by Macrobject Obfuscator.NET UNREGISTRED")&&(sOptions="Unregistered",bDetected=1)),result()}meta("protector","Obfuscator.NET 2009")

================================================
FILE: dbs_min/db/PE/protector_Obsidium.2.sg
================================================
function detect(){var E
if(!PE.isNet())return PE.compareEP("E8AB1C")?(sVersion="1.0.0.59",bDetected=1):PE.compareEP("E8AF1C0000")?(sVersion="1.0.0.61",bDetected=1):PE.compareEP("EB02....E8E71C0000")?(sVersion="1.1.1.1",bDetected=1):PE.compareEP("EB02....E8771E0000")?(sVersion="1.2",bDetected=1):PE.compareEP("EB02....E83F1E0000")?(sVersion="1.2.0.0",bDetected=1):PE.compareEP("E80E0000008B54240C8382B8000000")?(sVersion="1.2.5.0",bDetected=1):PE.compareEP("EB01..E829000000EB02....EB01..8B54240CEB04")?(sVersion="1.2.5.8",bDetected=1):PE.compareEP("E80E00000033C08B54240C8382B80000000DC36467FF36")?(sVersion="1.2.X",bDetected=1):PE.compareEP("EB04........E829000000EB02....EB01..8B54240CEB02")?(sVersion="1.3.0.0",bDetected=1):PE.compareEP("EB02....E825000000EB04........EB01..8B54240CEB01")?(sVersion="1.3.0.4",bDetected=1):PE.compareEP("EB01..E826000000EB02....EB02....8B54240CEB01")?(sVersion="1.3.0.13",bDetected=1):PE.compareEP("EB02....E828000000EB04........EB01..8B54240CEB")?(sVersion="1.3.0.17",bDetected=1):PE.compareEP("EB03......E82E000000EB04........EB04........8B")?(sVersion="1.3.0.21",bDetected=1):PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB04")?(sVersion="1.3.0.37",bDetected=1):PE.compareEP("EB02....E827000000EB02....EB03......8B54240CEB01")?(sVersion="1.3.1.1",bDetected=1):PE.compareEP("EB04........E82A000000EB03......EB04........8B54")?(sVersion="1.3.2.2",bDetected=1):PE.compareEP("EB01..E829000000EB02....EB03......8B54240CEB02")?(sVersion="1.3.3.1",bDetected=1):PE.compareEP("EB01..E82B000000EB02....EB02....8B54240CEB03")?(sVersion="1.3.3.2",bDetected=1):PE.compareEP("EB02....E829000000EB03......EB03......8B..240CEB")?(sVersion="1.3.3.3",bDetected=1):PE.compareEP("EB02....E829000000EB03......EB02....8B54240CEB03")?(sVersion="1.3.3.4",bDetected=1):PE.compareEP("EB04........E828000000EB01..............8B54240")?(sVersion="1.3.3.6",bDetected=1):PE.compareEP("EB02....E827000000EB03......EB01..8B54240CEB03")||PE.compareEP("EB02....E82C000000EB04........EB04........8B5424")?(sVersion="1.3.3.7",bDetected=1):PE.compareEP("EB04........E828000000EB01..EB01..8B54240CEB04")?(sVersion="1.3.3.8",bDetected=1):PE.compareEP("EB02....E829000000EB03......EB01..8B54240CEB04")?(sVersion="1.3.3.9",bDetected=1):PE.compareEP("EB01..E82A000000EB04........EB02....8B54240CEB03")?(sVersion="1.3.4.1",bDetected=1):PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB02")?(sVersion="1.3.4.2",bDetected=1):PE.compareEP("EB03......E8........EB02....EB04........8B54240C")?(sVersion="1.3.5.0",bDetected=1):PE.compareEP("EB04........50EB04........E8........EB02....EB04........33C0")?(sVersion="1.4.2.0",bDetected=1):PE.compareEP("EB02....50EB04........E8........EB01..EB01..8B54240C")||PE.compareEP("EB04........50EB01..E8........EB02....EB01..33C0")||PE.compareEP("EB05..........50EB04........E8........EB02....EB04........33C0")||PE.compareEP("EB03......50EB02....E8........EB05..........EB04........33C0")||PE.compareEP("EB01..50EB01..E8........EB04........EB02....33C0")||PE.compareEP("EB01..50EB04........E8........EB03......EB03......33C0")||PE.compareEP("EB01..50EB01..E8........EB01..EB02....33C0")||PE.compareEP("EB01..50EB01..E8........EB05..........EB04........33C0")||PE.compareEP("EB05..........50EB02....E8........EB02....EB03......33C0")||PE.compareEP("EB01..50EB04........E8........EB04........EB01..33C0")||PE.compareEP("EB03......50EB04........E8........EB04........EB03......8B54240C")||PE.compareEP("EB04........50EB02....E8........EB03......EB02....8B54240C")||PE.compareEP("EB04........50EB05..........E8........EB01..EB02....33C0")||PE.compareEP("EB04........E8........EB01..EB01..8B54240C")||PE.compareEP("EB03......E8........EB04........EB01..8B54240C")||PE.compareEP("EB03......50EB02....E8........EB01..EB03......33C0")||PE.compareEP("EB04........50EB01..E8........EB02....EB04........33C0")||PE.compareEP("EB03......50EB03......E8........EB04........EB01..33C0")||PE.compareEP("EB04........50EB01..E8........EB03......EB04........33C0")||PE.compareEP("EB01..50EB01..E8........EB04........EB03......33C0")||PE.compareEP("EB03......50EB01..E8........EB03......EB02....33C0")||PE.compareEP("EB02....50EB02....E8........EB04........EB01..33C0")||PE.compareEP("EB04........50EB02....E8........EB03......EB05..........33C0")||PE.compareEP("EB01..50EB01..E8........EB02....EB03......33C0")||PE.compareEP("EB05..........50EB04........E8........EB04........EB03......33C0")||PE.compareEP("EB04........50EB01..E8........EB03......EB02....33C0")||PE.compareEP("EB05..........50EB02....E8........EB03......EB04........33C0")||PE.compareEP("EB04........50EB01..E8........EB04........EB04........33C0")||PE.compareEP("EB02....50EB01..E8........EB05..........EB01..33C0")||PE.compareEP("EB03......50EB04........E8........EB04........EB01..33C0")||PE.compareEP("EB03......50EB01..E8........EB01..EB02....33C0")||PE.compareEP("EB01..50EB05..........E8........EB05..........EB03......33C0")||PE.compareEP("EB03......50EB02....E8........EB04........EB02....33C0")||PE.compareEP("EB03......50EB02....E8........EB03......EB02....33C0")||PE.compareEP("EB01..50EB04........E8........EB01..EB05..........33C0")||PE.compareEP("EB05..........50EB01..E8........EB01..EB03......33C0")||PE.compareEP("EB05..........50EB04........E8........EB01..EB02....33C0")||PE.compareEP("EB04........50EB03......E8........EB04........EB03......33C0")||PE.compareEP("EB05..........50EB03......E8........EB01..EB01..33C0")||PE.compareEP("EB01..50EB03......E8........EB05..........EB03......33C0")||PE.compareEP("EB$$EB$$50EB$$E8$$$$$$$$EB$$B8........eb$$eb$$05........eb$$75..eb$$64ff30")?bDetected=1:PE.compareEP("EB")?(E=PE.OffsetToVA(PE.getEntryPointOffset()),PE.readByte(PE.VAToOffset(E)+1)<6&&(E=PE.getDisasmNextAddress(E),80==PE.readByte(PE.VAToOffset(E)))&&(E=PE.getDisasmNextAddress(E),235==PE.readByte(PE.VAToOffset(E)))&&PE.readByte(PE.VAToOffset(E)+1)<6&&(E=PE.getDisasmNextAddress(E),232==PE.readByte(PE.VAToOffset(E)))&&(E=PE.getDisasmNextAddress(E+5),235==PE.readByte(PE.VAToOffset(E)))&&PE.readByte(PE.VAToOffset(E)+1)<6&&(E=PE.getDisasmNextAddress(E),PE.compare("8B54240C",PE.VAToOffset(E))||PE.compare("33C0",PE.VAToOffset(E)))&&(sVersion="1.4.X.X",bDetected=1)):PE.compareEP("eb08................eb03......50eb02")?(sVersion="1.6b43",bDetected=1):PE.compareEP("E84719")||PE.compareEP("EB$$E8....0000EB$$EB$$8B54240CEB")?bDetected=1:PE.getEntryPointSection()==PE.nLastSection?PE.compareEP("EB")&&0<=PE.getImportSection()&&PE.isOverlayPresent()&&(bDetected=1):PE.compareEP("EB")&&PE.compare("'ANTS'",PE.getEntryPointOffset()-4)&&(sOptions="heuristic detection",bDetected=1),result()}meta("protector","Obsidium")

================================================
FILE: dbs_min/db/PE/protector_OneVM.2.sg
================================================
function detect(){return PE.isNet()&&PE.isNetObjectPresent("Koi")&&PE.isNetObjectPresent("OneVM.Runtime")&&PE.isSignatureInSectionPresent(0,"72 .. .. .. .. 73 .. .. .. .. 7A")&&PE.isSignatureInSectionPresent(0,"%% 00 %% %% %% %% %% %% %% %% 00 %%")&&(bDetected=1,PE.isNetUStringPresent("OneVM V2 BETA"))&&(sVersion="2.0, beta"),result()}meta("protector","OneVM")

================================================
FILE: dbs_min/db/PE/protector_Oreans_CodeVirtualizer.2.sg
================================================
function detect(){return(PE.compareEP("eb$$e9$$$$$$$$e9$$$$$$$$565053e8$$$$$$$$584889c348ffc0482d........482d........4805........803b..75..c603..bb........68........68........5350e8")||PE.isSectionNamePresent(".vlizer"))&&(bDetected=1),result()}meta("protector","Oreans CodeVirtualizer")

================================================
FILE: dbs_min/db/PE/protector_PACE.2.sg
================================================
function detect(){return PE.compareEP("833d..........75..E8........a3........e8$$$$$$$$56578b3d........8bc7e8........8bf085f674..5668........68........ff15")&&(sVersion="Eden wrapper",bDetected=1),PE.compareEP("558bec81ec........5356578d45..6a..5068........ff15........85c074..8b45..eb..8b75..6a..56ff15........85c075..66813e")&&(sVersion="InterLok",bDetected=1),result()}meta("protector","PACE")

================================================
FILE: dbs_min/db/PE/protector_PCShrink.2.sg
================================================
function detect(){return PE.compareEP("01AD........FFB5........6A40FF95")?(sVersion="0.71 beta",bDetected=1):PE.compareEP("9C60BD........01AD........FF..........6A..FF..........50502D........89..........5F8D")&&(sVersion="0.71",bDetected=1),result()}meta("protector","PCShrink")

================================================
FILE: dbs_min/db/PE/protector_PC_Guard.2.sg
================================================
function detect(){return PE.isNet()?PE.isSignatureInSectionPresent(0,"00000000000000000000000000000000fc5550e8000000005d60e80300000083")&&(sVersion="5.X",bDetected=1):PE.compareEP("fc5550e8000000005d60e8$$$$$$$$eb$$58eb$$40eb$$ffe0")?(sVersion="5.04-5.05",bDetected=1):PE.compareEP("fc5550e8$$$$$$$$5deb$$60e8")&&(sVersion="4.06",bDetected=1),result()}meta("protector","PC Guard")

================================================
FILE: dbs_min/db/PE/protector_PE-Armor.2.sg
================================================
function detect(){return PE.compareEP("E8$$$$$$$$5D81ED050000008D753D56FF55318DB5860000005650FF552D898593000000")?(sVersion="0.46",bDetected=1):PE.compareEP("5652515355E81501000032....0000000000")?(sVersion="0.49",bDetected=1):PE.compareEP("60E8000000005D81ED........8DB5........555681C5........55C3")?(sVersion="0.7X",bDetected=1):PE.compareEP("558bec83c4..b8........e8$$$$$$$$5883ec..5de9$$$$$$$$60e8000000005d81ed........8db5........5556")&&(sVersion="0.X",bDetected=1),result()}meta("protector","PE-Armor")

================================================
FILE: dbs_min/db/PE/protector_PE-Shield.2.sg
================================================
function detect(){PE.compareEP("E9$$$$$$$$60E8$$$$$$$$5D83ED..EB$$8DB5........BA........8A3C1632FA80....80....88....4AEB")?(sVersion="0.25",bDetected=1):PE.compareEP("60E8$$$$$$$$5D83ED..EB$$8D....................8A....32..80....80....88......EB")?(sVersion="0.25-0.26",bDetected=1):PE.compareEP("60E8$$$$$$$$414e414b494e5d83ed..eb$$8d....................8a....32")&&(sVersion="0.2",bDetected=1)
var $=PE.section.PESHiELD
return bDetected?$||(sOptions="modified"):PE.isImportPositionHashPresent(0,911341197)&&$&&(bDetected=1),result()}meta("protector","PE-SHiELD")

================================================
FILE: dbs_min/db/PE/protector_PEBundle.2.sg
================================================
function detect(){if(PE.compareEP("9C60E802......33C08BC483C004938BE38B5BFC81EB........87DD")){switch(PE.getEntryPointSignature(28,2)){case"6A04":sVersion="0.2-2.0X"
break
case"01AD":sVersion="2.0b5-2.3"
break
case"83BD":sVersion="2.44"
break
case"80BD":sVersion="3.XX"}bDetected=1,PE.isSectionNamePresentExp(/^(peb|PEB)undle$/)||(sOptions="modified")}return result()}meta("protector","PEBundle")

================================================
FILE: dbs_min/db/PE/protector_PECRYPT32.2.sg
================================================
function detect(){return PE.compareEP("e8000000005b83eb..eb$$85c073..f705................58eb$$56575550e8")?(sVersion="1.02",sOptions="by random & killa",bDetected=1):PE.compareEP("e8000000005b83eb..eb$$eb$$eb$$eb$$eb$$eb$$eb$$eb$$80bb..........74..83bb..........74..be........03f38bbb........eb")?(sVersion="1.02",sOptions="by random & acpizer",bDetected=1):PE.compareEP("e8000000005b83eb..8b83........538beb2bd82b9d........899d........5bbe........03f38b93........52ad0bc00f84........8983")&&(sVersion="0.0193c",sOptions="by random & acp",bDetected=1),result()}meta("protector","PECRYPT32")

================================================
FILE: dbs_min/db/PE/protector_PELock.2.sg
================================================
function detect(){if(!PE.isNet()&&!PE.is64()){for(var e="",t=0,s=0,i=0,r=0,P=0,o=0,E=0,n=PE.OffsetToVA(PE.getEntryPointOffset()),c=0;c<1e3;)c++,"CLC"==(e=-1!=(e=PE.getDisasmString(n)).indexOf(" ")?e.slice(0,e.indexOf(" ")):e)&&t++,"STC"==e&&s++,"MOVSX"==e&&0,"MOVZX"==e&&i++,"SUB"==e&&r++,"IMUL"==e&&P++,"BT"!=e&&"BTR"!=e&&"BTS"!=e&&"BTC"!=e||o++,"BSF"!=e&&"BSR"!=e&&"BSWAP"!=e||E++,n=PE.getDisasmNextAddress(n)
return(bDetected=0<t&&0<s&&0!=i&&(P<r||0==r&&0==P)&&0==o&&0==E?!0:bDetected)||(PE.compareEP("6A6068........E8........BF94")||PE.isImportPositionHashPresent(0,3781729660))&&(sVersion="2.X",bDetected=1),result()}}meta("protector","PELock")

================================================
FILE: dbs_min/db/PE/protector_PENinja.2.sg
================================================
function detect(){return PE.compareEP("5D8BC581ED........2B85........2D710200008985........0FB6B5........8BFD")&&(sOptions="modified",bDetected=1),result()}meta("protector","PE Ninja")

================================================
FILE: dbs_min/db/PE/protector_PESpin.2.sg
================================================
function detect(){if(PE.is64())PE.compareEP("554881EC900000008D6C2428488975..48897D..48895D..4C8945..4C894D..4C8955..4C895D..4C8965..4C896D..4C8975..4C897D..48894D..488955")?(sVersion="1.2X",bDetected=1):PE.compareEP("554881EC90000000488d6c24284889751848897d2048895d004c8945284c894d304c8955384c895d404c8965484c896d504c8975584c897d6048894d0848895510482bc94c8d05")&&(sVersion="1.23",bDetected=1)
else if(PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24")){switch(PE.readByte(PE.getEntryPointOffset()+27)){case 92:sVersion="0.1"
break
case 183:sVersion="0.3"
break
case 115:sVersion="0.4"
break
case 131:sVersion="0.7"
break
case 200:sVersion="1.0"
break
case 125:sVersion="1.1"
break
case 113:sVersion="1.3, beta"
break
case 172:sVersion="1.3"
break
case 136:sVersion="1.3X"
break
case 23:sVersion="1.32"
break
case 119:sVersion="1.33"}bDetected=1}return result()}meta("protector","PESpin")

================================================
FILE: dbs_min/db/PE/protector_PETetris.2.sg
================================================
function detect(){return PE.isSectionNamePresent("PETETRIS")&&(bDetected=1),result()}meta("protector","PETetris")

================================================
FILE: dbs_min/db/PE/protector_PE_Diminisher.2.sg
================================================
function detect(){return PE.compareEP("535152565755E8000000005D8BD581ED........2B95........81EA0B0000008995........80BD")?(sVersion="0.1",bDetected=1):PE.compareEP("5D8BD581ED........2B95........81EA0B......8995........80BD")&&(sVersion="0.1",sOptions="Alt",bDetected=1),result()}meta("protector","PE Diminisher")

================================================
FILE: dbs_min/db/PE/protector_PE_Encrypt.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4D05356578D75FC8B442430250000FFFF8138'MZ'900074072D00100000EBF18945FC")&&(sVersion="1.0",bDetected=1),result()}meta("protector","PE Encrypt")

================================================
FILE: dbs_min/db/PE/protector_PE_Intro.2.sg
================================================
function detect(){return PE.compareEP("8B04249C60E8........5D81ED........80BD..........0F8548")&&(sVersion="1.0",bDetected=1),result()}meta("protector","PE Intro")

================================================
FILE: dbs_min/db/PE/protector_PE_Lock_NT.2.sg
================================================
function detect(){return PE.compareEP("EB03CD20EBEB01EB1EEB01EBEB02CD209CEB03CD")?(sVersion="2.01",bDetected=1):PE.compareEP("EB02C7851EEB03CD20EBEB01EB9CEB01EBEB02CD")?(sVersion="2.02c",bDetected=1):PE.compareEP("EB02C7851EEB03CD20C79CEB0269B160EB02EB01")?(sVersion="2.03",bDetected=1):PE.compareEP("EB$$1EEB$$9CEB$$EB$$60EB$$EB$$E8$$$$$$$$584050C3")&&(sVersion="2.04",bDetected=1),result()}meta("protector","PELOCKnt")

================================================
FILE: dbs_min/db/PE/protector_PE_Lock_Phantasm_by_Ding_Boy.2.sg
================================================
function detect(){return PE.compareEP("555756525153E8000000005D8BD581ED")?(sVersion="0.07/0.8",bDetected=1):PE.compareEP("5557565251536681C3EB02EBFC6681C3EB02EBFC")?(sVersion="1.0/1.1",bDetected=1):PE.compareEP("9C5557565251539CFAE8000000005D81ED")&&(sVersion="1.5b3",bDetected=1),result()}meta("protector","PE Lock Phantasm by Ding Boy")

================================================
FILE: dbs_min/db/PE/protector_PE_Password.2.sg
================================================
function detect(){return PE.compareEP("E804......8BEC5DC333C05D8BFD81ED........81EF........83EF0589AD........8D9D........8DB5........4680")&&(sVersion="0.2",bDetected=1),result()}meta("protector","PE Password")

================================================
FILE: dbs_min/db/PE/protector_PE_Protect.2.sg
================================================
function detect(){return(PE.compareEP("'\r\nPE-PROTECT 0.9 (C)o'",64)||PE.compareEP("525155576467A1300085C0780DE8........5883C007C6..C3"))&&(sVersion="0.9",bDetected=1),result()}meta("protector","PE Protect")

================================================
FILE: dbs_min/db/PE/protector_PEncrypt.2.sg
================================================
function detect(){return PE.compareEP("609CBE........8BFEB9........BB78563412AD33C3ABE2FA9D61E9......FF")?(sVersion="1.0",bDetected=1):PE.compareEP("EB$$E8000000005D81ED........8DB5........E8330000008985")?(sVersion="2.0",bDetected=1):PE.compareEP("E8000000005D81ED........8DB5........8BFEB90F000000BB")?(sVersion="3.0",bDetected=1):PE.compareEP("E9......00F00FC6")&&(sVersion="3.1",bDetected=1),result()}meta("protector","PEncrypt")

================================================
FILE: dbs_min/db/PE/protector_PEnguinCrypt.2.sg
================================================
function detect(){return PE.compareEP("B8........55506764FF360000676489260000BD4B484342B804000000CC")&&(sVersion="1.0",bDetected=1),result()}meta("protector","PEnguinCrypt")

================================================
FILE: dbs_min/db/PE/protector_PUNiSHER.2.sg
================================================
function detect(){return PE.compareEP("EB0483A4BCCE60EB0480BC0411E800000000")&&(sVersion="1.5 demo",bDetected=1),result()}meta("protector","PUNiSHER")

================================================
FILE: dbs_min/db/PE/protector_Phoenix.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"0000010b160c..........0208..........0d0906085961d21304091e630861d21305070811051e62110460d19d081758")?(sVersion="1.7-1.8",bDetected=1):PE.isSignatureInSectionPresent(0,"'?.resources'")?(sVersion="1.X",bDetected=1):PE.compareEP_NET("1b3002001c00000000000000280100000a280200000add01000000dc28070000")&&(bDetected=1)),result()}meta("protector","Phoenix")

================================================
FILE: dbs_min/db/PE/protector_Photo_Compiler.2.sg
================================================
function detect(){return PE.compareEP("558bEC83C4F0B8")&&PE.compareOverlay("'PK'")&&PE.isSignatureInSectionPresent(0,"'PhotoCompiler.Runtime'")&&(bDetected=1),result()}meta("protector","Photo Compiler")

================================================
FILE: dbs_min/db/PE/protector_PolyCrypt_PE.2.sg
================================================
function detect(){return PE.compareEP("60e8$$$$$$$$918bf4adfec9803408..e2..c3")&&(sVersion="2004-2005",bDetected=1),result()}meta("protector","JLabSoftware PolyCrypt PE")

================================================
FILE: dbs_min/db/PE/protector_Private_EXE_Protector.2.sg
================================================
function detect(){var e
return PE.compareEP("558BEC83C4F4FC5357568B7424208B7C242466813E4A430F85A502000083C60A33DB")?(sVersion="1.9.7",bDetected=1):PE.compareEP("B8........B9..9001..BE........68........6801......C3")?(sVersion="1.X",bDetected=1):PE.compareEP("89....380000008B..0000000081..........89..0000000081..0400000081..0400000081..000000000F85D6FFFFFF")?(sVersion="2.0",bDetected=1):PE.compareEP("52ba........c702########....50....53....51....52....56..57....55....81ee")?(sVersion="3.04",bDetected=1):PE.compareEP("EB08....0000000000007.009C")||PE.compareEP("EB08....0000000000007.0068")?(sVersion="4.0-4.12",bDetected=1):PE.compareEP("6064ff35........b9........89ce81c6........ba........bd........8b0683c6..8b1e89dffcf829c333dd31c3891e")?(sVersion="4.X",bDetected=1):PE.compareEP("51b9........c701........59ff35........c3")||PE.compareEP("53bb........c703........5bff35........c3")?(sVersion="3.4.0",bDetected=1):-1!=PE.findSignature(PE.getEntryPointOffset(),2816,"b900000000f3ae")||-1!=PE.findSignature(PE.getEntryPointOffset(),2816,"b900000000f366")?(sVersion="3.0.0-3.3.5",bDetected=1):1==PE.getNumberOfImports()&&"KERNEL32.DLL"==PE.getImportLibraryName(0)&&1==PE.getNumberOfImportThunks(0)&&(3221225504==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||3758096416==PE.section[0].Characteristics&&512==PE.getEntryPointOffset()||3758096416==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||1610612768==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||3758096512==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||3221225536==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||3758096480==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||3758096448==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset()||4026531904==PE.section[0].Characteristics&&1024==PE.getEntryPointOffset())?(sVersion="2.00-2.25",bDetected=1):3<=PE.section.length&&(1==PE.getNumberOfImports()&&"KERNEL32.DLL"==PE.getImportLibraryName(0)&&"ExitProcess"==PE.getImportFunctionName(0,0)?4096==PE.getAddressOfEntryPoint()&&512!=PE.section[0].FileSize&&1024!=PE.section[0].FileSize&&3758096416==PE.section[0].Characteristics?(bDetected=1,sVersion="1.X"):3825205248==PE.section[0].Characteristics&&3221225472==PE.section[1].Characteristics&&1342177344==PE.section[2].Characteristics&&(bDetected=1,sVersion="1.7"):1!=PE.getNumberOfImports()&&2!=PE.getNumberOfImports()||"KERNEL32.DLL"==PE.getImportLibraryName(0)&&1==PE.getNumberOfImportThunks(0)&&(e=PE.nLastSection,".rsrc"==PE.section[e].Name&&e--,3758096384==PE.section[e].Characteristics)&&3758096384==PE.section[e-1].Characteristics&&(bDetected=1,sVersion="2.X")),bDetected||PE.isImportPositionHashPresent(0,3634034317)&&(PE.isSectionNamePresent(".TRIAL!")?(sOptions="demo",bDetected=1):PE.isSectionNamePresent(".-PEP-")&&(bDetected=1)),result()}meta("protector","Private EXE Protector")

================================================
FILE: dbs_min/db/PE/protector_Protect_Disc.2.sg
================================================
function detect(){return PE.compareEP("363e268ac060e8$$$$$$$$558bec83ec..b8........8b7d..2bf8e8")?(sVersion="9.11.0",sOptions="Build "+getBuild(),bDetected=1):PE.compareEP("363e268ac060e8$$$$$$$$5f81ef........be........8b87........03c657568ca7")&&(sVersion="7.5.3",sOptions="Build "+getBuild(),bDetected=1),result()}function getBuild(){return PE.readDword(PE.getEntryPointOffset()+62)}meta("protector","Protect Disc")

================================================
FILE: dbs_min/db/PE/protector_Protection_Plus.2.sg
================================================
function detect(){return PE.compareEP("506029c064ff30e8........5d83ed..89e889a5........2b85........8985........8d85........508b0085c00f85")?(sVersion="4.X",bDetected=1):PE.isImportPositionHashPresent(0,391052164)&&PE.compare("'{4A6E2EB8-0392-4258-9C91-65BB5FF8F1F9}'",PE.getEntryPointOffset()-39)&&(sName+=" Wrapper",sVersion="4.6+",bDetected=1),result()}meta("protector","Protection Plus")

================================================
FILE: dbs_min/db/PE/protector_QrYPt0r.2.sg
================================================
function detect(){return PE.compareEP("EB$$E8$$$$$$$$64FF3500000000")&&(sVersion="1.0",bDetected=1),result()}meta("protector","QrYPt0r")

================================================
FILE: dbs_min/db/PE/protector_QuickBFC.2.sg
================================================
function detect(){var e=PE.section[".text"]
return PE.isSectionNamePresent(".didata")&&e&&PE.isResourceNamePresent("SRC")&&PE.isSignaturePresent(e.FileOffset,e.FileSize,"'batfilerecord'")&&(bDetected=1),sLang="Batch",result()}meta("protector","Quick Batch File Compiler")

================================================
FILE: dbs_min/db/PE/protector_QuickPack_NT.2.sg
================================================
function detect(){return PE.compareEP("4d5a90eb$$52e9$$$$$$$$e8$$$$$$$$5d8dad........8d9d........8d......506a..68........55ff53")&&(sVersion="0.1a",bDetected=1),result()}meta("protector","QuickPack NT")

================================================
FILE: dbs_min/db/PE/protector_REVProt.2.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$31c064ff30648920648f05........83c4..60e8$$$$$$$$83c4..e8$$$$$$$$5d81ed........60b9")&&(sVersion="0.1a",bDetected=1),result()}meta("protector","REVProt")

================================================
FILE: dbs_min/db/PE/protector_RLP.2.sg
================================================
function detect(){return PE.isSectionNamePresent(".rlp")&&(sVersion="0.7.3b",bDetected=1),result()}meta("protector","RLP")

================================================
FILE: dbs_min/db/PE/protector_ReNET-pack.2.sg
================================================
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"'Protected/Packed with ReNET-Pack by stx'")&&(bDetected=1),result()}meta("protector","ReNET-pack")

================================================
FILE: dbs_min/db/PE/protector_RobustObfuscator.2.sg
================================================
function detect(){return PE.isNet()&&PE.isNetGlobalCctorPresent()&&PE.isSignatureInSectionPresent(0,"00 20 .. .. .. .. FE 0E .. .. 20 .. .. .. .. 20 .. .. .. .. 20 .. .. .. .. 61 20 .. .. .. .. 20 .. .. .. .. 5F 20 .. .. .. ..")&&(bDetected=1),result()}meta("protector","Robust Obfuscator")

================================================
FILE: dbs_min/db/PE/protector_SC_Obfuscator.2.sg
================================================
function detect(){return PE.compareEP("6033c98b1d........031d........8a041984c074..3c..74..34..880419413b0d........75..a1........0105........61ff25")&&(bDetected=1),result()}meta("protector","SC Obfuscator")

================================================
FILE: dbs_min/db/PE/protector_SDProtector.2.sg
================================================
function detect(){return PE.compareEP("558BEC6AFF68........688888880864A1")&&(sVersion=PE.compareEP("5083EC08",42)?"1.10":PE.compareEP("1833C0",77)?"1.16":"1.1X",bDetected=1),result()}meta("protector","SDProtector")

================================================
FILE: dbs_min/db/PE/protector_SLVc0deProtector.2.sg
================================================
function detect(){var e=PE.nLastSection
return 2684354592==PE.section[e].Characteristics?255&PE.section[e].VirtualSize&&255&PE.section[e].FileSize&&PE.section[e].VirtualAddress==PE.getAddressOfEntryPoint()&&(sVersion="0.61",bDetected=1):PE.compareEP("E80000000058C600EBC6400108FFE0E952")&&(sVersion="1.12",bDetected=1),result()}meta("protector","SLVc0deProtector")

================================================
FILE: dbs_min/db/PE/protector_SVK_Protector.2.sg
================================================
function detect(){return PE.compareEP("60EB03C784E8EB03C7849AE8000000005D81ED10000000EB03C784E964A023000000EB")?(sVersion="1.051",bDetected=1):PE.compareEP("60E8........5D81ED06......64A023")?(sVersion="1.11",bDetected=1):PE.compareEP("60E8000000005D81ED06000000EB05B8........64A023")?(sVersion="1.3X-1.4X",bDetected=1):(PE.compareEP("E8000000005D81ED06000000EB05B8........64A023")||PE.compareEP("60E8000000005D81ED0600000074..75........64a023"))&&(bDetected=1),result()}meta("protector","SVK Protector")

================================================
FILE: dbs_min/db/PE/protector_Safedisc.2.sg
================================================
function detect(){return PE.compareEP("558bec60bb........33c98a0d........85c974..b8........2bc383e8..eb")&&(bDetected=1),result()}meta("protector","SafeDisc")

================================================
FILE: dbs_min/db/PE/protector_Safenet_RMS.2.sg
================================================
function detect(){return PE.compareEP("558bec81ec........535657c785................c745..........c745..........c745..........c785................c745..........8b45..a3........833d..........74..e9")&&(bDetected=1),result()}meta("protector","Safenet RMS (Sentinel)")

================================================
FILE: dbs_min/db/PE/protector_Safengine_Shielden.2.sg
================================================
function detect(){var e
return PE.compareEP("E8........5361")&&(4096==PE.section[PE.nLastSection].FileSize&&4096==PE.section[PE.nLastSection].VirtualSize?(sVersion="2.X",bDetected=1):8192==PE.section[PE.nLastSection].FileSize&&8192==PE.section[PE.nLastSection].VirtualSize&&(bDetected=1)),PE.compareEP("EB$$E9$$$$$$$$E8........'Safengine Shielden'")&&(sVersion="2.X",bDetected=1),PE.compareEP("E8........'Shielden'")&&-1!=(e=PE.findString(PE.getEntryPointOffset(),80,"Shielden v"))&&(sName="Shielden",sVersion=PE.getString(e+10),bDetected=1),1==bDetected&&-1!=(e=PE.findString(0,PE.getSize(),"Safengine Shielden v"))&&(sVersion=PE.getString(e+19)),result()}meta("protector","Safengine Shielden")

================================================
FILE: dbs_min/db/PE/protector_SecuROM.2.sg
================================================
function detect(){var e
return".securom"===PE.section[PE.nLastSection].Name?(sVersion="pre-8.03.03",bDetected=1):PE.section[".dsstext"]?(sVersion="8.03.03+",bDetected=1):PE.compareOverlay("'AddD'03")&&(e=PE.getOverlayOffset(),sVersion=PE.getString(e+8),bDetected=1),result()}meta("protector","SecuROM")

================================================
FILE: dbs_min/db/PE/protector_Secure_Shade.2.sg
================================================
function detect(){return PE.compareEP("558bec81ec........535657be........8d7d..8d45..a5a5a5a56a..50a4e8........8b1d........595968........ffd3")&&(sVersion="1.8",bDetected=1),result()}meta("protector","Secure Shade")

================================================
FILE: dbs_min/db/PE/protector_Shrink_Wrap.2.sg
================================================
function detect(){return PE.compareEP("58608BE85533F6684801....E84901....EB")&&(sVersion="1.4",bDetected=1),result()}meta("protector","Shrink Wrap")

================================================
FILE: dbs_min/db/PE/protector_Shrinker.2.sg
================================================
function detect(){return PE.compareEP("558BEC565775656800010000E8F1E6FFFF83C404")?(sVersion="3.2",bDetected=1):PE.compareEP("558BEC565775656800010000E8")?(sVersion="3.3",bDetected=1):PE.compareEP("558BEC5657756B6800010000E8110B000083C404")?(sVersion="3.4",bDetected=1):PE.compareEP("833D..........558BEC565775..68........e8........83....8b....a3........85F674..68")?(sVersion="3.2",bDetected=1):PE.compareEP("833D..........558BEC565775..68........e8........83....8b....a3........85F674..83")?(sVersion="3.5",bDetected=1):PE.compareEP("833DB4........558BEC5657756B6800010000E8..0B000083C4048B7508A3B4......85F67423837D0C03771D68FF")?(sVersion="3.4",bDetected=1):PE.compareEP("803D..........53568b7424..575575..85f674..68........8b3d........68........56ffd7")&&(bDetected=1),result()}meta("protector","Shrinker")

================================================
FILE: dbs_min/db/PE/protector_SimbiOZ.2.sg
================================================
function detect(){return PE.compareEP("5060E8000000005D81ED0710400068800B00008D851F10400050E8840B0000")?bDetected=1:PE.compareEP("57578D7C240450B800......AB585FC3")?(sVersion="1.3",bDetected=1):PE.compareEP("55508BC483C004C700........58C390")?(sVersion="2.1",bDetected=1):PE.compareEP("5560E8000000005D81ED........8D85........68........50E8")&&(bDetected=1),result()}meta("protector","SimbiOZ")

================================================
FILE: dbs_min/db/PE/protector_Sixxpack.2.sg
================================================
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"00'actmp.dll'00'stub'00'Sixxpack'00")?(sVersion="2.2",bDetected=1):PE.isSignatureInSectionPresent(0,"0021......'xpack!'00................'xpack'00")?(sVersion="2.4",bDetected=1):PE.isNetObjectPresent("Sixxpack")&&(sVersion="2.X",bDetected=1)),result()}meta("protector","Sixxpack")

================================================
FILE: dbs_min/db/PE/protector_Skater.2.sg
================================================
function detect(){return PE.isNet()&&(PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9")?(sVersion="2.X",bDetected=1):PE.isSignatureInSectionPresent(0,"'RustemSoft.Skater'")&&(bDetected=1)),bDetected&&PE.isSignatureInSectionPresent(0,"4F0062006600750073006300610074006F0072002000440065006D006F00")&&(sOptions="demo"),result()}meta("protector","Skater")

================================================
FILE: dbs_min/db/PE/protector_Smart_Assembly.2.sg
================================================
function detect(){var e
return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"20ffffff005f175920ffff0000")?(sVersion="3.X",bDetected=1):PE.isNetObjectPresent("Powered by {smartassembly}")?(sVersion="1.X-4.X",bDetected=1):PE.isNetObjectPresent("Powered by SmartAssembly")?(sVersion="5.X",bDetected=1):PE.isNetObjectPresent("SmartAssembly.Attributes")?bDetected=1:-1!=(nOffset=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Powered by SmartAssembly "))?(sVersion=PE.getString(nOffset+25),bDetected=1):-1!=(e=PE.getEntryPointSection())&&-1!=(nOffset=PE.findString(PE.section[e].FileOffset,PE.section[e].FileSize,"Powered by {smartassembly}"))&&(bDetected=1)),result()}meta("protector","Smart Assembly")

================================================
FILE: dbs_min/db/PE/protector_SmokesCrypt.2.sg
================================================
function detect(){return PE.compareEP("60B8........B8........8A140880F2..8814084183F9..75F1")&&(sVersion="1.2",bDetected=1),result()}meta("protector","SmokesCrypt")

================================================
FILE: dbs_min/db/PE/protector_SoftProtect.2.sg
================================================
function detect(){return(PE.compareEP("E8....00008D85....0000C70000000000E8....0000E8....00008D85....000050E8....000083")||PE.compareEP("EB01E360E803......D2EB0B58EB014840EB0135FFE0E76160E803"))&&(bDetected=1),result()}meta("protector","SoftProtect")

================================================
FILE: dbs_min/db/PE/protector_SoftSentry.2.sg
================================================
function detect(){return PE.compareEP("558BEC83EC..535657E9")&&(PE.compareEP("50",10)?sVersion="2.11":PE.compareEP("B006",10)&&(sVersion="3.0"),bDetected=1),result()}meta("protector","SoftSentry")

================================================
FILE: dbs_min/db/PE/protector_Special_EXE_Password_Protector.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED0600000089AD8C0100008BC52B85FE75000089853E")&&(sVersion="1.0X",bDetected=1),result()}meta("protector","Special EXE Password Protector")

================================================
FILE: dbs_min/db/PE/protector_SpicesNet.2.sg
================================================
function detect(){var e
return PE.isNet()&&(PE.isNetObjectPresent("NineRays.Obfuscator")&&(PE.isSignaturePresent(PE.section[1].FileOffset-512,512,"'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'")&&(sOptions="demo"),bDetected=1),bDetected?PE.isSignatureInSectionPresent(0,e)&&(sVersion="5.X",bDetected=1):(e="'9Rays.Net Spices.Net Obfuscator'",PE.isDll()&&(PE.isSignatureInSectionPresent(1,e)||PE.isSignatureInSectionPresent(0,e))&&(sVersion="5.X",sOptions="DLL",bDetected=1))),result()}meta("protector","Spices.Net")

================================================
FILE: dbs_min/db/PE/protector_StarForce.2.sg
================================================
function detect(){if(PE.compareEP("68........FF25....63"))sVersion="3.0",bDetected=1
else if(PE.compareEP("68........FF25....57"))sVersion="1.1",sOptions="ProActive",bDetected=1
else if(PE.compareEP("5768..0D01006800....00E850..FFFF68......0068......0068......0068......0068......00"))sOptions="Protection Driver",bDetected=1
else if(PE.compareEP("E8........000000000000"))sVersion="3.X",bDetected=1
else if(PE.compareEP("60e8000000005883c008")&&PE.isSectionNamePresent(".brick"))sVersion="3.4",bDetected=1
else if(PE.compareEP("68........FF25........0000000000"))sVersion="3.X",bDetected=1
else if(PE.isLibraryPresent("protect.dll"))(sVersion=PE.getPEFileVersion(PE.getFileDirectory()+"/protect.dll"))||(PE.isSectionNamePresent(".ps4")?(sVersion="4.X-5.X",bDetected=1):PE.isSectionNamePresent(".sforce3")&&(sVersion="3.X",bDetected=1))
else if(PE.isSectionNamePresent(".ps4"))for(var e=0;e<PE.getNumberOfImports();e++)if(1==PE.getNumberOfImportThunks(e)&&(!PE.getImportFunctionName(e,0)||"1"==PE.getImportFunctionName(e,0))){var t=PE.getImportLibraryName(e)
sVersion=(sVersion=PE.getPEFileVersion(PE.getFileDirectory()+"/"+t))||"4.X-5.X",sOptions=t,bDetected=1
break}return result()}meta("protector","StarForce")

================================================
FILE: dbs_min/db/PE/protector_Ste@lth_PE.2.sg
================================================
function detect(){return-1==PE.findSignature(PE.getSize()-64,64,"ba........b8........8902424242b8........89024a4a4affd2")&&-1==PE.findSignature(PE.getSize()-64,64,"b8........ba........8910404040ba........891048484850c3")||(sVersion="2.X",bDetected=1),result()}meta("protector","Ste@lth PE")

================================================
FILE: dbs_min/db/PE/protector_Tages.2.sg
================================================
function detect(){return PE.compareEP("8925........e8$$$$$$$$6a..6a..c705................e8$$$$$$$$8b4424..0faf4424..506a..ff15........50ff15........c3")&&(bDetected=1),result()}meta("protector","TAGES")

================================================
FILE: dbs_min/db/PE/protector_Themida.2.sg
================================================
function detectThemida(){var e,s=""
return 4<=PE.section.length&&(e=PE.getEntryPointSection(),1==PE.getResourceSection())&&2==PE.getImportSection()&&PE.getAddressOfEntryPoint()==PE.section[e].VirtualAddress&&7.5<=PE.calculateEntropy(PE.section[0].FileOffset,PE.section[0].FileSize)&&(3==e?s="1.X":3<e&&(s="2.X")),s}function detect(){if(PE.is64()&&PE.compareEP("4883EC085053E801000000CC584889C348FFC0482D........482D........4805........803BCC75..C60300"))sVersion="2.X"
else if(PE.isNet())PE.isSignatureInSectionPresent(0,"b8000000006011c0")?sVersion="1.9":PE.isSignatureInSectionPresent(0,"83ec048053e80100")&&(sVersion="2.X")
else if(PE.compareEP("B8........600BC074..E8000000005805..0000008038E975")){switch(PE.readByte(PE.getEntryPointOffset()+9)){case 88:sVersion="1.0.X.X-1.8.0.0"
break
case 104:sVersion="1.8.X-1.9.X"}sOptions="Compressed"}else{var e
PE.compareEP("558BEC83C4D860E8000000005A81EA........8BDAC745D8000000008B45D8408945D8817DD880000000")?(sVersion="1.0.X.X-1.8.X.X",sOptions="NoCompression"):PE.compareEP("8BC58BD460E8000000005D81ED........8995........89B5........8985........83BD")?(sVersion="1.X",sOptions="NoCompression SecureEngine"):PE.compareEP("83EC045053E801000000CC588BD840")||PE.compareEP("51b9........85c974$$59e9$$$$$$$$83ec..5053............5889c3402d........2d........05........803b..75..c603..bb........68........68........5350")?sVersion="2.0.1.0-2.1.8.0":PE.compareEP("83EC045053E801000000CC5889C3402D........2D........05........803BCC75..C60300")?sVersion="2.X":PE.compareEP("E9$$$$$$$$8bc58bd460e8")?sVersion="1.1.X-1.2.X":PE.compareEP("eb$$e9$$$$$$$$e9$$$$$$$$565053e8$$$$$$$$5889c3402d")?bDetected=1:PE.isImportPositionHashPresent(0,1073532042)&&PE.isImportPositionHashPresent(1,1261420630)?sVersion="1.XX-2.XX":PE.isSectionNamePresent(".themida")?sVersion="3.XX":PE.isSectionNamePresent(".winlice")?sVersion="3.XX, Winlicense":"   "==PE.section[0].Name&&PE.isImportPositionHashPresent(0,1073532042)?sVersion="~2.XX":"        "==PE.section[0].Name&&PE.isImportPositionHashPresent(0,911341197)?bDetected=1:(e=detectThemida())&&(sVersion=e)}return(bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions))&&PE.isFunctionPresent("_CorExeMain")&&(sOptions="DotNET"),result()}meta("protector","Themida/Winlicense")

================================================
FILE: dbs_min/db/PE/protector_Thinstall.2.sg
================================================
function detect(){if(PE.compareEP("6A00FF1520504000E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C741"))sVersion="2.403",bDetected=1
else if(PE.compareEP("558BECB8........BB........50E800000000582D..1A0000B9..1A0000BA..1B0000BE00100000BF..530000BD..1A000003E8817500..........7504........817508........81750C........817510"))sVersion="2.5XX",bDetected=1
else if(PE.compareEP("558BEC515356576A006A00FF15........50E887FCFFFF5959A1........8B40100305........8945FC8B45FCFFE05F5E5BC9C3000000"))sVersion="1.9X",bDetected=1
else if(PE.compareEP("B8EFBEADDE506A00FF15........E9..FFFFFF")){switch(PE.readByte(PE.getEntryPointOffset()+15)){case 173:sVersion="2.0X"
break
case 185:sVersion="2.2X-2.308"}bDetected=1}else if(PE.compareEP("E8F2FFFFFF5068........68401B0000E842FFFFFFE99DFFFFFF000000000000"))sVersion="2.545",bDetected=1
else if(PE.compareEP("E80000000058BB....00002BC35068........68....000068")){switch(PE.readWord(PE.getEntryPointOffset()+7)){case 32961:sVersion="2.547-2.600"
break
case 6573:sVersion="2.609"
break
case 7852:sVersion="2.620-2.623"
break
case 7476:sVersion="2.628"
break
default:sVersion="2.6XX"}bDetected=1}else PE.compareEP("9C60E80000000058BB........2BC35068........68........68........E8........E9")?(sVersion="2.7XX",bDetected=1):PE.compareEP("9C6068'StAl'68'ThIn'E80000000058BB........2BC35068")?(PE.compareEP("0028",32)?sVersion="3.035-3.043":PE.compareEP("002C",32)?sVersion="3.049-3.080":PE.compareEP("BAFE",42)?sVersion="3.0XX":PE.compareEP("2CFF",42)&&(sVersion="3.10X"),bDetected=1):PE.compareEP("b8........e8........482be08d50..4533c033c9e8........85c075..b9........ff15")?(sVersion="5.0",bDetected=1):PE.isOverlayPresent()&&1<=PE.nLastSection&&".res"==PE.section[1].Name&&(sVersion="4.7.X",bDetected=1)
var e
return PE.compareEP("6a..6a..6a..e8$$$$$$$$8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365")&&PE.compareOverlay("09050000")&&(sVersion="5.2.2",bDetected=1),PE.compareEP("6a..6a..6a..e8$$$$$$$$558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1")&&PE.compareOverlay("09050000")&&(sVersion="5.2.4",bDetected=1),bDetected&&(e=PE.getVersionStringInfo("ThinAppVersion"))&&(sVersion=e),result()}meta("protector","Thinstall(VMware ThinApp)")

================================================
FILE: dbs_min/db/PE/protector_UG2002_Cruncher.2.sg
================================================
function detect(){return PE.compareEP("60E8........5D81ED........E80D................................58")&&(sVersion="0.3b3",bDetected=1),result()}meta("protector","UG2002 Cruncher")

================================================
FILE: dbs_min/db/PE/protector_UPX_Protector.2.sg
================================================
function detect(){return PE.compareEP("EB..........8A064688074701DB75078B1E83EEFC11DB")&&(sVersion="1.0X",bDetected=1),result()}meta("protector","UPX Protector")

================================================
FILE: dbs_min/db/PE/protector_UPolyX.2.sg
================================================
function detect(){return PE.compareEP("81FD00FBFFFF83D1..8D142F83FDFC76..8A02428807474975")?(sVersion="0.X",bDetected=1):PE.compareEP("E2..FF..0000000000000000000000000000")?(sVersion="0.1",bDetected=1):(PE.compareEP("558BEC..00BD46008B..B9..00000080....51")||PE.compareEP("BB........83EC04891C24..B9..0000008033")||PE.compareEP("E8000000005983C10751C3C3")||PE.compareEP("EB01C3")||PE.compareEP("83EC0489..2459....000000"))&&(sVersion="0.5",bDetected=1),result()}meta("protector","UPolyX")

================================================
FILE: dbs_min/db/PE/protector_UltraPro.2.sg
================================================
function detect(){return PE.compareEP("A1........85C00F853B0600005556C705........01000000FF15")?(sVersion="1.0",bDetected=1):PE.compareEP("60E8070000006168....4000C383042418C32083B8ED2037EFC6B979379E61")?(sVersion="0.75",bDetected=1):PE.compareEP("83EC04C7042400......C300....000000000000000000000000....001000000002000001")&&(sVersion="1.03-1.10",bDetected=1),result()}meta("protector","UltraPro")

================================================
FILE: dbs_min/db/PE/protector_VBox.2.sg
================================================
function detect(){return PE.compareEP("ff7424..ff7424..ff7424..68........68........68........68........ff15")&&PE.isLibraryPresent("vboxp410.dll")&&(sVersion="4.10",bDetected=1),-1!==PE.findSignature(PE.getEntryPointOffset(),4096,"558bec83c4..5657be........8b45..8946..ff75..8f46..8b45..8946..56")&&(sVersion="4.20",bDetected=1),result()}meta("protector","VBox")

================================================
FILE: dbs_min/db/PE/protector_VCasm-Protector.2.sg
================================================
function detect(){return PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000E803000000")?(sVersion="1.0X",bDetected=1):PE.compareEP("EB..'[VProtect]'")&&(sVersion=PE.compareEP("..0A")?"1.0e":PE.compareEP("..0B")?"1.1-1.2":"1.X",bDetected=1),result()}meta("protector","VCasm-Protector")

================================================
FILE: dbs_min/db/PE/protector_VMProtect.2.sg
================================================
function detect(){if(!PE.isNet()){for(var e,t=PE.getNumberOfSections()-1;0<=t;t--)if(t!=PE.getRelocsSection()&&t!=PE.getResourceSection()){if(PE.getSectionName(t)){if(e=PE.getSectionName(t),0<t&&".vmp0"==e){bDetected=1
break}if(1<t&&"1"==e.substr(e.length-1)){var i=PE.getSectionNameCollision("0","1")
if(PE.isSectionNamePresent(i+"1")){bDetected=1
break}}else if(2<t&&"2"==e.substr(e.length-1)){i=PE.getSectionNameCollision("1","2")
if(PE.isSectionNamePresent(i+"1")&&PE.isSectionNamePresent(i+"0")){bDetected=1
break}}else if(3<t&&"3"==e.substr(e.length-1)){i=PE.getSectionNameCollision("2","3")
if(PE.isSectionNamePresent(i+"2")&&PE.isSectionNamePresent(i+"1")&&PE.isSectionNamePresent(i+"0")){bDetected=1
break}}}break}bDetected&&(PE.is64()&&(sVersion="2.XX-3.XX"),e&&"0"==e.substr(e.length-1)&&(sOptions="min protection"),PE.isImportPositionHashPresent(-1,536023103)?sVersion="1.70":PE.isImportPositionHashPresent(-1,202825517)?(sVersion="1.70",sOptions="max protection"):PE.isImportPositionHashPresent(-1,2635247955)?sVersion="2.0.3-2.13":PE.isImportPositionHashPresent(-1,508887233)?sVersion="3.0.0":PE.isImportPositionHashPresent(-1,3321588299)?sVersion="3.0.9":PE.isImportPositionHashPresent(-1,1554684359)&&(sVersion="3.2.0-3.5.0"))
if(!bDetected&&PE.isDeepScan()){for(var s="",n="",o=0,r=PE.OffsetToVA(PE.getEntryPointOffset()),P=0;"MOV EDX, DWORD PTR [EAX*4 "!=n.substr(0,n.indexOf("+"))&&"MOV EBX, DWORD PTR [EAX*4 "!=n.substr(0,n.indexOf("+"))&&"MOV ECX, DWORD PTR [EAX*4 "!=n.substr(0,n.indexOf("+"))&&P<1e3;){P++
var E=PE.readByte(PE.VAToOffset(r)),n=s=PE.getDisasmString(r),c=(-1!=s.indexOf(" ")&&(s=s.substr(0,s.indexOf(" "))),0)
if(255==E&&"JMP"==s||(195==E||194==E)&&"RET"==s){c=1
break}if(255==E&&"CALL"==s)break
"CLC"!=(s=-1!=s.indexOf(" ")?s.substr(0,s.indexOf(" ")):s)&&"CMC"!=s||o++,"PUSHFD"==s&&o++,"PUSHAL"==s&&o++,"XOR"==s&&o++,"NEG"!=s&&"NOT"!=s||o++,"SAR"!=s&&"SAL"!=s||o++,"JMP"!=s&&"CALL"!=s||0,"BT"!=s&&"BTR"!=s&&"BTS"!=s&&"BTC"!=s||o++,"BSF"!=s&&"BSR"!=s&&"BSWAP"!=s||o++,"ROL"!=s&&"ROR"!=s&&"RCL"!=s&&"RCR"!=s||o++,r=PE.getDisasmNextAddress(r)}10<o&&P<200&&(sVersion=1==c?"new":"old",sOptions="DS",bDetected=1)}for(var f=0,t=0;t<PE.getNumberOfImports();t++)if("KERNEL32.dll"===PE.getImportLibraryName(t)&&f++,2<=f){PE.is64()&&PE.compare("4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 ?? ?? ?? 0E ?? B4 09 CD 21 B8 01 4C CD")&&(bDetected=1,sOptions=sOptions.append("packed"))
break}return result()}}function detectVmp(e){if(PE.section[e]){e=PE.section[e].Characteristics
if(1610612832==e||3758096480==e||3758096448==e||1744830560==e||3791650912==e)return!0}return!1}function detectVmp2(){if(7<PE.section.length){for(var e=5,t=PE.getResourceSection(),i=PE.getRelocsSection(),s=(t>PE.section.length-e&&e++,i>PE.section.length-e&&e++,0),n=0,o=PE.section.length-e;o<PE.section.length;o++)o!=t&&o!=i&&(0==PE.section[o].FileSize&&0==PE.section[o].FileOffset&&s++,0!=PE.section[o].FileSize)&&0!=PE.section[o].FileOffset&&(n=o)
if(3<=s&&PE.getEntryPointSection()==n)if(3758096480==PE.section[n].Characteristics){if(7.6<PE.calculateEntropy(PE.section[n].FileOffset,PE.section[n].FileSize))return!0}else if(536870912&PE.section[n].Characteristics)for(var r,P=PE.section[n].FileOffset,E=PE.section[n].FileSize,c=P,f=E,e=0;0<f&&-1!=(r=PE.findSignature(c,f,"9c8d64"));)if(c=r+3,f=E-(r-P),2<=++e)return!0}return!1}meta("protector","VMProtect")

================================================
FILE: dbs_min/db/PE/protector_VMProtect_NET.2.sg
================================================
function detect(){if(PE.isNet()&&PE.isNetGlobalCctorPresent()&&3<=PE.getNumberOfSections()&&PE.isNetObjectPresent("SuppressIldasmAttribute")&&PE.isNetObjectPresent("kernel32")&&PE.isNetObjectPresent("get_IsAttached")&&PE.isNetObjectPresent("OpCodes")){for(var e="%% %% %% %% %% %% %% %% 00",t=PE.getSize()-PE.getOverlaySize(),s="00",r=0;r<12;r++)s+=e
var i=PE.section[0]
PE.isSignaturePresent(i.FileOffset,t,"'<Module>' 00"+e)&&PE.isSignaturePresent(i.FileOffset,t,s)&&(sVersion="3.X",bDetected=1),bDetected&&(PE.isSignaturePresent(i.FileOffset,t,generateUnicodeSignatureMask("Program will be terminated."))&&(sOptions="Resources protection"),".vmp"===(i=PE.getSectionNameCollision("0","1"))?sVersion="2.X-3.X":i&&(sOptions+=(0!=sOptions.length?" + ":"")+"Custom sections"),bDetected=bDetected&&!PE.isNetObjectPresent("VMProtect"))}return result()}function generateUnicodeSignatureMask(e){for(var t="",s=0;s<e.length;s++)t+=(0!=s?"00":"")+"'"+e[s]+"'"
return t}meta("protector","VMProtect")

================================================
FILE: dbs_min/db/PE/protector_VaySoft_PDF2EXE.2.sg
================================================
function detect(){return PE.compareEP("558BECB9")&&PE.compareOverlay("255B484220322A")&&(sOptions="PDF Adv.Xor Ovl.",sVersion="6.82",bDetected=1),result()}meta("protector","VaySoft PDF to EXE Converter")

================================================
FILE: dbs_min/db/PE/protector_VbsToExe.1.sg
================================================
function detect(){return PE.resource.D&&((PE.compare("'2edecompile'",PE.resource.D.Offset+2)||14==PE.resource.D.Size&&PE.isResourceNamePresent("B")&&PE.isResourceNamePresent("F")&&PE.isResourceNamePresent("I")&&PE.isResourceNamePresent("N")&&PE.isResourceNamePresent("O"))&&(sVersion="2.0.2.0",bDetected=1),bDetected)&&PE.isResourceNamePresent("P")&&(sOptions="Protected"),sLang="VBScript",result()}meta("protector","Vbs To Exe")

================================================
FILE: dbs_min/db/PE/protector_Virbox.2.sg
================================================
function detect(){return PE.compare("'SENS'",40)&&(bDetected=1),result()}meta("protector","Virbox")

================================================
FILE: dbs_min/db/PE/protector_XCR.2.sg
================================================
function detect(){return PE.compareEP("9371..EB$$EB$$8BD878$$EB$$9C33C0EB$$74$$EB$$6079..EB$$E8$$$$$$$$83C4..E8$$$$$$$$8D05........EB$$5D85ED75")&&(sVersion="0.13",bDetected=1),result()}meta("protector","XCR")

================================================
FILE: dbs_min/db/PE/protector_Xenocode_Postbuild.2.sg
================================================
function detect(){return PE.isNetObjectPresent("Xenocode.Client.Attributes.AssemblyAttributes")?(sVersion="2.X-3.X",bDetected=1):PE.isSectionNamePresent(".xcpad")&&PE.compareOverlay("'xvm'0001")&&(bDetected=1),result()}meta("protector","Xenocode Postbuild")

================================================
FILE: dbs_min/db/PE/protector_XerinFuscator.2.sg
================================================
function detect(){var e
return PE.isNet()&&(PE.isNetObjectPresent("XerinAtrribute")?(e=".text"===PE.section[0].Name?PE.section[0]:PE.section[1],-1!=(e=PE.findString(e.FileOffset,e.FileSize,"XerinFuscator v"))&&(sVersion=PE.getString(e+15,21),bDetected=1,PE.isNetObjectPresent("Xerin.Runtime"))&&(sOptions="XVM")):!(bDetected=PE.isNetUStringPresent("C# version only supports level 1 and 3")&&1<PE.getNumberOfSections()&&".text"!==PE.section[0].Name?!0:bDetected)&&PE.isSectionNamePresent(".Xerin")&&(sVersion="Legacy",bDetected=1)),result()}meta("protector","XerinFuscator")

================================================
FILE: dbs_min/db/PE/protector_Xtreamlok.2.sg
================================================
function detect(){return(PE.compareEP("9090eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")||PE.compareEP("90eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")||PE.compareEP("909090eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9")||PE.compareEP("eb$$525351565755e8000000005d81ed........e8$$$$$$$$6a..e9"))&&(sVersion="1.X-3.X",bDetected=1),result()}meta("protector","Xtreamlok (SoftWrap)")

================================================
FILE: dbs_min/db/PE/protector_Yano.2.sg
================================================
function detect(){return PE.isNetObjectPresent("YanoAttribute")&&(sVersion="1.X",bDetected=1),result()}meta("protector","Yano")

================================================
FILE: dbs_min/db/PE/protector_Yodas_Protector.2.sg
================================================
function detect(){return PE.compareEP("558BEC535657E8$$$$$$$$E8$$$$$$$$33C064FF30648920CCC3")?(sVersion="1.01",bDetected=1):PE.compareEP("E8$$$$$$$$BB........E8$$$$$$$$E8$$$$$$$$33c064ff306489204bccc3")&&".inq"!==PE.section[PE.nLastSection].Name&&(sVersion="1.02-1.03",bDetected=1),result()}meta("protector","Yoda's Protector")

================================================
FILE: dbs_min/db/PE/protector_Yummy_Game_SoftwareShield.2.sg
================================================
function detect(){return PE.compareEP("31C0E9B9FFFFFFC3")&&(sVersion="5.X",bDetected=1),result()}meta("protector","Yummy Game SoftwareShield")

================================================
FILE: dbs_min/db/PE/protector_Zprotect.2.sg
================================================
function detect(){return 3<PE.section.length&&(0!=PE.section[0].FileOffset||0!=PE.section[0].FileSize||PE.isDosStubPresent()||(PE.compare("6B65726E656C33322E646C6C000000005669727475616C416C6C6F6300000000",PE.section[1].FileOffset)||1==PE.getEntryPointSection()&&7.6<PE.calculateEntropy(PE.section[2].FileOffset,PE.section[2].FileSize))&&(sVersion="1.X",bDetected=1)),PE.compareEP("e8$$$$$$$$87..248d..........87..24e9$$$$$$$$60e9$$$$$$$$54e9")&&(bDetected=1),result()}meta("protector","Zprotect")

================================================
FILE: dbs_min/db/PE/protector_bambam.2.sg
================================================
function detect(){return PE.compareEP("6A14E89A050000....5368........E86CFDFFFF")?(sVersion="0.01",bDetected=1):PE.compareEP("4d5a90eb$$52e9$$$$$$$$eb$$64a1........eb$$8b48......eb$$05........eb$$668138")?(sVersion="0.1",bDetected=1):0===PE.getNumberOfImports()&&PE.isImportPositionHashPresent(0,3048297421)&&(bDetected=1),bDetected&&!PE.isSectionNamePresent(".bedrock")&&(sOptions="modified"),result()}meta("protector","bambam")

================================================
FILE: dbs_min/db/PE/protector_beria.2.sg
================================================
function detect(){return PE.compareEP("83EC18538B1D0030....555657683007000033ED55FFD38BF03BF5740D89AE20070000E8880F0000EB0233F66A105589353040....FFD38BF03BF57409892EE83CFEFFFFEB0233F66A18558935D843....FFD38BF0")&&(sVersion="0.07",bDetected=1),result()}meta("protector","Beria")

================================================
FILE: dbs_min/db/PE/protector_eXPressor.2.sg
================================================
function detect(){return PE.compareEP("E935140000E931130000E998120000E9EF0C0000E94213")?sVersion="1.0":PE.compareEP("E915130000E9F0120000E958120000E9AF0C0000E9AE02")?sVersion="1.1":PE.compareEP("558BEC81EC....0000535657EB0C'ExPr-v.1.2.'")?sVersion="1.2":PE.compareEP("558BEC83EC..535657EB0C'ExPr-v.1.3.'")?sVersion="1.3":PE.compareEP("558BEC83EC..535657EB0C'ExPr-v.1.4.'")||PE.compareEP("8BEC83EC..5356578365....F3EB0C'eXPr-v.1.4.'")?sVersion="1.4":PE.compareEP("558BEC83EC..5356578365..00F3EB0C'eXPr-v.1.4.'00")?sVersion="1.4.5.X":PE.compareEP("558BEC81EC........53565783A5..........F3EB0C'eXPr-v.1.5.'00")?sVersion="1.5.0.X":PE.compareEP("558BEC81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")||PE.compareEP("..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")||PE.compareEP("6a..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")||PE.compareEP("6a..6a..6a..6a..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")?sVersion="1.6":PE.compareEP("EB0168EB01........83EC0C535657EB01..833D........007408EB01E9E956010000EB02")?bDetected=1:PE.compareEP("68########eb$$eb$$558bec83ec..535657eb$$833d..........74")?sVersion="1.6.1":PE.compareEP("68........C3")&&3<=PE.section.length&&0==PE.section[0].FileSize&&".code"==PE.section[2].Name&&(sVersion="1.5-1.6"),bDetected=bDetected||Boolean(sVersion),result()}meta("protector","eXPressor")

================================================
FILE: dbs_min/db/PE/protector_hmimys_Protect.2.sg
================================================
function detect(){return PE.compareEP("5E83C664AD50AD5083EE6CAD50AD50AD50AD50AD50E8")?(sVersion="0.1",bDetected=1):PE.compareEP("E8BA000000..00000000....00..............00......0000....00......00......00......00......00......00..00000000000000......000000000000000000......00......000000000000000000")?(sVersion="1.0",bDetected=1):PE.compareEP("ba........ffe2ba........b8........890283c2..b8........890283c2..ffe2")&&(sVersion="0.1",bDetected=1),result()}meta("protector","hmimys Protect")

================================================
FILE: dbs_min/db/PE/protector_iPB_Protect.2.sg
================================================
function detect(){return PE.compareEP("558BEC6AFF68'KCUF'68'TIHS'64A100000000")&&(sVersion="0.1.3-0.1.7",bDetected=1),result()}meta("protector","iPB Protect")

================================================
FILE: dbs_min/db/PE/protector_kkryptor.2.sg
================================================
function detect(){return PE.compareEP("eb$$60e8........5e8d....b9........4933c05102....d3c04979..33....5900")&&(sVersion="3",bDetected=1),result()}meta("protector","k.kryptor")

================================================
FILE: dbs_min/db/PE/protector_tElock.2.sg
================================================
function detect(){if(PE.compareEP("668BC08D2424EB01EB60EB01EB9CE8000000005E83C6508BFE68"))sVersion="0.41X",bDetected=1
else if(PE.compareEP("C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C6")){switch(PE.readByte(PE.getEntryPointOffset()+22)){case 82:sVersion="0.4X"
break
case 94:sVersion="0.5X"}bDetected=1}else if(PE.compareEP("E90000000060E8000000005883C008"))sVersion="0.60",bDetected=1
else if(PE.compareEP("60E8....0000C383")){switch(PE.readWord(PE.getEntryPointOffset()+2)){case 4285:sVersion="0.70"
break
case 4333:sVersion="0.71"
break
case 4420:sVersion="0.71b2"
break
case 4424:sVersion="0.71b7"
break
case 4601:sVersion="0.80"
break
default:sVersion="0.7X-0.84"}bDetected=1}else PE.compareEP("60E802000000CD20E8000000005E2BC9587402")?(sVersion="0.85f",bDetected=1):PE.compareEP("....E802000000E800E8000000005E2B")?(sVersion="0.90",bDetected=1):PE.compareEP("E9....FFFF")?PE.compareEP("E97EE9")?(sVersion="0.92a",bDetected=1):PE.compareEP("E9D5E4")?(sVersion="0.95",bDetected=1):PE.compareEP("E959E4")?(sVersion="0.96",bDetected=1):PE.compareEP("E925E4")?(sVersion="0.98b1",bDetected=1):PE.compareEP("E91BE4")?(sVersion="0.98b2",bDetected=1):PE.compareEP("E999D7")?(sVersion="0.98 Special Build",bDetected=1):PE.compareEP("E95EDF")?(sVersion="0.99",bDetected=1):PE.compareEP("E93FDF")?(sVersion="0.99c",bDetected=1):PE.compareEP("E9E5E2")&&(sVersion="1.00",bDetected=1):PE.compareEP("668bc08d2424609ce8000000005dd14d")&&(sVersion="0.35",bDetected=1)
return result()}meta("protector","tElock")

================================================
FILE: dbs_min/db/PE/rar.6.sg
================================================
function detect(){return detect_RAR(0),result()}includeScript("rar-file")

================================================
FILE: dbs_min/db/PE/sfx_12Ghosts_Zip2.1.sg
================================================
function detect(){return PE.compareEP("E8$$$$$$$$558BEC83EC..A1........8365....8365....5357BF........3BC7BB........74")&&PE.isSignaturePresent(PE.getOverlayOffset(),4096,"'BZh91'")&&(sOptions="BZIP2",sVersion="8.0",bDetected=1),result()}meta("sfx","12Ghosts Zip2")

================================================
FILE: dbs_min/db/PE/sfx_7z.1.sg
================================================
function detect(){var e,t
return PE.compareOverlay("';!@Install@!UTF-8!'")?(sType="installer",(e=(t=PE.getManifest()).match(/(\n?)version="(.*?)"/))?(sVersion=e[2],e[1]&&(sOptions="new")):(e=t.match(/Archive v(\d.*?)<\/desc/))&&(sVersion=e[1]),bDetected=1):PE.compareOverlay("'7z'BCAF271C")?bDetected=1:PE.compareOverlay("efbbbf';!@Install@!UTF-8!'")&&(sType="installer",bDetected=1),bDetected&&!(sVersion="7z.sfx"!=PE.getVersionStringInfo("InternalName")&&"7zS2.sfx"!=PE.getVersionStringInfo("InternalName")?sVersion:(sVersion=PE.getVersionStringInfo("FileVersion"))||PE.getFileVersion().replace(/\.0\.0$/,""))&&PE.section[".rdata"]&&-1!=(t=PE.findString(PE.section[".rdata"].FileOffset,PE.section[".rdata"].FileSize,"7-Zip version:"))&&(sVersion=PE.getString(t+16,4)),result()}meta("sfx","7-Zip")

================================================
FILE: dbs_min/db/PE/sfx_ARJSFX.1.sg
================================================
function detect(){if(PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f64678b16....8b42..a3"))PE.compareOverlay("c0ab........60ea")&&(sName+="32",bDetected=1)
else if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")){if(PE.compareOverlay("60ea"))bDetected=1
else for(var e=0;e<PE.resource.length;e++)if(730==PE.resource[e].Type){bDetected=1
break}}else if(PE.compareEP("558bec83c4..e8$$$$$$$$e8........6a..e8........8905........e8........8905"))for(e=0;e<PE.resource.length&&!bDetected;e++)1001==PE.resource[e].Type&&PE.compare("60ea",PE.getResourceOffsetByNumber(e))&&(bDetected=1)
return result()}meta("sfx","ARJSFX")

================================================
FILE: dbs_min/db/PE/sfx_ARQ.1.sg
================================================
function detect(){return PE.compareOverlay("67570402")&&(PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")||PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))&&(bDetected=1),result()}meta("sfx","ARQ")

================================================
FILE: dbs_min/db/PE/sfx_Abbyy_Lingvo.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")&&PE.compare("'ArcUpdateABBYY'00",PE.getSize()-15)&&(bDetected=1),result()}meta("sfx","Abbyy Lingvo")

================================================
FILE: dbs_min/db/PE/sfx_Active_Delivery.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50648925........83ec605356578965..ff15")&&PE.section.actdlvry&&PE.compare("'AD01'",PE.section.actdlvry.FileOffset)&&(bDetected=1),result()}meta("sfx","Active Delivery")

================================================
FILE: dbs_min/db/PE/sfx_Cab.1.sg
================================================
function detect(){var e,r=PE.getOverlayOffset()
return PE.compareOverlay("'wextract'",16)?(-1!==(r=PE.findSignature(r-3584,3584,"BD04EFFE00000100"))&&(r+=16,sVersion=PE.readWord(r+2)+"."+PE.readWord(r)+"."+PE.readWord(r+6)+"."+PE.readWord(r+4)),bDetected=1):/sfxcab/.test(PE.getManifest())?((e=PE.section[".rsrc"])&&(r=e.FileOffset+e.VirtualSize,-1!==(r=PE.findSignature(r-1536,1536,"BD04EFFE00000100")))&&(r+=8,sVersion=PE.readWord(r+2)+"."+PE.readWord(r)+"."+PE.readWord(r+6)+"."+PE.readWord(r+4)),bDetected=1):/wextract/i.test(PE.getVersionStringInfo("InternalName"))?(sVersion=PE.getFileVersion().trim(),bDetected=1):(PE.compareEP("558bec81ec........535657ff15........a3........ff15........a1........6625....3d")&&PE.compare("'MSCF'00000000",20480)||PE.compareEP("6a..68........e8........66813d............75..a1........81b8................75..")&&PE.compareOverlay("'MSCF'00000000")||PE.compareEP("e9$$$$$$$$558bec81ec........830d..........5356576a..33dbbf........68........895d..881d"))&&(bDetected=1),0<PE.getNumberOfResources()&&(PE.compare("'MSCF'00000000",PE.getResourceNameOffset("CABINET"))&&(bDetected=1),PE.compare("'MSCF'00000000",PE.getResourceNameOffset("IDR_CABFILE")))&&(bDetected=1),result()}meta("sfx","Microsoft Cabinet")

================================================
FILE: dbs_min/db/PE/sfx_Chilkat_ZIP_Self-Extractor.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("07d26cbf2159abaa0100000000")&&(bDetected=1),result()}meta("sfx","Chilkat ZIP Self-Extractor")

================================================
FILE: dbs_min/db/PE/sfx_CoffeeCup_SFX.2.sg
================================================
function detect(){return PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a")&&PE.compareOverlay("'MPU'00")&&(bDetected=1),result()}meta("sfx","CoffeeCup")

================================================
FILE: dbs_min/db/PE/sfx_DelZip_SFX.2.sg
================================================
function detect(){return PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a")&&PE.compareOverlay("'MPV'")&&(bDetected=1),result()}meta("sfx","DelZip")

================================================
FILE: dbs_min/db/PE/sfx_Dimd_SFX.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("........'DIMDMSCF'")&&(sOptions="CAB SFX",bDetected=1),result()}meta("sfx","Dimd")

================================================
FILE: dbs_min/db/PE/sfx_Envoy_Packager.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("b297e169")&&(sOptions="1994 by Novell, Inc.",bDetected=1),result()}meta("sfx","Envoy Packager")

================================================
FILE: dbs_min/db/PE/sfx_GZip.1.sg
================================================
function detect(){if(PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965"))for(var e=0;e<PE.resource.length&&!bDetected;e++)PE.compare("1f8b08",PE.resource[e].Offset)&&(bDetected=1)
else PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("1f8b08")&&(bDetected=1)
return result()}meta("sfx","GZip")

================================================
FILE: dbs_min/db/PE/sfx_GkSetup.1.sg
================================================
function detect(){return-1!=PE.findString(PE.getOverlayOffset(),Math.min(768,PE.getOverlaySize()),"/SFX")?PE.compareEP("e9$$$$$$$$5351525589e583ec..b8........e8........a1........83c0..24..31d229c489e18b1d")?(sOptions="1998 by Gero Kuehn",bDetected=1):PE.compareEP("5668........33f668........56ff15........56ff15........a3........e8........85c074..a1")&&(sOptions="1999 by Gero Kuehn",bDetected=1):PE.compareOverlay("'2.00'")&&PE.compareEP("5633f656ff15........a3........e8........85c074..a1........8b40..48")&&(sVersion="2.0",bDetected=1),result()}meta("sfx","GkSetup SFX")

================================================
FILE: dbs_min/db/PE/sfx_INFTool.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..e8$$$$$$$$e8........6a..e8........8905........e8........8905........c705")&&-1!==PE.findString(0,PE.getOverlayOffset(),"INFTool.pkg")&&(bDetected=1),result()}meta("sfx","INFTool")

================================================
FILE: dbs_min/db/PE/sfx_KRZIP_SFX.2.sg
================================================
function detect(){return PE.compareEP("558bec83c4..53565733c08945..b8........e8........33c05568........64ff30648920a1........8378")&&PE.compareOverlay("'<KRZIP FILE BEGINS HERE>'")&&(sOptions="by Kryloff Technologies, Inc.",bDetected=1),result()}meta("sfx","KRZIP")

================================================
FILE: dbs_min/db/PE/sfx_LZH_SFX.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d")&&(PE.compareOverlay("....'-lh5-'")||PE.compareOverlay("........'-lh7-'"))&&(sVersion="2.60.w32.0031",sOptions="by Yoshi 1991 / mH 1995 / Micco 1997-99",bDetected=1),result()}meta("sfx","LZH SFX")

================================================
FILE: dbs_min/db/PE/sfx_Lyme_SFX.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&PE.compareOverlay("789c")&&(sOptions="zlib",bDetected=1),result()}meta("sfx","Lyme SFX")

================================================
FILE: dbs_min/db/PE/sfx_MP-ZipTool.1.sg
================================================
function detect(){return PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a")&&PE.compareOverlay("'MPU'0d")&&(bDetected=1),result()}meta("sfx","MP-ZipTool SFX32")

================================================
FILE: dbs_min/db/PE/sfx_MPQ.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")&&PE.compareOverlay("'MPQ'1a20")&&(bDetected=1),result()}meta("sfx","Blizzard MPQ")

================================================
FILE: dbs_min/db/PE/sfx_NanoZip.1.sg
================================================
function detect(){return PE.compareEP("60be........8dbe........5789e58d9c24........31c05039dc75")&&PE.compareOverlay("AE01'NanoZip 0.09 alpha'")&&(sVersion="0.09a",sOptions="nz_w32c.sfx",bDetected=1),result()}meta("sfx","NanoZip")

================================================
FILE: dbs_min/db/PE/sfx_PKSFX.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")&&PE.compareOverlay("'PK'090a")&&(sVersion="2.50",bDetected=1),result()}meta("sfx","PKSFX")

================================================
FILE: dbs_min/db/PE/sfx_Paquet.1.sg
================================================
function detect(){return PE.compareEP("558bec81c4........53565733c08985........8985........e8........e8")&&PE.compareOverlay("04'PBG'")&&(sVersion="1.5, 1998 by Guillaume Di Giusto",bDetected=1),result()}meta("sfx","Paquet")

================================================
FILE: dbs_min/db/PE/sfx_Quantum.1.sg
================================================
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))for(var e=0;e<PE.resource.length;e++)if(PE.compare("'DS'00",PE.resource[e].Offset)){bDetected=1
break}return result()}meta("sfx","Quantum")

================================================
FILE: dbs_min/db/PE/sfx_SZDD.1.sg
================================================
function detect(){if(PE.compareEP("558bec6a..68........68........64a1........50648925........83c4..5356578965..ff15")){for(var e=0;e<PE.resource.length;e++)if(2128==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){bDetected=1
break}}else if(PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f")){for(e=0;e<PE.resource.length;e++)if("RT_RCDATA"==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){sOptions="1997 by Khaled Mardam-Bey",bDetected=1
break}}else if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))for(e=0;e<PE.resource.length;e++)if("RT_RCDATA"==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){sOptions="1997 by Klever Co.",bDetected=1
break}return result()}meta("sfx","SZDD")

================================================
FILE: dbs_min/db/PE/sfx_Squeez_SFX.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")&&PE.compareOverlay("'SQ5SFX'")&&(sVersion="6.0.0.0",bDetected=1),result()}meta("sfx","Squeez SFX")

================================================
FILE: dbs_min/db/PE/sfx_WinACE.1.sg
================================================
function detect(){return/WinACE|UNACE/i.test(PE.getVersionStringInfo("InternalName"))&&(sVersion=PE.getVersionStringInfo("FileVersion"),bDetected=1),result()}meta("sfx","WinACE")

================================================
FILE: dbs_min/db/PE/sfx_WinIMP.1.sg
================================================
function detect(){return PE.compareEP("51526a..2eff15........506a..6a..2eff15........50e8........502eff15........5a59c3")&&PE.compareOverlay("'IMP'0a")&&(sOptions="1999 by Technelysium Pty Ltd",bDetected=1),result()}meta("sfx","WinIMP")

================================================
FILE: dbs_min/db/PE/sfx_WinImage.1.sg
================================================
function detect(){return PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d........83ec..89018b15")&&(PE.compareOverlay("'RsDl'")?(sOptions="1998 by Gilles Vollant",bDetected=1):PE.compare("'WSfxPK'0304",PE.getOverlayOffset()+12)&&(sVersion="0.90",sOptions="1993-97 by Gilles Vollant",bDetected=1)),result()}meta("sfx","WinImage")

================================================
FILE: dbs_min/db/PE/sfx_WinPatch.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83....535657")&&(PE.compareOverlay("'@Daisy@Lucy@xyzzy@'................1f8b08")||PE.compareOverlay("'@Daisy@Lucy@xyzzy@'1f8b08"))&&(sOptions="1996-1998 (gzip)",bDetected=1),result()}meta("sfx","WinPatch Apply Program by Artistry, Inc.")

================================================
FILE: dbs_min/db/PE/sfx_WinRAR.1.sg
================================================
function detect(){var e
if(!PE.isNet())return((e=PE.compareOverlay("'PK'"))||PE.compareOverlay("'Rar!'"))&&(PE.resource.STARTDLG&&PE.resource.LICENSEDLG||PE.resource.INSTALL&&PE.resource.SETUP)&&(e&&(sOptions="ZIP"),bDetected=1),PE.compareEP("e8$$$$$$$$53bb........e8........85c074..33d28a1083fa..75..40eb")&&PE.compareOverlay("'Rar!'1a")&&(bDetected=1),result()}meta("sfx","WinRAR")

================================================
FILE: dbs_min/db/PE/sfx_WinZip.1.sg
================================================
function detect(){if(PE.compareEP("ff15........b1..380874..b1..4080....74..380874..4080....75..80....74..4033"))sVersion="6.X",bDetected=1
else if(PE.compareEP("53ff15........b3..38..74..80c3..4033d28a083aca74..3acb74..408a083aca75"))-1!=PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"504b0304")?sVersion="2.2":PE.compareEP("8A48014033D23ACA740A3ACB74068A4801",16)&&(sVersion="8.X"),bDetected=1
else if(PE.compareEP("53ff15........b3..38..74..80c3..8a48..4033d23aca74..3acb74..8a48..40"))sVersion="8.X",bDetected=1
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")){for(var e=0;e<PE.resource.length&&!bDetected;e++)"RT_DIALOG"!=PE.resource[e].Type&&-1!=PE.findSignature(PE.resource[e].Offset,Math.min(PE.resource[e].Size,4352),"'PK'0304")&&(bDetected=1)
PE.isSectionNamePresent("_winzip_")&&(bDetected=1)}return PE.isSectionNamePresent("_winzip_")&&-1!=PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber("_winzip_")),4096,"'PK'0304")&&(sVersion="3.1",bDetected=1),result()}meta("sfx","WinZip")

================================================
FILE: dbs_min/db/PE/sfx_ZipCentral_SFX.1.sg
================================================
function detect(){return PE.compareEP("558BEC83C4..33C089....B8........e8........33c05568........64....64....6a")&&PE.compareOverlay("'MPV*'")&&(sVersion="2.0",sOptions=PE.getGeneralOptions(),bDetected=1),result()}meta("sfx","ZipCentral SFX-32")

================================================
FILE: dbs_min/db/PE/sfx_Zip_SFX.2.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")?-1!=PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"'PK'0304")&&(bDetected=1):PE.compareEP("558bec83c4..b8........e8........33c05568........64ff30648920e8")?PE.resource.length&&784==PE.resource[0].Type&&(bDetected=1):PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb")&&PE.compareOverlay("'PK'0304")&&(sOptions="by Intel",bDetected=1),PE.compareEP("558bec83c4..5356e8$$$$$$$$e8........6a..e8........8905........e8........8905")&&PE.compareOverlay("'PK'0304")&&(sOptions="by C.Ghisler & Co.",bDetected=1),PE.compareEP("558becb8........e8........5356be........578d45..5633db5053ff15........85c00f84")&&-1!=PE.findSignature(PE.getOverlayOffset(),4096,"'PK'0304")&&(sOptions="by Symantec",bDetected=1),PE.compareEP("83ec..5657ff15........8bf08d4424..50c74424..........ff15........8a068b3d........3c..75..56ffd7")&&PE.compareOverlay("'PK'0304")&&(sName="SymW32SFX",sOptions="by Symantec",bDetected=1),PE.compareEP("558bec83ec..565733ffff15........8bf0897d..8d45..50ff15........8a063c..75..56ff15")&&PE.compareOverlay("'PK'0304")&&(sName="Symantec EasyZIP SFX",bDetected=1),PE.compareEP("558bec83ec..56ff15........8bf08a003c..75..84c074..803e..74..46803e..75..803e..75..46eb")&&-1!=PE.findSignature(PE.getOverlayOffset(),8192,"'PK'0304")&&(sOptions="Squeez SFX by SpeedProject 1995-1998",bDetected=1),PE.compareEP("6a..33c0505050ff15........50e8$$$$$$$$55b8........8bece8........53b9........5657be")&&PE.compareOverlay("'PK'0304")&&(sOptions="EasyZIP SFX by AKSoft 1995-1996",bDetected=1),result()}meta("sfx","Zip SFX")

================================================
FILE: dbs_min/db/PE/sfx_rar.1.sg
================================================
function detect(){if(PE.compareEP("558bec83c4..535657e8........e8........33c05568........64ff30648920e8"))for(var e=0;e<PE.resource.length&&!bDetected;e++)PE.compare("'rar!'",PE.resource[e].Offset)&&(bDetected=1)
return result()}meta("sfx","RAR")

================================================
FILE: dbs_min/db/PE/sign_tool_Windows_Authenticode.7.sg
================================================
function detect(){return PE.isSigned()&&(sVersion="2.0",sOptions="PKCS #7",bDetected=1,PE.compareOverlay("00020200",4)||(sOptions=sOptions.append("after overlay"))),result()}meta("sign tool","Windows Authenticode")

================================================
FILE: dbs_min/db/PE/tool_AHTeam_UPX_Mutanter.2.sg
================================================
function detect(){return PE.compareEP("94 bc 61 62 4d 00 b9 .. 00 00 00 80 34 0c .. e2")&&(sOptions="Method 2",bDetected=1),PE.compareEP("94 bc .. b9 4d 00 b9 .. 00 00 00 80 34 0c .. e2")&&(sOptions="Method 1",bDetected=1),result()}meta("tool","AHTeam UPX Mutanter")

================================================
FILE: dbs_min/db/PE/tool_Microsoft_VisualStudio_NET.6.sg
================================================
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"590100'KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator'")&&(bDetected=1),result()}meta("tool","Microsoft Visual Studio")

================================================
FILE: dbs_min/db/PE/tool_UPX-Patcher.6.sg
================================================
function detect(){var e=PE.section[".dosx"],t=e?PE.section[e+1]:void 0
return 2<PE.getNumberOfSections()&&t&&e&&".fish"===t.Name&&(bDetected=1,e=PE.is64(),PE.isDll()||(PE.compareEP(e?"53":"55")?sOptions=(e?"x64":"x86")+" mode":bDetected=0)),result()}meta("tool","UPX-Patcher")

================================================
FILE: dbs_min/db/PE/tool_UPXFreak.2.sg
================================================
function detect(){return PE.compareEP("BE........83C601FFE60000")&&(sVersion="0.1",bDetected=1),result()}meta("tool","UPXFreak")

================================================
FILE: dbs_min/db/PE/tool_UPX_Inliner.2.sg
================================================
function detect(){return PE.compareEP("9C60E8000000005DB8........2D........2BE88DB5D5FEFFFF8B0683F8007411")&&(sVersion="1.0",bDetected=1),result()}meta("tool","UPX Inliner")

================================================
FILE: dbs_min/db/PE/tool_UPX_Modifier.2.sg
================================================
function detect(){return PE.compareEP("50BE........8DBE........5783CD")&&(sVersion="0.1X",bDetected=1),result()}meta("tool","UPX Modifier")

================================================
FILE: dbs_min/db/PE/tool_UPX_lock.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED........60E82B030000")&&(sVersion="1.0-1.2",bDetected=1),result()}meta("tool","UPX lock")

================================================
FILE: dbs_min/db/PE/tool_UPX_scrambler.2.sg
================================================
function detect(){return PE.compareEP("E8000000005983C10751C3C3BE........83EC04893424B9800000008136........50B80400000050033424585883E903E2E9EBD6")?(sVersion="3.06",bDetected=1):PE.compareEP("66C705........7507E9..FEFFFF00")?bDetected=1:(PE.compareEP("9061BE........8DBE........5783CDFF")||PE.compareEP("9061BE........8DBE........c787................5783CDFF"))&&(sVersion="1.X",bDetected=1),result()}meta("tool","UPX Scrambler")

================================================
FILE: dbs_min/db/PE/tool_UnoPiX.2.sg
================================================
function detect(){var e
return PE.compareEP("60E8070000006168........C383042418C3")&&(sVersion="0.75",bDetected=1),2<=PE.nLastSection&&(4096!=(e=PE.section[PE.nLastSection].VirtualSize)||e!=PE.section[PE.nLastSection].FileSize||3758096448!=PE.section[PE.nLastSection].Characteristics||PE.section[PE.nLastSection].Name||0!=PE.getMajorLinkerVersion()||0!=PE.getMinorLinkerVersion()||(sVersion="0.94",bDetected=1)),result()}meta("tool","UnoPiX")

================================================
FILE: dbs_min/db/PE/tool_XVolkolak.6.sg
================================================
function detect(){if(!PE.isNet()){for(var e=0,t=0,r=!1,s=0;s<PE.getNumberOfSections();s++){var c=PE.section[s]
".xvlk"===c.Name?(e++,3758096416&c.Characteristics&&(r=!0)):/rsrc/i.test(c.Name)&&t++}return r&&2<=e&&PE.getNumberOfSections()===e+t&&(sOptions="unpacked",bDetected=1),result()}}meta("tool","XVolkolak")

================================================
FILE: dbs_min/db/PE/tool_de4dot.6.sg
================================================
function detect(){return PE.isNet()&&PE.isNetObjectPresent("smethod_0")&&(PE.isNetObjectPresent("GClass0")||PE.isNetObjectPresent("Class0")&&PE.isNetObjectPresent("Class1"))&&(bDetected=1,sOptions="deobfuscated"),result()}meta("tool","de4dot")

================================================
FILE: dbs_min/db/PE/zip.6.sg
================================================
function detect(){return detect_Zip(0),result()}includeScript("zip-file")

================================================
FILE: dbs_min/db/PNG/_PNG.0.sg
================================================
function detect(){return sName=PNG.getFileFormatName(),sVersion=PNG.getFileFormatVersion(),sOptions=PNG.getFileFormatOptions(),sName&&(bDetected=1),result()}meta("format","PNG")

================================================
FILE: dbs_min/db/PNG/_init
================================================
var File=PNG,X=PNG

================================================
FILE: dbs_min/db/PYC/_PYC.0.sg
================================================
function detect(){return sName=PYC.getFileFormatName(),sVersion=PYC.getFileFormatVersion(),sOptions=PYC.getFileFormatOptions(),bDetected=1,result()}meta("format","PYC")

================================================
FILE: dbs_min/db/PYC/_init
================================================
var File=PYC,X=PYC

================================================
FILE: dbs_min/db/PYC/packer_UPP.1.sg
================================================
function detect(){return PYC.isConstPresent("UPP!1.10")&&(sVersion="1.10",bDetected=1),result()}init("packer","UPP")

================================================
FILE: dbs_min/db/QtFramework
================================================
var aQt,ownName
void 0!==aQt||"undefined"==typeof PE||(ownName=PE.getFileBaseName()+"."+PE.getFileCompleteSuffix(),aQt=PE.isLibraryPresentExp(/^Qt(\d)?Core(d?)(\d)?/i))||(aQt=ownName.match(/^Qt(\d)?Core(d?)(\d)?/i))&&(aQt[0]=ownName)

================================================
FILE: dbs_min/db/RAR/_RAR.0.sg
================================================
function detect(){return RAR.isVerbose()&&(sName=RAR.getFileFormatName(),sVersion=RAR.getFileFormatVersion(),sOptions=RAR.getFileFormatOptions(),sName)&&(bDetected=1),result()}meta("format","RAR")

================================================
FILE: dbs_min/db/RAR/_init
================================================
var File=RAR,X=RAR

================================================
FILE: dbs_min/db/RosASM
================================================
var bRosASM
void 0===bRosASM&&(bRosASM=!1,PE.compare("'RosAsm Assembler'",176)||PE.compare("'MZ'90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000000000000000........800000000e1fba0e00b409cd21b8014ccd21'This program cannot be run in DOS mode\r\n$'000000000000000000"))&&(bRosASM=!0)

================================================
FILE: dbs_min/db/SpASM
================================================
var bSpASM
void 0===bSpASM&&(bSpASM=PE.compare("'MZ'80000000000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000007786c16800000000e1fba0e00b409cd21b8014ccd21'Spindoz 32 spit PEfile made wizz SpAsm Assembler.$'"))

================================================
FILE: dbs_min/db/TASM32
================================================
var bTASM32
void 0===bTASM32&&(bTASM32=!1,!PE||!PE.compare("'This program must be run under Win'....0D0A24..00",80)||bBorlandC||PE.resource.PACKAGEINFO||PE.resource.DVCLAL||(bTASM32=!0))

================================================
FILE: dbs_min/db/ZIP/_ZIP.0.sg
================================================
function detect(){return ZIP.isVerbose()&&(sName=ZIP.getFileFormatName(),sVersion=ZIP.getFileFormatVersion(),sOptions=ZIP.getFileFormatOptions(),sName)&&(bDetected=1),result()}meta("format","ZIP")

================================================
FILE: dbs_min/db/ZIP/_init
================================================
var File=ZIP,X=ZIP

================================================
FILE: dbs_min/db/_db_caching
================================================
function _forceCaching(t){var s={}
return function(){var e=Array.prototype.slice.call(arguments),e=JSON.stringify(e)
return s.hasOwnProperty(e)?s[e]:s[e]=t.apply(this,arguments)}}var useBetaDieEngineCachingTechology=!0
if(useBetaDieEngineCachingTechology){for(var classNames=["Amiga","APK","Archive","Binary","COM","DEX","DOS4G","DOS16M","ELF","IPA","JAR","LE","LX","MACH","MACHOFAT","MSDOS","NE","NPM","PDF","PE","ZIP"],methodsToWrap=["isSignaturePresent","isSignatureInSectionPresent","findSignature","compare","findString"],i=0;i<classNames.length;i++){var className=classNames[i]
try{if("object"==typeof this[className]||"function"==typeof this[className])for(var cls=this[className],j=0;j<methodsToWrap.length;j++){var methodName=methodsToWrap[j]
"function"==typeof cls[methodName]&&(cls[methodName]=_forceCaching(cls[methodName]))}}catch(e){_error(e.message)}}try{void 0!==this.PE&&"function"==typeof this.PE.isNetObjectPresent&&(this.PE.isNetObjectPresent=_forceCaching(this.PE.isNetObjectPresent))}catch(e){_error(e.message)}}

================================================
FILE: dbs_min/db/_debug
================================================
function _debug(e){e="-> "+e,_log("Debug: "+e),_setResult("dev-output",e,"","")}function _error(e){e="Error: "+e
throw sName&&(e+=", last define() is '"+sName+"' with type '"+sType+"'"),_log("Exception: "+e),e}

================================================
FILE: dbs_min/db/_init
================================================
var bDetected,sType,sName,sVersion,sOptions,sLang,sLangVersion
function meta(e,n,s,t,i,r){e||_error("No input detection type."),sType=e,sName=n||"",sVersion=s||"",sOptions=t||"",sLang=i||"",sLangVersion=r||"",bDetected=0}function init(){meta.apply(null,arguments)}function result(){bDetected&&(sVersion=sVersion||"",sOptions=sOptions||"",sName?(_setResult(sType,sName,sVersion,sOptions),sLang&&(sLangVersion?_setLang(sLang,sLangVersion):_setLang(sLang))):_error("No input detection name.")),sName=sVersion=sOptions=sLang=sLangVersion=""
var e=bDetected
return bDetected=0,e}includeScript("_debug"),includeScript("_runtime_helpers"),includeScript("language")

================================================
FILE: dbs_min/db/_runtime_helpers
================================================
String.prototype.append=function(){var t=String(this)
return 0<arguments.length&&(0<t.length&&(t+=", "),t+=Array.prototype.join.call(arguments,", ")),t},String.prototype.appendS=function(t,e){var r=String(this)
return t&&(0<r.length&&(r+="string"==typeof e?e:", "),r+=t),r},String.prototype.addIfNone=function(t){var e=String(this)
return t&&e.indexOf(t)<0&&(e+=t),e},String.prototype.startsWith||(String.prototype.startsWith=function(t,e){e="number"==typeof e?Math.min(t.length,e):0
return!(t.length>this.length-e)&&this.slice(e,t.length)==t}),String.prototype.startsWithCI=function(t,e){return arguments.length<2?this.toLowerCase().startsWith(t.toLowerCase()):this.toLowerCase().startsWith(t.toLowerCase(),e)},String.prototype.endsWith||(String.prototype.endsWith=function(t,e){e="number"==typeof e?Math.min(this.length,e):this.length
return!(t.length>e||t.length&&this.slice(e-t.length,e)!=t)}),String.prototype.endsWithCI=function(t,e){return arguments.length<2?this.toLowerCase().endsWith(t.toLowerCase()):this.toLowerCase().endsWith(t.toLowerCase(),e)},String.prototype.repeat||(String.prototype.repeat=function(t){if("number"!=typeof t)return this
for(var e=this,r=1;r<t;r++)e+=this
return e}),String.prototype.padStart||(String.prototype.padStart=function(t,e){var r=this.valueOf()
return t>>=0,e=String(e||" "),r.length>=t?String(r):((t-=r.length)>e.length&&(e+=e.repeat(Math.ceil(t/e.length))),e.slice(0,t)+String(r))}),Number.prototype.padStart||(Number.prototype.padStart=function(t,e){var r=this.valueOf().toString()
return t>>=0,e=String(e||" "),r.length>=t?r:((t-=r.length)>e.length&&(e+=e.repeat(Math.ceil(t/e.length))),e.slice(0,t)+r)}),Number.prototype.clamp||(Number.prototype.clamp=function(t,e){return Math.min(Math.max(this,t),e)}),String.prototype.replaceAll||(String.prototype.replaceAll=function(t,e){if("string"!=typeof t||"string"!=typeof e)return"?"+t
for(var r="",n=0;n<this.length;n++)this.slice(n,n+t.length)==t?(r+=e,n+=t.length-1):r+=this[n]
return r}),Array.prototype.includes||(Array.prototype.includes=function(t,e){if(null==this)throw new TypeError('"this" is null or not defined')
var r=Object(this),n=r.length>>>0
if(0!=n)for(var e=0|e,i=Math.max(0<=e?e:n-Math.abs(e),0);i<n;){var o=r[i]
if(o===t||"number"==typeof o&&"number"==typeof t&&isNaN(o)&&isNaN(t))return!0
i++}return!1}),String.prototype.includes||(String.prototype.includes=function(t,e){return!((e="number"!=typeof e?0:e)+t.length>this.length)&&-1!==this.indexOf(t,e)})

================================================
FILE: dbs_min/db/archive-file
================================================
meta("archive")
var Archive={nFiles:0,nDirs:0,nSize:0,nPacked:0,add:function(i,n,s){s?this.nDirs++:(this.nFiles++,this.nSize+=i,this.nPacked+=n)},contents:function(){var i=""
return 0!=this.nSize&&(i=(this.nPacked/this.nSize*100).toFixed(1)+"%"),0!=this.nFiles&&(i=i.append(this.nFiles+(1==this.nFiles?" file":" files"))),i=0!=this.nDirs?i.append(this.nDirs+(1==this.nDirs?" dir":" dirs")):i}}

================================================
FILE: dbs_min/db/arj
================================================
function detect_ARJ(s,e){var p,s=s?(p=0,File.getSize()):(p=File.getOverlayOffset()+8,File.getOverlaySize())
if(64<=s&&(File.compare("60EA",p)&&(sVersion=File.readByte(p+5),bDetected=1),bDetected)&&e){switch(File.readByte(p+7)){case 0:sOptions=sOptions.append("MS-DOS")
break
case 1:sOptions=sOptions.append("PRIMOS")
break
case 2:sOptions=sOptions.append("UNIX")
break
case 3:sOptions=sOptions.append("AMIGA")
break
case 4:sOptions=sOptions.append("MAC-OS")
break
case 5:sOptions=sOptions.append("OS/2")
break
case 6:sOptions=sOptions.append("APPLE GS")
break
case 7:sOptions=sOptions.append("ATARI ST")
break
case 8:sOptions=sOptions.append("NeXT")
break
case 9:sOptions=sOptions.append("VAX VMS")}switch(1&File.readByte(p+8)&&(sOptions=sOptions.append("encrypted")),File.readByte(p+9)){case 0:sOptions=sOptions.append("stored")
break
case 1:sOptions=sOptions.append("compressed most")
break
case 2:sOptions=sOptions.append("compressed")
break
case 3:sOptions=sOptions.append("compressed faster")
break
case 4:sOptions=sOptions.append("compressed fastest")}}}includeScript("archive-file"),sName="ARJ"

================================================
FILE: dbs_min/db/bytecodeparsers
================================================
BCParseToReasonable=0,BCParseToEoF=-1,BCParseToEndMarker=-2,BCInvalidFormat=-1
var debug=0
function MUAP98CmdStr(e,r,a){if(2<(a="number"!=typeof a?0:a))return"…"
var t=["FM1: ","FM2: ","FM3: ","SSGA: ","SSGB: ","SSGC: ","FM4: ","FM5: ","FM6: ","RHY: ","PCM: ","FM7: ","FM8: ","FM9: ","FM10: ","FM11: ","FM12: "],s=X.U8(r),n=9==e?"rhy":10==e?"pcm":3<=e&&e<=5?"ssg":"fm",c=["=",">","<","!="]
if("fm"==n&&s<64)return t[e]+'note "'+Hex(s)+'" '+["C#","D","D#","E","F","F#","G","G#","A","A#","B","C"][s%12]+(1+Util.divu64(s,12))+" ~"+X.U8(r+1)
if("ssg"==n&&s<16)return t[e]+'key-on "'+Hex(s)+'"  ~'+X.U8(r+1)
switch(s){case 255:return t[e]+"rest"
case 254:return t[e]+"reset & play"
case 253:return t[e]+"reset & stop"
case 252:return"-= "+t[e]+"End. =-"
case 251:return t[e]+"wait on '"
case 250:return t[e]+(9==e||10==e?"x9 nop":"3ch 4harm play "+outArray(X.readBytes(r+1,8),16))
case 249:return t[e]+(9==e||10==e?"rhy cmd end":"same freq play")
case 248:return t[e]+"add freq "+outArray(X.readBytes(r+1,3),16)
case 247:return t[e]+"loop @"+Hex(r-X.I16(r+1))+" x"+Hex(X.U8(r+3))
case 246:return t[e]+("ssg"==n?"noise freq ":"pan ")+Hex(X.U8(r+1))
case 245:return t[e]+"Timer-A tempo "+Hex(X.U16(r+1))
case 244:return t[e]+"set length "+Hex(X.U8(r+1))+", ratio "+Hex(X.U8(r+2))
case 243:return"wait all channels"
case 242:return t[e]+(9==e||10==e?"DSP mode, level, delay"+outArray(X.readBytes(r+1,3),16):"ssg"==n?"set start decay data"+outArray(X.readBytes(r+1,3),16):"nop")
case 241:return t[e]+"R"+Hex(X.U8(r+1))+" = "+Hex(X.U8(r+2))
case 240:return t[e]+(9==e||10==e?"Rhythm Key On ":"set system detune ")+Hex(X.U8(r+1))
case 239:return t[e]+(9==e||10==e?"Rhythm Dump ":"hard LFO speed ")+Hex(X.U8(r+1))
case 238:return t[e]+(9==e||10==e?"Rhythm pan/vol ":"hard LFO AMD,PMD,AMon")+outArray(X.readBytes(r+1,2),16)
case 237:return t[e]+(9==e||10==e?"x2 nop":"3ch 4harm mode "+outArray(X.readBytes(r+1,2),16))
case 236:return t[e]+"key display mask on/off & colour "+Hex(X.U8(r+1))
case 235:return t[e]+(9==e||10==e?"PCM Tone ":"ssg"==n?"mixer mode ":"tone ")+Hex(X.U8(r))
case 234:return t[e]+"@jump "+Hex(r+X.I16(r+1))
case 233:return t[e]+"@call "+Hex(r+X.I16(r+1))+' ("'+MUAP98CmdStr(e,r+X.I16(r+1),a+1)+'"...)'
case 232:return t[e]+"@ret"
case 231:return t[e]+"Source Line symbolic info "+Hex(X.U16(r+1))
case 230:return t[e]+(9==e||10==e||"ssg"==n?"x27 nop":"USR Tone")
case 229:return t[e]+"Play Stack init"
case 228:return t[e]+"@if x"+((15&X.U8(r+1))-6)+" "+c[X.U8(r+1)>>4]+" "+X.U8(r+2)+" jump "+Hex(o=r+2+X.I16(r+3))+' ("'+MUAP98CmdStr(e,o,a+1)+'"...)'
case 227:return t[e]+"@if x"+((15&X.U8(r+1))-6)+" "+c[X.U8(r+1)>>4]+" "+X.U8(r+2)+" call "+Hex(o=r+2+X.I16(r+3))+' ("'+MUAP98CmdStr(e,o,a+1)+'")...'
case 226:return t[e]+"change vol data "+Hex(X.U8(r+1))
case 225:return t[e]+"tie"
case 224:return t[e]+"loopcnt clear"
case 223:return t[e]+"slur"
case 222:return t[e]+"set ratio "+Hex(X.U8(r+1))
case 221:return t[e]+"cmt len "+Hex(X.U8(r+1))
case 220:return t[e]+"init Skip_data "+outArray(X.readBytes(r+1,3),16)
case 219:return t[e]+"cmt: "+Hex(X.U8(r+1))+" "+Hex(X.U8(r+2))+': "'+X.SC(r+4,X.U8(r+3),"SJIS")+'"'
case 218:return t[e]+"set X: "+outArray(X.readBytes(r+1,3),16)
case 217:return t[e]+"set LFO pars. "+outArray(X.readBytes(r+1,6),16)
case 216:return t[e]+"LFO start(p,a)/stop "+Hex(X.U8(r+1))
case 215:return t[e]+"vol += "+Hex(X.U8(r+1))
case 214:return t[e]+"vol -= "+Hex(X.U8(r+1))
case 213:return t[e]+(9==e||10==e?"PCM play ":"ssg"==n?"Start vol/Attack rate ":"x3 nop ")+X.U16(r)
case 212:return t[e]+(9==e||10==e?"PCM addr "+X.U32(r+1):"x5 nop")
case 211:var o=(15&X.U8(r+1))-6
return t[e]+"@if "+(0<=o?"x"+o:"lpcnt")+" "+c[X.U8(r+1)>>4]+" "+X.U8(r+2)+" exit "+Hex(r+5+X.U16(r+3))
case 210:return t[e]+"Play Stack +1"
case 209:return t[e]+"fade out"
case 208:return t[e]+"ssg||pcm "+Hex(X.U8(r+1))
case 207:return t[e]+"channel change "+Hex(X.U8(r+1))
case 206:return t[e]+(9==e||10==e?"set last tone,vol,pan":"ssg"==n?"set last tone,vol":"?? FM: CEh ??")
default:return t[e]+"unk. cmd "+Hex(s)}}function parseMUAP98(e,r,a){for(var s,n=e=e||0,c=(r=r||BCParseToReasonable)==BCParseToReasonable?Math.min(65536,X.Sz(),e+1024):r==BCParseToEoF||r==BCParseToEndMarker?Math.min(65536,X.Sz()):e+r,o=9==a?"rhy":10==a?"pcm":3<=a&&a<=5?"ssg":"fm",u=0,i=!1,d="",U=ifd=mp=ic=0,l=[],f=n;f<c;f++)l[f]=!1
function m(e,r){return 1<debug&&_l2r("muap98",e,"ch"+a+": "+r),[BCInvalidFormat,e,0]}for(;n<=e&&e<c&&!i;)if(ifd<0&&sus++,l[e]=!0,e>mp&&(mp=e),(s=X.U8(e))<64){if(15<s&&"ssg"==o)return m(e,"!badSSGnote")
X.U8(e+1)||ic++,u++,e+=2}else{if(s<206)return m(e,"!badcmd"+Hex(s))
switch(s){case 255:e++
break
case 254:e++
break
case 253:e++,i=!0
break
case 252:i=!0,e++,mp<e&&(mp=e)
break
case 251:e++
break
case 249:9!=a&&u++,e++
break
case 248:e+=4
break
case 247:if(t=e-X.I16(e+1),!isWithin(t,24,c)||Math.abs(t-e)<2)return m(e,"loop@"+Hex(t))
isWithin(t,n,c)||sus++,e+=4
break
case 246:e+=2
break
case 245:if(!isWithin(X.U16(e+1),16,4095))return m(e,"!badtempo")
e+=3
break
case 244:e+=3
break
case 243:e++
break
case 242:e+=4
break
case 241:e+=3
break
case 240:9!=a&&10!=a||(u++,X.U8(e+1))||m(e,"RHY F0: 0"),e+=2
break
case 223:case 210:case 209:e++
break
case 250:e+=9
break
case 239:e+=2
break
case 238:e+=3
break
case 237:case 236:case 235:e+=2
break
case 234:if(t=e+X.I16(e+1),!isWithin(t,24,c)||Math.abs(t-e)<2)return m(e,"!"+MUAP98CmdStr(a,e,1))
t<n&&ic++,l[t]&&(i=!0),e=t
break
case 233:if(t=e+X.I16(e+1),!isWithin(t,24,c)||Math.abs(t-e)<2)return m(e,"!"+MUAP98CmdStr(a,e,1))
t<n&&ic++,U++,e+=3
break
case 232:if(--U<0)return m(e,"!RetW/oSub")
e++
break
case 231:e+=3
break
case 230:e+=27
break
case 229:e++
break
case 228:case 227:if(t=e+2+X.I16(e+3),!isWithin(t,24,c)||Math.abs(t-e)<2||3<X.U8(e+1)>>4)return m(e,"!"+MUAP98CmdStr(a,e,1))
t<n&&ic++,227==s&&U++,228==s?(l[t]&&(i=!0),e=t):e+=5
break
case 226:e+=2
break
case 225:e++
break
case 224:e++
break
case 222:e+=2
break
case 221:X.U8(e+1),e+=2
break
case 220:e+=4
break
case 219:d=d.appendS(X.SC(e+4,X.U8(e+3),"SJIS")," / "),e+=X.U8(e+3)+4
break
case 218:e+=4
break
case 217:e+=7
break
case 216:e+=2
break
case 215:case 214:e+=2
break
case 213:e+=3,9!=a&&10!=a||u++
break
case 212:case 211:e+=5
break
case 208:m(e,"ssg/pcm:"+Hex(X.U8(e+1))),e+=2
break
case 207:o=9==(a=X.U8(e+1))?"rhy":10==a?"pcm":3<=a&&a<=5?"ssg":"fm",e+=2
break
case 206:e++}}return[u,e,0,d,mp,ic]}function MDXCmdStr(e,r){var a=["A","B","C","D","E","F","G","H","P","Q","R","S","T","U","V","W"],t=X.U8(r)
if(t<128)return a[e]+": rest "+(t+1)
if(t<=223)return t-=128,8<e?a[e]+": smp#"+t:a[e]+": "+["D#","E","F","F#","G","G#","A","A#","B","B#","C","C#","D"][t%12]+Util.divu64(t,12)+" ~"+(X.U8(r+1)+1)
switch(t){case 255:return a[e]+": bpm "+X.U8(r+1)
case 254:return a[e]+": R "+YM2151RegStr(X.U8(r+1),X.U8(r+2))
case 253:return a[e]+": voicedata "+X.U8(r+1)
case 252:return a[e]+": pan "+X.U8(r+1)
case 251:return 128&X.U8(r+1)?a[e]+": @vol "+(127&X.U8(r+1)):a[e]+": vol "+X.U8(r+1)
case 250:return a[e]+": vol-"
case 249:return a[e]+": vol+"
case 248:return a[e]+": staccato "+X.U8(r+1)
case 247:return a[e]+": legato"
case 246:return a[e]+": rep."+X.U8(r+1)+" ["+(X.U8(r+2)?"/"+X.U8(r+2):"")+"..."
case 245:return a[e]+": ...]rep.,ret→"+Hex(r+X.I16(r+1,_BE))
case 244:return a[e]+": .../rep.esc→"+Hex(r+X.I16(r+1,_BE))
case 243:return a[e]+": detune "+X.I16(r+1,_BE)/64
case 242:return a[e]+": portamento "+X.I16(r+1,_BE)/16384+" ↓"
case 241:return X.U8(r+1)?a[e]+": loop from "+Hex(r+3+X.I16(r+1,_BE))+".":a[e]+" ends."
case 240:return a[e]+": delay key-on "+X.U8(r+1)
case 239:return a[e]+": sync send on ch"+X.U8(r+1)
case 238:return a[e]+": sync wait on ch"+X.U8(r+1)
case 237:return a[e]+": noise/smp freq "+X.U8(r+1)
case 236:return 128==X.U8(r+1)?a[e]+": pitch LFO off":129==X.U8(r+1)?a[e]+": pitch LFO on":a[e]+": LFO pitch wf "+X.U8(r+1)+" freq "+X.U16(r+2,_BE)+" amp "+X.U16(r+4,_BE)
case 235:return 128==X.U8(r+1)?a[e]+": vol LFO off":129==X.U8(r+1)?a[e]+": vol LFO on":a[e]+": LFO vol wf "+X.U8(r+1)+" freq "+X.U16(r+2,_BE)+" amp "+X.U16(r+4,_BE)
case 234:return 128==X.U8(r+1)?a[e]+": OPM LFO off":129==X.U8(r+1)?a[e]+": OPM LFO on":a[e]+": LFO OPM syn/wf "+X.U8(r+1)+" lfrq "+X.U8(r+2)+" PMD "+X.U8(r+3)+" AMD "+X.U8(r+4)+" P/AMS "+X.U8(r+5)
case 233:return a[e]+": LFO key-on dly "+X.U8(r+1)
case 232:return a[e]+": PCM8 on"
case 231:return a[e]+": Fadeout"+(1==X.U8(r+1)?"":Hex(X.U8(r+1)))+" spd "+X.U8(r+2)
default:return a[e]+": unknown command "+Hex(X.U8(r))}}function isYM2151Reg(e){return[0,2,3,4,5,6,7,9,10,11,12,13,14,16,19,21,22,23,26,28,29,30,31].indexOf(e)<0}function YM2151RegStr(e,r){return isYM2151Reg(e)?1==e?(2&r)==r?"LFOR":"TEST"+Bin(r):8==e?"keyon ch"+(7&r)+" slot"+Bin(r>>3&15):15==e?"noise"+["off","on"][r>>7]+" freq"+Hex(r>>31):17==e?"CLKA MSB freq"+Hex(r):18==e?"CLKA LSB freq"+Hex(3&r):19==e?"CLKB freq"+Hex(r):20==e?"Clk CSM"+(r>>7)+" FResetBA"+Bin(r>>4&3,2)+" IRQEnBA"+Bin(r>>2&3,2)+" LoadBA"+Bin(3&r,2):24==e?"LowOscFreq "+Hex(r):25==e?["Amp","Phase"][r>>7]+"Mod depth"+Hex(127&r):27==e?"LFOWave ctl"+(r>>6)+" "+["saw","sqr","tri","noise"][3&r]:e<=39?"Ch "+(7&e)+" ctl "+(128&r?"R":"")+(64&r?"L":"")+" FB"+(r>>3&7)+" con"+(7&r):e<=47?"KC/prep note-on ch"+(7&e)+" "+((o=r>>4&7)?["C#","D","D#","","E","F","F#","","G","G#","A","","A#","B","C",""][15&r]+o:"--"):e<=55?"KF/prep p.bend ch"+(7&e)+" kf"+(r>>2):e<=63?"ModSensy. ch"+(7&e)+" phase"+(r>>4&7)+" amp"+(3&r):e<=71?"OP1 ch"+(7&e)+" dt1:"+(r>>4&7)+" mul"+(15&r):e<=79?"OP3 ch"+(7&e)+" dt1:"+(r>>4&7)+" mul"+(15&r):e<=87?"OP2 ch"+(7&e)+" dt1:"+(r>>4&7)+" mul"+(15&r):e<=95?"OP4 ch"+(7&e)+" dt1:"+(r>>4&7)+" mul"+(15&r):e<=103?"OP1 ch"+(7&e)+" TL"+(127&r):e<=111?"OP3 ch"+(7&e)+" TL"+(127&r):e<=119?"OP2 ch"+(7&e)+" TL"+(127&r):e<=127?"OP4 ch"+(7&e)+" TL"+(127&r):e<=135?"OP1 ch"+(7&e)+" KeyScl"+(r>>6)+" atk"+(31&r):e<=143?"OP3 ch"+(7&e)+" KeyScl"+(r>>6)+" atk"+(31&r):e<=151?"OP2 ch"+(7&e)+" KeyScl"+(r>>6)+" atk"+(31&r):e<=159?"OP4 ch"+(7&e)+" KeyScl"+(r>>6)+" atk"+(31&r):e<=167?"OP1 ch"+(7&e)+" AMS"+["off","on"][r>>7]+" dcy1R:"+(31&r):e<=175?"OP3 ch"+(7&e)+" AMS"+["off","on"][r>>7]+" dcy1R:"+(31&r):e<=183?"OP2 ch"+(7&e)+" AMS"+["off","on"][r>>7]+" dcy1R:"+(31&r):e<=191?"OP4 ch"+(7&e)+" AMS"+["off","on"][r>>7]+" dcy1R:"+(31&r):e<=199?"OP1 ch"+(7&e)+" dt2:"+(r>>6)+" dcy2R:"+(31&r):e<=207?"OP3 ch"+(7&e)+" dt2:"+(r>>6)+" dcy2R:"+(31&r):e<=215?"OP2 ch"+(7&e)+" dt2:"+(r>>6)+" dcy2R:"+(31&r):e<=223?"OP4 ch"+(7&e)+" dt2:"+(r>>6)+" dcy2R:"+(31&r):e<=231?"OP1 ch"+(7&e)+" dcy2L:"+(r>>4)+" rel:"+(15&r):e<=239?"OP3 ch"+(7&e)+" dcy2L:"+(r>>4)+" rel:"+(15&r):e<=247?"OP2 ch"+(7&e)+" dcy2L:"+(r>>4)+" rel:"+(15&r):"OP4 ch"+(7&e)+" dcy2L:"+(r>>4)+" rel:"+(15&r):"!bad#"+Hex(e)}function parseYM2151RegLog(e,r){r=r||BCParseToReasonable,e=e||0
for(var a,t,s=r==BCParseToEoF?X.Sz():Math.min(X.Sz(),e+8192),n=0,c=0,o=!1,u=[0,0,0,0,0],i=[],d=0;d<8;i[d++]=0);function U(){0<debug&&_l2r("opm",e-2,Hex(a)+" - "+Hex(t)+": invalid value"),c++}for(;!X.U8(e)&&e<2048;)e++
if(!X.U8(e))return[BCInvalidFormat,e,0]
for(;e<s&&c<10;)if(a=X.U8(e++)){if(t=X.U8(e++),isYM2151Reg(a)||U(),1<debug&&_logIt(YM2151RegStr(a,t)),a<=39)if(1==a){if(253&t)break}else 8==a?120&t?(n+=bitCount(t>>3&15),u[0]++):128&t&&U():15==a?96&t&&U():17==a?3<t&&U():20==a?64&t&&U():27==a&&60&t&&U()
else a<=47?(128&t||0<=[3,7,11,15].indexOf(15&t))&&U():a<=55||(a<=63?140&t&&U():(a<=127?(128&t&&U(),u[1]++):a<=159?(32&t&&U(),u[2]++):a<=191?(96&t&&U(),u[3]++):(a<=223&&32&t&&U(),u[4]++),i[7&a]++))
if(!o&&4096<e){if(40<=c||n<20||u[0]<24||u[1]<24||u[2]<24||u[3]<24||u[4]<24)return[BCInvalidFormat]
o=!0}}for(var l=0,d=0;d<8;d++)5<i[d]&&l++
return 0<debug&&_logIt(outArray([n,u,l,e],16)),o&&0<l?[n,e,l]:[BCInvalidFormat,e,l]}function isYM2612Reg(e){return!(e<34||35==e||183<e||isWithin(e,44,47))}function parseMDGYM(e,r){r=r||BCParseToReasonable,e=e||0,0<debug&&(a=new CheckpointTimer).init(300)
var a,t,s,n,c,o=r==BCParseToEoF?X.Sz():Math.min(X.Sz(),e+8192),u=0,i=[0,0,0,0,0],d=0,U=!1
for(;!X.U8(e)&&e<2048;)e++
for(;e<o&&d<10;)switch(t=X.U8(e++)){case 0:U=!1
break
case 1:case 2:if(s=X.U8(e++),2==t&&s<33)return
n=X.U8(e++),isYM2612Reg(s)||(d++,0<debug&&_l2r("gym",e-2,t+": R "+Hex(s))),40==s&&n>>4?(u+=bitCount(n>>4),0<debug&&_l2r("gym",e-2,"#")):42==s?i[4]++:48==(240&s)?(i[0]++,0<debug&&_l2r("gym",e-2,"ML/DT")):64==(240&s)&&0<X.U8(e)?(i[1]++,0<debug&&_l2r("gym",e-2,"TL")):80==(240&s)?(i[2]++,0<debug&&_l2r("gym",e-2,"AR/RS")):96==(240&s)?(i[3]++,0<debug&&_l2r("gym",e-2,"DR/AM")):0<debug&&_l2r("gym",e-2,t+": R "+Hex(s))
break
case 3:if(s=X.U8(e++),0<debug&&_l2r("gym",e-2,"PSG"),128&s)U=!(16&s)&&s<224
else{if(!(U&&s<64))return[BCInvalidFormat,e,0]
U=!1}break
default:return n=e-1,c="!cmd"+Hex(t),0<debug&&_l2r("gym",n,c),[BCInvalidFormat,n,0]}return 0<debug&&a.next("GYM: end of tested area @"+Hex(e)+" ir="+d),0<debug&&_l2r("gym",e,outArray([u,i],16)),(!u||i[0]<8||i[1]<8||i[2]<8||i[3]<8)&&i[0]+i[1]+i[2]+i[3]+i[4]<100?[BCInvalidFormat,e,0]:[u,e,0]}function isYM3812Reg(e){return isWithinRanges(e,[1,2,3,4,8,189,[32,53]])||isWithinRanges(e,[[64,85],[96,117],[128,149],[224,245]])&&[6,7,14,15].indexOf(31&e)<0||isWithinRanges(e,[[160,168],[176,184],[192,200]])}for(var __adlibnote=[],_0=0;_0<9;_0++)__adlibnote.push([-1,-1,-1])
function YM3812CmdStr(e,r){var a=["1.1:","2.1:","3.1:","1.2:","2.2:","3.2:","!6:","!7:","4.1:","5.1:","6.1:","4.2:","5.2:","6.2:","!E:","!F:","7.1:","8.1:","9.1:","7.2:","8.2:","9.2:"],t=X.U8(e)
return 224<=t?a[31&t]+"wf "+["sine","/￣\\_","/￣\\/￣\\","/|_/|_"][X.U8(e+1)]:192<=t?1+(15&t)+":fb/conn"+Hex(X.U8(e+1)):189==t?"AMdepth/VD/Rhy "+Hex(X.U8(e+1)):176<=t?1+(15&t)+"oct/F_msb/key-on "+Hex(X.U8(e+1)):160<=t?1+(15&t)+"F_lsb "+Hex(X.U8(e+1)):128<=t?a[31&t]+"S/R "+Hex(X.U8(e+1)):96<=t?a[31&t]+"A/D "+Hex(X.U8(e+1)):64<=t?a[31&t]+"level "+Hex(X.U8(e+1)):32<=t?a[31&t]+"AM/vib/envgen/keyscale/MFmul "+Hex(X.U8(e+1)):8==t?"CSM/keysplit "+Hex(X.U8(e+1)):4==t?"tmrctl "+Hex(X.U8(e+1)):3==t?"tmr2 "+Hex(X.U8(e+1)):2==t?"tmr1 "+Hex(X.U8(e+1)):4==t?"test/wfctl "+Hex(X.U8(e+1)):void 0}function parseYM3812RegLog(e,r){e=e||0
var a,t,s,n,c,o=(r=r||BCParseToReasonable)==BCParseToEoF?X.Sz()-2:Math.min(X.Sz()-2,e+8192),u=0,i=[0,0,0,0]
for(0<debug&&(s=new CheckpointTimer).init(300);!X.U8(e)&&e<2048;)e++
if(!X.U8(e))return[BCInvalidFormat,e,0]
for(;e<o;){if(a=X.U8(e++),t=X.U8(e++),!isYM3812Reg(a))return n=e-2,c="R "+Hex(a)+" : "+Hex(t),1<debug&&_l2r("adlib",n,c),[BCInvalidFormat,n,0]
40==a&&t>>4&&(u+=bitCount(t>>4)),48==(240&a)&&i[0]++,64==(240&a)&&0<X.U8(e)&&i[1]++,80==(240&a)&&i[2]++,96==(240&a)&&i[3]++}return 0<debug&&s.next("OPM chiptune: end of parsed data"),0<debug&&_logIt(outArray([u,i,e],16)),!u||i[0]<24||i[1]<24||i[2]<24||i[3]<24?[BCInvalidFormat,e,0]:[u,e,0]}

================================================
FILE: dbs_min/db/cab
================================================
function detect_Cab(e,i){if(48<i&&File.compare("'MSCF'00000000",e)){bDetected=1,sVersion=File.readByte(e+25)+".0"+File.readByte(e+24)
var r=e+File.readDword(e+16),a=File.readWord(e+28),t=File.readDword(e+8)
switch(4&File.readByte(e+30)&&(e+=File.readDword(e+36)+4),15&File.readByte(e+42)){case 1:sOptions=sOptions.append("MSZip")
break
case 2:sOptions=sOptions.append("Quantum")
break
case 3:sOptions=sOptions.append("LZX")}for(t-=File.readDword(e+36);a--;)Archive.add(File.readDword(r),t,16&File.readByte(r+14)),r=File.findByte(r+16,256,0)+1,t=0
return sOptions=sOptions.append(Archive.contents()),1}return 0}includeScript("archive-file"),sName="Microsoft Cabinet File"

================================================
FILE: dbs_min/db/chunkparsers
================================================
function parseAmigaHunks(r){if(void 0===r&&(r=0),!X.c("000003F3",r))return[-1,[]]
for(var e,n=r+4,s=(sz=i=reslibs=0,[]);n<X.Sz()&&(e=X.U32(4,_BE),n+=4,reslibs,e);)reslibs++,n+=4*e
var t=X.U32(n+8,_BE)-X.U32(n+4,_BE)+1
for(n+=12,i=0;i<t&&n<X.Sz();i++,n+=4){var a=(f=X.U32(n,_BE))>>30==3?4:0,f=((f&=1073741823)<<2)+a
s.push([0,sz,f]),sz+=f}return sz+=n,s.length?[sz,s]:[-1,[]]}function parseAtariBinary(r){if("number"!=typeof r&&(r=0),!X.c("FFFF",r)||X.Sz()<r+6)return[-1,[]]
for(var e=[],i=[],n=2+r;n+4<=X.Sz()&&n<65520;){var s=X.U16(n),t=(i.length||65535!=s||(n+=2,s=X.U16(n)),X.U16(n+2))
if(t<s||s<=55295&&53248<=t)break
if(n+(t=t+1-s)>X.Sz()&&!i.length)break
if(!t)break
if(e.push(s,t),findIntersections(e,!0).length)break
i.push([n+=4,t]),n+=t}return i.length?[n,i]:[-1,[]]}includeScript("read")

================================================
FILE: dbs_min/db/duration
================================================
function duration(o){return o<60?o.toFixed(o<10?2:1)+"s":(o=Math.round(o),Math.floor(o/60)+"m"+("0"+Math.floor(o%60)).slice(-2)+"s")}

================================================
FILE: dbs_min/db/language
================================================
function _isLangPresent(e){return _isResultPresent("language",e)||_isResultPresent("~language",e)}function _isLangDetected(){return _getNumberOfResults("language")||_getNumberOfResults("~language")}function _setLang(e,n){var s
return!_isLangPresent("C/C++")||"C"!=e&&"C++"!=e||_removeResult("language","C/C++"),("C/C++"!=e||!_isLangPresent("C")&&!_isLangPresent("C++"))&&(_isLangPresent("C")&&"C"!==e&&_removeResult("language","C"),_isLangPresent("C++")&&"C++"!==e&&_removeResult("language","C++"),!_isLangDetected()||"C/C++"!=e&&"C++"!=e&&"C"!=e)?void(File.isVerbose()&&!_isLangPresent(e)&&(s="HEUR"==n,_setResult((s?"~":"")+"language",e,n&&!s?n:"",""))):null}

================================================
FILE: dbs_min/db/python
================================================
function getPythonVersionByDll(n){var t,e="",l=n.indexOf("python")
return-1!==l&&(-1===(t=n.indexOf(".",l+=6))&&(t=n.length),e=n.substring(l,t)),""!==e?1===e.length?e+".0":2===e.length?e[0]+"."+e[1]:e[0]+"."+e.substring(1):null}

================================================
FILE: dbs_min/db/rar-file
================================================
function detect_RAR(e){var i,e=e?(i=0,File.getSize()):(i=File.getOverlayOffset(),File.getOverlaySize())
if(64<=e){if(File.compare("'Rar!'1A07",i)){switch(File.readByte(i+6)){case 0:sVersion="4"
break
case 1:sVersion="5"}bDetected=1}else File.compare("'RE~^'",i)&&(sVersion="1.4",bDetected=1)
if("4"==sVersion){e=File.readByte(i+10)
if(8&e&&(sOptions="solid"),128&e)sOptions+=(sOptions!==""?", ":"")+"encrypted"
else{var r=0
for(i+=7+File.readWord(i+12);116!=File.readByte(i+2)&&(r=File.readWord(i+5)+File.readDword(i+7));)i+=r
for(;116==File.readByte(i+2);){var a=File.readDword(i+7)
if(Archive.add(File.readDword(i+11),a,224==(224&File.readByte(i+3))),!(r=File.readWord(i+5)+a))break
i+=r}sOptions=sOptions.append(Archive.contents())}}}}includeScript("archive-file"),sName="RAR"

================================================
FILE: dbs_min/db/read
================================================
function decEncoding(t,r,e,i){if(void 0===r)return""
if(void 0===e&&(e=!0),129<r.length)for(var n="",s=0;s<t.length&&(t[s]||!e);s++)n+=r[t[s]]
else{void 0===i&&(i=r==CPSpeccy?Chars0to1FSpeccy:r==CPATASCII?Chars0to1FATASCII:Chars0to1FCRLF)
for(var n="",a=0,s=0;s<t.length&&(t[s]||!e);s++)if(t[s]<128)switch(t[s]){case 14:r==JISX0201||r==KOI8R?a=128:n+=i[14]
break
case 15:r==JISX0201||r==KOI8R?a=0:n+=i[15]
break
case 92:r==JISX0201?n+="¥":n+="\\"
break
case 94:r==CPSpeccy?n+="↑":n+="^"
break
case 96:r==CPSpeccy?n+="£":r==CPPETSCIIshifted?n+=" ":n+="`"
break
case 123:r==CPATASCII?i==Chars0to1FATASCII2?n+="Ä":i==Chars0to1FATASCII_PL?n+=" ":n+="♠":n+="{"
break
case 125:r==CPATASCII?n+="↖":n+="}"
break
case 126:r==JISX0201?n+="‾":r==CPATASCII?n+="◀":n+="~"
break
case 127:r!=JISX0201?n+=r[0]:n+=String.fromCharCode(a+t[s])
break
default:!a&&0<=t[s]&&t[s]<32?n+=i[t[s]]:n+=String.fromCharCode(a+t[s])}else n+=r[t[s]-127]}return n}function decAnsi(t,r,e,i,n){return decEncoding(X.readBytes(t,r),e,i,n)}function isWithin(t,r,e){return r<=t&&t<=e}function isInside(t,r,e){return r<t&&t<e}function isWithinRanges(t,r){if(!isNaN(t)&&Array.isArray(r)){for(var e=0,i=!1;e<r.length;e++)if(Array.isArray(r[e])){if(!r[e].length)return
if(1<r[e].length){if(r[e][0]<=t&&t<=r[e][1]){i=!0
break}}else if(t===r[e][0]){i=!0
break}}else if(t===r[e]){i=!0
break}return i}}function Hex(t,r){if(void 0===t)return"!Hex("+t+")"
void 0===r&&(r=2)
var e="",t=(t<0&&(t=-t,e="-"),t.toString(16).toUpperCase()),i=""
return e+(i=t.length<r?Array(1+r-t.length).join("0"):i)+t+"h"}function Bin(t,r){if(void 0===t)return"!Bin("+t+")"
void 0===r&&(r=4)
var e="",t=(t<0&&(t=-t,e="-"),t.toString(2)),i=""
return e+(i=t.length<r?Array(1+r-t.length).join("0"):i)+t+"b"}function Oct(t,r){if(void 0===t)return"!Oct("+t+")"
void 0===r&&(r=3)
var e="",t=(t<0&&(t=-t,e="-"),t.toString(8)),i=""
return e+(i=t.length<r?Array(1+r-t.length).join("0"):i)+t+"o"}function readVarUInt(t){if(t<0||t>=File.getSize())return[0,0]
for(var r=0,e=1,i=1,n=t,s=X.U8(n++),r=r<<7|127&s,a=s;a;)a>>=1,e++
for(;i<16&&128&s;i++)r=r<<7|127&(s=X.U8(n++))
return 64<e?[0,0x10000000000000000]:128&s?[0,-1]:[i,r]}function readFloat80(t,r){var e=[]
if((r=r!=_BE?_LE:r)==_LE)for(var i=0;i<10;i++)e[i]=X.U8(t+i)
else for(i=0;i<10;i++)e[9-i]=X.U8(t+i)
for(var n=0,i=0;i<8;i++)n+=e[i]*Math.pow(256,i)
var r=e[8]+(e[9]<<8),s=32768&r?-1:1,r=32767&r
return 0==r&&0===n?0:32767==r?0===n?1/0*s:NaN:(r=r-16383,s*(Math.floor(n/Math.pow(2,63))+n%Math.pow(2,63)/Math.pow(2,63))*Math.pow(2,r))}function BitReader(t,r){this.n=0,this.buf=0,this.offset=t||0,this.endian=r||_LE,this.init=function(t){this.ofs=t||0,this.n=this.buf=0},this.read=function(t){if((t=64<t?64:t)<0)return 0
if(this.endian===_LE){for(;this.n<t;)this.buf|=Util.shlu64(File.read_uint8(this.offset++),this.n),this.n+=8
var r=this.buf&Util.shlu64(1,t)-1
this.buf=Util.shru64(this.buf,t)}else{for(;this.n<t;)this.buf=Util.shlu64(this.buf,8)|File.read_uint8(this.offset++),this.n+=8
r=Util.shru64(this.buf,this.n-t)
this.buf&=Util.shru64(Util.shlu64(1,this.n)-1,t)}return this.n-=t,r},this.consume=function(t){this.offset+=t},this.seek=function(t){this.offset=t},this.bseek=function(t){this.offset=t-t%8,this.buf=this.n=0,this.read(t%8)}}function bitCount(t){var r=0
for(t=!!t;t;)1&t&&r++,t>>=1
return r}function firstNotOf(t,r,e){if(t+r>X.Sz())return-1
i=0
if(Array.isArray(e)){for(i=0;i<e.length&&!("number"!=typeof e[i]||e[i]<0||e[i]%1!=0);i++);if(i<e.length)throw new Error("firstNotOf cannot parse: "+outArray(e))}else e="number"==typeof e&&0<e&&e%1==0||"string"==typeof e?[e]:[0]
for(r=Math.min(r,X.Sz()-t),i=0;i<r&&e.includes(X.U8(t+i));i++);return i<r?t+i:-1}function isAllZeroes(t,r){return firstNotOf(t,r)<0}function addEllipsis(t,r,e){if(e=e||78,t.length<(r=r||160)||r<e)return t.trim()
for(var i=" .,:;!\\/'\"=&\t\r\n&。、｡,，・",n=r,s=0,a=-1;e<=n&&s<2;){if(0<=i.indexOf(t[n])){for(s++;0<=i.indexOf(t[n]);)n--
a<0&&(a=n+1)}for(;i.indexOf(t[n])<0&&0<=n;)n--}return n<e&&s<2||!s?t.slice(0,r)+"…":t.slice(0,Math.max(a),e)+"…"}function sOptionT(t,r,e,i){void 0===r&&(r=""),void 0===e&&(e=""),void 0===i&&(i=", "),""!=(""+t).trim()&&(sOptions=sOptions.appendS(r+(""+t).trim()+e,i))}function sOption(t,r,e){void 0===r&&(r=""),void 0===e&&(e=""),"undefined"==typeof sep&&(sep=", "),""+t!=""&&(sOptions=sOptions.appendS(r+""+t+e,sep))}function outSz(){if(!arguments.length||void 0===arguments[0])return"?"
var t=[],r=[]
for(i=0;i<arguments.length;i++)0<=arguments[i]?(!r.length||r.indexOf(arguments[i])<0)&&(r.push(arguments[i]),t.push(arguments[i]<X.Sz()?arguments[i]+"(+"+(X.Sz()-arguments[i])+")":arguments[i]>X.Sz()?arguments[i]+"(-"+(arguments[i]-X.Sz())+"!)":arguments[i])):t.push("?")
return t.join("/")}function outArray(t,r,e){if("number"==typeof r&&r%1==0||(r=10),("number"!=typeof e||e%1!=0)&&void 0===e)switch(r){case 8:e=3
break
case 16:e=2
break
case 2:e=4
break
default:e=0}if("number"==typeof t)return t.toString(r).toUpperCase().padStart(e,"0")
if("string"==typeof t)return'"'+t+'"'
for(var i=0,n=[];i<t.length;i++)Array.isArray(t[i])?n.push(outArray(t[i],r,e)):"number"==typeof t[i]&&t[i]%1==0?n.push(t[i].toString(r).toUpperCase().padStart(e,"0")):"string"==typeof t[i]?n.push('"'+t[i]+'"'):n.push(t[i])
return"["+n.join(", ")+"]"}function extIs(t){return File.getFileSuffix().toLowerCase()==t.toLowerCase()}function slashTag(t,r){return t==r||""!=t&&""==r?t:""==t&&""!=r?r:""!=t&&""!=r?t+"/"+r:""}function createOrderlyHuffmanTable(t,r,e){var n=32,s=reall=code=0,a=[],o=[],f=[],h=[]
for(i=0;i<33;i++)o[i]=65535
for(i=0;i<r;i++)(len=t[i])&&(len<n&&(n=len),len>s&&(s=len),65535==o[len]?o[len]=f[len]=i:(h[f[len]]=i,f[len]=i),reall++)
if(!s)return!1
for(d=n;d<=s;d++)for(65535!=o[d]&&(h[f[d]]=r),i=o[d];i<r;i=h[i]){for(var l=0,u=a.length,c=d;0<=c;c--){var p=c&&code>>s-d>>c-1&1?1:0
if(l!=u){if(!c||!a[l][0]&&!a[l][1])return!1
a[l][p]?l=a[l][p]:a[l][p]=l=u}else a.push([c&&!p?u+1:0,c&&p?u+1:0,c?0:i]),l++,u++}code+=1<<s-d}return a}function secondsToTimeStr(t){var r=[315581497635,3155814976,31558150,2629846,604800,86400,3600,60],e="",i=t%r[7],n=Util.div64(t%r[6],r[7]),s=Util.div64(t%r[5],r[6]),a=Util.div64(t%r[4],r[5]),o=Util.div64(t%r[3],r[4]),f=Util.div64(t%r[2],r[3]),h=Util.div64(t%r[1],r[2]),l=Util.div64(t%r[0],r[1]),r=Util.div64(t,r[0])
return t<86400?(e=n.padStart(2,"0")+":"+i.padStart(2,"0"),s?s+":"+e:e):(i&&(e=i+"s"+e),n&&(e=n+"m"+e),s&&(e=s+"h"+e),a&&(e=a+"d"+e),o&&(e=o+"w"+e),f&&(e=f+"M"+e),h&&(e=h+"Y"+e),l&&(e=l+"C"+e),r?r+"Mil"+e:e)}function charStat(){if(!arguments.length)return"?"
if(void 0===arguments[0]||"number"==typeof arguments[0])return"?"
if(str=arguments[0],needall=!(arguments.length<2||!arguments[1]),""==str||str==[])return"empty"
var t,e=[],i=[0,0,0,0,0,0,0],n=[0,0,0,0,0,0,0,0]
if("string"==typeof str)for(t=0;t<str.length;t++)e.push(str.charCodeAt(t))
else e=str
for(t=0;t<e.length;t++)e[t]?9==e[t]?(i[1]++,i[3]++,i[5]++,i[6]++):10==e[t]||13==e[t]?(i[3]++,i[5]++,i[6]++):14==e[t]?(i[3]++,i[5]++):e[t]<=31||127==e[t]?i[5]++:32==e[t]?(i[1]++,i[2]++,i[3]++,i[4]++,i[6]++):43<=e[t]&&e[t]<=45||48<=e[t]&&e[t]<=57?(i[2]++,i[3]++,i[4]++,i[6]++):e[t]<=126?(i[2]++,i[3]++):255==e[t]?(i[3]++,i[6]++):127<e[t]&&i[6]++:(i[0]++,i[3]++,i[5]++,i[6]++)
for(t=0;t<i.length;t++)n[t]=Util.div64(100*i[t],e.length)
return r="",needall?(70<n[0]&&(100===n[0]&&(r+="all"),r+="00"),70<n[1]&&(100===n[1]&&(r+="all"),r+="t "),70<n[4]&&(100===n[4]&&(r+="all"),r+="num"),70<n[2]&&(100===n[2]&&(r+="all"),r+="asc"),70<n[3]&&(100===n[3]&&(r+="all"),r+="xsc"),70<n[5]&&(100===n[5]&&(r+="all"),r+="ctl"),70<n[6]&&(100===n[6]&&(r+="all"),r+="foreign")):70<n[0]?(100===n[0]&&(r+="all"),r+="00"):70<n[1]?(100===n[1]&&(r+="all"),r+="t "):70<n[4]?(100===n[4]&&(r+="all"),r+="num"):70<n[2]?(100===n[2]&&(r+="all"),r+="asc"):70<n[3]?(100===n[3]&&(r+="all"),r+="xsc"):70<n[5]?(100===n[5]&&(r+="all"),r+="ctl"):70<n[6]&&(100===n[6]&&(r+="all"),r+="foreign"),""==r?"any"+n:r}_BE=!0,FINT_QUICK=FINT_FAST=FINT_1=FXSEC1=!(CS_BEST=!(CS_ALL=!(_LE=!1))),TOEOF=-1,CP437="⌂ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥₧ƒáíóúñѪº¿⌐¬½¼¡«»░▒▓│┤╡╢╖╕╣║╗╝╜╛┐└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ ",CP866="⌂АБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмноп░▒▓│┤╡╢╖╕╣║╗╝╜╛┐└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀рстуфхцчшщъыьэюяЁёЄєЇїЎў°∙·√№¤■ ",CP1251="⌂ЂЃ‚ѓ„…†‡€‰Љ‹ЊЌЋЏђ‘’“”•–—・™љ›њќћџ ЎўЈ¤Ґ¦§Ё©Є«¬­®Ї°±Ііґµ¶·ё№є»јЅѕїАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя",CP1252="⌂€・‚ƒ„…†‡ˆ‰Š‹Œ・Ž・・‘’“”•–—˜™š›œ・žŸ ¡¢£¤¥¦§¨©ª«¬・®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ",KOI8R="⌂─│┌┐└┘├┤┬┴┼▀▄█▌▐░▒▓⌠■∙√≈≤≥ ⌡°²·÷═║╒ё╓╔╕╖╗╘╙╚╛╜╝╞╟╠╡Ё╢╣╤╥╦╧╨╩╪╫╬©юабцдефгхийклмнопярстужвьызшэщчъЮАБЦДЕФГХИЙКЛМНОПЯРСТУЖВЬЫЗШЭЩЧЪ",JISX0201="⌂→-‚ƒ„…†‡ˆ‰Š‹Œ↑Ž³™‘’“”•–—˜™š›œ¢žŸ→｡｢｣､･ｦｧｨｩｪｫｬｭｮｯｰｱｲｳｴｶｷｸｹｺｻｼｽｾｿﾀﾁﾂﾃﾄﾅﾆﾇﾈﾉﾊﾋﾌﾍﾎﾏﾐﾑﾒﾓﾔﾕﾖﾗﾘﾙﾚﾛﾜﾝﾞﾟàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ",CPAmiga="⫽абвгдежзийклмнопрстуфхцчшщъыьэюя ¡¢£¤¥¦§¨©ª«¬–®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ",CPRISCOS="⌂€Ŵŵ◰﯀Ŷŷ�⇦⇨⇩⇧…™‰•‘’‹›“”„–—−Œœ†‡fifl ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ",CPATASCII=["▶","🖤","├","▊","┘","┤","┐","╱","╲","◤","▛","◥","▙","▟","▆","￣","▜","♣","┌","─","┼","◘","▀","▐","┬","┴","▐","└","\n","↑","↓","←","→","█","！","”","＃","＄","％","＆","’","（","）","＊","＋","，","ー","．","/","𝟶","𝟷","𝟸","𝟹","𝟺","𝟻","𝟼","𝟽","𝟾","𝟿","：","；","＜","＝","＞","？","＠","𝙰","𝙱","𝙲","𝙳","𝙴","𝙵","𝙶","𝙷","𝙸","𝙹","𝙺","𝙻","𝙼","𝙽","𝙾","𝙿","𝚀","𝚁","𝚂","𝚃","𝚄","𝚅","𝚆","𝚇","𝚈","𝚉","【","\\","】","＾","＿","♦","𝚊","𝚋","𝚌","𝚍","𝚎","𝚏","𝚐","𝚑","𝚒","𝚓","𝚔","𝚕","𝚖","𝚗","𝚘","𝚙","𝚚","𝚛","𝚜","𝚝","𝚞","𝚟","𝚠","𝚡","𝚢","𝚣","♠","-","↰","◁","▷"],CPAtariST="⌂ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥ßƒáíóúñѪº¿⌐¬½¼¡«»ãõØøœŒÀÃÕ¨´†¶©®™ijIJאבגדהוזחטיכלמנסעפצקרשתןךםףץ§∧∞αβΓπΣσµτΦΘΩδ∮φ∈∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²³¯",CPFullCPETshifted=["\0","
","_","⛔️","","⚪","","🔔","⇪","\t","\n","↘","⇪","\r","↘️","💥","","⬇️","↩️","⇱","⌫","🗑️","🗯️","","⇆","↟","?","⎋","🟥","➡️","🟩","🟦"," ","!",'"',"#","$","%","&","'","(",")","*","+",",","-",".","/","0","1","2","3","4","5","6","7","8","9",":",";","<","=",">","?","@","A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z","[","\\","]","↑","←"," ","!",'"',"#","$","%","&","'","(",")","*","+",",","-",".","/","0","1","2","3","4","5","6","7","8","9",":",";","<","=",">","▧","€","🟣","💥","🚀","🕶️","[F1]","[F3]","[F5]","[F7]","[F2]","[F4]","[F6]","[F8]","↵","⇪","🕶️","⬛️","⬆️","↪️","🗑","🗯","🟫","🌸","🧪","⚫️","🟢","🔷","🔳","🟪","⬅️","🟨","🧪"," ","▌","▄","▔","▁","▏","░","▕","▄","▒","▕","├","▗","└","┐","▂","┌","┴","┬","┤","▎","▍","▕","▔","▔","▃","✓","▖","▝","┘","▘","▚","─","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z","┼","▏","│","▓","█"," ","▌","▄","▔","▁","▏","░","▕","▄","▒","▕","├","▗","└","┐","▂","┌","┴","┬","┤","▎","▍","▕","▔","▔","▃","✓","▖","▝","┘","▘","▚"],CPSpeccy=["©","  "," ▀","▀ ","▀▀"," ▄"," █","▀▄","▄█","▄ ","▄▀","█ ","█▀","▄▄","▄█","█▄","██","𝘼","𝘽","𝘾","𝘿","𝙀","𝙁","𝙂","𝙃","𝙄","𝙅","𝙆","𝙇","𝙈","𝙉","𝙊","𝙋","𝙌","𝙍","𝙎","𝚉𝚇¹²⁸","⏯︎","𝚁𝙽𝙳","𝙸𝙽𝙺𝙴𝚈$","π","𝙵𝙽 ","𝙿𝙾𝙸𝙽𝚃 ","𝚂𝙲𝚁𝙴𝙴𝙽$ ","𝙰𝚃𝚃𝚁 ","𝙰𝚃 ","𝚃𝙰𝙱 ","𝚅𝙰𝙻$ ","𝙲𝙾𝙳𝙴","𝚅𝙰𝙻 ","𝙻𝙴𝙽 ","𝚂𝙸𝙽 ","𝙲𝙾𝚂 ","𝚃𝙰𝙽 ","𝙰𝚂𝙽 ","𝙰𝙲𝚂 ","𝙰𝚃𝙽 ","𝙻𝙽 ","𝙴𝚇𝙿 ","𝙸𝙽𝚃 ","𝚂𝚀𝚁 ","𝚂𝙶𝙽 ","𝙰𝙱𝚂 ","𝙿𝙴𝙴𝙺 ","𝙸𝙽 ","𝚄𝚂𝚁 ","𝚂𝚃𝚁$ ","𝙲𝙷𝚁$ ","𝙽𝙾𝚃 ","𝙱𝙸𝙽 ","𝙾𝚁 ","𝙰𝙽𝙳 ","≤","≥","≠","𝙻𝙸𝙽𝙴 ","𝚃𝙷𝙴𝙽 ","𝚃𝙾 ","𝚂𝚃𝙴𝙿 ","𝙳𝙴𝙵 𝙵𝙽 ","𝙲𝙰𝚃 ","𝙵𝙾𝚁𝙼𝙰𝚃 ","𝙼𝙾𝚅𝙴 ","𝙴𝚁𝙰𝚂𝙴 ","𝙾𝙿𝙴𝙽 # ","𝙲𝙻𝙾𝚂𝙴 # ","𝙼𝙴𝚁𝙶𝙴 ","𝚅𝙴𝚁𝙸𝙵𝚈 ","𝙱𝙴𝙴𝙿 ","𝙲𝙸𝚁𝙲𝙻𝙴 ","𝙸𝙽𝙺 ","𝙿𝙰𝙿𝙴𝚁 ","𝙵𝙻𝙰𝚂𝙷 ","𝙱𝚁𝙸𝙶𝙷𝚃 ","𝙸𝙽𝚅𝙴𝚁𝚂𝙴 ","𝙾𝚅𝙴𝚁 ","𝙾𝚄𝚃 ","𝙻𝙿𝚁𝙸𝙽𝚃 ","𝙻𝙻𝙸𝚂𝚃 ","𝚂𝚃𝙾𝙿 ","𝚁𝙴𝙰𝙳 ","𝙳𝙰𝚃𝙰 ","𝚁𝙴𝚂𝚃𝙾𝚁𝙴 ","𝙽𝙴𝚆 ","𝙱𝙾𝚁𝙳𝙴𝚁 ","𝙲𝙾𝙽𝚃𝙸𝙽𝚄𝙴 ","𝙳𝙸𝙼 ","𝚁𝙴𝙼 ","𝙵𝙾𝚁 ","𝙶𝙾 𝚃𝙾 ","𝙶𝙾 𝚂𝚄𝙱 ","𝙸𝙽𝙿𝚄𝚃 ","𝙻𝙾𝙰𝙳 ","𝙻𝙸𝚂𝚃 ","𝙻𝙴𝚃 ","𝙿𝙰𝚄𝚂𝙴 ","𝙽𝙴𝚇𝚃 ","𝙿𝙾𝙺𝙴 ","𝙿𝚁𝙸𝙽𝚃 ","𝙿𝙻𝙾𝚃 ","𝚁𝚄𝙽 ","𝚂𝙰𝚅𝙴 ","𝚁𝙰𝙽𝙳𝙾𝙼𝙸𝚉𝙴 ","𝙸𝙵 ","𝙲𝙻𝚂","𝙳𝚁𝙰𝚆 ","𝙲𝙻𝙴𝙰𝚁 ","𝚁𝙴𝚃𝚄𝚁𝙽","𝙲𝙾𝙿𝚈"],Chars0to1F="・☺☻♥♦♣♠•◘○◙♂♀♪♫☼▶◀↕‼¶§▬↨↑↓→←∟↔▲▼",Chars0to1FLF="・☺☻♥♦♣♠•◘○\n♂♀♪♫☼▶◀↕‼¶§▬↨↑↓→←∟↔▲▼",Chars0to1FCRLF="・☺☻♥♦♣♠•◘○\n♂♀\r♫☼▶◀↕‼¶§▬↨↑↓→←∟↔▲▼",Chars0to1FSpeccy="\0
，📝︎///⬅➡⬇⬆⌫\n№",Chars0to1FATASCII="♥├◨┘┤┐／╲◢▗◣▝▘￣▂▖♣┌─┼•▄▎┬┴▌└␛↑↓←→",Chars0to1FATASCII2="áùÑÉçôòì£ïüäöúóöÜâûîéèñêȧàȦ␛↑↓←→",Chars0to1FATASCII_PL="ŹąźćŚėöÖ£üߣłŃÓ√ĘśäÜĆĄŻÄż␛↑↓←→",Chars0to1FAtariX="áùÑÉçôòì£ïüäÖúóöÜâûîéèñêȧàȦË↑↓←→",Chars0to1FPETSCII="\0
_⛔️⚪🔔⇪\t\n↘⇪\r↘️💥↓🔲⇱⌫🗑️🗯️⇆↟?⎋🟥→🟩🟦"
var patcheddata=[]
function rpU8(t){for(var r=0;r<patcheddata.length;r++)if(patcheddata[r][0]==t)return patcheddata[r][1]
return X.U8(t)}function rpU16be(t){return rpU8(t)<<8|rpU8(t+1)}function rpU32be(t){return rpU8(t)<<24|rpU8(t+1)<<16|rpU8(t+2)<<8|rpU8(t+3)}function wpU8(t,r){for(var e=0;e<patcheddata.length;e++)if(patcheddata[e][0]==t)return void(patcheddata[e][1]=r)
patcheddata.push([t,r])}function wpU16be(t,r){wpU8(t,r>>8&255),wpU8(t+1,255&r)}function wpU32be(t,r){wpU8(t,r>>24&255),wpU8(t+1,r>>16&255),wpU8(t+2,r>>8&255),wpU8(t+3,255&r)}function patchLength(){return patcheddata.length}function patchClear(){patcheddata=[]}function findGaps(r,e){var i=[]
if(Array.isArray(r)&&!(r.length<2)){for(s=0;s<r.length;s++)if(!Array.isArray(r[s])||2!=r[s].length||"number"!=typeof r[s][0]||"number"!=typeof r[s][1])return i
"number"!=typeof e&&(e=1)
for(var n=r.sort(function(t,r){return t[0]!=r[0]?t[0]-r[0]:t[1]-r[1]}),s=1;s<n.length;s++)(t=n[s-1][0]+n[s-1][1])<n[s][0]&&0<=n[s][0]-t-e&&i.push([t,n[s][0]-t])}return i}function findIntersections(t,r){var e,i=[]
if(!Array.isArray(t)||t.length<2)return i
for(o=0;o<t.length;o++)if(!Array.isArray(t[o])||2!=t[o].length||"number"!=typeof t[o][0]||"number"!=typeof t[o][1])return i
function n(t,r){return t[0]!=r[0]?t[0]-r[0]:t[1]-r[1]}for(var s=t.sort(n),a=!1,o=1;o<s.length&&!a;o++)for(j=0;j<o&&!a;j++)(e=s[j][0]+s[j][1])>s[o][0]&&(r&&(a=!0),i.push([s[o][0],s[o][0]+s[o][1]<=e?s[o][1]:e-s[o][0]]))
return i.sort(n)}function findMultiple(t,r,e,n){var s,a=e||[],o=ofs0=t||0,f=Math.min(X.Sz(),o+(r||0)),h=n||1
if(!a.length)return-1
for(i=0;i<a.length&&o<=f;i++){if(f<=o)return-1
if((s=X.fSig(o,a[i][1],a[i][0]))<0){if(!h)return-1
o=ofs0+=h,i=-1}else o=s+a[i][1],i||(ofs0=s)}return ofs0}function funSampleName(t,r){var e=1,i=0
return""!=(t=t.toString()).trim()&&((t.endsWithCI(".wav")||t.endsWithCI(".smp")||t.endsWithCI(".ins")||t.endsWithCI(".iff"))&&i++,(t.startsWithCI("ST-")||t.startsWithCI("df0:"))&&i++,/^\d+$/.test(t)&&i++,t.startsWith("#")&&(e+=5),(/^\s*(unnamed|dr[u]?m\d*|loop\s*\d*|strings?\s*\d*|bass\s*\d*|guitar\s*\d*|snare\s*\d*|piano)\s*$/i.test(t)||/^\s*(trumpet\s*\d*|bells\s*|synth\s*[0-9iv]*|shaker|banjo|lead|syn\d+|\w*\s*hihat|organ\s*\d*)\s*$/i.test(t)||/^\s*(voice\s*\d+|crash|cymbal\s*\d*|wonderpad\s*[0-9iv]+|tambourine\s*[0-9iv]*|tamb\d+)\s*$/i.test(t)||/^\s*((hard|echo)\s?tom|splash|cymbhit|orchm(in|aj)|orch\s?hit|chimes?|kick|scratch)\s*$/i.test(t)||/^\s*((ghost\s?|brass\s?)pad\s*(min|maj|\(sus4\))?|blip|bleep|hhc|hho|clv|bd|sd|pad)\s*$/i.test(t)||/^\s*(m(aj|in)or\s*[0-9iv]*|sawsynth|synbrass|hihat\sclosed)\s*$/i.test(t))&&i++,i<e)}var b64Chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
function toBase64(t){for(var r,e,i="",n=0,s=t.length-t.length%3,n=0;n<s;n+=3)i=(i=(i=(i+=b64Chars[t[n]>>2])+b64Chars[(3&t[n])<<4|(240&t[n+1])>>4])+b64Chars[(15&t[n+1])<<2|(192&t[n+2])>>6])+b64Chars[63&t[n+2]]
return n<t.length&&(r=t[n],e=n+1<t.length?t[n+1]:0,i=(i=(i+=b64Chars[r>>2])+b64Chars[(3&r)<<4|(240&e)>>4])+(n+1<t.length?b64Chars[(15&e)<<2]:"=")+"="),i}function compareArrays(t,r){var e=Math.min(t.length,r.length)
if(t.length+r.length!=0){if(0==e||t.length!=r.length)return!1
for(var i=0;i<e;++i)if(Array.isArray(t[i])){if(!Array.isArray(r[i]))return!1
if(!compareArrays(t[i],r[i]))return!1}else{if(Array.isArray(r[i]))return!1
if(t[i]!==r[i])return!1}}return!0}function _logBase64(t){var r=File.getFileBaseName()+"."+File.getFileCompleteSuffix()
_log('MIME-Version: 1.0\nContent-Type: application/octet-stream; name="'+r+'.dec"\nContent-Transfer-Encoding: base64\nContent-Disposition: attachment; filename="'+r+'.dec"\n'),_log(t)}function _logHex(t){var r=""
for(i=0;i<t.length;i++)i%16||(r+=(i?"  |\n":"")+i.toString(16).padStart(6,"0")+" |"),i%8||(r+=" "),r+=" "+t[i].toString(16).padStart(2,"0")
_log("-8<---"),_log(r),_log("---\x3e8-")}function _logText(t){if(_log("-8<---["+typeof t+" "+t.length+" bytes]---"),"object"==typeof t)for(var r=t,e=0;e<t.length;e++)0==r[e]&&(r[e]=32)
_log(decEncoding(void 0===t?X.readBytes(0,X.Sz(),!0):r,CP866,Chars0to1F)),_log("---\x3e8-")}function _l2r(t,r,e){_setResult("debug",e,"@"+Hex(r),t)}function _currentLine(){var t=(new Error).stack.split("\n")[1].match(/:(\d+)?$/)
return t?parseInt(t[1],10):null}function _logIt(t){void 0===t&&(t="")
var r=(new Error).stack.split("\n")[1]||"",e=r.match(/^(\w+)@/),e=e?e[1]:"<anon>",r=r.match(/:(\d+)(?!.*:)/),r=r?r[1]:"?"
_log(e+("?"==r?"":": "+r)+(t.length?": "+t:""))}function CheckpointTimer(){this.last=0,this.min=100,this.init=function(t){this.last=(new Date).getTime(),"number"==typeof t&&0<=t&&(this.min=t)},this.next=function(t){var r=(new Date).getTime(),e=r-this.last
e>=this.min&&_setResult("prof",t,"",e+" ms passed. "+(X.isOverlay()?" overlay":"")+(X.isResource()?" resource":"")+(X.isFilePart()?" file_part":"")+" Hex at [0]: "+X.getSignature(0,32)),this.last=r}}

================================================
FILE: dbs_min/db/shell-script
================================================
var sInterpreter,sLine,aMatch
function isInterpreter(e){return sInterpreter==e?(sInterpreter="",1):0}void 0===sInterpreter&&(sInterpreter="",aMatch=(sLine=(sLine=Binary.getString(0)).replace(/\/env\s+/,"/")).match(/#!.*\/(.+?)(?:\.exe)?\s/))&&(sInterpreter=aMatch[1])

================================================
FILE: dbs_min/db/soundchips
================================================
SoundChips=["AY-3-8910, AY8910, PSG","AY8930","AY-3-8912","AY-3-8913","YM2149, SSG","YM6630, Sunsoft 5B","YM3439, SSGC","YMZ284, SSGL","YMZ294, SSGLP","YMZ705, SSGS","YM2151, OPM, IC101, #IT-21-51-00","YM3012, IC102, #IT-30-12-00","YM2148, IC103, #IT-21-46-00","YM22702, IC104, #IT-22-70-20","YM2164, OPP","SN76489, DCSG","SN76489A","SN76496","YM3526, OPL","YM3812, OPL2","YMF262, OPL3","YMF278, OPL4","YM2413, OPLL","Konami VRC7","Y8950, MSX-AUDIO","YM2203, OPN","YM2608, OPNA","YM2612, OPN2","YM2610, OPNB","YM2610B","NEC D7759, uPD7759","NEC D7759C","Sharp LR35902, DMG-CPU, GameBoy DMG","Hudson Soft HuC6280","Ricoh 2A03, RP2A03, NES APU","Namco C140","Namco C219","Ensoniq ES5506","Ensoniq ES5505"]

================================================
FILE: dbs_min/db/vgmcodingutils
================================================
function xma2_parse_xma2_chunk(r){for(var U=X.U8(r),_=X.U8(r+1),a=X.U32(r+4,_BE),n=X.U32(r+8,_BE),e=0<X.U8(r+3)||n,t=X.U32(r+12,_BE),u=X.U32(r+(3==U?20:28),_BE),c=0,f=3==U?32:40,i=0;i<_;i++)c+=X.U8(r+f+4*i)
return[c,t,e,u,a,n]}function xma2_parse_fmt_chunk_extra(r,U){var _=X.U32(r+24,U),a=X.U32(r+40,U),U=X.U32(r+44,U),r=X.U8(r+48)||U
return[r=a+128-512==0&&_+128-512<=U+128-512+256?!1:r,_,a,U]}includeScript("read")

================================================
FILE: dbs_min/db/wxWidgets
================================================
var aWx
void 0!==aWx||(aWx=PE.isLibraryPresentExp(/^wx.*?(univ)?(\d+)(u)?(d)?/i))||PE.isResourceNamePresent("WXWINDOWMENU")&&(aWx=1)

================================================
FILE: dbs_min/db/zip-file
================================================
function detect_Zip(e){var i=0
if(e){if(File.compare("'PK00'")&&(i=4),Binary.compare("'PK'0708",i))return sOptions="extended",void(bDetected=1)}else if(File.compareOverlay("'PK'0304"))i=File.getOverlayOffset()
else{e=File.getSize()
if(e<64)return
if(i=e-=11,!File.compare("'PK'0506'",i)){if(e<4096?i=0:(i-=4096,e=4096),-1==(i=File.findSignature(i,e,"'PK'0506")))return
e=File.readDword(i+16)
if(i-=File.readDword(i+12),!File.compare("'PK'0102",i))return
i+=File.readDword(i+42)-e}}if(File.compare("'PK'0304",i)){bDetected=1,-1!=File.findString(i,64,"META-INF/MANIFEST.MF")&&(sOptions=sOptions.append("JAR")),-1!=File.findString(i,64,"classes.dex")&&(sOptions=sOptions.append("APK"))
var r=0,d=0
do{var t=File.readByte(i+4),t=(r<t&&(r=t),!d&&1&File.readByte(i+6)&&(d=1),File.readDword(i+18)),a=File.readWord(i+26)}while(Archive.add(File.readDword(i+22),t,0==t&&47==File.readByte(i+30+a-1)),i+=30+a+File.readWord(i+28)+t,File.compare("'PK'0304",i))
sOptions=(sOptions=d?"encrypted":sOptions).append(Archive.contents()),sVersion=(r/10).toFixed(1)}}includeScript("archive-file"),sName="Zip"

================================================
FILE: dbs_min/db/zlib
================================================
function detect_zlib(s,e){var o="ZLIB compression"
return s.compare("7801",e)?(s.isVerbose()&&(o+=" fastest"),sOptions=sOptions.append(o),!0):s.compare("785E",e)?(s.isVerbose()&&(o+=" fast"),sOptions=sOptions.append(o),!0):s.compare("789C",e)?(s.isVerbose()&&(o+=" normal"),sOptions=sOptions.append(o),!0):s.compare("78DA",e)?(s.isVerbose()&&(o+=" best"),sOptions=sOptions.append(o),!0):void 0}

================================================
FILE: dbs_min/db_custom/.vscode/about.txt
================================================
This directory is responsible for correct recognition of *.sg files by Visual Studio Code. You can delete it if you don't need it.

================================================
FILE: dbs_min/db_custom/.vscode/settings.json
================================================
{
    "files.associations": {
        "*.sg": "javascript"
    }
}

================================================
FILE: dbs_min/db_extra/.vscode/about.txt
================================================
This directory is responsible for correct recognition of *.sg files by Visual Studio Code. You can delete it if you don't need it.

================================================
FILE: dbs_min/db_extra/.vscode/settings.json
================================================
{
    "files.associations": {
        "*.sg": "javascript"
    }
}

================================================
FILE: dbs_min/db_extra/COM/packer_packers.2.sg
================================================
function detect(){return Binary.compare("bf....be....b9....fdf3a5fceb$$8bf7bf....adad8be8b2..e9")?(sOptions="by B. Vorontsov",bDetected=1):Binary.compare("565056fd8bfc83ef..b9....be....f3a447ffe7")?(sOptions="1997 by CyberWare",bDetected=1):Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf9bf....c3")?(sOptions="1997 by JES //CORE",bDetected=1):Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3")?(sVersion="1.2b",sOptions="1997 by JES //CORE",bDetected=1):Binary.compare("508cc890ba....05....3b06....72..b4..ba....cd21b8....cd21")&&(sOptions="1996 by LostSoul",bDetected=1),result()}meta("packer","Packer")

================================================
FILE: dbs_min/db_extra/COM/patcher_patchers.1.sg
================================================
function detect(){return Binary.compare("bc....8cc88ec08ed8fcbe....b9....8ae180e4..ac32c48844..e2")?(sName="Patch engine",sOptions="by SoNiC //UTG",bDetected=1):Binary.compare("e9$$$$b80300cd10b409ba....cd21e8$$$$1eb8....8ed833c98a0e....fec95133d2fec68916....b4..b2..cd21")?(sName="ByteHunter patch engine",sOptions="by nOP & THE_q //Phrozen Crew",bDetected=1):Binary.compare("e9$$$$0e588ec08ed88d16....68....9d9c582d....72..33dbb9")?(sName="GPatch",sVersion="1.2b",sOptions="by JES //C.O.R.E. team",bDetected=1):Binary.compare("e9$$$$0e588ec08ed8e8$$$$68....9d9c582d....73..8d3e....fbc3")?(sName="GPatch",sVersion="1.0c",sOptions="by JES //C.O.R.E. team",bDetected=1):Binary.compare("e9$$$$e8$$$$50558becc746......5d0733ffb9....fcb8....f3abc3")?(sName="Cracker",sOptions="by NightIce //ByTe Enf0rcerZ",bDetected=1):Binary.compare("eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99e8....f7d0f7d2b9")?(sName="AutoCRK",sVersion="1.2x (uncrypted)",sOptions="1995 by MACHiNE GUNgsTeR //BANG!",bDetected=1):Binary.compare("eb$$8bfc83ef..83ec..be....b9....57f3a45fffe7")?(sName="AutoCRK",sVersion="1.2x (crypted)",sOptions="1995 by MACHiNE GUNgsTeR //BANG!",bDetected=1):Binary.compare("c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99")?(sName="AutoCRK",sVersion="1.15",sOptions="1995 by MACHiNE GUNgsTeR //BANG!",bDetected=1):Binary.compare("e9$$$$ba....8bda438a2780fc..75..e8....3c..74..2e8b1e....83fb..75..e9")?(sName="CRK2COM",sVersion="1.10b",sOptions="1993",bDetected=1):Binary.compare("'/MG/'eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99")?(sName="AutoCRK",sVersion="1.20",sOptions="by MACHiNE GUNgsTeR //BANG!",bDetected=1):Binary.compare("e9$$$$e8$$$$bb....b9....8a0734..880743e2..c3")?(sName="Crack Engine",sVersion="0.2",sOptions="by Prizna //PSP",bDetected=1):Binary.compare("'SNT'1af8b409ba....cd2133f6bd....b8....ba....cd21a3....72..33c933d28bd8")?(sName="SNT patch",sOptions="//SNT",bDetected=1):Binary.compare("eb$$0e1fb409ba....cd21be....e8....803e......74..b4..ba....cd21eb..b4..ba....cd21b8....cd21")?(sOptions="by WOLVERiNE",bDetected=1):Binary.compare("bc....5406b8....cd21891e....8c06....b8....ba....cd21b8....ba....cd21071eb9....ba....b7..b8....cd10")?(sOptions="by Randall Flagg of Razor 1911",bDetected=1):Binary.compare("e9$$$$b8....cd10ba....e8....ba....b8....cd2173..ba....e8....ba....e8....b44ccd2193ba....e8")?(sOptions="by Nostromo",bDetected=1):Binary.compare("e9$$$$ba....b409cd21c706........c706........c706........c706........be....33c98a0e....80f9..74..5651")?(sName+=" #1",sOptions="by Drink Or Die (Dark Knight)",bDetected=1):Binary.compare("e9$$$$ba....b409cd2133c0cd16b4..33dbcd10feccb2..cd10c706........c706........c706........c706")?(sName+=" #2",sOptions="by Dark Knight",bDetected=1):Binary.compare("b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb")?(sOptions="by Mr. KIM",bDetected=1):Binary.compare("9090ba....8bfab409cd21c606......ba....b8....cd2172..93b8....33c933d2cd2172")?(sOptions="by SkorpyoN Team",bDetected=1):Binary.compare("9090ba....b409cd21b401cd1674..33c0cd1633c0cd163c..0f84")||Binary.compare("9090ba....8bfab409cd21b401cd1674..33c0cd1633c0cd163c..75")?(sOptions="by +DzA kRAker",bDetected=1):Binary.compare("ba....b409cd21ba....b409cd21ba....b8....cd21ba....0f82....a3....ba....b409cd218b1e")&&(sName="MkPatch",sVersion="1.0",sOptions="by eGIS!",bDetected=1),result()}meta("patcher","Patcher")

================================================
FILE: dbs_min/db_extra/ELF/protector_ELFCrypt.2.sg
================================================
function detect(){return ELF.compareEP("eb0206c6609cbe")&&(sVersion="1.0",bDetected=1),result()}meta("protector","ELFCrypt")

================================================
FILE: dbs_min/db_extra/MSDOS/cryptor_Cryptors.2.sg
================================================
function detect(){return MSDOS.compareEP("b2..33f6b9....2e30144649e3..eb..b8....ffe0")?(sOptions="by Rainor'99",bDetected=1):MSDOS.compareEP("1e8ccb8edbbb....8177......8177......8177......8177......8177......1f0eeb")?(sOptions="by Papaev V.V., Moscow",bDetected=1):MSDOS.compareEP("50e8$$$$5b9c5825....509d8ccb81c3....81eb....53bb....53cb")?(sOptions="1990-92 by Sergdesign",bDetected=1):MSDOS.compareEP("81c3....eb$$85fa85e8eb$$81c3....eb$$bb....81eb....81c3....f981e9....39f5ba....81ea....85de")?(sOptions="by eGIS! //CORE",bDetected=1):MSDOS.compareEP("bd....8cdb83c3..8cd805....8ed88ec033ffbe....b9....ba....0bc975..0bd274..4ae8....eb..561e")?(sOptions="1994 by FalCoN",bDetected=1):MSDOS.compareEP("e9$$$$e8$$$$bf....e9$$$$31d2eb$$eb$$e9$$$$8edae9$$$$e8$$$$8715e9$$$$52eb$$31f6e8$$bb....eb$$8737e9$$$$56e9$$$$e9$$$$e8$$$$bf....bb....2e8a1789d8")||MSDOS.compareEP("e9$$$$eb$$bf....e9$$$$29f6e8$$$$e9$$$$8edee8$$$$8735e8$$$$56e9$$$$e9$$$$31ede9$$$$bb....e9$$$$e8$$$$e9$$$$e8$$$$e9$$$$e9$$$$e8$$$$e8$$$$e8$$$$872f")?(sOptions="by Matrix Technologies",bDetected=1):MSDOS.compareEP("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35")?(sOptions="by DREAMMASTER",bDetected=1):MSDOS.compareEP("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d")?(sOptions="by RaZoR 1911",bDetected=1):MSDOS.compareEP("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2")?(sName+=" N1",sOptions="by ZeroCoder //XG",bDetected=1):MSDOS.compareEP("3beb81c5....fc23eb13ec85fd1e0e33e985ee01ed23ee1f0e81d1....84e931dd073efe0e....e9")?(sOptions="1996 by RAM Scanner //CiD",bDetected=1):MSDOS.compareEP("b8....15....72..d4..8ac4..c3....8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f")||MSDOS.compareEP("b8....15....72..d4..8ac4..c3..8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f")?(sOptions="by Thunderbyte",bDetected=1):MSDOS.compareEP("2e8c1e....2e8e06....33ff33f6b9....0e1f030e....f3a406b8....500e07cb")?(sOptions="1994 by Paragon Technology Systems",bDetected=1):MSDOS.compareEP("87dbb8....15....72$$8cd315....72..d4..8ac483c3..8ed8b9....f7d32e87")?(sOptions="1997 by Thunderbyte",bDetected=1):MSDOS.compareEP("50e8$$$$5b83c3..1e06530e1f83c3..90b0..b9....2e3007fec043e2")&&(sOptions="by Dr. Motorhead",bDetected=1),result()}meta("cryptor","Cryptor")

================================================
FILE: dbs_min/db_extra/MSDOS/packer_FCP_IV.2.sg
================================================
function detect(){return MSDOS.compareEP("bc....c3")&&MSDOS.compare("'FCP/IV'",MSDOS.getEntryPointOffset()-6)&&(sOptions="by FCP/IV",bDetected=1),result()}meta("packer","protector")

================================================
FILE: dbs_min/db_extra/PE/archive_Resources.6.sg
================================================
function detect(){if(0==PE.getAddressOfEntryPoint()){bDetected=1
for(var e=0;e<=PE.nLastSection&&!bDetected;e++)536870944&PE.section[e].Characteristics&&(bDetected=0)}return result()}meta("archive","Resources")

================================================
FILE: dbs_min/db_extra/PE/compiler_EP.MSC.4.sg
================================================
function detect(){return PE.compareEP("64a100000000558bec6aff68........68........506489250000000083ec..5356578965")?(sVersion="3.0-5.0",bDetected=1):PE.compareEP("64a100000000558bec6aff68........68........508b45..6489250000000083ec..85c05356578965")?(sVersion="3.10",bDetected=1):PE.compareEP("535657bb........8b7c....553bfb75..011d")?(sVersion="3.0-3.10",bDetected=1):PE.compareEP("53b8........8b5c....565785db5575..833d..........75..33c0")&&(sVersion="3.0-5.0",bDetected=1),result()}meta("compiler","EP:Microsoft C/C++")

================================================
FILE: dbs_min/db_extra/PE/compiler_EP.MSVC.4.sg
================================================
function detect(){return PE.compareEP("8bff558bec837d....75..e8........ff75..8b4d..8b55..e8")?sVersion="2008-2010":PE.compareEP("8bff558bec83ec..538b5d..83fb..75..5657e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")?sVersion="2010, 10":PE.compareEP("8bff558bec837d....0f84........ff75..ff75..e8........59595d")?sVersion="2010, 10 (30319, 40219)":PE.compareEP("837c24....8b4424..a3........75..68........6a")||PE.compareEP("558bec8b45..83f8..75..68........ff15")?sVersion="2010, 10 (40219)":PE.compareEP("8bff558bece8$$$$$$$$8bff558bec83ec..c745..........c745..........813d")?sVersion="2008, 9.0":PE.compareEP("8bff558bec83ec..837d....75..5657e8........b8........be........8bf8")||PE.compareEP("8bff558bece8........5de9")?sVersion="2008 SP1":PE.compareEP("8bff558bec837d....75..e8........8b45..508b4d..518b55..52e8")?(sVersion="2008",sOptions="MSVCRTD"):PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")?sVersion="2008-2010":PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....57bf........3bc7")?sVersion="2005-2010":PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5657bf........be........3bc7")?sVersion="2010, 10.10":PE.compareEP("8bff558bec837d....75..e8........5de9........8bff55")?sOptions="Patched":PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")?sVersion="6.0 (1720-9782)":PE.compareEP("558bec538b5d..568b75..85f6578b7d")?sVersion="2002 (2148)":PE.compareEP("558bec538b5d..568b75..578b7d..85f675")?sVersion="6.0 (1720-8966)":PE.compareEP("8b4424..83e8..74..4875..8b4424..50a3........ff15")?sVersion="2003, 7.1 (3077)":PE.compareEP("558bec8b45..83f8..56570f84........33ff3bc7")?sVersion="2003, 7.1 (3052)":PE.compareEP("558bec518b45..8945..837d....74..837d")||PE.compareEP("558bec568b75..83fe..74..83fe..75..a1")?sVersion="2002":PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff")?sVersion="2003, 7.1 (3052-9782)":PE.compareEP("6a..68........e8........66813d............75..a1")?sVersion="2002":PE.compareEP("6a..68........e8........33c0408945..8b75..33ff")||PE.compareEP("8bff558bec538b5d..568b75..85f6578b7d")?sVersion="2003":PE.compareEP("fff589e566f7c6....80c3..80eb..81ec........66c1eb..6689ed")||PE.compareEP("6689ff5589e581ec........814d..........0f82........538d45")?(sVersion="2003",sOptions="Driver"):PE.compareEP("8bff558bec837d....75..e8........5de9")?sVersion="2005":PE.compareEP("8bff558bec8b45..83e8..566a..5e0f84")?sVersion="2003-2005":PE.compareEP("8bff558bec8b45..5633f64685c0")?sVersion="2005":PE.compareEP("8bff558beca1........85c0b9........74..3bc175..a1")||PE.compareEP("8bff558bec83ec..53568b75..8b46..5733ff897d")?(sVersion="2005",sOptions="Driver"):PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357")||PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........85c074..3d........75..568d")?sVersion="2005":PE.compareEP("5355568b74....85f657b8........75..8b0d")?sVersion="5.0":PE.compareEP("558bec6a..68........68........64a100000000506489250000000083c4..535657")?sVersion="5.0-6.0 (1720-9049)":PE.compareEP("535657bb........8b7c....553bfb74..85ff")?sVersion="3.10":PE.compareEP("558bec837d....0f84........ff75..ff75..ff75..e8........83c4")?sVersion="2012":PE.compareEP("8bff558bec837d....74..8b55..51e8$$$$$$$$8bff558bec83ec..a1........33c58945..5633f657")?sVersion="2013, 12.1 (40116)":PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")||PE.compareEP("8bff558bec83ec..a1........33c58945..568b75..5783fe")?sVersion="2013":PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb")?sVersion="2005":PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc7")?sVersion="2012, update 4":PE.compareEP("8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365....8365....57bf........3bc7")?sVersion="2005 (50727)":PE.compareEP("8b4424..83e8..74..4875..568b7424..56ff15")?sVersion="2005 (50727.1)":PE.compareEP("837c24....75..e8$$$$$$$$8bff558bec83ec..a1........85c0")||PE.compareEP("8bff56e8........85c07c..e8$$$$$$$$e8$$$$$$$$8bff558bec83ec..a1........8365....8365....57bf........3bc7")||PE.compareEP("558bece8$$$$$$$$558bec83ec..c745..........c745..........813d")?sVersion="2005 (50727)":PE.compareEP("558bec81ec........8b45..89..........83............0f84........83")?sVersion="6.0":PE.compareEP("558bec51c745..........837d....75..833d..........75..33c0e9")?sVersion="6.0 (1720-8799)":PE.compareEP("558bec83ec..8365....5356578b3d........6a..5933c0")?(sVersion="6.0 (8168)",sOptions="Driver"):PE.compareEP("558bec83ec..5356578b3d........8d45..33db")?(sVersion="6.0 (1720)",sOptions="Driver"):PE.compareEP("558bec81ec........837d....75..8d85........c785")?sVersion="6.0 (1735)":PE.compareEP("8b4424..5383f8..5674..33c93bc10f84........83f8..0f84........6a..585e5b")?sVersion="6.0 (8168-8797)":PE.compareEP("837c24....8b4424..a3........c705................75..e8........b8........c2")?sVersion="2008, SP1":PE.compareEP("8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")?sVersion="2008, SP1 (21022, 30729)":PE.compareEP("8bff558bec837d....0f84........ff75..8b4d..8b55..e8........595d")?sVersion="2008 (21022)":PE.compareEP("837c24....0f84$$$$$$$$e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7")||PE.compareEP("837c24....75..e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7")?sVersion="2005":PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")?sVersion="2013-2017":PE.compareEP("8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..8365....8365....a1........5657bf........be........3bc7")?sVersion="2017, 15.0 (24610)":PE.compareEP("e8$$$$$$$$8bff558bec83ec..8365....8365....a1........5657bf........be........3bc7")?sVersion="2017, 15.0":PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8")?sVersion="2017, 15.5-6":PE.compareEP("5355568b7424..85f657b8........74..8b7c24..8b5c24..83fe..74")?sVersion="1997, 5.XX":PE.compareEP("535657bb........8b7c24..553bfb0f85........011d")&&(sVersion="3.1"),bDetected=bDetected||Boolean(sVersion)||Boolean(sOptions),sVersion&&(sVersion+=", by EP"),result()}meta("compiler","Microsoft Visual C/C++")

================================================
FILE: dbs_min/db_extra/PE/cryptor_3dcrypter.2.sg
================================================
function detect(){return PE.compareEP("684c124000e8eeffffff0000000000003000000038000000000000003848ee54")&&(sVersion="mod Zion-92",bDetected=1),result()}meta("cryptor","3dCrypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_404crypter.1.sg
================================================
function detect(){return PE.isNET()&&PE.isNetObjectPresent("Z.resources")&&PE.isNetObjectPresent("First")&&(bDetected=1),result()}meta("cryptor","404Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_ABC_Cryptor.2.sg
================================================
function detect(){return PE.compareEP("68FF6424F0685858585890FFD4508B40F205B095F6950F850181BBFF")&&(sVersion="1.0",bDetected=1),result()}meta("cryptor","ABC Cryptor")

================================================
FILE: dbs_min/db_extra/PE/cryptor_AR_Crypt_Private.2.sg
================================================
function detect(){return PE.compareEP("b8........5033c0c3")&&PE.compareEP("b8########6033db33c9b8........3d........74")&&(bDetected=1),result()}meta("cryptor","AR Crypt Private")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Aase_Crypter.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4F053B8A03E0010E893DEFFFF68F8420010E879DFFFFF6800430010")&&(sVersion="1.0",bDetected=1),result()}meta("cryptor","Aase Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_AcidCrypt.2.sg
================================================
function detect(){return(PE.compareEP("60B9........BA........BE........0238404E75FA8BC28A1832DFC0CB")||PE.compareEP("BE........0238404E75FA8BC28A1832DFC0CB"))&&(bDetected=1),result()}meta("cryptor","AcidCrypt")

================================================
FILE: dbs_min/db_extra/PE/cryptor_AlmafuerteCrypter.1.sg
================================================
function detect(){return PE.compareEP("649068f4134000e8ecffffff000000003000000040000000000000003b2d72e4")&&(sVersion="mod Zion-92",bDetected=1),result()}meta("cryptor","AlmafuerteCrypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Anslym_Crypter.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4F05356B838170510E85A45FBFF33C05568211C051064FF30648920")&&(bDetected=1),result()}meta("cryptor","Anslym Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_App_Encryptor.2.sg
================================================
function detect(){return(PE.compareEP("60E8000000005D81ED1F1F4000B97B0900008DBD671F40008BF7AC")||PE.compareEP("E997000000'\r\nSilent Team App Protector'"))&&(bDetected=1),result()}meta("cryptor","App Encryptor")

================================================
FILE: dbs_min/db_extra/PE/cryptor_BasicCrypt1.1.sg
================================================
function detect(){return PE.compareEP("68b0114000e88bfbffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4010000641b400000000000308c4000408c4000980b000000904000b41040")&&(sOptions="sudo",bDetected=1),result()}meta("cryptor","BasicCrypt")

================================================
FILE: dbs_min/db_extra/PE/cryptor_BopCrypt.2.sg
================================================
function detect(){return PE.compareEP("60BD........E8....0000")&&(sVersion="1.00",bDetected=1),result()}meta("cryptor","BopCrypt")

================================================
FILE: dbs_min/db_extra/PE/cryptor_ChainskiCrypter.1.sg
================================================
function detect(){return PE.isNetObjectPresent("Chainski")&&(bDetected=1),result()}meta("cryptor","ChainskiCrypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_CodeCrypter.2.sg
================================================
function detect(){return PE.compareEP("5058535B90BB........FFE390CCCCCC558BEC5DC3")&&(sVersion="0.31",bDetected=1),result()}meta("cryptor","CodeCrypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Crypter.2.sg
================================================
function detect(){return PE.compareEP("68FF6424F06858585858FFD4508B40F205B095F6950F850181BBFF68")&&(sVersion="3.1",bDetected=1),result()}meta("cryptor","Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Cryptic.2.sg
================================================
function detect(){return PE.compareEP("B8........BB........B900100000BA........03D803C803D13BCA74068031..41EBF6FFE3")&&(sVersion="2.0",bDetected=1),result()}meta("protector","Cryptic")

================================================
FILE: dbs_min/db_extra/PE/cryptor_DCrypt_Private.2.sg
================================================
function detect(){return PE.compareEP("B9........E8000000005868........83E80B0F1800D00048E2FBC3")&&(sVersion="0.9b",bDetected=1),result()}meta("cryptor","DCrypt Private")

================================================
FILE: dbs_min/db_extra/PE/cryptor_DataAnubis.1.sg
================================================
function detect(){return PE.isNetObjectPresent("_Lambda$__R20-1")&&PE.isNetObjectPresent("_Lambda$__R97-1")&&(bDetected=1),result()}meta("cryptor","DataAnubis")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Fly-Crypter.2.sg
================================================
function detect(){return(PE.compareEP("53565755BB2C....44BE00304444BF20....44807B28007516833F0074118B1789D033D289178B")||PE.compareEP("558BEC83C4F053B818224444E87FF7FFFFE80AF1FFFFB809000000E85CF1FFFF8BD885DB7505"))&&(sVersion="1.0",bDetected=1),result()}meta("cryptor","Fly-Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_FreeCryptor.2.sg
================================================
function detect(){return PE.compareEP("8B0424409083C007803890907402EBFF")?(PE.compareEP("68",16)?sVersion="0.1 build 001":PE.compareEP("9068",16)&&(sVersion="0.1 build 002"),bDetected=1):PE.compareEP("33D2901E68........0FA01F8B029050548F0290908E642408FFE2585033D25283F8019B408A10891424")?(sVersion="0.2 build 002",bDetected=1):PE.compareEP("90909b591e909b9033d29b68........9b9b0fa01f8b0a9b51548f0290909b")&&(sVersion="0.3 build 3",bDetected=1),result()}meta("cryptor","FreeCryptor")

================================================
FILE: dbs_min/db_extra/PE/cryptor_INCrypter.2.sg
================================================
function detect(){return PE.compareEP("6064A1300000008B400C8B400C8D5820C70300000000E8000000005D81ED")&&(sVersion="0.3",bDetected=1),result()}meta("cryptor","INCrypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Open_Source_Code_Crypter.2.sg
================================================
function detect(){return PE.compareEP("558BECB9090000006A006A004975F9535657B8........E828F8FFFF33C05568")&&(bDetected=1),result()}meta("cryptor","Open Source Code Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_STUD.2.sg
================================================
function detect(){return PE.compareEP("682C114000E8F0FFFFFF00000000000030000000380000000000000037BB71ECA4E1984C9BFE8F0FFA6A07F6")&&(sVersion="RC4 1.0",bDetected=1),result()}meta("cryptor","ScanTime UnDetectable")

================================================
FILE: dbs_min/db_extra/PE/cryptor_SexCrypt.2.sg
================================================
function detect(){return PE.isSignatureInSectionPresent(0,"'SexCrypt'....324485..4202....3842849322100493..7726374558429100005400000000002900390045....049003200539......44..000000219840")&&(bDetected=1),result()}meta("cryptor","sex")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Sexe_Crypter.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4EC53565733C08945ECB8........E830FAFFFF33C05568........64FF306489")&&(sVersion="1.1",bDetected=1),result()}meta("cryptor","Sexe Crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_Simple_UPX_Cryptor.2.sg
================================================
function detect(){return PE.compareEP("60B8........B9....0000803408..E2FA6168........C3")&&(PE.compareEP("1800",7)?sOptions="multi layer encryption":PE.compareEP("01",8)&&(sOptions="single layer encryption"),sVersion="30.4.2005",bDetected=1),result()}meta("cryptor","Simple UPX Cryptor")

================================================
FILE: dbs_min/db_extra/PE/cryptor_The_Best_Cryptor.2.sg
================================================
function detect(){return-1!=PE.findSignature(PE.getSize()-256,256,"8b042483e8..68........ffd0b8........3d..............30..40eb..b8........3d..............30..40eb")&&(bDetected=1),result()}meta("cryptor","The Best Cryptor by FsK")

================================================
FILE: dbs_min/db_extra/PE/cryptor_ass-crypter.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4EC53........8945ECB898400010E8ACEAFFFF33C055687851001064........206A0A6888510010A1E097001050E8D8EAFFFF8BD853A1E097001050E812EBFFFF8BF853A1E097001050E8DCEAFFFF8B")&&(bDetected=1),result()}meta("cryptor","ass-crypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_darkeye.1.sg
================================================
function detect(){return PE.isNetObjectPresent("BasicCryptorFromDebil")&&(bDetected=1),result()}meta("cryptor","DarkEye")

================================================
FILE: dbs_min/db_extra/PE/cryptor_njCrypter.2.sg
================================================
function detect(){return PE.isNET()&&(bDetected=1,validateReferences(isPositive=!0,references=["System.IO","System.Security.Cryptography","System.Text","System.Reflection","Stub","cMain","Decrypt","bSalt"]))?(bDetected=0,null):result()}function validateReferences(e,t){for(var r=0;r<t.length;r++){var n="00'"+t[r]+"'00"
if(1==e){if(!PE.isSignatureInSectionPresent(0,n))return!0}else if(PE.isSignatureInSectionPresent(0,n))return!0}return!1}meta("cryptor","njCrypter")

================================================
FILE: dbs_min/db_extra/PE/cryptor_unknown_malware_cryptor.2.sg
================================================
function detect(){return PE.compareEP("51578bcf47fc5f5955eb")?(sVersion="AA",bDetected=1):PE.compareEP("558bec81c4........565753508d8424........ff15")?(sVersion="AB",bDetected=1):(PE.compareEP("833d..........e9$$$$$$$$0f85........5058807c")||PE.compareEP("833d..........75$$ff35........e8$$$$$$$$558bec81ec"))&&(sVersion="AC",bDetected=1),result()}meta("cryptor","Unknown malware cryptor")

================================================
FILE: dbs_min/db_extra/PE/cryptors_1.2.sg
================================================
function detect(){return PE.compareEP("bb........8b338b4b..b8........eb$$31064975..83c3..833b..75..eb$$9b")&&(sName="Cryptor by Merix //UCF",bDetected=1),result()}meta("cryptor","Unknown cryptor")

================================================
FILE: dbs_min/db_extra/PE/cryptors_2.2.sg
================================================
function detect(){return PE.compareEP("909090909090609ce8000000005dd14d..816d..........d709d8ab")&&(sOptions="by TMG",bDetected=1),result()}meta("cryptor","unknwown cryptor")

================================================
FILE: dbs_min/db_extra/PE/insatller_Avast_installer.sg
================================================
function detect(){return bDetected=PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")&&PE.compareOverlay("'ASWsetupFPkgFil3'"),result()}meta("installer","Avast installer")

================================================
FILE: dbs_min/db_extra/PE/installer_Adobe_Flash_Player_installer.1.sg
================================================
function detect(){if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7"))for(var e=0;e<PE.getNumberOfResources()&&!bDetected;e++)"RT_RCDATA"==PE.resource[e].Type&&PE.compare("02010000",PE.resource[e].Offset)&&(bDetected=1)
return result()}meta("installer","Adobe Flash Player")

================================================
FILE: dbs_min/db_extra/PE/installer_Blizzard_PrePatch.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")?PE.compareOverlay("'MPQ'1a")&&(sVersion="2.XX",bDetected=1):PE.compareEP("e8$$$$$$$$e8$$$$$$$$a1........85c075..538b1d........5657be........bf........8d6424")&&PE.compareOverlay("'MPQ'1a")&&(sVersion="2.70",bDetected=1),result()}meta("installer","Blizzard PrePatch")

================================================
FILE: dbs_min/db_extra/PE/installer_Box_Stub.1.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374")&&-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(272,PE.getOverlaySize()),"'7z'bcaf")&&(sOptions="7zip",bDetected=1),result()}meta("installer","Box Stub")

================================================
FILE: dbs_min/db_extra/PE/installer_BulletProofSoft_installer.1.sg
================================================
function detect(){return PE.compareEP("558bec6a..68........68........64a100000000506489250000000083ec..5356578965")&&PE.compareOverlay("1f8b08",12288)&&(bDetected=1),result()}meta("installer","BulletProofSoft")

================================================
FILE: dbs_min/db_extra/PE/installer_DockerDesktopInstaller.1.sg
================================================
function detect(){return PE.isNET()&&PE.isNetObjectPresent("Docker Desktop Installer")&&4194304==PE.getAddressOfEntryPoint()&&16777216<PE.section[".rsrc"].FileSize&&(sVersion="4.x",bDetected=1),result()}meta("installer","Docker Desktop Installer .NET sfx 7zip")

================================================
FILE: dbs_min/db_extra/PE/installer_Enigma_Installer.1.sg
================================================
function detect(){for(var e=0;e<PE.resource.length;e++)if("/CFG/CONFIG"==PE.resource[e].Name&&"/CFG/PRIVACY_POLICY"==PE.resource[e+1].Name){bDetected=2
break}return PE.compareEP("E8....0100E9")&&2==bDetected&&(bDetected=1,sVersion="v1.0"),result()}meta("installer","Enigma")

================================================
FILE: dbs_min/db_extra/PE/installer_Hamrick_Software_installer.1.sg
================================================
function detect(){return PE.compareOverlay("BDA6EEE9F9EDEFEDE5ED")&&(PE.compareEP("E8....0000")||PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..33c0"))&&(bDetected=1),result()}meta("installer","Hamrick Software - VueScan Installer")

================================================
FILE: dbs_min/db_extra/PE/installer_Kingsoft_Installer.1.sg
================================================
function detect(){return(PE.compareEP("E8")||PE.compareEP("60"))&&PE.compareOverlay("'zzd.'")&&(sOptions="7z archive",bDetected=1),result()}meta("installer","Kingsoft")

================================================
FILE: dbs_min/db_extra/PE/installer_QT_installer.1.sg
================================================
function detect(){return PE.compareOverlay("'qres'")&&(bDetected=1),result()}meta("installer","QT installer")

================================================
FILE: dbs_min/db_extra/PE/installer_SHIROUZU_Hiroaki_installer.1.sg
================================================
function detect(){return PE.compareEP("E8....0000E9")&&PE.compareOverlay("0A'======================================================================'0A'IP2:'")&&(sVersion="5.X - .zlib ovl",bDetected=1),result()}meta("installer","SHIROUZU Hiroaki and FastCopy Lab Installer 1996-2024")

================================================
FILE: dbs_min/db_extra/PE/installer_Store_Installer.1.sg
================================================
function detect(){return PE.isNET()&&"StoreInstaller.exe"==PE.getVersionStringInfo("InternalName")&&(sVersion=PE.getVersionStringInfo("FileVersion"),bDetected=1),result()}meta("installer","Store Installer")

================================================
FILE: dbs_min/db_extra/PE/installer_TrueCrypt-VeraCrypt_installer.1.sg
================================================
function detect(){return PE.compareEP("E8....0000E9")&&PE.compareOverlay("..'CINSTRT'")?(sVersion="1.X-7.X",bDetected=1):PE.compareEP("558BEC83EC0C56")&&PE.compareOverlay("'VCINSTRT'")&&(sVersion="1.26 2025",bDetected=1),result()}meta("installer","TrueCrypt or VeraCrypt installer")

================================================
FILE: dbs_min/db_extra/PE/joiner_Anskya_Binder.2.sg
================================================
function detect(){return PE.compareEP("BE........BB........33ED83EE04392E7411")&&(sVersion="1.1",bDetected=1),result()}meta("joiner","Anskya Binder")

================================================
FILE: dbs_min/db_extra/PE/joiner_Blade_Joiner.1.sg
================================================
function detect(){return PE.compareEP("558BEC81C4E4FEFFFF53565733C08945F08985")&&(sVersion="1.5",bDetected=1),result()}meta("joiner","Blade Joiner")

================================================
FILE: dbs_min/db_extra/PE/joiner_DJoin.1.sg
================================================
function detect(){return PE.compareEP("C605........00C605........00................00........00..........00")?(sVersion="0.7 public",sOptions="RC4 encryption",bDetected=1):PE.compareEP("C605........00................00........00..........00")&&(sVersion="0.7 public",sOptions="xor encryption",bDetected=1),result()}meta("joiner","DJoin")

================================================
FILE: dbs_min/db_extra/PE/joiner_ExeJoiner.1.sg
================================================
function detect(){return PE.compareEP("68........6804010000E83903000005........C6005C680401000068")&&(sVersion="1.0",bDetected=1),result()}meta("joiner","ExeJoiner")

================================================
FILE: dbs_min/db_extra/PE/keygen_keygens.1.sg
================================================
function detect(){return PE.compareEP("6a..e8........a3........c705................c705................c705................c705................c705................a1........a3........6a..ff35........e8........a3........a3........68")?(sOptions="by Dimedrol //CORE",bDetected=1):PE.compareEP("606a..e8........a3........6a..6a..6a..e8........506a..e8........50")?(sOptions="by promethee //ECLIPSE",bDetected=1):PE.compareEP("6a..e8........a3........68........6a..6a..6a..6a..68........6a..6a..6a..68........6a..6a..6a..6a..e8........a3........6a")?(sOptions="by Duelist //CORE",bDetected=1):PE.compareEP("6a..e8........a3........6a..68........6a..6a..50e8........50e8........c3")?(sOptions="2000 by Duelist //CORE",bDetected=1):PE.compareEP("6a..e8........a3........33c066b8....6a..68........6a..50ff35........e8........e8........c8......53575633c0668b45..663d....75..eb")&&(sOptions="by //oDDiTy",bDetected=1),result()}meta("keygen","Keygen")

================================================
FILE: dbs_min/db_extra/PE/library_DS.Flexlm.4.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize(),e=(5e7<e&&(e=5e7),PE.findSignature(0,e,"'@(#) F'"))
return-1!=e&&(sName=File.cleanString(PE.getString(e,200).match(/\w\S*/i)),sVersion=File.cleanString(PE.getString(e,200).match(/\d\S*/i)))&&sVersion.length<32&&(bDetected=1),result()}meta("library")

================================================
FILE: dbs_min/db_extra/PE/library_DS.RLM.4.sg
================================================
function detect(){var e=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize(),c=(5e7<e&&(e=5e7),PE.findString(0,e,"Reprise License Manager (RLM)"))
return-1!==c&&(sVersion=PE.getString(c,200).match(/\d\S*\w/i),bDetected=1,-1!==(c=PE.findSignature(0,e,"44894c24..4c894424..48895424..48894c24..b8........e8........482be0488b05........4833c448898424........48c78424................48c78424................48c78424................c74424..........c74424..........488b8424........4805........48894424..c74424..........c74424..........c74424..........c78424................4883bc24..........74..488b8424........c7")))&&(sOptions="rlm_pubkey at "+c),result()}meta("library","Reprise License Manager (RLM)")

================================================
FILE: dbs_min/db_extra/PE/packer_BobPack.2.sg
================================================
function detect(){return PE.compareEP("60E8000000008B0C2489CD83E90681ED........E83D0000008985........89C2B85D0A00008D0408E8E40000008B700401D6E876000000E851010000E80101")&&(sVersion="1.00",bDetected=1),result()}meta("packer","BobPack")

================================================
FILE: dbs_min/db_extra/PE/packer_Feokt.2.sg
================================================
function detect(){return PE.compareEP("8925........bf........31c0b9........29f9fcf3aa9bdbe350669bd93c249b")&&(sOptions="by Max Feoktistov",bDetected=1),result()}meta("packer","Feokt run-time")

================================================
FILE: dbs_min/db_extra/PE/packer_IMPostor_Pack.2.sg
================================================
function detect(){return PE.compareEP("BE........83C601FFE600000000....000000000000000000......00..02....00100000000200")&&(sVersion="1.0",bDetected=1),result()}meta("packer","IMPostor Pack")

================================================
FILE: dbs_min/db_extra/PE/packer_Native_UD_Packer.2.sg
================================================
function detect(){return PE.compareEP("31C031DB31C9EB0E6A006A006A006A00FF15........FF15........89C768")&&(sVersion="1.1",bDetected=1),result()}meta("packer","Native UD Packer")

================================================
FILE: dbs_min/db_extra/PE/packer_TomatoX.2.sg
================================================
function detect(){return PE.isSectionNamePresent(".tomato")&&(bDetected=1),result()}meta("packer","TomatoX")

================================================
FILE: dbs_min/db_extra/PE/packer_bbfb.2.sg
================================================
function detect(){return-1!=PE.findString(0,PE.getSize(),"BB FlashBack Movie")&&(PE.compare("'FBPE'",PE.getSize()-4)&&(bDetected=1),sVersion=PE.getFileVersion()),result()}meta("packer","Blueberry/FLASHBACK")

================================================
FILE: dbs_min/db_extra/PE/patcher_Patch.1.sg
================================================
function detect(){if(PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68........6a..e8"))for(var e=0;e<PE.resource.length;e++)if("RT_RCDATA"==PE.resource[e].Type&&PE.compare("a28ff4c4",PE.resource[e].Offset)){sVersion="2.0",bDetected=1
break}return result()}meta("patcher","Patch")

================================================
FILE: dbs_min/db_extra/PE/protection_DS.Key-Lok_II_dongle.5.sg
================================================
function detect(){for(var e=0,t=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize();-1!=(e=PE.findString(e,t-e,"\\.\\"));)if(e+=4,PE.compare("'KeyDongle_0'",e)){bDetected=1
break}return result()}meta("protection","Key-Lok II dongle reference")

================================================
FILE: dbs_min/db_extra/PE/protection_DS.Novex_dongle.4.sg
================================================
function detect(){return-1!=PE.findString(0,PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize(),"\\\\.\\NVKEY")&&(bDetected=1),result()}meta("protection","Novex/Guardant dongle reference")

================================================
FILE: dbs_min/db_extra/PE/protection_DS.Rockey4_dongle.5.sg
================================================
function detect(){for(var e=0,r=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize();-1!=(e=PE.findString(e,r-e,"\\.\\"));)if(e+=4,PE.compare("'ROCKEY'",e)||PE.compare("'rockey'",e)){bDetected=1
break}return result()}meta("protection","Rockey4 dongle reference")

================================================
FILE: dbs_min/db_extra/PE/protection_DS.Wizzkey_dongle.5.sg
================================================
function detect(){return-1!=PE.findString(0,PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize(),"\\\\.\\WIZZKEYRL")&&(bDetected=1),result()}meta("protection","Wizzkey dongle reference")

================================================
FILE: dbs_min/db_extra/PE/protector_ARM_Protector.2.sg
================================================
function detect(){if(PE.compareEP("E8040000008360EB0C5DEB05")){switch(PE.readDword(PE.nEP+42)){case 2739:sVersion="0.5"
break
case 2977:sVersion="0.6"
break
default:sVersion="0.1b-0.3b"}bDetected=1}return result()}meta("protector","ARM Protector")

================================================
FILE: dbs_min/db_extra/PE/protector_ASPR_Stripper.2.sg
================================================
function detect(){return PE.compareEP("BB........E9........609CFCBF........B9........F3AA9D61C3558BEC")&&(sVersion="2.X",bDetected=1),result()}meta("protector","ASPR Stripper")

================================================
FILE: dbs_min/db_extra/PE/protector_Adept_Protector.2.sg
================================================
function detect(){var e
return PE.isNET()&&-1!=(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"ByAdeptProtector"))&&(PE.compare("'Smashed'",e-7)?sOptions="Evaluation":PE.compare("'STAThreadAttribute'",e+17)&&(sVersion="2.1"),bDetected=1),result()}meta("protector","Adept Protector")

================================================
FILE: dbs_min/db_extra/PE/protector_Alex_Protector.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED06104000E824000000")?(sVersion="1.0",bDetected=1):PE.compareEP("60E801000000C783C40433C9E8010000006883C404E8010000006883C404")&&(sVersion="0.4 beta 1",bDetected=1),result()}meta("protector","Alex Protector")

================================================
FILE: dbs_min/db_extra/PE/protector_Alloy.2.sg
================================================
function detect(){return PE.compareEP("9C60E802......33C08BC483C004938BE38B5BFC81EB........87DD6A0468001000006800..00006A00FF95........0B")&&(sVersion="4.x",bDetected=1),result()}meta("protector","Alloy")

================================================
FILE: dbs_min/db_extra/PE/protector_Apex-c.2.sg
================================================
function detect(){return PE.compareEP("68........B9FFFFFF0001D0F7E2720148E2F7B9FF0000008B34248036FD46E2FAC3")&&(sVersion="BLT Apex 4.0",bDetected=1),result()}meta("protector","Apex-c")

================================================
FILE: dbs_min/db_extra/PE/protector_BitShape_PE_Crypt.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED........B97B0900008DBD........8BF7AC")?(sVersion="1.5",bDetected=1):PE.compareEP("E8000000005B83EB05EB04'RND!'EB02CD20EB")&&(sVersion="1.0-1.02",bDetected=1),result()}meta("protector","BitShape PE Crypt")

================================================
FILE: dbs_min/db_extra/PE/protector_BlindSpot.2.sg
================================================
function detect(){return PE.compareEP("558BEC81EC500200008D85B0FEFFFF5356A3........578D85B0FDFFFF680001000033F65056FF15........5668800000006A0356568D85B0FDFFFF680000008050FF15........56566800080000508945FCFF15")&&(sVersion="1.00",bDetected=1),result()}meta("protector","BlindSpot")

================================================
FILE: dbs_min/db_extra/PE/protector_Break_Into_Pattern.2.sg
================================================
function detect(){return PE.compareEP("E9$$$$$$$$EB14")&&(sVersion="0.1",bDetected=1),result()}meta("protector","Break-Into-Pattern")

================================================
FILE: dbs_min/db_extra/PE/protector_CDS_SS.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED........FF742420E8D30300000BC00F84130300008985........668CD8A804740CC785")&&(sVersion="1.0 beta1",bDetected=1),result()}meta("protector","CDS SS")

================================================
FILE: dbs_min/db_extra/PE/protector_CodeSafe.2.sg
================================================
function detect(){return PE.compareEP("83EC10535657E8C40100",23)&&(sVersion="2.0",bDetected=1),result()}meta("protector","CodeSafe")

================================================
FILE: dbs_min/db_extra/PE/protector_DEF.2.sg
================================================
function detect(){return PE.compareEP("BE........6A..59807E070074118B460C05........8B56103010404A75FA83C628E2E4")&&(sVersion="1.0",bDetected=1),result()}meta("protector","DEF")

================================================
FILE: dbs_min/db_extra/PE/protector_DirTy_CrYpt0r.2.sg
================================================
function detect(){return PE.compareEP("b8........32dbfec33018403d........7e..68........e8")&&(bDetected=1),result()}meta("protector","DirTy CrYpt0r")

================================================
FILE: dbs_min/db_extra/PE/protector_EP.2.sg
================================================
function detect(){return PE.compareEP("5083C0178BF09733C033C9B124AC86C4ACAA86C4AAE2F600B8400003003C40D2338B661450708B8D3402448B1810487003BA")?(sVersion="1.0",bDetected=1):PE.compareEP("6A..60E90101")&&(sVersion="2.0",bDetected=1),result()}meta("protector","EP")

================================================
FILE: dbs_min/db_extra/PE/protector_EXECrypt.2.sg
================================================
function detect(){return PE.compareEP("909060E8000000005D81ED........B91500000083C10483C101EB05EBFE83C756EB00EB00")&&(sVersion="1.0",bDetected=1),result()}meta("protector","EXECrypt")

================================================
FILE: dbs_min/db_extra/PE/protector_EXERefactor.2.sg
================================================
function detect(){return PE.compareEP("558BEC81EC900B0000535657E9588C0100'USCATION'")&&(sVersion="0.1",bDetected=1),result()}meta("protector","EXERefactor")

================================================
FILE: dbs_min/db_extra/PE/protector_Embed_PE.2.sg
================================================
function detect(){if(PE.compareEP("83EC506068........E8....0000")){switch(PE.readWord(PE.nEP+10)){case 39215:sVersion="1.13"
break
case 65483:sVersion="1.24"
break
default:sVersion="1.X"}bDetected=1}return result()}meta("protector","Embed PE")

================================================
FILE: dbs_min/db_extra/PE/protector_EncryptPE.2.sg
================================================
function detect(){if(PE.compareEP("609C64FF3500000000E8")){switch(PE.readDword(PE.nEP+10)){case 377:sVersion="1.2003.3.18-1.2003.5.18"
break
case 378:sVersion="2.2004.6.16-2.2006.6.30"
break
case 371:sVersion="2.2006.7.10-2.2006.10.25"
break
case 539:sVersion="2.2007.04.11"}bDetected=1}return result()}meta("protector","EncryptPE")

================================================
FILE: dbs_min/db_extra/PE/protector_ExeSafeguard.2.sg
================================================
function detect(){return PE.isSignatureInSectionPresent(PE.nLastSection,"C05DEB4EEB47DF694E58DF5974F3EB01DF75EE9A599C81C1E2FFFFFFEB01DF9DFFE1E851E8EBFFFFFF")&&(sVersion="1.0",bDetected=1),result()}meta("protector","ExeSafeguard")

================================================
FILE: dbs_min/db_extra/PE/protector_ExeSmasher.2.sg
================================================
function detect(){return PE.compareEP("9CFE03..60BE........8DBE..10FFFF5783CDFFEB10")&&(bDetected=1),result()}meta("protector","ExeSmasher")

================================================
FILE: dbs_min/db_extra/PE/protector_Exe_Locker.2.sg
================================================
function detect(){return PE.compareEP("E800000000608B6C242081ED05000000")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Exe Locker")

================================================
FILE: dbs_min/db_extra/PE/protector_FakeNinja.2.sg
================================================
function detect(){return PE.compareEP("64A118000000EB02C3118B4030EB010F0FB6400283F80174FEEB01E890C0FFFFEB03BDF4B564A1300000000")?(sVersion="2.8",sOptions="Anti-Debug",bDetected=1):PE.compareEP("BA........FFE2........FF35........E840")&&(sVersion="2.8",bDetected=1),result()}meta("protector","FakeNinja")

================================================
FILE: dbs_min/db_extra/PE/protector_FixupPak.2.sg
================================================
function detect(){return PE.compareEP("55E8000000005D81ED....0000BE00..000003F5BA0000....2BD58BDD33C0AC3C00743D3C01740E")&&(sVersion="1.20",bDetected=1),result()}meta("protector","FixupPak")

================================================
FILE: dbs_min/db_extra/PE/protector_Fuck_n_Joy.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED........FF742420E88C0200000BC00F842C0100008985")&&(sVersion="1.0c",bDetected=1),result()}meta("protector","Fuck n Joy")

================================================
FILE: dbs_min/db_extra/PE/protector_Fusion.2.sg
================================================
function detect(){return PE.compareEP("68........68........E80903000068........E8C7020000")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Fusion")

================================================
FILE: dbs_min/db_extra/PE/protector_GuardantStealth.2.sg
================================================
function detect(){return 1==PE.getNumberOfImports()&&"NOVEX32.dll"==PE.getImportLibraryName(0)&&(bDetected=1),result()}meta("protector","Guardant Stealth")

================================================
FILE: dbs_min/db_extra/PE/protector_ICrypt.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4EC53565733C08945ECB8703B0010E83CFAFFFF33C055686C3C00")&&(sVersion="1.0",bDetected=1),result()}meta("protector","ICrypt")

================================================
FILE: dbs_min/db_extra/PE/protector_ID_Application_Protector_NoNamePacker.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED........B9........81E9........89EA81C2........8D3A89FE31C0E9D3020000CCCCCCCCE9CA020000'C:\\Windows\\SoftWareProtector\\'")&&(sVersion="1.2",bDetected=1),result()}meta("protector","ID Application Protector (NoNamePacker)")

================================================
FILE: dbs_min/db_extra/PE/protector_KGCrypt.2.sg
================================================
function detect(){return PE.compareEP("E8........5D81ED........64A1........84C074..64A1........0BC074")&&(bDetected=1),result()}meta("protector","KGCrypt")

================================================
FILE: dbs_min/db_extra/PE/protector_MZ-Crypt.2.sg
================================================
function detect(){return PE.compareEP("60E8000000005D81ED251440008BBD771440008B8D7F144000EB28837F1C07751E8B770C03B57B14")&&(sVersion="1.0",bDetected=1),result()}meta("protector","MZ-Crypt")

================================================
FILE: dbs_min/db_extra/PE/protector_Minke.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4F053..........10E87AF6FFFFBE........33C05568........64FF30648920E8FAF8FFFFBA")&&(sVersion="1.0.1",bDetected=1),result()}meta("protector","Minke")

================================================
FILE: dbs_min/db_extra/PE/protector_Morphine.2.sg
================================================
function detect(){return PE.compareEP("FF25........8BC0FF25........8BC0")&&(sVersion="1.2-1.3",bDetected=1),result()}meta("protector","Morphine")

================================================
FILE: dbs_min/db_extra/PE/protector_NecroVM.Virt.2.sg
================================================
function detect(){if(PE.isNet()){if("It's NecroVM!"==PE.getString(46,13)&&PE.isSignatureInSectionPresent(0,"5F00'VmLoad'00'mscorlib'"))return n="",-1!=(r=PE.findString(496,16,"v"))&&(n=PE.getString(r+1,511-r)),_setResult("packer","NecroVM Compressor",n,"LZMAT"),""
for(var e=["System.Reflection","System.Security.Cryptography","System.Runtime.InteropServices"],t=0;t<e.length;t++)if(!PE.isSignatureInSectionPresent(0,"00'"+e[t]+"'00"))return""
var n,r="NecroVM.Runtime"
PE.isSignatureInSectionPresent(0,"50??'"+r+"'")&&PE.isNetObjectPresent(r)&&PE.isSignatureInSectionPresent(0,"'info'00'flags'00'nativeEntry'00'nativeSizeOfCode'")&&(PE.isSignatureInSectionPresent(0,"0005'_'00'_'00")&&_setResult("protection","NecroVM Code Container","",""),PE.isSignatureInSectionPresent(0,"2000690073002000740061006d00700065007200650064002e00")&&_setResult("protection","NecroVM Anti-Tamper","",""),n="Virtualization",PE.isSignatureInSectionPresent(0,"00'm_1'")&&(n+=" + Obfuscation"),_setResult("protector","NecroVM","2.X",n))}return result()}

================================================
FILE: dbs_min/db_extra/PE/protector_NoodleCrypt.2.sg
================================================
function detect(){return PE.compareEP("EB019AE8..000000EB019AE8....0000EB019AE8....0000EB01")&&(sVersion="2.0",bDetected=1),result()}meta("protector","NoodleCrypt")

================================================
FILE: dbs_min/db_extra/PE/protector_PE-Admin.2.sg
================================================
function detect(){return PE.compareEP("609C64FF3500000000E879010000900000000000000000000000................0000000000000000000000000000000000000000")&&(sVersion="1.0",bDetected=1),result()}meta("protector","PE-Admin")

================================================
FILE: dbs_min/db_extra/PE/protector_PENightMare.2.sg
================================================
function detect(){return PE.compareEP("60E9........EF4003A7078F071C375D43A704B92C3A")?(sVersion="2 Beta",bDetected=1):PE.compareEP("60E8000000005DB9........8031154181F9")&&(sVersion="1.3",bDetected=1),result()}meta("protector","PENightMare")

================================================
FILE: dbs_min/db_extra/PE/protector_PE_Quake.2.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$5d81ed........8d75..56ff55..8db5........5650ff55..8985........6a..68")&&(sVersion="0.06",bDetected=1),result()}meta("protector","PE Quake")

================================================
FILE: dbs_min/db_extra/PE/protector_Pe123.2.sg
================================================
function detect(){return PE.compareEP("8BC0609CE801000000C353E87200000050E81C0300008BD8FFD35BC3")?(sVersion="2006.4.12",bDetected=1):PE.compareEP("8BC0EB013460EB012A9CEB02EAC8E80F000000EB033D2323EB014AEB015BC3")&&(sVersion="2006.4.4",bDetected=1),result()}meta("protector","Pe123")

================================================
FILE: dbs_min/db_extra/PE/protector_PolyEnE.2.sg
================================================
function detect(){return(PE.compareEP("6083ec..c70424........5868........8b0c2483c4..fff051ff15........50eb")||PE.compareEP("6068........8b04..83c4..83ec..c70424........595051ff15........eb"))&&(bDetected=1),result()}meta("protector","PolyEnE")

================================================
FILE: dbs_min/db_extra/PE/protector_PwdProtect.2.sg
================================================
function detect(){return PE.isSectionNamePresent(".pwdprot")&&(bDetected=1),result()}meta("protector","PwdProtect")

================================================
FILE: dbs_min/db_extra/PE/protector_QQProtect.2.sg
================================================
function detect(){return PE.isResourceNamePresent("QQPROTECT")&&(bDetected=1),result()}init("protector","QQProtect")

================================================
FILE: dbs_min/db_extra/PE/protector_Sepanta.2.sg
================================================
function detect(){return!PE.isOverlayPresent()||-1==PE.findString(PE.getOverlayOffset(),4096,"<Sepanta>")&&-1==PE.findString(PE.getOverlayOffset(),4096,"</Sepanta>")||(bDetected=1),result()}meta("protector","Sepanta")

================================================
FILE: dbs_min/db_extra/PE/protector_Soft_Defender.2.sg
================================================
function detect(){return PE.compareEP("74$$74$$78$$68A2AF470159E8")&&(bDetected=1,sVersion=PE.compareEP("BA010000",72)?"1.0-1.1":PE.compareEP("BE010000",73)?"1.12":"1.X"),result()}meta("protector","Soft Defender")

================================================
FILE: dbs_min/db_extra/PE/protector_TheHypers.2.sg
================================================
function detect(){return PE.compareEP("558BEC83EC148BFCE8$$$$$$$$5EE80D000000'kernel32.dll'00")&&(bDetected=1),result()}meta("protector","TheHypers")

================================================
FILE: dbs_min/db_extra/PE/protector_WinKript.2.sg
================================================
function detect(){return PE.compareEP("33C08BB8........8B90........85FF74..33C950EB..8A0439C0C8..34..880439413BCA72..58")&&(sVersion="1.0",bDetected=1),result()}meta("protector","WinKript")

================================================
FILE: dbs_min/db_extra/PE/protector_Wind_of_Crypt.2.sg
================================================
function detect(){return PE.compareEP("558BEC83C4EC53........8945ECB8........E828EAFFFF33C05568")&&(sVersion="1.0",bDetected=1),result()}meta("protector","Wind of Crypt")

================================================
FILE: dbs_min/db_extra/PE/protector_Xtreme-Protector.2.sg
================================================
function detect(){return PE.compareEP("B8........B9........5051E805000000E94A010000608B7424248B7C2428FCB2808A0646880747BB0200000")&&(sVersion="1.06",bDetected=1),result()}meta("protector","Xtreme-Protector")

================================================
FILE: dbs_min/db_extra/PE/protector_muckis_protector.2.sg
================================================
function detect(){return PE.compareEP("BE........B9........8A06F6D0880646E2F7E9")?bDetected=1:PE.compareEP("E8240000008B4C240CC70117000100C781B80000000000000031C0894114894118806A00")&&(sVersion="II",bDetected=1),result()}meta("protector","mucki's protector")

================================================
FILE: dbs_min/db_extra/PE/sfx_ADS_Self_Extractor.1.sg
================================================
function detect(){return PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774")?bDetected=PE.compareOverlay("7b00320030003700320036003300370037002d00"):PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")&&(bDetected=-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(256,PE.getOverlaySize()),"7b00320030003700320036003300370037002d00")),result()}meta("sfx","ADS Self-Extractor")

================================================
FILE: dbs_min/db_extra/PE/sfx_CipherWall.1.sg
================================================
function detect(){if(PE.compareEP("9061BE........8DBE0000FEFFC787C0200200")){switch(sVersion="1.5",PE.getEPSignature(19,14)){case"0B6E5B9B5783CDFFEB0E90909090":sOptions="Decryptor Console"
break
case"F989C76A5783CDFFEB0E90909090":sOptions="Decryptor GUI"}bDetected=1}return result()}meta("sfx","CipherWall")

================================================
FILE: dbs_min/db_extra/PE/tool_UPX_shit.2.sg
================================================
function detect(){return PE.compareEP("E2FA94FFE06100000000000000")||PE.compareEP("94BC......00B9..00000080340C..E2FA94FFE061")?(sVersion="0.0.1",bDetected=1):PE.compareEP("B8....4300B915000000803408..E2FAE9D6FFFFFF")?(sVersion="0.06",bDetected=1):PE.compareEP("E8000000005E83C614AD89C7AD89C1AD300747E2FBADFFE0C3")&&(sVersion="0.1",bDetected=1),result()}meta("tool","UPX shit")

================================================
FILE: dbs_min/db_extra/PE/tool_UPXcrypter.2.sg
================================================
function detect(){return PE.compareEP("BF......0081FF......007410812F..00000083C704BB05....00FFE3BE......00FFE600000000")&&(bDetected=1),result()}meta("tool","UPXcrypter")

================================================
FILE: dbs_min/db_extra/PE/virus_Win9x_CIH.1.sg
================================================
function detect(){return PE.compareEP("558d4424f833db648703e8000000005b8d4b425150500f014c24fe5b83c31cfa")&&(bDetected=1),result()}meta("virus","Win9x.CIH")

================================================
FILE: dbs_min/db_extra/about.txt
================================================
"db_extra" contains detection rules and scripts that were not approved for inclusion in the main database.
Some of these rules may trigger only a few positive detections across the entire internet.

Using this default database is NOT RECOMMENDED as it is not optimized or actively maintained.

================================================
FILE: dbs_min/timestamp.log
================================================
Generated: 16/03/2026


================================================
FILE: dbs_min_generate.cmd
================================================
@echo off
:: rd dbs_min /q /s
node autotools\dbcompiler\task.js
echo Generated: %DATE%>dbs_min\timestamp.log
call db_compress

================================================
FILE: dbs_min_generate_and_publish.cmd
================================================
@echo off
call dbs_min_generate.cmd
git add dbs_min\
git commit -m "dbs_min update" >nul 2>&1 && git push

================================================
FILE: detectiteasy.cmake
================================================
set(DETECTITEASY_SOURCES true)

if (DEFINED X_RESOURCES)
    install (DIRECTORY ${CMAKE_CURRENT_LIST_DIR}/db DESTINATION ${X_RESOURCES} OPTIONAL)
    install (DIRECTORY ${CMAKE_CURRENT_LIST_DIR}/db_custom DESTINATION ${X_RESOURCES} OPTIONAL)
endif()



================================================
FILE: die_version.txt
================================================
3.20

================================================
FILE: docker/diec.sh
================================================
#!/bin/bash
# This will simply take the argument passed to it,
# parse the directory and bind it as a read-only mount point on the container
# and pass in the filename as the argument to diec.sh
# This assumes file target is last argument!

# Build with:
# sudo docker build . -t horsicq:diec

TARGET="${@: -1}"  # last argument is target file
INPUT_DIR=$(cd $(dirname "$TARGET") && pwd -P)
INPUT_FILE=$(basename $TARGET)


if [ "$#" -eq 0 ]; then
  docker run -i horsicq:diec
elif [ "$#" -eq 1 ]; then
  docker run --rm --volume "$INPUT_DIR":/input:ro -i horsicq:diec "/input/$INPUT_FILE";
else
  docker run --rm --volume "$INPUT_DIR":/input:ro -i horsicq:diec "/input/$INPUT_FILE" "${@:1:$#-1}";
fi


================================================
FILE: docs/BUILD.md
================================================
# How to build on Docker

```bash
git clone https://github.com/horsicq/DIE-engine.git
cd DIE-engine
sudo docker build . -t horsicq:diec
```

# How to build on Linux based on Debian 

* You can also watch tutorial on [YouTube](https://www.youtube.com/watch?v=hODcbA_1Tns)
* For further Information you can look at [fr0stb1rd blogpost](https://fr0stb1rd.gitlab.io/posts/building-and-running-detect-it-easy-on-kali-linux-complete-tutorial/).
  
#### Install packages:

```bash
sudo apt-get install qtbase5-dev qtscript5-dev qttools5-dev-tools libqt5svg5-dev git build-essential -y
```

- Ubuntu 14.04-20.04:

```bash
sudo apt-get install qt5-default -y
```

- Ubuntu 21.04-25.10

```bash
sudo apt-get install qtchooser qt5-qmake pkg-config -y
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Run build script:

```bash
bash -x build_dpkg.sh
```

#### Install deb package:

```bash
sudo dpkg -i release/$(ls release)
```

# How to build on Linux based on Fedora (DNF) 
  
#### Install packages:

```bash
sudo dnf install qt5-qtbase-devel qt5-qtscript-devel qt5-qttools-devel git make gcc-c++
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```
#### Build

```bash
chmod a+x configure
./configure
make -j4
```

# How to build on Linux based on openSuse (zypper) 
  
#### Install packages:

```bash
sudo zypper install libqt5-qtbase-devel libqt5-qtscript-devel libqt5-qttools-devel libqt5-qtsvg-devel git gcc-c++ make
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```
#### Build

```bash
chmod a+x configure
./configure
make -j4
```

# How to build on Linux based on Arch Linux (pacman) 
  
#### Install packages:

```bash
sudo pacman -S --needed git base-devel qt5-base qt5-tools qt5-script
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```
#### Build

```bash
chmod a+x configure
./configure
make -j4
```

# How to build on Linux(Automake)

### Qt framework has to be installed on the system.

#### (Ubuntu) Install Qt Framework:

```bash
sudo apt-get install --quiet --assume-yes build-essential qt5-default qtbase5-dev qttools5-dev-tools qtscript5-dev libqt5svg5-dev
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Build

Might require sudo privileges

```bash
chmod a+x configure
./configure
make -j4
sudo make install
```

# How to build on Linux(QT6)

### Qt framework has to be installed on the system.

#### (Ubuntu) Install Qt Framework:

```bash
sudo apt-get install --quiet --assume-yes build-essential qt6-base-dev qt6-base-dev-tools qt6-tools-dev-tools qt6-5compat-dev libqt6svg6-dev qt6-declarative-dev
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Build

```bash
mkdir build
cd build
qmake6 ../die_source.pro CONFIG+=release
make
```

# How to build on macOS

Install Qt 5.15.2: https://github.com/horsicq/build_tools

Clone project: git clone --recursive https://github.com/horsicq/DIE-engine.git

Edit build_mac.sh (check QMAKE_PATH variable)

Run build script: bash -x build_mac.sh

# How to build on Windows(XP)

Install Visual Studio 2013: https://github.com/horsicq/build_tools

Install Qt 5.6.3 for VS2013: https://github.com/horsicq/build_tools

Install 7-Zip: https://github.com/horsicq/build_tools

Clone project: git clone --recursive https://github.com/horsicq/DIE-engine.git

Edit build_winxp.bat (check VSVARS_PATH, SEVENZIP_PATH, QMAKE_PATH variables)

Run build_winxp.bat

# How to build on Windows(7-11)

Install Visual Studio 2019: https://github.com/horsicq/build_tools

Install Qt 5.15.2 for VS2019: https://github.com/horsicq/build_tools

Install 7-Zip: https://github.com/horsicq/build_tools

Clone project: git clone --recursive https://github.com/horsicq/DIE-engine.git

Edit build_win32.bat ( check VSVARS_PATH, SEVENZIP_PATH, QMAKE_PATH variables)

Edit build_win64.bat ( check VSVARS_PATH, SEVENZIP_PATH, QMAKE_PATH variables)

Run build_win32.bat

Run build_win64.bat

# How to build with CMAKE

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Build

```bash
mkdir -p build
cmake . -B build
cd build
make -j4
# To use it as a command, uncomment the following line:
# sudo make install -j4
```

# How to build with MinGW/MSYS2

Install MSYS2: https://www.msys2.org/

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

### Install libaries

```bash
pacman -S mingw-w64-ucrt-x86_64-gcc
pacman -S mingw-w64-x86_64-qt5-tools
```

#### Build

```bash
chmod a+x configure
./configure
make -j4
```

# How to build with WSL

- Activate Windows Subsystem for Linux
- Download from the Microsoft Store any distribution

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

### Install libaries

```bash
sudo apt-get install --quiet --assume-yes build-essential qtbase5-dev qttools5-dev-tools qtscript5-dev libqt5svg5-dev
```

#### Build

```bash
chmod a+x build_dpkg.sh
./build_dpkg.sh
```

# How to build on Linux(Debug)

### Qt framework has to be installed on the system.

#### (Ubuntu) Install Qt Framework:

```bash
sudo apt-get install --quiet --assume-yes build-essential qt5-default qtbase5-dev qttools5-dev-tools qtscript5-dev libqt5svg5-dev
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Build

```bash
mkdir build
cd build
qmake ../die_source.pro CONFIG+=debug CONFIG-=release
make
```

# How to build on Linux(QT6/Debug)

### Qt framework has to be installed on the system.

#### (Ubuntu) Install Qt Framework:

```bash
sudo apt-get install --quiet --assume-yes build-essential qt6-base-dev qt6-base-dev-tools qt6-tools-dev-tools qt6-5compat-dev libqt6svg6-dev qt6-declarative-dev
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Build

```bash
mkdir build
cd build
qmake6 ../die_source.pro CONFIG+=debug CONFIG-=release
make
```

# How to build on Linux(QT5/AppImage)

### Qt framework has to be installed on the system.

#### (Ubuntu) Install Qt Framework:

```bash
sudo apt-get install --quiet --assume-yes build-essential qt5-default qtbase5-dev qttools5-dev-tools qtscript5-dev libqt5svg5-dev
```

#### Setup linuxdeploy ####
```bash
wget https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
chmod +x linuxdeploy-x86_64.AppImage
sudo mv linuxdeploy-x86_64.AppImage /usr/local/bin/linuxdeploy
sudo chmod +x /usr/local/bin/linuxdeploy

wget https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/continuous/linuxdeploy-plugin-qt-x86_64.AppImage
chmod +x linuxdeploy-plugin-qt-x86_64.AppImage
sudo mv linuxdeploy-plugin-qt-x86_64.AppImage /usr/local/bin/linuxdeploy-plugin-qt
```

#### Clone this repo recursively:

```bash
git clone --recursive https://github.com/horsicq/DIE-engine.git
cd DIE-engine
```

#### Build

```bash
chmod a+x configure
./configure
make
chmod a+x create_appimage.sh
./create_appimage.sh
```

================================================
FILE: docs/RUN.md
================================================
# Instructions to run Detect It Easy

### Linux Package/Build

```bash
die [FileName] or diec [FileName] or diel [FileName]
```

### Portable version on Linux

Download an appImage file https://github.com/horsicq/DIE-engine/releases/download/3.10/Detect_It_Easy-3.10-x86_64.AppImage

Make the file executable

```bash
chmod +x Detect_It_Easy-3.10-x86_64.AppImage
```

Run it

```bash
./Detect_It_Easy-3.10-x86_64.AppImage
```

### Run with Docker

Here's how to use DIE with Docker:

```bash
docker/diec.sh [FileName]
```


================================================
FILE: help/APK.md
================================================
###This is a description of the APK class.

* You could use all functions from Binary class but with APK prefix (Binary.compare -> APK.compare)

**QString getAndroidManifest()**

```
```
**QString getAndroidManifest(const QString &sRecord)**

```
```


================================================
FILE: help/Archive.md
================================================
# Archive Class Reference

The Archive class provides specialized analysis capabilities for archive file formats such as ZIP, RAR, 7-Zip, and other compressed archive types.

## Inheritance
* **Inherits from Binary class** - All Binary class functions are available with Archive prefix (e.g., `Binary.compare` → `Archive.compare`)

## Table of Contents
- [Archive Record Detection](#archive-record-detection)
- [Usage Examples](#usage-examples)

## Archive Record Detection

### isArchiveRecordPresent()
**`bool isArchiveRecordPresent(QString sArchiveRecord)`** - Check if a specific archive record or file entry is present.

**Parameters:**
* `sArchiveRecord` - The archive record/filename to search for

**Returns:** `true` if the archive record exists, `false` otherwise

This function searches for specific files or entries within the archive structure.

### isArchiveRecordPresentExp()
**`bool isArchiveRecordPresentExp(QString sArchiveRecord)`** - Check if an archive record matching a pattern is present.

**Parameters:**
* `sArchiveRecord` - Pattern or expression to match against archive records

**Returns:** `true` if a matching archive record exists, `false` otherwise

This function supports pattern matching for more flexible archive content detection.

## Usage Examples

```javascript
// Check for specific files in archive
if (Archive.isArchiveRecordPresent("setup.exe")) {
    sName = "Software installer archive";
    bDetected = true;
}

// Look for configuration files
if (Archive.isArchiveRecordPresent("config.xml") || 
    Archive.isArchiveRecordPresent("settings.ini")) {
    sOptions = "contains configuration";
}

// Pattern matching for file types
if (Archive.isArchiveRecordPresentExp("*.dll")) {
    sOptions = "contains DLL files";
} else if (Archive.isArchiveRecordPresentExp("*.exe")) {
    sOptions = "contains executables";
}

// Detect specific software packages
if (Archive.isArchiveRecordPresent("META-INF/MANIFEST.MF")) {
    sName = "Java JAR archive";
    bDetected = true;
} else if (Archive.isArchiveRecordPresent("AndroidManifest.xml")) {
    sName = "Android APK package";
    bDetected = true;
}

// Check for malware indicators
if (Archive.isArchiveRecordPresentExp("*.scr") || 
    Archive.isArchiveRecordPresentExp("*.pif")) {
    sOptions = "suspicious file types";
}
```

Archive detection can be combined with Binary class methods for comprehensive analysis:

```javascript
// Analyze archive structure and content
if (Archive.compare("'PK'0304")) {
    sName = "ZIP-based archive";
    
    // Check specific content
    if (Archive.isArchiveRecordPresent("word/document.xml")) {
        sName = "Microsoft Word document";
        sFormat = "DOCX";
    } else if (Archive.isArchiveRecordPresent("xl/workbook.xml")) {
        sName = "Microsoft Excel spreadsheet";
        sFormat = "XLSX";
    }
    
    bDetected = true;
}
```


================================================
FILE: help/Binary.js
================================================
/**
 * @class
 * @classdesc This is a description of the Binary class. This class is used when no other class matches.
 */
function Binary() {}
/**
 * Calculate the entropy of a region of the file.
 * @param {UInt} nOffset - The offset in the file.
 * @param {UInt} nSize - Number of bytes.
 * @returns {Float} Result in the form of quantity of bits per byte. Since there are 8 bits in a byte, the maximum entropy will be 8.0.
 */
Binary.calculateEntropy = function(nOffset, nSize) {}
    /**
     * Calculate the MD5 hash of a region of the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes.
     * @returns {String} MD5 hash.
     */
Binary.calculateMD5 = function(nOffset, nSize) {}
    /**
     * Compares bytes with a hexadecimal string signature.
     * <p>The signature may contain both lowercase and uppercase hexadecimal digits.
     * Spaces are skipped, and <code>.</code> and <code>?</code> represent any digit.
     * <p>Text may be matched by using single quotes. For example <samp>"01'Test'01"</samp>.
     * <p>There are two additional symbols:
     * <br><code>#</code> for absolute jump (e.g. <code>"68########55"</code>);
     * <br><code>$</code> for relative jump (e.g. <code>"E8$$$$$$$$55"</code>).
     *
     * @param {String} sSignature - The signature.
     * @param {UInt} [nOffset=0] - The offset in the file.
     * @returns {Bool}
     * @example
     * if(Binary.compare("'7z'BCAF271C")) // compare file header (nOffset=0)
     * {
     *     sVersion=Binary.readByte(6)+"."+Binary.readByte(7);
     *     bDetected=1;
     * }
     * @example
     * if(Binary.compare("'WAVEfmt '",8)) // compare file from offset 8
     * {
     *     bDetected=1;
     * }
     */
Binary.compare = function(sSignature, nOffset) {}
    /**
     * Search for a byte in the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes to search.
     * @param {UChar} cValue - The byte value.
     * @returns {Int} Offset in the file if the value is found; <code>-1</code> otherwise.
     */
Binary.findByte = function(nOffset, nSize, cValue) {}
    /**
     * Search for a word in the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes to search.
     * @param {UShort} sValue - The word value.
     * @returns {Int} Offset in the file if the value is found; <code>-1</code> otherwise.
     */
Binary.findWord = function(nOffset, nSize, sValue) {}
    /**
     * Search for a dword in the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes to search.
     * @param {UInt} nValue - The dword value.
     * @returns {Int} Offset in the file if the value is found; <code>-1</code> otherwise.
     */
Binary.findDword = function(nOffset, nSize, nValue) {}
    /**
     * Search for a string in the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes to search.
     * @param {String} sValue - The string value.
     * @returns {Int} Offset in the file if the value is found; <code>-1</code> otherwise.
     */
Binary.findString = function(nOffset, nSize, sValue) {}
    /**
     * Search for a signature (see {@link Binary.compare compare}) in the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes to search.
     * @param {String} sValue - The signature.
     * @returns {Int} Offset in the file if the signature is found; <code>-1</code> otherwise.
     */
Binary.findSignature = function(nOffset, nSize, sValue) {}
    /**
     * Get the directory of the file.
     * @returns {String}
     */
Binary.getFileDirectory = function() {}
    /**
     * Get the base name of the file.
     * @returns {String}
     */
Binary.getFileBaseName = function() {}
    /**
     * Get the complete suffix of the file.
     * @returns {String}
     */
Binary.getFileCompleteSuffix = function() {}
    /**
     * Get the suffix of the file.
     * @returns {String}
     */
Binary.getFileSuffix = function() {}
    /**
     * Get a signature string from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes.
     * @returns {String} Signature.
     * @example
     * var signature=Binary.getSignature(0,4);
     * if(signature=="AA5411DD")
     * {
     *     bDetected=1;
     * }
     */
Binary.getSignature = function(nOffset, nSize) {}
    /**
     * Get the size of the file.
     * @returns {UInt}
     */
Binary.getSize = function() {}
    /**
     * Get a text string from the file. A string is read up to the first unreadable character or up to the maximum length.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} [nSize=50] - The maximum size of the string, in bytes.
     * @returns {String}
     * @example
     * var sString=Binary.getString(0x100,32); // read a string from offset 0x100, maximum length 32 bytes
     * var sString=Binary.getString(60); // read a string from offset 60, maximum length 50 bytes (default value)
     */
Binary.getString = function(nOffset, nSize) {}
    /**
     * Check if a signature (see {@link Binary.compare compare}) exists in a region of the file.
     * @param {UInt} nOffset - The offset in the file.
     * @param {UInt} nSize - Number of bytes to check.
     * @param {String} sSignature - The signature.
     * @returns {Bool}
     */
Binary.isSignaturePresent = function(nOffset, nSize, sSignature) {}
    /**
     * Read a byte value from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UChar} The byte value.
     */
Binary.readByte = function(nOffset) {}
    /**
     * Read a dword value from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UInt} The dword value.
     */
Binary.readDword = function(nOffset) {}
    /**
     * Read a qword value from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UInt64} The qword value.
     */
Binary.readQword = function(nOffset) {}
    /**
     * Read a word from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UShort} The word value.
     */
Binary.readWord = function(nOffset) {}
    /**
     * Read a signed byte value from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UChar} The byte value.
     */
Binary.readSByte = function(nOffset) {}
    /**
     * Read a signed dword value from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UInt} The dword value.
     */
Binary.readSDword = function(nOffset) {}
    /**
     * Read a signed qword value from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UInt64} The qword value.
     */
Binary.readSQword = function(nOffset) {}
    /**
     * Read a signed word from the file.
     * @param {UInt} nOffset - The offset in the file.
     * @returns {UShort} The word value.
     */
Binary.readSWord = function(nOffset) {}
    /**
     * Swap the four bytes of a dword. For example <samp>0x11223344</samp> becomes <samp>0x44332211</samp>.
     * @param nValue {UInt} - The value.
     * @returns {Uint} The value with its bytes swapped.
     */
Binary.swapBytes = function(nValue) {}

================================================
FILE: help/Binary.md
================================================
# Binary Class Reference

The Binary class provides low-level file analysis and manipulation capabilities. This class is used when no other specialized class matches the file format.

## Table of Contents
- [File Information](#file-information)
- [Binary Comparison and Search](#binary-comparison-and-search)
- [Data Reading Methods](#data-reading-methods)
- [String Operations](#string-operations)
- [Hash and Checksum Functions](#hash-and-checksum-functions)
- [File Format Detection](#file-format-detection)
- [Utility Functions](#utility-functions)
- [Real-World Detection Examples](#real-world-detection-examples)
- [Method Shortcuts](#method-shortcuts)

## File Information

### getSize()
**`qint64 getSize()`** - Get the size of the file in bytes.

```javascript
var fileSize = Binary.getSize();
```

## Binary Comparison and Search

### compare()
**`bool compare(QString sSignature, qint64 nOffset=0)`** - Compares bytes with a hexadecimal string signature.

The signature may contain both lowercase and uppercase hexadecimal digits.
Spaces are skipped: **AA BB** = **AABB**
Text may be matched using single quotes: **"01'Test'01"**

**Special Symbols:**
* `#` - Absolute jump (e.g., "68########55")
* `$` - Relative jump (e.g., "E8$$$$$$$$55")

**Wildcard Parameters:**

| Parameter | Description                                      |
|-----------|--------------------------------------------------|
| `..`      | Represent any byte                               |
| `??`      | Represent any byte                               |
| `**`      | Not null                                         |
| `%%`      | ANSI character                                   |
| `%&`      | ANSI number                                      |
| `!%`      | Not ANSI character                               |
| `_%`      | Not ANSI and not null                            |

**Examples:**
```javascript
// Compare file header (nOffset=0)
if (Binary.compare("'7z'BCAF271C")) {
    sVersion = Binary.readByte(6) + "." + Binary.readByte(7);
    bDetected = true;
}

// Compare from specific offset
if (Binary.compare("'WAVEfmt '", 8)) {
    bDetected = true;
}

// JPEG file detection with JFIF header
if (Binary.compare("FFD8FFE0....'JFIF'00")) {
    bDetected = true;
    sVersion = Binary.readByte(11) + "." + Binary.readByte(12);
}

// SQLite database detection
if (Binary.compare("'SQLite format 3'00")) {
    sName = "SQLite 3 database";
    bDetected = true;
}

// RIFF/WAV file detection
if (Binary.compare("'RIFF'........'WAVE'")) {
    sFormat = "WAV Audio File";
    bDetected = true;
}

// Python compiled module detection
if (Binary.compare("?? 0D 0D 0A") && Binary.read_uint16(0x02) == 0x0A0D) {
    var magicValue = Binary.read_uint16(0);
    if (magicValue == 62211) {
        sVersion = "Python 3.6";
        bDetected = true;
    }
}
```

### compareEP()
**`bool compareEP(QString sSignature, qint64 nOffset=0)`** - Compare bytes at the Entry Point.

**Parameters:**
* `sSignature` - The hexadecimal signature to compare
* `nOffset` - Offset from the entry point (default: 0)

**Examples:**
```javascript
if (PE.compareEP("2C81", 8)) {
    sVersion = "1.98";
}

if (PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24")) {
    bDetected = true;
}
```

### Search Functions

#### findSignature()
**`qint64 findSignature(qint64 nOffset, qint64 nSize, QString sSignature)`** - Search for a signature in the file.

**Returns:** Offset in the file if found, `-1` otherwise.

#### findString()
**`qint64 findString(qint64 nOffset, qint64 nSize, QString sString)`** - Search for a string in the file.

**Returns:** Offset in the file if found, `-1` otherwise.

#### findByte()
**`qint64 findByte(qint64 nOffset, qint64 nSize, quint8 nValue)`** - Search for a byte value in the file.

**Returns:** Offset in the file if found, `-1` otherwise.

#### findWord()
**`qint64 findWord(qint64 nOffset, qint64 nSize, quint16 nValue)`** - Search for a 16-bit word in the file.

**Returns:** Offset in the file if found, `-1` otherwise.

#### findDword()
**`qint64 findDword(qint64 nOffset, qint64 nSize, quint32 nValue)`** - Search for a 32-bit double word in the file.

**Returns:** Offset in the file if found, `-1` otherwise.

### isSignaturePresent()
**`bool isSignaturePresent(qint64 nOffset, qint64 nSize, QString sSignature)`** - Check if a signature exists in a file region.

Uses the same signature format as [`compare()`](#compare).

## Data Reading Methods

### Basic Integer Types

#### 8-bit Values
**`quint8 readByte(qint64 nOffset)`** - Read an unsigned byte value.

**`qint8 readSByte(qint64 nOffset)`** - Read a signed byte value.

#### 16-bit Values  
**`quint16 readWord(qint64 nOffset)`** - Read an unsigned 16-bit word.

**`qint16 readSWord(qint64 nOffset)`** - Read a signed 16-bit word.

#### 32-bit Values
**`quint32 readDword(qint64 nOffset)`** - Read an unsigned 32-bit double word.

**`qint32 readSDword(qint64 nOffset)`** - Read a signed 32-bit double word.

#### 64-bit Values
**`quint64 readQword(qint64 nOffset)`** - Read an unsigned 64-bit quad word.

**`qint64 readSQword(qint64 nOffset)`** - Read a signed 64-bit quad word.

### Enhanced Reading Methods

#### Integer Types with Endianness Support
**`quint8 read_uint8(qint64 nOffset)`** - Read unsigned 8-bit integer.

**`qint8 read_int8(qint64 nOffset)`** - Read signed 8-bit integer.

**`quint16 read_uint16(qint64 nOffset, bool bIsBigEndian=false)`** - Read unsigned 16-bit integer.

**`qint16 read_int16(qint64 nOffset, bool bIsBigEndian=false)`** - Read signed 16-bit integer.

**`quint32 read_uint24(qint64 nOffset, bool bIsBigEndian=false)`** - Read unsigned 24-bit integer.

**`qint32 read_int24(qint64 nOffset, bool bIsBigEndian=false)`** - Read signed 24-bit integer.

**`quint32 read_uint32(qint64 nOffset, bool bIsBigEndian=false)`** - Read unsigned 32-bit integer.

**`qint32 read_int32(qint64 nOffset, bool bIsBigEndian=false)`** - Read signed 32-bit integer.

**`quint64 read_uint64(qint64 nOffset, bool bIsBigEndian=false)`** - Read unsigned 64-bit integer.

**`qint64 read_int64(qint64 nOffset, bool bIsBigEndian=false)`** - Read signed 64-bit integer.

#### Floating Point Types
**`float read_float(qint64 nOffset, bool bIsBigEndian=false)`** - Read 32-bit float.

**`double read_double(qint64 nOffset, bool bIsBigEndian=false)`** - Read 64-bit double.

**`float read_float16(qint64 nOffset, bool bIsBigEndian=false)`** - Read 16-bit half precision float.

**`float read_float32(qint64 nOffset, bool bIsBigEndian=false)`** - Read 32-bit single precision float.

**`double read_float64(qint64 nOffset, bool bIsBigEndian=false)`** - Read 64-bit double precision float.

#### Binary Coded Decimal (BCD)
**`quint8 read_bcd_uint8(qint64 nOffset)`** - Read 8-bit BCD value.

**`quint16 read_bcd_uint16(qint64 nOffset, bool bIsBigEndian=false)`** - Read 16-bit BCD value.

**`quint32 read_bcd_uint32(qint64 nOffset, bool bIsBigEndian=false)`** - Read 32-bit BCD value.

**`quint64 read_bcd_uint64(qint64 nOffset, bool bIsBigEndian=false)`** - Read 64-bit BCD value.

#### Special Data Types
**`QString read_UUID_bytes(qint64 nOffset)`** - Read UUID as raw bytes.

**`QString read_UUID(qint64 nOffset, bool bIsBigEndian=false)`** - Read formatted UUID.

**`QList<QVariant> readBytes(qint64 nOffset, qint64 nSize, bool bReplaceZeroWithSpace=false)`** - Read raw bytes as array.

## String Operations

### Basic String Reading
**`QString getString(qint64 nOffset, qint64 nMaxSize=50)`** - Read a null-terminated string.

**Parameters:**
* `nOffset` - File offset to read from
* `nMaxSize` - Maximum string length in bytes (default: 50)

**Example:**
```javascript
var sString = Binary.getString(0x100, 32);  // Read max 32 bytes from offset 0x100
var sString = Binary.getString(60);         // Read max 50 bytes from offset 60

// Detect UTF-8 BOM in text files
var sText = Binary.getString(0, Math.min(Binary.getSize(), 3));
if (/^\xef\xbb\xbf/.test(sText)) {
    sName = "UTF-8 text with BOM";
}

// Check line ending types
var size = Binary.getSize() < 4096 ? Binary.getSize() : 4096;
var pos = Binary.findByte(0, size, 10); // Look for LF (0x0A)
if (pos !== -1) {
    // Check if CRLF or just LF
    var hasCR = (pos != 0 && Binary.readByte(pos - 1) == 13) || 
                (pos + 1 < Binary.getSize() && Binary.readByte(pos + 1) == 13);
    sLineEnding = hasCR ? "CRLF" : "LF";
} else if (Binary.findByte(0, size, 13) != -1) {
    sLineEnding = "CR"; // Mac classic
}
```

### Encoding-Specific String Reading
**`QString read_ansiString(qint64 nOffset, qint64 nMaxSize=50)`** - Read ANSI encoded string.

**`QString read_unicodeString(qint64 nOffset, qint64 nMaxSize=50)`** - Read Unicode (UTF-16) string.

**`QString read_utf8String(qint64 nOffset, qint64 nMaxSize=50)`** - Read UTF-8 encoded string.

**`QString read_ucsdString(qint64 nOffset)`** - Read UCSD Pascal-style string (length-prefixed).

### Advanced String Reading
**`QString read_codePageString(qint64 nOffset, qint64 nMaxByteSize=256, QString sCodePage="System")`** - Read string with specific code page encoding.

**Supported Code Pages:**
```
System, ISO-8859-1, ISO-8859-2, ISO-8859-3, ISO-8859-4, ISO-8859-5,
ISO-8859-7, ISO-8859-9, ISO-8859-10, ISO-8859-13, ISO-8859-14,
ISO-8859-15, ISO-8859-16, ISO-8859-6, ISO-8859-8, Shift_JIS, EUC-JP,
EUC-KR, ISO-2022-JP, UTF-8, UTF-16BE, UTF-16LE, UTF-16, UTF-32,
UTF-32BE, UTF-32LE, GBK, GB18030, GB2312, Big5, Big5-HKSCS,
windows-1250 through windows-1258, KOI8-R, KOI8-U, IBM850, IBM866,
IBM874, TIS-620, macintosh, hp-roman8, TSCII, WINSAMI2, windows-949,
iscii-dev, iscii-bng, iscii-pnj, iscii-gjr, iscii-ori, iscii-tml,
iscii-tlg, iscii-knd, iscii-mlm
```

### String Search Functions
**`qint64 find_ansiString(qint64 nOffset, qint64 nSize, QString sString)`** - Search for ANSI string.

**`qint64 find_unicodeString(qint64 nOffset, qint64 nSize, QString sString)`** - Search for Unicode string.

**`qint64 find_utf8String(qint64 nOffset, qint64 nSize, QString sString)`** - Search for UTF-8 string.

### String Utility Functions
**`QString upperCase(QString sString)`** - Convert string to uppercase.

**`QString lowerCase(QString sString)`** - Convert string to lowercase.

**`QString cleanString(QString sString)`** - Clean and normalize string content.

## Hash and Checksum Functions

### CRC Functions
**`QString calculateCRC32(qint64 nOffset, qint64 nSize)`** - Calculate CRC32 hash as hex string.

**`quint16 crc16(qint64 nOffset, qint64 nSize, quint16 nInit=0)`** - Calculate CRC16 checksum.

**`quint32 crc32(qint64 nOffset, qint64 nSize, quint32 nInit=0)`** - Calculate CRC32 checksum.

### Cryptographic Hashes
**`QString calculateMD5(qint64 nOffset, qint64 nSize)`** - Calculate MD5 hash of file region.

### Other Checksums
**`quint32 adler32(qint64 nOffset, qint64 nSize)`** - Calculate Adler-32 checksum.

**`double calculateEntropy(qint64 nOffset, qint64 nSize)`** - Calculate entropy (bits per byte, max 8.0).

## File Format Detection

### Text Format Detection
**`bool isPlainText()`** - Check if file contains plain text.

**`bool isUTF8Text()`** - Check if file contains UTF-8 encoded text.

**`bool isUnicodeText()`** - Check if file contains Unicode text.

**`bool isText()`** - Check if file contains any text format.

**Example:**
```javascript
if (Binary.isPlainText()) {
    sName = "Plain text file";
    
    // Check for specific encodings
    if (Binary.isUTF8Text()) {
        sOptions = "UTF-8";
    } else if (Binary.isUnicodeText()) {
        sOptions = "Unicode";
    }
    
    bDetected = true;
}
```

### JPEG Detection and Analysis
**`bool isJpeg()`** - Check if file is JPEG format.

**`QString getJpegComment()`** - Extract JPEG comment field.

**`QString getJpegDqtMD5()`** - Get MD5 hash of JPEG quantization tables.

**`bool isJpegChunkPresent(qint32 nID)`** - Check for specific JPEG chunk.

**`bool isJpegExifPresent()`** - Check if JPEG contains EXIF data.

**`QString getJpegExifCameraName()`** - Extract camera name from EXIF data.

**Example:**
```javascript
if (Binary.isJpeg()) {
    sName = "JPEG image";
    
    // Extract comment if present
    var comment = Binary.getJpegComment();
    if (comment.length > 0) {
        sOptions = "comment: " + comment;
    }
    
    // Check for EXIF data
    if (Binary.isJpegExifPresent()) {
        var cameraName = Binary.getJpegExifCameraName();
        if (cameraName.length > 0) {
            sOptions += ", camera: " + cameraName;
        }
    }
    
    // Get quantization table hash for identification
    var dqtHash = Binary.getJpegDqtMD5();
    if (dqtHash.length > 0) {
        sOptions += ", DQT hash: " + dqtHash.substring(0, 8);
    }
    
    bDetected = true;
}
```

### Compression Detection
**`qint64 detectZLIB(qint64 nOffset, qint64 nSize)`** - Detect ZLIB compressed data.

**`qint64 detectGZIP(qint64 nOffset, qint64 nSize)`** - Detect GZIP compressed data.

**`qint64 detectZIP(qint64 nOffset, qint64 nSize)`** - Detect ZIP compressed data.

### Compression Support
**`QList<QString> getListOfCompressionMethods()`** - Get available compression methods.

**`QList<QVariant> decompressBytes(qint64 nOffset, qint64 nSize, QString sCompressionMethod)`** - Decompress data.

**`qint64 getCompressedDataSize(qint64 nOffset, qint64 nSize, QString sCompressionMethod)`** - Get compressed data size.

## Utility Functions

### File Path Operations
**`QString getFileDirectory()`** - Get directory containing the file.

**`QString getFileBaseName()`** - Get base filename without path or extension.

**`QString getFileCompleteSuffix()`** - Get complete file extension.

**`QString getFileSuffix()`** - Get primary file extension.

### Memory and Address Operations
**`qint64 RVAToOffset(qint64 nRVA)`** - Convert Relative Virtual Address to file offset.

**`qint64 VAToOffset(qint64 nVA)`** - Convert Virtual Address to file offset.

**`qint64 OffsetToVA(qint64 nOffset)`** - Convert file offset to Virtual Address.

**`qint64 OffsetToRVA(qint64 nOffset)`** - Convert file offset to Relative Virtual Address.

**`qint64 getImageBase()`** - Get image base address.

### Entry Point and Overlay Operations
**`qint64 getEntryPointOffset()`** - Get entry point file offset.

**`qint64 getAddressOfEntryPoint()`** - Get entry point virtual address.

**`qint64 getOverlayOffset()`** - Get overlay data offset.

**`qint64 getOverlaySize()`** - Get overlay data size.

**`bool isOverlayPresent()`** - Check if file has overlay data.

**`bool compareOverlay(QString sSignature, qint64 nOffset=0)`** - Compare overlay data signature.

### Data Conversion
**`quint32 swapBytes(quint32 nValue)`** - Swap byte order of 32-bit value.

Example: `0x11223344` becomes `0x44332211`

**`QString bytesCountToString(quint64 nValue, quint32 nBase=1024)`** - Convert byte count to human readable string.

**`QString getSignature(qint64 nOffset, qint64 nSize)`** - Get hex signature from file region.

**Example:**
```javascript
if (Binary.getSignature(0, 4) == "AA5411DD") {
    bDetected = true;
}

// SQLite version detection from header
var nSQLiteVersionNumber = Binary.read_uint32(0x60, true); // Big-endian
var nMajor = Math.floor(nSQLiteVersionNumber / 1000000);
var nMinor = Math.floor((nSQLiteVersionNumber - nMajor * 1000000) / 1000);
var nRelease = nSQLiteVersionNumber - (nMajor * 1000000) - (nMinor * 1000);
sVersion = nMajor + "." + nMinor + "." + nRelease;

// Extract JPEG dimensions and version
if (Binary.compare("FFD8FFE0....'JFIF'00")) {
    sVersion = Binary.readByte(11) + "." + Binary.readByte(12);
    
    // Search for Start Of Frame to get dimensions
    var nOffset = 2;
    while (nOffset < Binary.getSize()) {
        var wTag = Binary.read_uint16(nOffset, true); // Big-endian
        if (wTag >= 0xFFC0 && wTag <= 0xFFC3) {
            var width = Binary.read_uint16(nOffset + 7, true);
            var height = Binary.read_uint16(nOffset + 5, true);
            sOptions = width + "x" + height;
            break;
        }
        nOffset += 2;
    }
}
```

### Architecture and Build Detection
**`bool is16()`** - Check if file is 16-bit architecture.

**`bool is32()`** - Check if file is 32-bit architecture.

**`bool is64()`** - Check if file is 64-bit architecture.

**`bool isReleaseBuild()`** - Check if file is a release build.

**`bool isDebugBuild()`** - Check if file is a debug build.

### File Properties and Validation
**`bool isSigned()`** - Check if file is digitally signed.

**`bool isOverlay()`** - Check if current context is overlay data.

**`bool isResource()`** - Check if current context is resource data.

**`bool isDebugData()`** - Check if current context is debug data.

**`bool isFilePart()`** - Check if current context is part of a file.

### Validation Functions
**`bool isChecksumCorrect()`** - Verify file checksum.

**`bool isEntryPointCorrect()`** - Verify entry point validity.

**`bool isSectionAlignmentCorrect()`** - Verify section alignment.

**`bool isFileAlignmentCorrect()`** - Verify file alignment.

**`bool isHeaderCorrect()`** - Verify file header.

**`bool isRelocsTableCorrect()`** - Verify relocations table.

**`bool isImportTableCorrect()`** - Verify import table.

**`bool isExportTableCorrect()`** - Verify export table.

**`bool isResourcesTableCorrect()`** - Verify resources table.

**`bool isSectionsTableCorrect()`** - Verify sections table.

### Scan Mode Detection
**`bool isDeepScan()`** - Check if deep scan mode is enabled.

**`bool isHeuristicScan()`** - Check if heuristic scan mode is enabled.

**`bool isRecursiveScan()`** - Check if recursive scan mode is enabled.

**`bool isAggressiveScan()`** - Check if aggressive scan mode is enabled.

**`bool isVerbose()`** - Check if verbose mode is enabled.

### Performance and Debugging
**`bool isProfiling()`** - Check if profiling mode is enabled.

**`qint64 startTiming()`** - Start performance timing.

**`qint64 endTiming(qint64 nHandle, const QString &sInfo)`** - End performance timing.

**`qint64 getStartOffset()`** - Get physical offset in file.

**Example:**
```javascript
// Profiling flag should be set
var nProfiling = Binary.startTiming();
// ... slow code execution ...
var nTime = Binary.endTiming(nProfiling, "PROFILING");
```

### Disassembly Functions
**`qint32 getDisasmLength(qint64 nAddress)`** - Get length of instruction at address.

**`QString getDisasmString(qint64 nAddress)`** - Get disassembly string for instruction.

**`qint64 getDisasmNextAddress(qint64 nAddress)`** - Get address of next instruction.

### System Information
**`QString getOperationSystemName()`** - Get operating system name.

**`QString getOperationSystemVersion()`** - Get operating system version.

**`QString getOperationSystemOptions()`** - Get operating system options.

**`QString getFileFormatName()`** - Get file format name.

**`QString getFileFormatVersion()`** - Get file format version.

**`QString getFileFormatOptions()`** - Get file format options.

### Message and Header Information
**`QList<QString> getFormatMessages()`** - Get format-specific messages.

**`QString getHeaderString()`** - Get header information as string.

### Section-based Operations
**`bool isSignatureInSectionPresent(quint32 nNumber, QString sSignature)`** - Check signature in specific section.

## Real-World Detection Examples

This section contains practical examples from the DIE signature database showing how to use Binary class methods for file format detection.

### Archive Formats

#### ZIP Archive Detection
```javascript
// Basic ZIP detection
if (Binary.compare("'PK'0304") || Binary.compare("'PK'0506") || Binary.compare("'PK'0708")) {
    sName = "ZIP archive";
    bDetected = true;
}

// Enhanced ZIP detection with central directory
if (Binary.compare("'PK'0102")) {
    sName = "ZIP archive (central directory)";
    bDetected = true;
}
```

#### 7-Zip Archive Detection
```javascript
if (Binary.compare("'7z'BCAF271C")) {
    sName = "7-Zip archive";
    sVersion = Binary.readByte(6) + "." + Binary.readByte(7);
    bDetected = true;
}
```

#### RAR Archive Detection
```javascript
if (Binary.compare("'Rar!'1A0700")) {
    sName = "RAR archive";
    sVersion = "1.5-4.x";
    bDetected = true;
} else if (Binary.compare("'Rar!'1A070100")) {
    sName = "RAR archive";
    sVersion = "5.0+";
    bDetected = true;
}
```

### Image Formats

#### JPEG Image Detection
```javascript
if (Binary.compare("FFD8FFE0....'JFIF'00")) {
    sName = "JPEG image";
    bDetected = true;
    
    // Extract version
    sVersion = Binary.readByte(11) + ".";
    if (Binary.readByte(12) < 10) {
        sVersion += "0";
    }
    sVersion += Binary.readByte(12);
    
    // Find dimensions in Start of Frame marker
    var nOffset = 2;
    while (nOffset < Binary.getSize()) {
        var wTag = Binary.read_uint16(nOffset, true);
        if (wTag >= 0xFFC0 && wTag <= 0xFFC3) {
            var width = Binary.read_uint16(nOffset + 7, true);
            var height = Binary.read_uint16(nOffset + 5, true);
            sOptions = width + "x" + height;
            
            // Detect color space
            switch (Binary.readByte(nOffset + 9)) {
                case 1: sOptions += ", greyscale"; break;
                case 3: sOptions += ", YCbCr"; break;
                case 4: sOptions += ", CMYK"; break;
            }
            break;
        }
        var nLength = Binary.read_uint16(nOffset + 2, true);
        nOffset += nLength + 2;
    }
}
```

#### PNG Image Detection
```javascript
if (Binary.compare("89'PNG'0D0A1A0A")) {
    sName = "PNG image";
    bDetected = true;
    
    // Extract dimensions from IHDR chunk
    if (Binary.compare("'IHDR'", 12)) {
        var width = Binary.read_uint32(16, true);
        var height = Binary.read_uint32(20, true);
        var bitDepth = Binary.readByte(24);
        var colorType = Binary.readByte(25);
        
        sOptions = width + "x" + height + ", " + bitDepth + " bit";
        
        switch (colorType) {
            case 0: sOptions += ", grayscale"; break;
            case 2: sOptions += ", RGB"; break;
            case 3: sOptions += ", palette"; break;
            case 4: sOptions += ", grayscale+alpha"; break;
            case 6: sOptions += ", RGBA"; break;
        }
    }
}
```

### Audio Formats

#### WAV Audio Detection
```javascript
if (Binary.compare("'RIFF'........'WAVE'")) {
    sName = "WAV Audio File";
    bDetected = true;
    
    // Parse chunks to extract format information
    var nOffset = 12;
    while (nOffset < Binary.getSize() - 8) {
        var chunkId = Binary.getString(nOffset, 4);
        var chunkSize = Binary.read_uint32(nOffset + 4, false); // Little-endian
        
        if (chunkId == "fmt ") {
            var audioFormat = Binary.read_uint16(nOffset + 8, false);
            var numChannels = Binary.read_uint16(nOffset + 10, false);
            var sampleRate = Binary.read_uint32(nOffset + 12, false);
            var bitsPerSample = Binary.read_uint16(nOffset + 22, false);
            
            sOptions = sampleRate + " Hz, " + numChannels + " channel";
            if (numChannels > 1) sOptions += "s";
            sOptions += ", " + bitsPerSample + " bit";
            
            switch (audioFormat) {
                case 1: sOptions += ", PCM"; break;
                case 3: sOptions += ", IEEE float"; break;
                case 6: sOptions += ", A-law"; break;
                case 7: sOptions += ", μ-law"; break;
            }
            break;
        }
        
        nOffset += 8 + chunkSize;
        if (chunkSize % 2) nOffset++; // Pad to even boundary
    }
}
```

### Database Formats

#### SQLite Database Detection
```javascript
if (Binary.compare("'SQLite format 3'00")) {
    sName = "SQLite 3 database";
    bDetected = true;
    
    // Extract version information
    var nSQLiteVersionNumber = Binary.read_uint32(0x60, true);
    var nMajor = Math.floor(nSQLiteVersionNumber / 1000000);
    var nMinor = Math.floor((nSQLiteVersionNumber - nMajor * 1000000) / 1000);
    var nRelease = nSQLiteVersionNumber - (nMajor * 1000000) - (nMinor * 1000);
    sVersion = nMajor + "." + nMinor + "." + nRelease;
    
    // Check text encoding
    switch (Binary.read_uint32(0x38, true)) {
        case 1: sOptions = "UTF-8"; break;
        case 2: sOptions = "UTF-16LE"; break;
        case 3: sOptions = "UTF-16BE"; break;
    }
    
    // Application ID (if present)
    var nAppID = Binary.read_uint32(0x44, true);
    if (nAppID && Binary.isVerbose()) {
        sOptions += ", AppID:" + nAppID.toString(16);
    }
}
```

### Programming Languages

#### Python Compiled Module Detection
```javascript
if (Binary.compare("?? 0D 0D 0A") && Binary.read_uint16(0x02) == 0x0A0D) {
    sName = "Python compiled module";
    bDetected = true;
    
    var magicValue = Binary.read_uint16(0);
    switch (magicValue) {
        case 20121: sVersion = "1.5-1.5.2"; break;
        case 50428: sVersion = "1.6"; break;
        case 50823: sVersion = "2.0-2.0.1"; break;
        case 60202: sVersion = "2.1-2.1.2"; break;
        case 62211: sVersion = "3.6"; break;
        case 62061: sVersion = "2.4b1"; break;
        case 3394: sVersion = "3.8"; break;
        case 3413: sVersion = "3.9"; break;
        case 3439: sVersion = "3.10"; break;
        case 3495: sVersion = "3.11"; break;
        case 3531: sVersion = "3.12"; break;
        // Add more versions as needed
    }
    
    // Extract timestamp (compilation time)
    var timestamp = Binary.read_uint32(4, false);
    if (timestamp > 0) {
        var date = new Date(timestamp * 1000);
        sOptions = "compiled " + date.toISOString().split('T')[0];
    }
}
```

### Text Format Detection

#### Plain Text with Encoding Detection
```javascript
if (Binary.isPlainText()) {
    sName = "Plain text";
    bDetected = true;
    
    var sText = Binary.getString(0, Math.min(Binary.getSize(), 3));
    
    // Check for UTF-8 BOM
    if (Binary.compare("EFBBBF")) {
        sName = "UTF-8 text";
        sOptions = "BOM";
    }
    // Check for UTF-16 BOM
    else if (Binary.compare("FFFE")) {
        sName = "UTF-16LE text";
        sOptions = "BOM";
    }
    else if (Binary.compare("FEFF")) {
        sName = "UTF-16BE text";
        sOptions = "BOM";
    }
    
    // Detect line endings
    var size = Math.min(Binary.getSize(), 4096);
    var lfPos = Binary.findByte(0, size, 10);  // LF
    var crPos = Binary.findByte(0, size, 13);  // CR
    
    if (lfPos !== -1 && crPos !== -1) {
        sOptions = sOptions ? sOptions + ", CRLF" : "CRLF";
    } else if (lfPos !== -1) {
        sOptions = sOptions ? sOptions + ", LF" : "LF";
    } else if (crPos !== -1) {
        sOptions = sOptions ? sOptions + ", CR" : "CR";
    }
}
```

### Compression Detection

#### ZLIB Data Detection
```javascript
// ZLIB header detection
var firstByte = Binary.readByte(0);
var secondByte = Binary.readByte(1);

if ((firstByte & 0x0F) == 8 && (firstByte >> 4) <= 7) {
    if (((firstByte << 8) | secondByte) % 31 == 0) {
        sName = "ZLIB compressed data";
        bDetected = true;
        
        var compressionLevel = (secondByte >> 6) & 3;
        var windowSize = 1 << ((firstByte >> 4) + 8);
        
        sOptions = "level " + compressionLevel + ", " + windowSize + " byte window";
        
        if (secondByte & 0x20) {
            sOptions += ", dictionary";
        }
    }
}
```

### Executable Format Detection

#### Shellcode Detection
```javascript
// Detect common shellcode patterns
var shellcodePatterns = [
    "EB??5?5?", // JMP short, PUSH/POP pattern
    "E8????????", // CALL instruction
    "83C4??", // ADD ESP, immediate
    "FF??", // Various FF opcodes
];

var bShellcodeDetected = false;
var patternCount = 0;

for (var i = 0; i < shellcodePatterns.length; i++) {
    if (Binary.isSignaturePresent(0, Math.min(256, Binary.getSize()), shellcodePatterns[i])) {
        patternCount++;
    }
}

if (patternCount >= 2) {
    sName = "Possible shellcode";
    sOptions = "pattern count: " + patternCount;
    bDetected = true;
}
```

## Method Shortcuts

For convenience, shorter method names are available:

### Data Type Shortcuts
- `X.U8(a)` = `File.read_uint8(a)`
- `X.I8(a)` = `File.read_int8(a)`
- `X.U16(a, b)` = `File.read_uint16(a, b)`
- `X.I16(a, b)` = `File.read_int16(a, b)`
- `X.F16(a, b)` = `File.read_float16(a, b)`
- `X.U24(a, b)` = `File.read_uint24(a, b)`
- `X.I24(a, b)` = `File.read_int24(a, b)`
- `X.U32(a, b)` = `File.read_uint32(a, b)`
- `X.I32(a, b)` = `File.read_int32(a, b)`
- `X.F32(a, b)` = `File.read_float32(a, b)`
- `X.U64(a, b)` = `File.read_uint64(a, b)`
- `X.I64(a, b)` = `File.read_int64(a, b)`
- `X.F64(a, b)` = `File.read_float64(a, b)`

### String Shortcuts
- `X.SA(a, b)` = `File.read_ansiString(a, b)`
- `X.SC(a, b, c)` = `File.read_codePageString(a, b, c)`
- `X.UСSD(a, b)` = `File.read_ucsdString(a, b)`
- `X.SU8(a, b, c)` = `File.read_utf8String(a, b, c)`
- `X.SU16(a, b, c)` = `File.read_unicodeString(a, b, c)`

### Utility Shortcuts
- `X.Sz()` = `File.getSize()`
- `X.fSig(a, b, c)` = `File.findSignature(a, b, c)`
- `X.fStr(a, b, c)` = `File.findString(a, b, c)`
- `X.c(a, b)` = `File.compare(a, b)`
- `X.BA(a, b, c)` = `File.readBytes(a, b, c)`


================================================
FILE: help/COM.md
================================================
# COM (MS-DOS COM Executable) Class Reference

The COM class provides analysis capabilities for MS-DOS COM (Command) executable files, which are simple binary executables that load at a fixed memory address.

## Inheritance
* **Inherits from Binary class** - All Binary class functions are available with COM prefix (e.g., `Binary.compareEP` → `COM.compareEP`)

## Overview

COM files are the simplest form of executable files in MS-DOS. They:
- Have no header structure
- Load at memory address 0x0100 
- Are limited to 64KB in size
- Execute directly from the first byte

## Detection

COM files are typically detected by:
1. File extension (.COM)
2. File size (≤ 65,280 bytes)
3. Executable code patterns at the beginning
4. Absence of other executable headers (PE, NE, etc.)

## Usage Examples

```javascript
// Basic COM file detection
if (Binary.getSize() <= 65280 && Binary.getSize() > 0) {
    // Check for common COM file patterns
    if (COM.compare("E9") ||           // JMP near
        COM.compare("EB") ||           // JMP short  
        COM.compare("B4") ||           // MOV AH, immediate
        COM.compare("CD21")) {         // INT 21h
        sName = "MS-DOS COM executable";
        bDetected = true;
    }
}

// Check for specific COM program signatures
if (COM.compare("E9....")) {
    // Jump instruction at start
    sOptions = "JMP start";
} else if (COM.compare("B409CD21")) {
    // Print string DOS call
    sOptions = "DOS text output";
}
```

Since COM files inherit all Binary class functionality, you can use advanced analysis methods:

```javascript
// Analyze entropy to detect packed COM files
var entropy = COM.calculateEntropy(0, COM.getSize());
if (entropy > 7.5) {
    sOptions = "possibly packed";
}

// Search for DOS API calls
if (COM.findSignature(0, COM.getSize(), "CD21") != -1) {
    sOptions = "uses DOS API";
}
```


================================================
FILE: help/DEX.md
================================================
###This is a description of the DEX class.

* You could use all functions from Binary class but with DEX prefix (Binary.compare -> DEX.compare)

**bool isStringPoolSorted()**

```
```
**bool isOverlayPresent()**

```
```
**bool isDexStringPresent(QString sString)**

```
```
**bool isDexItemStringPresent(QString sItemString)**

```
```


================================================
FILE: help/ELF.js
================================================
/**
 * @class
 * @classdesc This is a description of the ELF class.
 */
function ELF() {}
/**
 * @see Binary.calculateEntropy
 */
ELF.calculateEntropy = function(nOffset, nSize) {}
    /**
     * @see Binary.calculateMD5
     */
ELF.calculateMD5 = function(nOffset, nSize) {}
    /**
     * @see Binary.compare
     */
ELF.compare = function(sSignature, nOffset) {}
    /**
     * @see PE.compareEP
     */
ELF.compareEP = function(sSignature, nOffset) {}
    /**
     * @see Binary.findByte
     */
ELF.findByte = function(nOffset, nSize, cValue) {}
    /**
     * @see Binary.findDword
     */
ELF.findDword = function(nOffset, nSize, nValue) {}
    /**
     * @see Binary.findSignature
     */
ELF.findSignature = function(nOffset, nSize, sSignature) {}
    /**
     * @see Binary.findString
     */
ELF.findString = function(nOffset, nSize, sValue) {}
    /**
     * @see Binary.findWord
     */
ELF.findWord = function(nOffset, nSize, sValue) {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_ehsize = function() {}
    /**
     * @returns {UInt}
     */
ELF.getElfHeader_entry = function() {}
    /**
     * @returns {UInt64}
     */
ELF.getElfHeader_entry64 = function() {}
    /**
     * @returns {UInt}
     */
ELF.getElfHeader_flags = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_machine = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_phentsize = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_phnum = function() {}
    /**
     * @returns {UInt}
     */
ELF.getElfHeader_phoff = function() {}
    /**
     * @returns {UInt64}
     */
ELF.getElfHeader_phoff64 = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_shentsize = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_shnum = function() {}
    /**
     * @returns {UInt}
     */
ELF.getElfHeader_shoff = function() {}
    /**
     * @returns {UInt64}
     */
ELF.getElfHeader_shoff64 = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_shstrndx = function() {}
    /**
     * @returns {UShort}
     */
ELF.getElfHeader_type = function() {}
    /**
     * @returns {UInt}
     */
ELF.getElfHeader_version = function() {}
    /**
     * @see Binary.getFileDirectory
     */
ELF.getFileDirectory = function() {}
    /**
     * @see Binary.getFileBaseName
     */
ELF.getFileBaseName = function() {}
    /**
     * @see Binary.getFileSuffix
     */
ELF.getFileSuffix = function() {}
    /**
     * @see Binary.getFileCompleteSuffix
     */
ELF.getFileCompleteSuffix = function() {}
    /**
     * Get a string in the form of <code>"<i>ELFtype</i> <i>ELFmode</i>"</code>. For example <code>"executable x86"</code> or <code>"shared object amd64"</code>.
     * @returns {String}
     */
ELF.getGeneralOptions = function() {}
    /**
     * @see Binary.getSignature
     */
ELF.getSignature = function(nOffset, nSize) {}
    /**
     * @see Binary.getSize
     */
ELF.getSize = function() {}
    /**
     * Check if a section exists with a specific name or matches a regular expression.
     * @param {String} sSectionName - Section name or pattern.
     * @returns {Bool}
     */
ELF.isSectionNamePresent = function(sSectionName) {}
    /**
     * @see Binary.isSignaturePresent
     */
ELF.isSignaturePresent = function(nOffset, nSize, sSignature) {}
    /**
     * Check if a string exists in the table.
     * @param {String} sSectionName - Section name.
     * @param {String} sString - String.
     * @returns {Bool}
     */
ELF.isStringInTablePresent = function(sSectionName, sString) {}
    /**
     * @see Binary.readByte
     */
ELF.readByte = function(nOffset) {}
    /**
     * @see Binary.readDword
     */
ELF.readDword = function(nOffset) {}
    /**
     * @see Binary.readQword
     */
ELF.readQword = function(nOffset) {}
    /**
     * @see Binary.readWord
     */
ELF.readWord = function(nOffset) {}
    /**
     * @see Binary.readSByte
     */
ELF.readSByte = function(nOffset) {}
    /**
     * @see Binary.readSDword
     */
ELF.readSDword = function(nOffset) {}
    /**
     * @see Binary.readSQword
     */
ELF.readSQword = function(nOffset) {}
    /**
     * @see Binary.readSWord
     */
ELF.readSWord = function(nOffset) {}
    /**
     * @see Binary.swapBytes
     */
ELF.swapBytes = function(nValue) {}
    /**
     * @see Binary.getString
     */
ELF.getString = function(nOffset, nSize) {}
    /**
     * Get the file offset of a section.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
ELF.getSectionFileOffset = function(nSection) {}
    /**
     * Get the file size of a section.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
ELF.getSectionFileSize = function(nSection) {}
    /**
     * Get the number of a section with a specific name.
     * @param {String} sSectionName - Section name.
     * @returns {Int} 0-based section number, or <code>-1</code> if there is no section with that name.
     */
ELF.getSectionNumber = function(sSectionName) {}
    /**
     * Check if the file is 64 bit (ELF64).
     * @returns {Bool}
     * @example
     * if(ELF.is64())
     * {
     *     sOptions="ELF64";
     * }
     */
ELF.is64 = function() {}
    /**
     * Convert a relative virtual address (RVA) to a file offset.
     * @param {UInt64} nRVA
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
ELF.RVAToOffset = function(nRVA) {}
    /**
     * Convert a virtual address (VA) to a file offset.
     * @param {UInt64} nVA
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
ELF.VAToOffset = function(nVA) {}
    /**
     * Convert a file offset to a relative virtual address (RVA).
     * @param {UInt64} nOffset
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
ELF.OffsetToRVA = function(nOffset) {}
    /**
     * Convert a file offset to a virtual address (VA).
     * @param {UInt64} nOffset
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
ELF.OffsetToVA = function(nOffset) {}
    /**
     * Get the number of sections.
     * @returns {Int}
     */
MACH.getNumberOfSections = function() {}
    /**
     * Get the number of programs in the program header table(pht).
     * @returns {Int}
     */
MACH.getNumberOfPrograms = function() {}
    /**
     * Get the file offset of a program.
     * @param {Int} nProgram - Program number.
     * @returns {UInt}
     */
ELF.getProgramFileOffset = function(nProgram) {}
    /**
     * Get the file size of a program.
     * @param {Int} nProgram - Program number.
     * @returns {UInt}
     */
ELF.getProgramFileSize = function(nProgram) {}
    /**
     * Get the size of the overlay.
     * @returns {Int}
     */
ELF.getOverlaySize = function() {}
    /**
     * Get the file offset of the overlay.
     * @returns {Int}
     */
ELF.getOverlayOffset = function() {}
    /**
     * Check if an overlay is present.
     * @returns {Bool}
     */
ELF.isOverlayPresent = function() {}
    /**
     * @see PE.compareOverlay
     */
ELF.compareOverlay = function(sSignature, nOffset) {}
    /**
     * Get the offset of the entry point.
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
ELF.getEntryPointOffset = function() {}

================================================
FILE: help/ELF.md
================================================
# ELF (Executable and Linkable Format) Class Reference

The ELF class provides specialized analysis capabilities for Unix/Linux ELF files, including executables, shared libraries, and object files.

## Inheritance
* **Inherits from Binary class** - All Binary class functions are available with ELF prefix (e.g., `Binary.compareEP` → `ELF.compareEP`)

## Table of Contents
- [Section Management](#section-management)
- [Program Header Operations](#program-header-operations)
- [ELF Header Information](#elf-header-information)
- [String and Symbol Tables](#string-and-symbol-tables)
- [Library Dependencies](#library-dependencies)
- [General Properties](#general-properties)

## Section Management

### isSectionNamePresent()
**`bool isSectionNamePresent(QString sSectionName)`** - Check if a specific section exists in the ELF file.

**Parameters:**
* `sSectionName` - Name of the section to search for

**Returns:** `true` if section exists, `false` otherwise

**Examples:**
```javascript
if (ELF.isSectionNamePresent(".text")) {
    _log("Code section found");
}

if (ELF.isSectionNamePresent(".debug_info")) {
    sOptions += "debug symbols";
}
```

### getNumberOfSections()
**`quint32 getNumberOfSections()`** - Get the total number of sections in the ELF file.

**Returns:** Number of sections

### getSectionNumber()
**`qint32 getSectionNumber(QString sSectionName)`** - Get the index number of a specific section.

**Parameters:**
* `sSectionName` - Name of the section

**Returns:** Section index, or -1 if not found

### getSectionFileOffset()
**`quint64 getSectionFileOffset(quint32 nNumber)`** - Get the file offset of a section.

**Parameters:**
* `nNumber` - Section index number

**Returns:** File offset of the section

### getSectionFileSize()
**`quint64 getSectionFileSize(quint32 nNumber)`** - Get the size of a section.

**Parameters:**
* `nNumber` - Section index number

**Returns:** Size of the section in bytes

**Examples:**
```javascript
var textSection = ELF.getSectionNumber(".text");
if (textSection != -1) {
    var offset = ELF.getSectionFileOffset(textSection);
    var size = ELF.getSectionFileSize(textSection);
    _log("Text section: offset=" + offset + ", size=" + size);
}
```

## Program Header Operations

### getNumberOfPrograms()
**`quint32 getNumberOfPrograms()`** - Get the number of program headers.

**Returns:** Number of program headers

### getProgramFileOffset()
**`quint64 getProgramFileOffset(quint32 nNumber)`** - Get the file offset of a program header.

**Parameters:**
* `nNumber` - Program header index

**Returns:** File offset of the program header

### getProgramFileSize()
**`quint64 getProgramFileSize(quint32 nNumber)`** - Get the size of a program header.

**Parameters:**
* `nNumber` - Program header index

**Returns:** Size of the program header

## ELF Header Information

### getElfHeader_type()
**`quint16 getElfHeader_type()`** - Get the ELF file type from the header.

**Returns:** ELF type value (ET_EXEC=2, ET_DYN=3, ET_REL=1, etc.)

**Examples:**
```javascript
var elfType = ELF.getElfHeader_type();
switch (elfType) {
    case 1: sType = "Relocatable object"; break;
    case 2: sType = "Executable"; break;
    case 3: sType = "Shared library"; break;
    case 4: sType = "Core dump"; break;
}
```

### getElfHeader_machine()
**`quint16 getElfHeader_machine()`** - Get the target machine architecture.

**Returns:** Machine type value (EM_X86_64=62, EM_386=3, EM_ARM=40, etc.)

### getElfHeader_version()
**`quint32 getElfHeader_version()`** - Get the ELF version.

**Returns:** ELF version (typically 1 for current version)

### getElfHeader_entry()
**`quint64 getElfHeader_entry()`** - Get the entry point virtual address.

**Returns:** Entry point address

### getElfHeader_phoff()
**`quint64 getElfHeader_phoff()`** - Get the program header table file offset.

**Returns:** Program header table offset

### getElfHeader_shoff()
**`quint64 getElfHeader_shoff()`** - Get the section header table file offset.

**Returns:** Section header table offset

### getElfHeader_flags()
**`quint32 getElfHeader_flags()`** - Get processor-specific flags.

**Returns:** Flags value

### Header Size Functions

#### getElfHeader_ehsize()
**`quint16 getElfHeader_ehsize()`** - Get the ELF header size.

#### getElfHeader_phentsize()
**`quint16 getElfHeader_phentsize()`** - Get the program header entry size.

#### getElfHeader_phnum()
**`quint16 getElfHeader_phnum()`** - Get the number of program header entries.

#### getElfHeader_shentsize()
**`quint16 getElfHeader_shentsize()`** - Get the section header entry size.

#### getElfHeader_shnum()
**`quint16 getElfHeader_shnum()`** - Get the number of section header entries.

#### getElfHeader_shstrndx()
**`quint16 getElfHeader_shstrndx()`** - Get the section header string table index.

## String and Symbol Tables

### isStringInTablePresent()
**`bool isStringInTablePresent(QString sSectionName, QString sString)`** - Check if a string exists in a string table section.

**Parameters:**
* `sSectionName` - Name of the string table section
* `sString` - String to search for

**Returns:** `true` if string is found, `false` otherwise

**Examples:**
```javascript
if (ELF.isStringInTablePresent(".dynstr", "libc.so.6")) {
    _log("Links with glibc");
}

if (ELF.isStringInTablePresent(".shstrtab", ".debug_info")) {
    sOptions += "debug info";
}
```

## Library Dependencies

### isLibraryPresent()
**`bool isLibraryPresent(QString sLibraryName)`** - Check if a specific library is required by the ELF file.

**Parameters:**
* `sLibraryName` - Name of the library to check

**Returns:** `true` if library dependency exists, `false` otherwise

**Examples:**
```javascript
if (ELF.isLibraryPresent("libQt5Core.so.5")) {
    sFramework = "Qt 5";
    bDetected = true;
}

if (ELF.isLibraryPresent("libpthread.so.0")) {
    sOptions += "threading";
}
```

### getRunPath()
**`QString getRunPath()`** - Get the runtime library search path (RPATH/RUNPATH).

**Returns:** Runtime path string

**Examples:**
```javascript
var runPath = ELF.getRunPath();
if (runPath.length > 0) {
    _log("Runtime path: " + runPath);
}
```

## General Properties

### getGeneralOptions()
**`QString getGeneralOptions()`** - Get general file characteristics and options.

**Returns:** String containing general options and properties

**Examples:**
```javascript
var options = ELF.getGeneralOptions();
if (options.length > 0) {
    sOptions = options;
}

// Complete ELF analysis example
if (ELF.isLibraryPresent("libssl.so")) {
    sName = "OpenSSL application";
    
    if (ELF.isSectionNamePresent(".debug_info")) {
        sOptions = "with debug symbols";
    }
    
    var machineType = ELF.getElfHeader_machine();
    if (machineType == 62) {
        sOptions += ", x86-64";
    } else if (machineType == 3) {
        sOptions += ", i386";
    }
    
    bDetected = true;
}
```


================================================
FILE: help/Global.js
================================================
/**
 * Include another script into this one.
 * @param {String} sScriptName - The script name. Default path is <code>$APP/db</code>.
 * @example
 * includeScript("Cab"); // include script $APP/db/Cab
 */
function includeScript(sScriptName) {}
/**
 * Display a message in the log window or as a console error. It is used to debug signatures.
 * @param {String} sString - The message.
 * @example
 * _log("Hello world!"); // display a string
 * _log(123); // display a number
 */
function _log(sString) {}

/**
 * Get a result string appropriate to the class.
 * @param {Bool} bShowType - True to include the type.
 * @param {Bool} bShowVersion - True to include the version.
 * @param {Bool} bShowOptions - True to include the options.
 * @returns {String}
 */
function result(bShowType, bShowVersion, bShowOptions) {}

================================================
FILE: help/Global.md
================================================
# Global Functions Reference

This document describes global functions available across all script classes in Detect-It-Easy.

## Table of Contents
- [Script Management](#script-management)
- [Logging and Debugging](#logging-and-debugging)
- [Result Management](#result-management)
- [Scan Control](#scan-control)
- [Environment Information](#environment-information)

## Script Management

### includeScript()
**`includeScript(sScriptName)`** - Include another script into the current one.

**Parameters:**
* `sScriptName` - The script name. Default path is `$APP/db`

**Examples:**
```javascript
includeScript("Cab");        // Include script $APP/db/Cab
includeScript("PE");         // Include PE format script
includeScript("Archive");    // Include archive detection script
```

## Logging and Debugging

### _log()
**`_log(sString)`** - Display a message in the log window or console for debugging signatures.

**Parameters:**
* `sString` - The message to display (string or number)

**Examples:**
```javascript
_log("Hello world!");        // Display a string
_log(123);                   // Display a number
_log("File size: " + Binary.getSize()); // Display dynamic information
```

### _encodingList()
**`_encodingList()`** - Display all available text codecs in the log.

**Usage:**
```javascript
_encodingList(); // Shows all supported text encodings
```

## Result Management

### result()
**`result()`** - Get the result string appropriate to the current class context.

**Returns:** Formatted result string for the current detection context.

### _setResult()
**`_setResult(sType, sName, sVersion, sOptions)`** - Set detection result.

**Parameters:**
* `sType` - Result type (e.g., "Packer", "Compiler", "Library")
* `sName` - Name of the detected item
* `sVersion` - Version information
* `sOptions` - Additional options or details

**Examples:**
```javascript
_setResult("Packer", "UPX", "3.95", "");
_setResult("Compiler", "Microsoft Visual C++", "2019", "MSVC 16.0");
_setResult("Library", "Qt", "5.15.2", "GUI framework");
```

### _isResultPresent()
**`bool _isResultPresent(sType, sName)`** - Check if a specific result already exists.

**Parameters:**
* `sType` - Result type to check
* `sName` - Result name to check

**Returns:** `true` if the result exists, `false` otherwise

**Examples:**
```javascript
if (!_isResultPresent("Packer", "UPX")) {
    _setResult("Packer", "UPX", version, "");
}
```

### _getNumberOfResults()
**`qint32 _getNumberOfResults(sType)`** - Get the count of results for a specific type.

**Parameters:**
* `sType` - Result type to count

**Returns:** Number of results of the specified type

### _removeResult()
**`void _removeResult(sType, sName)`** - Remove a specific result.

**Parameters:**
* `sType` - Result type to remove
* `sName` - Result name to remove

## Scan Control

### _isStop
**`bool _isStop`** - Check if the scan has been stopped by the user.

**Usage:**
```javascript
if (_isStop) {
    return; // Exit early if scan was cancelled
}
```

### _breakScan()
**`void _breakScan()`** - Programmatically stop the current scan operation.

**Usage:**
```javascript
if (criticalError) {
    _breakScan(); // Stop scanning due to error
}
```

## Environment Information

### Mode Detection Functions

#### _isConsoleMode()
**`bool _isConsoleMode()`** - Check if running in console mode.

**Returns:** `true` if in console mode, `false` otherwise

#### _isLiteMode()
**`bool _isLiteMode()`** - Check if running in lite mode (reduced functionality).

**Returns:** `true` if in lite mode, `false` otherwise

#### _isGuiMode()
**`bool _isGuiMode()`** - Check if running with GUI interface.

**Returns:** `true` if in GUI mode, `false` otherwise

#### _isLibraryMode()
**`bool _isLibraryMode()`** - Check if running as a library component.

**Returns:** `true` if in library mode, `false` otherwise

**Example usage:**
```javascript
if (_isGuiMode()) {
    // Enable GUI-specific features
    sOptions += ", Interactive mode";
} else if (_isConsoleMode()) {
    // Console-specific optimizations
    _log("Running in console mode");
}
```

### System Information Functions

#### _getEngineVersion()
**`QString _getEngineVersion()`** - Get the Detect-It-Easy engine version.

**Returns:** Engine version string

#### _getOS()
**`QString _getOS()`** - Get the current operating system name.

**Returns:** Operating system identifier

#### _getQtVersion()
**`QString _getQtVersion()`** - Get the Qt framework version being used.

**Returns:** Qt version string

**Example usage:**
```javascript
var engineVer = _getEngineVersion();
var osName = _getOS();
var qtVer = _getQtVersion();

_log("DIE " + engineVer + " on " + osName + " (Qt " + qtVer + ")");
```

================================================
FILE: help/ISO9660.md
================================================
# ISO9660 Class Reference

The ISO9660 class provides specialized analysis capabilities for ISO 9660 CD-ROM/DVD filesystem images.

## Inheritance
* **Inherits from Archive class** - All Archive class functions are available with ISO9660 prefix (e.g., `Archive.isArchiveRecordPresent` → `ISO9660.isArchiveRecordPresent`)
* **Inherits from Binary class** - All Binary class functions are available with ISO9660 prefix (e.g., `Binary.compare` → `ISO9660.compare`)

## Overview

ISO 9660 is the standard filesystem format for CD-ROMs and DVD-ROMs. This class enables detection and analysis of ISO image files commonly used for:
- Operating system installation media
- Software distribution
- Backup and archival purposes
- Virtual CD/DVD images

## Table of Contents
- [File Format Detection](#file-format-detection)
- [Volume Descriptor Information](#volume-descriptor-information)
- [Archive Content Analysis](#archive-content-analysis)
- [Usage Examples](#usage-examples)

## File Format Detection

### isValid()
**`bool isValid()`** - Verify if the file is a valid ISO 9660 image.

**Returns:** `true` if file has valid ISO 9660 structure, `false` otherwise

Checks for the ISO 9660 primary volume descriptor signature at the standard location (sector 16).

### getFileFormatName()
**`QString getFileFormatName()`** - Get the format name.

**Returns:** String containing "ISO 9660" or more specific format variant

### getFileFormatVersion()
**`QString getFileFormatVersion()`** - Get the ISO 9660 version.

**Returns:** Version string of the ISO 9660 format

### getFileFormatOptions()
**`QString getFileFormatOptions()`** - Get format-specific options or extensions.

**Returns:** String describing extensions like Joliet, Rock Ridge, etc.

## Volume Descriptor Information

### getSystemIdentifier()
**`QString getSystemIdentifier()`** - Get the system identifier from the Primary Volume Descriptor.

**Returns:** String containing the system that created the ISO image (32 characters maximum)

The system identifier describes the operating system or software system that can act upon sectors 0-15 of the volume.

### getVolumeIdentifier()
**`QString getVolumeIdentifier()`** - Get the volume identifier (volume label).

**Returns:** String containing the volume name/label (32 characters maximum)

This is the user-visible name of the volume, often used as a disc label.

### getVolumeSetIdentifier()
**`QString getVolumeSetIdentifier()`** - Get the volume set identifier.

**Returns:** String identifying the volume set this volume belongs to (128 characters maximum)

Used when multiple volumes are part of a set.

### getPublisherIdentifier()
**`QString getPublisherIdentifier()`** - Get the publisher identifier.

**Returns:** String identifying the volume publisher (128 characters maximum)

Specifies the organization or company that published the volume.

### getDataPreparerIdentifier()
**`QString getDataPreparerIdentifier()`** - Get the data preparer identifier.

**Returns:** String identifying who prepared the data (128 characters maximum)

Identifies the person or organization that prepared the data for recording.

### getApplicationIdentifier()
**`QString getApplicationIdentifier()`** - Get the application identifier.

**Returns:** String identifying the application used to create the volume (128 characters maximum)

Specifies the software application that was used to prepare the data on the volume. Commonly used to detect disc burning tools.

### getCopyrightFileIdentifier()
**`QString getCopyrightFileIdentifier()`** - Get the copyright file identifier.

**Returns:** String identifying the copyright file (37 characters maximum)

References a file within the ISO that contains copyright information.

### getAbstractFileIdentifier()
**`QString getAbstractFileIdentifier()`** - Get the abstract file identifier.

**Returns:** String identifying the abstract file (37 characters maximum)

References a file within the ISO that contains an abstract or summary.

### getBibliographicFileIdentifier()
**`QString getBibliographicFileIdentifier()`** - Get the bibliographic file identifier.

**Returns:** String identifying the bibliographic file (37 characters maximum)

References a file within the ISO that contains bibliographic information.

### getCreationDateTime()
**`QString getCreationDateTime()`** - Get the volume creation date and time.

**Returns:** String containing creation timestamp (17 characters in ISO 9660 format: YYYYMMDDHHMMSSmmZZ)

Format: Year(4), Month(2), Day(2), Hour(2), Minute(2), Second(2), Centiseconds(2), GMT offset(1)

### getModificationDateTime()
**`QString getModificationDateTime()`** - Get the volume modification date and time.

**Returns:** String containing last modification timestamp (17 characters)

Same format as creation date/time. Indicates when the volume was last modified.

### getExpirationDateTime()
**`QString getExpirationDateTime()`** - Get the volume expiration date and time.

**Returns:** String containing expiration timestamp (17 characters)

Date after which the volume is considered obsolete. May be empty/zeros if no expiration.

### getEffectiveDateTime()
**`QString getEffectiveDateTime()`** - Get the volume effective date and time.

**Returns:** String containing effective timestamp (17 characters)

Date from which the volume may be used. May be empty/zeros if effective immediately.

## Archive Content Analysis

### isArchiveRecordPresent()
**`bool isArchiveRecordPresent(QString sArchiveRecord)`** - Check if a specific file exists in the ISO image.

**Parameters:**
* `sArchiveRecord` - The filename or path to search for within the ISO filesystem

**Returns:** `true` if the file exists in the ISO image, `false` otherwise

### isArchiveRecordPresentExp()
**`bool isArchiveRecordPresentExp(QString sArchiveRecord)`** - Check if files matching a pattern exist in the ISO image.

**Parameters:**
* `sArchiveRecord` - Pattern or expression to match against files in the ISO

**Returns:** `true` if matching files exist, `false` otherwise

## Usage Examples

```javascript
// Basic ISO 9660 detection
if (ISO9660.isValid()) {
    sName = ISO9660.getFileFormatName();
    sVersion = ISO9660.getFileFormatVersion();
    sOptions = ISO9660.getFileFormatOptions();
    bDetected = true;
}

// Detect disc burning application
if (ISO9660.isValid()) {
    var sAppId = ISO9660.getApplicationIdentifier();
    
    if (sAppId.indexOf("NERO BURNING ROM") !== -1) {
        sName = "Nero Burning ROM";
        // Extract version if present
        bDetected = true;
    } else if (sAppId.indexOf("IMGBURN") !== -1) {
        sName = "ImgBurn";
        bDetected = true;
    } else if (sAppId.indexOf("CDRECORD") !== -1) {
        sName = "cdrecord";
        bDetected = true;
    }
}

// Check volume information
if (ISO9660.isValid()) {
    var sVolumeLabel = ISO9660.getVolumeIdentifier();
    var sPublisher = ISO9660.getPublisherIdentifier();
    var sCreationDate = ISO9660.getCreationDateTime();
    
    sOptions = "Volume: " + sVolumeLabel;
    if (sPublisher) {
        sOptions += ", Publisher: " + sPublisher;
    }
    bDetected = true;
}

// Detect bootable OS installation media
if (ISO9660.isArchiveRecordPresent("BOOT/BOOTFIX.BIN") || 
    ISO9660.isArchiveRecordPresent("isolinux/isolinux.bin")) {
    sName = "Bootable ISO";
    sOptions = "Linux installation media";
}

// Windows installation media detection
if (ISO9660.isArchiveRecordPresent("sources/install.wim") ||
    ISO9660.isArchiveRecordPresent("sources/boot.wim")) {
    sName = "Windows installation media";
    var sPreparer = ISO9660.getDataPreparerIdentifier();
    if (sPreparer) {
        sOptions = "Prepared by: " + sPreparer;
    }
    bDetected = true;
}

// Software distribution detection
if (ISO9660.isArchiveRecordPresent("setup.exe") ||
    ISO9660.isArchiveRecordPresent("autorun.inf")) {
    sName = "Software distribution ISO";
}

// Check for specific applications
if (ISO9660.isArchiveRecordPresent("VMware/vmware.exe")) {
    sName = "VMware distribution media";
    bDetected = true;
}
```

## Common ISO 9660 Extensions

- **Joliet** - Microsoft extension for long filenames and Unicode support
- **Rock Ridge** - POSIX extension for Unix-style permissions and long filenames
- **El Torito** - Extension for bootable CD-ROMs
- **UDF Bridge** - Hybrid format combining ISO 9660 with Universal Disk Format

## Notes

* ISO 9660 images typically have `.iso` file extension
* Maximum filename length in standard ISO 9660 is 31 characters (Level 1) or 207 characters (Level 2)
* Extensions like Joliet and Rock Ridge remove many of these limitations
* The class can analyze both physical CD/DVD media and ISO image files


================================================
FILE: help/JAR.md
================================================
###This is a description of the JAR class.

* You could use all functions from Binary class but with JAR prefix (Binary.compare -> JAR.compare)

**QString getManifest()**

```
```
**QString getManifestRecord(const QString &sRecord)**

```
```


================================================
FILE: help/LE.md
================================================
###This is a description of the LE class.

* You could use all functions from Binary class but with LE prefix (Binary.compareEP -> LE.compareEP)
* You could use all functions from MSDOS class but with LE prefix (MSDOS.isDosStubPresent -> LE.isDosStubPresent)


================================================
FILE: help/LX.md
================================================
###This is a description of the LX class.

* You could use all functions from Binary class but with LX prefix (Binary.compareEP -> LX.compareEP)
* You could use all functions from MSDOS class but with LX prefix (MSDOS.isDosStubPresent -> LX.isDosStubPresent)


================================================
FILE: help/MACH.js
================================================
/**
 * @class
 * @classdesc This is a description of the MACH class.
 */
function MACH() {}
/**
 * @see Binary.calculateEntropy
 */
MACH.calculateEntropy = function(nOffset, nSize) {}
    /**
     * @see Binary.calculateMD5
     */
MACH.calculateMD5 = function(nOffset, nSize) {}
    /**
     * @see Binary.compare
     */
MACH.compare = function(sSignature, nOffset) {}
    /**
     * @see PE.compareEP
     */
MACH.compareEP = function(sSignature, nOffset) {}
    /**
     * @see Binary.findByte
     */
MACH.findByte = function(nOffset, nSize, cValue) {}
    /**
     * @see Binary.findDword
     */
MACH.findDword = function(nOffset, nSize, nValue) {}
    /**
     * @see Binary.findSignature
     */
MACH.findSignature = function(nOffset, nSize, sSignature) {}
    /**
     * @see Binary.findString
     */
MACH.findString = function(nOffset, nSize, sValue) {}
    /**
     * @see Binary.findWord
     */
MACH.findWord = function(nOffset, nSize, sValue) {}
    /**
     * @see Binary.getSignature
     */
MACH.getSignature = function(nOffset, nSize) {}
    /**
     * @see Binary.getSize
     */
MACH.getSize = function() {}
    /**
     * @see Binary.isSignaturePresent
     */
MACH.isSignaturePresent = function(nOffset, nSize, sSignature) {}
    /**
     * @see Binary.readByte
     */
MACH.readByte = function(nOffset) {}
    /**
     * @see Binary.readDword
     */
MACH.readDword = function(nOffset) {}
    /**
     * @see Binary.readQword
     */
MACH.readQword = function(nOffset) {}
    /**
     * @see Binary.readWord
     */
MACH.readWord = function(nOffset) {}
    /**
     * @see Binary.readSByte
     */
MACH.readSByte = function(nOffset) {}
    /**
     * @see Binary.readSDword
     */
MACH.readSDword = function(nOffset) {}
    /**
     * @see Binary.readSQword
     */
MACH.readSQword = function(nOffset) {}
    /**
     * @see Binary.readSWord
     */
MACH.readSWord = function(nOffset) {}
    /**
     * @see Binary.swapBytes
     */
MACH.swapBytes = function(nValue) {}
    /**
     * @see Binary.getString
     */
MACH.getString = function(nOffset, nSize) {}
    /**
     * @see Binary.getFileDirectory
     */
MACH.getFileDirectory = function() {}
    /**
     * Get a string in the form of <code>"<i>MACHtype</i><i>MACHmode</i>"</code>. For example <code>"EXE32"</code> or <code>"DYLIB64"</code>.
     * @returns {String}
     */
MACH.getGeneralOptions = function() {}
    /**
     * Get the current version of a library.
     * @param {String} sLibrary - The name of the library.
     * @returns {String}
     */
MACH.getLibraryCurrentVersion = function(sLibrary) {}
    /**
     * Get the number of sections.
     * @returns {Int}
     */
MACH.getNumberOfSections = function() {}
    /**
     * Get the number of segments.
     * @returns {Int}
     */
MACH.getNumberOfSegments = function() {}
    /**
     * Check if there is a library with a specific name in the import table.
     * @param {String} sLibraryName - The name of the library.
     * @returns {Bool}
     */
MACH.isLibraryPresent = function(sLibrary) {}
    /**
     * Check if a section exists with a specific name or matches a regular expression.
     * @param {String} sSectionName - Section name or pattern.
     * @returns {Bool}
     */
MACH.isSectionNamePresent = function(sSectionName) {}
    /**
     * Get the number of a section with a specific name.
     * @param {String} sSectionName - Section name.
     * @returns {Int} 0-based section number, or <code>-1</code> if there is no section with that name.
     */
MACH.getSectionNumber = function(sSectionName) {}
    /**
     * Get the file offset of a section.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
MACH.getSectionFileOffset = function(nSection) {}
    /**
     * Get the file size of a section.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
MACH.getSectionFileSize = function(nSection) {}
    /**
     * Get the name of a section.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
MACH.getSectionName = function(nSection) {}
    /**
     * Get the file offset of a segment.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
MACH.getSegmentFileOffset = function(nSection) {}
    /**
     * Get the file size of a segment.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
MACH.getSegmentFileSize = function(nSection) {}
    /**
     * Get the name of a segment.
     * @param {Int} nSection - Section number.
     * @returns {UInt}
     */
MACH.getSegmentName = function(nSection) {}
    /**
     * Check if the file is 64 bit (MachO64).
     * @returns {Bool}
     * @example
     * if(MACH.is64())
     * {
     *     sOptions="MachO64";
     * }
     */
MACH.is64 = function() {}
    /**
     * Convert a relative virtual address (RVA) to a file offset.
     * @param {UInt64} nRVA
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
MACH.RVAToOffset = function(nRVA) {}
    /**
     * Convert a virtual address (VA) to a file offset.
     * @param {UInt64} nVA
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
MACH.VAToOffset = function(nVA) {}
    /**
     * Convert a file offset to a relative virtual address (RVA).
     * @param {UInt64} nOffset
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
MACH.OffsetToRVA = function(nOffset) {}
    /**
     * Convert a file offset to a virtual address (VA).
     * @param {UInt64} nOffset
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
MACH.OffsetToVA = function(nOffset) {}
    /**
     * Get the size of the overlay.
     * @returns {Int}
     */
MACH.getOverlaySize = function() {}
    /**
     * Get the file offset of the overlay.
     * @returns {Int}
     */
MACH.getOverlayOffset = function() {}
    /**
     * Check if an overlay is present.
     * @returns {Bool}
     */
MACH.isOverlayPresent = function() {}
    /**
     * @see PE.compareOverlay
     */
MACH.compareOverlay = function(sSignature, nOffset) {}
    /**
     * Get the offset of the entry point.
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
MACH.getEntryPointOffset = function() {}
    /**
     * @see Binary.getFileBaseName
     */
MACH.getFileBaseName = function() {}
    /**
     * @see Binary.getFileSuffix
     */
MACH.getFileSuffix = function() {}
    /**
     * @see Binary.getFileCompleteSuffix
     */
MACH.getFileCompleteSuffix = function() {}

================================================
FILE: help/MACH.md
================================================
###This is a description of the MACH class.

* You could use all functions from Binary class but with MACH prefix (Binary.compareEP -> MACH.compareEP)

**bool isLibraryPresent(QString sLibraryName)**

```
```
**quint32 getNumberOfSections()**

```
```
**quint32 getNumberOfSegments()**

```
```
**qint32 getSectionNumber(QString sSectionName)**

```
```
**QString getGeneralOptions()**

```
```
**quint32 getLibraryCurrentVersion(QString sLibraryName)**

```
```
**quint32 getNumberOfCommands()**

```
```
**quint32 getCommandId(quint32 nNumber)**

```
```
**bool isCommandPresent(quint32 nNumber)**

```
```


================================================
FILE: help/MSDOS.js
================================================
/**
 * @class
 * @classdesc This is a description of the MSDOS class.
 */
function MSDOS() {}
/**
 * @see Binary.calculateEntropy
 */
MSDOS.calculateEntropy = function(nOffset, nSize) {}
    /**
     * @see Binary.calculateMD5
     */
MSDOS.calculateMD5 = function(nOffset, nSize) {}
    /**
     * @see Binary.compare
     */
MSDOS.compare = function(sSignature, nOffset) {}
    /**
     * @see PE.compareEP
     */
MSDOS.compareEP = function(sSignature, nOffset) {}
    /**
     * @see Binary.findByte
     */
MSDOS.findByte = function(nOffset, nSize, cValue) {}
    /**
     * @see Binary.findDword
     */
MSDOS.findDword = function(nOffset, nSize, nValue) {}
    /**
     * @see Binary.findSignature
     */
MSDOS.findSignature = function(nOffset, nSize, sSignature) {}
    /**
     * @see Binary.findString
     */
MSDOS.findString = function(nOffset, nSize, sValue) {}
    /**
     * @see Binary.findWord
     */
MSDOS.findWord = function(nOffset, nSize, sValue) {}
    /**
     * @see Binary.getSignature
     */
MSDOS.getSignature = function(nOffset, nSize) {}
    /**
     * @see Binary.getSize
     */
MSDOS.getSize = function() {}
    /**
     * @see Binary.isSignaturePresent
     */
MSDOS.isSignaturePresent = function(nOffset, nSize, sSignature) {}
    /**
     * @see Binary.readByte
     */
MSDOS.readByte = function(nOffset) {}
    /**
     * @see Binary.readDword
     */
MSDOS.readDword = function(nOffset) {}
    /**
     * @see Binary.readQword
     */
MSDOS.readQword = function(nOffset) {}
    /**
     * @see Binary.readWord
     */
MSDOS.readWord = function(nOffset) {}
    /**
     * @see Binary.readSByte
     */
MSDOS.readSByte = function(nOffset) {}
    /**
     * @see Binary.readSDword
     */
MSDOS.readSDword = function(nOffset) {}
    /**
     * @see Binary.readSQword
     */
MSDOS.readSQword = function(nOffset) {}
    /**
     * @see Binary.readSWord
     */
MSDOS.readSWord = function(nOffset) {}
    /**
     * @see Binary.swapBytes
     */
MSDOS.swapBytes = function(nValue) {}
    /**
     * @see Binary.getString
     */
MSDOS.getString = function(nOffset, nSize) {}
    /**
     * @see Binary.getFileDirectory
     */
MSDOS.getFileDirectory = function() {}
    /**
     * Get the file offset of the overlay.
     * @returns {Int}
     */
MSDOS.getOverlayOffset = function() {}
    /**
     * Get the size of the overlay.
     * @returns {Int}
     */
MSDOS.getOverlaySize = function() {}
    /**
     * Check if an overlay is present.
     * @returns {Bool}
     */
MSDOS.isOverlayPresent = function() {}
    /**
     * Check if the file is a <b>N</b>ew <b>E</b>xecutable.
     * @returns {Bool}
     */
MSDOS.isNE = function() {}
    /**
     * Check if the file is a <b>L</b>inear <b>E</b>xecutable.
     * @returns {Bool}
     */
MSDOS.isLE = function() {}
    /**
     * Check if the file is a <b>L</b>inear e<b>X</b>ecutable.
     * @returns {Bool}
     */
MSDOS.isLX = function() {}
    /**
     * @see PE.compareOverlay
     */
MSDOS.compareOverlay = function(sSignature, nOffset) {}
    /**
     * Get the offset of the entry point.
     * @returns {Int} If an error occurs, -1 will be returned.
     */
MSDOS.getEntryPointOffset = function() {}
    /**
     * @see Binary.getFileBaseName
     */
MSDOS.getFileBaseName = function() {}
    /**
     * @see Binary.getFileSuffix
     */
MSDOS.getFileSuffix = function() {}
    /**
     * @see Binary.getFileCompleteSuffix
     */
MSDOS.getFileCompleteSuffix = function() {}

================================================
FILE: help/MSDOS.md
================================================
# MSDOS (MS-DOS Executable) Class Reference

The MSDOS class provides analysis capabilities for MS-DOS executable files with MZ headers, including detection of extended executable formats and Rich signatures.

## Inheritance
* **Inherits from Binary class** - All Binary class functions are available with MSDOS prefix (e.g., `Binary.compareEP` → `MSDOS.compareEP`)

## Table of Contents
- [Extended Format Detection](#extended-format-detection)
- [DOS Stub Analysis](#dos-stub-analysis)
- [Rich Signature Support](#rich-signature-support)

## Extended Format Detection

MS-DOS files can contain extended executable formats. These functions detect the presence of newer formats embedded within MZ files.

### isLE()
**`bool isLE()`** - Check if the file contains a Linear Executable (LE) format.

**Returns:** `true` if LE format is detected, `false` otherwise

LE format was used by OS/2 and some Windows VxD drivers.

### isLX()
**`bool isLX()`** - Check if the file contains a Linear eXecutable (LX) format.

**Returns:** `true` if LX format is detected, `false` otherwise

LX format was used by OS/2 32-bit applications.

### isNE()
**`bool isNE()`** - Check if the file contains a New Executable (NE) format.

**Returns:** `true` if NE format is detected, `false` otherwise

NE format was used by Windows 16-bit applications.

### isPE()
**`bool isPE()`** - Check if the file contains a Portable Executable (PE) format.

**Returns:** `true` if PE format is detected, `false` otherwise

PE format is used by modern Windows applications.

**Examples:**
```javascript
// Detect extended executable types
if (MSDOS.isPE()) {
    sName = "PE executable";
} else if (MSDOS.isNE()) {
    sName = "NE executable";
} else if (MSDOS.isLE()) {
    sName = "LE executable";
} else if (MSDOS.isLX()) {
    sName = "LX executable";
} else {
    sName = "MS-DOS executable";
}
```

## DOS Stub Analysis

The DOS stub is the 16-bit code that runs when a newer executable format is run on plain MS-DOS.

### getDosStubOffset()
**`qint64 getDosStubOffset()`** - Get the file offset where the DOS stub begins.

**Returns:** File offset of the DOS stub

### getDosStubSize()
**`qint64 getDosStubSize()`** - Get the size of the DOS stub in bytes.

**Returns:** Size of the DOS stub

### isDosStubPresent()
**`bool isDosStubPresent()`** - Check if a DOS stub is present in the file.

**Returns:** `true` if DOS stub exists, `false` otherwise

**Examples:**
```javascript
if (MSDOS.isDosStubPresent()) {
    var stubSize = MSDOS.getDosStubSize();
    var stubOffset = MSDOS.getDosStubOffset();
    
    _log("DOS stub found: offset=" + stubOffset + ", size=" + stubSize);
    
    // Analyze stub content
    if (MSDOS.compare("'This program cannot be run in DOS mode'", stubOffset)) {
        sOptions = "standard stub";
    } else {
        sOptions = "custom stub";
    }
}
```

## Rich Signature Support

Rich signatures contain information about the Microsoft compiler and linker used to build the executable.

### isRichSignaturePresent()
**`bool isRichSignaturePresent()`** - Check if a Rich signature is present.

**Returns:** `true` if Rich signature exists, `false` otherwise

### getNumberOfRichIDs()
**`qint32 getNumberOfRichIDs()`** - Get the number of Rich signature entries.

**Returns:** Number of Rich signature entries

### isRichVersionPresent()
**`bool isRichVersionPresent(quint32 nVersion)`** - Check if a specific compiler version is present in Rich signature.

**Parameters:**
* `nVersion` - Compiler version to check for

**Returns:** `true` if version is found, `false` otherwise

### getRichVersion()
**`quint32 getRichVersion(qint32 nPosition)`** - Get the compiler version at a specific position.

**Parameters:**
* `nPosition` - Position index in Rich signature

**Returns:** Compiler version number

### getRichID()
**`quint32 getRichID(qint32 nPosition)`** - Get the compiler ID at a specific position.

**Parameters:**
* `nPosition` - Position index in Rich signature

**Returns:** Compiler ID

### getRichCount()
**`quint32 getRichCount(qint32 nPosition)`** - Get the object count at a specific position.

**Parameters:**
* `nPosition` - Position index in Rich signature

**Returns:** Object count for this compiler/version

**Examples:**
```javascript
if (MSDOS.isRichSignaturePresent()) {
    var richCount = MSDOS.getNumberOfRichIDs();
    _log("Rich signature found with " + richCount + " entries");
    
    // Analyze Rich signature entries
    for (var i = 0; i < richCount; i++) {
        var richID = MSDOS.getRichID(i);
        var richVersion = MSDOS.getRichVersion(i);
        var richObjCount = MSDOS.getRichCount(i);
        
        // Map common compiler IDs
        var compilerName = "";
        switch (richID) {
            case 0x5D: compilerName = "Visual C++ 6.0"; break;
            case 0x5E: compilerName = "Visual C++ .NET"; break;
            case 0x5F: compilerName = "Visual C++ 2003"; break;
            case 0x84: compilerName = "Visual C++ 2005"; break;
            case 0x85: compilerName = "Visual C++ 2008"; break;
            case 0x86: compilerName = "Visual C++ 2010"; break;
            case 0x87: compilerName = "Visual C++ 2012"; break;
            case 0x88: compilerName = "Visual C++ 2013"; break;
            default: compilerName = "Unknown (" + richID + ")"; break;
        }
        
        _log("Entry " + i + ": " + compilerName + " v" + richVersion + 
             " (" + richObjCount + " objects)");
    }
    
    // Check for specific Visual Studio versions
    if (MSDOS.isRichVersionPresent(0x86)) {
        sOptions = "Visual C++ 2010";
    }
}
```

================================================
FILE: help/NE.md
================================================
###This is a description of the NE class.

* You could use all functions from Binary class but with NE prefix (Binary.compareEP -> NE.compareEP)
* You could use all functions from MSDOS class but with NE prefix (MSDOS.isDosStubPresent -> NE.isDosStubPresent)

================================================
FILE: help/PE.js
================================================
/**
 * @class
 * @classdesc This is a description of the PE class.
 */
function PE() {}
/**
 * @see Binary.calculateEntropy
 */
PE.calculateEntropy = function(nOffset, nSize) {}
    /**
     * @see Binary.calculateMD5
     */
PE.calculateMD5 = function(nOffset, nSize) {}
    /**
     * Calculate the size of the headers.
     * @returns {UInt}
     */
PE.calculateSizeOfHeaders = function() {}
    /**
     * @see Binary.compare
     */
PE.compare = function(sSignature, nOffset) {}
    /**
     * Compare (see {@link Binary.compare}) bytes at the <b>E</b>ntry <b>P</b>oint.
     * @param {String} sSignature - The signature.
     * @param {Int} [nOffset=0] - The offset from the entry point.
     * @returns {Bool}
     * @example
     * if(PE.compareEP("2C81",8))
     * {
     *     sVersion="1.98";
     * }
     *
     * if(PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24"))
     * {
     *     bDetected=1;
     * }
     */
PE.compareEP = function(sSignature, nOffset) {}
    /**
     * Compare (see {@link Binary.compare}) bytes at the <b>E</b>ntry <b>P</b>oint of .NET.
     * @param {String} sSignature - The signature.
     * @param {Int} [nOffset=0] - The offset from the entry point of .NET.
     * @returns {Bool}
     * @example
     * if(PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9"))
     * {
     *     bDetected=1;
     *     sVersion="2.X";
     * }
     */
PE.compareEP_NET = function(sSignature, nOffset) {}
    /**
     * Compare bytes at the overlay.
     * @param {String} sSignature - The signature.
     * @param {Int} [nOffset=0] - The offset from the overlay.
     * @returns {Bool}
     * @example
     * if(PE.compareOverlay("';!@Install@!UTF-8!'"))
     * {
     *     bDetected=1;
     * }
     */
PE.compareOverlay = function(sSignature, nOffset) {}
    /**
     * @see Binary.findByte
     */
PE.findByte = function(nOffset, nSize, cValue) {}
    /**
     * @see Binary.findDword
     */
PE.findDword = function(nOffset, nSize, nValue) {}
    /**
     * @see Binary.findSignature
     * @example
     * nOffset=PE.findSignature(nOffset,1024,"'7z'BCAF271C");
     * if(nOffset!=-1)
     * {
     *     bDetected=1;
     * }
     */
PE.findSignature = function(nOffset, nSize, sSignature) {}
    /**
     * @see Binary.findString
     * @example
     * nOffset=PE.findString(0,1024,"UPX!");
     * if(nOffset==-1)
     * {
     *     return;
     * }
     */
PE.findString = function(nOffset, nSize, sValue) {}
    /**
     * @see Binary.findWord
     */
PE.findWord = function(nOffset, nSize, sValue) {}
    /**
     * Get the relative virtual address (RVA) of the entry point.
     * @returns {UInt}
     * @example
     * var nSection=PE.nLastSection;
     * if(nSection>=2)
     * {
     *     if(PE.getAddressOfEntryPoint()==PE.section[nSection].VirtualAddress)
     *     {
     *         if(PE.section[nSection].Characteristics==0xe0000040)
     *         {
     *             if(PE.section[nSection-1].Characteristics==0xe0000040)
     *             {
     *                 if(PE.getNumberOfImportThunks(0)==1)
     *                 {
     *                     bDetected=1;
     *                 }
     *             }
     *         }
     *     }
     * }
     */
PE.getAddressOfEntryPoint = function() {}
    /**
     * Get the compiler version.
     * @returns {String} The string <code>"<i>MajorLinkerVersion</i>.<i>MinorLinkerVersion</i>"</code>.
     * @example
     * if(bDetected)
     * {
     *     switch(PE.getCompilerVersion())
     *     {
     *     case "6.0":  sVersion="6.0";  break;
     *     case "7.0":  sVersion="2002"; break;
     *     case "7.10": sVersion="2003"; break;
     *     case "8.0":  sVersion="2005"; break;
     *     case "9.0":  sVersion="2008"; break;
     *     case "10.0": sVersion="2010"; break;
     *     case "11.0": sVersion="2012"; break;
     *     case "12.0": sVersion="2013"; break;
     *     }
     * }
     */
PE.getCompilerVersion = function() {}
    /**
     * Get the number of the section containing the entry point.
     * @returns {Int} If no entry point returns <code>-1</code>.
     * @example
     * if(PE.getEntryPointSection()==PE.nLastSection)
     * {
     *     bDetected=1;
     * }
     */
PE.getEntryPointSection = function() {}
    /**
     * @see Binary.getFileDirectory
     */
PE.getFileDirectory = function() {}
    /**
     * Get the version of the file, if the version resource exists.
     * @returns {String}
     */
PE.getFileVersion = function() {}
    /**
     * Get a string in the form of <code>"<i>PEtype</i><i>PEmode</i>"</code>. For example <samp>"EXE32"</samp> or <samp>"Driver32"</samp>.
     * @returns {String}
     */
PE.getGeneralOptions = function() {}
    /**
     * Get the base address of the image.
     * @returns {UInt}
     */
PE.getImageBase = function() {}
    /**
     * Get the name of an imported function.
     * @param {UInt} nImport - Number of the imported library.
     * @param {UInt} nFunctionNumber - Number of the function in the library.
     * @returns {String}
     */
PE.getImportFunctionName = function(nImport, nFunctionNumber) {}
    /**
     * Get the name of an imported library.
     * @param {UInt} nImport - Number of the imported library.
     * @returns {String}
     */
PE.getImportLibraryName = function(nImport) {}
    /**
     * Get the number of the section containing the import table.
     * @returns {Int} If no import returns <code>-1</code>.
     */
PE.getImportSection = function() {}
    /**
     * Get the machine type.
     * @returns {UShort}
     */
PE.getMachineType = function() {}
    /**
     * Get the major linker version.
     * @returns {UInt}
     * @example
     * var nMajor=PE.getMajorLinkerVersion();
     * if(nMajor>3)
     * {
     *     sName="Microsoft Linker";
     *     bDetected=1;
     * }
     */
PE.getMajorLinkerVersion = function() {}
    /**
     * Get the XML manifest from the resources.
     * @returns {String}
     * @example
     * if(/requireAdministrator/.test(PE.getManifest()))
     * {
     *     sOptions=sOptions.append("admin");
     * }
     */
PE.getManifest = function() {}
    /**
     * Get the minor linker version.
     * @returns {UInt}
     * @example
     * var nMinor=PE.getMinorLinkerVersion();
     * if(nMinor==55)
     * {
     *     sName="LCC Linker";
     *     sVersion+="*";
     *     bDetected=1;
     * }
     */
PE.getMinorLinkerVersion = function() {}
    /**
     * Get the .NET version.
     * @returns {String}
     * @example
     * if(PE.isNET())
     * {
     *     sVersion=PE.getNETVersion();
     *     bDetected=1;
     * }
     */
PE.getNETVersion = function() {}
    /**
     * Get the number of imports.
     * @returns {Int}
     * @example
     * if(PE.getNumberOfImports()==1)
     * {
     *     if(PE.getNumberOfImportThunks(0)==2)
     *     {
     *         if(PE.section[0].Name=="ANDpakk2")
     *         {
     *             sVersion="2.X";
     *             bDetected=1;
     *         }
     *     }
     * }
     */
PE.getNumberOfImports = function() {}
    /**
     * Get the number of functions in the imported library.
     * @param {UInt} nImport - Number of the library.
     * @returns {UInt}
     * @example
     * if(PE.getNumberOfImportThunks(0)==1)
     * {
     *     bDetected=1;
     * }
     */
PE.getNumberOfImportThunks = function(nImport) {}
    /**
     * Get the number of sections.
     * @returns {Int}
     */
PE.getNumberOfSections = function() {}
    /**
     * Get the file offset of the overlay.
     * @returns {UInt}
     */
PE.getOverlayOffset = function() {}
    /**
     * Get the size of the overlay .
     * @returns {UInt}
     */
PE.getOverlaySize = function() {}
    /**
     * Get the version of a particular file, if the version resource exists.
     * @param {String} sFileName - The file name.
     * @returns {String}
     */
PE.getPEFileVersion = function(sFileName) {}
    /**
     * Get the file offset to a named resource.
     * @param {String} sFileName - The name of the resource.
     * @returns {Int} If an error occurs, <code>-1</code> will be returned.
     */
PE.getResourceNameOffset = function(sName) {}
    /**
     * Get the size of a named resource.
     * @param {String} sFileName - The name of the resource.
     * @returns {Int}
     */
PE.getResourceNameSize = function(sName) {}
    /**
     * Get the characteristics of a section.
     * @param {Int} nSectionNumber - Section number (from 0).
     * @returns {UInt}
     */
PE.getSectionCharacteristics = function(nSectionNumber) {}
    /**
     * Get the file offset of a section.
     * @param {Int} nSectionNumber - Section number (from 0).
     * @returns {UInt}
     */
PE.getSectionFileOffset = function(nSectionNumber) {}
    /**
     * Get the file size of a section.
     * @param {Int} nSectionNumber - Section number (from 0).
     * @returns {UInt}
     */
PE.getSectionFileSize = function(nSectionNumber) {}
    /**
     * Get the name of a section.
     * @param {Int} nSectionNumber - Section number (from 0).
     * @returns {String}
     */
PE.getSectionName = function(nSectionNumber) {}
    /**
     * Get the relative virtual address of a section.
     * @param {Int} nSectionNumber - Section number (from 0).
     * @returns {UInt}
     */
PE.getSectionVirtualAddress = function(nSectionNumber) {}
    /**
     * Get the virtual size of a section.
     * @param {Int} nSectionNumber - Section number (from 0).
     * @returns {UInt}
     */
PE.getSectionVirtualSize = function(nSectionNumber) {}
    /**
     * Get the common prefix of two section name suffixes.
     * @param {String} sString1 - First section name suffix.
     * @param {String} sString2 - Second section name suffix.
     * @returns {String} Section name prefix.
     * @example
     * if("UPX"==PE.getSectionNameCollision("0","1"))
     * {
     *     // Both "UPX0" and "UPX1" exist.
     *     bDetected=1;
     * }
     */
PE.getSectionNameCollision = function(sString1, sString2) {}
    /**
     * Get the number of a section with a specific name.
     * @param {String} sSectionName - Section name.
     * @returns {Int} 0-based section number, or <code>-1</code> if there is no section with that name.
     */
PE.getSectionNumber = function(sSectionName) {}
    /**
     * Get the number of a section whose name matches a regular expression.
     * @param {String} sSectionName - Section pattern.
     * @returns {Int} 0-based section number, or <code>-1</code> if there is no section with that pattern.
     */
PE.getSectionNumberExp = function(sSectionName) {}
    /**
     * Checks if a section exists with a specific name.
     * @param {String} sSectionName - Section name.
     * @returns {Bool}
     */
PE.isSectionNamePresent = function(sSectionName) {}
    /**
     * Check if a section name matches a regular expression.
     * @param {String} sSectionName - Section pattern.
     * @returns {Bool}
     */
PE.isSectionNamePresentExp = function(sSectionName) {}
    /**
     * @see Binary.getSignature
     */
PE.getSignature = function(nOffset, nSize) {}
    /**
     * @see Binary.getSize
     */
PE.getSize = function() {}
    /**
     * Get the size of code.
     * @returns {Int}
     */
PE.getSizeOfCode = function() {}
    /**
     * Get the size of uninitialized data.
     * @returns {Int}
     */
PE.getSizeOfUninitializedData = function() {}
    /**
     * Check if the file is a console application.
     * @returns {Bool}
     */
PE.isConsole = function() {}
    /**
     * Check if the file is a DLL.
     * @returns {Bool}
     */
PE.isDll = function() {}
    /**
     * Check if the file is a driver.
     * @returns {Bool}
     */
PE.isDriver = function() {}
    /**
     * Check if the file is a .NET application.
     * @returns {Bool}
     */
PE.isNET = function() {}
    /**
     * Check if there is an overlay in the file.
     * @returns {Bool}
     */
PE.isOverlayPresent = function() {}
    /**
     * Check if the file is 64 bit (PE+).
     * @returns {Bool}
     * @example
     * if(PE.isPEPlus())
     * {
     *     sOptions="PE+";
     * }
     */
PE.isPEPlus = function() {}
    /**
     * Check if the file is 64 bit (PE+).
     * @returns {Bool}
     * @example
     * if(PE.is64())
     * {
     *     sOptions="PE+";
     * }
     */
PE.is64 = function() {}
    /**
     * Check if the “Rich” signature is in the file. For more information see {@link http://www.ntcore.com/files/richsign.htm}. It is typical for the files made by the MS Linker.
     * @returns {Bool}
     * @example
     * if(PE.isRichSignaturePresent())
     * {
     *     sName="Microsoft Linker";
     *     bDetected=1;
     * }
     */
PE.isRichSignaturePresent = function() {}
    /**
     * Check if there is a resource with a specific name in the file.
     * @param {String} sName - The name of the resource.
     * @returns {Bool}
     * @example
     * if(PE.isResourceNamePresent("PACKAGEINFO"))
     * {
     *     bDetected=1;
     * }
     */
PE.isResourceNamePresent = function(sName) {}
    /**
     * Check if there is a resource group with a specific name in the file.
     * @param {String} sName - The name of the resource group.
     * @returns {Bool}
     */
PE.isResourceGroupNamePresent = function(sName) {}
    /**
     * Check if there is a resource group with a specific ID in the file.
     * @param {int} nID - The ID of the resource group.
     * @returns {Bool}
     */
PE.isResourceGroupIdPresent = function(sName) {}
    /**
     * Check if there is a specific .NET string.
     * @param {String} sString
     * @returns {Bool}
     * @example
     * if(PE.isNETStringPresent(0,"DotfuscatorAttribute"))
     * {
     *     bDetected=1;
     * }
     */
PE.isNETStringPresent = function(sString) {}
    /**
     * Check if there is a specific .NET Unicode string.
     * @param {String} sString
     * @returns {Bool}
     * @example
     * if(PE.isNETUnicodeStringPresent("E_TamperDetected"))
     * {
     *     sVersion="3.X-4.X";
     *     bDetected=1;
     * }
     */
PE.isNETUnicodeStringPresent = function(sString) {}
    /**
     * Check if a function exists in a library.
     * @param {String} sLibraryName - The name of the library.
     * @param {String} sFunctionName - The name of the function.
     * @returns {Bool}
     */
PE.isLibraryFunctionPresent = function(sLibraryName, sFunctionName) {}
    /**
     * Check if a library is imported.
     * @param {String} sLibraryName - The name of the library.
     * @returns {Bool}
     * @example
     * if(PE.isLibraryPresent("MSVBVM50.DLL"))
     * {
     *     sVersion="5.0";
     *     bDetected=1;
     * }
     */
PE.isLibraryPresent = function(sLibraryName) {}
    /**
     * Check if a signature (see {@link Binary.compare}) exists in a section.
     * @param {Int} nSection - Section number (from 0).
     * @param {String} sSignature - Signature.
     * @returns {Bool}
     * @example
     * if(PE.isSignatureInSectionPresent(0,"'ENIGMA'"))
     * {
     *     bDetected=1;
     * }
     */
PE.isSignatureInSectionPresent = function(nSection, sSignature) {}
    /**
     * @see Binary.isSignaturePresent
     */
PE.isSignaturePresent = function(nOffset, nSize, sSignature) {}
    /**
     * Convert a file offset to a relative virtual address (RVA).
     * @param {UInt64} nOffset
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
PE.OffsetToRVA = function(nOffset) {}
    /**
     * Convert a file offset to a virtual address (VA).
     * @param {UInt64} nOffset
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
PE.OffsetToVA = function(nOffset) {}
    /**
     * @see Binary.readByte
     */
PE.readByte = function(nOffset) {}
    /**
     * @see Binary.readDword
     */
PE.readDword = function(nOffset) {}
    /**
     * @see Binary.readQword
     */
ELF.readQword = function(nOffset) {}
    /**
     * @see Binary.readWord
     */
PE.readWord = function(nOffset) {}
    /**
     * @see Binary.readSByte
     */
PE.readSByte = function(nOffset) {}
    /**
     * @see Binary.readSDword
     */
PE.readSDword = function(nOffset) {}
    /**
     * @see Binary.readSQword
     */
PE.readSQword = function(nOffset) {}
    /**
     * @see Binary.readSWord
     */
PE.readSWord = function(nOffset) {}
    /**
     * @see Binary.swapBytes
     */
PE.swapBytes = function(nValue) {}
    /**
     * Convert a relative virtual address (RVA) to a file offset.
     * @param {UInt64} nRVA
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
PE.RVAToOffset = function(nRVA) {}
    /**
     * Convert a virtual address (VA) to a file offset.
     * @param {UInt64} nVA
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
PE.VAToOffset = function(nVA) {}
    /**
     * @see Binary.getString
     */
PE.getString = function(nOffset, nSize) {}
    /**
     * Get the value associated with a version resource string key.
     * @param {String} sKey
     * @returns {String}
     */
PE.getVersionStringInfo = function(sKey) {}
    /**
     * Check if there is an MSDOS stub.
     * @returns {Bool}
     */
PE.isDosStubPresent = function() {}
    /**
     * Get the file offset of the MSDOS stub.
     * @returns {UInt}
     */
PE.getDosStubOffset = function() {}
    /**
     * Get the size of the MSDOS stub.
     * @returns {UInt}
     */
PE.getDosStubSize = function() {}
    /**
     * Get the number of resources.
     * @returns {UInt}
     */
PE.getNumberOfResources = function() {}
    /**
     * Get the offset of a resource.
     * @param {UInt} nNumber - Number of resource.
     * @returns {Int} If an error occurs, -1 will be returned.
     */
PE.getResourceOffsetByNumber = function(nNumber) {}
    /**
     * Get the size of a resource.
     * @param {UInt} nNumber - Number of resource.
     * @returns {Int}
     */
PE.getResourceSizeByNumber = function(nNumber) {}
    /**
     * Get the Id of a resource.
     * @param {UInt} nNumber - Number of resource.
     * @returns {UInt}
     */
PE.getResourceIdByNumber = function(nNumber) {}
    /**
     * Get the name of a resource.
     * @param {UInt} nNumber - Number of resource.
     * @returns {String}
     */
PE.getResourceNameByNumber = function(nNumber) {}
    /**
     * Get the type of a resource.
     * @param {UInt} nNumber - Number of resource.
     * @returns {String}
     * @example
     * if(PE.getResourceTypeByNumber(0)=="RT_MANIFEST")
     * {
     *     bDetected=1;
     * }
     */
PE.getResourceTypeByNumber = function(nNumber) {}
    /**
     * Get the number of the section containing the export table.
     * @returns {Int} If no export returns <code>-1</code>.
     */
PE.getExportSection = function() {}
    /**
     * Get the number of the section containing the relocations.
     * @returns {Int} If no relocations returns <code>-1</code>.
     */
PE.getRelocsSection = function() {}
    /**
     * Get the number of the section containing the resources.
     * @returns {Int} If no resources returns <code>-1</code>.
     */
PE.getResourceSection = function() {}
    /**
     * Get the number of the section containing the TLS.
     * @returns {Int} If no TLS returns <code>-1</code>.
     */
PE.getTLSSection = function() {}
    /**
     * Get the number of the Rich IDs.
     * @returns {UInt}
     */
PE.getNumberOfRichIDs = function() {}
    /**
     * Check if there is a Rich version.
     * @param {UInt} nVersion - Rich version.
     * @returns {Bool}
     */
PE.isRichVersionPresent = function(nVersion) {}
    /**
     * Check if there is a digital signature.
     * @returns {Bool}
     */
PE.isSignedFile = function() {}
    /**
     * Get the offset of the entry point.
     * @returns {Int64} If an error occurs, -1 will be returned.
     */
PE.getEntryPointOffset = function() {}
    /**
     * @see Binary.getFileBaseName
     */
PE.getFileBaseName = function() {}
    /**
     * @see Binary.getFileSuffix
     */
PE.getFileSuffix = function() {}
    /**
     * @see Binary.getFileCompleteSuffix
     */
PE.getFileCompleteSuffix = function() {}
    /**
     * Check if Export presents.
     * @returns {Bool}
     */
PE.isExportPresent = function() {}
    /**
     * Check if TLS presents.
     * @returns {Bool}
     */
PE.isTLSPresent = function() {}
    /**
     * Check if Import presents.
     * @returns {Bool}
     */
PE.isImportPresent = function() {}
    /**
     * Check if Resources presents.
     * @returns {Bool}
     */
PE.isResourcesPresent = function() {}
    /**
     * Check if Export function exists with a specific name.
     * @param {String} sFunctionName - Function name
     * @returns {Bool}
     */
PE.isExportFunctionPresent = function() {}
    /**
     * Check if Export function matches a regular expression.
     * @param {String} sFunctionName - Function pattern
     * @returns {Bool}
     */
PE.isExportFunctionPresentExp = function() {}

================================================
FILE: help/PE.md
================================================
# PE (Portable Executable) Class Reference

The PE class provides specialized analysis capabilities for Windows Portable Executable (PE) files, including EXE, DLL, and SYS files.

## Inheritance
* **Inherits from Binary class** - All Binary class functions are available with PE prefix (e.g., `Binary.compareEP` → `PE.compareEP`)
* **Inherits from MSDOS class** - All MSDOS class functions are available with PE prefix (e.g., `MSDOS.isDosStubPresent` → `PE.isDosStubPresent`)

## Table of Contents
- [File Format Detection](#file-format-detection)
- [Section Management](#section-management)
- [Import Table Operations](#import-table-operations)
- [Export Table Operations](#export-table-operations)
- [Resource Management](#resource-management)
- [.NET Framework Support](#net-framework-support)
- [Version Information](#version-information)
- [Linker Information](#linker-information)
- [File Properties](#file-properties)
- [Advanced Analysis](#advanced-analysis)
- [Real-World PE Detection Examples](#real-world-pe-detection-examples)

## File Format Detection

### Basic PE Detection
**`bool isPEPlus()`** - Check if the file is PE32+ (64-bit) format.

**`bool isDll()`** - Check if the file is a Dynamic Link Library (DLL).

**`bool isDriver()`** - Check if the file is a device driver.

**`bool isConsole()`** - Check if the file is a console application.

### .NET Detection
**`bool isNET()`** - Check if the file contains .NET metadata.

**`QString getNETVersion()`** - Get the .NET Framework version.

**Examples:**
```javascript
if (PE.isNET()) {
    var netVersion = PE.getNETVersion();
    sInfo = ".NET " + netVersion;
    
    // Check for specific .NET features
    if (PE.isNetTypePresent("System.Windows.Forms", "Form")) {
        sFramework = "Windows Forms";
    } else if (PE.isNetTypePresent("System.Windows", "Window")) {
        sFramework = "WPF";
    }
}

if (PE.isDll()) {
    sType = "Dynamic Link Library";
    
    // Check if it's a .NET assembly
    if (PE.isNET()) {
        sType += " (.NET Assembly)";
    }
}

// Detailed architecture detection
if (PE.isPEPlus()) {
    sArchitecture = "x64 (PE32+)";
} else {
    sArchitecture = "x86 (PE32)";
}

// Check for specific PE characteristics
if (PE.isConsole()) {
    sSubsystem = "Console";
} else {
    sSubsystem = "Windows GUI";
}

if (PE.isDriver()) {
    sType = "Device Driver";
}
```

## Section Management

### Section Information
**`quint16 getNumberOfSections()`** - Get the total number of sections in the PE file.

**`QString getSectionName(quint32 nNumber)`** - Get the name of a specific section.

**`quint32 getSectionVirtualSize(quint32 nNumber)`** - Get the virtual size of a section.

**`quint32 getSectionVirtualAddress(quint32 nNumber)`** - Get the virtual address of a section.

**`quint32 getSectionFileSize(quint32 nNumber)`** - Get the raw data size of a section.

**`quint32 getSectionFileOffset(quint32 nNumber)`** - Get the file offset of a section.

**`quint32 getSectionCharacteristics(quint32 nNumber)`** - Get the characteristics flags of a section.

### Section Lookup and Validation
**`bool isSectionNamePresent(QString sSectionName)`** - Check if a section with the given name exists.

**`bool isSectionNamePresentExp(QString sSectionName)`** - Check if a section name exists using expression matching.

**`qint32 getSectionNumber(QString sSectionName)`** - Get the section number by name.

**`qint32 getSectionNumberExp(QString sSectionName)`** - Get the section number using expression matching.

**`QString getSectionNameCollision(QString sString1, QString sString2)`** - Check for section name collisions.

### Special Section Detection
**`qint32 getImportSection()`** - Get the section number containing the import table.

**`qint32 getExportSection()`** - Get the section number containing the export table.

**`qint32 getResourceSection()`** - Get the section number containing resources.

**`qint32 getEntryPointSection()`** - Get the section number containing the entry point.

**`qint32 getRelocsSection()`** - Get the section number containing relocations.

**`qint32 getTLSSection()`** - Get the section number containing Thread Local Storage.

**Examples:**
```javascript
var numSections = PE.getNumberOfSections();
for (var i = 0; i < numSections; i++) {
    var sectionName = PE.getSectionName(i);
    var virtualSize = PE.getSectionVirtualSize(i);
    
    if (sectionName == ".text") {
        var codeSize = virtualSize;
    }
}

if (PE.isSectionNamePresent(".rsrc")) {
    var resourceSection = PE.getSectionNumber(".rsrc");
}
```

## Import Table Operations

### Import Information
**`qint32 getNumberOfImports()`** - Get the number of imported libraries.

**`QString getImportLibraryName(quint32 nNumber)`** - Get the name of an imported library.

**`qint32 getNumberOfImportThunks(quint32 nNumber)`** - Get the number of functions imported from a library.

**`QString getImportFunctionName(quint32 nImport, quint32 nFunctionNumber)`** - Get the name of an imported function.

### Import Detection
**`bool isImportPresent()`** - Check if the file has an import table.

**`bool isLibraryPresent(QString sLibraryName, bool bCheckCase=false)`** - Check if a specific library is imported.

**`bool isLibraryFunctionPresent(QString sLibraryName, QString sFunctionName)`** - Check if a specific function is imported from a library.

### Import Hashing
**`quint32 getImportHash32()`** - Calculate 32-bit hash of import table.

**`quint64 getImportHash64()`** - Calculate 64-bit hash of import table.

**`bool isImportPositionHashPresent(qint32 nIndex, quint32 nHash)`** - Check if a specific import hash exists at position.

**Examples:**
```javascript
if (PE.isImportPresent()) {
    var numImports = PE.getNumberOfImports();
    
    for (var i = 0; i < numImports; i++) {
        var libName = PE.getImportLibraryName(i);
        
        if (libName.toLowerCase().includes("kernel32")) {
            var numFunctions = PE.getNumberOfImportThunks(i);
            
            // Analyze specific kernel32 functions
            for (var j = 0; j < numFunctions; j++) {
                var funcName = PE.getImportFunctionName(i, j);
                if (funcName == "VirtualProtect" || funcName == "VirtualAlloc") {
                    bMemoryManipulation = true;
                }
            }
        }
    }
}

// Check for specific libraries and functions
if (PE.isLibraryPresent("user32.dll")) {
    if (PE.isLibraryFunctionPresent("user32.dll", "MessageBoxA")) {
        bUsesMessageBox = true;
    }
    if (PE.isLibraryFunctionPresent("user32.dll", "SetWindowsHookExA")) {
        bUsesHooks = true;
    }
}

// Advanced import analysis for malware detection
if (PE.isLibraryPresent("ntdll.dll")) {
    var ntdllFunctions = ["NtCreateFile", "NtWriteFile", "NtReadFile"];
    var ntdllCount = 0;
    
    for (var i = 0; i < ntdllFunctions.length; i++) {
        if (PE.isLibraryFunctionPresent("ntdll.dll", ntdllFunctions[i])) {
            ntdllCount++;
        }
    }
    
    if (ntdllCount > 2) {
        bUsesNativAPI = true;
        sSuspiciousLevel = "High";
    }
}

// Calculate and analyze import hash
var importHash32 = PE.getImportHash32();
sImportHash = importHash32.toString(16).toUpperCase();
```

## Export Table Operations

### Export Information
**`bool isExportPresent()`** - Check if the file has an export table.

**`qint32 getNumberOfExportFunctions()`** - Get the number of exported functions.

**`QString getExportFunctionName(quint32 nNumber)`** - Get the name of an exported function.

### Export Detection
**`bool isExportFunctionPresent(QString sFunctionName)`** - Check if a specific function is exported.

**`bool isExportFunctionPresentExp(QString sFunctionName)`** - Check if an exported function exists using expression matching.

**Examples:**
```javascript
if (PE.isExportPresent()) {
    var numExports = PE.getNumberOfExportFunctions();
    
    for (var i = 0; i < numExports; i++) {
        var funcName = PE.getExportFunctionName(i);
        if (funcName.startsWith("Dll")) {
            sDllType = "Custom DLL";
        }
    }
}

if (PE.isExportFunctionPresent("DllMain")) {
    bHasDllMain = true;
}
```

## Resource Management

### Resource Information
**`bool isResourcesPresent()`** - Check if the file contains resources.

**`quint32 getNumberOfResources()`** - Get the total number of resources.

**`quint32 getResourceIdByNumber(quint32 nNumber)`** - Get the resource ID by index.

**`QString getResourceNameByNumber(quint32 nNumber)`** - Get the resource name by index.

**`qint64 getResourceOffsetByNumber(quint32 nNumber)`** - Get the file offset of a resource.

**`qint64 getResourceSizeByNumber(quint32 nNumber)`** - Get the size of a resource.

**`quint32 getResourceTypeByNumber(quint32 nNumber)`** - Get the type of a resource.

### Resource Lookup
**`qint64 getResourceNameOffset(QString sName)`** - Get the offset of a named resource.

**`bool isResourceNamePresent(QString sName)`** - Check if a named resource exists.

**`bool isResourceGroupNamePresent(QString sName)`** - Check if a resource group name exists.

**`bool isResourceGroupIdPresent(quint32 nID)`** - Check if a resource group ID exists.

**Examples:**
```javascript
if (PE.isResourcesPresent()) {
    var numResources = PE.getNumberOfResources();
    
    for (var i = 0; i < numResources; i++) {
        var resourceType = PE.getResourceTypeByNumber(i);
        var resourceSize = PE.getResourceSizeByNumber(i);
        
        if (resourceType == 16) { // RT_VERSION
            sHasVersionInfo = true;
        }
    }
}

if (PE.isResourceNamePresent("MANIFEST")) {
    var manifest = PE.getManifest();
}
```

## .NET Framework Support

### .NET String Detection
**`bool isNETStringPresent(QString sString)`** - Check if a .NET string is present.

**`bool isNETUnicodeStringPresent(QString sString)`** - Check if a .NET Unicode string is present.

**`bool isNetUStringPresent(QString sString)`** - Check if a .NET U-string is present.

### .NET Blob Analysis
**`qint64 findSignatureInBlob_NET(QString sSignature)`** - Find a signature in .NET blob.

**`bool isSignatureInBlobPresent_NET(QString sSignature)`** - Check if a signature exists in .NET blob.

**`bool compareEP_NET(QString sSignature, qint64 nOffset=0)`** - Compare signature at .NET entry point.

### .NET Metadata Analysis
**`bool isNetGlobalCctorPresent()`** - Check if .NET global constructor is present.

**`bool isNetTypePresent(QString sTypeNamespace, QString sTypeName)`** - Check if a .NET type exists.

**`bool isNetMethodPresent(QString sTypeNamespace, QString sTypeName, QString sMethodName)`** - Check if a .NET method exists.

**`bool isNetFieldPresent(QString sTypeNamespace, QString sTypeName, QString sFieldName)`** - Check if a .NET field exists.

**Examples:**
```javascript
if (PE.isNET()) {
    // String-based obfuscator detection
    var obfuscators = ["Confuser", "ConfuserEx", "Babel", "Dotfuscator", "SmartAssembly"];
    for (var i = 0; i < obfuscators.length; i++) {
        if (PE.isNETStringPresent(obfuscators[i])) {
            sObfuscator = obfuscators[i];
            break;
        }
    }
    
    // Framework capability detection
    if (PE.isNetTypePresent("System", "Console")) {
        bUsesConsole = true;
    }
    
    if (PE.isNetTypePresent("System.IO", "File")) {
        bUsesFileIO = true;
    }
    
    if (PE.isNetMethodPresent("System.IO", "File", "ReadAllText")) {
        bReadsFiles = true;
    }
    
    // Cryptography detection
    if (PE.isNetTypePresent("System.Security.Cryptography", "AES")) {
        bUsesCrypto = true;
        sCryptoType = "AES";
    }
    
    // Network capabilities
    if (PE.isNetTypePresent("System.Net", "WebClient")) {
        bNetworkCapable = true;
    }
    
    // Anti-debugging detection
    if (PE.isNetMethodPresent("System.Diagnostics", "Debugger", "IsAttached")) {
        bAntiDebug = true;
    }
    
    // Reflection usage (potential packer/obfuscator)
    if (PE.isNetTypePresent("System.Reflection", "Assembly")) {
        bUsesReflection = true;
    }
}
```

## Version Information

### File Version
**`QString getFileVersion()`** - Get the file version from version info.

**`QString getFileVersionMS()`** - Get the Microsoft-style file version.

**`QString getPEFileVersion(QString sFileName)`** - Get version of a specific PE file.

### Version String Information
**`QString getVersionStringInfo(QString sKey)`** - Get version string information by key.

**Common version keys:**
- `CompanyName`
- `FileDescription`
- `FileVersion`
- `ProductName`
- `ProductVersion`
- `LegalCopyright`
- `OriginalFilename`

**Examples:**
```javascript
var fileVersion = PE.getFileVersion();
var companyName = PE.getVersionStringInfo("CompanyName");
var productName = PE.getVersionStringInfo("ProductName");

if (companyName.includes("Microsoft")) {
    bMicrosoftFile = true;
}
```

## Linker Information

### Linker Version
**`quint8 getMajorLinkerVersion()`** - Get the major linker version.

**`quint8 getMinorLinkerVersion()`** - Get the minor linker version.

**`QString getCompilerVersion()`** - Get the compiler version information.

### Header Information
**`quint64 getImageFileHeader(QString sString)`** - Get IMAGE_FILE_HEADER field value.

**`quint64 getImageOptionalHeader(QString sString)`** - Get IMAGE_OPTIONAL_HEADER field value.

**`qint64 calculateSizeOfHeaders()`** - Calculate the total size of headers.

### Code and Data Sizes
**`quint32 getSizeOfCode()`** - Get the size of code section.

**`quint32 getSizeOfUninitializedData()`** - Get the size of uninitialized data.

**Examples:**
```javascript
var majorLinker = PE.getMajorLinkerVersion();
var minorLinker = PE.getMinorLinkerVersion();
var linkerVersion = majorLinker + "." + minorLinker;

var codeSize = PE.getSizeOfCode();
var headerSize = PE.calculateSizeOfHeaders();
```

## File Properties

### Security and Signing
**`bool isSignedFile()`** - Check if the file is digitally signed.

### Special Features
**`bool isTLSPresent()`** - Check if Thread Local Storage is present.

**`QString getManifest()`** - Get the embedded manifest content.

### General Options
**`QString getGeneralOptions()`** - Get general PE file options and characteristics.

**Examples:**
```javascript
if (PE.isSignedFile()) {
    sSecurity = "Digitally Signed";
}

if (PE.isTLSPresent()) {
    bUsesTLS = true;
}

var manifest = PE.getManifest();
if (manifest.includes("requireAdministrator")) {
    bRequiresAdmin = true;
}
```

## Advanced Analysis

### Hash Analysis
Functions for calculating and comparing import hashes for malware analysis and similarity detection.

### Metadata Inspection
Deep analysis of .NET metadata for understanding application structure and dependencies.

### Section Analysis
Detailed examination of PE sections for packing detection and code analysis.

### Resource Extraction
Access to embedded resources including version information, icons, and manifests.

## Real-World PE Detection Examples

This section contains practical examples from the DIE PE signature database showing how to use PE class methods for analyzing Windows executables.

### Packer Detection

#### UPX Packer Detection
```javascript
// UPX detection with import analysis
function detectUPX() {
    var nNumberOfFunctions = PE.getNumberOfImportThunks(0);
    
    if (nNumberOfFunctions > 1 && nNumberOfFunctions < 7) {
        if (PE.getSizeOfCode() && PE.getSizeOfUninitializedData() && 
            PE.getNumberOfSections() > 2) {
            
            var funcCounter = 0;
            
            // Check for typical UPX import functions
            if (PE.getImportFunctionName(0, 0) == "LoadLibraryA") {
                funcCounter++;
            }
            if (PE.getImportFunctionName(0, 1) == "GetProcAddress") {
                funcCounter++;
            }
            
            if (nNumberOfFunctions == 4) {
                if (PE.getImportFunctionName(0, 2) == "VirtualProtect") {
                    funcCounter++;
                }
                if (PE.getImportFunctionName(0, 3) == "ExitProcess") {
                    funcCounter++;
                }
            }
            
            if (funcCounter >= 2) {
                sName = "UPX";
                sType = "packer";
                bDetected = true;
            }
        }
    }
}
```

#### ASPack Packer Detection
```javascript
// ASPack detection with entry point pattern matching
function detectASPack() {
    var nOffset = PE.getEntryPointOffset();
    
    if (PE.compare("60E8000000005D81ED........B8........03C5", nOffset)) {
        sName = "ASPack";
        sVersion = "1.00b-1.07b";
        bDetected = true;
    } else if (PE.compare("60E8000000005D............BB........03DD", nOffset)) {
        sName = "ASPack";
        sVersion = "1.08.03";
        bDetected = true;
    } else if (PE.compare("60E870050000EB4C", nOffset)) {
        sName = "ASPack";
        sVersion = "2.000";
        bDetected = true;
    } else if (PE.compare("60E93D040000", nOffset)) {
        sName = "ASPack";
        sVersion = "2.11";
        bDetected = true;
    }
}
```

#### VMProtect Detection
```javascript
// VMProtect detection using section analysis
function detectVMProtect() {
    if (PE.isNET()) return; // Native files only
    
    var nNumberOfSections = PE.getNumberOfSections();
    
    for (var i = nNumberOfSections - 1; i >= 0; i--) {
        if (i == PE.getRelocsSection() || i == PE.getResourceSection()) {
            continue;
        }
        
        var sectionName = PE.getSectionName(i);
        
        if (i > 0 && sectionName == ".vmp0") {
            sName = "VMProtect";
            bDetected = true;
            break;
        } else if (i > 1 && sectionName.substr(sectionName.length - 1) == "1") {
            var sCollision = PE.getSectionNameCollision("0", "1");
            
            if (PE.isSectionNamePresent(sCollision + "1")) {
                sName = "VMProtect";
                bDetected = true;
                break;
            }
        }
    }
}
```

### Compiler Detection

#### Microsoft Visual C++ Detection
```javascript
// Comprehensive Microsoft compiler detection
function detectMicrosoftCompiler() {
    var linkerMajor = PE.getMajorLinkerVersion();
    var linkerMinor = PE.getMinorLinkerVersion();
    
    // Rich signature analysis for detailed version detection
    var richSignatureOffset = PE.findSignature(0, 0x1000, "52696368"); // "Rich"
    if (richSignatureOffset != -1) {
        sName = "Microsoft Visual C++";
        
        // Map linker versions to Visual Studio versions
        var linkerVersion = linkerMajor + "." + linkerMinor;
        switch (linkerVersion) {
            case "6.0": sVersion = "6.0 (VC 6.0)"; break;
            case "7.0": sVersion = "2002 (VC 7.0)"; break;
            case "7.1": sVersion = "2003 (VC 7.1)"; break;
            case "8.0": sVersion = "2005 (VC 8.0)"; break;
            case "9.0": sVersion = "2008 (VC 9.0)"; break;
            case "10.0": sVersion = "2010 (VC 10.0)"; break;
            case "11.0": sVersion = "2012 (VC 11.0)"; break;
            case "12.0": sVersion = "2013 (VC 12.0)"; break;
            case "14.0": sVersion = "2015 (VC 14.0)"; break;
            case "14.1": sVersion = "2017 (VC 14.1)"; break;
            case "14.2": sVersion = "2019 (VC 14.2)"; break;
            case "14.3": sVersion = "2022 (VC 14.3)"; break;
        }
        
        bDetected = true;
    }
}
```

#### Delphi Compiler Detection
```javascript
// Delphi/Borland compiler detection
function detectDelphi() {
    if (PE.isNET()) {
        // .NET Delphi detection
        if (PE.isNetTypePresent("Borland.Vcl", "Types")) {
            sName = "Borland Delphi";
            sVersion = "8";
            sOptions = ".NET";
            bDetected = true;
        } else if (PE.isNetTypePresent("Borland.Delphi", "System")) {
            sName = "Borland Delphi";
            sVersion = "8 WinForm";
            sOptions = ".NET";
            bDetected = true;
        }
    } else {
        // Native Delphi detection through section analysis
        var nSectionOffset = PE.getSectionFileOffset(0);
        var nSectionSize = PE.getSectionFileSize(0);
        
        // Look for Delphi runtime signatures
        var delphiSignature = PE.findSignature(nSectionOffset, nSectionSize, "53574156");
        if (delphiSignature != -1) {
            sName = "Borland Delphi";
            
            // Version detection based on specific patterns
            if (PE.findSignature(nSectionOffset, nSectionSize, "4465706869") != -1) {
                // More specific version detection logic here
                sVersion = "7.0+";
            }
            
            bDetected = true;
        }
    }
}
```

### .NET Obfuscator Detection

#### ConfuserEx Detection
```javascript
// ConfuserEx obfuscator detection
function detectConfuserEx() {
    if (!PE.isNET()) return;
    
    // Check for ConfusedByAttribute
    if (PE.isNetTypePresent("", "ConfusedByAttribute")) {
        sName = "Confuser";
        
        // Try to extract version from string
        var nVersionOffset = PE.findString(
            PE.getSectionFileOffset(0), 
            PE.getSectionFileSize(0), 
            "Confuser v"
        );
        
        if (nVersionOffset != -1) {
            sVersion = PE.getString(nVersionOffset + 10);
        } else {
            sVersion = "1.X";
        }
        
        bDetected = true;
    } else if (PE.getNumberOfSections() >= 2) {
        // Check for ConfuserEx signature
        var nVersionOffset = PE.findString(
            PE.getSectionFileOffset(1), 
            PE.getSectionFileSize(1), 
            "ConfuserEx v"
        );
        
        if (nVersionOffset != -1) {
            sName = "ConfuserEx";
            sVersion = PE.getString(nVersionOffset + 12, 7);
            bDetected = true;
        }
    }
}
```

### Installer Detection

#### InstallShield Detection
```javascript
// InstallShield installer detection
function detectInstallShield() {
    // Check entry point signature
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        sName = "InstallShield";
        
        if (PE.isOverlayPresent()) {
            var overlayOffset = PE.getOverlayOffset();
            var nOffset = PE.readByte(overlayOffset) + overlayOffset + 12;
            
            if (PE.compare("135d658c", nOffset)) {
                sVersion = "3.X";
                bDetected = true;
            } else if (PE.compare("'PK'0304", nOffset)) {
                sVersion = "3.X";
                sOptions = "ZIP compressed";
                bDetected = true;
            }
        } else {
            // Check for IS2 resource type
            var numResources = PE.getNumberOfResources();
            for (var i = 0; i < numResources; i++) {
                var resourceType = PE.getResourceTypeByNumber(i);
                if (resourceType == 3000) { // IS2 type
                    var resourceOffset = PE.getResourceOffsetByNumber(i);
                    if (PE.compare("'SZDD'", resourceOffset)) {
                        sVersion = "2.X";
                        bDetected = true;
                        break;
                    }
                }
            }
        }
        
        // Check for cabinet section
        if (PE.isSectionNamePresent("_cabinet")) {
            bDetected = true;
        }
    }
}
```

### Advanced Analysis Examples

#### Import Hash Calculation for Malware Analysis
```javascript
// Calculate import hashes for malware family clustering
function analyzeImportHash() {
    if (!PE.isImportPresent()) return;
    
    var importHash32 = PE.getImportHash32();
    var importHash64 = PE.getImportHash64();
    
    // Known malware family hashes
    var knownHashes = {
        0x1234ABCD: "Emotet variant",
        0x5678EFAB: "TrickBot loader", 
        0x9ABC1234: "Cobalt Strike beacon"
    };
    
    if (knownHashes[importHash32]) {
        sMalwareFamily = knownHashes[importHash32];
        sOptions = "ImpHash: " + importHash32.toString(16);
    }
    
    // Check for suspicious import patterns
    var suspiciousLibs = ["ntdll.dll", "kernel32.dll"];
    var suspiciousFunctions = ["NtCreateFile", "VirtualProtect", "LoadLibraryA"];
    
    var suspiciousCount = 0;
    for (var i = 0; i < suspiciousLibs.length; i++) {
        if (PE.isLibraryPresent(suspiciousLibs[i])) {
            for (var j = 0; j < suspiciousFunctions.length; j++) {
                if (PE.isLibraryFunctionPresent(suspiciousLibs[i], suspiciousFunctions[j])) {
                    suspiciousCount++;
                }
            }
        }
    }
    
    if (suspiciousCount > 2) {
        sFlags = "Potentially suspicious imports";
    }
}
```

#### Section Analysis for Packing Detection
```javascript
// Comprehensive section analysis for packer detection
function analyzeSections() {
    var numSections = PE.getNumberOfSections();
    var suspiciousNames = [".packed", ".upx0", ".upx1", ".aspack", ".vmp0", ".vmp1"];
    var packerIndicators = [];
    
    for (var i = 0; i < numSections; i++) {
        var sectionName = PE.getSectionName(i);
        var virtualSize = PE.getSectionVirtualSize(i);
        var rawSize = PE.getSectionFileSize(i);
        var characteristics = PE.getSectionCharacteristics(i);
        
        // Check for suspicious section names
        for (var j = 0; j < suspiciousNames.length; j++) {
            if (sectionName.toLowerCase().includes(suspiciousNames[j])) {
                packerIndicators.push("Suspicious section: " + sectionName);
            }
        }
        
        // Check for high entropy sections (potential packed code)
        if (rawSize > 0) {
            var entropy = PE.calculateEntropy(
                PE.getSectionFileOffset(i), 
                rawSize
            );
            
            if (entropy > 7.5) {
                packerIndicators.push("High entropy section: " + sectionName);
            }
        }
        
        // Check for executable sections with size anomalies
        if (characteristics & 0x20000000) { // IMAGE_SCN_MEM_EXECUTE
            if (virtualSize > rawSize * 10) {
                packerIndicators.push("Inflated section: " + sectionName);
            }
        }
    }
    
    if (packerIndicators.length > 0) {
        sOptions = packerIndicators.join(", ");
        sPossiblePacker = "Detected";
    }
}
```

#### .NET Metadata Deep Analysis
```javascript
// Deep .NET metadata analysis
function analyzeNETMetadata() {
    if (!PE.isNET()) return;
    
    var netVersion = PE.getNETVersion();
    var frameworkTypes = [
        {namespace: "System", type: "Console", description: "Console operations"},
        {namespace: "System.IO", type: "File", description: "File operations"},
        {namespace: "System.Net", type: "WebClient", description: "Network operations"},
        {namespace: "System.Reflection", type: "Assembly", description: "Reflection capabilities"},
        {namespace: "System.Security.Cryptography", type: "AES", description: "Cryptography"},
        {namespace: "Microsoft.Win32", type: "Registry", description: "Registry access"}
    ];
    
    var capabilities = [];
    for (var i = 0; i < frameworkTypes.length; i++) {
        var type = frameworkTypes[i];
        if (PE.isNetTypePresent(type.namespace, type.type)) {
            capabilities.push(type.description);
        }
    }
    
    // Check for obfuscation indicators
    var obfuscationIndicators = ["ConfuserEx", "Babel", "Dotfuscator", "SmartAssembly"];
    for (var i = 0; i < obfuscationIndicators.length; i++) {
        if (PE.isNETStringPresent(obfuscationIndicators[i])) {
            sObfuscator = obfuscationIndicators[i];
            break;
        }
    }
    
    // Check for anti-debugging
    if (PE.isNetMethodPresent("System.Diagnostics", "Debugger", "IsAttached")) {
        capabilities.push("Anti-debugging");
    }
    
    sCapabilities = capabilities.join(", ");
    sNETVersion = netVersion;
}
```

## Usage Examples

### Basic PE Analysis
```javascript
// Check if file is a PE
if (PE.isPEPlus()) {
    sArchitecture = "x64";
} else {
    sArchitecture = "x86";
}

// Analyze sections
var textSection = PE.getSectionNumber(".text");
if (textSection != -1) {
    var codeSize = PE.getSectionVirtualSize(textSection);
}

// Check imports
if (PE.isLibraryPresent("ntdll.dll")) {
    if (PE.isLibraryFunctionPresent("ntdll.dll", "NtCreateFile")) {
        bUsesNativeAPI = true;
    }
}
```

### .NET Analysis
```javascript
if (PE.isNET()) {
    var netVersion = PE.getNETVersion();
    
    // Check for obfuscation
    if (PE.isNETStringPresent("ConfuserEx") || 
        PE.isNETStringPresent("Babel")) {
        sObfuscator = "Detected";
    }
    
    // Analyze types
    if (PE.isNetTypePresent("System.Net", "WebClient")) {
        bNetworkCapable = true;
    }
}
```

### Malware Analysis
```javascript
// Calculate import hash for similarity analysis
var importHash32 = PE.getImportHash32();

// Check for suspicious sections
if (PE.isSectionNamePresent(".packed") || 
    PE.isSectionNamePresent("UPX0")) {
    sPacker = "Detected";
}

// Analyze exports for DLL classification
if (PE.isExportPresent()) {
    var numExports = PE.getNumberOfExportFunctions();
    if (numExports > 100) {
        sClassification = "Library";
    }
}
```


================================================
FILE: help/PYC.md
================================================
# PYC Class Reference

* You could use all functions from Binary class but with PYC prefix (Binary.compare -> PYC.compare)

**bool isConstPresent(QString sConstValue)**

```
Check if a constant string is present in the Python bytecode constants table.
Returns true if the specified string constant exists in the code object's consts tuple.

Example:
if (PYC.isConstPresent("UPP!1.10")) {
    // UPP packer detected
}
```


================================================
FILE: help/Signatures.md
================================================
# Signature Patterns Reference

This document describes the signature pattern formats used in Detect-It-Easy for binary file detection.

## Table of Contents
- [Basic Signature Format](#basic-signature-format)
- [Wildcard Characters](#wildcard-characters)
- [Special Signatures](#special-signatures)
- [Text Matching](#text-matching)
- [Advanced Patterns](#advanced-patterns)
- [Examples](#examples)

## Basic Signature Format

Signatures are hexadecimal patterns that match byte sequences in files. They can contain:
- **Hexadecimal bytes** - Exact byte values (e.g., `4D 5A`, `FF D8`)
- **Wildcards** - Variable bytes that can match any value
- **Text strings** - ASCII text enclosed in single quotes
- **Special symbols** - Jump distances, addresses, and conditional matches

### Standard Format Examples
```
4D 5A 90 ?? ?? 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00
4D 5A 90 .. .. 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00
'MZ'90....00000004000000FFFF0000B8000000
```

All three examples above are equivalent and match a DOS/PE executable header.

## Wildcard Characters

| Symbol | Description | Example |
|--------|-------------|---------|
| `??` | Any single byte | `4D 5A ?? ??` |
| `..` | Any single byte (alternative) | `4D 5A .. ..` |
| `....` | Any 2 bytes | `4D 5A....` |
| `........` | Any 4 bytes | `FF D8........` |

**Examples:**
```javascript
// Match JPEG header with any app marker
if (Binary.compare("FFD8FFE?")) {
    sName = "JPEG image";
}

// Match PE header with any checksum
if (Binary.compare("4D5A........E8........")) {
    sName = "PE executable";
}
```

## Special Signatures

### Jump Signatures
Used to match relative jumps and calls in executable code.

| Pattern | Description | Example |
|---------|-------------|---------|
| `$$` | 1-byte relative jump | `EB$$` |
| `$$$$` | 2-byte relative jump | `E8$$$$` |
| `$$$$$$$$` | 4-byte relative jump | `E8$$$$$$$$` |

**Examples:**
```javascript
// Match common shellcode pattern
if (Binary.compare("83CDFFEB$$8B1E83EEFC11DB72$$8A0646")) {
    sName = "Shellcode pattern";
}
```

### Address Signatures
Used to match absolute addresses in code.

| Pattern | Description | Example |
|---------|-------------|---------|
| `####` | 2-byte address | `68####` |
| `########` | 4-byte address | `68########` |

**Examples:**
```javascript
// Match PUSH instruction with any address
if (Binary.compare("68########55")) {
    sName = "Common packer pattern";
}
```

### Conditional Wildcards

| Pattern | Description | Usage |
|---------|-------------|-------|
| `**` | Not null byte | `**CDFFEB` |
| `!!` | Not ANSI character | `!!CDFFEB` |
| `__` | Not ANSI and not null | `__CDFFEB` |

**Examples:**
```javascript
// Match non-null byte followed by specific pattern
if (Binary.compare("**4D5A")) {
    // Ensures first byte is not 0x00
}

// Match non-ASCII followed by pattern
if (Binary.compare("!!FFD8")) {
    // Ensures first byte is not printable ASCII
}
```

## Text Matching

Enclose ASCII text in single quotes to match string literals:

```javascript
// SQLite database detection
if (Binary.compare("'SQLite format 3'00")) {
    sName = "SQLite database";
}

// 7-Zip signature
if (Binary.compare("'7z'BCAF271C")) {
    sName = "7-Zip archive";
}

// Mixed text and hex
if (Binary.compare("FFD8FFE0....'JFIF'00")) {
    sName = "JPEG JFIF";
}
```

## Advanced Patterns

### Delta Signatures
Match byte differences rather than absolute values:

```javascript
// Match increasing byte sequence
if (Binary.compare("CD+EB")) {
    // 0xCD followed by any byte >= 0xEB
}
```

### Complex Combinations
```javascript
// Advanced PE detection
if (Binary.compare("4D5A........'PE'0000")) {
    // DOS header + PE signature
    
    // Check for .NET
    if (Binary.compare("........'.text'", 0x18)) {
        sOptions = ".NET";
    }
}

// ZIP file detection with various markers
if (Binary.compare("'PK'0304") || 
    Binary.compare("'PK'0506") || 
    Binary.compare("'PK'0708")) {
    sName = "ZIP archive";
}
```

## Examples

### Executable Formats
```javascript
// Windows PE
if (Binary.compare("4D5A") && Binary.compare("'PE'0000", Binary.read_uint32(0x3C))) {
    sName = "PE executable";
}

// Linux ELF
if (Binary.compare("7F'ELF'")) {
    sName = "ELF executable";
    
    switch (Binary.readByte(4)) {
        case 1: sOptions = "32-bit"; break;
        case 2: sOptions = "64-bit"; break;
    }
}

// macOS Mach-O
if (Binary.compare("FEEDFACE") || Binary.compare("FEEDFACF")) {
    sName = "Mach-O executable";
}
```

### Archive Formats
```javascript
// RAR archive
if (Binary.compare("'Rar!'1A0700")) {
    sVersion = "1.5-4.x";
} else if (Binary.compare("'Rar!'1A070100")) {
    sVersion = "5.0+";
}

// TAR archive (POSIX format)
if (Binary.compare("'ustar'0030", 257)) {
    sName = "TAR archive";
    sOptions = "POSIX format";
}
```

### Media Formats
```javascript
// PNG image
if (Binary.compare("89'PNG'0D0A1A0A")) {
    sName = "PNG image";
    
    // Get dimensions from IHDR
    var width = Binary.read_uint32(16, true);
    var height = Binary.read_uint32(20, true);
    sOptions = width + "x" + height;
}

// MP3 audio
if (Binary.compare("'ID3'") || Binary.compare("FFF?")) {
    sName = "MP3 audio";
    
    if (Binary.compare("'ID3'")) {
        var version = Binary.readByte(3) + "." + Binary.readByte(4);
        sOptions = "ID3v" + version;
    }
}
```

### Database Files
```javascript
// Microsoft Access
if (Binary.compare("'Standard Jet DB'")) {
    sName = "Microsoft Access database";
}

// MySQL MyISAM
if (Binary.compare("FE000001")) {
    sName = "MySQL MyISAM table";
}
```

This signature system provides powerful pattern matching capabilities for accurate file format detection across a wide range of binary file types.

================================================
FILE: help/Util.md
================================================
# Util (Utility Functions) Class Reference

The Util class provides mathematical and utility functions for script operations, particularly useful for bit manipulation and time formatting.

## Table of Contents
- [Bit Manipulation Functions](#bit-manipulation-functions)
- [Division Functions](#division-functions)
- [Time Formatting](#time-formatting)

## Bit Manipulation Functions

### Unsigned 64-bit Shift Operations

#### shlu64()
**`quint64 shlu64(quint64 nValue, quint64 nShift)`** - Perform unsigned left bit shift on 64-bit value.

**Parameters:**
* `nValue` - The value to shift
* `nShift` - Number of positions to shift left

**Returns:** Result of left shift operation

#### shru64()
**`quint64 shru64(quint64 nValue, quint64 nShift)`** - Perform unsigned right bit shift on 64-bit value.

**Parameters:**
* `nValue` - The value to shift
* `nShift` - Number of positions to shift right

**Returns:** Result of right shift operation

### Signed 64-bit Shift Operations

#### shl64()
**`qint64 shl64(qint64 nValue, qint64 nShift)`** - Perform signed left bit shift on 64-bit value.

**Parameters:**
* `nValue` - The signed value to shift
* `nShift` - Number of positions to shift left

**Returns:** Result of signed left shift operation

#### shr64()
**`qint64 shr64(qint64 nValue, qint64 nShift)`** - Perform signed right bit shift on 64-bit value.

**Parameters:**
* `nValue` - The signed value to shift
* `nShift` - Number of positions to shift right

**Returns:** Result of signed right shift operation (arithmetic shift)

**Examples:**
```javascript
// Left shift operations
var value1 = Util.shlu64(0x12345678, 8);  // Shift left by 8 bits
var value2 = Util.shl64(-1000, 2);        // Signed left shift

// Right shift operations  
var value3 = Util.shru64(0xFFFFFFFF00000000, 32); // Unsigned right shift
var value4 = Util.shr64(-1000, 2);                // Signed arithmetic right shift

// Bit manipulation example
var extractHigh32 = Util.shru64(fullValue, 32);
var extractLow32 = fullValue & 0xFFFFFFFF;
```

## Division Functions

### divu64()
**`Util.divu64(quint64 nDividend, quint64 nDivisor)`** - Perform unsigned 64-bit division.

**Parameters:**
* `nDividend` - The unsigned dividend
* `nDivisor` - The unsigned divisor

**Returns:** Result of unsigned division

### div64()
**`Util.div64(qint64 nDividend, qint64 nDivisor)`** - Perform signed 64-bit division.

**Parameters:**
* `nDividend` - The signed dividend
* `nDivisor` - The signed divisor

**Returns:** Result of signed division

**Examples:**
```javascript
// Unsigned division
var result1 = Util.divu64(0xFFFFFFFFFFFFFFFF, 1000);

// Signed division
var result2 = Util.div64(-5000000000, 1000);

// Safe division with check
if (divisor != 0) {
    var quotient = Util.div64(dividend, divisor);
    _log("Result: " + quotient);
}
```

## Time Formatting

### secondsToTimeStr()
**`QString secondsToTimeStr(qint32 nValue)`** - Convert seconds to human-readable time string.

**Parameters:**
* `nValue` - Time value in seconds

**Returns:** Formatted time string (e.g., "1h 23m 45s")

**Examples:**
```javascript
// Format various time durations
var time1 = Util.secondsToTimeStr(3661);    // "1h 1m 1s"
var time2 = Util.secondsToTimeStr(90);      // "1m 30s"
var time3 = Util.secondsToTimeStr(45);      // "45s"

// Usage in file analysis
var timestamp = Binary.read_uint32(0x10);
if (timestamp > 0) {
    var timeStr = Util.secondsToTimeStr(timestamp);
    sOptions = "duration: " + timeStr;
}

// Calculate file processing time
var processingTime = Util.secondsToTimeStr(endTime - startTime);
_log("Processing completed in " + processingTime);
```

These utility functions are essential for low-level binary analysis and data manipulation in signature scripts.


================================================
FILE: help/ZIP.md
================================================
###This is a description of the ZIP class.

* You could use all functions from Binary class but with ZIP prefix (Binary.compareEP -> ZIP.compareEP)

**bool isArchiveRecordPresent(QString sArchiveRecord)**

```
```



================================================
FILE: peid_rules/PE/compiler.userdb.txt
================================================
; PEiD signature database - compiler
; Auto-categorized from userdb.txt (429 entries)

[* PseudoSigner 0.1 [Borland Delphi 3.0]
signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]
signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8
ep_only = true

[* PseudoSigner 0.1 [LCC Win32 1.x]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9
ep_only = true

[* PseudoSigner 0.1 [LCC Win32 DLL]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]
signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 6.20]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [MinGW GCC 2.x]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9
ep_only = true

[* PseudoSigner 0.1 [WATCOM C/C++ EXE]
signature = E9 00 00 00 00 90 90 90 90 57 41 E9
ep_only = true

[* PseudoSigner 0.2 [Borland C++ 1999]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3
ep_only = true

[* PseudoSigner 0.2 [Borland C++ DLL (Method 2)]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90
ep_only = true

[* PseudoSigner 0.2 [Borland Delphi DLL]
signature = 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00
ep_only = true

[* PseudoSigner 0.2 [Borland Delphi Setup Module]
signature = 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [LCC Win32 1.x]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50
ep_only = true

[* PseudoSigner 0.2 [LCC Win32 DLL]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true

[* PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00
ep_only = true

[* PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84
ep_only = true

[* PseudoSigner 0.2 [MinGW GCC 2.x]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45
ep_only = true

[* PseudoSigner 0.2 [Watcom C/C++ DLL]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1
ep_only = true

[* PseudoSigner 0.2 [WATCOM C/C++ EXE]
signature = E9 00 00 00 00 90 90 90 90 57 41
ep_only = true

[.NET DLL -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25
ep_only = true

[.NET executable]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[.NET executable]
signature = FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10
ep_only = true

[.NET executable -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25
ep_only = true

[AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8
ep_only = true

[AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8
ep_only = true

[Borland C / Borland Builder]
signature = 3B CF 76 05 2B CF FC F3 AA 59
ep_only = true

[Borland C++]
signature = A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F
ep_only = true

[Borland C++]
signature = EB J3 53 51 06 33 C0 50 9A ?? ?? ?? ?? 58 07 59 5B 9A
ep_only = true

[Borland C++]
signature = A1 ?? ?? ?? ?? C1 E0 02 A3
ep_only = true

[Borland C++ 1991]
signature = 2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F
ep_only = true

[Borland C++ 1992, 1994]
signature = 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06
ep_only = true

[Borland C++ 1994]
signature = 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9
ep_only = true

[Borland C++ DLL]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 80 ?? ?? ?? ?? ?? ?? 74
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52
ep_only = true

[Borland C++ for Win16 1991]
signature = 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00
ep_only = true

[Borland C++ for Win32 1994]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF
ep_only = true

[Borland C++ for Win32 1994]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74
ep_only = true

[Borland C++ for Win32 1995]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76
ep_only = true

[Borland C++ for Win32 1999]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2
ep_only = true

[Borland Delphi]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D
ep_only = true

[Borland Delphi]
signature = 55 8B EC 83 C4 F4
ep_only = true

[Borland Delphi]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40
ep_only = true

[Borland Delphi (Component)]
signature = C3 E9 ?? ?? ?? FF 8D 40
ep_only = true

[Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00
ep_only = true

[Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00
ep_only = true

[Borland Delphi 3.0 (???)]
signature = 55 8B EC 83
ep_only = true

[Borland Delphi 4.0]
signature = 55 8B EC 83 C4
ep_only = true

[Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00
ep_only = true

[Borland Delphi DLL]
signature = 55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40
ep_only = true

[Borland Delphi DLL]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20
ep_only = true

[Borland Delphi Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8
ep_only = true

[Borland Delphi Setup Module]
signature = 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45
ep_only = true

[Borland Delphi v2.0]
signature = E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3
ep_only = true

[Borland Delphi v2.0]
signature = 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9
ep_only = true

[Borland Delphi v3.0]
signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0
ep_only = true

[Borland Delphi v3.0]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v3.0]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Borland Delphi v3.0]
signature = 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68
ep_only = true

[Borland Delphi v4.0 - v5.0]
signature = 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3
ep_only = true

[Borland Delphi v4.0 - v5.0]
signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3
ep_only = true

[Borland Delphi v5.0 KOL]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Borland Delphi v5.0 KOL]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[Borland Delphi v5.0 KOL]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = true

[Borland Delphi v5.0 KOL/MCK]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v5.0 KOL/MCK]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 83 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v6.0]
signature = 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8
ep_only = true

[Borland Delphi v6.0]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = 55 8B EC 83 C4 F0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = 53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2
ep_only = true

[Borland Delphi v6.0 KOL]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi vx.x (Component)]
signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF
ep_only = true

[Borland Graphics Interface Driver]
signature = 46 42 47 44
ep_only = true

[Borland Pascal 7.0 for Windows]
signature = 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00
ep_only = true

[Borland Pascal v7.0]
signature = B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75
ep_only = true

[Borland Pascal v7.0]
signature = B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E
ep_only = true

[Borland precompiled header file]
signature = 54 50 53
ep_only = true

[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]
signature = 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8
ep_only = true

[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]
signature = 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = true

[Cygwin32]
signature = 55 89 E5 83 EC 04 83 3D
ep_only = true

[Cygwin32]
signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00
ep_only = true

[Delphi v1.0 Unit]
signature = 44 43 55 31
ep_only = true

[Delphi v2.0 Unit]
signature = 44 43 55 32
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00
ep_only = true

[Dev-C++ v4]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF
ep_only = true

[Dev-C++ v5]
signature = 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[Ding Boy's PE-lock Phantasm v0.8]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00
ep_only = true

[Ding Boy's PE-lock Phantasm v1.0 / v1.1]
signature = 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC
ep_only = true

[dUP 2.x Patcher --> www.diablo2oo2.cjb.net]
signature = 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9
ep_only = true

[dUP v2.x Patcher --> www.diablo2oo2.cjb.net]
signature = 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F
ep_only = true

[fasm -> Tomasz Grysztar]
signature = 6A 24
ep_only = true

[fasm -> Tomasz Grysztar]
signature = 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00
ep_only = true

[fasm -> Tomasz Grysztar [flat]]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84
ep_only = true

[FASM v1.3x]
signature = 6A ?? FF 15 ?? ?? ?? ?? A3
ep_only = true

[FASM v1.5x]
signature = 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00
ep_only = true

[FASM v1.5x]
signature = 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FOXPRO DOS, Watcom C 386 Run-Time System]
signature = EB J3 8C D8 8E C0 B8 ?? ?? 8E D8 C7 ?? ?? ?? ?? ?? B8 ?? ?? 2D ?? ?? 3B C4 76 ?? C7 ?? ?? ?? ?? ?? 8F ?? ?? ?? 8F ?? ?? ?? 58
ep_only = true

[Free Pascal 0.99.10]
signature = E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29
ep_only = true

[Free Pascal v0.99.10]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29
ep_only = true

[Free Pascal v0.99.10]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 75
ep_only = true

[Free Pascal v1.0.10 (win32 console)]
signature = C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC
ep_only = true

[Free Pascal v1.0.10 (win32 GUI)]
signature = C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5
ep_only = true

[Free Pascal v1.06]
signature = C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FreeBasic 0.14]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D
ep_only = true

[FreeBASIC 0.16b]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90
ep_only = true

[FreeBASIC v0.11]
signature = E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5
ep_only = true

[FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00
ep_only = true

[FreePascal 2.0.0 Win32]
signature = C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00
ep_only = true

[FreePascal 2.0.0 Win32]
signature = C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00
ep_only = true

[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE
ep_only = true

[FSG v1.10  -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 F3 DD 60 F2 73 A8 C3 45 2E 22 43 C4 FA 15 2E 73 97 BE D5 04 25 A6 D5 E0 FC 54 EC D9 A0 84 C4 04 FA D6 D7 07 3A 14 4F 18 F6 AB D8 88 B8 E7 CB C4 36 B8 51 4E 4B 97 29 7C B4 3F D7 99 BC 66 DA CE 9C AC DD 01 0D 65 6D CD F5 5E F6 8E 7F 36 4F A7 AF 27 C7 70 5
ep_only = true

[FSG v1.10  -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]
signature = EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]
signature = EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]
signature = EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]
signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]
signature = CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]
signature = EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]
signature = EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]
signature = F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]
signature = F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = EB 01 ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]
signature = C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]
signature = B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]
signature = 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]
signature = 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]
signature = E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]
signature = E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 87 FE ?? 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 87 C0 EB ?? 71 ?? 02 D8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]
signature = 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MS Visual C++ / Borland C++ / Watcom C++)]
signature = EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD
ep_only = true

[FSG v1.10 -> dulek/xt -> (Microsoft Visual C++ 7.0)]
signature = EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C
ep_only = true

[Gentee Installer Custom]
signature = 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF
ep_only = true

[Inno Installer v5.1.2] ;collides with: Borland Delphi 2.0 [Overlay]
signature = 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22
ep_only = true

[LamCrypt v1.0 -> LaZaRuS]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8
ep_only = true

[LameCrypt -> LaZaRus]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0
ep_only = true

[LCC Win32 DLL]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true

[LCC Win32 v1.x]
signature = 64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50
ep_only = true

[LCC Win32 v1.x]
signature = 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10
ep_only = true

[LCC-Win32]
signature = 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B
ep_only = true

[MASM / TASM]
signature = 6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00
ep_only = true

[MASM / TASM]
signature = 6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00
ep_only = true

[MASM / TASM]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83
ep_only = true

[MASM/TASM - sig1(h)]
signature = CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = true

[MASM/TASM - sig2(h)]
signature = C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = true

[MASM/TASM - sig4 (h)]
signature = FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = true

[MASM32]
signature = 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20
ep_only = true

[MASM32 / TASM32]
signature = 2B C0 50 E8
ep_only = true

[Metrowerks CodeWarrior (DLL) v2.0]
signature = 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9
ep_only = true

[Metrowerks CodeWarrior v2.0 (Console)]
signature = 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8
ep_only = true

[Metrowerks CodeWarrior v2.0 (GUI)]
signature = 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8
ep_only = true

[Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)]
signature = 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40
ep_only = true

[Microsoft Visual Basic 4.0]
signature = 68 ?? ?? ?? 00 E8 ?? FF FF FF 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual Basic 5.0]
signature = FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
ep_only = true

[Microsoft Visual Basic v5.0]
signature = ?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
ep_only = true

[Microsoft Visual Basic v5.0]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00
ep_only = true

[Microsoft Visual Basic v5.0 - v6.0]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00
ep_only = true

[Microsoft Visual Basic v5.0 - v6.0]
signature = FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF
ep_only = true

[Microsoft Visual Basic v6.0]
signature = FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30
ep_only = true

[Microsoft Visual Basic v6.0 DLL]
signature = 5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF
ep_only = true

[Microsoft Visual Basic v6.0 DLL]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3
ep_only = true

[Microsoft Visual C 2.0]
signature = 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75
ep_only = true

[Microsoft Visual C 2.0]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68
ep_only = true

[Microsoft Visual C 5.0]
signature = 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57
ep_only = true

[Microsoft Visual C# / Basic .NET]
signature = FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Visual C# / Basic .NET]
signature = 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B
ep_only = true

[Microsoft Visual C# v7.0 / Basic .NET]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Visual C++]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00
ep_only = true

[Microsoft Visual C++]
signature = 55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F
ep_only = true

[Microsoft Visual C++]
signature = 8B 44 24 08 56 83 E8 ?? 74 ?? 48 75
ep_only = true

[Microsoft Visual C++]
signature = 8B 44 24 08 83 ?? ?? 74
ep_only = true

[Microsoft Visual C++]
signature = 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25
ep_only = true

[Microsoft Visual C++ (3.0 old crap)]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF
ep_only = true

[Microsoft Visual C++ 4.2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89
ep_only = true

[Microsoft Visual C++ 4.2 (2)]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7
ep_only = true

[Microsoft Visual C++ 4.2 (DLL)]
signature = 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75
ep_only = true

[Microsoft Visual C++ 5.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50
ep_only = true

[Microsoft Visual C++ 6.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83
ep_only = true

[Microsoft Visual C++ 6.0]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 &# 40 ;T RU NC AT ED HE RE &# 41 ;
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 &# 40 ;T RU NC AT ED HE RE &# 41
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3
ep_only = true

[Microsoft Visual C++ 6.0 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E
ep_only = true

[Microsoft Visual C++ 6.0 SFX Custom]
signature = E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50
ep_only = true

[Microsoft Visual C++ 7]
signature = ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83
ep_only = true

[Microsoft Visual C++ 7.0 Custom]
signature = 60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
ep_only = true

[Microsoft Visual C++ 8]
signature = E8 ?? ?? 00 00 E9 ?? ?? FF FF
ep_only = true

[Microsoft Visual C++ 8]
signature = E8 ?? ?? ?? ?? E9
ep_only = true

[Microsoft Visual C++ 8]
signature = ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A ?? FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8
ep_only = true

[Microsoft Visual C++ 8.0]
signature = ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[Microsoft Visual C++ 8.0]
signature = E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
ep_only = true

[Microsoft Visual C++ 8.0]
signature = E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4
ep_only = true

[Microsoft Visual C++ 8.0 (DLL)]
signature = 48 83 EC 28
ep_only = true

[Microsoft Visual C++ 8.0 (DLL)]
signature = 48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48
ep_only = true

[Microsoft Visual C++ 8.0 (MFC)]
signature = 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[Microsoft Visual C++ 8.0 (MFC)]
signature = C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Visual C++ 8.0 [Debug]
signature = C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00
ep_only = true

[Microsoft Visual C++ 8.0 [Debug]]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65
ep_only = true

[Microsoft Visual C++ DLL]
signature = 53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0
ep_only = true

[Microsoft Visual C++ DLL]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C
ep_only = true

[Microsoft Visual C++ DLL]
signature = 53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14
ep_only = true

[Microsoft Visual C++ DLL]
signature = 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2
ep_only = true

[Microsoft Visual C++ DLL]
signature = 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC
ep_only = true

[Microsoft Visual C++ v4.2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57
ep_only = true

[Microsoft Visual C++ v4.2 DLL]
signature = 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08
ep_only = true

[Microsoft Visual C++ v5.0]
signature = 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57
ep_only = true

[Microsoft Visual C++ v5.0 DLL]
signature = ?? ?? 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D
ep_only = true

[Microsoft Visual C++ v5.0 DLL]
signature = ?? ?? 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83
ep_only = true

[Microsoft Visual C++ v6.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57
ep_only = true

[Microsoft Visual C++ v6.0]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22
ep_only = true

[Microsoft Visual C++ v6.0]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 0D ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1C ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v6.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF
ep_only = true

[Microsoft Visual C++ v6.0]
signature = ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 ?? 00
ep_only = true

[Microsoft Visual C++ v6.0 (Debug Version)]
signature = 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Microsoft Visual C++ v6.0 (Debug Version)]
signature = 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? ?? ?? 02
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B
ep_only = true

[Microsoft Visual C++ v6.0 SPx]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 6A ?? 68 ?? ?? ?? ?? E8
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00
ep_only = true

[Microsoft Visual C++ v7.0 (64 Bit)]
signature = ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC
ep_only = true

[Microsoft Visual C++ v7.1 DLL (Debug)]
signature = 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v7.1 EXE]
signature = 6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01
ep_only = true

[Microsoft Visual C++ vx.x]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04
ep_only = true

[Microsoft Visual C++ vx.x]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3
ep_only = true

[Microsoft Visual C++ vx.x]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD
ep_only = true

[Microsoft Visual C++ vx.x DLL]
signature = ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68
ep_only = true

[Microsoft Visual C++ vx.x DLL]
signature = ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3
ep_only = true

[Microsoft Visual Studio .NET]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[MinGW]
signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF
ep_only = true

[MinGW 3.2.x (Dll_WinMain)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00
ep_only = true

[MinGW 3.2.x (WinMain)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D
ep_only = true

[MinGW GCC DLL v2xx]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[MinGW GCC DLL v2xx]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[MinGW GCC v2.x]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00
ep_only = true

[MinGW GCC v2.x]
signature = 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D
ep_only = true

[MinGW v3.2.x (Dll_main)]
signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00
ep_only = true

[MinGW v3.2.x (Dll_WinMain)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3
ep_only = true

[MinGW v3.2.x (Dll_WinMain)]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10
ep_only = true

[MinGW v3.2.x (main)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00
ep_only = true

[MinGW v3.2.x (WinMain)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00
ep_only = true

[MingWin32 GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[MingWin32 GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55
ep_only = true

[MS Visual C++ v.8  (h-good sig, but is it MSVC?)]
signature = E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC
ep_only = true

[MS Visual C++ v.8 DLL (h-small sig1)]
signature = 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC
ep_only = true

[MS Visual C++ v.8 DLL (h-small sig2)]
signature = 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01
ep_only = true

[MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = true

[MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = true

[MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58
ep_only = true

[MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB
ep_only = true

[MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSVC++ DLL v.8 (typical OEP recognized - h)]
signature = 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00
ep_only = true

[NsPacK .Net -> LiuXingPing]
signature = 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C
ep_only = true

[nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping]
signature = FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Packer=UPX Compresor..Gratuito... www.upx.sourceforge.net]
signature = 60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF
ep_only = true

[PE-Exe Executable Image]
signature = 50 45 00 00
ep_only = true

[Pelles C 2.90 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = true

[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74
ep_only = true

[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB
ep_only = true

[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = true

[Pelles C 4.50 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75
ep_only = true

[PowerBASIC/CC 3.0x]
signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85
ep_only = true

[PowerBASIC/CC 4.0]
signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03
ep_only = true

[PowerBASIC/Win 7.0x]
signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00
ep_only = true

[PowerBASIC/Win 8.00]
signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02
ep_only = true

[PseudoSigner 0.1 [Borland Delphi 3.0]
signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]
signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]
signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9
ep_only = true

[Symantec C v2.10, v4.00 or Zortech C v3.0r1]
signature = FA FC B8 ?? ?? 8E D8
ep_only = true

[Symantec C v4.00 + Libraries]
signature = FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26
ep_only = true

[Symantec Visual Cafe v3.0]
signature = 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15
ep_only = true

[Turbo Basic v1.0 1987]
signature = 2E 8C ?? ?? ?? 2E C7
ep_only = true

[Turbo C]
signature = 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06
ep_only = true

[Turbo C 1987]
signature = FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA
ep_only = true

[Turbo C 1987]
signature = FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21
ep_only = true

[Turbo C 1988]
signature = 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC
ep_only = true

[Turbo C 1990 or Turbo C 1988]
signature = BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA
ep_only = true

[Turbo C or Borland C++]
signature = BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA
ep_only = true

[Turbo or Borland Pascal v7.0]
signature = 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68
ep_only = true

[Turbo or Borland Pascal v7.x Unit]
signature = 54 50 55 51 00
ep_only = true

[Turbo Pascal Configuration File]
signature = 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E
ep_only = true

[Turbo Pascal Desktop File]
signature = 54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70
ep_only = true

[Turbo Pascal Help File]
signature = 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50
ep_only = true

[Turbo Pascal v2.0 1984]
signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34
ep_only = true

[Turbo Pascal v3.0 1985]
signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35
ep_only = true

[Turbo Pascal v4.0 Unit]
signature = 54 50 55 30 00
ep_only = true

[Turbo Pascal v5.0 Unit]
signature = 54 50 55 35 00
ep_only = true

[Turbo Pascal v5.5 Unit]
signature = 54 50 55 36 00
ep_only = true

[Turbo Pascal v6.0 Unit]
signature = 54 50 55 39 00
ep_only = true

[Turbo Pascal Version 3.0 1985]
signature = E9 J1 J1 E8 ?? ?? 06 00 ?? ?? ?? 4B 8E 04 85 00 00 04 ?? ?? ?? ?? ?? ?? 80 ?? ?? EC E8 ?? ?? 45 1B ?? ?? ?? A6
ep_only = true

[Upack v0.28 - 0.39 (relocated image base - Delphi, .NET, DLL or something else :) -> Dwing (h)]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C
ep_only = true

[UPX -> www.upx.sourceforge.net]
signature = 60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF
ep_only = true

[UPXFreak v0.1 (Borland Delphi) -> HMX0101]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00
ep_only = true

[WATCOM C 1988, 1989, 1990]
signature = E9 J1 J1 FB 8C C9 BB ?? ?? 8E C1 26 ?? ?? ?? ?? 26 ?? ?? ?? 3D ?? ?? 73 ?? B8 ?? ?? 03 D8 8E D1 8B E3 26 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 8B D3 D1 EA D1 EA D1 EA D1 EA 8B ?? ?? ?? 8C C0 2B C8 3B D1
ep_only = true

[WATCOM C 1991]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 83 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 03 DC
ep_only = true

[WATCOM C Protected Mode (386, 486) 1988-92]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 80 ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC
ep_only = true

[WATCOM C/C++]
signature = BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3
ep_only = true

[WATCOM C/C++]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41
ep_only = true

[Watcom C/C++]
signature = E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00
ep_only = true

[WATCOM C/C++ 16 1994]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 26 BB ?? ?? 83 ?? ?? 80 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 01 E3
ep_only = true

[WATCOM C/C++ 16 1994]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 8? ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC
ep_only = true

[WATCOM C/C++ 32 Run-Time System 1988-1994]
signature = FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21
ep_only = true

[WATCOM C/C++ 32 Run-Time System 1988-1995]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54
ep_only = true

[WATCOM C/C++ DLL]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87
ep_only = true

[Zortech C]
signature = E8 ?? ?? 2E FF ?? ?? ?? FC 06
ep_only = true

[Zortech C]
signature = FA FC B8 ?? ?? ?? 8C C8 8E D8
ep_only = true

[Zortech C v2.00 1988, 1989]
signature = FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E
ep_only = true

[AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3
ep_only = false

[AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15
ep_only = false

[Borland Delphi v6.0 - v7.0]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
ep_only = false

[Borland Delphi v6.0 - v7.0]
signature = 53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8
ep_only = false

[Borland Delphi v6.0 KOL]
signature = 53 8B D8 33 C0 A3 0: ?? ?? :0 6A 00 E8 0: ?? :0 FF A3 0: ?? ?? :0 A1 0: ?? ?? :0 A3 0: ?? ?? :0 33 C0 A3 0: ?? ?? :0 33 C0 A3 0: ?? ?? :0 E8
ep_only = false

[Free Pascal v0.99.10]
signature = C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00
ep_only = false

[FreeBASIC 0.16b]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D
ep_only = false

[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3
ep_only = false

[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8
ep_only = false

[FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01
ep_only = false

[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA
ep_only = false

[MASM / TASM]
signature = 6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00
ep_only = false

[MASM/TASM - sig4 (h)]
signature = C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 C2 0C 00
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3
ep_only = false

[Microsoft Visual C++ 6.0 DLL (Debug)]
signature = 8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00
ep_only = false

[Microsoft Visual C++ 7.0 - 8.0]
signature = 53 56 8B 44 24 18 0B C0 75 18 8B 4C 24 14 8B 44 24 10 33 D2 F7 F1 8B D8 8B 44 24 0C F7 F1 8B D3 EB 41 8B C8 8B 5C 24 14 8B 54 24 10 8B 44 24 0C D1 E9 D1 DB D1 EA D1 D8 0B C9 75 F4 F7 F3 8B F0 F7 64 24 18 8B C8 8B 44 24 14 F7 E6 03 D1 72 0E 3B 54 24 10 77 08 72 07
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00
ep_only = false

[Microsoft Visual C++ 8.0]
signature = 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF ?? ?? ?? ?? 3B C7 59 73 0F 8B 06 85 C0 74 02 FF D0 83 C6 04 3B F7 72 F1
ep_only = false

[Microsoft Visual C++ 8.0]
signature = 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF
ep_only = false

[Microsoft Visual C++ v6.0 DLL]
signature = 8B 44 ?? 08
ep_only = false

[MinGW 3.2.x (main)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00
ep_only = false

[MinGW GCC 2.x]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D
ep_only = false

[MinGW GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55
ep_only = false

[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]
signature = E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00
ep_only = false

[MSVC++ v.8 (procedure 1 recognized - h)]
signature = 55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3
ep_only = false

[Pelles C 2.8.x-4.5.x -> Pelle Orinius]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC
ep_only = false

[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3
ep_only = false

[Pelles C 2.x-4.x DLL -> Pelle Orinius]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10
ep_only = false

[PureBasic 4.x -> Neil Hodgson]
signature = 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3
ep_only = false

[PureBasic 4.x DLL -> Neil Hodgson]
signature = 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3
ep_only = false

[PureBasic DLL -> Neil Hodgson]
signature = 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8
ep_only = false

[Watcom C/C++]
signature = E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20
ep_only = false



================================================
FILE: peid_rules/PE/file_format.userdb.txt
================================================
; PEiD signature database - file_format
; Auto-categorized from userdb.txt (97 entries)

[3DMark Database file]
signature = 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65
ep_only = true

[ADEX Graphics format]
signature = 50 49 43 54 00 08 ?? 02
ep_only = true

[Adlib Sample Audio file]
signature = 47 4F 4C 44 20 53 41 4D 50 4C 45
ep_only = true

[Adobe PDF (Portable document) Version %v3.%v4]
signature = 25 50 44 46 2D V3 2E V4
ep_only = true

[Adobe PhotoShop Graphics format]
signature = 38 42 50 53 00 01 00 00
ep_only = true

[Alias PIX/Vivid IMG Graphics format]
signature = ?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01
ep_only = true

[Alpha BMP graphics file]
signature = FF FF 00 01 64 00 00 00
ep_only = true

[Amiga IFF/ILBM Graphics format]
signature = 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44
ep_only = true

[AT&T Group 4 Graphics format]
signature = 01 00 ?? 00 3A 03
ep_only = true

[AutoDesk Animation file]
signature = ?? ?? ?? 00 12 AF ?? ?? 40 01 C8
ep_only = true

[AutoLogic Graphics format]
signature = FF 04 00 07
ep_only = true

[AVHRR Graphics format]
signature = D5 C8 00 01 00 03 00 01
ep_only = true

[AVI movie file]
signature = 52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54
ep_only = true

[Banner's font file]
signature = AB CD 00
ep_only = true

[CalComp Graphics format]
signature = 02 50 0A
ep_only = true

[CALS Raster graphics format]
signature = 73 72 63 64 6F 63 69 64 3A 20
ep_only = true

[CGM Graphics format]
signature = 00 2A 08 48 69 4A 61 61 6B 20 32
ep_only = true

[CorelDraw 8 CDR Graphics format]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 52 38
ep_only = true

[CorelDraw 8 CDR Graphics format]
signature = 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25
ep_only = true

[CorelDraw CMX Graphics format]
signature = 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31
ep_only = true

[Creative Audio file]
signature = 43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65
ep_only = true

[CubiComp PictureMaker graphics format (blue)]
signature = 36 0C FF 02 00 00 00 00
ep_only = true

[CubiComp PictureMaker graphics format (green)]
signature = 26 0C FF 02 00 00 00 00
ep_only = true

[CubiComp PictureMaker graphics format (red)]
signature = 16 0C FF 02 00 00 00 00
ep_only = true

[DOS32 v.3.3 DOS-Extender and Loader]
signature = 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21
ep_only = true

[DrHalo or DrGenius Image Graphics format]
signature = ?? ?? 3A 03 00 00
ep_only = true

[DrHalo or DrGenius Palette Graphics format]
signature = 41 48 E3 00 00 00 0A 00
ep_only = true

[Encapsulated Postscript graphics file v2.0 EPSF-1.2]
signature = 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32
ep_only = true

[Encapsulated Postscript graphics file v3.0 EPSF-3.0]
signature = 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30
ep_only = true

[Erdas LAN/GIS Image graphics format]
signature = 48 45 41 44 37 34 00 00 03 00
ep_only = true

[FreeHand Graphics format]
signature = 41 47 44 32
ep_only = true

[Frusion -> biff]
signature = 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14
ep_only = true

[GIF87a Graphics format]
signature = 47 49 46 38 37 61
ep_only = true

[GIF89a Graphics format]
signature = 47 49 46 38 39 61
ep_only = true

[Hitachi Raster Format graphics format]
signature = 43 41 44 43 2F 4B 52 20 52 53 54
ep_only = true

[HP-48sx graphics format]
signature = 48 50 48 50 34 38 2D 41
ep_only = true

[HSI JPEG graphics file]
signature = 68 73 69 31 00 00
ep_only = true

[IBM IOCA Graphics format]
signature = 00 11 D3 A6 FB
ep_only = true

[Image Systems Technology Graphics format]
signature = 03 3A ?? ?? 00 ?? 00 00
ep_only = true

[Imaging Technology Graphics format]
signature = 49 4D 00 00
ep_only = true

[Inset Systems PIX Graphics format]
signature = 03 00 ?? 00 00 00 20 00
ep_only = true

[Intel DCX Graphics format]
signature = B1 68 DE 3A 04 10 00
ep_only = true

[Interchange Format File (IFF), type WVQA]
signature = 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44
ep_only = true

[InterGraph Graphics format]
signature = 08 09 FE 01 18 00 00 00
ep_only = true

[JEDMICS CCITT4 Graphics format]
signature = 80 00 00 00 ?? ?? ?? 00
ep_only = true

[JPEG & GIF library file]
signature = 00 05 16 07 00 02 00 00
ep_only = true

[JPEG Graphics format + description]
signature = FF D8 FF FE 00 27
ep_only = true

[Kodak Color management for Windows file]
signature = ?? ?? ?? ?? 4B 43 4D 53
ep_only = true

[LE-Exe Executable Image]
signature = 4C 45
ep_only = true

[Lotus Graphics format]
signature = 01 00 00 00 01 00 08 00
ep_only = true

[Lotus Word Pro document file]
signature = 57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37
ep_only = true

[LX-Exe Executable Image]
signature = 4C 58
ep_only = true

[MacPaint Graphics format]
signature = 00 00 00 02 FF FF FF FF
ep_only = true

[Micrografix Draw Graphics format]
signature = 01 FF 02 04 03 02 00 02
ep_only = true

[Microsoft Access Database file]
signature = 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00
ep_only = true

[Microsoft Bitmap Graphics format]
signature = 01 00 09 00
ep_only = true

[Microsoft Paint Graphics format]
signature = 4C 69 6E 53
ep_only = true

[MIDI Music file]
signature = 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54
ep_only = true

[MPEG Video file (2)]
signature = 00 00 01 B3
ep_only = true

[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]
signature = B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73
ep_only = true

[NE-Exe Executable Image]
signature = 4E 45
ep_only = true

[Next/Sun Audio file]
signature = 2E 73 6E 64
ep_only = true

[OAZ Fax Graphics format]
signature = 0F 0F 0F 0F 01 00 00 00
ep_only = true

[OLE2 Document (WinWord, Excel ...)]
signature = D0 CF 11 E0 A1 B1 1A E1
ep_only = true

[OS/2 Icon Graphics format]
signature = 43 49 4E 00 00 00
ep_only = true

[PMW1 Executable Image (using DOSExtender)]
signature = 50 4D 57 31
ep_only = true

[PNG Graphics format]
signature = 89 50 4E 47 0D 0A 1A 0A
ep_only = true

[Portable BitMap (PBM) Graphics format]
signature = 50 36 0A
ep_only = true

[PRO-MIDI Music file]
signature = 52 49 46 46 ?? ?? ?? ?? 52 4D 49 44
ep_only = true

[PS-AdobeFont v.1.0]
signature = 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A
ep_only = true

[QuickLink II Fax Graphics format]
signature = 51 4C 49 49 46 41 58 20
ep_only = true

[Real Networks Video/Audio file]
signature = 2E 52 4D 46
ep_only = true

[SA2 Adlib Module music file]
signature = 53 41 64 54
ep_only = true

[Scodl Graphics format]
signature = E0 01 ?? 00 ?? ?? 00
ep_only = true

[SGI Image Graphics format]
signature = 01 DA 00 01 00 03
ep_only = true

[Sharp GPB Graphics format]
signature = 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00
ep_only = true

[Sierra`s audio file]
signature = 8D 0C 53 4F 4C 00 22 56 0D
ep_only = true

[Sun Icon Graphics format]
signature = 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C
ep_only = true

[Sun Raster Graphics format]
signature = 59 A6 6A 95
ep_only = true

[TIFF Graphics file (IBM)]
signature = 49 49 2A
ep_only = true

[TIFF Graphics file (Macintosh)]
signature = 4D 4D 00
ep_only = true

[Trilobyte's JPEG graphics Library]
signature = 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00
ep_only = true

[TrueType Font file]
signature = 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48
ep_only = true

[TrueType Font file]
signature = 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32
ep_only = true

[TrueVision Targa Graphics format]
signature = 00 00 02 00 00 00 00 00
ep_only = true

[UnoPiX 0.75 -> BaGiE]
signature = 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61
ep_only = true

[UnoPiX 1.03-1.10 -> BaGiE]
signature = 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00
ep_only = true

[UnoPiX 1.03-1.10 -> BaGiE]
signature = 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10
ep_only = true

[Wicat GED Graphics format]
signature = 0D 00 40 00
ep_only = true

[Windows Icon Graphics format]
signature = 00 00 01 00
ep_only = true

[Windows or OS/2 Graphics format]
signature = 42 4D
ep_only = true

[WordPerfect Graphics format]
signature = FF 57 50 43 10 00 00 00
ep_only = true

[XE Executable Image (using DOSExtender)]
signature = 58 45
ep_only = true

[XWD graphics format]
signature = 00 00 00 71 00 00 00 07 00 00 00 02 00 00 00
ep_only = true

[ZM-Exe Executable Image]
signature = 5A 4D
ep_only = true

[Microsoft WAV Audio file]
signature = 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74
ep_only = false

[UnoPiX 1.03-1.10 -> BaGiE]
signature = 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00
ep_only = false



================================================
FILE: peid_rules/PE/installer.userdb.txt
================================================
; PEiD signature database - installer
; Auto-categorized from userdb.txt (90 entries)

[GP-Install v5.0.3.32]
signature = 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0
ep_only = true

[Inno Installer v5.1.2]
signature = 9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC
ep_only = true

[Inno Installer v5.1.2]
signature = 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B
ep_only = true

[Inno Setup Module]
signature = 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43
ep_only = true

[Inno Setup Module]
signature = 49 6E 6E 6F
ep_only = true

[Inno Setup Module v1.09a]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0
ep_only = true

[Inno Setup Module v1.09a]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 68
ep_only = true

[Inno Setup Module v5]
signature = 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? F3 FF FF E8 ?? F4 FF FF 33 C0 55
ep_only = true

[Install Stub 32-bit]
signature = 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29
ep_only = true

[InstallAnywhere 6.1 -> Zero G Software Inc]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[InstallAnywhere 6.1 -> Zero G Software Inc]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

[Installer VISE Custom]
signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[NSIS Installer --> NullSoft]
signature = 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE
ep_only = true

[Nullsoft Install System 1.xx]
signature = 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00
ep_only = true

[Nullsoft Install System 2.0]
signature = 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56
ep_only = true

[Nullsoft Install System 2.0 RC2]
signature = 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74
ep_only = true

[Nullsoft Install System 2.0a0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0
ep_only = true

[Nullsoft Install System v1.98]
signature = 83 EC 0C 53 56 57 FF 15 2C 81 40
ep_only = true

[Nullsoft Install System v1.98]
signature = 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75
ep_only = true

[Nullsoft Install System v1.xx]
signature = 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B
ep_only = true

[Nullsoft Install System v2.0a0]
signature = 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00
ep_only = true

[Nullsoft Install System v2.0b2, v2.0b3]
signature = 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15
ep_only = true

[Nullsoft Install System v2.0b4]
signature = 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43
ep_only = true

[Patch Creation Wizard 1.2 Memory Patch]
signature = E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75
ep_only = true

[Patch Creation Wizard 1.2 Seek and Destroy Patch]
signature = 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01
ep_only = true

[Patch Creation Wizard v1.2 Byte Patch]
signature = E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54
ep_only = true

[Patch Creation Wizard v1.2 Memory Patch]
signature = 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00
ep_only = true

[Patch Creation Wizard v1.2 Seek and Destroy Patch]
signature = E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54
ep_only = true

[Setup Factory 6.x Custom]
signature = 55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[Setup Factory v6.0.0.3 Setup Launcher]
signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45
ep_only = true

[Setup2Go Installer Stub]
signature = 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72
ep_only = true

[Silicon Realms Install Stub]
signature = 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05
ep_only = true

[Silicon Realms Install Stub]
signature = 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3
ep_only = true

[Thinstall 2.403 -> Jitit]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF
ep_only = true

[Thinstall 2.4x - 2.5x -> Jitit Software]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8
ep_only = true

[Thinstall 2.4x - 2.5x -> Jitit Software]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD
ep_only = true

[Thinstall 2.5xx -> Jtit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A
ep_only = true

[Thinstall 2.628 -> Jtit]
signature = E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3
ep_only = true

[Thinstall 2.736 -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00
ep_only = true

[Thinstall 3.035 -> Jtit]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3
ep_only = true

[Thinstall 3.035 -> Jtit]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00
ep_only = true

[Thinstall Embedded 1.9X -> Jitit]
signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00
ep_only = true

[Thinstall Embedded 2.0X -> Jitit]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

[Thinstall Embedded 2.2X-2.308 -> Jitit]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

[Thinstall Embedded 2.312 -> Jitit]
signature = 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

[Thinstall Embedded 2.422-2.428 -> Jitit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = true

[Thinstall Embedded 2.501 -> Jitit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = true

[Thinstall Embedded 2.545 -> Jitit]
signature = E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00
ep_only = true

[Thinstall Embedded 2.547-V2.600 -> Jitit]
signature = E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00
ep_only = true

[Thinstall Embedded 2.609 -> Jitit]
signature = E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00
ep_only = true

[Thinstall Embedded 2.620-2.623 -> Jitit]
signature = E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00
ep_only = true

[Thinstall Embedded 2.717-2.719 -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00
ep_only = true

[Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true

[Thinstall Embedded V2.312 -> Jitit ! Sign by fly]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true

[Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly]
signature = 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true

[Thinstall V2.403 -> Jitit]
signature = 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39
ep_only = true

[Thinstall V2.403 -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D
ep_only = true

[Thinstall v2.460 -> Jitit]
signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E
ep_only = true

[Thinstall V2.7X -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
ep_only = true

[Thinstall V2.7X -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0
ep_only = true

[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB
ep_only = true

[Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB
ep_only = true

[Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00
ep_only = true

[Thinstall Virtualization Suite 3.0X -> Thinstall Company]
signature = 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA
ep_only = true

[Thinstall Virtualization Suite 3.0X -> Thinstall Company]
signature = 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB
ep_only = true

[Thinstall Virtualization Suite 3.0xx -> Jitit Software]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4
ep_only = true

[Thinstall Virtualization Suite V3.10X -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 74
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20
ep_only = true

[Wise Installer Stub v1.10.1029.1]
signature = 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45
ep_only = true

[Inno Setup Module]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C
ep_only = false

[Inno Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = false

[Nullsoft Install System 2.0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00
ep_only = false

[Nullsoft Install System 2.06]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00
ep_only = false

[Nullsoft Install System 2.0b4]
signature = 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74
ep_only = false

[Nullsoft Install System 2.0b4]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00
ep_only = false

[Nullsoft Install System v1.98]
signature = 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71
ep_only = false

[Nullsoft Install System v2.0]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52
ep_only = false

[Nullsoft Install System v2.0a0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03
ep_only = false

[Nullsoft Install System v2.0b4]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52
ep_only = false

[Patch Creation Wizard v1.2 Byte Patch]
signature = E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75
ep_only = false

[Setup Factory 6.x Custom]
signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89
ep_only = false

[Thinstall 2.4x - 2.5x -> Jitit Software]
signature = 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = false

[Thinstall 2.5xx -> Jtit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = false

[Thinstall 2.628 -> Jtit]
signature = E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01
ep_only = false

[Thinstall Virtualization Suite 3.0x - 3.300 -> Thinstall Inc.]
signature = CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 ?? ?? ?? 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 ?? ?? 73 0E 8B 4D F8 E8 27 01 ?? ?? 02 45 F7 AA EB E9 E8 04 01 ?? ?? 0F 82 96 ?? ?? ?? E8 F9 ?? ?? ?? 73 5B B9 04 ?? ?? ?? E8 05 01 ?? ?? 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF ?? ?? ?? 73 1B 55 BD ?? ?? ?? ?? E8 DF ?? ?? ?? 88 07 47 4D 75 F5 E8 C7 ?? ?? ?? 72 E9 5D
ep_only = false

[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20
ep_only = false



================================================
FILE: peid_rules/PE/joiner.userdb.txt
================================================
; PEiD signature database - joiner
; Auto-categorized from userdb.txt (57 entries)

[Ady's Glue 1.10]
signature = 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC
ep_only = true

[Ady`s Glue v0.10]
signature = 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F
ep_only = true

[Anskya Binder v1.1 -> Anskya]
signature = BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true

[Anskya Binder v1.1 -> Anskya]
signature = BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00
ep_only = true

[Blade Joiner v1.5]
signature = 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85
ep_only = true

[EXE joiner -> Amok]
signature = A1 14 A1 40 00 C1 E0 02 A3 18 A1 40
ep_only = true

[ExeJoiner 1.0 -> Yoda]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50
ep_only = true

[FreeJoiner 1.5.1 -> GlOFF]
signature = 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52
ep_only = true

[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]
signature = E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00
ep_only = true

[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]
signature = E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 0
ep_only = true

[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]
signature = E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00
ep_only = true

[FreeJoiner Small (build 014-021/024-027) -> GlOFF]
signature = E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 017) -> GlOFF]
signature = E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 023) -> GlOFF]
signature = E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 029) -> GlOFF]
signature = 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8
ep_only = true

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 033) -> GlOFF]
signature = 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 035) -> GlOFF]
signature = 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[Freshbind v2.0 -> gFresh]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00
ep_only = true

[Freshbind v2.0 -> gFresh]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40
ep_only = true

[Joiner (sign from pinch 25.03.2007 20:10)]
signature = 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D
ep_only = true

[Joiner (sign from pinch 25.03.2007 20:10)]
signature = 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01
ep_only = true

[MicroJoiner 1.1 -> coban2k]
signature = BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true

[MicroJoiner 1.5 -> coban2k]
signature = BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF
ep_only = true

[MicroJoiner 1.5 -> coban2k]
signature = BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C
ep_only = true

[MicroJoiner 1.6 -> coban2k]
signature = 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B
ep_only = true

[MicroJoiner 1.7 -> coban2k]
signature = BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00
ep_only = true

[MicroJoiner 1.7 -> coban2k]
signature = BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3
ep_only = true

[N-Joiner 0.1 (Asm Version) -> NEX]
signature = 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC
ep_only = true

[nBinder v3.6.1]
signature = 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C
ep_only = true

[nBinder v4.0]
signature = 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79
ep_only = true

[RJoiner 1.2 by Vaska (25.03.2007 16:58)]
signature = 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46
ep_only = true

[RJoiner 1.2a -> Vaska]
signature = 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00
ep_only = true

[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]
signature = E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10
ep_only = true

[Unknown Joiner (sign from pinch 26.03.2007 02:12)]
signature = 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80
ep_only = true

[FreeJoiner 1.5.1 -> GlOFF]
signature = 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8
ep_only = false

[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]
signature = E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00
ep_only = false

[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]
signature = 86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6
ep_only = false

[FreeJoiner Small (build 014-021/024-027) -> GlOFF]
signature = E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00
ep_only = false

[FreeJoiner Small (build 014/015) -> GlOFF]
signature = 55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50
ep_only = false

[FreeJoiner Small (build 017) -> GlOFF]
signature = 55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50
ep_only = false

[FreeJoiner Small (build 023) -> GlOFF]
signature = E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF
ep_only = false

[FreeJoiner Small (build 029) -> GlOFF]
signature = 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00
ep_only = false

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40
ep_only = false

[FreeJoiner Small (build 033) -> GlOFF]
signature = 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10
ep_only = false

[FreeJoiner Small (build 035) -> GlOFF]
signature = 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10
ep_only = false

[N-Joiner 0.1 (Asm Version) -> NEX]
signature = 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12
ep_only = false

[nBinder v3.6.1]
signature = 6E 73 70 61 63 6B 24 40
ep_only = false

[nBinder v4.0]
signature = 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00
ep_only = false

[RJoiner 1.2a -> Vaska]
signature = 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11
ep_only = false



================================================
FILE: peid_rules/PE/overlay.userdb.txt
================================================
; PEiD signature database - overlay
; Auto-categorized from userdb.txt (15 entries)

[CauseWay DOS Extender v2.64, v3.25 1992-95]
signature = EB J3 8B E8 8C C6 0E 1F 8C C0 05 ?? ?? 01 ?? ?? ?? B8 ?? ?? CD 21 3C ?? 73
ep_only = true

[CauseWay DOS Extender v3.25]
signature = FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07
ep_only = true

[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9
ep_only = true

[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF
ep_only = true

[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 00 00 42 00 31 DB 43 EB 58
ep_only = true

[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44
ep_only = true

[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]
signature = BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7
ep_only = true

[E.S.O. Eclipse Operating System v.2.08 + DOS Extender]
signature = 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9
ep_only = true

[Go32Stub v.2.00 DOS-Extender]
signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80
ep_only = true

[Go32Stub v.2.00T DOS-Extender]
signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C
ep_only = true

[MetaWare High C + Phar Lap DOS Extender 1983-89]
signature = EB J3 33 ED 2E 8E 1E ?? ?? 26 A1 ?? ?? A3 ?? ?? 26 8B 1E ?? ?? B1 ?? 4B
ep_only = true

[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]
signature = B8 ?? ?? 50 B8 ?? ?? 50 CB
ep_only = true

[Overlay]
signature = 55 8B EC 83 C4 D4 53 56 57 33 C0 89 45 F0 89 45 E4 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22
ep_only = true

[Phar Lap DOS Extender 1986-91]
signature = EB J3 8C D8 8E C0 B8 ?? ?? 8E D8 BB ?? ?? 8C C0 2B D8 81 ?? ?? ?? B4 4A CD 21
ep_only = true

[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]
signature = FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4
ep_only = true



================================================
FILE: peid_rules/PE/packer.userdb.txt
================================================
; PEiD signature database - packer
; Auto-categorized from userdb.txt (992 entries)

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10
ep_only = true

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28
ep_only = true

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3
ep_only = true

[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3
ep_only = true

[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 55 53 45 52 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 EB 4C 47 6C 6F 62 61 6C 41 6C 6C 6F 63 00 47 6C 6F 62 61 6C 46 72 65 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45
ep_only = true

[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]
signature = 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12 D2 73 4A 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 D6 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 EB A0 B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 83 E8 02 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 58 FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 18 FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 03 FF FF FF 8A 06 46 33 C9 C0 E8 01 74 12 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E E9 E7 FE FF FF 5D 2B 7D 0C 89 7D FC 61 5D C3
ep_only = true

[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]
signature = 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12
ep_only = true

[!EPack V1.4 lite final -> 6aHguT]
signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00
ep_only = true

[$pirit v1.5]
signature = ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
ep_only = true

[$PIRIT v1.5]
signature = B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21
ep_only = true

[* PseudoSigner 0.1 [32Lite 0.03]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [ASPack 2.xx Heuristic]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true

[* PseudoSigner 0.1 [Crunch/PE Heuristic]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [FSG 1.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9
ep_only = true

[* PseudoSigner 0.1 [FSG 1.31]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9
ep_only = true

[* PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [MEW 11 SE 1.0]
signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9
ep_only = true

[* PseudoSigner 0.1 [Neolite 2.0]
signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [NorthStar PE Shrinker 1.3]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]
signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [PE Intro 1.0]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9
ep_only = true

[* PseudoSigner 0.1 [PE Pack 0.99]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9
ep_only = true

[* PseudoSigner 0.1 [PECompact 1.4+]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[* PseudoSigner 0.1 [PENightMare 2 Beta]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9
ep_only = true

[* PseudoSigner 0.1 [PEtite 2.x (level 0)]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68
ep_only = true

[* PseudoSigner 0.1 [PEX 0.99]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [UPX 0.6]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9
ep_only = true

[* PseudoSigner 0.2 [32Lite 0.03]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68
ep_only = true

[* PseudoSigner 0.2 [Crunch/PE Heuristic]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [FSG 1.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true

[* PseudoSigner 0.2 [FSG 1.31]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80
ep_only = true

[* PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01
ep_only = true

[* PseudoSigner 0.2 [MEW 11 SE 1.0]
signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90
ep_only = true

[* PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [PE Intro 1.0]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A
ep_only = true

[* PseudoSigner 0.2 [PE Pack 0.99]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A
ep_only = true

[* PseudoSigner 0.2 [PENightMare 2 Beta]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true

[* PseudoSigner 0.2 [PEX 0.99]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01
ep_only = true

[* PseudoSigner 0.2 [UPX 0.6]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00
ep_only = true

[32Lite v0.03a]
signature = 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68
ep_only = true

[32Lite v0.03a]
signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B
ep_only = true

[ACE-SFX Archive]
signature = 2A 2A 41 43 45 2A 2A
ep_only = true

[AHPack 0.1 -> FEUERRADER]
signature = 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00
ep_only = true

[AHpack 0.1 -> FEUERRADER]
signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[AHPack 0.1 -> FEUERRADER]
signature = 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61
ep_only = true

[AHTeam EP Protector 0.3 (fake ASPack 2.12) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB
ep_only = true

[Amiga AIFF 8SFX Audio file]
signature = 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52
ep_only = true

[Anskya NTPacker Generator -> Anskya]
signature = 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54
ep_only = true

[Anskya NTPacker Generator -> Anskya]
signature = 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70
ep_only = true

[Anti007 -> NsPacK Private]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0
ep_only = true

[Anti007 -> NsPacK Private]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Anti007 V1.0-V2.X -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00
ep_only = true

[Anti007 V1.0-V2.X -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74
ep_only = true

[Anti007 V2.5-V2.6 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53
ep_only = true

[Anti007 V2.7-V3.5 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00
ep_only = true

[Anti007 V2.7-V3.5 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54
ep_only = true

[Apex 3.0 alpha -> 500mhz]
signature = 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3
ep_only = true

[APEX_C (BLT Apex 4.0) -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3
ep_only = true

[ARC-SFX Archive]
signature = 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8
ep_only = true

[ARJ SFX Custom]
signature = 60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[ARJ SFX Custom]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6
ep_only = true

[ARJ SFX Custom]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A
ep_only = true

[ARJ-SFX Archive]
signature = 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 4A 53 58
ep_only = true

[ASPack 1.02b or 1.08.03]
signature = 60 E8 00 00 00 00 5D 81 ED
ep_only = true

[ASPack 1.05b by]
signature = 75 00 E9
ep_only = true

[ASPAck 1.061b]
signature = 90 90 75 00 E9
ep_only = true

[ASPack 1.08]
signature = 90 90 90 75 01 90 E9
ep_only = true

[ASPack v1.00b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44
ep_only = true

[ASPack v1.00b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF
ep_only = true

[ASPack v1.01b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44
ep_only = true

[ASPack v1.01b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44
ep_only = true

[ASPack v1.02a]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23
ep_only = true

[ASPack v1.02b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43
ep_only = true

[ASPack v1.02b]
signature = 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5
ep_only = true

[ASPack v1.02b]
signature = 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33
ep_only = true

[ASPack v1.03b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43
ep_only = true

[ASPack v1.03b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58
ep_only = true

[ASPack v1.04b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D
ep_only = true

[ASPack v1.04b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE
ep_only = true

[ASPack v1.061b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43
ep_only = true

[ASPack v1.06b]
signature = 90 90 90 75 00 E9
ep_only = true

[ASPack v1.06b]
signature = 90 75 00 E9
ep_only = true

[ASPack v1.06b]
signature = 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true

[ASPack v1.07b]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5
ep_only = true

[ASPack v1.07b]
signature = 90 90 90 75 ?? E9
ep_only = true

[ASPack v1.07b]
signature = 90 90 75 ?? E9
ep_only = true

[ASPack v1.07b]
signature = 90 75 ?? E9
ep_only = true

[ASPack v1.07b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00
ep_only = true

[ASPack v1.08]
signature = 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A
ep_only = true

[ASPack v1.08]
signature = 90 90 90 75 01 FF E9
ep_only = true

[ASPack v1.08]
signature = 90 90 75 01 FF E9
ep_only = true

[ASPack v1.08]
signature = 90 75 01 FF E9
ep_only = true

[ASPack v1.08.01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D
ep_only = true

[ASPack v1.08.01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D
ep_only = true

[ASPack v1.08.01]
signature = 90 90 90 75 ?? 90 E9
ep_only = true

[ASPack v1.08.01]
signature = 90 90 75 ?? 90 E9
ep_only = true

[ASPack v1.08.01]
signature = 90 75 ?? 90 E9
ep_only = true

[ASPack v1.08.01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72
ep_only = true

[ASPack v1.08.02]
signature = 90 90 75 01 90 E9
ep_only = true

[ASPack v1.08.02]
signature = 90 75 01 90 E9
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD
ep_only = true

[ASPack v1.08.03]
signature = 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6
ep_only = true

[ASPack v1.08.04]
signature = 60 E8 41 06 00 00 EB 41
ep_only = true

[ASPack v1.08.04]
signature = 60 E8 ?? ?? ?? ?? EB
ep_only = true

[ASPack v1.08.x]
signature = 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true

[ASPack v2.000]
signature = 60 E8 70 05 00 00 EB 4C
ep_only = true

[ASPack v2.000]
signature = 60 E8 48 11 00 00 C3 83
ep_only = true

[ASPack v2.001]
signature = 60 E8 72 05 00 00 EB 4C
ep_only = true

[ASPack v2.001]
signature = 60 E8 72 05 00 00 EB 33 87 DB 90 00
ep_only = true

[ASPack v2.1]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB
ep_only = true

[ASPack v2.11]
signature = 60 E9 3D 04 00 00
ep_only = true

[ASPack v2.11]
signature = 60 E8 F9 11 00 00 C3 83
ep_only = true

[ASPack v2.11b]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00
ep_only = true

[ASPack v2.11b]
signature = 60 E8 02 00 00 00 EB 09 5D 55
ep_only = true

[ASPack v2.11c]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00
ep_only = true

[ASPack v2.11d]
signature = 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02
ep_only = true

[ASPack v2.12]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01
ep_only = true

[Aspack v2.12 -> www.aspack.com]
signature = ?? ?8 0? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?3 ?? ?? 0? ?? 0? ?? ?? ?? ?? ?? 0? ?? ?F ?? ?? ?3 0? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?0 0? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8? ?? ?D ?? ?? ?? ?? 5
ep_only = true

[ASPack v2.xx]
signature = A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true

[ASPack v2.xx]
signature = A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95
ep_only = true

[ASPR Stripper v2.x unpacked]
signature = BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC
ep_only = true

[ASPR Stripper v2.x unpacked]
signature = BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8
ep_only = true

[ASProtect vx.x]
signature = 90 60 ?? ?? ?? 00 00
ep_only = true

[ASProtect vx.x]
signature = 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D
ep_only = true

[ASProtect vx.x]
signature = 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00
ep_only = true

[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2
ep_only = true

[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true

[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true

[BeRoEXEPacker v1.00 (LZMA)]
signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true

[BeRoEXEPacker V1.00 -> BeRo]
signature = BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3
ep_only = true

[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]
signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2
ep_only = true

[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8
ep_only = true

[BeRoEXEPacker v1.00 DLL [LZBRS]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 DLL [LZBRS]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 [LZBRR]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true

[BeRoEXEPacker v1.00 [LZBRS]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 [LZBRS]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[CAN (Crunched ANsi) file]
signature = CA 01
ep_only = true

[ChSfx (small) v1.1]
signature = BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89
ep_only = true

[CICompress v1.0]
signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08
ep_only = true

[CICompress v1.0]
signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35
ep_only = true

[CICompress v1.0]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74
ep_only = true

[Code-Lock vx.x]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00
ep_only = true

[Code-Lock vx.x]
signature = 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9
ep_only = true

[Code-Lock vx.x]
signature = 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A
ep_only = true

[CRC2COM v1.24 (packed)]
signature = EB J3 8B FC 83 EF ?? 83 EC ?? BE ?? ?? B9 ?? ?? 57 F3 A4 5F FF E7
ep_only = true

[CRC2COM v1.24 (unpacked)]
signature = EB J3 C8 ?? ?? ?? E8 ?? ?? 0E 07 C6 ?? ?? ?? E8 ?? ?? E8
ep_only = true

[CreateInstall Stub vx.x]
signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00
ep_only = true

[CreateInstall Stub vx.x]
signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56
ep_only = true

[Crunch 4]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8
ep_only = true

[Crunch 4 -> Bit-Arts]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00
ep_only = true

[Crunch 5 -> Bit-Arts]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = true

[Crunch 5 / Fusion 4 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00
ep_only = true

[Crunch 5 Fusion 4]
signature = EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8
ep_only = true

[Crunch v4.0]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0
ep_only = true

[Crunch v5 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1
ep_only = true

[Crunch V5.0 -> Bitarts]
signature = EB 15 03 00 00 00 06
ep_only = true

[Crunch V5.0 -> Bitarts]
signature = 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[Crunch/PE]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85
ep_only = true

[Crunch/PE]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74
ep_only = true

[Crunch/PE]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5
ep_only = true

[Crunch/PE v1.0.x.x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85
ep_only = true

[Crunch/PE v1.0.x.x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26
ep_only = true

[Crunch/PE v3.0.x.x]
signature = 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01
ep_only = true

[Crunch/PE v5.0]
signature = EB 15 03 ?? ?? ?? 06
ep_only = true

[Cruncher v1.0]
signature = 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB
ep_only = true

[CrypWrap vx.x]
signature = E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E
ep_only = true

[DBPE vx.xx]
signature = 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A
ep_only = true

[DIET v1.00, v1.00d]
signature = BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true

[DIET v1.00d]
signature = FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[DIET v1.02b, v1.10a, v1.20]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC
ep_only = true

[DIET v1.44, v1.45f]
signature = F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52
ep_only = true

[DIET v1.44, v1.45f]
signature = F9 9C EB
ep_only = true

[diPacker 1.x -> diProtector Software]
signature = 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5
ep_only = true

[Dropper Creator V0.1 -> Conflict]
signature = 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09
ep_only = true

[EXE Packer v7.0 by TurboPower Software]
signature = 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE
ep_only = true

[EXE Packer v7.0 by TurboPower Software]
signature = EB J3 1E 06 8C C3 83 ?? ?? 0E 1F 01 ?? ?? ?? 01 ?? ?? ?? BE ?? ?? B9 ?? ?? FC AD 3B C1 74
ep_only = true

[Exe Shield vx.x]
signature = 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00
ep_only = true

[Exe Shield vx.x]
signature = 53 E8 00 00 00 00 5B 8B C3 2D
ep_only = true

[EXE2COM (Packed)]
signature = BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB
ep_only = true

[EXE32Pack v1.36]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40
ep_only = true

[EXE32Pack v1.36]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40
ep_only = true

[EXE32Pack v1.37]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40
ep_only = true

[EXE32Pack v1.38]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40
ep_only = true

[EXE32Pack v1.39]
signature = 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81
ep_only = true

[EXE32Pack v1.3x]
signature = 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED
ep_only = true

[EXE32Pack v1.3x]
signature = 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73
ep_only = true

[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3
ep_only = true

[EXECryptor 2.3.9 (compressed resources)]
signature = 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5
ep_only = true

[EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com]
signature = CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75
ep_only = true

[EXECryptor 2.3.9 DLL (compressed resources)]
signature = 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10
ep_only = true

[EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com]
signature = 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0
ep_only = true

[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar]
signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89
ep_only = true

[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB
ep_only = true

[EXEPACK v4.05, v4.06]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4
ep_only = true

[EXEPACK v5.31.009 (LINK v3.69)]
signature = 8B E8 8C C0
ep_only = true

[eXPressor 1.2.0 Beta PE Packer]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true

[FSG 1.3]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D
ep_only = true

[FSG v1.0]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true

[FSG v1.0]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.0]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4
ep_only = true

[FSG v1.00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.1]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16
ep_only = true

[FSG v1.1]
signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? F6
ep_only = true

[FSG v1.1]
signature = EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00
ep_only = true

[FSG v1.1]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = E8 01 00 00 00 ?? ?? E8 ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = ?? ?? EB ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? EB 02
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 CD 20
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 01 ?? E8 ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? E8 E7 1C 00 00
ep_only = true

[FSG v1.2]
signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC
ep_only = true

[FSG v1.2]
signature = 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00
ep_only = true

[FSG v1.3]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73
ep_only = true

[FSG v1.3]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9
ep_only = true

[FSG v1.31 (Eng) -> dulek/xt]
signature = BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B
ep_only = true

[FSG v1.33]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF
ep_only = true

[FSG v1.33]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v2.0]
signature = 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13
ep_only = true

[FSG v2.0 -> bart/xt]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 00 08 D0 05 D4 06 D5 0B 40 09 00 10 7F 26 4F 0B 00 09 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[hmimys's PE-Pack 0.1 -> hmimys]
signature = E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00
ep_only = true

[hmimys's PE-Pack 0.1 -> hmimys]
signature = E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75
ep_only = true

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = true

[Inno Installer v4.0.5] ;collides with: Inno Setup Module Heuristic Mode [Inno SFX]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22
ep_only = true

[JDPack]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB
ep_only = true

[JDPack]
signature = 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2
ep_only = true

[JDPack 2.x -> JDPack]
signature = 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00
ep_only = true

[JExeCompressor 1.0 - by Arash Veyskarami]
signature = 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0
ep_only = true

[JExeCompressor V1.0 -> UsAr]
signature = 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F BC C8 EB ?? C3 B8 ?? ?? ?? ?? 50
ep_only = true

[JExeCompressor V1.0 -> UsAr]
signature = 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8
ep_only = true

[Kbys Packer 0.28 Beta->shoooo314]
signature = 68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00
ep_only = true

[KByS Packer v0.28]
signature = 68 ?? ?? ?? 00 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00
ep_only = true

[KByS V0.22 -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8
ep_only = true

[KByS V0.28 -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4
ep_only = true

[KByS V0.28 DLL -> shoooo]
signature = B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00
ep_only = true

[KGB SFX]
signature = 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[KGCrypt vx.x]
signature = E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74
ep_only = true

[KGCrypt vx.x]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true

[kkrunchy -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0
ep_only = true

[kkrunchy -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10
ep_only = true

[kkrunchy -> Ryd]
signature = BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8
ep_only = true

[kkrunchy 0.23 alpha -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0
ep_only = true

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE
ep_only = true

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF
ep_only = true

[kkrunchy v0.17 -> F. Giesen]
signature = FC FF 4D 08 31 D2 8D 7D 30 BE
ep_only = true

[kkrunchy V0.2X -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6
ep_only = true

[LHA-SFX Archive v2.05, v2.13]
signature = EB J3 FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB ?? ?? ?? ?? ?? E8 ?? ?? 06 1F B4 30 CD 21 8B D8 1E 3C 03 72 ?? 36 ?? ?? ?? ?? 33 C0 8B F8 B9
ep_only = true

[LHA-SFX Archive v2.05S, v2.54S]
signature = EB J3 ?? ?? ?? FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB
ep_only = true

[LHA-SFX Archive v2.13L]
signature = EB J3 FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 E8 ?? ?? BB ?? ?? E8 ?? ?? 06 1F B4 30 CD 21 8B D8 1E
ep_only = true

[LHARC-SFX Archive v1.131c]
signature = EB J3 ?? ?? ?? ?? 24 4C 48 61 72 ?? 27 73 ?? 53 46 58
ep_only = true

[LHARC-SFX Archive v1.13L]
signature = E9 J1 J1 FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 05 ?? ?? 8E C0 B8 ?? ?? CD 21 BE ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? AC E8
ep_only = true

[LHICE-SFX Archive v1.13, v1.17]
signature = EB J3 FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 2E ?? ?? ?? ?? 8E D8 8E C0 05 ?? ?? 2E ?? ?? ?? ?? 76 ?? BB
ep_only = true

[LZEXE v0.91, v1.00a (1)]
signature = 06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7
ep_only = true

[LZEXE v0.91, v1.00a (2)]
signature = BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE
ep_only = true

[LZEXE v0.91, v1.00a (3)]
signature = 50 06 0E 1F 8B 0E
ep_only = true

[Maked by Graphic WorkShop's Self-Displayer v.6.0]
signature = E9 J1 J1 2E C7 ?? ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43 2E 01 1E ?? ?? E8 ?? ?? 3D
ep_only = true

[Maked by Graphic WorkShop. Self-Displayer v.7.0]
signature = E9 J1 J1 2E C7 06 ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43 2E
ep_only = true

[Mew 10 exe-coder 1.0  -> Northfox [HCC]
signature = 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70
ep_only = true

[MEW 10 packer v1.0 -> Northfox]
signature = 33 C0 E9 ?? ?0
ep_only = true

[Mew 10 v1.0 (Eng) -> Northfox]
signature = 33 C0 E9 ?? ?? ?? FF
ep_only = true

[Mew 10 v1.0 -> Northfox]
signature = 33 C0 E9 ?? ?? FF FF
ep_only = true

[MEW 11 SE 1.1 -> Northfox]
signature = E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00
ep_only = true

[MEW 11 SE v1.0 -> Northfox]
signature = E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0
ep_only = true

[MEW 11 SE v1.1]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true

[MEW 11 SE v1.1  -> Northfox [HCC]
signature = E9 ?? ?? ?? FF 0C ?0
ep_only = true

[MEW 11 SE v1.1  -> Northfox [HCC]
signature = E9 ?? ?? ?? FF 0C
ep_only = true

[MEW 11 SE v1.2]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00
ep_only = true

[MEW 11 SE v1.2]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Mew 11 SE v1.2 (Eng) -> Northfox]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C
ep_only = true

[Mew 11 SE v1.2 (Eng) -> Northfox]
signature = 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D
ep_only = true

[MEW 5 1.0 -> Northfox]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0
ep_only = true

[MEW 5 1.0 -> Northfox]
signature = BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0
ep_only = true

[Mew 5.0.1 -> NorthFox / HCC]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D
ep_only = true

[Microsoft CAB SFX]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20
ep_only = true

[Microsoft CAB SFX]
signature = E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC
ep_only = true

[Microsoft Windows Update CAB SFX module]
signature = E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00
ep_only = true

[Microsoft Windows Update CAB SFX module]
signature = E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18
ep_only = true

[MPRESS V0.71a-V0.75b -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080310]
signature = 57 56 53 51 52 55 E8 10 00 00 00 E8 7A 00 00 00 5D 5A 59 5B 5E 5F E9 84 01 00 00 E8 00 00 00 00 58 05 84 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 AC 0A C0 74 37 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1E F6 C1 40 75 0A 8B C8 2B C0 F3 AA 75 FC EB D9 8B D6 8B CF 03 F0 E8 8F 00 00 00 03 F8 EB CA 8B C8 F3 A4 75 FC EB C2 C3 E8 00 00 00 00 5F 81 C7 71 FF FF FF B0 E9 AA B8 9A 01 00 00 AB 2B FF E8 00 00 00 00 58 05 FE 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 53 8B 30 03 F0 2B F2 8B EE 8B C2 8B 45 3C 03 C5 8B 48 34 2B CD 74 3D E8 00 00 00 00 58 05 DD 00 00 00 8B 10 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3
ep_only = true

[MPRESS V0.77b -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080313]
signature = 60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3
ep_only = true

[MPRESS V0.85-V0.92 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080414]
signature = 60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9
ep_only = true

[MPRESS V0.97-V0.99 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080416]
signature = 60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9
ep_only = true

[MPRESS V1.01 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00
ep_only = true

[MPRESS V1.07-V1.25 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00
ep_only = true

[MS Compress Archive]
signature = 53 5A 44 44
ep_only = true

[MSLRH 0.32a (fake ASPack 2.11d) -> emadicius]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50
ep_only = true

[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B
ep_only = true

[MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = true

[MSLRH 0.32a (fake Neolite 2.0) -> emadicius]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75
ep_only = true

[MSLRH 0.32a (fake nSPack 1.3) -> emadicius]
signature = E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31
ep_only = true

[MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83
ep_only = true

[MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02
ep_only = true

[MSLRH 0.32a (fake PECompact 1.4x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29
ep_only = true

[MSLRH 0.32a (fake PEtite 2.1) -> emadicius]
signature = 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04
ep_only = true

[MSLRH 0.32a (fake PEX 0.99) -> emadicius]
signature = B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
ep_only = true

[MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4
ep_only = true

[MSLRH 0.32a (fake WWPack32 1.x) -> emadicius]
signature = 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40
ep_only = true

[MSLRH v0.32a (fake ASPack 2.11d) -> emadicius]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake Neolite 2.0) -> emadicius]
signature = E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake nSPack 1.3) -> emadicius]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PECompact 1.4x) -> emadicius]
signature = EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEtite 2.1) -> emadicius]
signature = B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEX 0.99) -> emadicius]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]
signature = 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake WWPack32 1.x) -> emadicius]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[Naked Packer V1.0 -> BigBoote]
signature = 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3
ep_only = true

[Naked Packer V1.X -> BigBoote]
signature = 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF E8 00 00 00 00 EB 01 ?? 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05
ep_only = true

[Naked Packer V1.X -> BigBoote]
signature = 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00
ep_only = true

[NakedPacker 1.0 - by BigBoote]
signature = 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01
ep_only = true

[Name of the Packer v1.0]
signature = 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3
ep_only = true

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40
ep_only = true

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00
ep_only = true

[NeoLite v1.0]
signature = E9 9B 00 00 00 A0
ep_only = true

[NeoLite v1.0]
signature = 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74
ep_only = true

[Neolite v2.0]
signature = E9 A6 00 00 00
ep_only = true

[NeoLite v2.0]
signature = E9 A6
ep_only = true

[NeoLite v2.0]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75
ep_only = true

[NeoLite v2.00]
signature = E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32
ep_only = true

[NeoLite vx.x]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61
ep_only = true

[NoName Packer]
signature = 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C
ep_only = true

[NoodleCrypt v2.0]
signature = EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01
ep_only = true

[NoodleCrypt v2.0]
signature = 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true

[NoodleCrypt v2.00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02
ep_only = true

[NoodleCrypt v2.00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00
ep_only = true

[nPack 1.1.150.2006.Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack 1.1.250.2006.Beta -> NEOx/[uinC]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3
ep_only = true

[nPack 1.1.300.2006 Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00
ep_only = true

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68
ep_only = true

[nPack v1.1 250 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.150.2006.Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3
ep_only = true

[nPack V1.1.150.2006.Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.200.2006.Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.275.2006.Beta -> NEOx   * Sign.By.fly * 200800212]
signature = 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack v1.1.300.2006 Beta]
signature = 83 3D 4C ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00
ep_only = true

[nPack V1.1.500.2008 Beta -> NEOx&nbsp; &nbsp;* Sign.By.fly]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3
ep_only = true

[NSPack -> Nort Star Software - url:://www.nsdsn.com/]
signature = 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57
ep_only = true

[NsPack 1.4 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00
ep_only = true

[NsPack 1.4 by North Star (Liu Xing Ping)]
signature = 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53
ep_only = true

[nSPack 1.x/2.x -> North Star/Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D B8
ep_only = true

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36
ep_only = true

[nSPack 2.x -> North Star/Liu Xing Ping]
signature = FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01
ep_only = true

[NsPack 3.0 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36
ep_only = true

[NsPack 3.0 by North Star (Liu Xing Ping)]
signature = FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[NsPack 3.1 -> North Star (h)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00
ep_only = true

[NsPack 3.1 by North Star (Liu Xing Ping)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00
ep_only = true

[NsPack 3.4 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00
ep_only = true

[NsPack 3.4 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5
ep_only = true

[NSPack 3.x -> Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01
ep_only = true

[NSPack 3.x -> Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D
ep_only = true

[nSpack V1.1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00
ep_only = true

[NsPack V1.3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00
ep_only = true

[NsPack V1.4 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00
ep_only = true

[NsPack v2.3 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61
ep_only = true

[NsPacK V3.0 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74
ep_only = true

[NsPacK V3.0 -> LiuXingPing]
signature = 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83
ep_only = true

[NsPacK V3.1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74
ep_only = true

[NsPack v3.1 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00
ep_only = true

[NsPacK V3.3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74
ep_only = true

[NsPacK V3.3 -> LiuXingPing]
signature = 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85
ep_only = true

[NsPacK V3.4-V3.5 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84
ep_only = true

[NsPacK V3.6 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00
ep_only = true

[NsPacK V3.7 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00
ep_only = true

[NsPack v3.7 -> North Star (h)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D
ep_only = true

[NTKrnlPacker -> Ashkbiz Danehkar]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true

[NTPacker 1.0 -> ErazerZ]
signature = 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31
ep_only = true

[NTPacker V2.X -> ErazerZ]
signature = 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00
ep_only = true

[Nullsoft PiMP Install System]
signature = 83 EC ?? 53 55 56
ep_only = true

[Nullsoft PIMP Install System v1.3x]
signature = 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD
ep_only = true

[Nullsoft PiMP Install System v1.x]
signature = 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00
ep_only = true

[Nullsoft PiMP Install System v1.x]
signature = 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F
ep_only = true

[Nullsoft PiMP Stub -> SFX]
signature = 81 EC ?? ?? ?? ?? 53 55 56
ep_only = true

[NX PE Packer v1.0]
signature = FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00
ep_only = true

[NX PE Packer v1.0]
signature = 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00
ep_only = true

[Obsidium vx.x.x.x]
signature = E8 47 19
ep_only = true

[Pack Master v1.0]
signature = 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true

[Pack Master v1.0]
signature = 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81
ep_only = true

[Packed with: PKLITE v1.50 with CRC check (1)]
signature = 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[Packer=Petite v2.2 Compresor www.un4seen.com/petite]
signature = B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Packman 0.0.0.1]
signature = 60 E8 ?? ?? ?? ?? 58 8D A8
ep_only = true

[Packman 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00
ep_only = true

[Packman 0.0.0.1 -> bubba]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true

[Packman 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Packman 0.0.0.1 -> Bubbasoft]
signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3
ep_only = true

[Packman Executable Image Packer 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF
ep_only = true

[Packman v0.0.0.1]
signature = 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48
ep_only = true

[Packman V0.0.0.1 -> Bubbasoft]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8
ep_only = true

[Packman V1.0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA
ep_only = true

[Packman v1.0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B
ep_only = true

[Password Protector for the UPX 0.30 -> g0d]
signature = C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86
ep_only = true

[PC Shrinker v0.29]
signature = ?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40
ep_only = true

[PC Shrinker v0.29]
signature = ?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB
ep_only = true

[PC Shrinker v0.45]
signature = ?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40
ep_only = true

[PC Shrinker v0.71]
signature = 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D
ep_only = true

[PE Diminisher v0.1]
signature = 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99
ep_only = true

[PE Diminisher v0.1]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87
ep_only = true

[PE Diminisher v0.1]
signature = 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD
ep_only = true

[PE Diminisher v0.1]
signature = 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00
ep_only = true

[PE Diminisher V0.1 -> Teraphy]
signature = 53 51 52 56 57 55 E8 00 00 00 00
ep_only = true

[PE Intro v1.0]
signature = 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB
ep_only = true

[PE Pack v1.0]
signature = 74 ?? E9
ep_only = true

[PE Pack v1.0]
signature = 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D
ep_only = true

[PE Packer]
signature = FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10
ep_only = true

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D
ep_only = true

[PE Spin v0.b]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00
ep_only = true

[PE Spin v0.b]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C
ep_only = true

[PE-PACK 1.0]
signature = 74 00 E9
ep_only = true

[PE-PACK 1.0]
signature = 50 FC AD 33 C2 AB 8B D0 E2 F8
ep_only = true

[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN]
signature = C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PE-PACK v1.0 by ANAKiN 1998 (???)]
signature = 74 ?? E9 ?? ?? ?? ?? 00 00 00 00
ep_only = true

[PEBundle v0.2 - v2.0x]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95
ep_only = true

[PEBundle v0.2 - v2.0x]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD
ep_only = true

[PEBundle v2.44]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD
ep_only = true

[PEBundle v3.10]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01
ep_only = true

[PECompact 2.0beta/student version -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F
ep_only = true

[PECompact 2.0beta/student version ->Jeremy Collake]
signature = B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00
ep_only = true

[PECompact 2.0x Heuristic Mode -> Jeremy Collake]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PeCompact 2.53 DLL (Slim Loader) --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32
ep_only = true

[PeCompact 2.53 DLL --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PeCompact 2.53 DLL -> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D
ep_only = true

[PECompact 2.5x -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? FF E0
ep_only = true

[PECompact 2.x (beta version) ->Jeremy Collake]
signature = B8 ?? ?? ?? 00 80 00 28 40
ep_only = true

[PECompact 2.x -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
ep_only = true

[PeCompact 2.xx (Slim Loader) --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00
ep_only = true

[PeCompact 2.xx (Slim Loader) -> BitSum Technologies]
signature = B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PECompact v0.90]
signature = EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5
ep_only = true

[PECompact v0.92]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5
ep_only = true

[PECompact v0.94]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02
ep_only = true

[PECompact v0.94]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85
ep_only = true

[PECompact v0.977]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87
ep_only = true

[PECompact v0.977]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11
ep_only = true

[PECompact v0.978.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11
ep_only = true

[PECompact v0.978.2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85
ep_only = true

[PECompact v0.99]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85
ep_only = true

[PECompact v0.99]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63
ep_only = true

[PECompact v1.10b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60
ep_only = true

[PECompact v1.10b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[PECompact v1.10b3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95
ep_only = true

[PECompact v1.10b3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49
ep_only = true

[PECompact v1.10b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44
ep_only = true

[PECompact v1.10b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7
ep_only = true

[PECompact v1.10b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14
ep_only = true

[PECompact v1.20 - v1.20.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40
ep_only = true

[PECompact v1.22]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08
ep_only = true

[PECompact v1.22]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D
ep_only = true

[PECompact v1.23b3 - v1.24.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08
ep_only = true

[PECompact v1.23b3 - v1.24.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E
ep_only = true

[PECompact v1.24.2 - v1.24.3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09
ep_only = true

[PECompact v1.33]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E
ep_only = true

[PECompact v1.33]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12
ep_only = true

[PECompact v1.34 - v1.40b1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10
ep_only = true

[PECompact v1.40 - v1.45]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11
ep_only = true

[PECompact v1.40b2 - v1.40b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11
ep_only = true

[PECompact v1.40b2 - v1.40b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12
ep_only = true

[PECompact v1.46]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12
ep_only = true

[PECompact v1.47 - v1.50]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12
ep_only = true

[PECompact v1.60 - v1.65]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12
ep_only = true

[PECompact v1.66]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11
ep_only = true

[PECompact v1.67]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11
ep_only = true

[PECompact v2.0]
signature = B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90
ep_only = true

[PECompact v2.0]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D
ep_only = true

[PECompact v2.0 beta -> Jeremy Collake]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PECompact v2.00 alpha 38]
signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00
ep_only = true

[PeCompact2 2.53-2.76 --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF
ep_only = true

[PEQuake 0.06-> forgat]
signature = E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00
ep_only = true

[PEQuake V0.06 -> forgat]
signature = E8 A5 00 00 00
ep_only = true

[PEQuake V0.06 -> forgat]
signature = E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[PEQuake v0.06 -> forgot/us (h)]
signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64
ep_only = true

[PEQuake v0.06 -> forgot/us (h)]
signature = E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8
ep_only = true

[PEQuake v0.06 by fORGAT]
signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB
ep_only = true

[PEQuake V0.06-> forgot]
signature = E8 A5 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C2 08 00
ep_only = true

[PESpin 1.0 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin 1.1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESPin 1.3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin 1.304 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin 1.3beta -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08
ep_only = true

[PESpin v0.1 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF
ep_only = true

[PESpin v0.1 -> Cyberbob (h)]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08
ep_only = true

[PESpin V0.1 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? B9 A5 08 00 00 8D ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC
ep_only = true

[PESpin v0.3 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00
ep_only = true

[PESpin V0.41 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 02 D2 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 ?? 68 3C 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 59 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 ?? E8 1A 00 00 00
ep_only = true

[PESpin v0.7 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00
ep_only = true

[PESpin v0.7 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00
ep_only = true

[PESpin V0.7 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 01 ?? 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB ?? 83 04 24 0C C3
ep_only = true

[PESpin V0.71 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E
ep_only = true

[PESpin V0.71 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3
ep_only = true

[PESpin V0.b -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0
ep_only = true

[PESpin v1.0 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00
ep_only = true

[PESpin V1.0 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3
ep_only = true

[PESpin V1.1 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E
ep_only = true

[PESpin v1.1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8E P_ ON LY =T RU E
ep_only = true

[PESpin v1.1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8
ep_only = true

[PESpin V1.1 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080311]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB
ep_only = true

[PESpin v1.1 by cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C
ep_only = true

[PESPin v1.3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A
ep_only = true

[PESpin V1.3.betaX -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080311]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3
ep_only = true

[PESpin v1.304 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 0E P_ ON LY =T RU E
ep_only = true

[PESpin v1.304 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin v1.304 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 0
ep_only = true

[PESpin V1.304 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080310]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 ?? ?? ?? ?? EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3
ep_only = true

[PESpin V1.32 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080310]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 17 E6 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D FF E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF E8 02 00 00 00 ?? ?? 5A 81 ?? ?? ?? ?? ?? 83 EA FE 89 95 A9 57 40 00 2B C0 2B C9 83 F1 06 09 85 CB 57 40 00 9C D3 2C 24 80 C1 FB 21 0C 24 50 52 B8 36 C7 09 FF 05 FE 37 F6 00 F7 64 24 08 8D 84 28 B1 35 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC CD 20 BB 69 74 58 0B C1 C3
ep_only = true

[Petite 1.2]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00
ep_only = true

[Petite 1.2]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02
ep_only = true

[Petite 1.3]
signature = 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1
ep_only = true

[Petite 1.3]
signature = ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03
ep_only = true

[Petite 1.3 -> (c)1998 Ian Luck (h)]
signature = ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3
ep_only = true

[Petite 1.4]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6
ep_only = true

[Petite 1.4 -> (c)1998-99 Ian Luck]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3
ep_only = true

[Petite 1.4 -> (c)1998-99 Ian Luck (h)]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = true

[Petite 2.1]
signature = 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8
ep_only = true

[Petite 2.2 -> (c)1998-99 Ian Luck]
signature = ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66
ep_only = true

[Petite 2.2 -> (c)1998-99 Ian Luck (h)]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42
ep_only = true

[Petite v1.4]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00
ep_only = true

[PEtite v1.4]
signature = ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40
ep_only = true

[PEtite v2.0]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68
ep_only = true

[PEtite v2.1]
signature = B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v2.1 (1)]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[PEtite v2.2]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v2.2 -> www.un4seen.com/petite]
signature = B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Petite v?.? (after v1.4)]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83
ep_only = true

[PEtite vx.x]
signature = B8 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[PeX 0.99 -> bart^CrackPl]
signature = E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PEX v0.99]
signature = E9 F5 00 00 00
ep_only = true

[PEX v0.99]
signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00
ep_only = true

[Phonebook packed datafile]
signature = 21 50 48 32 50 41 43 4B 24
ep_only = true

[PKLITE v1.00, v1.03]
signature = B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B
ep_only = true

[PKLITE v1.00c (1)]
signature = 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE
ep_only = true

[PKLITE v1.00c (2)]
signature = BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90
ep_only = true

[PKLITE v1.12, v1.15, v1.20 (1)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20
ep_only = true

[PKLITE v1.12, v1.15, v1.20 (2)]
signature = B8 ?? ?? BA ?? ?? 3B C4 73
ep_only = true

[PKLITE v1.14, v1.15, v1.20 (3)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F
ep_only = true

[PKLITE v1.14, v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20
ep_only = true

[PKLITE v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21
ep_only = true

[PKLITE v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 8B FC 81 ?? ?? ?? 57 57 52 B9 ?? ?? BE ?? ?? 8B FE FD 49 74 ?? AD 92 03 C2
ep_only = true

[PKLITE v1.20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 2D ?? ?? FA 8E D0 BC ?? ?? FB 2D ?? ?? 50 52 80
ep_only = true

[PKLITE v1.20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 8B FC 81 ?? ?? ?? 57 57 52 80
ep_only = true

[PKLITE v1.50 (Device driver compression)]
signature = B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB
ep_only = true

[PKLITE v2.00b [extra]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80
ep_only = true

[PKLITE v2.00c]
signature = 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC
ep_only = true

[PKLITE32 1.1]
signature = 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9
ep_only = true

[PKLITE32 1.1]
signature = 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true

[PKLITE32 v1.1]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8
ep_only = true

[PKLITE32 v1.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true

[PKLITE32 v1.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC
ep_only = true

[PKLITE32 v1.1]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32
ep_only = true

[PoPa 0.01 (Packer on Pascal) -> bagie]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF
ep_only = true

[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = true

[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8
ep_only = true

[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]
signature = E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = true

[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00
ep_only = true

[Protection Plus vx.x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A
ep_only = true

[Protection Plus vx.x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85
ep_only = true

[PseudoSigner 0.1 [Neolite 2.0]
signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]
signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9
ep_only = true

[RAR SFX]
signature = E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90
ep_only = true

[RatPacker (Glue) stub]
signature = 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF
ep_only = true

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A
ep_only = true

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5
ep_only = true

[RLPack 1.1 BasicEdition -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68
ep_only = true

[RLPack 1.18 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]
signature = 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.19 Basic Edition]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 ?? ?? 00 00 EB 0C
ep_only = true

[RLPack 1.20 Basic Edition [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00
ep_only = true

[RLPack 1.20 Basic Edition [LZMA]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83
ep_only = true

[RLPack Full Edition 1.17 (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
ep_only = true

[RLPack Full Edition 1.17 -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF
ep_only = true

[RLPack Full Edition 1.17 DLL (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34
ep_only = true

[RLPack Full Edition 1.17 DLL (LZMA)]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85
ep_only = true

[RLPack Full Edition 1.17 DLL -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true

[RLPack Full Edition 1.17 DLL [aPLib]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75
ep_only = true

[RLPack Full Edition 1.17 iBox (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
ep_only = true

[RLPack Full Edition 1.17 iBox [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34
ep_only = true

[RLPack FullEdition V1.20 (aPlib 0.43) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00
ep_only = true

[RLPack FullEdition V1.20 (BasicEdition Stub) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00
ep_only = true

[RLPack FullEdition V1.20 (LZMA 4.30) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00
ep_only = true

[RLPack V1.0.beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.11 -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.12 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.12 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60
ep_only = true

[RLPack V1.15-V1.16 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.15-V1.16 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14
ep_only = true

[RLPack V1.15-V1.17 Dll -> ap0x]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true

[RLPack V1.18 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68
ep_only = true

[RLPack v1.18 Basic DLL [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A
ep_only = true

[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83
ep_only = true

[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A
ep_only = true

[RLPack V1.18 Basic Edition (aPlib 0.43)  -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74
ep_only = true

[RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00
ep_only = true

[RLPack V1.18 Basic Edition (LZMA 4.30)  -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00
ep_only = true

[RLPack v1.18 Basic [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6
ep_only = true

[RLPack v1.18 Basic [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83
ep_only = true

[RLPack V1.18 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3
ep_only = true

[RLPack V1.19 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76
ep_only = true

[RLPack V1.19 Dll (aPlib 0.43) -> ap0x]
signature = 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x  * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA
ep_only = true

[RLPack V1.20 (aPlib 0.43) -> ap0x   * Sign.By.fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.20 (LZMA 4.30) -> ap0x   * Sign.By.fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.20 Dll (aPlib 0.43) -> ap0x   * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 6F 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.20 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;* Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 (aPlib 0.43) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 (LZMA 4.30) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 80 7C 24 08 01 0F 85 74 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption]
signature = 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption]
signature = 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1
ep_only = true

[Simple UPX Cryptor v30.4.2005 [One layer encryption]
signature = 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true

[SimplePack 1.0X -> bagie]
signature = 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0
ep_only = true

[SimplePack 1.11 Method 1 -> bagie[TMX]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5
ep_only = true

[SimplePack 1.11 Method 1 -> bagie[TMX]]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC
ep_only = true

[SimplePack 1.11 Method 2(NT) -> bagie[TMX]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB
ep_only = true

[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01
ep_only = true

[SimplePack V1.1X (Method1) -> bagie]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0
ep_only = true

[SimplePack V1.1X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00
ep_only = true

[SimplePack V1.1X-V1.2X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00
ep_only = true

[SimplePack V1.21.build.09.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = true

[SimplePack V1.X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = true

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00
ep_only = true

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74
ep_only = true

[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]
signature = 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40
ep_only = true

[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]
signature = 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD
ep_only = true

[Software Compress -> BG Software]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00
ep_only = true

[Software Compress -> BG Software]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true

[Software Compress V1.2 ->  BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00
ep_only = true

[Software Compress V1.2 ->  BG Software Protect Technologies   * Sign.By.fly]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00
ep_only = true

[Software Compress v1.2 -> BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24
ep_only = true

[Software Compress V1.2 -> BG Software Protect Technologies]
signature = E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90
ep_only = true

[Software Compress V1.4 ->  BG Software Protect Technologies   * Sign.By.fly]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3
ep_only = true

[Software Compress v1.4 LITE -> BG Software Protect Technologies]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A
ep_only = true

[Software Compress v1.4 LITE -> BG Software Protect Technologies]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04
ep_only = true

[Special EXE Password Protector 1.0 -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00
ep_only = true

[Splash Bitmap v1.00 (With Unpack Code) --> BoB / Bobsoft]
signature = E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40
ep_only = true

[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01
ep_only = true

[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = true

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60
ep_only = true

[Themida 1.2.0.1 (compressed) -> Oreans Technologies]
signature = B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = true

[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]
signature = B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Thinstall vx.x]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33
ep_only = true

[TSCRUNCH v3.01]
signature = EB J3 06 1E 55 57 56 52 51 53 50 16 1F 0E 07 8B F4
ep_only = true

[Ultra Compressor`s Archive]
signature = 55 43 32 1A
ep_only = true

[Unknown encryptor (2) - "PK7Tjrvx"]
signature = 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8
ep_only = true

[Unknown packer (02)]
signature = FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB
ep_only = true

[Unknown packer (03)]
signature = 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C
ep_only = true

[Unknown packer (04)]
signature = BC ?? ?? C3 2E FF 2E ?? ?? CF
ep_only = true

[Unknown packer (05)]
signature = FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27
ep_only = true

[Unknown packer (06)]
signature = FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC
ep_only = true

[Unknown packer (07)]
signature = 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83
ep_only = true

[Unknown packer (08)]
signature = 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F
ep_only = true

[Unknown Packer -> Northfox]
signature = 54 59 68 61 7A 79
ep_only = true

[Unknown SFX Archive (aWAW)]
signature = 61 57 41 57
ep_only = true

[Unknown SFX Archive (IDSKA32)]
signature = 69 64 73 6B 61 33 32
ep_only = true

[Unknown SFX Archive (MRI)]
signature = 4D 52 49
ep_only = true

[Unknown UPX modifyer]
signature = E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3
ep_only = true

[Unknown UPX or File modifyer]
signature = E8 02 00 00 00 CD 03 5A 81 C2 86 EA FE FF 81 C2 45 23 01 00 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3
ep_only = true

[Unpacked BS-SFX Archive v1.9]
signature = 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73
ep_only = true

[Unpacked BS-SFX Archive v1.9]
signature = 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8
ep_only = true

[Upack 0.10 - 0.12 beta -> Dwing]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1
ep_only = true

[Upack 0.12 beta -> Dwing]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7
ep_only = true

[Upack 0.12 beta-->Dwing]
signature = BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1
ep_only = true

[Upack 0.1x -> Dwing]
signature = BE 48 01 40 00 AD 8B F8
ep_only = true

[Upack 0.1x / 0.20 / 0.21 / 0.24 beta -> Dwing]
signature = BE ?8 01 40 00 AD 8B F8
ep_only = true

[Upack 0.1x / 0.20 / 0.21 / 0.24 beta -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33
ep_only = true

[Upack 0.20 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3
ep_only = true

[Upack 0.20 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00
ep_only = true

[Upack 0.22 - 0.23 -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD
ep_only = true

[Upack 0.22 - 0.23 beta -> Dwing]
signature = ?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00
ep_only = true

[Upack 0.22 - 0.23 beta -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5
ep_only = true

[Upack 0.24 - 0.27 beta / 0.28 alpha -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0
ep_only = true

[Upack 0.2x -> Dwing]
signature = BE 88 01 40 00 AD 8B F8
ep_only = true

[Upack 0.2x beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95
ep_only = true

[Upack 0.38 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true

[Upack 0.399 -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true

[Upack V0.10-V0.11 -> Dwing]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5
ep_only = true

[Upack V0.10-V0.12 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0
ep_only = true

[UPack v0.11]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7
ep_only = true

[Upack v0.1x - v0.2x -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 95
ep_only = true

[Upack V0.1X-V0.2X -> Dwing]
signature = 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C
ep_only = true

[Upack v0.2 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33
ep_only = true

[Upack V0.20 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00
ep_only = true

[Upack V0.21 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00
ep_only = true

[Upack V0.22-V0.23 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 6A 07 BE ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00
ep_only = true

[Upack v0.24 ~ v0.28 Alpha -> Dwing]
signature = BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD
ep_only = true

[Upack V0.24-V0.28 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C
ep_only = true

[Upack V0.28-V0.399 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0
ep_only = true

[Upack v0.29 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29
ep_only = true

[Upack v0.29 Beta ~ v0.31 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3
ep_only = true

[Upack v0.30 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30
ep_only = true

[Upack v0.31 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31
ep_only = true

[Upack v0.32 Beta (Patch) -> Dwing]
signature = BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5
ep_only = true

[Upack v0.35 alpha -> Dwing]
signature = 8B F2 8B CA 03 4C 19 1C 03 54 1A 20
ep_only = true

[Upack V0.36 -> Dwing]
signature = BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00
ep_only = true

[Upack V0.36 -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01
ep_only = true

[Upack V0.36 -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[Upack v0.36 alpha -> Dwing]
signature = AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0
ep_only = true

[Upack v0.36 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B
ep_only = true

[Upack V0.36-V0.37 (DLL) -> Dwing]
signature = 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E
ep_only = true

[Upack V0.36-V0.37 (DLL) -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00
ep_only = true

[Upack V0.37 -> Dwing]
signature = BE ?? ?? ?? ?? AD 50 FF ?? ?? EB
ep_only = true

[Upack v0.37 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F
ep_only = true

[Upack V0.37-V0.39 -> Dwing]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00
ep_only = true

[Upack v0.38 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F
ep_only = true

[Upack v0.39 final -> Dwing]
signature = FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF
ep_only = true

[Upack v0.39 final -> Sign by hot_UNP]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true

[Upack v0.399 -> Dwing]
signature = 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5
ep_only = true

[Upack v0.399 -> Dwing]
signature = 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00
ep_only = true

[Upack v0.399 -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50
ep_only = true

[Upack_Patch -> Dwing]
signature = 81 3A 00 00 00 02 00 00 00 00
ep_only = true

[Upack_Patch or any Version -> Dwing]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02
ep_only = true

[Upack_Patch or any Version -> Sign by hot_UNP]
signature = 60 E8 09 00 00 00 17 CD 00 00 E9 06 02
ep_only = true

[UPX 0.50 - 0.70]
signature = 60 E8 00 00 00 00 58 83 E8 3D
ep_only = true

[UPX 0.72]
signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E
ep_only = true

[UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]
signature = 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF
ep_only = true

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90
ep_only = true

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04
ep_only = true

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB
ep_only = true

[UPX 2.93 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90
ep_only = true

[UPX Alternative stub]
signature = B9 ?? ?? BE ?? ?? BF C0 FF FD
ep_only = true

[UPX Inliner v1.0 by GPcH]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D
ep_only = true

[UPX Inliner v1.0 by GPcH]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01
ep_only = true

[UPX Modified stub]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9
ep_only = true

[UPX Modified stub]
signature = 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD
ep_only = true

[UPX Modified Stub b -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9
ep_only = true

[UPX Modified Stub b -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC
ep_only = true

[UPX Modified Stub b -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB
ep_only = true

[UPX Modified Stub c -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48
ep_only = true

[UPX Protector v1.0x]
signature = EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[UPX v0.51]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90
ep_only = true

[UPX v0.51]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[UPX v0.62]
signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58
ep_only = true

[UPX v0.62]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[UPX v0.70]
signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB
ep_only = true

[UPX v0.71 [DLL]
signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83
ep_only = true

[UPX v0.72]
signature = 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB
ep_only = true

[UPX v0.76.1 [dos exe]
signature = B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC
ep_only = true

[UPX v0.80 - v0.84]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC
ep_only = true

[UPX v0.80 - v0.84]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC
ep_only = true

[UPX v0.81 - v0.84 Modified]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF
ep_only = true

[UPX v0.89.6 - v1.02 / v1.05 - v1.22]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75
ep_only = true

[UPX v0.89.6 - v1.02 / v1.05 - v1.22]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD
ep_only = true

[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true

[UPX v1.03 - v1.04]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF
ep_only = true

[Upx v1.2 -> Marcus & Lazlo]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83
ep_only = true

[UPX V1.94 -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = true

[UPX v2.0 -> Markus, Laszlo & Reiser (h)]
signature = 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = true

[UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = true

[UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00
ep_only = true

[UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56
ep_only = true

[UPX$HiT 0.0.1 -> DJ Siba]
signature = E2 FA 94 FF E0 61 00 00 00 00 00 00 00
ep_only = true

[UPX$HiT v0.0.1]
signature = 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61
ep_only = true

[Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft]
signature = 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61
ep_only = true

[UPX-SCRAMBLER 3.06 -> �OnT�oL]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6
ep_only = true

[UPX-Scrambler RC v1.x]
signature = 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E
ep_only = true

[UPX-Shit 0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? <S PA NS TY LE =" FO NT -W EI GH T: BO LD "> 01 </ SP AN >? ?? ?? ?0 05 55 05 82 D5 36 86 97 42 07 63 02 E3 12 02 D2 07 77 77 72 E6 26 C6 16 36 B6 C6 F6 76 96 32 E6 E6 57 42 02 D2 06 36 F6 46 52 06 27 92 05 B3 53 03 06 D6 87 A5 D
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00
ep_only = true

[v.02Packer -> tt.t]
signature = 60 E8 36 FE FF FF C3 90 ?? 00
ep_only = true

[VisualUPX 0.2 -> emadicius]
signature = 66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF
ep_only = true

[VPacker -> ttui]
signature = 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60
ep_only = true

[Vx: ACME (Clonewar Mutant)]
signature = FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE
ep_only = true

[Vx: Agiplan.1536]
signature = E9 J1 J1 50 B0 ?? BA ?? ?? EE BA ?? ?? EC 3C ?? 76 ?? E9 ?? ?? B8 ?? ?? CD 21 8C D8 8E C0 83 ?? ?? 75 ?? E9 ?? ?? BA ?? ?? B8 ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[Vx: ARCV.4]
signature = E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06
ep_only = true

[Vx: August 16th (Iron Maiden)]
signature = BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02
ep_only = true

[Vx: Backfont.900]
signature = E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83
ep_only = true

[Vx: Caterpillar.1575]
signature = EB J3 06 1E 8C C0 0E 1F 0E 07 A3 ?? ?? 8C D0 A3 ?? ?? B0 ?? E6 20 FC ?? C0 8E D8 ?? F6 BF ?? ?? B9 ?? ?? F2 A4 1E 17
ep_only = true

[Vx: Caz.1204]
signature = E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10
ep_only = true

[Vx: Compiler]
signature = 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E
ep_only = true

[Vx: Eddie.1530]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E
ep_only = true

[Vx: Eddie.1800]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E
ep_only = true

[Vx: Eddie.2000]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21
ep_only = true

[Vx: Eddie.2100]
signature = E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC
ep_only = true

[Vx: Eddie.based.1745]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8
ep_only = true

[Vx: EVC.161]
signature = E9 J1 J1 06 FA 33 DB 8E C3 26 ?? ?? ?? ?? 8F ?? ?? ?? 26 ?? ?? ?? ?? 8F ?? ?? ?? B8 21 25 BA ?? ?? CD 21 FB 07 BA ?? ?? CD 27
ep_only = true

[Vx: Explosion.1000]
signature = E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8
ep_only = true

[Vx: FaxFree.Topo]
signature = FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB
ep_only = true

[Vx: Gotcha.879]
signature = E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21
ep_only = true

[Vx: Grazie.883]
signature = 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21
ep_only = true

[Vx: GRUNT.1.Family]
signature = 01 B9 ?? 00 31 17
ep_only = true

[Vx: Hafen.1641]
signature = E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC
ep_only = true

[Vx: Hafen.809]
signature = E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D
ep_only = true

[Vx: Heloween.1172]
signature = E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D
ep_only = true

[Vx: Horse.1776]
signature = E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07
ep_only = true

[Vx: Hymn.1865]
signature = E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21
ep_only = true

[Vx: KBDflags.1024]
signature = 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22
ep_only = true

[Vx: Kuku.448]
signature = AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB
ep_only = true

[Vx: Lehigh.555]
signature = E9 J1 J1 E8 ?? ?? 5E 83 ?? ?? 8B DE 81 ?? ?? ?? 53 81 ?? ?? ?? B4 19 CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 4A CD 21
ep_only = true

[Vx: Lucee.1888]
signature = E9 J1 J1 E8 ?? ?? 5E 83 ?? ?? FC 50 53 B8 ?? ?? CD 21 3D ?? ?? 75 ?? E9
ep_only = true

[Vx: Manuel.based]
signature = E9 J1 J1 0E B8 ?? ?? 50 06 1E 55 E8 ?? ?? 43 60 14 ?? 02 E9 53 0C 00 ?? ?? ?? ?? ?? ?? 5D 83 ?? ?? 8D ?? ?? ?? BF ?? ?? A5 A4 B4 ?? CD 21
ep_only = true

[Vx: Mh.757]
signature = E9 J1 J1 B8 ?? ?? CD 21 3C 07 75 ?? FB B8 ?? ?? CD 21 8C C8 48 8E C0 26 ?? ?? ?? ?? ?? 74 ?? B4 ?? BB ?? ?? CD 21 81 ?? ?? ?? 72 ?? B4 ?? CD 21 72 ?? 48 8E C0 FA
ep_only = true

[Vx: Necropolis]
signature = B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0
ep_only = true

[Vx: Noon.1163]
signature = E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC
ep_only = true

[Vx: November 17.768]
signature = E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC
ep_only = true

[Vx: Number One]
signature = F9 07 3C 53 6D 69 6C 65 3E E8
ep_only = true

[Vx: Payback.dropper]
signature = E9 J1 J1 B9 ?? ?? B8 ?? ?? BE ?? ?? 49 78 ?? 30 04 86 E0 D3 C8 4E EB
ep_only = true

[Vx: Phoenix.927]
signature = E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8
ep_only = true

[Vx: Predator.2448]
signature = 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC
ep_only = true

[Vx: Quake.518]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81
ep_only = true

[Vx: Raubkopie.2219]
signature = E9 J1 J1 8C D0 2E ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 8E D0 BC ?? ?? 1E 8E D8 58 A3 ?? ?? E8 ?? ?? 8C C8 8E C0 E8 ?? ?? BA ?? ?? B4 1A CD 21
ep_only = true

[Vx: Spanz]
signature = E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84
ep_only = true

[Vx: TravJack.883]
signature = EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81
ep_only = true

[Vx: Trivial.25]
signature = B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD
ep_only = true

[Vx: Trivial.46]
signature = B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21
ep_only = true

[Vx: Trojan.Format]
signature = E9 J1 J1 B4 2A CD 21 81 F9 ?? ?? 72 ?? 80 FE ?? 72 ?? 80 FA ?? 72 ?? B8 ?? ?? BB
ep_only = true

[Vx: Trojan.Shock]
signature = E9 J1 J1 BE ?? ?? E8 ?? ?? B2 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? BE ?? ?? E8 ?? ?? B8 00 4C CD 21 ?? 50 52 AC
ep_only = true

[Vx: Trojan.Surprice]
signature = E9 J1 J1 BF ?? ?? 8B ?? ?? 8D ?? ?? ?? B9 ?? ?? 81 ?? ?? ?? AD E2
ep_only = true

[Vx: Uddy.2617]
signature = 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98
ep_only = true

[Vx: VCL]
signature = AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89
ep_only = true

[Vx: VCL]
signature = 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3
ep_only = true

[Vx: VCL (encrypted)]
signature = 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3
ep_only = true

[Vx: VirusConstructor.based]
signature = BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8
ep_only = true

[Vx: VirusConstructor.based]
signature = E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21
ep_only = true

[Vx: XPEH.4768]
signature = E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8
ep_only = true

[Vx: XRCV.1015]
signature = E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B
ep_only = true

[Vx: Zherkov.2968]
signature = E9 J1 J1 EB ?? ?? ?? ?? 53 51 52 57 06 1E E8 ?? ?? 5E 2E ?? ?? ?? 3C 00 74 ?? 8B FE 83
ep_only = true

[Wavelet compressed bitmap]
signature = 57 49
ep_only = true

[WinRAR 32-bit SFX Module]
signature = E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF
ep_only = true

[WinRAR 32-bit SFX Module]
signature = E9 ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[WinUpack v0.30 beta -> By Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 7E P_ ON LY =T RU E
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 7
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33
ep_only = true

[WinUpack v0.39 final -> By Dwing c)2005]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51
ep_only = true

[WinZip (32-bit) 6.x]
signature = FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15
ep_only = true

[WWPACK v3.00, v3.01 (Extractable)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC
ep_only = true

[WWPACK v3.00, v3.01 (Relocations pack)]
signature = BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC
ep_only = true

[WWPACK v3.02, v3.02a (Extractable)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3
ep_only = true

[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC
ep_only = true

[WWPACK v3.03]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53
ep_only = true

[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)]
signature = 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Extractable)]
signature = 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Modified)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Unextractable + Password checking)]
signature = 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Unextractable + Virus Shield)]
signature = 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[!EPack 1.4 lite (final) - by 6aHguT]
signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
ep_only = false

[AHTeam EP Protector 0.3 (fake PEtite 2.2) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50
ep_only = false

[Aspack v2.12 -> www.aspack.com]
signature = ?? ?8 0? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?3 ?? ?? 0? ?? 0? ?? ?? ?? ?? ?? 0? ?? ?F ?? ?? ?3 0? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?0 0? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8
ep_only = false

[BeRoEXEPacker V1.00 -> BeRo]
signature = BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74
ep_only = false

[CreateInstall Stub vx.x]
signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40
ep_only = false

[Crunch 5 / Fusion 4 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00
ep_only = false

[Crunch/PE]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2
ep_only = false

[Crunch/PE v1.0.x.x]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = false

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00
ep_only = false

[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50
ep_only = false

[EXECryptor 2.xx (compressed resources)]
signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3
ep_only = false

[EXECryptor 2.xx (max. compressed resources)]
signature = 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50
ep_only = false

[FSG 1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38
ep_only = false

[FSG 1.31 (Eng) -> dulek/xt]
signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3
ep_only = false

[FSG 1.31 -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB
ep_only = false

[FSG v1.00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = false

[FSG v2.0]
signature = 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75
ep_only = false

[FSG v2.0 -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE
ep_only = false

[hmimys-Packer 1.0]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00
ep_only = false

[hmimys-Packer 1.0 -> hmimys]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07
ep_only = false

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER] (h)]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = false

[KBys Packer 0.28 Beta -> Shoooo]
signature = 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53
ep_only = false

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8
ep_only = false

[MEW 11 SE 1.2]
signature = E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = false

[MEW 11 SE v1.0 -> Northfox]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[MEW 11 SE v1.2 -> Northfox]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC
ep_only = false

[Mew 5.0.1 -> NorthFox / HCC]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E
ep_only = false

[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75
ep_only = false

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7
ep_only = false

[NoodleCrypt v2.0]
signature = EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01
ep_only = false

[nPack 1.1.300.2006 Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35
ep_only = false

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00
ep_only = false

[nPack V1.1.275.2006.Beta -> NEOx * Sign.By.fly * 200800212]
signature = 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3
ep_only = false

[NSPack -> Nort Star Software - url:://www.nsdsn.com/]
signature = 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08
ep_only = false

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68
ep_only = false

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD
ep_only = false

[NsPack 3.0 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40
ep_only = false

[NsPack 3.0 by North Star (Liu Xing Ping)]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95
ep_only = false

[NsPack 3.1 by North Star (Liu Xing Ping)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5
ep_only = false

[nSpack V2.3 -> LiuXingPing]
signature = 9C 60 70 61 63 6B 24 40
ep_only = false

[nSpack V2.x -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5
ep_only = false

[NTPacker 1.0 -> ErazerZ]
signature = 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1
ep_only = false

[Nullsoft PIMP Install System v1.3x]
signature = 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74
ep_only = false

[Packman 0.0.0.1 -> Bubbasoft]
signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00
ep_only = false

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B
ep_only = false

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9
ep_only = false

[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN]
signature = C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70
ep_only = false

[PEQuake 0.06-> forgat]
signature = E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64
ep_only = false

[PESpin 0.3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false

[PESpin 0.7 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false

[PESpin 1.3x -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false

[PeX 0.99 -> bart^CrackPl]
signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = false

[PKLITE32 v1.1]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10
ep_only = false

[PoPa 0.01 (Packer on Pascal) -> bagie]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10
ep_only = false

[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]
signature = E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10
ep_only = false

[RatPacker (Glue) stub]
signature = 40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF
ep_only = false

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A
ep_only = false

[RLPack 1.16 (aPLib compression) -> ap0x (h)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B
ep_only = false

[RLPack 1.16 (LZMA compression) -> ap0x (h)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2
ep_only = false

[RLPack 1.20 Basic Edition [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3
ep_only = false

[RLPack 1.20 Basic Edition [LZMA]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59
ep_only = false

[RLPack Full Edition V1.1X -> ap0x]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F
ep_only = false

[RLPack Full Edition V1.1X -> ap0x]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10
ep_only = false

[RLPack FullEdition V1.20 (aPlib 0.43) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65
ep_only = false

[RLPack FullEdition V1.20 (BasicEdition Stub) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69
ep_only = false

[SimplePack 1.2.build.30.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack 1.21.build.09.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack 1.X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack V1.1X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack V1.1X-V1.2X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = false

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00
ep_only = false

[SPLayer v0.08]
signature = 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = false

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00
ep_only = false

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB
ep_only = false

[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25
ep_only = false

[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Upack 0.22 - 0.23 beta -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54
ep_only = false

[Upack 0.36 beta -> Dwing]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72
ep_only = false

[Upack 0.37 beta -> Dwing]
signature = BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C
ep_only = false

[UPack Alt Stub -> Dwing]
signature = 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD
ep_only = false

[Upack Upack 0.30 - 0.32 beta -> Dwing]
signature = 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84
ep_only = false

[Upack v0.10 - v0.12Beta -> Sign by hot_UNP]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false

[Upack V0.29-V0.31 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10
ep_only = false

[Upack V0.32 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 85 5C FF 16 72 57 2C 03 73 02 ?? ?? 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? ?? ?? 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 16 5A 9F 12 C0 D0 E9 74 0E ?? ?? ?? ?? ?? ?? ?? ?? ?? B5 01 FF 56 08 ?? ?? FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F ?? ?? D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 ?? ?? 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0
ep_only = false

[Upack v0.32 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5
ep_only = false

[Upack v0.32 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5
ep_only = false

[Upack V0.33-V0.34 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 57 51 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF C1 ED ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3
ep_only = false

[Upack V0.35 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? ?? ?? ?? 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 A8
ep_only = false

[Upack V0.36 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 18 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 1C 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 1C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 14 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 3C E2 E3
ep_only = false

[Upack V0.37 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10
ep_only = false

[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Dwing]
signature = 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33
ep_only = false

[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Sign by hot_UNP]
signature = 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08
ep_only = false

[Upack V0.38 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5B 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? 69 ED 00 0C 00 00 8D AC 2B 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 FB 00 00 00 04 F9 1A C0 B1 30 8B 6B 08 03 D1 FF 16 73 49 03 D1 FF 16 72 17 03 D1 FF 16 72 27 24 02 04 09 50 8B C7 2B 43 08 8A 00 E9 CD 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 24 03 04 08 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 95 00 00 00 24 03 04 07 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10
ep_only = false

[Upack v0.39 final -> Dwing]
signature = 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91
ep_only = false

[Upack V0.39-V0.399 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 4F 04 FD 1A D2 22 C2 3C 07 73 F6 50 0F B6 6F FF ?? ?? ?? 66 69 ED 00 03 8D AC AB 08 10 00 00 57 B0 01 E3 1F 2B 7B 08 84 0F 0F 95 C4 FE C4 8D 54 85 00 FF 16 12 C0 D0 E9 74 0E 2A E0 80 E4 01 75 E6 33 C9 B5 01 FF 56 50 33 C9 5F E9 F2 00 00 00 04 F9 1A C0 B1 30 24 03 8B 6B 08 04 08 03 D1 FF 16 73 42 03 D1 FF 16 72 14 03 D1 FF 16 72 24 0C 01 50 8B C7 2B 43 08 B1 80 8A 00 EB CE 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 8F 00 00 00 48 87 6B 0C 50 87 6B 10 8D 93 C0 0B 00 00 89 6B 14 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 B1 40 F6 E1 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5A 33 ED D1 E8 83 D5 02 48 91 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF
ep_only = false

[Upack_Patch -> Dwing]
signature = 2A A3 F2 54 CE
ep_only = false

[UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = false

[UPX Protector v1.0x]
signature = EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB
ep_only = false

[UPX v2.0 -> Markus, Laszlo & Reiser]
signature = 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80
ep_only = false

[UPX-Scrambler RC v1.x]
signature = 66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00
ep_only = false

[VX: Tibs/Zhelatin "StormWorm" variant]
signature = FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8
ep_only = false

[WinUpack v0.30 beta -> By Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00
ep_only = false

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false

[WWPACK v3.00, v3.01 (Extractable)]
signature = 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35
ep_only = false



================================================
FILE: peid_rules/PE/protection.userdb.txt
================================================
; PEiD signature database - protection
; Auto-categorized from userdb.txt (943 entries)

[* [MSLRH] V0.31 -> emadicius]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1
ep_only = true

[*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)]
signature = 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04
ep_only = true

[.BJFnt v1.1b]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56
ep_only = true

[.BJFnt v1.1b]
signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8
ep_only = true

[.BJFnt v1.2 RC]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB
ep_only = true

[.BJFnt v1.2 RC]
signature = EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47
ep_only = true

[.BJFnt v1.3]
signature = EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB
ep_only = true

[.BJFnt v1.3]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60
ep_only = true

[.BJFnt v1.3]
signature = EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72
ep_only = true

[.BJFnt v1.3]
signature = EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF
ep_only = true

[624 (Six to Four) v1.0]
signature = 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED
ep_only = true

[A program by Jupiter ..]
signature = 2B C0 74 05 68 ?? ?? ?? ?? 50
ep_only = true

[A3E (TXT2COM)]
signature = 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB
ep_only = true

[ABKprot v1.00]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 J3 9C 8C C0 06 5B 59 51 53 BA ?? ?? 87 F2 56 CF 0E 1F 0E 07
ep_only = true

[Added HYPDOC v.1.0]
signature = E9 J1 J1 E8 ?? ?? E8 ?? ?? E8 ?? ?? 2E C6 ?? ?? ?? ?? 2E C6 06 ?? ?? ?? B9 ?? ?? 2E 8A 26 ?? ?? B0 ?? E8 ?? ?? 2E
ep_only = true

[AdFlt2]
signature = 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD
ep_only = true

[AEP v1.00]
signature = E8 J1 J1 E4 21 2E ?? ?? ?? 33 C0 8B D8 5D B9 ?? ?? 50 B8 ?? ?? E6 21 0F A9 E6 ?? 53
ep_only = true

[AINEXE v2.1]
signature = A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9
ep_only = true

[AINEXE v2.30]
signature = 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8
ep_only = true

[Alex Protector 1.0 -> Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00
ep_only = true

[Alex Protector 1.0 beta 2 by Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85
ep_only = true

[Alex Protector 1.0 beta 2 by Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25
ep_only = true

[Alex Protector v0.4 beta 1 by Alex]
signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00
ep_only = true

[Alex Protector v1.0 -> Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B
ep_only = true

[Alloy 4.x -> PGWare LLC]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85
ep_only = true

[Alloy 4.x -> PGWare LLC]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68
ep_only = true

[Alloy v1.x.2000]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B
ep_only = true

[Aluwain v8.09]
signature = 8B EC 1E E8 ?? ?? 9D 5E
ep_only = true

[ANDpakk2 (apk2) V0.06 -> Dmitry &quot;AND&quot; Andreev&nbsp; &nbsp;* Sign.By.fly * 20080731]
signature = 60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 (apk2) V0.18 -> Dmitry &quot;AND&quot; Andreev&nbsp; &nbsp;* Sign.By.fly * 20080731]
signature = FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 0.06 - by Dmitry "AND" Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 0.06 - by Dmitry "AND" Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74
ep_only = true

[ANDpakk2 0.06 -> Dmitry Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E
ep_only = true

[ANDpakk2 0.18 - by Dmitry "AND" Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 0.18 -> Dmitry Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8
ep_only = true

[Anti007 V2.5-V2.6 -> LiuXingPing   * Sign.By.fly]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00
ep_only = true

[AntiDote 1.0 Beta -> SIS-Team]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0
ep_only = true

[AntiDote 1.0 beta -> Spy Instructor]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00
ep_only = true

[AntiDote 1.0 beta -> Spy Instructor]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08
ep_only = true

[AntiDote 1.0.Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65
ep_only = true

[AntiDote 1.0.Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52
ep_only = true

[AntiDote 1.2 Beta (Demo) -> SIS-Team]
signature = 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0
ep_only = true

[AntiDote 1.2.Demo -> SIS-Team]
signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B
ep_only = true

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF
ep_only = true

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11
ep_only = true

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B
ep_only = true

[AntiDote 1.2/1.4 SE DLL -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB
ep_only = true

[AntiDote 1.4 SE -> SIS-Team]
signature = 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3
ep_only = true

[AntiDote V1.2 -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00
ep_only = true

[AntiDote V1.2.Demo -> SIS-Team]
signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08
ep_only = true

[AntiDote v1.4 osCE  *Sing by osC++CoDeR]
signature = 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00
ep_only = true

[AntiDote v1.4 osCE *Sing by osC++CoDeR]
signature = 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74
ep_only = true

[AntiDote V1.x -> SIS-Team]
signature = 68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF
ep_only = true

[AntiVirus Vaccine v.1.03]
signature = FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2
ep_only = true

[aPack v0.62]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6
ep_only = true

[aPack v0.82]
signature = 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB
ep_only = true

[aPack v0.98 -m]
signature = 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76
ep_only = true

[aPack v0.98b (com)]
signature = BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4
ep_only = true

[aPack v0.98b (DS & ES not saved)]
signature = 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75
ep_only = true

[APatch GUI v1.1]
signature = 52 31 C0 E8 FF FF FF FF
ep_only = true

[APatch GUI v1.1]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08
ep_only = true

[App Protector -> Silent Team]
signature = E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF
ep_only = true

[App Protector -> Silent Team]
signature = E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A
ep_only = true

[ARM Protector 0.1 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4
ep_only = true

[ARVID's TDR file]
signature = 74 00 00 00
ep_only = true

[AsCrypt v0.1 -> SToRM]
signature = 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB
ep_only = true

[AsCrypt V0.1 -> SToRM   * Sign.By.fly]
signature = B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true

[AsCrypt v0.1 -> SToRM - #2]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2
ep_only = true

[AsCrypt v0.1 -> SToRM - #3]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2
ep_only = true

[AsCrypt v0.1 -> SToRM - #4]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2
ep_only = true

[ASDPack -> asd   * Sign.By.fly]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90
ep_only = true

[ASDPack 2.0 -> asd]
signature = 5B 43 83 7B 74
ep_only = true

[ASYLUM Music File v.1.0]
signature = 41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00
ep_only = true

[Audio-CD file]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74
ep_only = true

[AVP Antiviral Database]
signature = 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65
ep_only = true

[AVP Inspector Database]
signature = 47 68 6F 73 74 20 42 75 73 74 65 72
ep_only = true

[AVPACK v1.20]
signature = 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB
ep_only = true

[BAFF (BMP's) graphics library]
signature = 42 41 46 46 01 00 00 00
ep_only = true

[bambam 0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0
ep_only = true

[bambam 0.04 -> bedrock]
signature = BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00
ep_only = true

[BamBam v0.01]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5
ep_only = true

[bambam V0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF
ep_only = true

[bambam V0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = true

[bambam V0.04 -> bedrock]
signature = BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3
ep_only = true

[Banner's banner file]
signature = D1 BA 01 00
ep_only = true

[BAT2COM v1.5 (c) Douglas Boling, PC Magazine]
signature = EB J3 FC BD ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? B4 4A CD 21 A1 ?? ?? 89
ep_only = true

[BDC HelpSystem Help file]
signature = 42 44 43 20 48 65 6C 70 53 79 73 74 65 6D
ep_only = true

[beria v0.07 public WIP --> symbiont]
signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0
ep_only = true

[beria v0.07 public WIP -> symbiont]
signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7
ep_only = true

[Berio 1.00 beta (h)]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F
ep_only = true

[Berio 2.00 beta (h)]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01
ep_only = true

[BeRo Tiny Pascal -> BeRo]
signature = E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20
ep_only = true

[BGI Device Driver]
signature = 70 6B 08 08 42 47 49 20
ep_only = true

[BGI Stroked Font v.1.1]
signature = 50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31
ep_only = true

[BIN-Lock (tm) 1994]
signature = EB J3 31 C0 8E C0 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? CC CD 01 EB
ep_only = true

[Bitlock 3.1]
signature = EB J3 B4 30 CD 21 3C 03 72
ep_only = true

[BlindSpot 1.0 -> s134k]
signature = 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50
ep_only = true

[BlindSpot 1.0 -> s134k]
signature = 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15
ep_only = true

[BobPack v1.00 --> BoB / BobSoft]
signature = 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01
ep_only = true

[BookManager v9510]
signature = FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50
ep_only = true

[by Central Point Software]
signature = 50 51 52 56 57 8B EB 1E 2E
ep_only = true

[C, C++ Library file]
signature = F0 0D 00 00
ep_only = true

[C-Crypt v1.02]
signature = E9 J1 J1 E8 ?? ?? 5D 83 ?? ?? 55 D9 D0 9C 58 25 ?? ?? 50 9D 50 57 BF ?? ?? B0 ?? AA 5F 58 66 51
ep_only = true

[C.I Crypt V0.2 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[C.I Crypt V0.2 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = true

[CA Visual Objects 2.0 - 2.5]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74
ep_only = true

[CA Visual Objects 2.0 - 2.5]
signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB
ep_only = true

[CA Visual Objects 2.0 - 2.5]
signature = 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3
ep_only = true

[CAN2EXE v0.01]
signature = 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9
ep_only = true

[Can2Exe v0.01]
signature = 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73
ep_only = true

[CC v2.61 Beta]
signature = BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true

[CC286x� v2.1]
signature = E9 J1 J1 EB ?? 9A ?? ?? ?? ?? 81 ?? ?? ?? EB ?? 66 ?? ?? ?? ?? ?? EA ?? ?? ?? ?? FF E6
ep_only = true

[CDS SS 1.0 beta1 -> CyberDoom]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50
ep_only = true

[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8
ep_only = true

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3
ep_only = true

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 0
ep_only = true

[CERBERUS v2.0]
signature = 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5
ep_only = true

[CExe v1.0a]
signature = 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16
ep_only = true

[Ciphator v4.6]
signature = 93 93 E8 J1 J1 58 6A 00 0E 68 ?? ?? CF EB
ep_only = true

[CodeCrypt v0.14b]
signature = E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.15b]
signature = E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.15b]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34
ep_only = true

[CodeCrypt v0.164]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.16b - v0.163b]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00
ep_only = true

[CodeSafe v2.0]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?8 3E C1 05 35 65 7E 8C 40 10 0
ep_only = true

[CodeSafe v2.0]
signature = 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10
ep_only = true

[COM-Crypt II / 386 by ROSE]
signature = E9 J1 J1 BF ?? ?? 57 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 47 47 E2 ?? 33 FF C3
ep_only = true

[COM2EXE]
signature = E9 J1 J1 8C CA 81 C2 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true

[COM2EXE]
signature = EB J3 5B 0E 1F 81
ep_only = true

[COM2EXE]
signature = F0 FF FE FF
ep_only = true

[Com4mail v1.0]
signature = 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A
ep_only = true

[ComCrypt]
signature = E9 J1 J1 B9 ?? ?? BE ?? ?? 89 F7 0E 1F 0E 07 BB ?? ?? FC AD 31 D8 AB E2 ?? C6
ep_only = true

[COMLOCK v0.10 (c) 1994]
signature = E9 J1 J1 EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BB ?? ?? BE ?? ?? 81 ?? ?? ?? 03 F3 BF ?? ?? B9 ?? ?? F3 A4 2E ?? ?? ?? ?? BE ?? ?? 8B CB 2E ?? ?? 46 FE C0 E2
ep_only = true

[COMPACK v4.5 (2)]
signature = BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE
ep_only = true

[COMPACK v5.1]
signature = BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16
ep_only = true

[Comprot v1.0b]
signature = E9 J1 J1 E8 ?? ?? 5E 8B EE 81 ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? F6 14 46 E2 ?? 4B
ep_only = true

[ComProtector v1.0]
signature = E9 J1 J1 B9 ?? ?? BB ?? ?? BF ?? ?? 2E ?? ?? 34 ?? FE C8 C0 ?? ?? 2E ?? ?? 2E ?? ?? 2E ?? ?? 47 43 E2
ep_only = true

[COP v1.0 (c) 1988]
signature = BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90
ep_only = true

[Copy Protector v2.0]
signature = 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F
ep_only = true

[Copy Protector v2.0]
signature = E9 J1 J1 50 53 51 52 1E 06 57 E8 ?? ?? 5F 83 EF ?? B4 ?? 1E 0E 1F
ep_only = true

[CopyControl v3.03]
signature = CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C
ep_only = true

[CopyControl v3.03]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9
ep_only = true

[CorelPhotoPaint Image]
signature = 43 50 54 37 46 49 4C 45
ep_only = true

[CPAV]
signature = E8 ?? ?? 4D 5A B1 01 93 01 00 00 02
ep_only = true

[Cracked by AutoHack (1)]
signature = FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC
ep_only = true

[Cracked by Autohack (2)]
signature = 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9
ep_only = true

[CrackStop v1.01 (c) Stefan Esser 1997]
signature = B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC
ep_only = true

[cramble v0.2b3]
signature = E9 J1 J1 60 9C FC ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? 01 2A ?? FF
ep_only = true

[CryExe v4.0]
signature = E9 J1 J1 E9 ?? ?? 31 ED EB ?? F5
ep_only = true

[CRYPACK v3.0]
signature = EB J3 06 1E 8C D8 05 ?? ?? 8E D8 33 DB 0E 07 33 FF BE ?? ?? 8A 07 26 ?? ?? 32 C4 88 07 47 3B FE
ep_only = true

[CrypKey -> Kenonic Controls (h)]
signature = 8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8
ep_only = true

[CrypKey v5 - v6]
signature = E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06
ep_only = true

[CrypKey v5 - v6]
signature = E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50
ep_only = true

[CrypKey V5.6.X -> Kenonic Controls Ltd.]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8
ep_only = true

[CrypKey V5.6.X -> Kenonic Controls Ltd.]
signature = E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1
ep_only = true

[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]
signature = 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8
ep_only = true

[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]
signature = 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA
ep_only = true

[CRYPT Version 1.7 (c) Dismember]
signature = 0E 17 9C 58 F6 ?? ?? 74 ?? E9
ep_only = true

[CRYPT Version 1.7 (c) Dismember (COM)]
signature = 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60
ep_only = true

[CRYPTCOM]
signature = BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3
ep_only = true

[CRYPTCOM]
signature = E9 J1 J1 BE 00 01 56 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 46 46 E2 ?? 31 F6 31 C9 C3
ep_only = true

[CRYPTEXE v1.04 (c) DOP]
signature = EB J3 8B DC EB ?? EA ?? ?? ?? ?? 01 EA 83 FC ?? 74 ?? EB
ep_only = true

[CrypteXeC v1.01]
signature = FD 25 ?? ?? E8 J1 J1 3E BA ?? ?? EC 0C ?? 26 EE ?? B9 ?? ?? 51 51 ?? 87 C9
ep_only = true

[Cryptic 2.0 -> Tughack]
signature = B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3
ep_only = true

[CSV v.01]
signature = E9 J1 J1 FC BE ?? ?? 8B FE B9 ?? ?? 51 56 57 B4 ?? 04 ?? AC ?? ?? 2A C4 32 C4 AA E2 ?? 5F 5E 59
ep_only = true

[D1S1G --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 4
ep_only = true

[DalKrypt 1.0 - by DalKiT]
signature = 68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7
ep_only = true

[Datafile from Norton Utilities]
signature = 50 4E 43 49
ep_only = true

[DBPE v1.53]
signature = 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA
ep_only = true

[DBPE v1.53]
signature = 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0
ep_only = true

[DBPE v2.10]
signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? 53 6C 65 65 70 ?? 47 65 74 54 69 63 6B 43 6F 75 6E 74
ep_only = true

[DBPE v2.10]
signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C
ep_only = true

[DBPE v2.10]
signature = 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE
ep_only = true

[DBPE v2.10]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83
ep_only = true

[DBPE v2.10]
signature = 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08
ep_only = true

[DBPE v2.33]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71
ep_only = true

[DBPE v2.33]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED
ep_only = true

[DCREXE v2.0]
signature = E8 J4 J4 53 E8 ?? ?? 92 5B 83 ?? ?? FF E3 ?? FA 83 ?? ?? FB 5B 52 BA ?? ?? 5A EB
ep_only = true

[DCrypt Private 0.9b -> drmist]
signature = B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF v1.0]
signature = BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46
ep_only = true

[DEF v1.00 (Eng) -> bart/xt]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF v1.00 (Eng) -> bart/xt]
signature = 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8
ep_only = true

[diProtector 1.x -> diProtector Software]
signature = 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5
ep_only = true

[DiskDupe (c) MSD Configuration file]
signature = 4D 53 44 20 44 61 74 61 20 56 65 72 73
ep_only = true

[DiskDupe (c) MSD Users file]
signature = 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E
ep_only = true

[DOS Device Driver]
signature = FF FF FF FF
ep_only = true

[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]
signature = B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04
ep_only = true

[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]
signature = 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85
ep_only = true

[DrWeb v4.00+ Virus DataBase]
signature = 49 44 52 57
ep_only = true

[Dual's eXe 1.0]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF
ep_only = true

[Dual's eXe 1.0]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00
ep_only = true

[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68
ep_only = true

[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75
ep_only = true

[DxPack 1.0]
signature = 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84
ep_only = true

[DxPack 1.0]
signature = 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45
ep_only = true

[DxPack V0.86 -> Dxd]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00
ep_only = true

[DxPack V0.86 -> Dxd]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF
ep_only = true

[DZA Patcher v1.3 -> DZA]
signature = EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00
ep_only = true

[DZA Patcher v1.3 ->DZA]
signature = EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B
ep_only = true

[DzA Patcher v1.3 Loader]
signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78
ep_only = true

[E language]
signature = E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF
ep_only = true

[E language]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00
ep_only = true

[E.You.Di.Dai-> YueHeiFengGao]
signature = 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0
ep_only = true

[E2C by DoP]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3
ep_only = true

[EEXE Version 1.12]
signature = B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21
ep_only = true

[Embed PE v1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68
ep_only = true

[Embed PE v1.13 -> cyclotron]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90
ep_only = true

[EP v1.0]
signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA
ep_only = true

[EP v1.0]
signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1
ep_only = true

[EP v1.0]
signature = 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB
ep_only = true

[EP v2.0]
signature = 6A ?? 60 E9 01 01
ep_only = true

[EPW v1.2]
signature = 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E
ep_only = true

[EPW v1.30]
signature = 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E
ep_only = true

[Escargot 0.1 (final) -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50
ep_only = true

[Escargot 0.1 - by ueMeat]
signature = EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50
ep_only = true

[Escargot V0.1 -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61
ep_only = true

[Escargot V0.1 -> ++Meat]
signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00
ep_only = true

[Exact Audio Copy]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00
ep_only = true

[Exact Audio Copy]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Exact Audio Copy]
signature = EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B
ep_only = true

[Exact Audio Copy]
signature = E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21
ep_only = true

[Exact Audio Copy -> (UnknownCompiler)]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Excalibur 1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00
ep_only = true

[Excalibur 1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08
ep_only = true

[Excalibur V1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39
ep_only = true

[eXcalibur v1.03 -> forgot/us]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
ep_only = true

[eXcalibur v1.03 -> forgot/us (h)]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com (h)]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0
ep_only = true

[Exe Locker 1.0 -> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00
ep_only = true

[Exe Locker 1.0 -> IonIce]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D
ep_only = true

[Exe Locker v1.0 --> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00
ep_only = true

[EXE Manager Version 3.0 1994 (c) Solar Designer]
signature = B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2
ep_only = true

[EXE2COM (Encrupted)]
signature = E9 J1 J1 B9 ?? ?? BE ?? ?? 8B FE 51 56 B4 ?? AC 32 C4 C0 ?? ?? 02 E1 AA E2 ?? BF ?? ?? 5E 59 F3 A4 BE ?? ?? 56 C3
ep_only = true

[EXE2COM (Extra Encruption)]
signature = E9 J1 J1 E8 ?? ?? 5D B2 ?? 8B CD 83 ED ?? BF ?? ?? BE ?? ?? 2B CF AC 32 C2 42 AA E2 ?? B9 ?? ?? BE ?? ?? 03 F5
ep_only = true

[EXE2COM (Limited)]
signature = BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true

[EXE2COM (Method 1)]
signature = 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3
ep_only = true

[EXE2COM (Method 2)]
signature = E9 J1 J1 E8 ?? ?? 5B 50 8C C0 05 ?? ?? 8B ?? ?? ?? 03 C8 89 ?? ?? 8B ?? ?? ?? 03 C8 89
ep_only = true

[EXE2COM (Method 3)]
signature = E9 J1 J1 8C DA 83 ?? ?? 8E DA 4A E8 ?? ?? 81 C3 ?? ?? A1 ?? ?? 2E ?? ?? A1 ?? ?? 03 C2
ep_only = true

[EXE2COM (Method 4)]
signature = E9 J1 J1 E8 ?? ?? 5D 8B CD 83 ?? ?? BF ?? ?? BE ?? ?? 2B CF F3 A4 B9 ?? ?? BE
ep_only = true

[EXE2COM (regular)]
signature = E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D
ep_only = true

[EXE2COM (With CRC check)]
signature = B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3
ep_only = true

[ExeBundle v3.0 (small loader)]
signature = 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
ep_only = true

[ExeBundle v3.0 (standard loader)]
signature = 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB
ep_only = true

[ExeCode v1.0]
signature = E9 J1 J1 FA 8C C3 02 DF 50 33 C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8E D0 BC ?? ?? BE ?? ?? B9 ?? ?? 33 FF 2E ?? ?? ?? ?? ?? ?? 32 DB B0 ?? E6 64 AC
ep_only = true

[EXECrypt 1.0 -> ReBirth]
signature = 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC
ep_only = true

[EXELOCK 666 1.5]
signature = BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9
ep_only = true

[EXERefactor V0.1 -> random]
signature = 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E
ep_only = true

[ExeSplitter 1.0 -> Bill Prisoner / TPOC]
signature = E9 ?? ?? ?? 00 4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ExeSplitter 1.0 -> Bill Prisoner / TPOC]
signature = E9 ?? ?? ?? 00 4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 .. .
ep_only = true

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3
ep_only = true

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 0
ep_only = true

[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66
ep_only = true

[ExeTools COM2EXE]
signature = E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60
ep_only = true

[ExeTools v2.1 Encruptor by DISMEMBER]
signature = E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74
ep_only = true

[eXPressor 1.0 beta -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70
ep_only = true

[eXPressor 1.0 beta -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[eXPressor 1.1 -> CGSoftLabs]
signature = E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00
ep_only = true

[eXPressor 1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true

[eXPressor 1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E
ep_only = true

[eXPressor 1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02
ep_only = true

[eXPressor 1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14
ep_only = true

[eXPressor V1.0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00
ep_only = true

[eXpressor v1.0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13
ep_only = true

[eXpressor v1.1 -> CGSoftLabs]
signature = E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00
ep_only = true

[eXpressor v1.1 -> CGSoftLabs]
signature = E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35
ep_only = true

[eXpressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76
ep_only = true

[eXpressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15
ep_only = true

[eXPressor v1.2.0b]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C
ep_only = true

[eXPressor V1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45
ep_only = true

[eXPressor v1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05
ep_only = true

[eXPressor V1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 B0 06
ep_only = true

[eXPressor v1.4 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8
ep_only = true

[eXPressor v1.4 -> CGSoftLabs]
signature = 65 58 50 72 2D 76 2E 31 2E 34 2E
ep_only = true

[eXpressor v1.4.5 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C
ep_only = true

[eXpressor v1.4.5 -> CGSoftLabs]
signature = 55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B
ep_only = true

[eXPressor V1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C
ep_only = true

[eXPressor v1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC
ep_only = true

[eXPressor v1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D
ep_only = true

[eXPressor V1.4.5.1 -> CGSoftLabs   * Sign.By.fly]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14 89 4D ?? E9 ?? ?? ?? ?? C7 05
ep_only = true

[eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs]
signature = 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35
ep_only = true

[eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs]
signature = 5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0
ep_only = true

[eXpressor Version 1.5.01]
signature = 55 8B EC 81 EC 50 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00
ep_only = true

[eXPressor.FullSupport V1.6.0.1 -> CGSoftLabs&nbsp; &nbsp;* Sign.By.fly * 20080308]
signature = 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00
ep_only = true

[eXPressor.Light V1.6.0.1 -> CGSoftLabs&nbsp; &nbsp;* Sign.By.fly * 20080308]
signature = 55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00
ep_only = true

[eXPressor.PacK 1.5.0.X -> CGSoftLabs]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04
ep_only = true

[eXPressor.Protection 1.5.0.X -> CGSoftLabs]
signature = EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB
ep_only = true

[eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly]
signature = EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02
ep_only = true

[E�εش�-> �ºڷ��]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = true

[FACRYPT v1.0]
signature = B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3
ep_only = true

[FakeNinja v2.8 -> Spirit]
signature = BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40
ep_only = true

[FCRYPT v.1.00 1990]
signature = E9 J1 J1 50 53 51 BE ?? ?? BF ?? ?? 8B EF B9 ?? ?? FC AC 32 C1 AA E2 ?? 59 5B 58 FF
ep_only = true

[fds0ft c0m pr0tect v0.4b]
signature = 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB
ep_only = true

[Feokt]
signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 BE ?? ?? 40 00 BF
ep_only = true

[Feokt]
signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8
ep_only = true

[FIDO mail packet]
signature = 03 00 03 00 CD 07
ep_only = true

[File Analyzer Compiled Datafile Version]
signature = 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E
ep_only = true

[File Analyzer Extended Datafile Version]
signature = 23 03 45 58 54 44 ?? ?? 3A 03
ep_only = true

[File Analyzer Registration file v1.0]
signature = 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31
ep_only = true

[File Analyzer Registration file v1.1]
signature = 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D
ep_only = true

[FishPE V1.0X -> hellfish]
signature = 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00
ep_only = true

[FishPE V1.0X -> hellfish ! Sign by fly]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40
ep_only = true

[FishPE V1.1X -> hellfish   * Sign.By.fly]
signature = 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 18 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C2 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 E0
ep_only = true

[FMC Faust Module music file]
signature = 46 4D 43 21
ep_only = true

[FreeHand 8 document]
signature = 41 47 44 33
ep_only = true

[from NORMAN Anti-Virus Utilites]
signature = E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A
ep_only = true

[Fuck'n'Joy v1.0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF
ep_only = true

[Fuck'n'Joy v1.0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00
ep_only = true

[Fusion 1.0 -> jaNooNi]
signature = 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00
ep_only = true

[G!X Protector 1.2 -> Guru.eXe]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00
ep_only = true

[Gamehouse Media Protector Version Unknown]
signature = 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[Gardian Angel 1.0]
signature = 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB
ep_only = true

[GEM Image graphics file]
signature = 00 01 00 08 00 04 00 02
ep_only = true

[Gem VDI Image graphics file]
signature = 00 01 00 ?? 00 ?? 00 01
ep_only = true

[GHF Protector (pack only) --> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3
ep_only = true

[GHF Protector (pack only) --> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0E P_ ON LY =T RU E
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 0
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[Gleam 1.00]
signature = 83 EC 0C 53 56 57 E8 24 02 00
ep_only = true

[Gleam v1.00]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 0C 53 56 57 E8 24 02 00
ep_only = true

[Gleam v1.00]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[Goat's PE Mutilator 1.6]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Goat's PE Mutilator 1.6]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Goats Mutilator V1.6 -> Goat/_e0f]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D
ep_only = true

[Goats Mutilator v1.6 -> Goat/_e0f]
signature = E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68
ep_only = true

[GOES graphics file]
signature = C8 C4 D9 40 C1 D9 C5 C1
ep_only = true

[Golded's Output text file]
signature = C4 20 5B
ep_only = true

[HACKSTOP v1.00]
signature = FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F
ep_only = true

[HACKSTOP v1.10, v1.11]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true

[HACKSTOP v1.10p1]
signature = B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true

[HACKSTOP v1.11c]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB
ep_only = true

[HACKSTOP v1.13]
signature = 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA
ep_only = true

[HACKSTOP v1.13]
signature = FA BD J2 J2 D4 85 4E 32 EB EB
ep_only = true

[HACKSTOP v1.17]
signature = FA BE J2 J2 05 0C 00 07 1D 4A 46 1E 16 FD AC 44 ?? ?? ?? ?? F1 6D 84 D3 3D ?? ?? CF AF FB 34 DB 33 ?? ?? ?? ?? ?? D0 D6 ?? ?? 92 B4 24 9E
ep_only = true

[HACKSTOP v1.18]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB
ep_only = true

[HACKSTOP v1.19]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB
ep_only = true

[HEALTH v.5.1 by Muslim M.Polyak]
signature = 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26
ep_only = true

[HPA]
signature = E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3
ep_only = true

[HPA]
signature = E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00
ep_only = true

[HSC music file]
signature = C8 E2 04 20
ep_only = true

[IBM PictureMaker graphics file]
signature = 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01
ep_only = true

[Ice v1.00]
signature = EB J3 BE ?? ?? 8B FE 8B ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? 50 FC AD 33 C2 AB 8B D0
ep_only = true

[ICrypt 1.0 - by BuGGz]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65
ep_only = true

[ID Application Protector 1.2 -> ID Security Suite]
signature = 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C
ep_only = true

[ID Application Protector V1.2 -> ID Security Suite ! Sign by fly]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B
ep_only = true

[id Software's WAD file]
signature = 50 57 41 44 0B 00
ep_only = true

[IDA (Interactive Disassembler) database]
signature = 49 44 41
ep_only = true

[ILUCRYPT v4.015 [com]
signature = E9 J1 J1 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true

[ILUCRYPT v4.015 [exe]
signature = 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true

[iLUCRYPT v4.018 [com]
signature = E9 J1 J1 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 31 05 D1 C8 4F 81
ep_only = true

[Imploder v1.04 --> BoB / BobSoft]
signature = 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[Inbuild v1.0 [hard]
signature = B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2
ep_only = true

[Inset Systems IGF graphics file]
signature = 01 80 04 00 01 00 58 00
ep_only = true

[Interplay's MVE file]
signature = 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A
ep_only = true

[JAM v2.11]
signature = 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB
ep_only = true

[JAM v2.11]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00
ep_only = true

[Jovian VI graphics file]
signature = 56 49 ?? ?? ?? ?? ?? 00
ep_only = true

[Khrome Crypt v0.3]
signature = B9 ?? ?? B8 ?? ?? EB ?? 80 ?? ?? EB ?? EB J3 EB ?? 66 ?? ?? ?? ?? ?? 66
ep_only = true

[Kofax Group 4 graphics file]
signature = 2E 4B 46 68 80 00 01 00
ep_only = true

[kryptor 3]
signature = EB 66 87 DB
ep_only = true

[kryptor 5]
signature = E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02
ep_only = true

[kryptor 6]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[kryptor 8]
signature = EB 6A 87 DB
ep_only = true

[kryptor 9]
signature = 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9
ep_only = true

[LamerStop v1.0c (c) Stefan Esser]
signature = E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA
ep_only = true

[Lattice C v1.01]
signature = FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB
ep_only = true

[Lattice C v3.0]
signature = FA B8 ?? ?? 8E D8 B8 ?? ?? 8E
ep_only = true

[LaunchAnywhere v4.0.0.1]
signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3
ep_only = true

[LaunchAnywhere v4.0.0.1]
signature = 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F
ep_only = true

[Launcher Generator v1.03]
signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Launcher Generator v1.03]
signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00
ep_only = true

[LGLZ v1.04 [com]
signature = BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21
ep_only = true

[LGLZ v1.04b]
signature = FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79
ep_only = true

[Libraries by John Socha]
signature = BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21
ep_only = true

[LOCK98 V1.00.28 -> keenvim]
signature = 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08
ep_only = true

[Lockless Intro Pack]
signature = B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB
ep_only = true

[LockProg v0.5a]
signature = E8 J1 J1 E8 ?? ?? E8 ?? ?? BF ?? ?? 8B EC 8B ?? ?? 2E ?? ?? ?? 03 F9 89 0D B4 30 CD 21 3C 02 73 ?? B4 4C CD 21
ep_only = true

[LSI C-86 Run-Time Libray]
signature = B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC
ep_only = true

[LTC v1.3]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06
ep_only = true

[LTC v1.3]
signature = 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB
ep_only = true

[LY_WGKX -> www.szleyu.com]
signature = 4D 79 46 75 6E 00 62 73
ep_only = true

[MacroMedia ShockWave Movie file]
signature = 46 57 53
ep_only = true

[Macromedia Windows Flash Projector/Player v3.0]
signature = 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06
ep_only = true

[Macromedia Windows Flash Projector/Player v3.0]
signature = 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC
ep_only = true

[Macromedia Windows Flash Projector/Player v4.0]
signature = 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[Macromedia Windows Flash Projector/Player v5.0]
signature = 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[Maked by Grabber v.3.84]
signature = E9 J1 J1 FC 8C DB 8C C8 8E D8 8E C0 89 1E ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? E8
ep_only = true

[Maked by The DRAW v.?.??]
signature = EB J3 B4 ?? CD 10 BB ?? ?? 3C ?? 74 ?? 3C ?? 74 ?? C6
ep_only = true

[MASK v2.3]
signature = E8 J1 J1 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 ?? ?? ?? FF ?? ?? 5D 49 E8
ep_only = true

[MaskPE V2.0 -> yzkzero]
signature = B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3
ep_only = true

[MCLock v1.2, v1.3]
signature = E9 J1 J1 90 90 90 FA 29 C0 8E C0 26 C6 06
ep_only = true

[MEGALITE v1.20a]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90
ep_only = true

[MESS v1.07]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? F3 ?? AC E3 ?? EB J3 BA ?? ?? B4 09 CD 21 CD 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 30 CD 21 3C 02 77
ep_only = true

[MESS v1.20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6
ep_only = true

[MESS v1.20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? AC ?? ?? EB J3 1E 0E 1F BA ?? ?? 81 ?? ?? ?? B4 09 CD 21 1F B4 4C CD 21
ep_only = true

[Microsoft Basic Compiler v5.60 1982-97]
signature = 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB
ep_only = true

[Microsoft C]
signature = B4 30 CD 21 3C 02 73 ?? B8
ep_only = true

[Microsoft C (1988/1989)]
signature = B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72
ep_only = true

[Microsoft C (1990/1992)]
signature = B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7
ep_only = true

[Microsoft C for Windows]
signature = 33 ED 55 9A ?? ?? ?? ?? 0B C0 74
ep_only = true

[Microsoft C for Windows (2)]
signature = 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89
ep_only = true

[Microsoft C Library 1985]
signature = BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73
ep_only = true

[Microsoft C v1.04]
signature = FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB
ep_only = true

[Microsoft FORTRAN]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9
ep_only = true

[Microsoft QBasic v3.0]
signature = E9 J1 J1 8C C8 8E D8 E8 ?? ?? 8A 17 0A D2 74 ?? B4 ?? CD 21 43
ep_only = true

[Microsoft QBasic v4.0]
signature = EB J3 0E 1F B8 ?? ?? 50 9A ?? ?? ?? ?? 8E DA 93 8A 17 0A D2 74 ?? B4 ?? CD 21 43
ep_only = true

[Microsoft Windows Cabinet file]
signature = 4D 53 43 46
ep_only = true

[Microsoft Windows Enhanced Metafile]
signature = 01 00 00 00 58
ep_only = true

[Microsoft Windows Help file]
signature = 3F 5F 03
ep_only = true

[Microsoft Windows Metafile]
signature = D7 CD C6 9A
ep_only = true

[Microsoft Windows Shortcut file]
signature = 4C 00 00 00 01 14 02 00 00 00
ep_only = true

[Minke 1.0.1 - by Codius]
signature = 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38
ep_only = true

[Minke V1.0.1 -> Codius]
signature = 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73
ep_only = true

[Minke V1.0.1 -> Codius ! Sign by fly]
signature = 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8
ep_only = true

[mkfpack -> llydd]
signature = E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08
ep_only = true

[MOD 8 Track Oktatracker music file]
signature = 4F 43 54
ep_only = true

[modified HACKSTOP v1.11f]
signature = 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8
ep_only = true

[Morphnah Beta -> Kas]
signature = 2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0
ep_only = true

[mPack 0.0.3 -> DeltaAziz]
signature = 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5
ep_only = true

[mPACK v0.0.2 -> DeltaAziz (h)]
signature = 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF
ep_only = true

[mPACK v0.0.2 -> DeltaAziz (h)]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD
ep_only = true

[mPack V0.03 -> DeltaAziz]
signature = 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ?? 32 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 C9 C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 04 00 00 00 E8 C5 C9 FF FF 83 3D ?? ?? ?? ?? 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 92 C9 FF FF BA 18 A5 00 10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9 FF FF 83 F8 04 74 0A E8 14 B2 FF FF E9 A7 00 00 00 E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 63 C9 FF FF 83 F8 FF 75 0A E8 F1 B1 FF FF E9 84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 D4 CD FF FF 84 C0 75 07 E8 CF B1 FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 0F FA FF FF 3B 05 ?? ?? ?? ?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB FF FF 6A 03 E8 07 C4 FF FF A1 ?? ?? ?? ?? E8 C1 C6 FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 AA C6 FF FF A1 ?? ?? ?? ?? E8 A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F0 E8 A7 B5 FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF FF
ep_only = true

[MPEG movie file]
signature = 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF
ep_only = true

[Mr.HDKiller ProtectioN v1.2]
signature = E9 J1 J1 48 51 44 2E ?? ?? ?? 2D ?? ?? 8B D8 05 ?? ?? 8B F0 BF ?? ?? B9 ?? ?? ?? F3 A4 8B CB D1 E9
ep_only = true

[MS FORTRAN Library 19??]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9
ep_only = true

[MS FORTRAN Library 19??]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26
ep_only = true

[MS HTML-Help file]
signature = 49 54 53 46
ep_only = true

[MS Run-Time Library 1987]
signature = B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92
ep_only = true

[MS Run-Time Library 1988 (04)]
signature = 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB
ep_only = true

[MS Run-Time Library 1990 (06)]
signature = EB J3 B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73
ep_only = true

[MS Run-Time Library 1990 (07)]
signature = 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB
ep_only = true

[MS Run-Time Library 1990 (10)]
signature = E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB
ep_only = true

[MS Run-Time Library 1990, 1992 (09)]
signature = B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E
ep_only = true

[MS Run-Time Library 1992 (11)]
signature = B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5
ep_only = true

[MS Run-Time Library 1992 (13)]
signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21
ep_only = true

[MS Run-Time Library 1992 (14)]
signature = 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30
ep_only = true

[MSCC v1.0cs]
signature = E9 J1 J1 0E 07 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 B9 ?? ?? BE ?? ?? AC CC 98
ep_only = true

[MSLRH]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81
ep_only = true

[MSLRH]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08
ep_only = true

[MSLRH 0.32a (fake SVKP 1.11) -> emadicius]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83
ep_only = true

[MSLRH V0.31 -> emadicius]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B
ep_only = true

[MSLRH v0.31a]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00
ep_only = true

[MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake SVKP 1.11) -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a -> emadicius]
signature = E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C
ep_only = true

[mucki's protector]
signature = BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9
ep_only = true

[mucki's protector II -> mucki]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3
ep_only = true

[MultiEdit`s compiled macros]
signature = 1E AA
ep_only = true

[MultiEdit`s Programming Language help]
signature = 0C 2A 20
ep_only = true

[MZ0oPE 1.0.6b --> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3
ep_only = true

[MZ0oPE 1.0.6b -> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3
ep_only = true

[MZ0oPE 1.0.6b -> TaskFall]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2
ep_only = true

[MZ_Crypt 1.0 - by BrainSt0rm]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00
ep_only = true

[MZ_Crypt 1.0 - by BrainSt0rm]
signature = 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0
ep_only = true

[N-Code 0.1 -> NEX]
signature = BB E8 03 00 00 81 C3 E8 03 00 00 B8 05 00 00 00 B9 73 00 00 00 01 C8 83 E8 32 90 90 90 90 6B C0 02 90 68 FF 64 24 F0 90 90 90 90 90 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68
ep_only = true

[N-Joy 1.0 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00
ep_only = true

[N-Joy 1.1 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0
ep_only = true

[N-Joy 1.3 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00
ep_only = true

[Nakedpack v1.0 -> BigBoote]
signature = 60 FC 0F ?? ?? ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?2 B0 5? ?? ?? ?? ?A 3? ?? ?? ?? ?? ?? ?? ?? ?? ?0 3? ?? ?? ?? ?? ?A 3? ?? ?? ?? ?E 89 A0 00 00 0A 3? ?? ?? ?? ?C 6? ?? ?? ?? ?? ?? ?8 3? ?? ?? ?? ?? ?0 07 50 76 1F F? ?? ?? ?? ?? ?6 1F F? ?? ?? ?6 A0 0F F? ?? ?? ?? ?? ?? ?F F? ?? ?? ?? ?? ?C 3
ep_only = true

[nbuild v1.0 [soft]
signature = B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2
ep_only = true

[Netopsystems FEAD Optimizer]
signature = 60 BE 00 50 43 00 8D BE 00 C0 FC FF
ep_only = true

[Netopsystems FEAD Optimizer]
signature = E8 00 00 00 00 58 BB 00 00 40 00 8B
ep_only = true

[NFO v1.x modified]
signature = 60 9C 8D 50
ep_only = true

[NME 1.1 Public - by redlime]
signature = 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62
ep_only = true

[NME 1.1 Public - by redlime]
signature = 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B
ep_only = true

[North Star PE Shrinker 1.3 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5
ep_only = true

[North Star PE Shrinker v1.3 by Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D
ep_only = true

[North Star PE Shrinker v1.3 by Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01
ep_only = true

[Norton Speed Disk Configuration file]
signature = 4E 6F 72 74 6F 6E 20 53 70 65 65 64
ep_only = true

[NOTA Version 1.1 (c) Novitex 1990]
signature = EB J3 06 1E 33 C0 8E D8 BE ?? ?? 0E 07 BF ?? ?? B9 ?? ?? FC F3 A4 1F 8C D3 BE ?? ?? 8B D4 8E D6 BC ?? ?? 8B F4
ep_only = true

[Nuts & Bolts Disk Image]
signature = 4E 42 69 6D
ep_only = true

[Packanoid -> Arkanoid]
signature = BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8
ep_only = true

[Packanoid 1.0 -> ackanoid]
signature = BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00
ep_only = true

[Packanoid 1.0 -> ackanoid]
signature = 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true

[Packanoid v1 --> Arkanoid]
signature = BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08
ep_only = true

[Packanoid v1 --> Arkanoid]
signature = BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00
ep_only = true

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00
ep_only = true

[PackItBitch V1.0-> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[PACKWIN v1.01p]
signature = 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB
ep_only = true

[PassCOM v2.0 / PPC]
signature = E9 J1 J1 BE ?? ?? B9 ?? ?? 87 1C EB ?? FB FA 87 ?? ?? ?? 87 ?? ?? ?? FB 1F 58 4B EB ?? 50 1E 33 C0 8E D8 EB
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24
ep_only = true

[Password Protector (c) MiniSoft 1992]
signature = E9 J1 J1 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true

[Password protector my SMT]
signature = E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74
ep_only = true

[Password protector my SMT]
signature = C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F
ep_only = true

[PCPaint/Pictor graphics file format]
signature = 34 12 ?? ?? ?? ?? 00 00
ep_only = true

[PCPEC "alpha - preview"]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00
ep_only = true

[PCPEC [alpha]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83
ep_only = true

[PcShare �ļ������� v4.0 -> �޿ɷ���]
signature = 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1
ep_only = true

[Pe Ninja -> +DzA kRAker [TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PE Ninja v1.0 -> +DzA kRAker TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PE Ninja v1.0 -> +DzA kRAker TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[Pe123  v2006.4.12]
signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33
ep_only = true

[Pe123  v2006.4.12]
signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B
ep_only = true

[Pe123  v2006.4.4]
signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC
ep_only = true

[Pe123  v2006.4.4]
signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10
ep_only = true

[Pe123  v2006.4.4-4.12]
signature = 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? 45 ?? 50 E8 ?? FF FF FF ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 45
ep_only = true

[Pe123 v2006.4.12]
signature = 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3
ep_only = true

[PECrc32 0.88 -> ZhouJinYu]
signature = 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00
ep_only = true

[PECrc32 0.88 -> ZhouJinYu]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC
ep_only = true

[PEiD-Bundle 1.02 DLL -> BoB / BobSoft]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00
ep_only = true

[PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft]
signature = 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft]
signature = 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9
ep_only = true

[PEiD-Bundle v1.00 --> BoB / BobSoft]
signature = 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.01 --> BoB / BobSoft]
signature = 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.02 - v1.03 --> BoB / BobSoft]
signature = 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[PEiD-Bundle v1.02 - v1.04 --> BoB / BobSoft]
signature = 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[PEMangle]
signature = 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3
ep_only = true

[PEMangle]
signature = 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61
ep_only = true

[PEnguinCrypt v1.0]
signature = B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0
ep_only = true

[PEnguinCrypt v1.0]
signature = B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB
ep_only = true

[PENinja]
signature = 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90
ep_only = true

[PENinja modified]
signature = 5D 83 ED 06 EB 02 EA 04 8D
ep_only = true

[PEShit]
signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF
ep_only = true

[PEShit]
signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01
ep_only = true

[PGMPACK v0.13]
signature = FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true

[PGPROT]
signature = E9 J1 J1 2E ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 0E 1F 8C C0 01 ?? ?? ?? 01 ?? ?? ?? 26 ?? ?? ?? ?? 07 32 C0 33 FF B9 ?? ?? F2 AE
ep_only = true

[PH Icons file (Trilobyte)]
signature = 69 63 6F 6E 01 00 10 00 10
ep_only = true

[Phoenix Protector v1.0/v1.1 -> NTCore.com]
signature = 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF 07 73 ?? ?? ?? 0A 38 E5 FF FF FF
ep_only = true

[Phonebook configuration file Version %v3.%v4]
signature = 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? V3 ?? V4 ?? 63 6F
ep_only = true

[Phonebook configuration file Version %v3.%v4]
signature = 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF
ep_only = true

[Pksmart 1.0b]
signature = BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3
ep_only = true

[PLINK86 1984, 1985]
signature = FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26
ep_only = true

[PluginToExe v1.00 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00
ep_only = true

[PluginToExe v1.01 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00
ep_only = true

[PluginToExe v1.02 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00
ep_only = true

[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00
ep_only = true

[PocketPC ARM]
signature = F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1
ep_only = true

[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9
ep_only = true

[PocketPC ARM]
signature = 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 01 3C ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF
ep_only = true

[PocketPC SHA]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 00 08 D0 05 D4 06 D5 0B 40 09 00 10 7F 26 4F
ep_only = true

[PocketPC SHA]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09
ep_only = true

[Pohernah 1.0.0 - by Kas]
signature = 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah 1.0.1 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.2 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.3 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.3 - by Kas]
signature = 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28
ep_only = true

[PolyBox C -> Anskya]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11
ep_only = true

[Prepared by SLR (OPTLINK)]
signature = 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F
ep_only = true

[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]
signature = 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56
ep_only = true

[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]
signature = 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08
ep_only = true

[Private EXE Protector 1.8]
signature = BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0
ep_only = true

[Private exe Protector 1.8X-1.9X -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00
ep_only = true

[Private Exe Protector 1.x -> setisoft]
signature = B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3
ep_only = true

[Private EXE Protector 2.0 -> SetiSoft]
signature = 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF
ep_only = true

[Private exe Protector 2.0 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[Private exe Protector 2.15 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00
ep_only = true

[Private exe Protector V1.8 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[Private exe Protector V2.30-V2.3X -> SetiSoft Team   * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Private EXE v2.0a]
signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B
ep_only = true

[PrivateEXE v2.0a]
signature = 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E
ep_only = true

[PRO-PACK v2.08]
signature = 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53
ep_only = true

[PRO-PACK v2.08]
signature = 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B
ep_only = true

[ProActivate V1.0X -> TurboPower Software Company]
signature = 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33
ep_only = true

[Program Protector XP v1.0]
signature = 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D
ep_only = true

[Program Protector XP v1.0]
signature = E8 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[PUNiSHER V1.5 Demo-> FEUERRADER]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00
ep_only = true

[QrYPt0r - by NuTraL]
signature = 80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01
ep_only = true

[R!SC's Process Patcher 1.5.1]
signature = E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92
ep_only = true

[R!SC's Process Patcher v1.4]
signature = E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03
ep_only = true

[R!SC's Process Patcher v1.5.1]
signature = 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05
ep_only = true

[R-CRYPT v0.91]
signature = E9 J1 J1 68 ?? ?? 60 BF ?? ?? B9 ?? ?? B0 ?? 2E ?? ?? FE C0 47 E2 ?? 61 C7 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C3
ep_only = true

[RAZOR 1911 encruptor]
signature = E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true

[RCC II/286 v1.02]
signature = FA BD J2 J2 93 C8 ?? ?? ?? 54 62 E9
ep_only = true

[RCC II/286 v1.14 (hard)]
signature = FA BD J2 J2 B2 ?? 50 3F F2
ep_only = true

[RCC II/286 v1.14 (mild)]
signature = FA BD J2 J2 BE ?? ?? 9C 46 30 ?? ?? ?? 99
ep_only = true

[RCC II/386 v0.51]
signature = FA BC J2 J2 FE ?? ?? 0E 1F 3E ?? ?? ?? ?? ?? 3E ?? ?? ?? ?? ?? B8 ?? ?? CD 21 06 53 B8 ?? ?? CD 21 06 53 8B D5 8C C8 8E D8 B8 ?? ?? CD 21 8B D5 B8 ?? ?? CD 21 CD 01 9C
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET] (h1)]
signature = 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85
ep_only = true

[REC v0.34 [3]
signature = 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true

[REC.Small v1.01]
signature = 8C D8 1E E8 J1 J1 5D 83 ?? ?? 81 ?? ?? ?? B9 ?? ?? 40 8E D8 2B DB B2 55
ep_only = true

[REC.Small v1.02]
signature = 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83
ep_only = true

[Reflexive Arcade Wrapper]
signature = 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF
ep_only = true

[Reflexive Arcade Wrapper]
signature = 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8
ep_only = true

[Reg2Exe 2.20/2.21 - by Jan Vorel]
signature = 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8
ep_only = true

[Reg2Exe 2.22/2.23 - by Jan Vorel]
signature = 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8
ep_only = true

[Reg2Exe 2.22/2.23 - by Jan Vorel]
signature = 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00
ep_only = true

[Reg2Exe 2.24 - by Jan Vorel]
signature = 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16
ep_only = true

[Reg2Exe 2.24 - by Jan Vorel]
signature = 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00
ep_only = true

[Reg2Exe 2.25 - by Jan Vorel]
signature = 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35
ep_only = true

[Reg2Exe 2.25 - by Jan Vorel]
signature = 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00
ep_only = true

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? :3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9 ?? ?? ?? 80 74 0E 51 56 25 ?? ?? ?? 7F 03 C3 8B F0 42 EB B2 51 03 C3 8B 38 03 FD 8B 48 04 D2 0F 30 0F 47 E2 F9 59 E2 AF 4A 74 04 5E 59 EB F7 8D 85 ?? ?? ?? ?? 5D FF E:
ep_only = true

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? :3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9 ?? ?? ?? 80 74 0E 51 56 25 ?? ?? ?? 7F 03 C3 8B F0 42 EB B2 51 03 C3 8B 38 03 FD 8B 48 04 D2 0F 30 0F 47 E2 F9 59 E2 AF 4A 74 04 5E 59 EB F7 8D 85 ?? ?? ?? ?? 5D FF E
ep_only = true

[ResCrypt v1.02]
signature = 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98
ep_only = true

[RIX graphics file]
signature = 52 49 58 33
ep_only = true

[RLP V0.7.3.beta -> ap0x]
signature = 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0
ep_only = true

[RLP V0.7.3.beta -> ap0x ! Sign by fly]
signature = 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56
ep_only = true

[ROD High TECH -> Ayman]
signature = 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00
ep_only = true

[ROD High TECH -> Ayman]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36
ep_only = true

[RTPatch software update package data file]
signature = 4B 2A
ep_only = true

[S3M music file]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 53 43 52 4D
ep_only = true

[Safe 2.0]
signature = 83 EC 10 53 56 57 E8 C4 01 00
ep_only = true

[SciFax Graphics file]
signature = 44 54 3D 00
ep_only = true

[Scitech Software Display Driver]
signature = 56 42 45 41 46 2E 44 52 56
ep_only = true

[SCRAM! v0.8a1]
signature = B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C
ep_only = true

[SCRAM! vC5]
signature = B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true

[SCRAMB v1.20]
signature = E9 J1 J1 E8 ?? ?? 5B 0E 1F 81 ?? ?? ?? 8B C3 05 ?? ?? 50 8B C8 03 D1 2B FA C3
ep_only = true

[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF
ep_only = true

[SDProtector 1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1
ep_only = true

[SDProtector 1.x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SDProtector 1.x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41
ep_only = true

[SDProtector Basic/Pro Edition 1.10 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00
ep_only = true

[SDProtector Basic/Pro Edition 1.10 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64
ep_only = true

[SDProtector Basic/Pro Edition 1.12 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2
ep_only = true

[SDProtector Pro 1.12]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3
ep_only = true

[SDProtector Pro Edition 1.16 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8
ep_only = true

[SDProtector Pro Edition 1.16 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41
ep_only = true

[SDProtector V1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1
ep_only = true

[SDW v1.74]
signature = E9 J1 J1 54 5B 3B DC 75 ?? EB ?? 9C 5B 81 ?? ?? ?? 53 9D 9C 58
ep_only = true

[SEA-AXE]
signature = FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5
ep_only = true

[SEA-AXE]
signature = FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3
ep_only = true

[SecurePE 1.X]
signature = 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3
ep_only = true

[SEN Debug Protector???]
signature = 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55
ep_only = true

[ShellModify 0.1 -> pll621]
signature = 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00
ep_only = true

[SHOWV20 Show-Text Utility]
signature = E9 J1 J1 B8 ?? ?? 2B ?? ?? ?? A3 ?? ?? E8 ?? ?? E8 ?? ?? E8
ep_only = true

[Shrink v1.0]
signature = 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3
ep_only = true

[Shrink Wrap v1.4]
signature = 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB
ep_only = true

[Shrinker 3.2]
signature = 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04
ep_only = true

[Shrinker 3.3]
signature = 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = true

[Shrinker 3.4]
signature = 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04
ep_only = true

[Shrinker v3.2]
signature = 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF
ep_only = true

[Signature = Safe 2.0]
signature = SA FE 2. 0
ep_only = true

[SimbiOZ -> Extranger]
signature = 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00
ep_only = true

[SimbiOZ 1.3 -> Extranger]
signature = 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3
ep_only = true

[SLR (OPTLINK)]
signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21
ep_only = true

[SLR (OPTLINK)]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = true

[SLVc0deProtector 0.60 -> SLV / ICU]
signature = EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD
ep_only = true

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00
ep_only = true

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C
ep_only = true

[SLVc0deProtector v0.6 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90
ep_only = true

[SLVc0deProtector v0.61 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00
ep_only = true

[SmartE -> Microsoft]
signature = EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06
ep_only = true

[SMK movie file]
signature = 53 4D 4B 32
ep_only = true

[SND music file]
signature = 00 00 F8 2A ?? 00
ep_only = true

[SnoopStop v1.15]
signature = ?? E9 J1 J1 EB ?? 20 ?? ?? ?? 73 ?? 20 ?? ?? 41 1A 05
ep_only = true

[Soft Defender 1.1x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44
ep_only = true

[Soft Defender v1.0 - v1.1]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8
ep_only = true

[Soft Defender v1.0 - v1.1]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Soft Defender v1.12]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8
ep_only = true

[SoftComp 1.x -> BG Soft PT]
signature = E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00
ep_only = true

[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F
ep_only = true

[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF
ep_only = true

[Spalsher 1.0 - 3.0 -> Amok]
signature = 9C 60 8B 44 24 24 E8 00 00 00 00
ep_only = true

[Spalsher 1.0 - 3.0 -> Amok]
signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC
ep_only = true

[Spalsher v1.0 - v3.0]
signature = 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84
ep_only = true

[Sphinx C-- v?.?? 19??]
signature = E9 J1 J1 B4 34 CD 21 8C 06 ?? ?? 89 1E ?? ?? B8 ?? ?? E8 ?? ?? B8 ?? ?? BB
ep_only = true

[Sphinx C-- v?.?? 19??]
signature = EB J3 31 C0 8E C0 26 C7 06 ?? ?? ?? ?? 26 8C 0E ?? ?? E9
ep_only = true

[Splash Bitmap v1.00 --> BoB / Bobsoft]
signature = E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00
ep_only = true

[Splice 1.1 - by Tw1sted L0gic]
signature = 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76
ep_only = true

[ST Protector V1.5 -> Silent Software]
signature = 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC
ep_only = true

[Ste@lth PE 1.01 -> BGCorp]
signature = ?? ?? ?? ?? ?? BA ?? ?? ?? 00
ep_only = true

[Stony Brook Pascal v6.14]
signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A
ep_only = true

[Stranik 1.3 Modula/C/Pascal]
signature = E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Stranik 1.3 Modula/C/Pascal]
signature = E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB
ep_only = true

[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]
signature = 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00
ep_only = true

[SuckStop v1.11]
signature = EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B
ep_only = true

[SuckStop v1.11]
signature = 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4
ep_only = true

[SuperDAT]
signature = 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[SVKP v1.32 -> Pavol Cerven (h)]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61
ep_only = true

[SVKP v1.42 -> Pavol Cerven (h)]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67
ep_only = true

[SVKP v1.43 -> Pavol Cerven (h)]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67
ep_only = true

[Symantec WinFax PRO 8.3 Coverpage]
signature = 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C
ep_only = true

[SysPack v0.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? J2 J2 0E 2E ?? ?? ?? ?? 06 53 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? 74 ?? 26 ?? ?? ?? ?? ?? 5B 07
ep_only = true

[T-PACK v0.5c -m1]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE
ep_only = true

[TaiShanXiangYu LockSoft V1.0 -> zlocksoft * Sign.By.fly]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8B D5 81 ?? ?? ?? ?? ?? 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[TAV]
signature = E8 ?? ?? 4D 5A CB
ep_only = true

[The Norton Antivirus Information file]
signature = 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65
ep_only = true

[theWRAP - by TronDoc]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7
ep_only = true

[Thunderbolt V0.02 -> deXep (forgot) * Sign.By.fly]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3
ep_only = true

[Tiny Xor v0.1]
signature = E9 J1 J1 FC B8 ?? ?? BB ?? ?? B9 ?? ?? BE ?? ?? 30 04 02 C3 86 C4 86 DF 46 E2 ?? BE ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 33 C0 33 DB 33 C9 FF E6
ep_only = true

[TINYPROG v3.6, v3.9]
signature = E9 J1 J1 EB ?? C3
ep_only = true

[TLink v%v5.%v6]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 00 FB V5
ep_only = true

[TMT-Pascal's Unit file]
signature = 50 00 00 00 53 50 46 50
ep_only = true

[TopSpeed v3.01 1989]
signature = 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53
ep_only = true

[TPPpack -> clane]
signature = E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8
ep_only = true

[Trainer Creation Kit v5 Trainer]
signature = 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF
ep_only = true

[Trainer Creation Kit v5 Trainer]
signature = 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40
ep_only = true

[Trap v1.21]
signature = E8 J1 J1 5B 83 ?? ?? ?? 8B D3 E8 ?? ?? ?? 5B 2E ?? ?? ?? 74 ?? ?? ?? 8B DA B9 ?? ?? EB
ep_only = true

[Trilobyte's RNR graphics library]
signature = 84 10 ?? ?? ?? ?? ?? ?? ?? 10
ep_only = true

[Trivial173 by SMT/SMF]
signature = EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29
ep_only = true

[TTPpack]
signature = E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05
ep_only = true

[TurboBAT v3.10 .. 5.0]
signature = BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4
ep_only = true

[TXT2COM]
signature = E8 ?? ?? CD 20
ep_only = true

[TXT2COM (Read-A-Matic v1.0)]
signature = B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21
ep_only = true

[TXT2COM v2.06]
signature = 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20
ep_only = true

[TXTMaker v1.22]
signature = EB J3 B4 ?? 33 DB CD 10 80 ?? ?? 74 ?? B0 ?? EB ?? 8B
ep_only = true

[UCEXE v2.3, v2.4]
signature = 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB
ep_only = true

[UCOMCRY]
signature = E9 J1 J1 60 06 FA E4 64 0C 40 E6 64 B8 ?? ?? 8E C0 26
ep_only = true

[UNITA3 (tm) by Sanitary Equipment Research]
signature = E8 ?? ?? 4D 5A 3E
ep_only = true

[Unknown by SMT]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB
ep_only = true

[Unknown file protector]
signature = EB J3 BE ?? ?? BF ?? ?? 2E
ep_only = true

[Unknown Protected Mode compiler (1)]
signature = FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1
ep_only = true

[Unknown Protected Mode compiler (2)]
signature = FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3
ep_only = true

[UPolyX 0.x -> Delikon]
signature = 81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75
ep_only = true

[UPolyX V0.1 -> Delikon]
signature = E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[UPXFreak V0.1 -> HMX0101]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00
ep_only = true

[UPXLock v1.1 -> CyberDoom & Bob]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60
ep_only = true

[UPXShit 0.06]
signature = B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF
ep_only = true

[USCC v1.4]
signature = E9 J1 J1 60 BB ?? ?? B9 ?? ?? 30 0F 43 E2 ?? 5D F5 F5 FC EF EE FA 4B 9E
ep_only = true

[USERNAME v3.00]
signature = E9 J1 J1 E8 ?? ?? 5D 83 ?? ?? FA FC 33 F6 8E DE BF ?? ?? 03 FD B9 ?? ?? F3 A4 8B FC
ep_only = true

[USERNAME v3.00]
signature = FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6
ep_only = true

[USSR 0.31 - by Spirit]
signature = E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3
ep_only = true

[USSR V0.31 -> SpiritST]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[VBOX v4.2 MTE]
signature = 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5
ep_only = true

[VBOX v4.3 - v4.6]
signature = ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40
ep_only = true

[VC8 -> Microsoft Corporation]
signature = E8 ?? ?? ?? ?? E9 ?? ?? FF FF
ep_only = true

[vcasm 1.0 - 1.1 -> vcasm]
signature = EB 01 9A 60
ep_only = true

[VcAsm Protector -> VcAsm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3
ep_only = true

[VcAsm Protector V1.0X-> VcAsm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00
ep_only = true

[Vcasm Protector V1.X -> vcasm]
signature = EB ?? 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true

[Vcasm-Protector 1.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9
ep_only = true

[Vcasm-Protector 1.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
ep_only = true

[Vcasm-Protector 1.0a - 1.0d -> vcasm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00
ep_only = true

[Vcasm-Protector 1.0e -> vcasm]
signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true

[Vcasm-Protector 1.1 - 1.2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true

[Vcasm-Protector 1.1 - 1.2 -> vcasm]
signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00
ep_only = true

[vfp&exeNc V5.00 -> Wang JianGuo]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC
ep_only = true

[Video-Lan-Client]
signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Virogen Crypt v0.75]
signature = 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01
ep_only = true

[Virogen Crypt v0.75]
signature = 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74
ep_only = true

[Virtual Image Maker Graphics file]
signature = 53 4F 4D 56
ep_only = true

[VIRUS - I-Worm.Bagle]
signature = 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40
ep_only = true

[VIRUS - I-Worm.Bagle]
signature = 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00
ep_only = true

[VIRUS - I-Worm.Hybris]
signature = EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15
ep_only = true

[VIRUS - I-Worm.KLEZ]
signature = 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0
ep_only = true

[VITec graphics file format]
signature = 00 5B 07 20 00 00 00 2C
ep_only = true

[Vterminal V1.0X -> Lei Peng]
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00
ep_only = true

[Vterminal V1.0X -> Lei Peng]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68
ep_only = true

[Vterminal V1.0X -> Lei Peng]
signature = 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72
ep_only = true

[WARNING -> TROJAN -> HuiGeZi]
signature = 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF
ep_only = true

[WARNING -> TROJAN -> XiaoHui]
signature = 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00
ep_only = true

[WarWind Save file]
signature = 57 41 52 53 41 56
ep_only = true

[WebCops [DLL]
signature = A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B
ep_only = true

[WIBU-Key V4.10A -> http://wibu.com/us/]
signature = F7 05 ?? ?? ?? ?? FF 00 00 00 75 12
ep_only = true

[Wind of Crypt 1.0 - by DarkPressure]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D
ep_only = true

[Windows 9x registry file]
signature = 43 52 45 47
ep_only = true

[Windows 9x User password file]
signature = E3 82 85 96
ep_only = true

[Windows Animation format]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF
ep_only = true

[Windows Group file]
signature = 50 4D 43 43
ep_only = true

[Windows PIF file]
signature = 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 02
ep_only = true

[Windows Type 1 font metric file]
signature = 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20
ep_only = true

[Windows Write file]
signature = ?? BE 00 00 00 AB 00 00 00
ep_only = true

[Winkript v1.0]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58
ep_only = true

[WinKript v1.0 -> Mr. Crimson]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[with added 'PK' signature]
signature = C7 ?? ?? ?? ?? ?? 8C D8 05
ep_only = true

[X-Hider 1.0 -> GlobaL]
signature = 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5
ep_only = true

[X-Hider 1.0 -> GlobaL]
signature = 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00
ep_only = true

[X-Pack v1.4.2]
signature = 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3
ep_only = true

[X-PEOR v0.99b]
signature = E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40
ep_only = true

[XCF File Format by Adeline Software]
signature = 46 72 61 6D 65 4C 65 6E F4 0F
ep_only = true

[XcomOR v0.99i]
signature = ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? D3 ?? ?? C2 ?? ?? B9 ?? ?? EB J3 0F 23 F8 0F 23 D8 0F 23 F8 0F 23 C8 E2
ep_only = true

[XJ / XPAL -> LiNSoN]
signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C
ep_only = true

[XMI music file]
signature = 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44
ep_only = true

[XorCom v1.0]
signature = E9 J1 J1 FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? AC 34 ?? AA E2 ?? C3
ep_only = true

[XorCopy v1.0]
signature = E9 J1 J1 B8 ?? ?? BB ?? ?? BA ?? ?? 31 07 43 40 39 D3 75 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 31 C0 31 DB 31 D2 E9
ep_only = true

[Xorer v1.0]
signature = E9 J1 J1 BE ?? ?? 8B FE B9 ?? ?? 33 DB 80 ?? ?? AC 32 C3 AA E2
ep_only = true

[Xorer v2.1]
signature = E9 J1 J1 BA ?? ?? B9 ?? ?? 51 B0 ?? E6 60 FA B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true

[XPack 1.52 - 1.64]
signature = 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB
ep_only = true

[yC v1.3 by Ashkbiz Danehkar]
signature = 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[yC v1.3 by Ashkbiz Danehkar]
signature = 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[yP v1.0b by Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? AA E2 9C
ep_only = true

[yP v1.0b by Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8
ep_only = true

[yzpack 1.12 -> UsAr]
signature = 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00
ep_only = true

[YZPack 1.2 --> UsAr]
signature = 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9
ep_only = true

[YZPack 1.2 -> UsAr]
signature = 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C
ep_only = true

[yzpack V1.1]
signature = 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2
ep_only = true

[yzpack V2.0 -> UsAr ! Sign by fly]
signature = 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00
ep_only = true

[ZealPack 1.0 -> Zeal]
signature = C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4
ep_only = true

[[MSLRH]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01
ep_only = true

[[MSLRH]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31
ep_only = true

[�ؾ���EXE�ļ������ ��Աר�� -> �¾��]
signature = 55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45
ep_only = true

[����EXE�ļ������� v1.0 -> ����]
signature = 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1
ep_only = true

[�ļ������� v1.0 -> ����]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44
ep_only = true

[�ļ������� v1.0 -> ����]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00
ep_only = true

[����EXE�ϲ��� -> yy66]
signature = 68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30
ep_only = true

[ܥ��ѹ�� 2.2b Anti -> xiaohui]
signature = EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8
ep_only = true

[ܥ��ѹ�� 2.2b Anti -> xiaohui]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8
ep_only = true

[* [MSLRH] v0.1 -> emadicius]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8
ep_only = false

[* [MSLRH] v0.31a]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F
ep_only = false

[* [MSLRH] v0.32a -> emadicius]
signature = E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8
ep_only = false

[* [MSLRH] v0.32a -> emadicius]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = false

[AI1 Creator 1 Beta 2 - by MZ]
signature = E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00
ep_only = false

[AI1 Creator 1 Beta 2 - by MZ]
signature = E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = false

[Alex Protector 0.4 beta 1 by Alex]
signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68
ep_only = false

[ANDpakk2 0.18 - by Dmitry "AND" Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D
ep_only = false

[AntiDote 1.0 Demo / 1.2 -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C
ep_only = false

[AntiDote 1.0.Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00
ep_only = false

[AntiDote 1.2 Beta (Demo) -> SIS-Team]
signature = 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90
ep_only = false

[AntiDote 1.4 SE -> SIS-Team]
signature = 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60
ep_only = false

[aPack v0.98b (exe)]
signature = 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA
ep_only = false

[ARM Protector 0.1 by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0
ep_only = false

[ARM Protector 0.2-> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00
ep_only = false

[ARM Protector 0.3 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4
ep_only = false

[ARM Protector 0.3 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0
ep_only = false

[AsCrypt v0.1 -> SToRM]
signature = 83 ?? ?? E2 ?? ?? E2 ?? FF
ep_only = false

[AsCrypt v0.1 -> SToRM - needs to be added]
signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF
ep_only = false

[AsCrypt v0.1 -> SToRM - needs to be added]
signature = 83 C6 14 8B 55 FC E9 ?? FF FF FF
ep_only = false

[ASDPack -> asd * Sign.By.fly]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65
ep_only = false

[ASDPack 2.0 -> asd]
signature = 8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00
ep_only = false

[ASDPack 2.0 -> asd]
signature = 5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9
ep_only = false

[ASDPack v1.0 -> asd]
signature = 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F
ep_only = false

[ASDPack v1.0 -> asd]
signature = 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00
ep_only = false

[BamBam 0.01]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = false

[C.I Crypt V0.1 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[CDS SS 1.0 beta1 -> CyberDoom]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40
ep_only = false

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3
ep_only = false

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0
ep_only = false

[D1NS1G -> D1N]
signature = 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[D1NS1G -> D1N]
signature = 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00
ep_only = false

[D1S1G v1.1 beta --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00
ep_only = false

[D1S1G v1.1 beta --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00
ep_only = false

[DalKrypt 1.0 - by DalKiT]
signature = 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7
ep_only = false

[DEF v1.0]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3
ep_only = false

[DZA Patcher v1.3 -> DZA]
signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35
ep_only = false

[Escargot 0.1 (final) -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05
ep_only = false

[ExeSplitter 1.2 -> Bill Prisoner / TPOC]
signature = E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08
ep_only = false

[ExeSplitter 1.2 -> Bill Prisoner / TPOC]
signature = E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE
ep_only = false

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC
ep_only = false

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]
signature = 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64
ep_only = false

[eXPressor 1.0 beta -> CGSoftLabs]
signature = E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8
ep_only = false

[eXPressor 1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04
ep_only = false

[eXPressor 1.3 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04
ep_only = false

[eXPressor 1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14
ep_only = false

[eXPressor v1.2 -> CGSoftLabs]
signature = 45 78 50 72 2D 76 2E 31 2E 32 2E
ep_only = false

[eXPressor v1.3 -> CGSoftLabs]
signature = 45 78 50 72 2D 76 2E 31 2E 33 2E
ep_only = false

[eXPressor v1.4 -> CGSoftLabs]
signature = 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = false

[eXPressor V1.4.5.1 -> CGSoftLabs * Sign.By.fly]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14
ep_only = false

[eXPressor.Protection V1.6.0.1 -> CGSoftLabs&nbsp; &nbsp;* Sign.By.fly * 20080308]
signature = EB 01 ?? EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 E2 05 00 00 EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 ?? 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 ?? ?? 8B 45 F4 0F B6 ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 81 ?? ?? ?? ?? EB 01 ?? EB D4 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 FC EB 02 ?? ?? 83 7D FC 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 A0 05 00 00 A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 F8 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 FC E8 01 00 00 00 ?? 83 04 24 06 C3
ep_only = false

[FakeNinja V2.8 Private -> Spirit * Sign.By.fly]
signature = 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 17 E5 FF 60
ep_only = false

[File Analyzer Compiled Datafile Version]
signature = 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E ?? V3 ?? V4
ep_only = false

[File Analyzer Extended Datafile Version]
signature = 23 03 45 58 54 44 V3 V4 3A 03
ep_only = false

[FishPE V1.1X -> hellfish * Sign.By.fly]
signature = 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00
ep_only = false

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6
ep_only = false

[Histogram graphics file]
signature = 6D 68 77 61 6E 68 00 04 01 02 01 02
ep_only = false

[HQR data file]
signature = 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00
ep_only = false

[Img Software Set graphics file]
signature = 53 43 4D 49 20 20 20 31 41 54
ep_only = false

[Ionic Wind Software]
signature = 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8
ep_only = false

[LY_WGKX * ��ҿ��� V2.X -> www.szleyu.com * Sign.By.fly * 20080122]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 01 00 4D 79 46 75 6E 00 62 73 00 00
ep_only = false

[LY_WGKX * ��ҿ��� V2.X -> www.szleyu.com * Sign.By.fly * 20080122]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00
ep_only = false

[LY_WGKX -> www.szleyu.com]
signature = 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58
ep_only = false

[Macromedia Windows Flash Projector/Player v3.0]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00
ep_only = false

[MaskPE 1.6 -> yzkzero]
signature = 36 81 2C 24 ?? ?? ?? 00 C3 60
ep_only = false

[Microsoft (R) Full-text index file]
signature = 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78
ep_only = false

[Microsoft Resource Cursors file]
signature = 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16
ep_only = false

[mkfpack -> llydd]
signature = E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6
ep_only = false

[MPEG movie file]
signature = 00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB
ep_only = false

[MSLRH]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08
ep_only = false

[MSLRH v0.1 -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = false

[MSLRH v0.1 -> emadicius]
signature = 54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65
ep_only = false

[MSLRH v0.32a -> emadicius (h)]
signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F 70 79 72 69 67 68 74 20 62 79 20 43 48 52 69 53 54 4F 50 48 20 47 41 42 4C 45 52 20 69 6E 20 31 39 39 38 21 0D 0A 52 65 67 69 73 74 65 72 65 64 20 74 6F 20 3A 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[MSLRH v32a -> emadicius]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 $[ MU LT IE DI T` SC OM PI LE DM AC RO S= 1E AA
ep_only = false

[N-Joy 1.1 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00
ep_only = false

[N-Joy 1.2 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00
ep_only = false

[Ningishzida 1.0 -> CyberDoom]
signature = 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = false

[ocBat2Exe 1.0 -> OC]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF
ep_only = false

[ocBat2Exe 1.0 -> OC]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF
ep_only = false

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = false

[PDS graphics file format]
signature = 49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20
ep_only = false

[Pe123 v2006.4.4-4.12]
signature = 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50
ep_only = false

[Phonebook configuration file Version %v3.%v4]
signature = 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F
ep_only = false

[PluginToExe v1.00 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF
ep_only = false

[PluginToExe v1.01 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A
ep_only = false

[PluginToExe v1.02 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A
ep_only = false

[PolyBox C -> Anskya]
signature = 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85
ep_only = false

[PolyBox C -> Anskya]
signature = 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF
ep_only = false

[PolyBox D -> Anskya]
signature = 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0
ep_only = false

[PolyBox D -> Anskya]
signature = 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF
ep_only = false

[PolyEnE 0.01+ by Lennart Hedlund]
signature = 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0
ep_only = false

[PolyEnE V0.01+ -> Lennart Hedlund]
signature = 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C
ep_only = false

[Private EXE Protector 1.8]
signature = A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3
ep_only = false

[Private EXE Protector 1.8 -> SetiSoft]
signature = A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00
ep_only = false

[Private EXE Protector 1.9.7 -> SetiSoft]
signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6
ep_only = false

[Private EXE Protector 1.9.7 -> SetiSoft (h)]
signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05
ep_only = false

[Private exe Protector V2.30-V2.3X -> SetiSoft Team * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Private exe Protector V2.5X-V2.6X -> SetiSoft Team * Sign.By.fly * 20080116]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Private exe Protector V2.5X-V2.6X -> SetiSoft Team * Sign.By.fly * 20080116]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Private EXE v2.0a]
signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D
ep_only = false

[PUNiSHER V1.5 Demo -> FEUERRADER]
signature = 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32
ep_only = false

[PuNkMoD 1.x -> PuNkDuDe]
signature = 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C
ep_only = false

[QrYPt0r - by NuTraL]
signature = 86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3
ep_only = false

[QrYPt0r - by NuTraL]
signature = EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04
ep_only = false

[R!SC's Process Patcher v1.4]
signature = 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83
ep_only = false

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? ?3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9 ?? ?? ?? 80 74 0E 51 56 25 ?? ?? ?? 7F 03 C3 8B F0 42 EB B2 51 03 C3 8B 38 03 FD 8B 48 04 D2 0F 30 0F 47 E2 F9 59 E2 AF 4A 74 04 5E 59 EB F7 8D 85 ?? ?? ?? ?? 5D FF E
ep_only = false

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? :3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9
ep_only = false

[RosAsm 2050a -> Betov]
signature = 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00
ep_only = false

[Rpoly crypt by Vaska (20.03.07 18:41)]
signature = 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04
ep_only = false

[SDProtector 1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00
ep_only = false

[SimbiOZ Poly 2.1 -> Extranger]
signature = 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90
ep_only = false

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6
ep_only = false

[SLVc0deProtector v0.6 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8
ep_only = false

[SLVc0deProtector v1.1 -> SLV (h)]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00
ep_only = false

[ST Protector V1.5 -> Silent Software]
signature = 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00
ep_only = false

[Symantec WinFax PRO 7.5 Coverpage]
signature = 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80
ep_only = false

[Symantec WinFax PRO 8.3 Coverpage]
signature = FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65
ep_only = false

[TaiShanXiangYu LockSoft DLL V1.0 -> zlocksoft * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = false

[TaiShanXiangYu LockSoft DLL V1.0 -> zlocksoft * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3
ep_only = false

[Thunderbolt V0.02 -> deXep (forgot) * Sign.By.fly]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00
ep_only = false

[UPolyX -> delikon]
signature = FF 96 ?? ?? ?? 00 61 E9 ?? ?? ?? FF
ep_only = false

[UPolyX 0.3 by delikon]
signature = ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 80
ep_only = false

[UPolyX 0.4 by delikon]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 E9 ?? E2 ?? C3 00 00 00 00
ep_only = false

[UPolyx 0.4 by delikon]
signature = C3 ?? ?? ?? ?? ?? 83 EC 04 89
ep_only = false

[UPolyx 0.5 by delikon]
signature = 51 ?? C9 B9 ?? ?? ?? ?? 83 ?? 01 E2
ep_only = false

[UPolyX v0.5]
signature = ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[UPolyX v0.5]
signature = 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[UPolyX v0.5]
signature = ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[USSR V0.31 -> SpiritST]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = false

[VBOX v4.3 - v4.6]
signature = 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4
ep_only = false

[VBOX v4.3 - v4.6]
signature = 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5
ep_only = false

[Video-CD file]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74
ep_only = false

[Windows Animation format]
signature = 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54
ep_only = false

[X-Hider 1.0 -> GlobaL]
signature = 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90
ep_only = false

[X-Hider 1.0 -> GlobaL]
signature = 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF
ep_only = false

[XM music file]
signature = 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A
ep_only = false

[XXPack 0.1 -> bagie]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3
ep_only = false

[ZealPack 1.0 -> Zeal]
signature = C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD
ep_only = false



================================================
FILE: peid_rules/PE/protector.userdb.txt
================================================
; PEiD signature database - protector
; Auto-categorized from userdb.txt (1784 entries)

[* PseudoSigner 0.1 --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [ACProtect 1.09]
signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Armadillo 3.00]
signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9
ep_only = true

[* PseudoSigner 0.1 [ASProtect]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9
ep_only = true

[* PseudoSigner 0.1 [CD-Cops II]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9
ep_only = true

[* PseudoSigner 0.1 [Code-Lock]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9
ep_only = true

[* PseudoSigner 0.1 [CodeSafe 2.0]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9
ep_only = true

[* PseudoSigner 0.1 [DEF 1.0]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9
ep_only = true

[* PseudoSigner 0.1 [DxPack 1.0]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [ExeSmasher]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9
ep_only = true

[* PseudoSigner 0.1 [Gleam 1.00]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9
ep_only = true

[* PseudoSigner 0.1 [Lockless Intro Pack]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9
ep_only = true

[* PseudoSigner 0.1 [LTC 1.3]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9
ep_only = true

[* PseudoSigner 0.1 [Macromedia Flash Projector 6.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9
ep_only = true

[* PseudoSigner 0.1 [Morphine 1.2]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [PE Protect 0.9]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9
ep_only = true

[* PseudoSigner 0.1 [PENinja 1.31]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9
ep_only = true

[* PseudoSigner 0.1 [PESHiELD 0.25]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9
ep_only = true

[* PseudoSigner 0.1 [REALBasic]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [Ste@lth PE 1.01]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00
ep_only = true

[* PseudoSigner 0.1 [VBOX 4.3 MTE]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9
ep_only = true

[* PseudoSigner 0.1 [Video-Lan-Client]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [VOB ProtectCD 5]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [XCR 0.11]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 E9
ep_only = true

[* PseudoSigner 0.1 [Yoda's Protector 1.02]
signature = E8 03 00 00 00 EB 01 90 90 E9
ep_only = true

[* PseudoSigner 0.2 [.BJFNT 1.1b]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90
ep_only = true

[* PseudoSigner 0.2 [.BJFNT 1.2]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00
ep_only = true

[* PseudoSigner 0.2 [Armadillo 3.00]
signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85
ep_only = true

[* PseudoSigner 0.2 [ASProtect]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD
ep_only = true

[* PseudoSigner 0.2 [CD-Cops II]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01
ep_only = true

[* PseudoSigner 0.2 [Code-Lock]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B
ep_only = true

[* PseudoSigner 0.2 [CodeSafe 2.0]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85
ep_only = true

[* PseudoSigner 0.2 [DEF 1.0]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01
ep_only = true

[* PseudoSigner 0.2 [DxPack 1.0]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [ExeSmasher]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B
ep_only = true

[* PseudoSigner 0.2 [Gleam 1.00]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF
ep_only = true

[* PseudoSigner 0.2 [Lockless Intro Pack]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD
ep_only = true

[* PseudoSigner 0.2 [Macromedia Flash Projector 6.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[* PseudoSigner 0.2 [PE Protect 0.9]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3
ep_only = true

[* PseudoSigner 0.2 [PESHiELD 0.25]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC
ep_only = true

[* PseudoSigner 0.2 [REALBasic]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01
ep_only = true

[* PseudoSigner 0.2 [VBOX 4.3 MTE]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0
ep_only = true

[* PseudoSigner 0.2 [Video-Lan-Client]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01
ep_only = true

[* PseudoSigner 0.2 [VOB ProtectCD 5]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [XCR 0.11]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01
ep_only = true

[* PseudoSigner 0.2 [Yoda's Protector 1.02]
signature = E8 03 00 00 00 EB 01 90 90
ep_only = true

[* PseudoSigner 0.2 [ZCode 1.01]
signature = E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF
ep_only = true

[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00
ep_only = true

[ABC Cryptor 1.0 - by ZloY]
signature = 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8
ep_only = true

[ABC Cryptor 1.0 - by ZloY]
signature = 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8
ep_only = true

[AcidCrypt]
signature = 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true

[AcidCrypt]
signature = BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true

[AcidCrypt]
signature = BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80
ep_only = true

[ACProtect 1.09g -> Risco software Inc.]
signature = 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00
ep_only = true

[ACProtect 1.09g -> Risco software Inc.]
signature = 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9
ep_only = true

[ACProtect 1.3x - 1.4x DLL -> Risco Software Inc.]
signature = 80 7C 24 08 01 0F 85
ep_only = true

[ACProtect 1.3x - 1.4x DLL -> Risco Software Inc.]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[ACProtect 1.41 -> AntiCrack Software]
signature = E8 01 00 00 00 ?? 83
ep_only = true

[ACProtect 1.4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00
ep_only = true

[ACProtect v1.35 -> risco software Inc. & Anticrack Software]
signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73
ep_only = true

[ACProtect V1.3X -> risco]
signature = 60 50 E8 01 00 00 00 75 83
ep_only = true

[ACProtect V1.3X -> risco]
signature = 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05
ep_only = true

[ACProtect V1.4X -> risco]
signature = 60 E8 01 00 00 00 7C 83 04 24 06 C3
ep_only = true

[ACProtect V1.4X -> risco]
signature = 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC
ep_only = true

[ACProtect v1.90g -> Risco software Inc.]
signature = 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3
ep_only = true

[ACProtect V2.0 -> risco]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3
ep_only = true

[ACProtect V2.0 -> risco]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50
ep_only = true

[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00
ep_only = true

[ActiveMark -> Trymedia Systems Inc.]
signature = 89 25 ?? ?? ?? ?? EB
ep_only = true

[ActiveMark -> Trymedia Systems Inc.]
signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00
ep_only = true

[ActiveMARK 5.x -> Trymedia Systems Inc. (h)]
signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67
ep_only = true

[ActiveMARK 5.x -> Trymedia Systems,Inc.]
signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67
ep_only = true

[ActiveMARK[TM]
signature = 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25
ep_only = true

[ActiveMARK[TM] R5.31.1140 -> Trymedia]
signature = 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF
ep_only = true

[AHTeam EP Protector 0.3 (fake ASProtect 1.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D
ep_only = true

[AHTeam EP Protector 0.3 (fake k.kryptor 9/kryptor a) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9
ep_only = true

[AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER]
signature = 90
ep_only = true

[AHTeam EP Protector 0.3 (fake PE Lock NT 2.04) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB
ep_only = true

[AHTeam EP Protector 0.3 (fake PE-Crypt 1.02) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44
ep_only = true

[AHTeam EP Protector 0.3 (fake PESHiELD 2.x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83
ep_only = true

[AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00
ep_only = true

[AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02
ep_only = true

[AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F
ep_only = true

[AHTeam EP Protector 0.3 - 0.41 -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0
ep_only = true

[AHTeam EP Protector 0.3 - 0.41 -> FEUERRADER]
signature = 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[AHTeam EP Protector v0.3 -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0
ep_only = true

[Anslym Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3
ep_only = true

[Anslym Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B
ep_only = true

[Anslym FUD Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 78 03 79 01 ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD
ep_only = true

[App Encryptor -> Silent Team]
signature = 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC
ep_only = true

[Armadillo 3.00a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42
ep_only = true

[Armadillo 3.00a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F
ep_only = true

[Armadillo 3.01 - 3.50a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43
ep_only = true

[Armadillo 3.6x -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76
ep_only = true

[Armadillo 3.7x -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC
ep_only = true

[Armadillo 3.X-5.X -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08
ep_only = true

[Armadillo 3.X-5.X -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33
ep_only = true

[Armadillo 4.00.0053 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1
ep_only = true

[Armadillo 4.10 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5
ep_only = true

[Armadillo 4.20 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5
ep_only = true

[Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24
ep_only = true

[Armadillo 4.30a -> Silicon Realms Toolworks]
signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53
ep_only = true

[Armadillo 4.30a -> Silicon Realms Toolworks]
signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43
ep_only = true

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00
ep_only = true

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8
ep_only = true

[Armadillo 4.40 -> Silicon Realms Toolworks (h)]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =F AL SE
ep_only = true

[Armadillo 4.44a public build -> Silicon Realms Toolworks (h)]
signature = 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF
ep_only = true

[Armadillo 5.0 Dll -> Silicon Realms Toolworks]
signature = 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3
ep_only = true

[Armadillo 5.00 -> Silicon Realms Toolworks]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3
ep_only = true

[Armadillo 5.00 -> Silicon Realms Toolworks]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = true

[Armadillo 5.00 Dll -> Silicon Realms Toolworks]
signature = 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57
ep_only = true

[Armadillo v1.60a]
signature = 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.72 - v1.73]
signature = 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58
ep_only = true

[Armadillo v1.77]
signature = 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.80]
signature = 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.82]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.83]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.84]
signature = 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90a]
signature = 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b1]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b2]
signature = 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b3]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b4]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90c]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.9x]
signature = 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true

[Armadillo v1.xx - v2.xx]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6
ep_only = true

[Armadillo v2.00]
signature = 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.00b2-2.00b3]
signature = 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.01]
signature = 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.10b2]
signature = 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.20]
signature = 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.20b1]
signature = 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.50]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true

[Armadillo v2.50b3]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true

[Armadillo v2.51]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38
ep_only = true

[Armadillo v2.52b2]
signature = 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24
ep_only = true

[Armadillo v2.53]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true

[Armadillo v2.53]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89
ep_only = true

[Armadillo v2.53b3]
signature = 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true

[Armadillo v2.5x - v2.6x]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true

[Armadillo v2.60]
signature = 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84
ep_only = true

[Armadillo v2.60a]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4
ep_only = true

[Armadillo v2.60b1]
signature = 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC
ep_only = true

[Armadillo v2.60b2]
signature = 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C
ep_only = true

[Armadillo v2.60c]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true

[Armadillo v2.61]
signature = 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C
ep_only = true

[Armadillo v2.65b1]
signature = 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true

[Armadillo v2.75a]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

[Armadillo v2.85]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

[Armadillo v2.xx (CopyMem II)]
signature = 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82
ep_only = true

[Armadillo v2.xx (CopyMem II)]
signature = 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3
ep_only = true

[Armadillo v3.00]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9
ep_only = true

[Armadillo v3.00]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB
ep_only = true

[Armadillo v3.00a]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58
ep_only = true

[Armadillo v3.01, v3.05]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B
ep_only = true

[Armadillo v3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05
ep_only = true

[Armadillo v3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC
ep_only = true

[Armadillo v3.xx]
signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB
ep_only = true

[Armadillo v4.00.0053 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89
ep_only = true

[Armadillo v4.10 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89
ep_only = true

[Armadillo v4.20 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89
ep_only = true

[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3
ep_only = true

[Armadillo V5.00-V5.X Dll -> Silicon Realms Toolworks * Sign.By.fly]
signature = 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 E8 ?? ?? ?? ?? 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 ?? ?? ?? ?? 59 89 7D FC FF 75 08 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 ?? ?? ?? ?? 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 ?? ?? ?? ?? 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 ?? ?? ?? ?? 59 C3
ep_only = true

[Armadillo V5.0X -> Silicon Realms Toolworks   * Sign.By.fly]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC ?? 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3
ep_only = true

[Armadillo V5.20 -> Silicon Realms Toolworks   * Sign.By.fly * 20080214]
signature = E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 FE 1A 00 00 59 89 7D FC FF 75 08 E8 56 45 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 96 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 A4 19 00 00 59 C3 3B DF 75 0D 8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3 E8 CC 1D 00 00 C3 55 8B EC 51 83 65 FC 00 57 8D 45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B F8 83 C4 0C 85 FF 75 19 56 8B 75 FC 85 F6 74 10 E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89 30 5E 8B C7 5F C9 C3 6A 0C 68 ?? ?? ?? ?? E8 3B 1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ?? ?? ?? 75 43 6A 04 E8 FF 19 00 00 59 83 65 FC 00 56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56 50 E8 A0 3C 00 00 59 59 C7 45 FC FE FF FF FF E8 0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A 6A 04 E8 ED 18 00 00 59 C3
ep_only = true

[Armadillo V5.20.Beta1 -> Silicon Realms Toolworks   * Sign.By.fly * 20080214]
signature = E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13 00 00 59 89 7D FC FF 75 08 E8 AC 47 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 7C D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 AD 11 00 00 59 C3
ep_only = true

[Armadillo V5.40 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 C1 1B 00 00 59 89 7D FC FF 75 08 E8 B1 46 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 86 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 67 1A 00 00 59 C3
ep_only = true

[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]
signature = 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect 2.0]
signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect 2.3 SKE build 04.26 Beta]
signature = 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E
ep_only = true

[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = true

[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = true

[ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = true

[ASProtect SKE 2.3 -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C
ep_only = true

[ASProtect v1.0]
signature = 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D
ep_only = true

[ASProtect v1.0]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true

[ASProtect v1.1]
signature = 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE
ep_only = true

[ASProtect v1.1]
signature = 90 60 E8 1B ?? ?? ?? E9 FC
ep_only = true

[ASProtect v1.1 BRS]
signature = 60 E9 ?? 05
ep_only = true

[ASProtect v1.1 MTE]
signature = 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9
ep_only = true

[ASProtect v1.1 MTEb]
signature = 90 60 E9 ?? 04
ep_only = true

[ASProtect v1.1 MTEc]
signature = 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74
ep_only = true

[ASProtect v1.2]
signature = 68 01 ?? ?? ?? C3
ep_only = true

[ASProtect v1.2]
signature = 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect v1.2 -> Alexey Solodovnikov]
signature = 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00
ep_only = true

[ASProtect v1.23 RC1]
signature = 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D
ep_only = true

[ASProtect v1.2x]
signature = 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3
ep_only = true

[ASProtect v1.2x]
signature = 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42
ep_only = true

[ASProtect v2.0]
signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2C
ep_only = true

[ASProtect V2.X DLL -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD
ep_only = true

[ASProtect v?.? -> If you know this version, post on PEiD board]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ASProtect v?.? -> If you know this version, post on PEiD board]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ass - crypter -> by santasdad]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45
ep_only = true

[ass - crypter -> by santasdad]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B
ep_only = true

[AverCryptor 1.0 -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3
ep_only = true

[AverCryptor 1.02 beta -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3
ep_only = true

[AZProtect]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83
ep_only = true

[AZProtect 0x0001 -> AlexZ aka AZCRC]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00
ep_only = true

[BlackEnergy DDoS Bot Crypter]
signature = 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F
ep_only = true

[BopCrypt v1.0]
signature = 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true

[ChinaProtect -> dummy]
signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3
ep_only = true

[CipherWall Self-Extrator/Decryptor (Console) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4
ep_only = true

[CipherWall Self-Extrator/Decryptor (Console) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[CipherWall Self-Extrator/Decryptor (GUI) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4
ep_only = true

[CipherWall Self-Extrator/Decryptor (GUI) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[codeCrypter 0.31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[codeCrypter 0.31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3
ep_only = true

[ComCryptor BTS v9.12]
signature = E9 J1 J1 B7 ?? E8 ?? ?? 83 ?? ?? EB ?? 5D 55 C3 BF ?? ?? 03 FD 8B F7 B9
ep_only = true

[Compiled InstallSHIELD Installation Script]
signature = B8 C9 0C 00
ep_only = true

[COOLcryptor 0.9 -> kongfoo]
signature = E8 03 00 00 00 E9 EB 07 FF 04 24 EB 01 FF C3 E8 03 00 00 00 EB 02 EA C3 EB 08 8D 8D 72 08
ep_only = true

[CopyMinder -> Microcosm.Ltd]
signature = 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25
ep_only = true

[Crypto-Lock V2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[Crypto-Lock V2.02 (Eng) -> Ryan Thian]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[CRYPToCRACK's PE Protector V0.9.2 -> Lukas Fleischer]
signature = E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26
ep_only = true

[CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74
ep_only = true

[DAEMON Protect v0.6.7]
signature = 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61
ep_only = true

[deep-CRyPTer v0.1c]
signature = ?? E9 J1 J1 E8 ?? ?? 59 8B E9 81 ?? ?? ?? 81 ?? ?? ?? BE ?? ?? 8D ?? ?? ?? 66 ?? ?? 66 ?? ?? 8D ?? ?? ?? 8B D7 8B DF
ep_only = true

[Ding Boy's PE-lock v0.07]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (xor encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (xor encryption) -> drmist]
signature = C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40
ep_only = true

[DotFix Nice Protect 2.1 -> GPcH Soft]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3
ep_only = true

[DotFix Nice Protect 2.1 -> GPcH Soft]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5
ep_only = true

[DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true

[DragonArmor -> Orient]
signature = BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1
ep_only = true

[DragonArmor -> Orient]
signature = BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3
ep_only = true

[DSHIELD]
signature = 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E
ep_only = true

[Dual's Cryptor -> dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E
ep_only = true

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50
ep_only = true

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33
ep_only = true

[EmbedPE V1.00-V1.24 -> cyclotron]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00
ep_only = true

[EmbedPE v1.24 -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00
ep_only = true

[EmbedPE v1.24 -> cyclotron]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E
ep_only = true

[EmbedPE v1.24 -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true

[Encriptor v1.00c]
signature = EB J3 B9 ?? ?? BE ?? ?? BF ?? ?? AC D0 C8 AA E2 ?? BE ?? ?? BF ?? ?? AC AA
ep_only = true

[ENcryptCOM v3.06 (???)]
signature = E9 J1 J1 B4 30 CD 21 3C 02 77 01 C3
ep_only = true

[Encrypted by: RSCC/286 v1.01]
signature = FE 52 53 43 43 2F 31 2E 30 31 FE
ep_only = true

[Encrypted by: RSCC/286 v1.02]
signature = FE 52 53 43 43 2F 31 2E 30 32 FE
ep_only = true

[EncryptPE 1.2003.3.18-1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE 1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79
ep_only = true

[EncryptPE 1.2003.5.18 -> WFS]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00
ep_only = true

[EncryptPE 2.2004.6.16-2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A
ep_only = true

[EncryptPE 2.2006.7.10-2.2006.10.25 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS   * Sign.By.fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2006.1.15 -> WFS]
signature = 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35
ep_only = true

[EncryptPE V2.2006.1.15 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2006.7.10 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00
ep_only = true

[EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2007.04.11 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[Enigma Protector 1.0X -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01
ep_only = true

[Enigma protector 1.10 (unregistered)]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Enigma protector 1.10/1.11 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A
ep_only = true

[Enigma Protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04
ep_only = true

[Enigma Protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB
ep_only = true

[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]
signature = 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9
ep_only = true

[Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00
ep_only = true

[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]
signature = 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00
ep_only = true

[ENIGMA Protector V1.0-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81
ep_only = true

[Enigma protector v1.02 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E BE 01 00 00 00 C1 E6 02 83 EC 04 87 DE 89 1C 24
ep_only = true

[ENIGMA Protector V1.1 -> Sukhov Vladimir]
signature = 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61
ep_only = true

[ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81
ep_only = true

[ENIGMA Protector V1.1-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC
ep_only = true

[ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81
ep_only = true

[ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2
ep_only = true

[ENIGMA Protector V1.12-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = true

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05
ep_only = true

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0
ep_only = true

[EXE Shield V0.1b-V0.8 -> SMoKE]
signature = E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 40 50 C3
ep_only = true

[EXE Shield V0.5 -> Smoke]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90
ep_only = true

[EXE Shield V0.6 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90
ep_only = true

[EXE Shield V0.6 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = true

[Exe Shield v1.7]
signature = EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90
ep_only = true

[Exe Shield v1.7]
signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95
ep_only = true

[Exe Shield v2.7]
signature = EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00
ep_only = true

[Exe Shield v2.7]
signature = EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85
ep_only = true

[Exe Shield v2.7b]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3
ep_only = true

[Exe Shield v2.9]
signature = 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8
ep_only = true

[EXE Stealth 2.73]
signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC
ep_only = true

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC
ep_only = true

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72
ep_only = true

[EXE Stealth v1.1]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.5]
signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40
ep_only = true

[EXE Stealth v2.73]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 77 0C 00 00 90 8D BD 61 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.74]
signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 91 0C 00 00 90 8D BD 38 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.74 -> WebToolMaster]
signature = 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A
ep_only = true

[EXE2COM (Encrypted without selfcheck)]
signature = B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6
ep_only = true

[EXECryptor 2.0/2.1 -> www.strongbit.com]
signature = 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF
ep_only = true

[EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar]
signature = A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75
ep_only = true

[EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)]
signature = 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F
ep_only = true

[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development]
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]
signature = 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3
ep_only = true

[EXECryptor 2.2.6 (minimum protection)]
signature = 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB
ep_only = true

[EXECryptor 2.2.6 DLL (minimum protection)]
signature = 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9
ep_only = true

[EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com]
signature = 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0
ep_only = true

[EXECryptor 2.2.x -> SoftComplete Developement]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF
ep_only = true

[EXECryptor 2.3.9 (minimum protection)]
signature = 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0
ep_only = true

[EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com]
signature = 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00
ep_only = true

[EXECryptor 2.3.9 DLL (minimum protection)]
signature = 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87
ep_only = true

[EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com]
signature = 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9
ep_only = true

[EXECryptor 2.x -> SoftComplete Developement]
signature = A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1
ep_only = true

[EXECryptor v1.3.0.45]
signature = 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1
ep_only = true

[EXECryptor v1.3.0.45]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3
ep_only = true

[EXECryptor v1.4.0.1]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80
ep_only = true

[EXECryptor v1.5.1.x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[EXECryptor v1.5.1.x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41
ep_only = true

[EXECryptor v1.5.3]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[EXECryptor V2.1X -> softcomplete.com]
signature = E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1
ep_only = true

[EXECryptor V2.1X -> SoftComplete.com]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32
ep_only = true

[EXECryptor V2.2X -> softcomplete.com]
signature = FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00
ep_only = true

[EXECryptor V2.2X-V2.4X -> StrongBit Technology * Sign.By.fly]
signature = E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3
ep_only = true

[EXEGUARD v1.3]
signature = BA ?? ?? BF ?? ?? EB J3 E8 ?? ?? 7C ?? 79 ?? FA EA ?? ?? ?? ?? 76 ?? D8 FD
ep_only = true

[ExeSafeguard v1.0 -> simonzh]
signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF
ep_only = true

[ExeShield 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8
ep_only = true

[ExeShield 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F
ep_only = true

[ExeShield Cryptor 1.3RC -> Tom Commander]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[ExeShield Protector 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC
ep_only = true

[ExeShield Protector V3.6 -> www.exeshield.com]
signature = 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB
ep_only = true

[ExeStealth -> WebToolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F
ep_only = true

[EXEStealth 2.75 -> WebtoolMaster]
signature = 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21
ep_only = true

[EXEStealth 2.76 Unregistered -> WebtoolMaster]
signature = EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20
ep_only = true

[EXEStealth v2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5
ep_only = true

[FakeNinja v2.8 (Anti-Debug) -> Spirit]
signature = 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF
ep_only = true

[fEaRzCrypter v1.0 -> fEaRz]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00
ep_only = true

[FileShield]
signature = 50 1E EB ?? 90 00 00 8B D8
ep_only = true

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00
ep_only = true

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40
ep_only = true

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00
ep_only = true

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40
ep_only = true

[Fly-Crypter 1.0 -> ut1lz]
signature = 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90
ep_only = true

[FreeCryptor 0.1 (build 001) -> GlOFF]
signature = 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08
ep_only = true

[FreeCryptor 0.1 (build 002) -> GlOFF]
signature = 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08
ep_only = true

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B ?? 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A
ep_only = true

[FreeCryptor 0.3 -> GlOFF]
signature = 1E 98 3. ..
ep_only = true

[FreeCryptor 0.3 -> GlOFF]
signature = 1E 98 3
ep_only = true

[GameGuard - nProtect]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

[GameGuard v2006.5.x.x (*.dll)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00
ep_only = true

[GameGuard v2006.5.x.x (*.dll)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B
ep_only = true

[GameGuard v2006.5.x.x (*.exe)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00
ep_only = true

[Guardant Stealth aka Novex Dongle]
signature = 55 8B EC 83 C4 F0 60 E8 51 FF FF FF
ep_only = true

[Guardant Stealth aka Novex Dongle]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80
ep_only = true

[Hardlock dongle (Alladin)]
signature = 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76
ep_only = true

[Hardlock dongle (Alladin)]
signature = 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD
ep_only = true

[Hasp 4 envelope dongle (Alladin)]
signature = 10 02 D0 51 0F 00 83
ep_only = true

[Hasp dongle (Alladin)]
signature = 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32
ep_only = true

[HASP HL Protection V1.X -> Aladdin]
signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15
ep_only = true

[HASP HL Protection V1.X -> Aladdin]
signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
ep_only = true

[Hide PE 1.01 -> BGCorp]
signature = ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D
ep_only = true

[Hide&Protect 1.016 -> SoftWar Company]
signature = 90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00
ep_only = true

[Hide&Protect V1.016C-> SoftWar Company   * Sign.By.fly]
signature = 90 90 90 E9 D8
ep_only = true

[Hide&Protect V1.0X-> SoftWar Company]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[hying's PE-Armor -> hying[CCG]
signature = E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D
ep_only = true

[Hying's PE-Armor 0.75.exe -> Hying]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC
ep_only = true

[Hying's PE-Armor 0.75.exe -> Hying [CCG]
signature = 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3
ep_only = true

[hying's PEArmor V0.76 -> hying]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00
ep_only = true

[hying's PEArmor V0.7X -> hying]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3
ep_only = true

[INCrypter 0.3 (INinY) - by z3e_NiFe]
signature = 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3
ep_only = true

[InstallShield 2000]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57
ep_only = true

[InstallShield 3.x Custom]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1
ep_only = true

[InstallShield Archive]
signature = 2A AB 79 D8
ep_only = true

[InstallShield Cabinet Archive]
signature = 49 53 63
ep_only = true

[InstallShield Custom]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B
ep_only = true

[iPB Protect 0.1.3 - 0.1.7 -> forgot]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00
ep_only = true

[iPBProtect v0.1.3]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70
ep_only = true

[iPBProtect v0.1.3]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78
ep_only = true

[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF
ep_only = true

[IProtect 1.0 (FxSub.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF
ep_only = true

[IProtect 1.0 (FxSub.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00
ep_only = true

[Krypton v0.2]
signature = 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04
ep_only = true

[Krypton v0.2]
signature = 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48
ep_only = true

[Krypton v0.4]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06
ep_only = true

[Krypton v0.5]
signature = 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = true

[Matrix Dongle -> TDi GmbH]
signature = E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF
ep_only = true

[MicroDog Win32Shell V4.0.9.3 -> SafeNet   * Sign.By.fly]
signature = 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D BD EC FC FF FF 33 C0 B9 3F 00 00 00 F3 AB C7 85 10 FE FF FF A5 A5 00 00 66 C7 85 08 FE FF FF 0A 00 E9 13 09 00 00 90 68 00 10 00 00 E8 B8 F5 FF FF 83 C4 04 89 45 D0 83 7D D0 00 75 05 E9 C1 11 00 00 68 00 10 00 00 A1 ?? ?? ?? ?? 50 8B 45 D0 50 E8 FF F6 FF FF 83 C4 0C A1 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 89 85 34 FE FF FF 8B 85 34 FE FF FF 89 45 CC E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 C7 45 EC 00 00 EB 04 66 FF 45 EC 8B 45 EC 25 FF FF 00 00 83 F8 03 0F 8D DF 00 00 00 8B 45 EC 25 FF FF 00 00 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 83 C0 07 89 85 EC FB FF FF EB 7E
ep_only = true

[MicroDog Win32Shell V4.0.9.3 Dll -> SafeNet   * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D FC 00 74 0F 8B 45 EC 0F AF 45 FC 25 FF FF 00 00 01 45 F0 8B 45 EC 0F AF 45 F8 8B 4D F0 C1 E1 10 81 E1 00 00 FF FF 03 C1 40 89 45 E8 8B 45 E8 8B 4D 08 89 01 C1 6D E8 10 81 65 E8 FF 7F 00 00 66 8B 45 E8 EB 00 5F 5E 5B C9 C3
ep_only = true

[MicroDog Win32Shell V4.X -> SafeNet * Sign.By.fly]
signature = 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7 ?? ?? ?? ?? ?? ?? ?? E9 13 09 00 00 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 05 E9 C1 11 00 00 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 8B ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 ?? ?? ?? ?? ?? EB 04 66 ?? ?? ?? 8B ?? ?? 25 FF FF 00 00 83 ?? ?? 0F 8D DF 00 00 00 8B ?? ?? 25 FF FF 00 00 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 83 ?? ?? 89 ?? ?? ?? ?? ?? EB 7E
ep_only = true

[MoleBox Pro v2.6.1]
signature = E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 2A 6A 00 00 E9 3E 6A 00 00 E9 39 6A 00 00 E8 6E FB FF FF 7E 04 01 00 ?? 96 00 00 ?? ?? ?? ?? ?? ?? F1 ?? ?? ?? A4 ?? ?? ?? A1 ?? ?? ?? E0 ?? ?? ?? 19 ?? ?? ?? BE ?? ?? ?? 13
ep_only = true

[MoleBox v2.0]
signature = E8 ?? ?? ?? ?? 60 E8 4F
ep_only = true

[MoleBox V2.3X -> MoleStudio.com]
signature = E8 00 00 00 00 60 E8 4F 00 00 00
ep_only = true

[MoleBoxPro 2.5.5 -> Mole Studio (h)]
signature = E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 E9 D9 69 00 00 E8 5E FB FF FF 3E F4 00 00
ep_only = true

[Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = true

[Morphine v1.2]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E2 ?? ?? ?? ?? ?? 82 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Morphine v1.2 - v1.3]
signature = FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0
ep_only = true

[Morphine v2.7 --> Holy_Father & Ratter/29A]
signature = ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Morphine v2.7 -> Holy_Father & Ratter/29A]
signature = 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74
ep_only = true

[MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius]
signature = FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58
ep_only = true

[MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
ep_only = true

[MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius]
signature = EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A
ep_only = true

[MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52
ep_only = true

[MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius]
signature = FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius]
signature = 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[nCrypt 1.x (Cryptor InterFac) -> NEG]
signature = E9 95 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F1 BB 00 10 40 00 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB 00 00 00 00 75 05 BB 00 00 00 00 8A 23 30 C4 88 23 43 81 FB ?? ?? ?? ?? 75 89 1E 68 ?? ?? ?? ?? C3 BA C9 ?? ?? ?? 0F 10 02 BA 06 ?? ?? ?? 0F 11 02 BA ?? ?? ?? ?? 0F 10 02 BA ?? ?? ?? ?? 0F 11 02 64 8B 0D 20 00 00 00 EB 01 C
ep_only = true

[NTkrnl Secure Suite -> NTkrnl Team (Blue)]
signature = 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF
ep_only = true

[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = true

[NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true

[Obsidium 1.2.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 3F 1E 00 00
ep_only = true

[Obsidium 1.2.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00
ep_only = true

[Obsidium 1.2.5.0 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00
ep_only = true

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00
ep_only = true

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00
ep_only = true

[Obsidium 1.3.0.13 -> Obsidium Software]
signature = EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03
ep_only = true

[Obsidium 1.3.0.13 -> Obsidium Software]
signature = EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00
ep_only = true

[Obsidium 1.3.0.17 -> Obsidium software]
signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium 1.3.0.21 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00
ep_only = true

[Obsidium 1.3.0.37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00
ep_only = true

[Obsidium 1.3.1.1 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01
ep_only = true

[Obsidium 1.3.1.1 -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03
ep_only = true

[Obsidium 1.3.2.2 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04
ep_only = true

[Obsidium 1.3.3.1 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00
ep_only = true

[Obsidium 1.3.3.2 -> Obsidium Software]
signature = EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0
ep_only = true

[Obsidium 1.3.3.2 -> Obsidium Software]
signature = EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00
ep_only = true

[Obsidium 1.3.3.3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27
ep_only = true

[Obsidium 1.3.3.3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03
ep_only = true

[Obsidium 1.3.3.6 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04
ep_only = true

[Obsidium 1.3.3.6 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04
ep_only = true

[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00
ep_only = true

[Obsidium 1.3.3.7 -> Obsidium Software]
signature = EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00
ep_only = true

[Obsidium 1.3.3.8 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04
ep_only = true

[Obsidium 1.3.3.8 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00
ep_only = true

[Obsidium 1.3.3.9 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03
ep_only = true

[Obsidium 1.3.3.9 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00
ep_only = true

[Obsidium 1.3.4.1 -> Obsidium Software]
signature = EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33
ep_only = true

[Obsidium 1.3.4.1 -> Obsidium Software]
signature = EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00
ep_only = true

[Obsidium v1.0.0.59 Final]
signature = E8 AB 1C
ep_only = true

[Obsidium v1.0.0.61]
signature = E8 AF 1C 00 00
ep_only = true

[Obsidium v1.1.1.1]
signature = EB 02 ?? ?? E8 ?? 00 00 00
ep_only = true

[Obsidium V1.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 77 1E 00 00
ep_only = true

[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software]
signature = EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB
ep_only = true

[Obsidium V1.2.X -> Obsidium Software]
signature = E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00
ep_only = true

[Obsidium V1.25 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 ?? 00 00 00
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED
ep_only = true

[Obsidium v1.3.0.0 -> Obsidium Software (h)]
signature = EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD
ep_only = true

[Obsidium v1.3.0.37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27
ep_only = true

[Obsidium v1.3.0.37 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB
ep_only = true

[Obsidium v1.3.0.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00
ep_only = true

[Obsidium v1.3.0.4 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64
ep_only = true

[Obsidium V1.3.0.X -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3
ep_only = true

[Obsidium V1.3.2.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33
ep_only = true

[Obsidium v1.3.3.1 -> Obsidium Software (h)]
signature = EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04
ep_only = true

[Obsidium V1.3.3.3 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB
ep_only = true

[Obsidium V1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium V1.3.4.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00
ep_only = true

[Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly]
signature = EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50
ep_only = true

[Obsidium V1.3.5.0 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsidium V1.3.5.2 -> Obsidium Software   * Sign.By.fly]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8
ep_only = true

[Obsidium V1.3.5.3 -> Obsidium Software   * Sign.By.fly * 20080120]
signature = EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8
ep_only = true

[Obsidium V1.3.5.4 -> Obsidium Software   * Sign.By.fly * 200800207]
signature = EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00
ep_only = true

[Obsidium V1.3.5.5 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080411]
signature = EB 01 ?? E8 2B 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsidium V1.3.5.7 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080521]
signature = EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 03 ?? ?? ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsidium V1.3.6.0 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8
ep_only = true

[Obsidium V1.3.6.1 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080521]
signature = EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8
ep_only = true

[Obsidium V1.3.6.3 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8
ep_only = true

[Obsidium V1.4.0.0.Beta -> Obsidium Software * Sign.By.fly * 20080102]
signature = EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8
ep_only = true

[Open Source Code Crypter -> p0ke]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0
ep_only = true

[ORiEN 1.03 -> A. Fisun]
signature = E8 FD 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5B EB 01
ep_only = true

[ORiEN 2.01 -> A. Fisun]
signature = E9 5D 01 00 00
ep_only = true

[ORiEN 2.11 - 2.12 -> Fisun Alexander]
signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = true

[ORiEN V1.X-V2.X -> Fisun A.V.]
signature = 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D
ep_only = true

[ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly]
signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = true

[ORiEN v2.11 (DEMO)]
signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D
ep_only = true

[ORiEN v2.11 (DEMO)]
signature = E9 5D 01 00 00 CE D1 CE CD 0D
ep_only = true

[ORiEN v2.11 - 2.12 -> Fisun Alexander]
signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D
ep_only = true

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0
ep_only = true

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = true

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89
ep_only = true

[PC-Guard v3.03d, v3.05d]
signature = 55 53 56 51 52 57 E8 16 00 00 00
ep_only = true

[PC-Guard v4.05d, v4.10d, v4.15d]
signature = FC 55 50 E8 00 00 00 00 5D EB 01
ep_only = true

[PC-Guard v5.00d]
signature = FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB
ep_only = true

[PCIENC Cryptor]
signature = 06 50 43 49 45 4E
ep_only = true

[PCrypt v3.51]
signature = 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9
ep_only = true

[PE Crypt 1.5 -> BitShape Software]
signature = 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[PE Crypt v1.00/v1.01]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44
ep_only = true

[PE Crypt32 (Console v1.0, v1.01, v1.02)]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true

[PE Crypt32 (Console v1.0, v1.01, v1.02)]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7
ep_only = true

[PE Crypt32 v1.02]
signature = E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21
ep_only = true

[PE Encrypt 1.0 -> Liwuyue]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73
ep_only = true

[PE Lock NT v2.01]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60
ep_only = true

[PE Lock NT v2.02c]
signature = EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01
ep_only = true

[PE Lock NT v2.04]
signature = EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3
ep_only = true

[PE Lock NT v2.04]
signature = EB ?? ?? BE ?? ?? BF ?? ?? 2E
ep_only = true

[PE Protect v0.9]
signature = 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
ep_only = true

[PE Protector 0.9.3 --> CRYPToCRACk]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00
ep_only = true

[PE-Armor 0.46 -> China Cracking Group]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC
ep_only = true

[PE-Armor 0.46 -> China Cracking Group]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41
ep_only = true

[PE-Armor 0.46 -> Hying]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = true

[PE-Armor 0.460-0.759 -> hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00
ep_only = true

[PE-Armor 0.49 -> Hying]
signature = 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00
ep_only = true

[PE-Armor 0.49 -> Hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00
ep_only = true

[PE-Armor V0.46 -> hying]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[PE-Crypt 1.02]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72
ep_only = true

[PE-Crypter]
signature = 60 E8 00 00 00 00 5D EB 26
ep_only = true

[PE-Crypter]
signature = 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9
ep_only = true

[PE-PROTECT 0.9]
signature = E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PE-PROTECT 0.9]
signature = 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53
ep_only = true

[PE-SHiELD 0.2]
signature = 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[PEArmor V0.7X -> Hying]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[PEcrypt - by archphase]
signature = 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF
ep_only = true

[PEEncrypt v4.0b (JunkCode)]
signature = 66 ?? ?? 00 66 83 ?? 00
ep_only = true

[PEEncrypt v4.0b (JunkCode)]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24
ep_only = true

[PEncrypt 2.0 -> junkcode]
signature = EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0
ep_only = true

[PEncrypt 2.0 -> junkcode]
signature = EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85
ep_only = true

[PEncrypt v3.0]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA
ep_only = true

[PEncrypt v3.1]
signature = E9 ?? ?? ?? 00 F0 0F C6
ep_only = true

[PEncrypt v3.1]
signature = E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9
ep_only = true

[PESHiELD v0.2 / v0.2b / v0.2b2]
signature = 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[PESHiELD v0.25]
signature = 60 E8 2B 00 00 00
ep_only = true

[PeStubOEP v1.x]
signature = 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3
ep_only = true

[PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[PE_Protector V2.60��hying's PE-Armor V0.460 modify�� -> Engprog * Sign.By.fly]
signature = 55 53 51 52 56 57 E8 E1 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 0B 00 00 00 8B 9D 9B 00 00 00 03 9D 9F 00 00 00 0B DB 74 14 8B 83 7F 46 00 00 03 83 87 46 00 00 5F 5E 5A 59 5B 5D FF E0 8D 75 43 56 FF 55 54 8D B5 A3 00 00 00 56 50 FF 55 50 89 85 B0 00 00 00 8D 75 43 56 FF 55 54 8D B5 B4 00 00 00 56 50 FF 55 50 89 85 C0 00 00 00 8D 75 43 56 FF 55 54 8D B5 C4 00 00 00 56 50 FF 55 50 89 85 D0 00 00 00 6A 40 68 00 10 00 00 FF B5 97 00 00 00 6A 00 FF 95 B0 00 00 00 89 85 9B 00 00 00 55 8D 9D F2 01 00 00 53 8D 9D CC 01 00 00 FF D3 8B 74 24 04 8B 7C 24 0C F7 46 04 07 00 00 00 75 08 81 3E 27 00 00 C0 75 06 B8 00 00 00 00 C3
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF
ep_only = true

[Pohernah Crypter V1.0.1 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah Crypter V1.0.1 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED
ep_only = true

[Pohernah Crypter V1.0.2 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah Crypter V1.0.2 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24
ep_only = true

[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations]
signature = 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB
ep_only = true

[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]
signature = 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45
ep_only = true

[PolyCryptor by SMT Version %v3.%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29
ep_only = true

[PolyCryptor by SMT Version %v3.%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 V3 ?? V4 20 62 79 20 53 4D 54 29
ep_only = true

[PPC-PROTECT 1.0 -> Alexey Gorchakov]
signature = FF 5F 2D E9
ep_only = true

[PPC-PROTECT 1.1X -> Alexey Gorchakov]
signature = FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5
ep_only = true

[Protect Shareware V1.1 -> eCompserv CMS]
signature = 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00
ep_only = true

[PROTECT! EXE/COM v4.0]
signature = E9 J1 J1 E8 ?? ?? 5D 81 ED ?? ?? 33 C0 8E D8 8B F0 BF ?? ?? B9 ?? ?? FC F3 A5
ep_only = true

[PROTECT! EXE/COM v5.0]
signature = 1E 0E 0E 1F 07
ep_only = true

[pscrambler 1.2 -> by p0ke]
signature = 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65
ep_only = true

[PseudoSigner 0.1 -> Anorganix]
signature = 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC
ep_only = true

[PseudoSigner 0.1 [ACProtect 1.09]
signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Morphine 1.2]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9
ep_only = true

[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04
ep_only = true

[QinYingShieldLicense V1.0X-V1.21 -> Lei Peng * Sign.By.fly * 20080122]
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 FE B9 FE 00 00 00 00 00 00 00
ep_only = true

[RCryptor 1.5 -> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)]
signature = 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3
ep_only = true

[RCryptor 1.6c -> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)]
signature = 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3
ep_only = true

[RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3
ep_only = true

[RCryptor 2.0 -> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3
ep_only = true

[RCryptor 2.0 -> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF
ep_only = true

[RCryptor v1.1 -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3
ep_only = true

[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50
ep_only = true

[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7
ep_only = true

[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.5 (Private) --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2
ep_only = true

[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68
ep_only = true

[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB
ep_only = true

[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68
ep_only = true

[RCryptor V1.6d -> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6x --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3
ep_only = true

[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68
ep_only = true

[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v2.0 --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD
ep_only = true

[RCryptor V2.0 Private -> Vaska&nbsp; &nbsp;* Sign.By.fly]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3
ep_only = true

[RCryptor V2.0 Private -> Vaska&nbsp; &nbsp;* Sign.By.fly]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF 59 BA ?? ?? ?? ?? F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF C0 0A ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 80 32 ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? ?? 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC
ep_only = true

[ReversingLabsProtector 0.7.4 beta -> Ap0x]
signature = 68 00 00 41 00 E8 01 00 00 00 C3 C3
ep_only = true

[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]
signature = 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1
ep_only = true

[Safedisc V4.50.000 -> Macrovision Corporation * Sign.By.fly * 20080117]
signature = 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ?? ?? ?? FF 10 61 5D EB 47 80 7C 24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ?? 89 4C 24 04 59 EB 29 50 B8 FD ?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04 FF D0 58 B8 25 ?? ?? ?? FF 30 C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74 05 E9 91 FE FF FF C3
ep_only = true

[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]
signature = 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57
ep_only = true

[Safeguard 1.0 - 1.01 -> Simonzh]
signature = E8 00 00 00 00 EB 29
ep_only = true

[Safeguard 1.03 -> Simonzh]
signature = E8 ?? 00 00 00
ep_only = true

[SafeGuard V1.0X -> simonzh2000]
signature = E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1
ep_only = true

[Sc Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D 00
ep_only = true

[Sc Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00
ep_only = true

[SDProtect -> Randy Li]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00
ep_only = true

[SDProtect -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05
ep_only = true

[SecureEXE 3.0 -> ZipWorx]
signature = E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[SecuROM V7.X -> Sony DADC * Sign.By.fly * 20080114]
signature = 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 6C 24 1C C1 E2 00 8B 6C 24 0C 83 C4 18 9D ?? 74 12 81 04 24 ?? ?? ?? ?? ?? 81 04 24 C3 D1 FF 00 EB FA 6B 81 04 24 ?? ?? ?? ?? 0F AC F8 00 81 04 24 C2 04 00 3E FF 74 24 04 9D EB F5 EE 93 9D
ep_only = true

[Securom7 -> Sony DADC]
signature = B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8
ep_only = true

[Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet]
signature = 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15
ep_only = true

[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]
signature = A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8
ep_only = true

[Sentinel SuperPro Dongle V5.42.0.0 -> Rainbow Technologies * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E DF 80 E8 ?? ?? ?? ?? 68 B9 10 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 12 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 07 2A A3 00 E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 88 B5 5B FF E8 ?? ?? ?? ?? 68 B9 30 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68
ep_only = true

[Sentinel UltraPro Dongle V1.1.0 -> SafeNet Inc. * Sign.By.fly]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 04 83 F8 64 7C E7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 8B 4D 00 83 C5 08 ?? ?? ?? ?? ?? ?? ?? 66 8B 75 FA ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B 55 FC 81 E1 FF FF 00 00 81 F9
ep_only = true

[Sexe Crypter 1.1 - by santasdad]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79
ep_only = true

[Shegerd Dongle V4.78 -> MS.Co.]
signature = E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C
ep_only = true

[SoftDefender 1.x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00
ep_only = true

[SoftProtect -> SoftProtect.by.ru]
signature = E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83
ep_only = true

[SoftProtect -> SoftProtect.by.ru]
signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C
ep_only = true

[SoftProtect -> www.softprotect.by.ru]
signature = E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01
ep_only = true

[SoftSentry v2.11]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 50
ep_only = true

[Solidshield Protector V1.X -> Solidshield Technologies * Sign.By.fly]
signature = 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00
ep_only = true

[Solidshield Protector V1.X DLL -> Solidshield Technologies * Sign.By.fly]
signature = 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF FF 83 FE 02 57 8B 7D 10 75 53 FF 75 24 FF 75 20 FF 75 1C FF 75 18 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 20 3C 01 75 04 8B C6 EB 6A 57 FF 75 0C E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 14 3C 01 74 DF 6A 03 5E 83 FE 03 75 1B 57 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 6A 00 FF 15 ?? ?? ?? ?? 83 FE 04 75 0D FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 59 59 83 FE 05 75 11 FF 75 30 FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 83 C4 0C 33 C0 5F 5E 5D C3
ep_only = true

[StarForce -> Protection Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[StarForce 3.0 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 63
ep_only = true

[StarForce 3.0 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 57
ep_only = true

[StarForce ProActive 1.1 -> StarForce Technology]
signature = 53 55 8B E8 33 DB EB 60
ep_only = true

[StarForce V1.X-V3.X -> StarForce Copy Protection System]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00
ep_only = true

[StarForce V3.X DLL -> StarForce Copy Protection System]
signature = E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21
ep_only = true

[Stone's PE Encryptor v1.0]
signature = 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00
ep_only = true

[Stone's PE Encryptor v1.13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28
ep_only = true

[Stone`s PE Encruptor v1.13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81
ep_only = true

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23
ep_only = true

[SVK Protector v1.3x (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SVK-Protector v1.43 -> www.anticracking.sk]
signature = 78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05 6
ep_only = true

[T.P.C's COM Scrambler v1.00]
signature = ?? ?? ?? ?? ?? ?? ?? EB J3 2E ?? ?? ?? ?? 8E C0 8C D8 BE ?? ?? BF ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 0E 07 B9 ?? ?? FC F3 A4 CC
ep_only = true

[tElock 0.51 -> tE!]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74
ep_only = true

[tElock 0.96 -> tE!]
signature = E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C
ep_only = true

[tElock 0.98 -> tE!]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65
ep_only = true

[tElock 0.98 Special Build -> forgot & heXer]
signature = E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA
ep_only = true

[tElock 0.99 - 1.0 private -> tE!]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[tElock 0.99 - 1.0 private -> tE!]
signature = E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5
ep_only = true

[tElock 0.99 -> tE!]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05
ep_only = true

[tElock 0.99c (Private ECLIPSE) -> tE!]
signature = E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65
ep_only = true

[tElock v0.42]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true

[tElock v0.4x - v0.5x]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true

[tElock v0.70]
signature = 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70
ep_only = true

[tElock v0.71]
signature = 60 E8 ED 10 00 00 C3 83
ep_only = true

[tElock v0.71b2]
signature = 60 E8 44 11 00 00 C3 83
ep_only = true

[tElock v0.7x - v0.84]
signature = 60 E8 00 00 C3 83
ep_only = true

[tElock v0.7x - v0.84]
signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[tElock v0.92a]
signature = E9 7E E9 FF FF 00
ep_only = true

[tElock v0.92a]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00
ep_only = true

[tElock v0.95]
signature = E9 D5 E4 FF FF 00
ep_only = true

[tElock v0.96]
signature = E9 59 E4 FF FF 00
ep_only = true

[tElock v0.96]
signature = E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3
ep_only = true

[tElock v0.98]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E
ep_only = true

[tElock v0.98b1]
signature = E9 25 E4 FF FF
ep_only = true

[tElock v0.98b2]
signature = E9 1B E4 FF FF
ep_only = true

[tElock v0.99]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 77 ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[tElock v0.99 -> tE! [TMD]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[tElock v1.00]
signature = E9 E5 E2 FF FF
ep_only = true

[The aPE Inline Patch Basic, Advanced, Stealth)]
signature = B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68
ep_only = true

[The aPE Inline Patch ExtraStealth, SuperStealth)]
signature = E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
ep_only = true

[The Best Cryptor -> FsK   * Sign.By.fly]
signature = EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90
ep_only = true

[The WiZ Cryptor v1.00a by SP0T //UCL]
signature = E9 J1 J1 FA 60 56 1E 8E D8 BE ?? ?? BF ?? ?? B8 ?? ?? 87 ?? ?? ?? AB 8C C8 87 ?? ?? ?? AB 1F 68 ?? ?? 9C 58 80 ?? ?? 50 9D FC
ep_only = true

[Themida -> Oreans Technologies 2004]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8
ep_only = true

[Themida 1.2.0.1 -> Oreans Technologies (h)]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00
ep_only = true

[Themida 1.8.x.x - 1.9.x.x -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9
ep_only = true

[Themida 1.8.x.x -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67
ep_only = true

[Themida 1.9.2.0]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9
ep_only = true

[Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00
ep_only = true

[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9
ep_only = true

[Themida/WinLicense V1.8.0.2 +  -> Oreans Technologies]
signature = B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00
ep_only = true

[Themida/WinLicense V1.8.X-V1.9.X  -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9
ep_only = true

[Themida/WinLicense V1.8.X-V1.9.X Other -> Oreans Technologies * Sign.By.fly * 20080131]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58
ep_only = true

[UltraPro V1.0 -> SafeNet]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15
ep_only = true

[UnderGround Crypter - by Booster2000]
signature = 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0
ep_only = true

[Unknown encryptor (3)]
signature = ?? ?? ?? E9 J1 J1 1E 06 8C D8 05 ?? ?? 8E D8 8E C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8B E8 2E
ep_only = true

[Unnamed Scrambler 1.1C -> p0ke]
signature = 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF
ep_only = true

[Unnamed Scrambler 1.2B -> p0ke]
signature = 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10
ep_only = true

[Unnamed Scrambler 1.2C / 1.2D -> p0ke]
signature = 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65
ep_only = true

[Unnamed Scrambler 1.3B -> p0ke]
signature = 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10
ep_only = true

[Unnamed Scrambler 1.3B -> p0ke]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF
ep_only = true

[Unnamed Scrambler 1.3B -> p0ke]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00
ep_only = true

[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]
signature = 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74
ep_only = true

[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]
signature = 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8
ep_only = true

[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]
signature = 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8
ep_only = true

[VMProtect 0.7x - 0.8 -> PolyTech]
signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D
ep_only = true

[VMProtect 0.x -> PolyTech]
signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20
ep_only = true

[VMProtect 1.06..1.07 -> PolyTech]
signature = 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8
ep_only = true

[VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52
ep_only = true

[VOB ProtectCD]
signature = 36 3E 26 8A C0 60 E8
ep_only = true

[VProtector -> vcasm]
signature = 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC
ep_only = true

[VProtector 1.0X -> vcasm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00
ep_only = true

[VProtector 1.0X -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00
ep_only = true

[VProtector 1.1X -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3
ep_only = true

[vprotector 1.2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00
ep_only = true

[vprotector 1.2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00
ep_only = true

[vprotector 1.2 -> vcasm (h)]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
ep_only = true

[vprotector 1.3 -> vcasm]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68
ep_only = true

[VProtector 1.3X -> vcasm]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00
ep_only = true

[VProtector V1.0 [Build 2004.12.13]
signature = 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.0A -> vcasm]
signature = 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.0B -> vcasm]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.0D -> vcasm]
signature = 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.1 -> vcasm]
signature = B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00
ep_only = true

[VProtector V1.3X -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00
ep_only = true

[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)]
signature = 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00
ep_only = true

[XCR v0.13]
signature = 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB
ep_only = true

[Xtreme-Protector v1.06]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE P_ ON LY =T RU E
ep_only = true

[Xtreme-Protector v1.06]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 F
ep_only = true

[Xtreme-Protector v1.06]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4
ep_only = true

[yoda's Crypter 1.3 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00
ep_only = true

[yoda's Crypter 1.3 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[yoda's Protector 1.0 beta -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00
ep_only = true

[yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00
ep_only = true

[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00
ep_only = true

[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00
ep_only = true

[yoda's Protector 1.02 -> Ashkibiz Danehlar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector 1.02 -> Ashkibiz Danehlar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector 1.03.1 -> Ashkibiz Danehlar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector 1.0b -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01
ep_only = true

[yoda's Protector 1.0x -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03
ep_only = true

[yoda's Protector 1.0x -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01
ep_only = true

[yoda's Protector v1.01 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector v1.01 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA
ep_only = true

[yoda's Protector V1.01 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[yoda's Protector v1.02 (.dll,.ocx) --> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector v1.02 (.dll,.ocx) -> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector V1.02 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector v1.02b-> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01
ep_only = true

[yoda's Protector V1.03.1 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[yoda's Protector v1.03.2 (.dll,.ocx) --> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector v1.03.2 (.dll,.ocx) -> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector V1.03.2 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector V1.03.3 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3
ep_only = true

[yoda's Protector v1.0b -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector V1.0b -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC
ep_only = true

[ZCode Win32/PE Protector v1.01]
signature = 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0
ep_only = true

[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC]
signature = E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = false

[ACProtect 1.41 -> AntiCrack Software]
signature = E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30
ep_only = false

[ACProtect 1.4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70
ep_only = false

[ACProtect 1.4x -> RISCO soft]
signature = 47 53 44 31 02 00 11 00
ep_only = false

[ACProtect v1.35 -> risco software Inc. & Anticrack Software]
signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63
ep_only = false

[ACProtect V1.3X-V1.4X -> RiSco   * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00
ep_only = false

[ACProtect v1.41]
signature = 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00
ep_only = false

[ActiveMARK 5.x -> Trymedia Systems,Inc. (h)]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48
ep_only = false

[AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = false

[AHTeam EP Protector 0.3 (fake Spalsher 1.x-3.x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84
ep_only = false

[AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34
ep_only = false

[AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03
ep_only = false

[AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D
ep_only = false

[AHTeam EP Protector 0.3 (fake VIRUS/I-Worm Hybris) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15
ep_only = false

[AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00
ep_only = false

[AHTeam EP Protector 0.3 (fake Xtreme-Protector 1.05) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8
ep_only = false

[AHTeam EP Protector 0.3 (fake ZCode 1.01) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35
ep_only = false

[Armadillo 3.01, 3.05]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F
ep_only = false

[Armadillo 3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1
ep_only = false

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 61 69 6C 65 64 20 43 52 43 20 63 68 65 63 6B 00 00 00 00 52
ep_only = false

[Armadillo 4.40 -> Silicon Realms Toolworks (h)]
signature = 30 31 2E 30 31 00 00 04
ep_only = false

[Armadillo v1.71]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1
ep_only = false

[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24
ep_only = false

[Armadillo V5.00-V5.X Dll -> Silicon Realms Toolworks * Sign.By.fly]
signature = 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57
ep_only = false

[Armadillo V5.20 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = false

[Armadillo V5.20.Beta1 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = false

[Armadillo V5.40 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = false

[ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C
ep_only = false

[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = false

[ASProtect v1.2 -> Alexey Solodovnikov (h1)]
signature = 90 ?? 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0
ep_only = false

[ASProtect v1.2x]
signature = 00 00 68 01 ?? ?? ?? C3 AA
ep_only = false

[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]
signature = 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40
ep_only = false

[AverCryptor 1.0 -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8
ep_only = false

[AverCryptor 1.02 beta -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F
ep_only = false

[ChinaProtect -> dummy]
signature = 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3
ep_only = false

[ChinaProtect -> dummy]
signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0
ep_only = false

[Code Virtualizer 1.3.1.0 -> Oreans Technologies]
signature = 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC
ep_only = false

[codeCrypter 0.31 -> Tibbar]
signature = 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC
ep_only = false

[Crypter 3.1 -> SLESH]
signature = 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68
ep_only = false

[Crypto-Lock 2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = false

[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]
signature = E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B
ep_only = false

[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]
signature = E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03
ep_only = false

[DotFix NiceProtect vna]
signature = 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29
ep_only = false

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00
ep_only = false

[Elicense System V4.0.0.0 -> ViaTech Inc]
signature = 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00
ep_only = false

[EncryptPE V2.2007.12.1 -> WFS * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 45 4D 61 69 6C 3A 20 77 66 73 23 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 00 00 00
ep_only = false

[EncryptPE V2.2007.12.1 -> WFS * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74
ep_only = false

[EncryptPE V2.2008.6.18 -> WFS * Sign.By.KuNgBiM]
signature = 68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65
ep_only = false

[ENIGMA Protector -> Sukhov Vladimir]
signature = 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31
ep_only = false

[Enigma Protector 1.0X -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70
ep_only = false

[Enigma protector 1.10/1.11 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Enigma Protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A
ep_only = false

[Enigma protector 1.12 -> Vladimir Sukhov (h)]
signature = 55 46 41 C6 D2 C1 00 00
ep_only = false

[Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Enigma protector v1.02 -> Vladimir Sukhov (h)]
signature = 55 53 20 50 54 4F 20 00
ep_only = false

[Enigma Protector v1.12 LITE]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Exe Shield 2.7b]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = false

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40
ep_only = false

[EXE Shield V0.1b-V0.8 -> SMoKE]
signature = E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00
ep_only = false

[EXE Stealth 2.74]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02
ep_only = false

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9
ep_only = false

[EXE Stealth v2.76 -> WebToolMaster]
signature = EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41
ep_only = false

[EXECryptor 2.0/2.1 (protected IAT)]
signature = A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41
ep_only = false

[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development]
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01
ep_only = false

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = false

[EXECryptor 2.2.x -> SoftComplete Developement]
signature = 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1
ep_only = false

[EXECryptor 2.2/2.3 (protected IAT)]
signature = CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78
ep_only = false

[EXECryptor 2.x -> SoftComplete Developement]
signature = 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C
ep_only = false

[EXECryptor V2.1X -> softcomplete.com]
signature = 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[ExeSafeguard v1.0 -> simonzh]
signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE
ep_only = false

[FakeNinja v2.8 (Anti-Debug) -> Spirit]
signature = 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00
ep_only = false

[Fly-Crypter 1.0 -> ut1lz]
signature = 53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3
ep_only = false

[Fly-Crypter 1.0 -> ut1lz]
signature = 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB
ep_only = false

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A
ep_only = false

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2
ep_only = false

[hmimys Protect v1.0]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8
ep_only = false

[Hying's PE-Armor 0.75.exe -> Hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00
ep_only = false

[Hying's PE-Armor 0.75.exe -> Hying [CCG] (h)]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C9
ep_only = false

[Hying's PE-Armor 0.76 -> Hying [CCG]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75
ep_only = false

[Hying's PE-Armor 0.76 -> Hying [CCG] (h)]
signature = 01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3
ep_only = false

[MarjinZ EXE-Scrambler SE - by MarjinZ]
signature = E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3
ep_only = false

[MarjinZ EXE-Scrambler SE - by MarjinZ]
signature = E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45
ep_only = false

[Matrix Dongle -> TDi GmbH]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2
ep_only = false

[MicroDog Win32Shell V4.0.9.3 -> SafeNet * Sign.By.fly]
signature = 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D
ep_only = false

[MicroDog Win32Shell V4.0.9.3 Dll -> SafeNet * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D
ep_only = false

[MicroDog Win32Shell V4.X -> SafeNet * Sign.By.fly]
signature = 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D
ep_only = false

[MoleBox v2.3.0 -> Teggo]
signature = 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC
ep_only = false

[MoleBox v2.5.4 -> Teggo]
signature = ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = false

[MoleBoxPro 2.5.5 -> Mole Studio (h)]
signature = E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00
ep_only = false

[Morphine 2.7 -> Holy_Father & Ratter/29A]
signature = ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Morphine 3.3 -> Holy_Father & Ratter/29A]
signature = 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Morphine v1.2]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59
ep_only = false

[Morphine v1.2 - v1.3]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Morphine v2.7 -> Holy_Father & Ratter/29A (h)]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = false

[Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)]
signature = BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[NTkrnl Secure Suite -> NTkrnl team]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73
ep_only = false

[NTkrnl Secure Suite -> NTkrnl team (h)]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = false

[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79
ep_only = false

[NTkrnl Secure Suite 0.1-0.15 DLL -> NTkrnl Software]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3
ep_only = false

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B
ep_only = false

[Obsidium 1.3.0.21 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB
ep_only = false

[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB
ep_only = false

[Obsidium V1.3.4.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04
ep_only = false

[Obsidium V1.3.5.0 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB
ep_only = false

[Obsidium V1.3.5.2 -> Obsidium Software * Sign.By.fly]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04
ep_only = false

[Obsidium V1.3.5.3 -> Obsidium Software * Sign.By.fly * 20080120]
signature = EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04
ep_only = false

[Obsidium V1.3.5.4 -> Obsidium Software * Sign.By.fly * 200800207]
signature = EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50
ep_only = false

[Obsidium V1.4.0.0.Beta -> Obsidium Software * Sign.By.fly * 20080102]
signature = EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03
ep_only = false

[Open Source Code Crypter -> p0ke]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00
ep_only = false

[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]
signature = 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3
ep_only = false

[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]
signature = 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80
ep_only = false

[PC-Guard v3.03d, v3.05d]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = false

[PE Encrypt 1.0 -> Liwuyue]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89
ep_only = false

[PE Protect v0.9]
signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F
ep_only = false

[PE-Armor 0.760-0.765 -> hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00
ep_only = false

[PE-PROTECT 0.9]
signature = 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39
ep_only = false

[PEncrypt 1.0 -> JunkCode]
signature = 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF
ep_only = false

[PeStubOEP v1.x]
signature = 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF
ep_only = false

[PeStubOEP v1.x]
signature = E8 05 00 00 00 33 C0 40 48 C3 E8 05
ep_only = false

[PeStubOEP v1.x]
signature = ?? ?? B8 ?? ?? ?? 00 FF E0
ep_only = false

[PE_Protector V2.60��hying's PE-Armor V0.460 modify�� -> Engprog * Sign.By.fly]
signature = 55 53 51 52 56 57 E8 E1 00 00 00
ep_only = false

[Pi Cryptor 1.0 - by Scofield]
signature = 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9
ep_only = false

[Pi Cryptor 1.0 - by Scofield]
signature = 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68
ep_only = false

[Protect Shareware V1.1 -> eCompserv CMS]
signature = 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
ep_only = false

[QinYingShieldLicense V1.0X-V1.21 -> Lei Peng * Sign.By.fly * 20080122]
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9
ep_only = false

[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0
ep_only = false

[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = false

[RCryptor v1.5 --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F
ep_only = false

[RCryptor v2.0 (Hide EP) --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3
ep_only = false

[RCryptor v2.0 --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75
ep_only = false

[RPolyCryptor V1.4.2 -> Vaska * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00
ep_only = false

[SafeDisc v4]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F
ep_only = false

[Safedisc V4.50.000 -> Macrovision Corporation * Sign.By.fly * 20080117]
signature = 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74
ep_only = false

[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]
signature = 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C
ep_only = false

[SC Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C
ep_only = false

[SecuROM V7.X -> Sony DADC * Sign.By.fly * 20080114]
signature = 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89
ep_only = false

[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]
signature = A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00
ep_only = false

[Sentinel SuperPro Dongle V5.42.0.0 -> Rainbow Technologies * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8
ep_only = false

[Sentinel UltraPro Dongle V1.1.0 -> SafeNet Inc. * Sign.By.fly]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4
ep_only = false

[Sexe Crypter 1.1 - by santasdad]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B
ep_only = false

[SimbiOZ PolyCryptor v.xx-> Extranger]
signature = 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
ep_only = false

[Solidshield Protector V1.X DLL -> Solidshield Technologies * Sign.By.fly]
signature = 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF
ep_only = false

[SVK Protector 1.3x (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = false

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = false

[tElock 0.51 -> tE!]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00
ep_only = false

[tElock 0.96 -> tE!]
signature = E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39
ep_only = false

[tElock 0.98 -> tE!]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00
ep_only = false

[tElock 0.98 Special Build -> forgot & heXer]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00
ep_only = false

[tElock 0.99]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00
ep_only = false

[tElock 0.99c (Private ECLIPSE) -> tE!]
signature = E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00
ep_only = false

[tElock v0.41x]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00
ep_only = false

[Themida 1.2.0.1 -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25
ep_only = false

[Themida 1.9.2.0]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00
ep_only = false

[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = false

[Themida/WinLicense V1.8.X-V1.9.X -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3
ep_only = false

[Themida/WinLicense V1.X -> Oreans Technologies   * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00
ep_only = false

[Themida/WinLicense V1.X -> Oreans Technologies * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65
ep_only = false

[TPAV Cryptor V1.1 -> msaha_dev * Sign.By.fly]
signature = 8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D 95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ?? 70
ep_only = false

[TTProtect V1.0X -> somuch&nbsp; &nbsp;* Sign.By.fly * 20080806]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 50 57 53 9C E8 ?? 00 00 00
ep_only = false

[TTProtect V1.0X -> somuch&nbsp; &nbsp;* Sign.By.fly * 20080807]
signature = 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0
ep_only = false

[Unnamed Scrambler 1.0 -> p0ke]
signature = 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32
ep_only = false

[Unnamed Scrambler 1.1C -> p0ke]
signature = 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10
ep_only = false

[Unnamed Scrambler 1.2B -> p0ke]
signature = 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8
ep_only = false

[Unnamed Scrambler 1.2C / 1.2D -> p0ke]
signature = 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54
ep_only = false

[Unnamed Scrambler 2.0 -> p0ke]
signature = 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00
ep_only = false

[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]
signature = 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8
ep_only = false

[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]
signature = 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1
ep_only = false

[Unnamed Scrambler 2.5A -> p0ke]
signature = 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C
ep_only = false

[VProtector -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00
ep_only = false

[VProtector 1.1A-1.2 -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3
ep_only = false

[VProtector 1.3X -> vcasm]
signature = 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF
ep_only = false

[VProtector V1.3X -> vcasm]
signature = 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00
ep_only = false

[VProtector V1.3X -> vcasm * Sign.By.fly]
signature = 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41
ep_only = false

[Werus Crypter 1.0 - by Kas]
signature = BB E8 12 40 00 80 33 05 E9 7D FF FF FF
ep_only = false

[Werus Crypter 1.0 -> Kas]
signature = 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40
ep_only = false

[Werus Crypter 1.0 -> Kas]
signature = 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF
ep_only = false

[Xtreme-Protector v1.05]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02
ep_only = false

[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75
ep_only = false

[yoda's Protector 1.0x -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01
ep_only = false

[Zylom encrypted game -> Zylom games (h)]
signature = 2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 7A 79 6C 6D 73 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2E 7A 79 6C 6D 69 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0
ep_only = false



================================================
FILE: peid_rules/PE/sfx_archive.userdb.txt
================================================
; PEiD signature database - sfx_archive
; Auto-categorized from userdb.txt (38 entries)

[ACE Archive]
signature = ?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A
ep_only = true

[AMGC Archive]
signature = AD 36 22 00
ep_only = true

[ARJ Archive]
signature = 60 EA
ep_only = true

[DWC Archive]
signature = 44 57 43
ep_only = true

[EZIP v1.0]
signature = E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C
ep_only = true

[FixupPak 1.20]
signature = 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00
ep_only = true

[FixupPak v1.20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[FixupPak v1.20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8
ep_only = true

[FixupPak v1.20]
signature = 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D
ep_only = true

[FIZ Archive]
signature = 46 49 5A 1A 01
ep_only = true

[FOXSQZ Archive]
signature = 46 4F 58 53 51 5A
ep_only = true

[GZIP Archive]
signature = 1F 8B 08 08 ?? ?? ?? 35
ep_only = true

[HA Archive]
signature = 48 41
ep_only = true

[HPACK Archive]
signature = 48 50 41 4B
ep_only = true

[Hyper Archive]
signature = 1A 53 54
ep_only = true

[ICE Archive]
signature = ?? ?? 2D 6C 68 ?? 2D
ep_only = true

[InterLok V5.51 -> PACE Anti-Piracy * Sign.By.fly]
signature = EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 ?? ?? EB FA ?? EB 01 ?? EB F8 ?? EB 01 ?? 57 EB 03 ?? ?? ?? EB 11 ?? ?? ?? EB 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 08 ?? EB F0 ?? EB 07 ?? ?? EB FA ?? ?? ?? EB 02 ?? ?? BB ?? ?? ?? ?? EB 03 ?? ?? ?? 0F 85 ?? ?? ?? ?? EB 07
ep_only = true

[InterLok V5.X -> PACE Anti-Piracy * Sign.By.fly]
signature = 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 48 3C 03 C8 89 ?? ?? ?? ?? ?? EB 06 8B ?? ?? ?? ?? ?? 66 8B 59 16 C1 EB 0D 83 E3 01 74 0A 83 7D 0C 01 0F 85 38 01 00 00 8D 45 F8 50 8D 45 FC 50 E8 47 01 00 00 8B F8 59 3B FE 59 75 52 83 7D FC FF FF 75 F8 75 17 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C EB 18 FF 75 FC 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 10 6A 30 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? E9 BB 00 00 00 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 FF D7 57 6A 01 8B F0 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 F6 0F 84 96 00 00 00 83 FE F6 7F 32 74 29 83 FE 97 74 75 83 FE F3 74 18 83 FE F4 74 0C 83 FE F5 75 2B B8 ?? ?? ?? ?? EB 4F B8 ?? ?? ?? ?? EB 48 B8 ?? ?? ?? ?? EB 41 B8 ?? ?? ?? ?? EB 3A 83 FE FA 74 30 83 FE FC 74 24 83 FE FD 74 18 56 8D 45 E0 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C 8D 45 E0 EB 13 B8 ?? ?? ?? ?? EB 0C B8 ?? ?? ?? ?? EB 05 B8 ?? ?? ?? ?? 6A 30 68 ?? ?? ?? ?? 50 6A 00 FF 15 ?? ?? ?? ?? 85 DB 75 08 6A 01 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B C9 C2 0C 00
ep_only = true

[JRC Archive]
signature = 4A 52 63 68 69 76 65
ep_only = true

[LHA Archive]
signature = ?? ?? ?? 6C 68 35
ep_only = true

[Limit Archive]
signature = 4C 4D 1A
ep_only = true

[Mac`s StuffIt Archive]
signature = 53 49 54 21 00
ep_only = true

[PEZip v1.0 by BaGIE]
signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6
ep_only = true

[PEZip v1.0 by BaGIE]
signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51
ep_only = true

[PKZIP Archive]
signature = 50 4B 03 04
ep_only = true

[RAR Archive]
signature = 52 61 72 21
ep_only = true

[RAR Configuration file]
signature = 52 41 52 20 43 4F 4E 46 49 47
ep_only = true

[SQZ Archive]
signature = 48 4C 53 51 5A
ep_only = true

[Stirling Archive]
signature = 13 5D 65 8C 3A
ep_only = true

[SWAG Archive]
signature = ?? ?? 2D 73 77 31 2D
ep_only = true

[TheHyper's protector -> TheHyper]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8
ep_only = true

[TheHyper's protector -> TheHyper (h)]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D
ep_only = true

[TheHyper's protector -> TheHyper (h)]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D
ep_only = true

[TPACK v1.7 Archive]
signature = ?? 54 50 41 43 ?? 31 2E 37
ep_only = true

[ZOO Archive]
signature = 5A 4F 4F
ep_only = true

[InterLok V5.51 -> PACE Anti-Piracy * Sign.By.fly]
signature = EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7
ep_only = false

[InterLok V5.X -> PACE Anti-Piracy * Sign.By.fly]
signature = 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3
ep_only = false

[JAR Archive]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B
ep_only = false



================================================
FILE: peid_rules/PE/split_userdb.ps1
================================================
$ErrorActionPreference = 'Stop'
$base = "C:\tmp_build\qt5\_mylibs\XPEID\peid\PE"
$content = Get-Content "$base\userdb.txt" -Raw -Encoding UTF8

# Category patterns (order matters - first match wins)
$categories = [ordered]@{
    'compiler' = '(?i)(Borland|Delphi|Visual\s+(C|Basic|Studio)|MSVC|\.NET|GCC|MinGW|Watcom|FASM|MASM|NASM|TASM|GoLink|LCC\s+Win|PureBasic|PowerBasic|FreeBasic|Turbo\s+(C|Pascal|Assembler|Basic)|Intel\s+C|Digital\s+Mars|Lahey|Dev-C|Code\s*Gear|Embarcadero|AutoIt|AutoHotkey|Lazarus|Free\s*Pascal|GNU\s+(C|Pascal)|Cygwin|DJGPP|Open\s*Watcom|Pelles\s+C|Tiny\s+C|lcc-win|Clarion|Eiffel|Ada\b|GNAT\b|CodeWarrior|Metrowerks|Symantec\s+C|Zortech|Power\s*C|Quick\s*C|Quick\s*Basic|Clipper|Harbour|C\+\+Builder|RAD\s*Studio|\.NET\s+(DLL|executable)|PE-Exe\s+Executable|BobSoft\s+Mini\s+Delphi|Microsoft\s+Visual|RSRC\b|Resource\s+Editor|Gentee|HiPEC|BlitzBasic|CAD-UL|PowerBASIC)'
    'packer' = '(?i)(UPX\b|ASPack|FSG\b|PECompact|PeCompact|PEBundle|Petite|NsPack|MPRESS|Upack|WinUpack|MEW\s|Neolite|PKLite|LZEXE|Diet\b|Crunch|KByS|nPack\b|PE.?Pack|JDPack|WWPack|Exe32Pack|AHPack|BeRo\s+EXE|kkrunchy|RLPack|PackMan|!EP\b|EPack\b|ExePack\b|Pack\s*Master|PEPACK|32Lite|PE\s+Intro|PE\s+Spin|PESpin|PEX\b|Packer\b|Dropper|Aspack|pack(?:ed|er|ing)|compress|SFX\b|WinZip|WinRAR|self.extract|7.Zip.*SFX|RAR\s+SFX|\$pirit|\$PIRIT|Special\s+EXE|SPLayer|SLVc0de\s+Joiner|PC\s+Shrinker|NorthStar|NoodleCrypt|Nullsoft\s+PiMP|PE\s+Diminisher|PEQuake|PENightMare|Vx\b)'
    'protector' = '(?i)(Armadillo|ExeCryptor|ASProtect|StarForce|SecuROM|SafeDisc|SafeNet|Sentinel|CodeVirtualizer|WinLicense|ACProtect|AntiCrack|ZProtect|PCGuard|SoftDefender|CopyMinder|PE.?Protect|PE.?SHiELD|PE.?Guard|PE.?Armor|PE.?Lock|PE.?Crypt|tElock|Themida|VMProtect|Enigma|Obsidium|MoleBox|Yoda.s\s+(Protector|Crypter)|Crypto|Crypt(?:er|or)\b|Cipher|Obfuscat|Morph(?:ine|er|ing)|SVK.Protector|DNGuard|Stealth|Anti.?Debug|NTkrnl|Xtreme.Protector|VProtector|ActiveMARK|VOB\s+Protect|Software\s+Passport|SoftSentry|CodeLock|PseudoSigner|EP\s+Protector|AHTeam|Hide.?PE|ORiEN|ProtectPE|SecureEXE|Stone.s\s+PE|WaterMark|EmbedPE|HASP\b|Dongle|Scrambl|NoobyProtect|PEStubOEP|Protect\b|Shield\b|Guard\b|Armor\b|Encr[iy]pt|Anti.?Tamper|License|Virtual(?:ize|Machine)|Code.?Virtual|Polymorph|CRC.Protect|ABC\s+Crypt|Acid\s*Crypt|WWCryptor|PCrypt|XCR\b|Krypton|Polycrypt|ReCrypt|SimplePack|The\s+Wall|Super\s+Protect|SProtect)'
    'joiner' = '(?i)(join|bind|binder|glue|merge|fuse|juntador|Exejoin|ExeBind|FileBinder|YAB\b)'
    'installer' = '(?i)(install|setup\b|deploy|wizard|InnoSetup|Inno\s+Install|NSIS|Nullsoft\s+Install|Wise|Ghost\s+Install|CreateInstall|Smart\s*Install|SetupFactory|InstallAnywhere|InstallJammer|BitRock|Advanced\s+Installer|GP.Install|Installer\s+VISE|Patch\s+Creation)'
    'sfx_archive' = '(?i)(Archive|\.cab\b|ZIP\s|GZIP|BZIP|\.rar\b|\.7z\b|\.ace\b|ARJ\b|LHA\b|LZH\b|ZOO\b|ARC\b\s|PKZip|PKSFX|ACE\s|AMGC|DWC\b|EZIP|FIZ\b|FOXSQZ|HA\s+Archive|HAP\b|HPack|Hyper\b|JAR\b|LIMIT\b|LZOP|PAK\b|QUANTUM|RAR\b|Reduce|SQZ\b|YAC\b|UC2\b|UHARC)'
    'file_format' = '(?i)(Graphics?\s+format|Audio\s+(file|format)|Image\s+file|Video\s+file|Font\s+file|Database\s+file|PDF|BMP\s+graph|GIF\s+graph|JPEG|PNG\s+graph|TIFF|WAV\b|MP3\b|MIDI|PCX\b|TGA\b|EPS\b|WMF\b|EMF\b|PIX\b|IFF\b|PSD\b|CDR\b|DXF\b|Kodak|Lotus|WordPerfect|PostScript|3DMark|Amiga|Alias\s+PIX|Alpha\s+BMP|Autodesk|ADEX|Adlib|Adobe|CorelDRAW|Rich\s+Text|DBase|FoxPro|Paradox|Excel|Access\s+Database|Executable\s+Image|Object\s+Module|AVI\b|RIFF\b|SWF\b|FLV\b|MOV\b|Atari|Macintosh|Apple|OS.2)'
    'overlay' = '(?i)(overlay|appended\s+data|Crinkler|Go32Stub|DOS.Extender|stub\s+engine)'
}

# Split content into blocks
$blocks = $content -split '(?m)(?=^\[)' | Where-Object { $_.Trim() -ne '' -and $_.Trim() -match '^\[' }

$results = @{}
foreach ($cat in $categories.Keys) {
    $results[$cat] = [System.Collections.Generic.List[string]]::new()
}
$results['protection'] = [System.Collections.Generic.List[string]]::new()

foreach ($block in $blocks) {
    $firstLine = ($block -split "`n")[0].Trim()
    $matched = $false
    foreach ($cat in $categories.Keys) {
        if ($firstLine -match $categories[$cat]) {
            $results[$cat].Add($block.TrimEnd())
            $matched = $true
            break
        }
    }
    if (-not $matched) {
        $results['protection'].Add($block.TrimEnd())
    }
}

# Write files
$total = 0
foreach ($cat in $results.Keys | Sort-Object) {
    $count = $results[$cat].Count
    $total += $count
    $header = "; PEiD signature database - $cat`r`n; Auto-categorized from userdb.txt ($count entries)`r`n`r`n"
    Set-Content -Path "$base\$cat.userdb.txt" -Value ($header + ($results[$cat] -join "`r`n`r`n") + "`r`n") -Encoding UTF8
    Write-Output "$cat.userdb.txt: $count entries"
}

Write-Output ""
Write-Output "Total: $total (original: 4445)"
Write-Output ""
Write-Output "Files:"
Get-ChildItem "$base\*.userdb.txt" | Sort-Object Name | ForEach-Object { Write-Output "  $($_.Name) ($([math]::Round($_.Length/1024, 1)) KB)" }


================================================
FILE: peid_rules/PE/userdb.txt
================================================
;  Made with Add Signature v2.00 by BoB / BobSoft ..
;  4445 Signatures in list ..

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10
ep_only = true

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28
ep_only = true

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3
ep_only = true

[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3
ep_only = true

[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 55 53 45 52 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 EB 4C 47 6C 6F 62 61 6C 41 6C 6C 6F 63 00 47 6C 6F 62 61 6C 46 72 65 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45
ep_only = true

[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]
signature = 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12 D2 73 4A 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 D6 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 EB A0 B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 83 E8 02 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 58 FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 18 FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 03 FF FF FF 8A 06 46 33 C9 C0 E8 01 74 12 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E E9 E7 FE FF FF 5D 2B 7D 0C 89 7D FC 61 5D C3
ep_only = true

[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]
signature = 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12
ep_only = true

[!EPack V1.4 lite final -> 6aHguT]
signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00
ep_only = true

[$pirit v1.5]
signature = ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
ep_only = true

[$PIRIT v1.5]
signature = B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21
ep_only = true

[* PseudoSigner 0.1 --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [32Lite 0.03]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [ACProtect 1.09]
signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Armadillo 3.00]
signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9
ep_only = true

[* PseudoSigner 0.1 [ASPack 2.xx Heuristic]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true

[* PseudoSigner 0.1 [ASProtect]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 3.0]
signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]
signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8
ep_only = true

[* PseudoSigner 0.1 [CD-Cops II]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9
ep_only = true

[* PseudoSigner 0.1 [Code-Lock]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9
ep_only = true

[* PseudoSigner 0.1 [CodeSafe 2.0]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9
ep_only = true

[* PseudoSigner 0.1 [Crunch/PE Heuristic]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [DEF 1.0]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9
ep_only = true

[* PseudoSigner 0.1 [DxPack 1.0]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [ExeSmasher]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9
ep_only = true

[* PseudoSigner 0.1 [FSG 1.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9
ep_only = true

[* PseudoSigner 0.1 [FSG 1.31]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9
ep_only = true

[* PseudoSigner 0.1 [Gleam 1.00]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9
ep_only = true

[* PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [LCC Win32 1.x]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9
ep_only = true

[* PseudoSigner 0.1 [LCC Win32 DLL]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [Lockless Intro Pack]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9
ep_only = true

[* PseudoSigner 0.1 [LTC 1.3]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9
ep_only = true

[* PseudoSigner 0.1 [Macromedia Flash Projector 6.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9
ep_only = true

[* PseudoSigner 0.1 [MEW 11 SE 1.0]
signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]
signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 6.20]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [MinGW GCC 2.x]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9
ep_only = true

[* PseudoSigner 0.1 [Morphine 1.2]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Neolite 2.0]
signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [NorthStar PE Shrinker 1.3]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]
signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [PE Intro 1.0]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9
ep_only = true

[* PseudoSigner 0.1 [PE Pack 0.99]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9
ep_only = true

[* PseudoSigner 0.1 [PE Protect 0.9]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9
ep_only = true

[* PseudoSigner 0.1 [PECompact 1.4+]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[* PseudoSigner 0.1 [PENightMare 2 Beta]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9
ep_only = true

[* PseudoSigner 0.1 [PENinja 1.31]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9
ep_only = true

[* PseudoSigner 0.1 [PESHiELD 0.25]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9
ep_only = true

[* PseudoSigner 0.1 [PEtite 2.x (level 0)]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68
ep_only = true

[* PseudoSigner 0.1 [PEX 0.99]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [REALBasic]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [Ste@lth PE 1.01]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00
ep_only = true

[* PseudoSigner 0.1 [UPX 0.6]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [VBOX 4.3 MTE]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9
ep_only = true

[* PseudoSigner 0.1 [Video-Lan-Client]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [VOB ProtectCD 5]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [WATCOM C/C++ EXE]
signature = E9 00 00 00 00 90 90 90 90 57 41 E9
ep_only = true

[* PseudoSigner 0.1 [XCR 0.11]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 E9
ep_only = true

[* PseudoSigner 0.1 [Yoda's Protector 1.02]
signature = E8 03 00 00 00 EB 01 90 90 E9
ep_only = true

[* PseudoSigner 0.2 [.BJFNT 1.1b]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90
ep_only = true

[* PseudoSigner 0.2 [.BJFNT 1.2]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00
ep_only = true

[* PseudoSigner 0.2 [32Lite 0.03]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68
ep_only = true

[* PseudoSigner 0.2 [Armadillo 3.00]
signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85
ep_only = true

[* PseudoSigner 0.2 [ASProtect]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD
ep_only = true

[* PseudoSigner 0.2 [Borland C++ 1999]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3
ep_only = true

[* PseudoSigner 0.2 [Borland C++ DLL (Method 2)]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90
ep_only = true

[* PseudoSigner 0.2 [Borland Delphi DLL]
signature = 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00
ep_only = true

[* PseudoSigner 0.2 [Borland Delphi Setup Module]
signature = 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [CD-Cops II]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01
ep_only = true

[* PseudoSigner 0.2 [Code-Lock]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B
ep_only = true

[* PseudoSigner 0.2 [CodeSafe 2.0]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85
ep_only = true

[* PseudoSigner 0.2 [Crunch/PE Heuristic]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [DEF 1.0]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01
ep_only = true

[* PseudoSigner 0.2 [DxPack 1.0]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [ExeSmasher]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B
ep_only = true

[* PseudoSigner 0.2 [FSG 1.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true

[* PseudoSigner 0.2 [FSG 1.31]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80
ep_only = true

[* PseudoSigner 0.2 [Gleam 1.00]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF
ep_only = true

[* PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01
ep_only = true

[* PseudoSigner 0.2 [LCC Win32 1.x]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50
ep_only = true

[* PseudoSigner 0.2 [LCC Win32 DLL]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true

[* PseudoSigner 0.2 [Lockless Intro Pack]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD
ep_only = true

[* PseudoSigner 0.2 [Macromedia Flash Projector 6.0]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[* PseudoSigner 0.2 [MEW 11 SE 1.0]
signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90
ep_only = true

[* PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00
ep_only = true

[* PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84
ep_only = true

[* PseudoSigner 0.2 [MinGW GCC 2.x]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45
ep_only = true

[* PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [PE Intro 1.0]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A
ep_only = true

[* PseudoSigner 0.2 [PE Pack 0.99]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A
ep_only = true

[* PseudoSigner 0.2 [PE Protect 0.9]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3
ep_only = true

[* PseudoSigner 0.2 [PENightMare 2 Beta]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true

[* PseudoSigner 0.2 [PESHiELD 0.25]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC
ep_only = true

[* PseudoSigner 0.2 [PEX 0.99]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01
ep_only = true

[* PseudoSigner 0.2 [REALBasic]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01
ep_only = true

[* PseudoSigner 0.2 [UPX 0.6]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00
ep_only = true

[* PseudoSigner 0.2 [VBOX 4.3 MTE]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0
ep_only = true

[* PseudoSigner 0.2 [Video-Lan-Client]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01
ep_only = true

[* PseudoSigner 0.2 [VOB ProtectCD 5]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [Watcom C/C++ DLL]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1
ep_only = true

[* PseudoSigner 0.2 [WATCOM C/C++ EXE]
signature = E9 00 00 00 00 90 90 90 90 57 41
ep_only = true

[* PseudoSigner 0.2 [XCR 0.11]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01
ep_only = true

[* PseudoSigner 0.2 [Yoda's Protector 1.02]
signature = E8 03 00 00 00 EB 01 90 90
ep_only = true

[* PseudoSigner 0.2 [ZCode 1.01]
signature = E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true

[* [MSLRH] V0.31 -> emadicius]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1
ep_only = true

[*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)]
signature = 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04
ep_only = true

[.BJFnt v1.1b]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56
ep_only = true

[.BJFnt v1.1b]
signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8
ep_only = true

[.BJFnt v1.2 RC]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB
ep_only = true

[.BJFnt v1.2 RC]
signature = EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47
ep_only = true

[.BJFnt v1.3]
signature = EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB
ep_only = true

[.BJFnt v1.3]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60
ep_only = true

[.BJFnt v1.3]
signature = EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72
ep_only = true

[.BJFnt v1.3]
signature = EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF
ep_only = true

[.NET DLL -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25
ep_only = true

[.NET executable]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[.NET executable]
signature = FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10
ep_only = true

[.NET executable -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25
ep_only = true

[32Lite v0.03a]
signature = 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68
ep_only = true

[32Lite v0.03a]
signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B
ep_only = true

[3DMark Database file]
signature = 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65
ep_only = true

[624 (Six to Four) v1.0]
signature = 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED
ep_only = true

[A program by Jupiter ..]
signature = 2B C0 74 05 68 ?? ?? ?? ?? 50
ep_only = true

[A3E (TXT2COM)]
signature = 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB
ep_only = true

[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF
ep_only = true

[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00
ep_only = true

[ABC Cryptor 1.0 - by ZloY]
signature = 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8
ep_only = true

[ABC Cryptor 1.0 - by ZloY]
signature = 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8
ep_only = true

[ABKprot v1.00]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 J3 9C 8C C0 06 5B 59 51 53 BA ?? ?? 87 F2 56 CF 0E 1F 0E 07
ep_only = true

[ACE Archive]
signature = ?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A
ep_only = true

[ACE-SFX Archive]
signature = 2A 2A 41 43 45 2A 2A
ep_only = true

[AcidCrypt]
signature = 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true

[AcidCrypt]
signature = BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true

[AcidCrypt]
signature = BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80
ep_only = true

[ACProtect 1.09g -> Risco software Inc.]
signature = 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00
ep_only = true

[ACProtect 1.09g -> Risco software Inc.]
signature = 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9
ep_only = true

[ACProtect 1.3x - 1.4x DLL -> Risco Software Inc.]
signature = 80 7C 24 08 01 0F 85
ep_only = true

[ACProtect 1.3x - 1.4x DLL -> Risco Software Inc.]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[ACProtect 1.41 -> AntiCrack Software]
signature = E8 01 00 00 00 ?? 83
ep_only = true

[ACProtect 1.4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00
ep_only = true

[ACProtect v1.35 -> risco software Inc. & Anticrack Software]
signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73
ep_only = true

[ACProtect V1.3X -> risco]
signature = 60 50 E8 01 00 00 00 75 83
ep_only = true

[ACProtect V1.3X -> risco]
signature = 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05
ep_only = true

[ACProtect V1.4X -> risco]
signature = 60 E8 01 00 00 00 7C 83 04 24 06 C3
ep_only = true

[ACProtect V1.4X -> risco]
signature = 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC
ep_only = true

[ACProtect v1.90g -> Risco software Inc.]
signature = 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3
ep_only = true

[ACProtect V2.0 -> risco]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3
ep_only = true

[ACProtect V2.0 -> risco]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50
ep_only = true

[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00
ep_only = true

[ActiveMark -> Trymedia Systems Inc.]
signature = 89 25 ?? ?? ?? ?? EB
ep_only = true

[ActiveMark -> Trymedia Systems Inc.]
signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00
ep_only = true

[ActiveMARK 5.x -> Trymedia Systems Inc. (h)]
signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67
ep_only = true

[ActiveMARK 5.x -> Trymedia Systems,Inc.]
signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67
ep_only = true

[ActiveMARK[TM]
signature = 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25
ep_only = true

[ActiveMARK[TM] R5.31.1140 -> Trymedia]
signature = 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF
ep_only = true

[Added HYPDOC v.1.0]
signature = E9 J1 J1 E8 ?? ?? E8 ?? ?? E8 ?? ?? 2E C6 ?? ?? ?? ?? 2E C6 06 ?? ?? ?? B9 ?? ?? 2E 8A 26 ?? ?? B0 ?? E8 ?? ?? 2E
ep_only = true

[ADEX Graphics format]
signature = 50 49 43 54 00 08 ?? 02
ep_only = true

[AdFlt2]
signature = 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD
ep_only = true

[Adlib Sample Audio file]
signature = 47 4F 4C 44 20 53 41 4D 50 4C 45
ep_only = true

[Adobe PDF (Portable document) Version %v3.%v4]
signature = 25 50 44 46 2D V3 2E V4
ep_only = true

[Adobe PhotoShop Graphics format]
signature = 38 42 50 53 00 01 00 00
ep_only = true

[Ady's Glue 1.10]
signature = 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC
ep_only = true

[Ady`s Glue v0.10]
signature = 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F
ep_only = true

[AEP v1.00]
signature = E8 J1 J1 E4 21 2E ?? ?? ?? 33 C0 8B D8 5D B9 ?? ?? 50 B8 ?? ?? E6 21 0F A9 E6 ?? 53
ep_only = true

[AHPack 0.1 -> FEUERRADER]
signature = 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00
ep_only = true

[AHpack 0.1 -> FEUERRADER]
signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[AHPack 0.1 -> FEUERRADER]
signature = 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61
ep_only = true

[AHTeam EP Protector 0.3 (fake ASPack 2.12) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB
ep_only = true

[AHTeam EP Protector 0.3 (fake ASProtect 1.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D
ep_only = true

[AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8
ep_only = true

[AHTeam EP Protector 0.3 (fake k.kryptor 9/kryptor a) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9
ep_only = true

[AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3
ep_only = true

[AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER]
signature = 90
ep_only = true

[AHTeam EP Protector 0.3 (fake PE Lock NT 2.04) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB
ep_only = true

[AHTeam EP Protector 0.3 (fake PE-Crypt 1.02) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44
ep_only = true

[AHTeam EP Protector 0.3 (fake PESHiELD 2.x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83
ep_only = true

[AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00
ep_only = true

[AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02
ep_only = true

[AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F
ep_only = true

[AHTeam EP Protector 0.3 - 0.41 -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0
ep_only = true

[AHTeam EP Protector 0.3 - 0.41 -> FEUERRADER]
signature = 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[AHTeam EP Protector v0.3 -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0
ep_only = true

[AINEXE v2.1]
signature = A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9
ep_only = true

[AINEXE v2.30]
signature = 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8
ep_only = true

[Alex Protector 1.0 -> Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00
ep_only = true

[Alex Protector 1.0 beta 2 by Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85
ep_only = true

[Alex Protector 1.0 beta 2 by Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25
ep_only = true

[Alex Protector v0.4 beta 1 by Alex]
signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00
ep_only = true

[Alex Protector v1.0 -> Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B
ep_only = true

[Alias PIX/Vivid IMG Graphics format]
signature = ?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01
ep_only = true

[Alloy 4.x -> PGWare LLC]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85
ep_only = true

[Alloy 4.x -> PGWare LLC]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68
ep_only = true

[Alloy v1.x.2000]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B
ep_only = true

[Alpha BMP graphics file]
signature = FF FF 00 01 64 00 00 00
ep_only = true

[Aluwain v8.09]
signature = 8B EC 1E E8 ?? ?? 9D 5E
ep_only = true

[AMGC Archive]
signature = AD 36 22 00
ep_only = true

[Amiga AIFF 8SFX Audio file]
signature = 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52
ep_only = true

[Amiga IFF/ILBM Graphics format]
signature = 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44
ep_only = true

[ANDpakk2 (apk2) V0.06 -> Dmitry &quot;AND&quot; Andreev&nbsp; &nbsp;* Sign.By.fly * 20080731]
signature = 60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 (apk2) V0.18 -> Dmitry &quot;AND&quot; Andreev&nbsp; &nbsp;* Sign.By.fly * 20080731]
signature = FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 0.06 - by Dmitry "AND" Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 0.06 - by Dmitry "AND" Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74
ep_only = true

[ANDpakk2 0.06 -> Dmitry Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E
ep_only = true

[ANDpakk2 0.18 - by Dmitry "AND" Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[ANDpakk2 0.18 -> Dmitry Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8
ep_only = true

[Anskya Binder v1.1 -> Anskya]
signature = BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true

[Anskya Binder v1.1 -> Anskya]
signature = BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00
ep_only = true

[Anskya NTPacker Generator -> Anskya]
signature = 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54
ep_only = true

[Anskya NTPacker Generator -> Anskya]
signature = 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70
ep_only = true

[Anslym Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3
ep_only = true

[Anslym Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B
ep_only = true

[Anslym FUD Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A
ep_only = true

[Anti007 -> NsPacK Private]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0
ep_only = true

[Anti007 -> NsPacK Private]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Anti007 V1.0-V2.X -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00
ep_only = true

[Anti007 V1.0-V2.X -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74
ep_only = true

[Anti007 V2.5-V2.6 -> LiuXingPing   * Sign.By.fly]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00
ep_only = true

[Anti007 V2.5-V2.6 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53
ep_only = true

[Anti007 V2.7-V3.5 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00
ep_only = true

[Anti007 V2.7-V3.5 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 78 03 79 01 ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04
ep_only = true

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD
ep_only = true

[AntiDote 1.0 Beta -> SIS-Team]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0
ep_only = true

[AntiDote 1.0 beta -> Spy Instructor]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00
ep_only = true

[AntiDote 1.0 beta -> Spy Instructor]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08
ep_only = true

[AntiDote 1.0.Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65
ep_only = true

[AntiDote 1.0.Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52
ep_only = true

[AntiDote 1.2 Beta (Demo) -> SIS-Team]
signature = 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0
ep_only = true

[AntiDote 1.2.Demo -> SIS-Team]
signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B
ep_only = true

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF
ep_only = true

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11
ep_only = true

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B
ep_only = true

[AntiDote 1.2/1.4 SE DLL -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB
ep_only = true

[AntiDote 1.4 SE -> SIS-Team]
signature = 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3
ep_only = true

[AntiDote V1.2 -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00
ep_only = true

[AntiDote V1.2.Demo -> SIS-Team]
signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08
ep_only = true

[AntiDote v1.4 osCE  *Sing by osC++CoDeR]
signature = 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00
ep_only = true

[AntiDote v1.4 osCE *Sing by osC++CoDeR]
signature = 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74
ep_only = true

[AntiDote V1.x -> SIS-Team]
signature = 68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF
ep_only = true

[AntiVirus Vaccine v.1.03]
signature = FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2
ep_only = true

[aPack v0.62]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6
ep_only = true

[aPack v0.82]
signature = 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB
ep_only = true

[aPack v0.98 -m]
signature = 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76
ep_only = true

[aPack v0.98b (com)]
signature = BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4
ep_only = true

[aPack v0.98b (DS & ES not saved)]
signature = 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75
ep_only = true

[APatch GUI v1.1]
signature = 52 31 C0 E8 FF FF FF FF
ep_only = true

[APatch GUI v1.1]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3
ep_only = true

[Apex 3.0 alpha -> 500mhz]
signature = 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3
ep_only = true

[APEX_C (BLT Apex 4.0) -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08
ep_only = true

[App Encryptor -> Silent Team]
signature = 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC
ep_only = true

[App Protector -> Silent Team]
signature = E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF
ep_only = true

[App Protector -> Silent Team]
signature = E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A
ep_only = true

[ARC-SFX Archive]
signature = 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8
ep_only = true

[ARJ Archive]
signature = 60 EA
ep_only = true

[ARJ SFX Custom]
signature = 60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[ARJ SFX Custom]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6
ep_only = true

[ARJ SFX Custom]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A
ep_only = true

[ARJ-SFX Archive]
signature = 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 4A 53 58
ep_only = true

[ARM Protector 0.1 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4
ep_only = true

[Armadillo 3.00a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42
ep_only = true

[Armadillo 3.00a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F
ep_only = true

[Armadillo 3.01 - 3.50a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43
ep_only = true

[Armadillo 3.6x -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76
ep_only = true

[Armadillo 3.7x -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC
ep_only = true

[Armadillo 3.X-5.X -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08
ep_only = true

[Armadillo 3.X-5.X -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33
ep_only = true

[Armadillo 4.00.0053 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1
ep_only = true

[Armadillo 4.10 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5
ep_only = true

[Armadillo 4.20 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5
ep_only = true

[Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24
ep_only = true

[Armadillo 4.30a -> Silicon Realms Toolworks]
signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53
ep_only = true

[Armadillo 4.30a -> Silicon Realms Toolworks]
signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43
ep_only = true

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00
ep_only = true

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8
ep_only = true

[Armadillo 4.40 -> Silicon Realms Toolworks (h)]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =F AL SE
ep_only = true

[Armadillo 4.44a public build -> Silicon Realms Toolworks (h)]
signature = 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF
ep_only = true

[Armadillo 5.0 Dll -> Silicon Realms Toolworks]
signature = 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3
ep_only = true

[Armadillo 5.00 -> Silicon Realms Toolworks]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3
ep_only = true

[Armadillo 5.00 -> Silicon Realms Toolworks]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = true

[Armadillo 5.00 Dll -> Silicon Realms Toolworks]
signature = 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57
ep_only = true

[Armadillo v1.60a]
signature = 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.72 - v1.73]
signature = 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58
ep_only = true

[Armadillo v1.77]
signature = 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.80]
signature = 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.82]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.83]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.84]
signature = 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90a]
signature = 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b1]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b2]
signature = 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b3]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b4]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90c]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.9x]
signature = 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true

[Armadillo v1.xx - v2.xx]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6
ep_only = true

[Armadillo v2.00]
signature = 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.00b2-2.00b3]
signature = 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.01]
signature = 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.10b2]
signature = 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.20]
signature = 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.20b1]
signature = 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.50]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true

[Armadillo v2.50b3]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true

[Armadillo v2.51]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38
ep_only = true

[Armadillo v2.52b2]
signature = 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24
ep_only = true

[Armadillo v2.53]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true

[Armadillo v2.53]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89
ep_only = true

[Armadillo v2.53b3]
signature = 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true

[Armadillo v2.5x - v2.6x]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true

[Armadillo v2.60]
signature = 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84
ep_only = true

[Armadillo v2.60a]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4
ep_only = true

[Armadillo v2.60b1]
signature = 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC
ep_only = true

[Armadillo v2.60b2]
signature = 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C
ep_only = true

[Armadillo v2.60c]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true

[Armadillo v2.61]
signature = 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C
ep_only = true

[Armadillo v2.65b1]
signature = 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true

[Armadillo v2.75a]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

[Armadillo v2.85]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

[Armadillo v2.xx (CopyMem II)]
signature = 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82
ep_only = true

[Armadillo v2.xx (CopyMem II)]
signature = 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3
ep_only = true

[Armadillo v3.00]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9
ep_only = true

[Armadillo v3.00]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB
ep_only = true

[Armadillo v3.00a]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58
ep_only = true

[Armadillo v3.01, v3.05]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B
ep_only = true

[Armadillo v3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05
ep_only = true

[Armadillo v3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC
ep_only = true

[Armadillo v3.xx]
signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB
ep_only = true

[Armadillo v4.00.0053 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89
ep_only = true

[Armadillo v4.10 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89
ep_only = true

[Armadillo v4.20 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89
ep_only = true

[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3
ep_only = true

[Armadillo V5.00-V5.X Dll -> Silicon Realms Toolworks * Sign.By.fly]
signature = 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 E8 ?? ?? ?? ?? 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 ?? ?? ?? ?? 59 89 7D FC FF 75 08 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 ?? ?? ?? ?? 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 ?? ?? ?? ?? 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 ?? ?? ?? ?? 59 C3
ep_only = true

[Armadillo V5.0X -> Silicon Realms Toolworks   * Sign.By.fly]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC ?? 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3
ep_only = true

[Armadillo V5.20 -> Silicon Realms Toolworks   * Sign.By.fly * 20080214]
signature = E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 FE 1A 00 00 59 89 7D FC FF 75 08 E8 56 45 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 96 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 A4 19 00 00 59 C3 3B DF 75 0D 8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3 E8 CC 1D 00 00 C3 55 8B EC 51 83 65 FC 00 57 8D 45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B F8 83 C4 0C 85 FF 75 19 56 8B 75 FC 85 F6 74 10 E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89 30 5E 8B C7 5F C9 C3 6A 0C 68 ?? ?? ?? ?? E8 3B 1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ?? ?? ?? 75 43 6A 04 E8 FF 19 00 00 59 83 65 FC 00 56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56 50 E8 A0 3C 00 00 59 59 C7 45 FC FE FF FF FF E8 0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A 6A 04 E8 ED 18 00 00 59 C3
ep_only = true

[Armadillo V5.20.Beta1 -> Silicon Realms Toolworks   * Sign.By.fly * 20080214]
signature = E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13 00 00 59 89 7D FC FF 75 08 E8 AC 47 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 7C D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 AD 11 00 00 59 C3
ep_only = true

[Armadillo V5.40 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 C1 1B 00 00 59 89 7D FC FF 75 08 E8 B1 46 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 86 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 67 1A 00 00 59 C3
ep_only = true

[ARVID's TDR file]
signature = 74 00 00 00
ep_only = true

[AsCrypt v0.1 -> SToRM]
signature = 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB
ep_only = true

[AsCrypt V0.1 -> SToRM   * Sign.By.fly]
signature = B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true

[AsCrypt v0.1 -> SToRM - #2]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2
ep_only = true

[AsCrypt v0.1 -> SToRM - #3]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2
ep_only = true

[AsCrypt v0.1 -> SToRM - #4]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2
ep_only = true

[ASDPack -> asd   * Sign.By.fly]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90
ep_only = true

[ASDPack 2.0 -> asd]
signature = 5B 43 83 7B 74
ep_only = true

[ASPack 1.02b or 1.08.03]
signature = 60 E8 00 00 00 00 5D 81 ED
ep_only = true

[ASPack 1.05b by]
signature = 75 00 E9
ep_only = true

[ASPAck 1.061b]
signature = 90 90 75 00 E9
ep_only = true

[ASPack 1.08]
signature = 90 90 90 75 01 90 E9
ep_only = true

[ASPack v1.00b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44
ep_only = true

[ASPack v1.00b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF
ep_only = true

[ASPack v1.01b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44
ep_only = true

[ASPack v1.01b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44
ep_only = true

[ASPack v1.02a]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23
ep_only = true

[ASPack v1.02b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43
ep_only = true

[ASPack v1.02b]
signature = 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5
ep_only = true

[ASPack v1.02b]
signature = 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33
ep_only = true

[ASPack v1.03b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43
ep_only = true

[ASPack v1.03b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58
ep_only = true

[ASPack v1.04b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D
ep_only = true

[ASPack v1.04b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE
ep_only = true

[ASPack v1.061b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43
ep_only = true

[ASPack v1.06b]
signature = 90 90 90 75 00 E9
ep_only = true

[ASPack v1.06b]
signature = 90 75 00 E9
ep_only = true

[ASPack v1.06b]
signature = 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true

[ASPack v1.07b]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5
ep_only = true

[ASPack v1.07b]
signature = 90 90 90 75 ?? E9
ep_only = true

[ASPack v1.07b]
signature = 90 90 75 ?? E9
ep_only = true

[ASPack v1.07b]
signature = 90 75 ?? E9
ep_only = true

[ASPack v1.07b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00
ep_only = true

[ASPack v1.08]
signature = 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A
ep_only = true

[ASPack v1.08]
signature = 90 90 90 75 01 FF E9
ep_only = true

[ASPack v1.08]
signature = 90 90 75 01 FF E9
ep_only = true

[ASPack v1.08]
signature = 90 75 01 FF E9
ep_only = true

[ASPack v1.08.01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D
ep_only = true

[ASPack v1.08.01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D
ep_only = true

[ASPack v1.08.01]
signature = 90 90 90 75 ?? 90 E9
ep_only = true

[ASPack v1.08.01]
signature = 90 90 75 ?? 90 E9
ep_only = true

[ASPack v1.08.01]
signature = 90 75 ?? 90 E9
ep_only = true

[ASPack v1.08.01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72
ep_only = true

[ASPack v1.08.02]
signature = 90 90 75 01 90 E9
ep_only = true

[ASPack v1.08.02]
signature = 90 75 01 90 E9
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD
ep_only = true

[ASPack v1.08.03]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD
ep_only = true

[ASPack v1.08.03]
signature = 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6
ep_only = true

[ASPack v1.08.04]
signature = 60 E8 41 06 00 00 EB 41
ep_only = true

[ASPack v1.08.04]
signature = 60 E8 ?? ?? ?? ?? EB
ep_only = true

[ASPack v1.08.x]
signature = 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true

[ASPack v2.000]
signature = 60 E8 70 05 00 00 EB 4C
ep_only = true

[ASPack v2.000]
signature = 60 E8 48 11 00 00 C3 83
ep_only = true

[ASPack v2.001]
signature = 60 E8 72 05 00 00 EB 4C
ep_only = true

[ASPack v2.001]
signature = 60 E8 72 05 00 00 EB 33 87 DB 90 00
ep_only = true

[ASPack v2.1]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB
ep_only = true

[ASPack v2.11]
signature = 60 E9 3D 04 00 00
ep_only = true

[ASPack v2.11]
signature = 60 E8 F9 11 00 00 C3 83
ep_only = true

[ASPack v2.11b]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00
ep_only = true

[ASPack v2.11b]
signature = 60 E8 02 00 00 00 EB 09 5D 55
ep_only = true

[ASPack v2.11c]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00
ep_only = true

[ASPack v2.11d]
signature = 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02
ep_only = true

[ASPack v2.12]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01
ep_only = true

[Aspack v2.12 -> www.aspack.com]
signature = ?? ?8 0? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?3 ?? ?? 0? ?? 0? ?? ?? ?? ?? ?? 0? ?? ?F ?? ?? ?3 0? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?0 0? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8? ?? ?D ?? ?? ?? ?? 5
ep_only = true

[ASPack v2.xx]
signature = A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true

[ASPack v2.xx]
signature = A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95
ep_only = true

[ASPR Stripper v2.x unpacked]
signature = BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC
ep_only = true

[ASPR Stripper v2.x unpacked]
signature = BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8
ep_only = true

[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]
signature = 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect 2.0]
signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect 2.3 SKE build 04.26 Beta]
signature = 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E
ep_only = true

[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = true

[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = true

[ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = true

[ASProtect SKE 2.3 -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C
ep_only = true

[ASProtect v1.0]
signature = 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D
ep_only = true

[ASProtect v1.0]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true

[ASProtect v1.1]
signature = 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE
ep_only = true

[ASProtect v1.1]
signature = 90 60 E8 1B ?? ?? ?? E9 FC
ep_only = true

[ASProtect v1.1 BRS]
signature = 60 E9 ?? 05
ep_only = true

[ASProtect v1.1 MTE]
signature = 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9
ep_only = true

[ASProtect v1.1 MTEb]
signature = 90 60 E9 ?? 04
ep_only = true

[ASProtect v1.1 MTEc]
signature = 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74
ep_only = true

[ASProtect v1.2]
signature = 68 01 ?? ?? ?? C3
ep_only = true

[ASProtect v1.2]
signature = 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect v1.2 -> Alexey Solodovnikov]
signature = 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00
ep_only = true

[ASProtect v1.23 RC1]
signature = 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D
ep_only = true

[ASProtect v1.2x]
signature = 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3
ep_only = true

[ASProtect v1.2x]
signature = 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42
ep_only = true

[ASProtect v2.0]
signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2C
ep_only = true

[ASProtect V2.X DLL -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD
ep_only = true

[ASProtect v?.? -> If you know this version, post on PEiD board]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ASProtect v?.? -> If you know this version, post on PEiD board]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ASProtect vx.x]
signature = 90 60 ?? ?? ?? 00 00
ep_only = true

[ASProtect vx.x]
signature = 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D
ep_only = true

[ASProtect vx.x]
signature = 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00
ep_only = true

[ass - crypter -> by santasdad]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45
ep_only = true

[ass - crypter -> by santasdad]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B
ep_only = true

[ASYLUM Music File v.1.0]
signature = 41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00
ep_only = true

[AT&T Group 4 Graphics format]
signature = 01 00 ?? 00 3A 03
ep_only = true

[Audio-CD file]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74
ep_only = true

[AutoDesk Animation file]
signature = ?? ?? ?? 00 12 AF ?? ?? 40 01 C8
ep_only = true

[AutoLogic Graphics format]
signature = FF 04 00 07
ep_only = true

[AverCryptor 1.0 -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3
ep_only = true

[AverCryptor 1.02 beta -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3
ep_only = true

[AVHRR Graphics format]
signature = D5 C8 00 01 00 03 00 01
ep_only = true

[AVI movie file]
signature = 52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54
ep_only = true

[AVP Antiviral Database]
signature = 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65
ep_only = true

[AVP Inspector Database]
signature = 47 68 6F 73 74 20 42 75 73 74 65 72
ep_only = true

[AVPACK v1.20]
signature = 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB
ep_only = true

[AZProtect]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83
ep_only = true

[AZProtect 0x0001 -> AlexZ aka AZCRC]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00
ep_only = true

[BAFF (BMP's) graphics library]
signature = 42 41 46 46 01 00 00 00
ep_only = true

[bambam 0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0
ep_only = true

[bambam 0.04 -> bedrock]
signature = BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00
ep_only = true

[BamBam v0.01]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5
ep_only = true

[bambam V0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF
ep_only = true

[bambam V0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = true

[bambam V0.04 -> bedrock]
signature = BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3
ep_only = true

[Banner's banner file]
signature = D1 BA 01 00
ep_only = true

[Banner's font file]
signature = AB CD 00
ep_only = true

[BAT2COM v1.5 (c) Douglas Boling, PC Magazine]
signature = EB J3 FC BD ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? B4 4A CD 21 A1 ?? ?? 89
ep_only = true

[BDC HelpSystem Help file]
signature = 42 44 43 20 48 65 6C 70 53 79 73 74 65 6D
ep_only = true

[beria v0.07 public WIP --> symbiont]
signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0
ep_only = true

[beria v0.07 public WIP -> symbiont]
signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7
ep_only = true

[Berio 1.00 beta (h)]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F
ep_only = true

[Berio 2.00 beta (h)]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01
ep_only = true

[BeRo Tiny Pascal -> BeRo]
signature = E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20
ep_only = true

[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2
ep_only = true

[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true

[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true

[BeRoEXEPacker v1.00 (LZMA)]
signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true

[BeRoEXEPacker V1.00 -> BeRo]
signature = BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3
ep_only = true

[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]
signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2
ep_only = true

[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8
ep_only = true

[BeRoEXEPacker v1.00 DLL [LZBRS]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 DLL [LZBRS]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 [LZBRR]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true

[BeRoEXEPacker v1.00 [LZBRS]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 [LZBRS]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BGI Device Driver]
signature = 70 6B 08 08 42 47 49 20
ep_only = true

[BGI Stroked Font v.1.1]
signature = 50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31
ep_only = true

[BIN-Lock (tm) 1994]
signature = EB J3 31 C0 8E C0 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? CC CD 01 EB
ep_only = true

[Bitlock 3.1]
signature = EB J3 B4 30 CD 21 3C 03 72
ep_only = true

[BlackEnergy DDoS Bot Crypter]
signature = 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F
ep_only = true

[Blade Joiner v1.5]
signature = 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85
ep_only = true

[BlindSpot 1.0 -> s134k]
signature = 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50
ep_only = true

[BlindSpot 1.0 -> s134k]
signature = 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15
ep_only = true

[BobPack v1.00 --> BoB / BobSoft]
signature = 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8
ep_only = true

[BookManager v9510]
signature = FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50
ep_only = true

[BopCrypt v1.0]
signature = 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true

[Borland C / Borland Builder]
signature = 3B CF 76 05 2B CF FC F3 AA 59
ep_only = true

[Borland C++]
signature = A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F
ep_only = true

[Borland C++]
signature = EB J3 53 51 06 33 C0 50 9A ?? ?? ?? ?? 58 07 59 5B 9A
ep_only = true

[Borland C++]
signature = A1 ?? ?? ?? ?? C1 E0 02 A3
ep_only = true

[Borland C++ 1991]
signature = 2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F
ep_only = true

[Borland C++ 1992, 1994]
signature = 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06
ep_only = true

[Borland C++ 1994]
signature = 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9
ep_only = true

[Borland C++ DLL]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 80 ?? ?? ?? ?? ?? ?? 74
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90
ep_only = true

[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52
ep_only = true

[Borland C++ for Win16 1991]
signature = 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00
ep_only = true

[Borland C++ for Win32 1994]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF
ep_only = true

[Borland C++ for Win32 1994]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74
ep_only = true

[Borland C++ for Win32 1995]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76
ep_only = true

[Borland C++ for Win32 1999]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2
ep_only = true

[Borland Delphi]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D
ep_only = true

[Borland Delphi]
signature = 55 8B EC 83 C4 F4
ep_only = true

[Borland Delphi]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40
ep_only = true

[Borland Delphi (Component)]
signature = C3 E9 ?? ?? ?? FF 8D 40
ep_only = true

[Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00
ep_only = true

[Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00
ep_only = true

[Borland Delphi 3.0 (???)]
signature = 55 8B EC 83
ep_only = true

[Borland Delphi 4.0]
signature = 55 8B EC 83 C4
ep_only = true

[Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00
ep_only = true

[Borland Delphi DLL]
signature = 55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40
ep_only = true

[Borland Delphi DLL]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20
ep_only = true

[Borland Delphi Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8
ep_only = true

[Borland Delphi Setup Module]
signature = 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45
ep_only = true

[Borland Delphi v2.0]
signature = E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3
ep_only = true

[Borland Delphi v2.0]
signature = 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9
ep_only = true

[Borland Delphi v3.0]
signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0
ep_only = true

[Borland Delphi v3.0]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v3.0]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Borland Delphi v3.0]
signature = 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68
ep_only = true

[Borland Delphi v4.0 - v5.0]
signature = 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3
ep_only = true

[Borland Delphi v4.0 - v5.0]
signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3
ep_only = true

[Borland Delphi v5.0 KOL]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Borland Delphi v5.0 KOL]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[Borland Delphi v5.0 KOL]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = true

[Borland Delphi v5.0 KOL/MCK]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v5.0 KOL/MCK]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 83 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v6.0]
signature = 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8
ep_only = true

[Borland Delphi v6.0]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = 55 8B EC 83 C4 F0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = 53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8
ep_only = true

[Borland Delphi v6.0 - v7.0]
signature = BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2
ep_only = true

[Borland Delphi v6.0 KOL]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00
ep_only = true

[Borland Delphi vx.x (Component)]
signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF
ep_only = true

[Borland Graphics Interface Driver]
signature = 46 42 47 44
ep_only = true

[Borland Pascal 7.0 for Windows]
signature = 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00
ep_only = true

[Borland Pascal v7.0]
signature = B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75
ep_only = true

[Borland Pascal v7.0]
signature = B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E
ep_only = true

[Borland precompiled header file]
signature = 54 50 53
ep_only = true

[by Central Point Software]
signature = 50 51 52 56 57 8B EB 1E 2E
ep_only = true

[C, C++ Library file]
signature = F0 0D 00 00
ep_only = true

[C-Crypt v1.02]
signature = E9 J1 J1 E8 ?? ?? 5D 83 ?? ?? 55 D9 D0 9C 58 25 ?? ?? 50 9D 50 57 BF ?? ?? B0 ?? AA 5F 58 66 51
ep_only = true

[C.I Crypt V0.2 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[C.I Crypt V0.2 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = true

[CA Visual Objects 2.0 - 2.5]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74
ep_only = true

[CA Visual Objects 2.0 - 2.5]
signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB
ep_only = true

[CA Visual Objects 2.0 - 2.5]
signature = 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3
ep_only = true

[CalComp Graphics format]
signature = 02 50 0A
ep_only = true

[CALS Raster graphics format]
signature = 73 72 63 64 6F 63 69 64 3A 20
ep_only = true

[CAN (Crunched ANsi) file]
signature = CA 01
ep_only = true

[CAN2EXE v0.01]
signature = 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9
ep_only = true

[Can2Exe v0.01]
signature = 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73
ep_only = true

[CauseWay DOS Extender v2.64, v3.25 1992-95]
signature = EB J3 8B E8 8C C6 0E 1F 8C C0 05 ?? ?? 01 ?? ?? ?? B8 ?? ?? CD 21 3C ?? 73
ep_only = true

[CauseWay DOS Extender v3.25]
signature = FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07
ep_only = true

[CC v2.61 Beta]
signature = BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true

[CC286x v2.1]
signature = E9 J1 J1 EB ?? 9A ?? ?? ?? ?? 81 ?? ?? ?? EB ?? 66 ?? ?? ?? ?? ?? EA ?? ?? ?? ?? FF E6
ep_only = true

[CDS SS 1.0 beta1 -> CyberDoom]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50
ep_only = true

[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8
ep_only = true

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3
ep_only = true

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 0
ep_only = true

[CERBERUS v2.0]
signature = 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5
ep_only = true

[CExe v1.0a]
signature = 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16
ep_only = true

[CGM Graphics format]
signature = 00 2A 08 48 69 4A 61 61 6B 20 32
ep_only = true

[ChinaProtect -> dummy]
signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3
ep_only = true

[ChSfx (small) v1.1]
signature = BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89
ep_only = true

[CICompress v1.0]
signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08
ep_only = true

[CICompress v1.0]
signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35
ep_only = true

[CICompress v1.0]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74
ep_only = true

[Ciphator v4.6]
signature = 93 93 E8 J1 J1 58 6A 00 0E 68 ?? ?? CF EB
ep_only = true

[CipherWall Self-Extrator/Decryptor (Console) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4
ep_only = true

[CipherWall Self-Extrator/Decryptor (Console) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[CipherWall Self-Extrator/Decryptor (GUI) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4
ep_only = true

[CipherWall Self-Extrator/Decryptor (GUI) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[Code-Lock vx.x]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00
ep_only = true

[Code-Lock vx.x]
signature = 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9
ep_only = true

[Code-Lock vx.x]
signature = 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A
ep_only = true

[CodeCrypt v0.14b]
signature = E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.15b]
signature = E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.15b]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34
ep_only = true

[CodeCrypt v0.164]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.16b - v0.163b]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00
ep_only = true

[codeCrypter 0.31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[codeCrypter 0.31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3
ep_only = true

[CodeSafe v2.0]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?8 3E C1 05 35 65 7E 8C 40 10 0
ep_only = true

[CodeSafe v2.0]
signature = 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10
ep_only = true

[COM-Crypt II / 386 by ROSE]
signature = E9 J1 J1 BF ?? ?? 57 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 47 47 E2 ?? 33 FF C3
ep_only = true

[COM2EXE]
signature = E9 J1 J1 8C CA 81 C2 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true

[COM2EXE]
signature = EB J3 5B 0E 1F 81
ep_only = true

[COM2EXE]
signature = F0 FF FE FF
ep_only = true

[Com4mail v1.0]
signature = 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A
ep_only = true

[ComCrypt]
signature = E9 J1 J1 B9 ?? ?? BE ?? ?? 89 F7 0E 1F 0E 07 BB ?? ?? FC AD 31 D8 AB E2 ?? C6
ep_only = true

[ComCryptor BTS v9.12]
signature = E9 J1 J1 B7 ?? E8 ?? ?? 83 ?? ?? EB ?? 5D 55 C3 BF ?? ?? 03 FD 8B F7 B9
ep_only = true

[COMLOCK v0.10 (c) 1994]
signature = E9 J1 J1 EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BB ?? ?? BE ?? ?? 81 ?? ?? ?? 03 F3 BF ?? ?? B9 ?? ?? F3 A4 2E ?? ?? ?? ?? BE ?? ?? 8B CB 2E ?? ?? 46 FE C0 E2
ep_only = true

[COMPACK v4.5 (2)]
signature = BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE
ep_only = true

[COMPACK v5.1]
signature = BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16
ep_only = true

[Compiled InstallSHIELD Installation Script]
signature = B8 C9 0C 00
ep_only = true

[Comprot v1.0b]
signature = E9 J1 J1 E8 ?? ?? 5E 8B EE 81 ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? F6 14 46 E2 ?? 4B
ep_only = true

[ComProtector v1.0]
signature = E9 J1 J1 B9 ?? ?? BB ?? ?? BF ?? ?? 2E ?? ?? 34 ?? FE C8 C0 ?? ?? 2E ?? ?? 2E ?? ?? 2E ?? ?? 47 43 E2
ep_only = true

[COOLcryptor 0.9 -> kongfoo]
signature = E8 03 00 00 00 E9 EB 07 FF 04 24 EB 01 FF C3 E8 03 00 00 00 EB 02 EA C3 EB 08 8D 8D 72 08
ep_only = true

[COP v1.0 (c) 1988]
signature = BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90
ep_only = true

[Copy Protector v2.0]
signature = 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F
ep_only = true

[Copy Protector v2.0]
signature = E9 J1 J1 50 53 51 52 1E 06 57 E8 ?? ?? 5F 83 EF ?? B4 ?? 1E 0E 1F
ep_only = true

[CopyControl v3.03]
signature = CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C
ep_only = true

[CopyControl v3.03]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9
ep_only = true

[CopyMinder -> Microcosm.Ltd]
signature = 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25
ep_only = true

[CorelDraw 8 CDR Graphics format]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 52 38
ep_only = true

[CorelDraw 8 CDR Graphics format]
signature = 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25
ep_only = true

[CorelDraw CMX Graphics format]
signature = 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31
ep_only = true

[CorelPhotoPaint Image]
signature = 43 50 54 37 46 49 4C 45
ep_only = true

[CPAV]
signature = E8 ?? ?? 4D 5A B1 01 93 01 00 00 02
ep_only = true

[Cracked by AutoHack (1)]
signature = FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC
ep_only = true

[Cracked by Autohack (2)]
signature = 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9
ep_only = true

[CrackStop v1.01 (c) Stefan Esser 1997]
signature = B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC
ep_only = true

[cramble v0.2b3]
signature = E9 J1 J1 60 9C FC ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? 01 2A ?? FF
ep_only = true

[CRC2COM v1.24 (packed)]
signature = EB J3 8B FC 83 EF ?? 83 EC ?? BE ?? ?? B9 ?? ?? 57 F3 A4 5F FF E7
ep_only = true

[CRC2COM v1.24 (unpacked)]
signature = EB J3 C8 ?? ?? ?? E8 ?? ?? 0E 07 C6 ?? ?? ?? E8 ?? ?? E8
ep_only = true

[CreateInstall Stub vx.x]
signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00
ep_only = true

[CreateInstall Stub vx.x]
signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56
ep_only = true

[Creative Audio file]
signature = 43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65
ep_only = true

[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9
ep_only = true

[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF
ep_only = true

[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 00 00 42 00 31 DB 43 EB 58
ep_only = true

[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44
ep_only = true

[Crunch 4]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8
ep_only = true

[Crunch 4 -> Bit-Arts]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00
ep_only = true

[Crunch 5 -> Bit-Arts]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = true

[Crunch 5 / Fusion 4 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00
ep_only = true

[Crunch 5 Fusion 4]
signature = EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8
ep_only = true

[Crunch v4.0]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0
ep_only = true

[Crunch v5 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1
ep_only = true

[Crunch V5.0 -> Bitarts]
signature = EB 15 03 00 00 00 06
ep_only = true

[Crunch V5.0 -> Bitarts]
signature = 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[Crunch/PE]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85
ep_only = true

[Crunch/PE]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74
ep_only = true

[Crunch/PE]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5
ep_only = true

[Crunch/PE v1.0.x.x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85
ep_only = true

[Crunch/PE v1.0.x.x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26
ep_only = true

[Crunch/PE v3.0.x.x]
signature = 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01
ep_only = true

[Crunch/PE v5.0]
signature = EB 15 03 ?? ?? ?? 06
ep_only = true

[Cruncher v1.0]
signature = 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB
ep_only = true

[CryExe v4.0]
signature = E9 J1 J1 E9 ?? ?? 31 ED EB ?? F5
ep_only = true

[CRYPACK v3.0]
signature = EB J3 06 1E 8C D8 05 ?? ?? 8E D8 33 DB 0E 07 33 FF BE ?? ?? 8A 07 26 ?? ?? 32 C4 88 07 47 3B FE
ep_only = true

[CrypKey -> Kenonic Controls (h)]
signature = 8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8
ep_only = true

[CrypKey v5 - v6]
signature = E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06
ep_only = true

[CrypKey v5 - v6]
signature = E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50
ep_only = true

[CrypKey V5.6.X -> Kenonic Controls Ltd.]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8
ep_only = true

[CrypKey V5.6.X -> Kenonic Controls Ltd.]
signature = E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1
ep_only = true

[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]
signature = 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8
ep_only = true

[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]
signature = 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA
ep_only = true

[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]
signature = 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8
ep_only = true

[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]
signature = 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = true

[CRYPT Version 1.7 (c) Dismember]
signature = 0E 17 9C 58 F6 ?? ?? 74 ?? E9
ep_only = true

[CRYPT Version 1.7 (c) Dismember (COM)]
signature = 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60
ep_only = true

[CRYPTCOM]
signature = BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3
ep_only = true

[CRYPTCOM]
signature = E9 J1 J1 BE 00 01 56 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 46 46 E2 ?? 31 F6 31 C9 C3
ep_only = true

[CRYPTEXE v1.04 (c) DOP]
signature = EB J3 8B DC EB ?? EA ?? ?? ?? ?? 01 EA 83 FC ?? 74 ?? EB
ep_only = true

[CrypteXeC v1.01]
signature = FD 25 ?? ?? E8 J1 J1 3E BA ?? ?? EC 0C ?? 26 EE ?? B9 ?? ?? 51 51 ?? 87 C9
ep_only = true

[Cryptic 2.0 -> Tughack]
signature = B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3
ep_only = true

[Crypto-Lock V2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[Crypto-Lock V2.02 (Eng) -> Ryan Thian]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[CRYPToCRACK's PE Protector V0.9.2 -> Lukas Fleischer]
signature = E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26
ep_only = true

[CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74
ep_only = true

[CrypWrap vx.x]
signature = E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E
ep_only = true

[CSV v.01]
signature = E9 J1 J1 FC BE ?? ?? 8B FE B9 ?? ?? 51 56 57 B4 ?? 04 ?? AC ?? ?? 2A C4 32 C4 AA E2 ?? 5F 5E 59
ep_only = true

[CubiComp PictureMaker graphics format (blue)]
signature = 36 0C FF 02 00 00 00 00
ep_only = true

[CubiComp PictureMaker graphics format (green)]
signature = 26 0C FF 02 00 00 00 00
ep_only = true

[CubiComp PictureMaker graphics format (red)]
signature = 16 0C FF 02 00 00 00 00
ep_only = true

[Cygwin32]
signature = 55 89 E5 83 EC 04 83 3D
ep_only = true

[Cygwin32]
signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00
ep_only = true

[D1S1G --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 4
ep_only = true

[DAEMON Protect v0.6.7]
signature = 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61
ep_only = true

[DalKrypt 1.0 - by DalKiT]
signature = 68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7
ep_only = true

[Datafile from Norton Utilities]
signature = 50 4E 43 49
ep_only = true

[DBPE v1.53]
signature = 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA
ep_only = true

[DBPE v1.53]
signature = 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0
ep_only = true

[DBPE v2.10]
signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? 53 6C 65 65 70 ?? 47 65 74 54 69 63 6B 43 6F 75 6E 74
ep_only = true

[DBPE v2.10]
signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C
ep_only = true

[DBPE v2.10]
signature = 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE
ep_only = true

[DBPE v2.10]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83
ep_only = true

[DBPE v2.10]
signature = 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08
ep_only = true

[DBPE v2.33]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71
ep_only = true

[DBPE v2.33]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED
ep_only = true

[DBPE vx.xx]
signature = 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[DCREXE v2.0]
signature = E8 J4 J4 53 E8 ?? ?? 92 5B 83 ?? ?? FF E3 ?? FA 83 ?? ?? FB 5B 52 BA ?? ?? 5A EB
ep_only = true

[DCrypt Private 0.9b -> drmist]
signature = B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3
ep_only = true

[deep-CRyPTer v0.1c]
signature = ?? E9 J1 J1 E8 ?? ?? 59 8B E9 81 ?? ?? ?? 81 ?? ?? ?? BE ?? ?? 8D ?? ?? ?? 66 ?? ?? 66 ?? ?? 8D ?? ?? ?? 8B D7 8B DF
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF v1.0]
signature = BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46
ep_only = true

[DEF v1.00 (Eng) -> bart/xt]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF v1.00 (Eng) -> bart/xt]
signature = 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8
ep_only = true

[Delphi v1.0 Unit]
signature = 44 43 55 31
ep_only = true

[Delphi v2.0 Unit]
signature = 44 43 55 32
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00
ep_only = true

[Dev-C++ v4]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF
ep_only = true

[Dev-C++ v5]
signature = 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[DIET v1.00, v1.00d]
signature = BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true

[DIET v1.00d]
signature = FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[DIET v1.02b, v1.10a, v1.20]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC
ep_only = true

[DIET v1.44, v1.45f]
signature = F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52
ep_only = true

[DIET v1.44, v1.45f]
signature = F9 9C EB
ep_only = true

[Ding Boy's PE-lock Phantasm v0.8]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00
ep_only = true

[Ding Boy's PE-lock Phantasm v1.0 / v1.1]
signature = 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC
ep_only = true

[Ding Boy's PE-lock v0.07]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00
ep_only = true

[diPacker 1.x -> diProtector Software]
signature = 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5
ep_only = true

[diProtector 1.x -> diProtector Software]
signature = 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5
ep_only = true

[DiskDupe (c) MSD Configuration file]
signature = 4D 53 44 20 44 61 74 61 20 56 65 72 73
ep_only = true

[DiskDupe (c) MSD Users file]
signature = 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (xor encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (xor encryption) -> drmist]
signature = C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40
ep_only = true

[DOS Device Driver]
signature = FF FF FF FF
ep_only = true

[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]
signature = BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7
ep_only = true

[DOS32 v.3.3 DOS-Extender and Loader]
signature = 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21
ep_only = true

[DotFix Nice Protect 2.1 -> GPcH Soft]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3
ep_only = true

[DotFix Nice Protect 2.1 -> GPcH Soft]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5
ep_only = true

[DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true

[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]
signature = B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04
ep_only = true

[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]
signature = 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85
ep_only = true

[DragonArmor -> Orient]
signature = BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1
ep_only = true

[DragonArmor -> Orient]
signature = BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3
ep_only = true

[DrHalo or DrGenius Image Graphics format]
signature = ?? ?? 3A 03 00 00
ep_only = true

[DrHalo or DrGenius Palette Graphics format]
signature = 41 48 E3 00 00 00 0A 00
ep_only = true

[Dropper Creator V0.1 -> Conflict]
signature = 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09
ep_only = true

[DrWeb v4.00+ Virus DataBase]
signature = 49 44 52 57
ep_only = true

[DSHIELD]
signature = 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E
ep_only = true

[Dual's Cryptor -> dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E
ep_only = true

[Dual's eXe 1.0]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF
ep_only = true

[Dual's eXe 1.0]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00
ep_only = true

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50
ep_only = true

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7
ep_only = true

[dUP 2.x Patcher --> www.diablo2oo2.cjb.net]
signature = 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9
ep_only = true

[dUP v2.x Patcher --> www.diablo2oo2.cjb.net]
signature = 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F
ep_only = true

[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68
ep_only = true

[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75
ep_only = true

[DWC Archive]
signature = 44 57 43
ep_only = true

[DxPack 1.0]
signature = 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84
ep_only = true

[DxPack 1.0]
signature = 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45
ep_only = true

[DxPack V0.86 -> Dxd]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00
ep_only = true

[DxPack V0.86 -> Dxd]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF
ep_only = true

[DZA Patcher v1.3 -> DZA]
signature = EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00
ep_only = true

[DZA Patcher v1.3 ->DZA]
signature = EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B
ep_only = true

[DzA Patcher v1.3 Loader]
signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78
ep_only = true

[E language]
signature = E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF
ep_only = true

[E language]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00
ep_only = true

[E.S.O. Eclipse Operating System v.2.08 + DOS Extender]
signature = 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9
ep_only = true

[E.You.Di.Dai-> YueHeiFengGao]
signature = 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0
ep_only = true

[E2C by DoP]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3
ep_only = true

[EEXE Version 1.12]
signature = B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21
ep_only = true

[Embed PE v1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68
ep_only = true

[Embed PE v1.13 -> cyclotron]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33
ep_only = true

[EmbedPE V1.00-V1.24 -> cyclotron]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00
ep_only = true

[EmbedPE v1.24 -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00
ep_only = true

[EmbedPE v1.24 -> cyclotron]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E
ep_only = true

[EmbedPE v1.24 -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true

[Encapsulated Postscript graphics file v2.0 EPSF-1.2]
signature = 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32
ep_only = true

[Encapsulated Postscript graphics file v3.0 EPSF-3.0]
signature = 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30
ep_only = true

[Encriptor v1.00c]
signature = EB J3 B9 ?? ?? BE ?? ?? BF ?? ?? AC D0 C8 AA E2 ?? BE ?? ?? BF ?? ?? AC AA
ep_only = true

[ENcryptCOM v3.06 (???)]
signature = E9 J1 J1 B4 30 CD 21 3C 02 77 01 C3
ep_only = true

[Encrypted by: RSCC/286 v1.01]
signature = FE 52 53 43 43 2F 31 2E 30 31 FE
ep_only = true

[Encrypted by: RSCC/286 v1.02]
signature = FE 52 53 43 43 2F 31 2E 30 32 FE
ep_only = true

[EncryptPE 1.2003.3.18-1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE 1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79
ep_only = true

[EncryptPE 1.2003.5.18 -> WFS]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00
ep_only = true

[EncryptPE 2.2004.6.16-2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A
ep_only = true

[EncryptPE 2.2006.7.10-2.2006.10.25 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS   * Sign.By.fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2006.1.15 -> WFS]
signature = 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35
ep_only = true

[EncryptPE V2.2006.1.15 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2006.7.10 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00
ep_only = true

[EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00
ep_only = true

[EncryptPE V2.2007.04.11 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[Enigma Protector 1.0X -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01
ep_only = true

[Enigma protector 1.10 (unregistered)]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Enigma protector 1.10/1.11 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A
ep_only = true

[Enigma Protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04
ep_only = true

[Enigma Protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB
ep_only = true

[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]
signature = 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9
ep_only = true

[Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00
ep_only = true

[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]
signature = 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00
ep_only = true

[ENIGMA Protector V1.0-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81
ep_only = true

[Enigma protector v1.02 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E BE 01 00 00 00 C1 E6 02 83 EC 04 87 DE 89 1C 24
ep_only = true

[ENIGMA Protector V1.1 -> Sukhov Vladimir]
signature = 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61
ep_only = true

[ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81
ep_only = true

[ENIGMA Protector V1.1-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC
ep_only = true

[ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81
ep_only = true

[ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2
ep_only = true

[ENIGMA Protector V1.12-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = true

[EP v1.0]
signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA
ep_only = true

[EP v1.0]
signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1
ep_only = true

[EP v1.0]
signature = 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB
ep_only = true

[EP v2.0]
signature = 6A ?? 60 E9 01 01
ep_only = true

[EPW v1.2]
signature = 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E
ep_only = true

[EPW v1.30]
signature = 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E
ep_only = true

[Erdas LAN/GIS Image graphics format]
signature = 48 45 41 44 37 34 00 00 03 00
ep_only = true

[Escargot 0.1 (final) -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50
ep_only = true

[Escargot 0.1 - by ueMeat]
signature = EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50
ep_only = true

[Escargot V0.1 -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61
ep_only = true

[Escargot V0.1 -> ++Meat]
signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00
ep_only = true

[Exact Audio Copy]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00
ep_only = true

[Exact Audio Copy]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Exact Audio Copy]
signature = EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B
ep_only = true

[Exact Audio Copy]
signature = E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21
ep_only = true

[Exact Audio Copy -> (UnknownCompiler)]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Excalibur 1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00
ep_only = true

[Excalibur 1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08
ep_only = true

[Excalibur V1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39
ep_only = true

[eXcalibur v1.03 -> forgot/us]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
ep_only = true

[eXcalibur v1.03 -> forgot/us (h)]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com (h)]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0
ep_only = true

[EXE joiner -> Amok]
signature = A1 14 A1 40 00 C1 E0 02 A3 18 A1 40
ep_only = true

[Exe Locker 1.0 -> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00
ep_only = true

[Exe Locker 1.0 -> IonIce]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D
ep_only = true

[Exe Locker v1.0 --> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00
ep_only = true

[EXE Manager Version 3.0 1994 (c) Solar Designer]
signature = B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2
ep_only = true

[EXE Packer v7.0 by TurboPower Software]
signature = 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE
ep_only = true

[EXE Packer v7.0 by TurboPower Software]
signature = EB J3 1E 06 8C C3 83 ?? ?? 0E 1F 01 ?? ?? ?? 01 ?? ?? ?? BE ?? ?? B9 ?? ?? FC AD 3B C1 74
ep_only = true

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05
ep_only = true

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0
ep_only = true

[EXE Shield V0.1b-V0.8 -> SMoKE]
signature = E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 40 50 C3
ep_only = true

[EXE Shield V0.5 -> Smoke]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90
ep_only = true

[EXE Shield V0.6 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90
ep_only = true

[EXE Shield V0.6 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = true

[Exe Shield v1.7]
signature = EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90
ep_only = true

[Exe Shield v1.7]
signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95
ep_only = true

[Exe Shield v2.7]
signature = EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00
ep_only = true

[Exe Shield v2.7]
signature = EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85
ep_only = true

[Exe Shield v2.7b]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3
ep_only = true

[Exe Shield v2.9]
signature = 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8
ep_only = true

[Exe Shield vx.x]
signature = 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00
ep_only = true

[Exe Shield vx.x]
signature = 53 E8 00 00 00 00 5B 8B C3 2D
ep_only = true

[EXE Stealth 2.73]
signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC
ep_only = true

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC
ep_only = true

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72
ep_only = true

[EXE Stealth v1.1]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.5]
signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20
ep_only = true

[EXE Stealth v2.7]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40
ep_only = true

[EXE Stealth v2.73]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 77 0C 00 00 90 8D BD 61 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.74]
signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 91 0C 00 00 90 8D BD 38 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[EXE Stealth v2.74 -> WebToolMaster]
signature = 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A
ep_only = true

[EXE2COM (Encrupted)]
signature = E9 J1 J1 B9 ?? ?? BE ?? ?? 8B FE 51 56 B4 ?? AC 32 C4 C0 ?? ?? 02 E1 AA E2 ?? BF ?? ?? 5E 59 F3 A4 BE ?? ?? 56 C3
ep_only = true

[EXE2COM (Encrypted without selfcheck)]
signature = B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6
ep_only = true

[EXE2COM (Extra Encruption)]
signature = E9 J1 J1 E8 ?? ?? 5D B2 ?? 8B CD 83 ED ?? BF ?? ?? BE ?? ?? 2B CF AC 32 C2 42 AA E2 ?? B9 ?? ?? BE ?? ?? 03 F5
ep_only = true

[EXE2COM (Limited)]
signature = BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true

[EXE2COM (Method 1)]
signature = 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3
ep_only = true

[EXE2COM (Method 2)]
signature = E9 J1 J1 E8 ?? ?? 5B 50 8C C0 05 ?? ?? 8B ?? ?? ?? 03 C8 89 ?? ?? 8B ?? ?? ?? 03 C8 89
ep_only = true

[EXE2COM (Method 3)]
signature = E9 J1 J1 8C DA 83 ?? ?? 8E DA 4A E8 ?? ?? 81 C3 ?? ?? A1 ?? ?? 2E ?? ?? A1 ?? ?? 03 C2
ep_only = true

[EXE2COM (Method 4)]
signature = E9 J1 J1 E8 ?? ?? 5D 8B CD 83 ?? ?? BF ?? ?? BE ?? ?? 2B CF F3 A4 B9 ?? ?? BE
ep_only = true

[EXE2COM (Packed)]
signature = BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB
ep_only = true

[EXE2COM (regular)]
signature = E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D
ep_only = true

[EXE2COM (With CRC check)]
signature = B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3
ep_only = true

[EXE32Pack v1.36]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40
ep_only = true

[EXE32Pack v1.36]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40
ep_only = true

[EXE32Pack v1.37]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40
ep_only = true

[EXE32Pack v1.38]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40
ep_only = true

[EXE32Pack v1.39]
signature = 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81
ep_only = true

[EXE32Pack v1.3x]
signature = 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED
ep_only = true

[EXE32Pack v1.3x]
signature = 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73
ep_only = true

[ExeBundle v3.0 (small loader)]
signature = 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
ep_only = true

[ExeBundle v3.0 (standard loader)]
signature = 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB
ep_only = true

[ExeCode v1.0]
signature = E9 J1 J1 FA 8C C3 02 DF 50 33 C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8E D0 BC ?? ?? BE ?? ?? B9 ?? ?? 33 FF 2E ?? ?? ?? ?? ?? ?? 32 DB B0 ?? E6 64 AC
ep_only = true

[EXECrypt 1.0 -> ReBirth]
signature = 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC
ep_only = true

[EXECryptor 2.0/2.1 -> www.strongbit.com]
signature = 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF
ep_only = true

[EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar]
signature = A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75
ep_only = true

[EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)]
signature = 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F
ep_only = true

[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development]
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]
signature = 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3
ep_only = true

[EXECryptor 2.2.6 (minimum protection)]
signature = 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB
ep_only = true

[EXECryptor 2.2.6 DLL (minimum protection)]
signature = 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9
ep_only = true

[EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com]
signature = 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0
ep_only = true

[EXECryptor 2.2.x -> SoftComplete Developement]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF
ep_only = true

[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3
ep_only = true

[EXECryptor 2.3.9 (compressed resources)]
signature = 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5
ep_only = true

[EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com]
signature = CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75
ep_only = true

[EXECryptor 2.3.9 (minimum protection)]
signature = 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0
ep_only = true

[EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com]
signature = 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00
ep_only = true

[EXECryptor 2.3.9 DLL (compressed resources)]
signature = 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10
ep_only = true

[EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com]
signature = 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0
ep_only = true

[EXECryptor 2.3.9 DLL (minimum protection)]
signature = 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87
ep_only = true

[EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com]
signature = 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9
ep_only = true

[EXECryptor 2.x -> SoftComplete Developement]
signature = A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF
ep_only = true

[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar]
signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1
ep_only = true

[EXECryptor v1.3.0.45]
signature = 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1
ep_only = true

[EXECryptor v1.3.0.45]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3
ep_only = true

[EXECryptor v1.4.0.1]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80
ep_only = true

[EXECryptor v1.5.1.x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[EXECryptor v1.5.1.x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41
ep_only = true

[EXECryptor v1.5.3]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[EXECryptor V2.1X -> softcomplete.com]
signature = E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1
ep_only = true

[EXECryptor V2.1X -> SoftComplete.com]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32
ep_only = true

[EXECryptor V2.2X -> softcomplete.com]
signature = FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00
ep_only = true

[EXECryptor V2.2X-V2.4X -> StrongBit Technology * Sign.By.fly]
signature = E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3
ep_only = true

[EXEGUARD v1.3]
signature = BA ?? ?? BF ?? ?? EB J3 E8 ?? ?? 7C ?? 79 ?? FA EA ?? ?? ?? ?? 76 ?? D8 FD
ep_only = true

[ExeJoiner 1.0 -> Yoda]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50
ep_only = true

[EXELOCK 666 1.5]
signature = BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9
ep_only = true

[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB
ep_only = true

[EXEPACK v4.05, v4.06]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4
ep_only = true

[EXEPACK v5.31.009 (LINK v3.69)]
signature = 8B E8 8C C0
ep_only = true

[EXERefactor V0.1 -> random]
signature = 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E
ep_only = true

[ExeSafeguard v1.0 -> simonzh]
signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF
ep_only = true

[ExeShield 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8
ep_only = true

[ExeShield 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F
ep_only = true

[ExeShield Cryptor 1.3RC -> Tom Commander]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[ExeShield Protector 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC
ep_only = true

[ExeShield Protector V3.6 -> www.exeshield.com]
signature = 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB
ep_only = true

[ExeSplitter 1.0 -> Bill Prisoner / TPOC]
signature = E9 ?? ?? ?? 00 4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ExeSplitter 1.0 -> Bill Prisoner / TPOC]
signature = E9 ?? ?? ?? 00 4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 .. .
ep_only = true

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3
ep_only = true

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 0
ep_only = true

[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66
ep_only = true

[ExeStealth -> WebToolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F
ep_only = true

[EXEStealth 2.75 -> WebtoolMaster]
signature = 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21
ep_only = true

[EXEStealth 2.76 Unregistered -> WebtoolMaster]
signature = EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20
ep_only = true

[EXEStealth v2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5
ep_only = true

[ExeTools COM2EXE]
signature = E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60
ep_only = true

[ExeTools v2.1 Encruptor by DISMEMBER]
signature = E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74
ep_only = true

[eXPressor 1.0 beta -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70
ep_only = true

[eXPressor 1.0 beta -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[eXPressor 1.1 -> CGSoftLabs]
signature = E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00
ep_only = true

[eXPressor 1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true

[eXPressor 1.2.0 Beta PE Packer]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true

[eXPressor 1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E
ep_only = true

[eXPressor 1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02
ep_only = true

[eXPressor 1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14
ep_only = true

[eXPressor V1.0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00
ep_only = true

[eXpressor v1.0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13
ep_only = true

[eXpressor v1.1 -> CGSoftLabs]
signature = E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00
ep_only = true

[eXpressor v1.1 -> CGSoftLabs]
signature = E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35
ep_only = true

[eXpressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76
ep_only = true

[eXpressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15
ep_only = true

[eXPressor v1.2.0b]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C
ep_only = true

[eXPressor V1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45
ep_only = true

[eXPressor v1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05
ep_only = true

[eXPressor V1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 B0 06
ep_only = true

[eXPressor v1.4 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8
ep_only = true

[eXPressor v1.4 -> CGSoftLabs]
signature = 65 58 50 72 2D 76 2E 31 2E 34 2E
ep_only = true

[eXpressor v1.4.5 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C
ep_only = true

[eXpressor v1.4.5 -> CGSoftLabs]
signature = 55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B
ep_only = true

[eXPressor V1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C
ep_only = true

[eXPressor v1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC
ep_only = true

[eXPressor v1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D
ep_only = true

[eXPressor V1.4.5.1 -> CGSoftLabs   * Sign.By.fly]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14 89 4D ?? E9 ?? ?? ?? ?? C7 05
ep_only = true

[eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs]
signature = 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35
ep_only = true

[eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs]
signature = 5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0
ep_only = true

[eXpressor Version 1.5.01]
signature = 55 8B EC 81 EC 50 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00
ep_only = true

[eXPressor.FullSupport V1.6.0.1 -> CGSoftLabs&nbsp; &nbsp;* Sign.By.fly * 20080308]
signature = 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00
ep_only = true

[eXPressor.Light V1.6.0.1 -> CGSoftLabs&nbsp; &nbsp;* Sign.By.fly * 20080308]
signature = 55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00
ep_only = true

[eXPressor.PacK 1.5.0.X -> CGSoftLabs]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04
ep_only = true

[eXPressor.Protection 1.5.0.X -> CGSoftLabs]
signature = EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB
ep_only = true

[eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly]
signature = EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02
ep_only = true

[EZIP v1.0]
signature = E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C
ep_only = true

[Eεش-> ºڷ]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = true

[FACRYPT v1.0]
signature = B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3
ep_only = true

[FakeNinja v2.8 (Anti-Debug) -> Spirit]
signature = 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF
ep_only = true

[FakeNinja v2.8 -> Spirit]
signature = BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40
ep_only = true

[fasm -> Tomasz Grysztar]
signature = 6A 24
ep_only = true

[fasm -> Tomasz Grysztar]
signature = 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00
ep_only = true

[fasm -> Tomasz Grysztar [flat]]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84
ep_only = true

[FASM v1.3x]
signature = 6A ?? FF 15 ?? ?? ?? ?? A3
ep_only = true

[FASM v1.5x]
signature = 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00
ep_only = true

[FASM v1.5x]
signature = 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FCRYPT v.1.00 1990]
signature = E9 J1 J1 50 53 51 BE ?? ?? BF ?? ?? 8B EF B9 ?? ?? FC AC 32 C1 AA E2 ?? 59 5B 58 FF
ep_only = true

[fds0ft c0m pr0tect v0.4b]
signature = 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB
ep_only = true

[fEaRzCrypter v1.0 -> fEaRz]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00
ep_only = true

[Feokt]
signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 BE ?? ?? 40 00 BF
ep_only = true

[Feokt]
signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8
ep_only = true

[FIDO mail packet]
signature = 03 00 03 00 CD 07
ep_only = true

[File Analyzer Compiled Datafile Version]
signature = 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E
ep_only = true

[File Analyzer Extended Datafile Version]
signature = 23 03 45 58 54 44 ?? ?? 3A 03
ep_only = true

[File Analyzer Registration file v1.0]
signature = 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31
ep_only = true

[File Analyzer Registration file v1.1]
signature = 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D
ep_only = true

[FileShield]
signature = 50 1E EB ?? 90 00 00 8B D8
ep_only = true

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00
ep_only = true

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40
ep_only = true

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00
ep_only = true

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40
ep_only = true

[FishPE V1.0X -> hellfish]
signature = 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00
ep_only = true

[FishPE V1.0X -> hellfish ! Sign by fly]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40
ep_only = true

[FishPE V1.1X -> hellfish   * Sign.By.fly]
signature = 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 18 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C2 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 E0
ep_only = true

[FixupPak 1.20]
signature = 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00
ep_only = true

[FixupPak v1.20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[FixupPak v1.20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8
ep_only = true

[FixupPak v1.20]
signature = 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D
ep_only = true

[FIZ Archive]
signature = 46 49 5A 1A 01
ep_only = true

[Fly-Crypter 1.0 -> ut1lz]
signature = 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90
ep_only = true

[FMC Faust Module music file]
signature = 46 4D 43 21
ep_only = true

[FOXPRO DOS, Watcom C 386 Run-Time System]
signature = EB J3 8C D8 8E C0 B8 ?? ?? 8E D8 C7 ?? ?? ?? ?? ?? B8 ?? ?? 2D ?? ?? 3B C4 76 ?? C7 ?? ?? ?? ?? ?? 8F ?? ?? ?? 8F ?? ?? ?? 58
ep_only = true

[FOXSQZ Archive]
signature = 46 4F 58 53 51 5A
ep_only = true

[Free Pascal 0.99.10]
signature = E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29
ep_only = true

[Free Pascal v0.99.10]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29
ep_only = true

[Free Pascal v0.99.10]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 75
ep_only = true

[Free Pascal v1.0.10 (win32 console)]
signature = C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC
ep_only = true

[Free Pascal v1.0.10 (win32 GUI)]
signature = C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5
ep_only = true

[Free Pascal v1.06]
signature = C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FreeBasic 0.14]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D
ep_only = true

[FreeBASIC 0.16b]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90
ep_only = true

[FreeBASIC v0.11]
signature = E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5
ep_only = true

[FreeCryptor 0.1 (build 001) -> GlOFF]
signature = 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08
ep_only = true

[FreeCryptor 0.1 (build 002) -> GlOFF]
signature = 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08
ep_only = true

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B ?? 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A
ep_only = true

[FreeCryptor 0.3 -> GlOFF]
signature = 1E 98 3. ..
ep_only = true

[FreeCryptor 0.3 -> GlOFF]
signature = 1E 98 3
ep_only = true

[FreeHand 8 document]
signature = 41 47 44 33
ep_only = true

[FreeHand Graphics format]
signature = 41 47 44 32
ep_only = true

[FreeJoiner 1.5.1 -> GlOFF]
signature = 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52
ep_only = true

[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]
signature = E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00
ep_only = true

[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]
signature = E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 0
ep_only = true

[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]
signature = E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00
ep_only = true

[FreeJoiner Small (build 014-021/024-027) -> GlOFF]
signature = E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 017) -> GlOFF]
signature = E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 023) -> GlOFF]
signature = E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 029) -> GlOFF]
signature = 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8
ep_only = true

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 033) -> GlOFF]
signature = 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 035) -> GlOFF]
signature = 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00
ep_only = true

[FreePascal 2.0.0 Win32]
signature = C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00
ep_only = true

[FreePascal 2.0.0 Win32]
signature = C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00
ep_only = true

[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3
ep_only = true

[Freshbind v2.0 -> gFresh]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00
ep_only = true

[Freshbind v2.0 -> gFresh]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40
ep_only = true

[from NORMAN Anti-Virus Utilites]
signature = E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A
ep_only = true

[Frusion -> biff]
signature = 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13
ep_only = true

[FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB
ep_only = true

[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE
ep_only = true

[FSG 1.3]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D
ep_only = true

[FSG v1.0]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true

[FSG v1.0]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.0]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4
ep_only = true

[FSG v1.00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.1]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16
ep_only = true

[FSG v1.1]
signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? F6
ep_only = true

[FSG v1.1]
signature = EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00
ep_only = true

[FSG v1.1]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE
ep_only = true

[FSG v1.10  -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 F3 DD 60 F2 73 A8 C3 45 2E 22 43 C4 FA 15 2E 73 97 BE D5 04 25 A6 D5 E0 FC 54 EC D9 A0 84 C4 04 FA D6 D7 07 3A 14 4F 18 F6 AB D8 88 B8 E7 CB C4 36 B8 51 4E 4B 97 29 7C B4 3F D7 99 BC 66 DA CE 9C AC DD 01 0D 65 6D CD F5 5E F6 8E 7F 36 4F A7 AF 27 C7 70 5
ep_only = true

[FSG v1.10  -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]
signature = EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = E8 01 00 00 00 ?? ?? E8 ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = ?? ?? EB ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? EB 02
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 CD 20
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 01 ?? E8 ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? E8 E7 1C 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]
signature = EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]
signature = EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]
signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]
signature = CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]
signature = EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]
signature = EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]
signature = F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]
signature = F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = EB 01 ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]
signature = C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]
signature = B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]
signature = 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]
signature = 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]
signature = E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]
signature = E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 87 FE ?? 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 87 C0 EB ?? 71 ?? 02 D8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]
signature = 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MS Visual C++ / Borland C++ / Watcom C++)]
signature = EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD
ep_only = true

[FSG v1.10 -> dulek/xt -> (Microsoft Visual C++ 7.0)]
signature = EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB
ep_only = true

[FSG v1.2]
signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC
ep_only = true

[FSG v1.2]
signature = 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C
ep_only = true

[FSG v1.3]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73
ep_only = true

[FSG v1.3]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9
ep_only = true

[FSG v1.31 (Eng) -> dulek/xt]
signature = BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B
ep_only = true

[FSG v1.33]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF
ep_only = true

[FSG v1.33]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[FSG v2.0]
signature = 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13
ep_only = true

[FSG v2.0 -> bart/xt]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 00 08 D0 05 D4 06 D5 0B 40 09 00 10 7F 26 4F 0B 00 09 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Fuck'n'Joy v1.0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF
ep_only = true

[Fuck'n'Joy v1.0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00
ep_only = true

[Fusion 1.0 -> jaNooNi]
signature = 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00
ep_only = true

[G!X Protector 1.2 -> Guru.eXe]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00
ep_only = true

[GameGuard - nProtect]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

[GameGuard v2006.5.x.x (*.dll)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00
ep_only = true

[GameGuard v2006.5.x.x (*.dll)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B
ep_only = true

[GameGuard v2006.5.x.x (*.exe)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00
ep_only = true

[Gamehouse Media Protector Version Unknown]
signature = 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[Gardian Angel 1.0]
signature = 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB
ep_only = true

[GEM Image graphics file]
signature = 00 01 00 08 00 04 00 02
ep_only = true

[Gem VDI Image graphics file]
signature = 00 01 00 ?? 00 ?? 00 01
ep_only = true

[Gentee Installer Custom]
signature = 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF
ep_only = true

[GHF Protector (pack only) --> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3
ep_only = true

[GHF Protector (pack only) --> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0E P_ ON LY =T RU E
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 0
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[GIF87a Graphics format]
signature = 47 49 46 38 37 61
ep_only = true

[GIF89a Graphics format]
signature = 47 49 46 38 39 61
ep_only = true

[Gleam 1.00]
signature = 83 EC 0C 53 56 57 E8 24 02 00
ep_only = true

[Gleam v1.00]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 0C 53 56 57 E8 24 02 00
ep_only = true

[Gleam v1.00]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[Go32Stub v.2.00 DOS-Extender]
signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80
ep_only = true

[Go32Stub v.2.00T DOS-Extender]
signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C
ep_only = true

[Goat's PE Mutilator 1.6]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Goat's PE Mutilator 1.6]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Goats Mutilator V1.6 -> Goat/_e0f]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D
ep_only = true

[Goats Mutilator v1.6 -> Goat/_e0f]
signature = E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68
ep_only = true

[GOES graphics file]
signature = C8 C4 D9 40 C1 D9 C5 C1
ep_only = true

[Golded's Output text file]
signature = C4 20 5B
ep_only = true

[GP-Install v5.0.3.32]
signature = 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0
ep_only = true

[Guardant Stealth aka Novex Dongle]
signature = 55 8B EC 83 C4 F0 60 E8 51 FF FF FF
ep_only = true

[Guardant Stealth aka Novex Dongle]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80
ep_only = true

[GZIP Archive]
signature = 1F 8B 08 08 ?? ?? ?? 35
ep_only = true

[HA Archive]
signature = 48 41
ep_only = true

[HACKSTOP v1.00]
signature = FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F
ep_only = true

[HACKSTOP v1.10, v1.11]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true

[HACKSTOP v1.10p1]
signature = B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true

[HACKSTOP v1.11c]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB
ep_only = true

[HACKSTOP v1.13]
signature = 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA
ep_only = true

[HACKSTOP v1.13]
signature = FA BD J2 J2 D4 85 4E 32 EB EB
ep_only = true

[HACKSTOP v1.17]
signature = FA BE J2 J2 05 0C 00 07 1D 4A 46 1E 16 FD AC 44 ?? ?? ?? ?? F1 6D 84 D3 3D ?? ?? CF AF FB 34 DB 33 ?? ?? ?? ?? ?? D0 D6 ?? ?? 92 B4 24 9E
ep_only = true

[HACKSTOP v1.18]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB
ep_only = true

[HACKSTOP v1.19]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB
ep_only = true

[Hardlock dongle (Alladin)]
signature = 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76
ep_only = true

[Hardlock dongle (Alladin)]
signature = 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD
ep_only = true

[Hasp 4 envelope dongle (Alladin)]
signature = 10 02 D0 51 0F 00 83
ep_only = true

[Hasp dongle (Alladin)]
signature = 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32
ep_only = true

[HASP HL Protection V1.X -> Aladdin]
signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15
ep_only = true

[HASP HL Protection V1.X -> Aladdin]
signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
ep_only = true

[HEALTH v.5.1 by Muslim M.Polyak]
signature = 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26
ep_only = true

[Hide PE 1.01 -> BGCorp]
signature = ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D
ep_only = true

[Hide&Protect 1.016 -> SoftWar Company]
signature = 90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00
ep_only = true

[Hide&Protect V1.016C-> SoftWar Company   * Sign.By.fly]
signature = 90 90 90 E9 D8
ep_only = true

[Hide&Protect V1.0X-> SoftWar Company]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[Hitachi Raster Format graphics format]
signature = 43 41 44 43 2F 4B 52 20 52 53 54
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[hmimys's PE-Pack 0.1 -> hmimys]
signature = E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00
ep_only = true

[hmimys's PE-Pack 0.1 -> hmimys]
signature = E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75
ep_only = true

[HP-48sx graphics format]
signature = 48 50 48 50 34 38 2D 41
ep_only = true

[HPA]
signature = E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3
ep_only = true

[HPA]
signature = E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00
ep_only = true

[HPACK Archive]
signature = 48 50 41 4B
ep_only = true

[HSC music file]
signature = C8 E2 04 20
ep_only = true

[HSI JPEG graphics file]
signature = 68 73 69 31 00 00
ep_only = true

[hying's PE-Armor -> hying[CCG]
signature = E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D
ep_only = true

[Hying's PE-Armor 0.75.exe -> Hying]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC
ep_only = true

[Hying's PE-Armor 0.75.exe -> Hying [CCG]
signature = 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3
ep_only = true

[hying's PEArmor V0.76 -> hying]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00
ep_only = true

[hying's PEArmor V0.7X -> hying]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3
ep_only = true

[Hyper Archive]
signature = 1A 53 54
ep_only = true

[IBM IOCA Graphics format]
signature = 00 11 D3 A6 FB
ep_only = true

[IBM PictureMaker graphics file]
signature = 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01
ep_only = true

[ICE Archive]
signature = ?? ?? 2D 6C 68 ?? 2D
ep_only = true

[Ice v1.00]
signature = EB J3 BE ?? ?? 8B FE 8B ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? 50 FC AD 33 C2 AB 8B D0
ep_only = true

[ICrypt 1.0 - by BuGGz]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65
ep_only = true

[ID Application Protector 1.2 -> ID Security Suite]
signature = 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C
ep_only = true

[ID Application Protector V1.2 -> ID Security Suite ! Sign by fly]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B
ep_only = true

[id Software's WAD file]
signature = 50 57 41 44 0B 00
ep_only = true

[IDA (Interactive Disassembler) database]
signature = 49 44 41
ep_only = true

[ILUCRYPT v4.015 [com]
signature = E9 J1 J1 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true

[ILUCRYPT v4.015 [exe]
signature = 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true

[iLUCRYPT v4.018 [com]
signature = E9 J1 J1 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 31 05 D1 C8 4F 81
ep_only = true

[Image Systems Technology Graphics format]
signature = 03 3A ?? ?? 00 ?? 00 00
ep_only = true

[Imaging Technology Graphics format]
signature = 49 4D 00 00
ep_only = true

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = true

[Imploder v1.04 --> BoB / BobSoft]
signature = 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[Inbuild v1.0 [hard]
signature = B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2
ep_only = true

[INCrypter 0.3 (INinY) - by z3e_NiFe]
signature = 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3
ep_only = true

[Inno Installer v4.0.5] ;collides with: Inno Setup Module Heuristic Mode [Inno SFX]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22
ep_only = true

[Inno Installer v5.1.2]
signature = 9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC
ep_only = true

[Inno Installer v5.1.2]
signature = 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B
ep_only = true

[Inno Installer v5.1.2] ;collides with: Borland Delphi 2.0 [Overlay]
signature = 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22
ep_only = true

[Inno Setup Module]
signature = 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43
ep_only = true

[Inno Setup Module]
signature = 49 6E 6E 6F
ep_only = true

[Inno Setup Module v1.09a]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0
ep_only = true

[Inno Setup Module v1.09a]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 68
ep_only = true

[Inno Setup Module v5]
signature = 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? F3 FF FF E8 ?? F4 FF FF 33 C0 55
ep_only = true

[Inset Systems IGF graphics file]
signature = 01 80 04 00 01 00 58 00
ep_only = true

[Inset Systems PIX Graphics format]
signature = 03 00 ?? 00 00 00 20 00
ep_only = true

[Install Stub 32-bit]
signature = 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29
ep_only = true

[InstallAnywhere 6.1 -> Zero G Software Inc]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[InstallAnywhere 6.1 -> Zero G Software Inc]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

[Installer VISE Custom]
signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[InstallShield 2000]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57
ep_only = true

[InstallShield 3.x Custom]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1
ep_only = true

[InstallShield Archive]
signature = 2A AB 79 D8
ep_only = true

[InstallShield Cabinet Archive]
signature = 49 53 63
ep_only = true

[InstallShield Custom]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B
ep_only = true

[Intel DCX Graphics format]
signature = B1 68 DE 3A 04 10 00
ep_only = true

[Interchange Format File (IFF), type WVQA]
signature = 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44
ep_only = true

[InterGraph Graphics format]
signature = 08 09 FE 01 18 00 00 00
ep_only = true

[InterLok V5.51 -> PACE Anti-Piracy * Sign.By.fly]
signature = EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 ?? ?? EB FA ?? EB 01 ?? EB F8 ?? EB 01 ?? 57 EB 03 ?? ?? ?? EB 11 ?? ?? ?? EB 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 08 ?? EB F0 ?? EB 07 ?? ?? EB FA ?? ?? ?? EB 02 ?? ?? BB ?? ?? ?? ?? EB 03 ?? ?? ?? 0F 85 ?? ?? ?? ?? EB 07
ep_only = true

[InterLok V5.X -> PACE Anti-Piracy * Sign.By.fly]
signature = 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 48 3C 03 C8 89 ?? ?? ?? ?? ?? EB 06 8B ?? ?? ?? ?? ?? 66 8B 59 16 C1 EB 0D 83 E3 01 74 0A 83 7D 0C 01 0F 85 38 01 00 00 8D 45 F8 50 8D 45 FC 50 E8 47 01 00 00 8B F8 59 3B FE 59 75 52 83 7D FC FF FF 75 F8 75 17 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C EB 18 FF 75 FC 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 10 6A 30 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? E9 BB 00 00 00 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 FF D7 57 6A 01 8B F0 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 F6 0F 84 96 00 00 00 83 FE F6 7F 32 74 29 83 FE 97 74 75 83 FE F3 74 18 83 FE F4 74 0C 83 FE F5 75 2B B8 ?? ?? ?? ?? EB 4F B8 ?? ?? ?? ?? EB 48 B8 ?? ?? ?? ?? EB 41 B8 ?? ?? ?? ?? EB 3A 83 FE FA 74 30 83 FE FC 74 24 83 FE FD 74 18 56 8D 45 E0 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C 8D 45 E0 EB 13 B8 ?? ?? ?? ?? EB 0C B8 ?? ?? ?? ?? EB 05 B8 ?? ?? ?? ?? 6A 30 68 ?? ?? ?? ?? 50 6A 00 FF 15 ?? ?? ?? ?? 85 DB 75 08 6A 01 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B C9 C2 0C 00
ep_only = true

[Interplay's MVE file]
signature = 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A
ep_only = true

[iPB Protect 0.1.3 - 0.1.7 -> forgot]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00
ep_only = true

[iPBProtect v0.1.3]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70
ep_only = true

[iPBProtect v0.1.3]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78
ep_only = true

[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF
ep_only = true

[IProtect 1.0 (FxSub.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF
ep_only = true

[IProtect 1.0 (FxSub.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00
ep_only = true

[JAM v2.11]
signature = 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB
ep_only = true

[JAM v2.11]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00
ep_only = true

[JDPack]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB
ep_only = true

[JDPack]
signature = 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2
ep_only = true

[JDPack 2.x -> JDPack]
signature = 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00
ep_only = true

[JEDMICS CCITT4 Graphics format]
signature = 80 00 00 00 ?? ?? ?? 00
ep_only = true

[JExeCompressor 1.0 - by Arash Veyskarami]
signature = 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0
ep_only = true

[JExeCompressor V1.0 -> UsAr]
signature = 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F BC C8 EB ?? C3 B8 ?? ?? ?? ?? 50
ep_only = true

[JExeCompressor V1.0 -> UsAr]
signature = 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8
ep_only = true

[Joiner (sign from pinch 25.03.2007 20:10)]
signature = 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D
ep_only = true

[Joiner (sign from pinch 25.03.2007 20:10)]
signature = 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01
ep_only = true

[Jovian VI graphics file]
signature = 56 49 ?? ?? ?? ?? ?? 00
ep_only = true

[JPEG & GIF library file]
signature = 00 05 16 07 00 02 00 00
ep_only = true

[JPEG Graphics format + description]
signature = FF D8 FF FE 00 27
ep_only = true

[JRC Archive]
signature = 4A 52 63 68 69 76 65
ep_only = true

[Kbys Packer 0.28 Beta->shoooo314]
signature = 68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00
ep_only = true

[KByS Packer v0.28]
signature = 68 ?? ?? ?? 00 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00
ep_only = true

[KByS V0.22 -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8
ep_only = true

[KByS V0.28 -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4
ep_only = true

[KByS V0.28 DLL -> shoooo]
signature = B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00
ep_only = true

[KGB SFX]
signature = 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[KGCrypt vx.x]
signature = E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74
ep_only = true

[KGCrypt vx.x]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true

[Khrome Crypt v0.3]
signature = B9 ?? ?? B8 ?? ?? EB ?? 80 ?? ?? EB ?? EB J3 EB ?? 66 ?? ?? ?? ?? ?? 66
ep_only = true

[kkrunchy -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0
ep_only = true

[kkrunchy -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10
ep_only = true

[kkrunchy -> Ryd]
signature = BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8
ep_only = true

[kkrunchy 0.23 alpha -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0
ep_only = true

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE
ep_only = true

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF
ep_only = true

[kkrunchy v0.17 -> F. Giesen]
signature = FC FF 4D 08 31 D2 8D 7D 30 BE
ep_only = true

[kkrunchy V0.2X -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6
ep_only = true

[Kodak Color management for Windows file]
signature = ?? ?? ?? ?? 4B 43 4D 53
ep_only = true

[Kofax Group 4 graphics file]
signature = 2E 4B 46 68 80 00 01 00
ep_only = true

[Krypton v0.2]
signature = 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04
ep_only = true

[Krypton v0.2]
signature = 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48
ep_only = true

[Krypton v0.4]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06
ep_only = true

[Krypton v0.5]
signature = 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = true

[kryptor 3]
signature = EB 66 87 DB
ep_only = true

[kryptor 5]
signature = E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02
ep_only = true

[kryptor 6]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[kryptor 8]
signature = EB 6A 87 DB
ep_only = true

[kryptor 9]
signature = 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9
ep_only = true

[LamCrypt v1.0 -> LaZaRuS]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8
ep_only = true

[LameCrypt -> LaZaRus]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0
ep_only = true

[LamerStop v1.0c (c) Stefan Esser]
signature = E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA
ep_only = true

[Lattice C v1.01]
signature = FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB
ep_only = true

[Lattice C v3.0]
signature = FA B8 ?? ?? 8E D8 B8 ?? ?? 8E
ep_only = true

[LaunchAnywhere v4.0.0.1]
signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3
ep_only = true

[LaunchAnywhere v4.0.0.1]
signature = 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F
ep_only = true

[Launcher Generator v1.03]
signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Launcher Generator v1.03]
signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00
ep_only = true

[LCC Win32 DLL]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true

[LCC Win32 v1.x]
signature = 64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50
ep_only = true

[LCC Win32 v1.x]
signature = 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10
ep_only = true

[LCC-Win32]
signature = 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B
ep_only = true

[LE-Exe Executable Image]
signature = 4C 45
ep_only = true

[LGLZ v1.04 [com]
signature = BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21
ep_only = true

[LGLZ v1.04b]
signature = FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79
ep_only = true

[LHA Archive]
signature = ?? ?? ?? 6C 68 35
ep_only = true

[LHA-SFX Archive v2.05, v2.13]
signature = EB J3 FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB ?? ?? ?? ?? ?? E8 ?? ?? 06 1F B4 30 CD 21 8B D8 1E 3C 03 72 ?? 36 ?? ?? ?? ?? 33 C0 8B F8 B9
ep_only = true

[LHA-SFX Archive v2.05S, v2.54S]
signature = EB J3 ?? ?? ?? FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB
ep_only = true

[LHA-SFX Archive v2.13L]
signature = EB J3 FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 E8 ?? ?? BB ?? ?? E8 ?? ?? 06 1F B4 30 CD 21 8B D8 1E
ep_only = true

[LHARC-SFX Archive v1.131c]
signature = EB J3 ?? ?? ?? ?? 24 4C 48 61 72 ?? 27 73 ?? 53 46 58
ep_only = true

[LHARC-SFX Archive v1.13L]
signature = E9 J1 J1 FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 05 ?? ?? 8E C0 B8 ?? ?? CD 21 BE ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? AC E8
ep_only = true

[LHICE-SFX Archive v1.13, v1.17]
signature = EB J3 FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 2E ?? ?? ?? ?? 8E D8 8E C0 05 ?? ?? 2E ?? ?? ?? ?? 76 ?? BB
ep_only = true

[Libraries by John Socha]
signature = BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21
ep_only = true

[Limit Archive]
signature = 4C 4D 1A
ep_only = true

[LOCK98 V1.00.28 -> keenvim]
signature = 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08
ep_only = true

[Lockless Intro Pack]
signature = B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB
ep_only = true

[LockProg v0.5a]
signature = E8 J1 J1 E8 ?? ?? E8 ?? ?? BF ?? ?? 8B EC 8B ?? ?? 2E ?? ?? ?? 03 F9 89 0D B4 30 CD 21 3C 02 73 ?? B4 4C CD 21
ep_only = true

[Lotus Graphics format]
signature = 01 00 00 00 01 00 08 00
ep_only = true

[Lotus Word Pro document file]
signature = 57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37
ep_only = true

[LSI C-86 Run-Time Libray]
signature = B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC
ep_only = true

[LTC v1.3]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06
ep_only = true

[LTC v1.3]
signature = 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB
ep_only = true

[LX-Exe Executable Image]
signature = 4C 58
ep_only = true

[LY_WGKX -> www.szleyu.com]
signature = 4D 79 46 75 6E 00 62 73
ep_only = true

[LZEXE v0.91, v1.00a (1)]
signature = 06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7
ep_only = true

[LZEXE v0.91, v1.00a (2)]
signature = BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE
ep_only = true

[LZEXE v0.91, v1.00a (3)]
signature = 50 06 0E 1F 8B 0E
ep_only = true

[MacPaint Graphics format]
signature = 00 00 00 02 FF FF FF FF
ep_only = true

[MacroMedia ShockWave Movie file]
signature = 46 57 53
ep_only = true

[Macromedia Windows Flash Projector/Player v3.0]
signature = 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06
ep_only = true

[Macromedia Windows Flash Projector/Player v3.0]
signature = 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC
ep_only = true

[Macromedia Windows Flash Projector/Player v4.0]
signature = 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[Macromedia Windows Flash Projector/Player v5.0]
signature = 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[Mac`s StuffIt Archive]
signature = 53 49 54 21 00
ep_only = true

[Maked by Grabber v.3.84]
signature = E9 J1 J1 FC 8C DB 8C C8 8E D8 8E C0 89 1E ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? E8
ep_only = true

[Maked by Graphic WorkShop's Self-Displayer v.6.0]
signature = E9 J1 J1 2E C7 ?? ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43 2E 01 1E ?? ?? E8 ?? ?? 3D
ep_only = true

[Maked by Graphic WorkShop. Self-Displayer v.7.0]
signature = E9 J1 J1 2E C7 06 ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43 2E
ep_only = true

[Maked by The DRAW v.?.??]
signature = EB J3 B4 ?? CD 10 BB ?? ?? 3C ?? 74 ?? 3C ?? 74 ?? C6
ep_only = true

[MASK v2.3]
signature = E8 J1 J1 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 ?? ?? ?? FF ?? ?? 5D 49 E8
ep_only = true

[MaskPE V2.0 -> yzkzero]
signature = B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3
ep_only = true

[MASM / TASM]
signature = 6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00
ep_only = true

[MASM / TASM]
signature = 6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00
ep_only = true

[MASM / TASM]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83
ep_only = true

[MASM/TASM - sig1(h)]
signature = CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = true

[MASM/TASM - sig2(h)]
signature = C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = true

[MASM/TASM - sig4 (h)]
signature = FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = true

[MASM32]
signature = 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20
ep_only = true

[MASM32 / TASM32]
signature = 2B C0 50 E8
ep_only = true

[Matrix Dongle -> TDi GmbH]
signature = E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF
ep_only = true

[MCLock v1.2, v1.3]
signature = E9 J1 J1 90 90 90 FA 29 C0 8E C0 26 C6 06
ep_only = true

[MEGALITE v1.20a]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90
ep_only = true

[MESS v1.07]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? F3 ?? AC E3 ?? EB J3 BA ?? ?? B4 09 CD 21 CD 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 30 CD 21 3C 02 77
ep_only = true

[MESS v1.20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6
ep_only = true

[MESS v1.20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? AC ?? ?? EB J3 1E 0E 1F BA ?? ?? 81 ?? ?? ?? B4 09 CD 21 1F B4 4C CD 21
ep_only = true

[MetaWare High C + Phar Lap DOS Extender 1983-89]
signature = EB J3 33 ED 2E 8E 1E ?? ?? 26 A1 ?? ?? A3 ?? ?? 26 8B 1E ?? ?? B1 ?? 4B
ep_only = true

[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]
signature = B8 ?? ?? 50 B8 ?? ?? 50 CB
ep_only = true

[Metrowerks CodeWarrior (DLL) v2.0]
signature = 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9
ep_only = true

[Metrowerks CodeWarrior v2.0 (Console)]
signature = 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8
ep_only = true

[Metrowerks CodeWarrior v2.0 (GUI)]
signature = 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8
ep_only = true

[Mew 10 exe-coder 1.0  -> Northfox [HCC]
signature = 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70
ep_only = true

[MEW 10 packer v1.0 -> Northfox]
signature = 33 C0 E9 ?? ?0
ep_only = true

[Mew 10 v1.0 (Eng) -> Northfox]
signature = 33 C0 E9 ?? ?? ?? FF
ep_only = true

[Mew 10 v1.0 -> Northfox]
signature = 33 C0 E9 ?? ?? FF FF
ep_only = true

[MEW 11 SE 1.1 -> Northfox]
signature = E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00
ep_only = true

[MEW 11 SE v1.0 -> Northfox]
signature = E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0
ep_only = true

[MEW 11 SE v1.1]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true

[MEW 11 SE v1.1  -> Northfox [HCC]
signature = E9 ?? ?? ?? FF 0C ?0
ep_only = true

[MEW 11 SE v1.1  -> Northfox [HCC]
signature = E9 ?? ?? ?? FF 0C
ep_only = true

[MEW 11 SE v1.2]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00
ep_only = true

[MEW 11 SE v1.2]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Mew 11 SE v1.2 (Eng) -> Northfox]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C
ep_only = true

[Mew 11 SE v1.2 (Eng) -> Northfox]
signature = 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D
ep_only = true

[MEW 5 1.0 -> Northfox]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0
ep_only = true

[MEW 5 1.0 -> Northfox]
signature = BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0
ep_only = true

[Mew 5.0.1 -> NorthFox / HCC]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D
ep_only = true

[MicroDog Win32Shell V4.0.9.3 -> SafeNet   * Sign.By.fly]
signature = 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D BD EC FC FF FF 33 C0 B9 3F 00 00 00 F3 AB C7 85 10 FE FF FF A5 A5 00 00 66 C7 85 08 FE FF FF 0A 00 E9 13 09 00 00 90 68 00 10 00 00 E8 B8 F5 FF FF 83 C4 04 89 45 D0 83 7D D0 00 75 05 E9 C1 11 00 00 68 00 10 00 00 A1 ?? ?? ?? ?? 50 8B 45 D0 50 E8 FF F6 FF FF 83 C4 0C A1 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 89 85 34 FE FF FF 8B 85 34 FE FF FF 89 45 CC E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 C7 45 EC 00 00 EB 04 66 FF 45 EC 8B 45 EC 25 FF FF 00 00 83 F8 03 0F 8D DF 00 00 00 8B 45 EC 25 FF FF 00 00 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 83 C0 07 89 85 EC FB FF FF EB 7E
ep_only = true

[MicroDog Win32Shell V4.0.9.3 Dll -> SafeNet   * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D FC 00 74 0F 8B 45 EC 0F AF 45 FC 25 FF FF 00 00 01 45 F0 8B 45 EC 0F AF 45 F8 8B 4D F0 C1 E1 10 81 E1 00 00 FF FF 03 C1 40 89 45 E8 8B 45 E8 8B 4D 08 89 01 C1 6D E8 10 81 65 E8 FF 7F 00 00 66 8B 45 E8 EB 00 5F 5E 5B C9 C3
ep_only = true

[MicroDog Win32Shell V4.X -> SafeNet * Sign.By.fly]
signature = 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7 ?? ?? ?? ?? ?? ?? ?? E9 13 09 00 00 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 05 E9 C1 11 00 00 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 8B ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 ?? ?? ?? ?? ?? EB 04 66 ?? ?? ?? 8B ?? ?? 25 FF FF 00 00 83 ?? ?? 0F 8D DF 00 00 00 8B ?? ?? 25 FF FF 00 00 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 83 ?? ?? 89 ?? ?? ?? ?? ?? EB 7E
ep_only = true

[Micrografix Draw Graphics format]
signature = 01 FF 02 04 03 02 00 02
ep_only = true

[MicroJoiner 1.1 -> coban2k]
signature = BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true

[MicroJoiner 1.5 -> coban2k]
signature = BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF
ep_only = true

[MicroJoiner 1.5 -> coban2k]
signature = BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C
ep_only = true

[MicroJoiner 1.6 -> coban2k]
signature = 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B
ep_only = true

[MicroJoiner 1.7 -> coban2k]
signature = BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00
ep_only = true

[MicroJoiner 1.7 -> coban2k]
signature = BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3
ep_only = true

[Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)]
signature = 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40
ep_only = true

[Microsoft Access Database file]
signature = 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00
ep_only = true

[Microsoft Basic Compiler v5.60 1982-97]
signature = 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB
ep_only = true

[Microsoft Bitmap Graphics format]
signature = 01 00 09 00
ep_only = true

[Microsoft C]
signature = B4 30 CD 21 3C 02 73 ?? B8
ep_only = true

[Microsoft C (1988/1989)]
signature = B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72
ep_only = true

[Microsoft C (1990/1992)]
signature = B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7
ep_only = true

[Microsoft C for Windows]
signature = 33 ED 55 9A ?? ?? ?? ?? 0B C0 74
ep_only = true

[Microsoft C for Windows (2)]
signature = 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89
ep_only = true

[Microsoft C Library 1985]
signature = BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73
ep_only = true

[Microsoft C v1.04]
signature = FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB
ep_only = true

[Microsoft CAB SFX]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20
ep_only = true

[Microsoft CAB SFX]
signature = E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC
ep_only = true

[Microsoft FORTRAN]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9
ep_only = true

[Microsoft Paint Graphics format]
signature = 4C 69 6E 53
ep_only = true

[Microsoft QBasic v3.0]
signature = E9 J1 J1 8C C8 8E D8 E8 ?? ?? 8A 17 0A D2 74 ?? B4 ?? CD 21 43
ep_only = true

[Microsoft QBasic v4.0]
signature = EB J3 0E 1F B8 ?? ?? 50 9A ?? ?? ?? ?? 8E DA 93 8A 17 0A D2 74 ?? B4 ?? CD 21 43
ep_only = true

[Microsoft Visual Basic 4.0]
signature = 68 ?? ?? ?? 00 E8 ?? FF FF FF 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual Basic 5.0]
signature = FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
ep_only = true

[Microsoft Visual Basic v5.0]
signature = ?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
ep_only = true

[Microsoft Visual Basic v5.0]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00
ep_only = true

[Microsoft Visual Basic v5.0 - v6.0]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00
ep_only = true

[Microsoft Visual Basic v5.0 - v6.0]
signature = FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF
ep_only = true

[Microsoft Visual Basic v6.0]
signature = FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30
ep_only = true

[Microsoft Visual Basic v6.0 DLL]
signature = 5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF
ep_only = true

[Microsoft Visual Basic v6.0 DLL]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3
ep_only = true

[Microsoft Visual C 2.0]
signature = 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75
ep_only = true

[Microsoft Visual C 2.0]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68
ep_only = true

[Microsoft Visual C 5.0]
signature = 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57
ep_only = true

[Microsoft Visual C# / Basic .NET]
signature = FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Visual C# / Basic .NET]
signature = 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B
ep_only = true

[Microsoft Visual C# v7.0 / Basic .NET]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Visual C++]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00
ep_only = true

[Microsoft Visual C++]
signature = 55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F
ep_only = true

[Microsoft Visual C++]
signature = 8B 44 24 08 56 83 E8 ?? 74 ?? 48 75
ep_only = true

[Microsoft Visual C++]
signature = 8B 44 24 08 83 ?? ?? 74
ep_only = true

[Microsoft Visual C++]
signature = 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25
ep_only = true

[Microsoft Visual C++ (3.0 old crap)]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF
ep_only = true

[Microsoft Visual C++ 4.2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89
ep_only = true

[Microsoft Visual C++ 4.2 (2)]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7
ep_only = true

[Microsoft Visual C++ 4.2 (DLL)]
signature = 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75
ep_only = true

[Microsoft Visual C++ 5.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50
ep_only = true

[Microsoft Visual C++ 6.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83
ep_only = true

[Microsoft Visual C++ 6.0]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 &# 40 ;T RU NC AT ED HE RE &# 41 ;
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 &# 40 ;T RU NC AT ED HE RE &# 41
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51
ep_only = true

[Microsoft Visual C++ 6.0 - 8.0]
signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3
ep_only = true

[Microsoft Visual C++ 6.0 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E
ep_only = true

[Microsoft Visual C++ 6.0 SFX Custom]
signature = E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50
ep_only = true

[Microsoft Visual C++ 7]
signature = ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89
ep_only = true

[Microsoft Visual C++ 7.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83
ep_only = true

[Microsoft Visual C++ 7.0 Custom]
signature = 60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
ep_only = true

[Microsoft Visual C++ 8]
signature = E8 ?? ?? 00 00 E9 ?? ?? FF FF
ep_only = true

[Microsoft Visual C++ 8]
signature = E8 ?? ?? ?? ?? E9
ep_only = true

[Microsoft Visual C++ 8]
signature = ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A ?? FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8
ep_only = true

[Microsoft Visual C++ 8.0]
signature = ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true

[Microsoft Visual C++ 8.0]
signature = E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
ep_only = true

[Microsoft Visual C++ 8.0]
signature = E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8
ep_only = true

[Microsoft Visual C++ 8.0]
signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4
ep_only = true

[Microsoft Visual C++ 8.0 (DLL)]
signature = 48 83 EC 28
ep_only = true

[Microsoft Visual C++ 8.0 (DLL)]
signature = 48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48
ep_only = true

[Microsoft Visual C++ 8.0 (MFC)]
signature = 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[Microsoft Visual C++ 8.0 (MFC)]
signature = C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Visual C++ 8.0 [Debug]
signature = C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00
ep_only = true

[Microsoft Visual C++ 8.0 [Debug]]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65
ep_only = true

[Microsoft Visual C++ DLL]
signature = 53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0
ep_only = true

[Microsoft Visual C++ DLL]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C
ep_only = true

[Microsoft Visual C++ DLL]
signature = 53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14
ep_only = true

[Microsoft Visual C++ DLL]
signature = 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2
ep_only = true

[Microsoft Visual C++ DLL]
signature = 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC
ep_only = true

[Microsoft Visual C++ v4.2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57
ep_only = true

[Microsoft Visual C++ v4.2 DLL]
signature = 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08
ep_only = true

[Microsoft Visual C++ v5.0]
signature = 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57
ep_only = true

[Microsoft Visual C++ v5.0 DLL]
signature = ?? ?? 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D
ep_only = true

[Microsoft Visual C++ v5.0 DLL]
signature = ?? ?? 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83
ep_only = true

[Microsoft Visual C++ v6.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57
ep_only = true

[Microsoft Visual C++ v6.0]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22
ep_only = true

[Microsoft Visual C++ v6.0]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 0D ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1C ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v6.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF
ep_only = true

[Microsoft Visual C++ v6.0]
signature = ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 ?? 00
ep_only = true

[Microsoft Visual C++ v6.0 (Debug Version)]
signature = 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Microsoft Visual C++ v6.0 (Debug Version)]
signature = 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? ?? ?? 02
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45
ep_only = true

[Microsoft Visual C++ v6.0 DLL]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B
ep_only = true

[Microsoft Visual C++ v6.0 SPx]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 6A ?? 68 ?? ?? ?? ?? E8
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56
ep_only = true

[Microsoft Visual C++ v7.0]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00
ep_only = true

[Microsoft Visual C++ v7.0 (64 Bit)]
signature = ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B
ep_only = true

[Microsoft Visual C++ v7.1 DLL]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC
ep_only = true

[Microsoft Visual C++ v7.1 DLL (Debug)]
signature = 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00
ep_only = true

[Microsoft Visual C++ v7.1 EXE]
signature = 6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01
ep_only = true

[Microsoft Visual C++ vx.x]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04
ep_only = true

[Microsoft Visual C++ vx.x]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3
ep_only = true

[Microsoft Visual C++ vx.x]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD
ep_only = true

[Microsoft Visual C++ vx.x DLL]
signature = ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68
ep_only = true

[Microsoft Visual C++ vx.x DLL]
signature = ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3
ep_only = true

[Microsoft Visual Studio .NET]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Microsoft Windows Cabinet file]
signature = 4D 53 43 46
ep_only = true

[Microsoft Windows Enhanced Metafile]
signature = 01 00 00 00 58
ep_only = true

[Microsoft Windows Help file]
signature = 3F 5F 03
ep_only = true

[Microsoft Windows Metafile]
signature = D7 CD C6 9A
ep_only = true

[Microsoft Windows Shortcut file]
signature = 4C 00 00 00 01 14 02 00 00 00
ep_only = true

[Microsoft Windows Update CAB SFX module]
signature = E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00
ep_only = true

[Microsoft Windows Update CAB SFX module]
signature = E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18
ep_only = true

[MIDI Music file]
signature = 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54
ep_only = true

[MinGW]
signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF
ep_only = true

[MinGW 3.2.x (Dll_WinMain)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00
ep_only = true

[MinGW 3.2.x (WinMain)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D
ep_only = true

[MinGW GCC DLL v2xx]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[MinGW GCC DLL v2xx]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[MinGW GCC v2.x]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00
ep_only = true

[MinGW GCC v2.x]
signature = 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D
ep_only = true

[MinGW v3.2.x (Dll_main)]
signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00
ep_only = true

[MinGW v3.2.x (Dll_WinMain)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3
ep_only = true

[MinGW v3.2.x (Dll_WinMain)]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10
ep_only = true

[MinGW v3.2.x (main)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00
ep_only = true

[MinGW v3.2.x (WinMain)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00
ep_only = true

[MingWin32 GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[MingWin32 GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55
ep_only = true

[Minke 1.0.1 - by Codius]
signature = 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38
ep_only = true

[Minke V1.0.1 -> Codius]
signature = 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73
ep_only = true

[Minke V1.0.1 -> Codius ! Sign by fly]
signature = 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8
ep_only = true

[mkfpack -> llydd]
signature = E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08
ep_only = true

[MOD 8 Track Oktatracker music file]
signature = 4F 43 54
ep_only = true

[modified HACKSTOP v1.11f]
signature = 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8
ep_only = true

[MoleBox Pro v2.6.1]
signature = E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 2A 6A 00 00 E9 3E 6A 00 00 E9 39 6A 00 00 E8 6E FB FF FF 7E 04 01 00 ?? 96 00 00 ?? ?? ?? ?? ?? ?? F1 ?? ?? ?? A4 ?? ?? ?? A1 ?? ?? ?? E0 ?? ?? ?? 19 ?? ?? ?? BE ?? ?? ?? 13
ep_only = true

[MoleBox v2.0]
signature = E8 ?? ?? ?? ?? 60 E8 4F
ep_only = true

[MoleBox V2.3X -> MoleStudio.com]
signature = E8 00 00 00 00 60 E8 4F 00 00 00
ep_only = true

[MoleBoxPro 2.5.5 -> Mole Studio (h)]
signature = E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 E9 D9 69 00 00 E8 5E FB FF FF 3E F4 00 00
ep_only = true

[Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = true

[Morphine v1.2]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E2 ?? ?? ?? ?? ?? 82 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Morphine v1.2 - v1.3]
signature = FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0
ep_only = true

[Morphine v2.7 --> Holy_Father & Ratter/29A]
signature = ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Morphine v2.7 -> Holy_Father & Ratter/29A]
signature = 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Morphnah Beta -> Kas]
signature = 2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0
ep_only = true

[mPack 0.0.3 -> DeltaAziz]
signature = 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5
ep_only = true

[mPACK v0.0.2 -> DeltaAziz (h)]
signature = 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF
ep_only = true

[mPACK v0.0.2 -> DeltaAziz (h)]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD
ep_only = true

[mPack V0.03 -> DeltaAziz]
signature = 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ?? 32 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 C9 C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 04 00 00 00 E8 C5 C9 FF FF 83 3D ?? ?? ?? ?? 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 92 C9 FF FF BA 18 A5 00 10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9 FF FF 83 F8 04 74 0A E8 14 B2 FF FF E9 A7 00 00 00 E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 63 C9 FF FF 83 F8 FF 75 0A E8 F1 B1 FF FF E9 84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 D4 CD FF FF 84 C0 75 07 E8 CF B1 FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 0F FA FF FF 3B 05 ?? ?? ?? ?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB FF FF 6A 03 E8 07 C4 FF FF A1 ?? ?? ?? ?? E8 C1 C6 FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 AA C6 FF FF A1 ?? ?? ?? ?? E8 A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F0 E8 A7 B5 FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF FF
ep_only = true

[MPEG movie file]
signature = 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF
ep_only = true

[MPEG Video file (2)]
signature = 00 00 01 B3
ep_only = true

[MPRESS V0.71a-V0.75b -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080310]
signature = 57 56 53 51 52 55 E8 10 00 00 00 E8 7A 00 00 00 5D 5A 59 5B 5E 5F E9 84 01 00 00 E8 00 00 00 00 58 05 84 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 AC 0A C0 74 37 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1E F6 C1 40 75 0A 8B C8 2B C0 F3 AA 75 FC EB D9 8B D6 8B CF 03 F0 E8 8F 00 00 00 03 F8 EB CA 8B C8 F3 A4 75 FC EB C2 C3 E8 00 00 00 00 5F 81 C7 71 FF FF FF B0 E9 AA B8 9A 01 00 00 AB 2B FF E8 00 00 00 00 58 05 FE 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 53 8B 30 03 F0 2B F2 8B EE 8B C2 8B 45 3C 03 C5 8B 48 34 2B CD 74 3D E8 00 00 00 00 58 05 DD 00 00 00 8B 10 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3
ep_only = true

[MPRESS V0.77b -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080313]
signature = 60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3
ep_only = true

[MPRESS V0.85-V0.92 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080414]
signature = 60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9
ep_only = true

[MPRESS V0.97-V0.99 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080416]
signature = 60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9
ep_only = true

[MPRESS V1.01 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00
ep_only = true

[MPRESS V1.07-V1.25 -> MATCODE Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00
ep_only = true

[Mr.HDKiller ProtectioN v1.2]
signature = E9 J1 J1 48 51 44 2E ?? ?? ?? 2D ?? ?? 8B D8 05 ?? ?? 8B F0 BF ?? ?? B9 ?? ?? ?? F3 A4 8B CB D1 E9
ep_only = true

[MS Compress Archive]
signature = 53 5A 44 44
ep_only = true

[MS FORTRAN Library 19??]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9
ep_only = true

[MS FORTRAN Library 19??]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26
ep_only = true

[MS HTML-Help file]
signature = 49 54 53 46
ep_only = true

[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]
signature = B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73
ep_only = true

[MS Run-Time Library 1987]
signature = B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92
ep_only = true

[MS Run-Time Library 1988 (04)]
signature = 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB
ep_only = true

[MS Run-Time Library 1990 (06)]
signature = EB J3 B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73
ep_only = true

[MS Run-Time Library 1990 (07)]
signature = 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB
ep_only = true

[MS Run-Time Library 1990 (10)]
signature = E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB
ep_only = true

[MS Run-Time Library 1990, 1992 (09)]
signature = B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E
ep_only = true

[MS Run-Time Library 1992 (11)]
signature = B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5
ep_only = true

[MS Run-Time Library 1992 (13)]
signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21
ep_only = true

[MS Run-Time Library 1992 (14)]
signature = 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30
ep_only = true

[MS Visual C++ v.8  (h-good sig, but is it MSVC?)]
signature = E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC
ep_only = true

[MS Visual C++ v.8 DLL (h-small sig1)]
signature = 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC
ep_only = true

[MS Visual C++ v.8 DLL (h-small sig2)]
signature = 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01
ep_only = true

[MSCC v1.0cs]
signature = E9 J1 J1 0E 07 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 B9 ?? ?? BE ?? ?? AC CC 98
ep_only = true

[MSLRH]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81
ep_only = true

[MSLRH]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08
ep_only = true

[MSLRH 0.32a (fake ASPack 2.11d) -> emadicius]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50
ep_only = true

[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B
ep_only = true

[MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = true

[MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = true

[MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = true

[MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58
ep_only = true

[MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB
ep_only = true

[MSLRH 0.32a (fake Neolite 2.0) -> emadicius]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75
ep_only = true

[MSLRH 0.32a (fake nSPack 1.3) -> emadicius]
signature = E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31
ep_only = true

[MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74
ep_only = true

[MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius]
signature = FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58
ep_only = true

[MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
ep_only = true

[MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83
ep_only = true

[MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02
ep_only = true

[MSLRH 0.32a (fake PECompact 1.4x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29
ep_only = true

[MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius]
signature = EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A
ep_only = true

[MSLRH 0.32a (fake PEtite 2.1) -> emadicius]
signature = 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04
ep_only = true

[MSLRH 0.32a (fake PEX 0.99) -> emadicius]
signature = B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
ep_only = true

[MSLRH 0.32a (fake SVKP 1.11) -> emadicius]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83
ep_only = true

[MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4
ep_only = true

[MSLRH 0.32a (fake WWPack32 1.x) -> emadicius]
signature = 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40
ep_only = true

[MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52
ep_only = true

[MSLRH V0.31 -> emadicius]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B
ep_only = true

[MSLRH v0.31a]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00
ep_only = true

[MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake ASPack 2.11d) -> emadicius]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake Neolite 2.0) -> emadicius]
signature = E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake nSPack 1.3) -> emadicius]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius]
signature = FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PECompact 1.4x) -> emadicius]
signature = EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius]
signature = 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEtite 2.1) -> emadicius]
signature = B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake PEX 0.99) -> emadicius]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake SVKP 1.11) -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true

[MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]
signature = 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake WWPack32 1.x) -> emadicius]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0.32a -> emadicius]
signature = E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C
ep_only = true

[MSVC++ DLL v.8 (typical OEP recognized - h)]
signature = 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00
ep_only = true

[mucki's protector]
signature = BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9
ep_only = true

[mucki's protector II -> mucki]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3
ep_only = true

[MultiEdit`s compiled macros]
signature = 1E AA
ep_only = true

[MultiEdit`s Programming Language help]
signature = 0C 2A 20
ep_only = true

[MZ0oPE 1.0.6b --> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3
ep_only = true

[MZ0oPE 1.0.6b -> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3
ep_only = true

[MZ0oPE 1.0.6b -> TaskFall]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2
ep_only = true

[MZ_Crypt 1.0 - by BrainSt0rm]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00
ep_only = true

[MZ_Crypt 1.0 - by BrainSt0rm]
signature = 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0
ep_only = true

[N-Code 0.1 -> NEX]
signature = BB E8 03 00 00 81 C3 E8 03 00 00 B8 05 00 00 00 B9 73 00 00 00 01 C8 83 E8 32 90 90 90 90 6B C0 02 90 68 FF 64 24 F0 90 90 90 90 90 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68
ep_only = true

[N-Joiner 0.1 (Asm Version) -> NEX]
signature = 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00
ep_only = true

[N-Joy 1.0 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00
ep_only = true

[N-Joy 1.1 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0
ep_only = true

[N-Joy 1.3 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00
ep_only = true

[Naked Packer V1.0 -> BigBoote]
signature = 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3
ep_only = true

[Naked Packer V1.X -> BigBoote]
signature = 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF E8 00 00 00 00 EB 01 ?? 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05
ep_only = true

[Naked Packer V1.X -> BigBoote]
signature = 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC
ep_only = true

[Nakedpack v1.0 -> BigBoote]
signature = 60 FC 0F ?? ?? ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?2 B0 5? ?? ?? ?? ?A 3? ?? ?? ?? ?? ?? ?? ?? ?? ?0 3? ?? ?? ?? ?? ?A 3? ?? ?? ?? ?E 89 A0 00 00 0A 3? ?? ?? ?? ?C 6? ?? ?? ?? ?? ?? ?8 3? ?? ?? ?? ?? ?0 07 50 76 1F F? ?? ?? ?? ?? ?6 1F F? ?? ?? ?6 A0 0F F? ?? ?? ?? ?? ?? ?F F? ?? ?? ?? ?? ?C 3
ep_only = true

[NakedPacker 1.0 - by BigBoote]
signature = 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01
ep_only = true

[Name of the Packer v1.0]
signature = 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3
ep_only = true

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40
ep_only = true

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00
ep_only = true

[nBinder v3.6.1]
signature = 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C
ep_only = true

[nBinder v4.0]
signature = 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79
ep_only = true

[nbuild v1.0 [soft]
signature = B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2
ep_only = true

[nCrypt 1.x (Cryptor InterFac) -> NEG]
signature = E9 95 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F1 BB 00 10 40 00 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB 00 00 00 00 75 05 BB 00 00 00 00 8A 23 30 C4 88 23 43 81 FB ?? ?? ?? ?? 75 89 1E 68 ?? ?? ?? ?? C3 BA C9 ?? ?? ?? 0F 10 02 BA 06 ?? ?? ?? 0F 11 02 BA ?? ?? ?? ?? 0F 10 02 BA ?? ?? ?? ?? 0F 11 02 64 8B 0D 20 00 00 00 EB 01 C
ep_only = true

[NE-Exe Executable Image]
signature = 4E 45
ep_only = true

[NeoLite v1.0]
signature = E9 9B 00 00 00 A0
ep_only = true

[NeoLite v1.0]
signature = 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74
ep_only = true

[Neolite v2.0]
signature = E9 A6 00 00 00
ep_only = true

[NeoLite v2.0]
signature = E9 A6
ep_only = true

[NeoLite v2.0]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75
ep_only = true

[NeoLite v2.00]
signature = E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32
ep_only = true

[NeoLite vx.x]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61
ep_only = true

[Netopsystems FEAD Optimizer]
signature = 60 BE 00 50 43 00 8D BE 00 C0 FC FF
ep_only = true

[Netopsystems FEAD Optimizer]
signature = E8 00 00 00 00 58 BB 00 00 40 00 8B
ep_only = true

[Next/Sun Audio file]
signature = 2E 73 6E 64
ep_only = true

[NFO v1.x modified]
signature = 60 9C 8D 50
ep_only = true

[NME 1.1 Public - by redlime]
signature = 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62
ep_only = true

[NME 1.1 Public - by redlime]
signature = 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B
ep_only = true

[NoName Packer]
signature = 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C
ep_only = true

[NoodleCrypt v2.0]
signature = EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01
ep_only = true

[NoodleCrypt v2.0]
signature = 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true

[NoodleCrypt v2.00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02
ep_only = true

[NoodleCrypt v2.00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00
ep_only = true

[North Star PE Shrinker 1.3 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5
ep_only = true

[North Star PE Shrinker v1.3 by Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D
ep_only = true

[North Star PE Shrinker v1.3 by Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01
ep_only = true

[Norton Speed Disk Configuration file]
signature = 4E 6F 72 74 6F 6E 20 53 70 65 65 64
ep_only = true

[NOTA Version 1.1 (c) Novitex 1990]
signature = EB J3 06 1E 33 C0 8E D8 BE ?? ?? 0E 07 BF ?? ?? B9 ?? ?? FC F3 A4 1F 8C D3 BE ?? ?? 8B D4 8E D6 BC ?? ?? 8B F4
ep_only = true

[nPack 1.1.150.2006.Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack 1.1.250.2006.Beta -> NEOx/[uinC]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3
ep_only = true

[nPack 1.1.300.2006 Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00
ep_only = true

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68
ep_only = true

[nPack v1.1 250 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.150.2006.Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3
ep_only = true

[nPack V1.1.150.2006.Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.200.2006.Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.275.2006.Beta -> NEOx   * Sign.By.fly * 200800212]
signature = 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack v1.1.300.2006 Beta]
signature = 83 3D 4C ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00
ep_only = true

[nPack V1.1.500.2008 Beta -> NEOx&nbsp; &nbsp;* Sign.By.fly]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3
ep_only = true

[NSIS Installer --> NullSoft]
signature = 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE
ep_only = true

[NSPack -> Nort Star Software - url:://www.nsdsn.com/]
signature = 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57
ep_only = true

[NsPacK .Net -> LiuXingPing]
signature = 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C
ep_only = true

[NsPack 1.4 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00
ep_only = true

[NsPack 1.4 by North Star (Liu Xing Ping)]
signature = 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53
ep_only = true

[nSPack 1.x/2.x -> North Star/Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D B8
ep_only = true

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36
ep_only = true

[nSPack 2.x -> North Star/Liu Xing Ping]
signature = FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01
ep_only = true

[nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping]
signature = FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[NsPack 3.0 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36
ep_only = true

[NsPack 3.0 by North Star (Liu Xing Ping)]
signature = FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[NsPack 3.1 -> North Star (h)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00
ep_only = true

[NsPack 3.1 by North Star (Liu Xing Ping)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00
ep_only = true

[NsPack 3.4 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00
ep_only = true

[NsPack 3.4 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5
ep_only = true

[NSPack 3.x -> Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01
ep_only = true

[NSPack 3.x -> Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D
ep_only = true

[nSpack V1.1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00
ep_only = true

[NsPack V1.3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00
ep_only = true

[NsPack V1.4 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00
ep_only = true

[NsPack v2.3 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61
ep_only = true

[NsPacK V3.0 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74
ep_only = true

[NsPacK V3.0 -> LiuXingPing]
signature = 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83
ep_only = true

[NsPacK V3.1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74
ep_only = true

[NsPack v3.1 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00
ep_only = true

[NsPacK V3.3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74
ep_only = true

[NsPacK V3.3 -> LiuXingPing]
signature = 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85
ep_only = true

[NsPacK V3.4-V3.5 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84
ep_only = true

[NsPacK V3.6 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00
ep_only = true

[NsPacK V3.7 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00
ep_only = true

[NsPack v3.7 -> North Star (h)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D
ep_only = true

[NTkrnl Secure Suite -> NTkrnl Team (Blue)]
signature = 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF
ep_only = true

[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = true

[NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true

[NTKrnlPacker -> Ashkbiz Danehkar]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true

[NTPacker 1.0 -> ErazerZ]
signature = 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31
ep_only = true

[NTPacker V2.X -> ErazerZ]
signature = 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00
ep_only = true

[Nullsoft Install System 1.xx]
signature = 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00
ep_only = true

[Nullsoft Install System 2.0]
signature = 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56
ep_only = true

[Nullsoft Install System 2.0 RC2]
signature = 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74
ep_only = true

[Nullsoft Install System 2.0a0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0
ep_only = true

[Nullsoft Install System v1.98]
signature = 83 EC 0C 53 56 57 FF 15 2C 81 40
ep_only = true

[Nullsoft Install System v1.98]
signature = 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75
ep_only = true

[Nullsoft Install System v1.xx]
signature = 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B
ep_only = true

[Nullsoft Install System v2.0a0]
signature = 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00
ep_only = true

[Nullsoft Install System v2.0b2, v2.0b3]
signature = 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15
ep_only = true

[Nullsoft Install System v2.0b4]
signature = 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43
ep_only = true

[Nullsoft PiMP Install System]
signature = 83 EC ?? 53 55 56
ep_only = true

[Nullsoft PIMP Install System v1.3x]
signature = 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD
ep_only = true

[Nullsoft PiMP Install System v1.x]
signature = 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00
ep_only = true

[Nullsoft PiMP Install System v1.x]
signature = 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F
ep_only = true

[Nullsoft PiMP Stub -> SFX]
signature = 81 EC ?? ?? ?? ?? 53 55 56
ep_only = true

[Nuts & Bolts Disk Image]
signature = 4E 42 69 6D
ep_only = true

[NX PE Packer v1.0]
signature = FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00
ep_only = true

[NX PE Packer v1.0]
signature = 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00
ep_only = true

[OAZ Fax Graphics format]
signature = 0F 0F 0F 0F 01 00 00 00
ep_only = true

[Obsidium 1.2.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 3F 1E 00 00
ep_only = true

[Obsidium 1.2.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00
ep_only = true

[Obsidium 1.2.5.0 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00
ep_only = true

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00
ep_only = true

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00
ep_only = true

[Obsidium 1.3.0.13 -> Obsidium Software]
signature = EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03
ep_only = true

[Obsidium 1.3.0.13 -> Obsidium Software]
signature = EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00
ep_only = true

[Obsidium 1.3.0.17 -> Obsidium software]
signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium 1.3.0.21 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00
ep_only = true

[Obsidium 1.3.0.37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00
ep_only = true

[Obsidium 1.3.1.1 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01
ep_only = true

[Obsidium 1.3.1.1 -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03
ep_only = true

[Obsidium 1.3.2.2 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04
ep_only = true

[Obsidium 1.3.3.1 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00
ep_only = true

[Obsidium 1.3.3.2 -> Obsidium Software]
signature = EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0
ep_only = true

[Obsidium 1.3.3.2 -> Obsidium Software]
signature = EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00
ep_only = true

[Obsidium 1.3.3.3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27
ep_only = true

[Obsidium 1.3.3.3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03
ep_only = true

[Obsidium 1.3.3.6 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04
ep_only = true

[Obsidium 1.3.3.6 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04
ep_only = true

[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00
ep_only = true

[Obsidium 1.3.3.7 -> Obsidium Software]
signature = EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00
ep_only = true

[Obsidium 1.3.3.8 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04
ep_only = true

[Obsidium 1.3.3.8 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00
ep_only = true

[Obsidium 1.3.3.9 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03
ep_only = true

[Obsidium 1.3.3.9 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00
ep_only = true

[Obsidium 1.3.4.1 -> Obsidium Software]
signature = EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33
ep_only = true

[Obsidium 1.3.4.1 -> Obsidium Software]
signature = EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00
ep_only = true

[Obsidium v1.0.0.59 Final]
signature = E8 AB 1C
ep_only = true

[Obsidium v1.0.0.61]
signature = E8 AF 1C 00 00
ep_only = true

[Obsidium v1.1.1.1]
signature = EB 02 ?? ?? E8 ?? 00 00 00
ep_only = true

[Obsidium V1.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 77 1E 00 00
ep_only = true

[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software]
signature = EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB
ep_only = true

[Obsidium V1.2.X -> Obsidium Software]
signature = E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00
ep_only = true

[Obsidium V1.25 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 ?? 00 00 00
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED
ep_only = true

[Obsidium v1.3.0.0 -> Obsidium Software (h)]
signature = EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD
ep_only = true

[Obsidium v1.3.0.37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27
ep_only = true

[Obsidium v1.3.0.37 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB
ep_only = true

[Obsidium v1.3.0.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00
ep_only = true

[Obsidium v1.3.0.4 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64
ep_only = true

[Obsidium V1.3.0.X -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3
ep_only = true

[Obsidium V1.3.2.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33
ep_only = true

[Obsidium v1.3.3.1 -> Obsidium Software (h)]
signature = EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04
ep_only = true

[Obsidium V1.3.3.3 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB
ep_only = true

[Obsidium V1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium V1.3.4.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00
ep_only = true

[Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly]
signature = EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50
ep_only = true

[Obsidium V1.3.5.0 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsidium V1.3.5.2 -> Obsidium Software   * Sign.By.fly]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8
ep_only = true

[Obsidium V1.3.5.3 -> Obsidium Software   * Sign.By.fly * 20080120]
signature = EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8
ep_only = true

[Obsidium V1.3.5.4 -> Obsidium Software   * Sign.By.fly * 200800207]
signature = EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00
ep_only = true

[Obsidium V1.3.5.5 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080411]
signature = EB 01 ?? E8 2B 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsidium V1.3.5.7 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080521]
signature = EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 03 ?? ?? ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsidium V1.3.6.0 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8
ep_only = true

[Obsidium V1.3.6.1 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080521]
signature = EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8
ep_only = true

[Obsidium V1.3.6.3 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly * 20080730]
signature = EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8
ep_only = true

[Obsidium V1.4.0.0.Beta -> Obsidium Software * Sign.By.fly * 20080102]
signature = EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8
ep_only = true

[Obsidium vx.x.x.x]
signature = E8 47 19
ep_only = true

[OLE2 Document (WinWord, Excel ...)]
signature = D0 CF 11 E0 A1 B1 1A E1
ep_only = true

[Open Source Code Crypter -> p0ke]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0
ep_only = true

[ORiEN 1.03 -> A. Fisun]
signature = E8 FD 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5B EB 01
ep_only = true

[ORiEN 2.01 -> A. Fisun]
signature = E9 5D 01 00 00
ep_only = true

[ORiEN 2.11 - 2.12 -> Fisun Alexander]
signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = true

[ORiEN V1.X-V2.X -> Fisun A.V.]
signature = 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D
ep_only = true

[ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly]
signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = true

[ORiEN v2.11 (DEMO)]
signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D
ep_only = true

[ORiEN v2.11 (DEMO)]
signature = E9 5D 01 00 00 CE D1 CE CD 0D
ep_only = true

[ORiEN v2.11 - 2.12 -> Fisun Alexander]
signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D
ep_only = true

[OS/2 Icon Graphics format]
signature = 43 49 4E 00 00 00
ep_only = true

[Overlay]
signature = 55 8B EC 83 C4 D4 53 56 57 33 C0 89 45 F0 89 45 E4 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22
ep_only = true

[Pack Master v1.0]
signature = 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true

[Pack Master v1.0]
signature = 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81
ep_only = true

[Packanoid -> Arkanoid]
signature = BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8
ep_only = true

[Packanoid 1.0 -> ackanoid]
signature = BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00
ep_only = true

[Packanoid 1.0 -> ackanoid]
signature = 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true

[Packanoid v1 --> Arkanoid]
signature = BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08
ep_only = true

[Packanoid v1 --> Arkanoid]
signature = BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00
ep_only = true

[Packed with: PKLITE v1.50 with CRC check (1)]
signature = 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[Packer=Petite v2.2 Compresor www.un4seen.com/petite]
signature = B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Packer=UPX Compresor..Gratuito... www.upx.sourceforge.net]
signature = 60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF
ep_only = true

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00
ep_only = true

[PackItBitch V1.0-> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Packman 0.0.0.1]
signature = 60 E8 ?? ?? ?? ?? 58 8D A8
ep_only = true

[Packman 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00
ep_only = true

[Packman 0.0.0.1 -> bubba]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true

[Packman 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Packman 0.0.0.1 -> Bubbasoft]
signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3
ep_only = true

[Packman Executable Image Packer 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF
ep_only = true

[Packman v0.0.0.1]
signature = 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48
ep_only = true

[Packman V0.0.0.1 -> Bubbasoft]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8
ep_only = true

[Packman V1.0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA
ep_only = true

[Packman v1.0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B
ep_only = true

[PACKWIN v1.01p]
signature = 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB
ep_only = true

[PassCOM v2.0 / PPC]
signature = E9 J1 J1 BE ?? ?? B9 ?? ?? 87 1C EB ?? FB FA 87 ?? ?? ?? 87 ?? ?? ?? FB 1F 58 4B EB ?? 50 1E 33 C0 8E D8 EB
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24
ep_only = true

[Password Protector (c) MiniSoft 1992]
signature = E9 J1 J1 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true

[Password Protector for the UPX 0.30 -> g0d]
signature = C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86
ep_only = true

[Password protector my SMT]
signature = E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74
ep_only = true

[Password protector my SMT]
signature = C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F
ep_only = true

[Patch Creation Wizard 1.2 Memory Patch]
signature = E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75
ep_only = true

[Patch Creation Wizard 1.2 Seek and Destroy Patch]
signature = 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01
ep_only = true

[Patch Creation Wizard v1.2 Byte Patch]
signature = E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54
ep_only = true

[Patch Creation Wizard v1.2 Memory Patch]
signature = 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00
ep_only = true

[Patch Creation Wizard v1.2 Seek and Destroy Patch]
signature = E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54
ep_only = true

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0
ep_only = true

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = true

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89
ep_only = true

[PC Shrinker v0.29]
signature = ?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40
ep_only = true

[PC Shrinker v0.29]
signature = ?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB
ep_only = true

[PC Shrinker v0.45]
signature = ?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40
ep_only = true

[PC Shrinker v0.71]
signature = 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D
ep_only = true

[PC-Guard v3.03d, v3.05d]
signature = 55 53 56 51 52 57 E8 16 00 00 00
ep_only = true

[PC-Guard v4.05d, v4.10d, v4.15d]
signature = FC 55 50 E8 00 00 00 00 5D EB 01
ep_only = true

[PC-Guard v5.00d]
signature = FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB
ep_only = true

[PCIENC Cryptor]
signature = 06 50 43 49 45 4E
ep_only = true

[PCPaint/Pictor graphics file format]
signature = 34 12 ?? ?? ?? ?? 00 00
ep_only = true

[PCPEC "alpha - preview"]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00
ep_only = true

[PCPEC [alpha]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83
ep_only = true

[PCrypt v3.51]
signature = 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9
ep_only = true

[PcShare ļ v4.0 -> ޿ɷ]
signature = 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1
ep_only = true

[PE Crypt 1.5 -> BitShape Software]
signature = 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[PE Crypt v1.00/v1.01]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44
ep_only = true

[PE Crypt32 (Console v1.0, v1.01, v1.02)]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true

[PE Crypt32 (Console v1.0, v1.01, v1.02)]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7
ep_only = true

[PE Crypt32 v1.02]
signature = E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21
ep_only = true

[PE Diminisher v0.1]
signature = 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99
ep_only = true

[PE Diminisher v0.1]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87
ep_only = true

[PE Diminisher v0.1]
signature = 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD
ep_only = true

[PE Diminisher v0.1]
signature = 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00
ep_only = true

[PE Diminisher V0.1 -> Teraphy]
signature = 53 51 52 56 57 55 E8 00 00 00 00
ep_only = true

[PE Encrypt 1.0 -> Liwuyue]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73
ep_only = true

[PE Intro v1.0]
signature = 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB
ep_only = true

[PE Lock NT v2.01]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60
ep_only = true

[PE Lock NT v2.02c]
signature = EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01
ep_only = true

[PE Lock NT v2.04]
signature = EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3
ep_only = true

[PE Lock NT v2.04]
signature = EB ?? ?? BE ?? ?? BF ?? ?? 2E
ep_only = true

[Pe Ninja -> +DzA kRAker [TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PE Ninja v1.0 -> +DzA kRAker TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PE Ninja v1.0 -> +DzA kRAker TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PE Pack v1.0]
signature = 74 ?? E9
ep_only = true

[PE Pack v1.0]
signature = 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D
ep_only = true

[PE Packer]
signature = FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10
ep_only = true

[PE Protect v0.9]
signature = 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
ep_only = true

[PE Protector 0.9.3 --> CRYPToCRACk]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00
ep_only = true

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D
ep_only = true

[PE Spin v0.b]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00
ep_only = true

[PE Spin v0.b]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C
ep_only = true

[PE-Armor 0.46 -> China Cracking Group]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC
ep_only = true

[PE-Armor 0.46 -> China Cracking Group]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41
ep_only = true

[PE-Armor 0.46 -> Hying]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = true

[PE-Armor 0.460-0.759 -> hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00
ep_only = true

[PE-Armor 0.49 -> Hying]
signature = 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00
ep_only = true

[PE-Armor 0.49 -> Hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00
ep_only = true

[PE-Armor V0.46 -> hying]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[PE-Crypt 1.02]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72
ep_only = true

[PE-Crypter]
signature = 60 E8 00 00 00 00 5D EB 26
ep_only = true

[PE-Crypter]
signature = 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9
ep_only = true

[PE-Exe Executable Image]
signature = 50 45 00 00
ep_only = true

[PE-PACK 1.0]
signature = 74 00 E9
ep_only = true

[PE-PACK 1.0]
signature = 50 FC AD 33 C2 AB 8B D0 E2 F8
ep_only = true

[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN]
signature = C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PE-PACK v1.0 by ANAKiN 1998 (???)]
signature = 74 ?? E9 ?? ?? ?? ?? 00 00 00 00
ep_only = true

[PE-PROTECT 0.9]
signature = E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PE-PROTECT 0.9]
signature = 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53
ep_only = true

[PE-SHiELD 0.2]
signature = 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[Pe123  v2006.4.12]
signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33
ep_only = true

[Pe123  v2006.4.12]
signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B
ep_only = true

[Pe123  v2006.4.4]
signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC
ep_only = true

[Pe123  v2006.4.4]
signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10
ep_only = true

[Pe123  v2006.4.4-4.12]
signature = 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? 45 ?? 50 E8 ?? FF FF FF ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 45
ep_only = true

[Pe123 v2006.4.12]
signature = 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3
ep_only = true

[PEArmor V0.7X -> Hying]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[PEBundle v0.2 - v2.0x]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95
ep_only = true

[PEBundle v0.2 - v2.0x]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD
ep_only = true

[PEBundle v2.44]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD
ep_only = true

[PEBundle v3.10]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01
ep_only = true

[PECompact 2.0beta/student version -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F
ep_only = true

[PECompact 2.0beta/student version ->Jeremy Collake]
signature = B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00
ep_only = true

[PECompact 2.0x Heuristic Mode -> Jeremy Collake]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PeCompact 2.53 DLL (Slim Loader) --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32
ep_only = true

[PeCompact 2.53 DLL --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PeCompact 2.53 DLL -> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D
ep_only = true

[PECompact 2.5x -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? FF E0
ep_only = true

[PECompact 2.x (beta version) ->Jeremy Collake]
signature = B8 ?? ?? ?? 00 80 00 28 40
ep_only = true

[PECompact 2.x -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
ep_only = true

[PeCompact 2.xx (Slim Loader) --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00
ep_only = true

[PeCompact 2.xx (Slim Loader) -> BitSum Technologies]
signature = B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PECompact v0.90]
signature = EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5
ep_only = true

[PECompact v0.92]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5
ep_only = true

[PECompact v0.94]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02
ep_only = true

[PECompact v0.94]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85
ep_only = true

[PECompact v0.977]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87
ep_only = true

[PECompact v0.977]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11
ep_only = true

[PECompact v0.978.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11
ep_only = true

[PECompact v0.978.2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85
ep_only = true

[PECompact v0.99]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85
ep_only = true

[PECompact v0.99]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63
ep_only = true

[PECompact v1.10b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60
ep_only = true

[PECompact v1.10b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[PECompact v1.10b3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95
ep_only = true

[PECompact v1.10b3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49
ep_only = true

[PECompact v1.10b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44
ep_only = true

[PECompact v1.10b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7
ep_only = true

[PECompact v1.10b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14
ep_only = true

[PECompact v1.20 - v1.20.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40
ep_only = true

[PECompact v1.22]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08
ep_only = true

[PECompact v1.22]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D
ep_only = true

[PECompact v1.23b3 - v1.24.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08
ep_only = true

[PECompact v1.23b3 - v1.24.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E
ep_only = true

[PECompact v1.24.2 - v1.24.3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09
ep_only = true

[PECompact v1.33]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E
ep_only = true

[PECompact v1.33]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12
ep_only = true

[PECompact v1.34 - v1.40b1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10
ep_only = true

[PECompact v1.40 - v1.45]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11
ep_only = true

[PECompact v1.40b2 - v1.40b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11
ep_only = true

[PECompact v1.40b2 - v1.40b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12
ep_only = true

[PECompact v1.46]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12
ep_only = true

[PECompact v1.47 - v1.50]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12
ep_only = true

[PECompact v1.60 - v1.65]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12
ep_only = true

[PECompact v1.66]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11
ep_only = true

[PECompact v1.67]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11
ep_only = true

[PECompact v2.0]
signature = B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90
ep_only = true

[PECompact v2.0]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D
ep_only = true

[PECompact v2.0 beta -> Jeremy Collake]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PECompact v2.00 alpha 38]
signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00
ep_only = true

[PeCompact2 2.53-2.76 --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF
ep_only = true

[PECrc32 0.88 -> ZhouJinYu]
signature = 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00
ep_only = true

[PECrc32 0.88 -> ZhouJinYu]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC
ep_only = true

[PEcrypt - by archphase]
signature = 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF
ep_only = true

[PEEncrypt v4.0b (JunkCode)]
signature = 66 ?? ?? 00 66 83 ?? 00
ep_only = true

[PEEncrypt v4.0b (JunkCode)]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24
ep_only = true

[PEiD-Bundle 1.02 DLL -> BoB / BobSoft]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00
ep_only = true

[PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft]
signature = 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft]
signature = 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9
ep_only = true

[PEiD-Bundle v1.00 --> BoB / BobSoft]
signature = 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.01 --> BoB / BobSoft]
signature = 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.02 - v1.03 --> BoB / BobSoft]
signature = 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[PEiD-Bundle v1.02 - v1.04 --> BoB / BobSoft]
signature = 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[Pelles C 2.90 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = true

[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74
ep_only = true

[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB
ep_only = true

[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = true

[Pelles C 4.50 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75
ep_only = true

[PEMangle]
signature = 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3
ep_only = true

[PEMangle]
signature = 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61
ep_only = true

[PEncrypt 2.0 -> junkcode]
signature = EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0
ep_only = true

[PEncrypt 2.0 -> junkcode]
signature = EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85
ep_only = true

[PEncrypt v3.0]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA
ep_only = true

[PEncrypt v3.1]
signature = E9 ?? ?? ?? 00 F0 0F C6
ep_only = true

[PEncrypt v3.1]
signature = E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9
ep_only = true

[PEnguinCrypt v1.0]
signature = B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0
ep_only = true

[PEnguinCrypt v1.0]
signature = B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB
ep_only = true

[PENinja]
signature = 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90
ep_only = true

[PENinja modified]
signature = 5D 83 ED 06 EB 02 EA 04 8D
ep_only = true

[PEQuake 0.06-> forgat]
signature = E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00
ep_only = true

[PEQuake V0.06 -> forgat]
signature = E8 A5 00 00 00
ep_only = true

[PEQuake V0.06 -> forgat]
signature = E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[PEQuake v0.06 -> forgot/us (h)]
signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64
ep_only = true

[PEQuake v0.06 -> forgot/us (h)]
signature = E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8
ep_only = true

[PEQuake v0.06 by fORGAT]
signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB
ep_only = true

[PEQuake V0.06-> forgot]
signature = E8 A5 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C2 08 00
ep_only = true

[PESHiELD v0.2 / v0.2b / v0.2b2]
signature = 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[PESHiELD v0.25]
signature = 60 E8 2B 00 00 00
ep_only = true

[PEShit]
signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF
ep_only = true

[PEShit]
signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01
ep_only = true

[PESpin 1.0 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin 1.1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESPin 1.3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin 1.304 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin 1.3beta -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08
ep_only = true

[PESpin v0.1 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF
ep_only = true

[PESpin v0.1 -> Cyberbob (h)]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08
ep_only = true

[PESpin V0.1 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? B9 A5 08 00 00 8D ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC
ep_only = true

[PESpin v0.3 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00
ep_only = true

[PESpin V0.41 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 02 D2 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 ?? 68 3C 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 59 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 ?? E8 1A 00 00 00
ep_only = true

[PESpin v0.7 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00
ep_only = true

[PESpin v0.7 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00
ep_only = true

[PESpin V0.7 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 01 ?? 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB ?? 83 04 24 0C C3
ep_only = true

[PESpin V0.71 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E
ep_only = true

[PESpin V0.71 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3
ep_only = true

[PESpin V0.b -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0
ep_only = true

[PESpin v1.0 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00
ep_only = true

[PESpin V1.0 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080312]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3
ep_only = true

[PESpin V1.1 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E
ep_only = true

[PESpin v1.1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8E P_ ON LY =T RU E
ep_only = true

[PESpin v1.1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8
ep_only = true

[PESpin V1.1 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080311]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB
ep_only = true

[PESpin v1.1 by cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C
ep_only = true

[PESPin v1.3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A
ep_only = true

[PESpin V1.3.betaX -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080311]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3
ep_only = true

[PESpin v1.304 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 0E P_ ON LY =T RU E
ep_only = true

[PESpin v1.304 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin v1.304 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 0
ep_only = true

[PESpin V1.304 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080310]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 ?? ?? ?? ?? EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3
ep_only = true

[PESpin V1.32 -> cyberbob&nbsp; &nbsp;* Sign.By.fly * 20080310]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 17 E6 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D FF E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF E8 02 00 00 00 ?? ?? 5A 81 ?? ?? ?? ?? ?? 83 EA FE 89 95 A9 57 40 00 2B C0 2B C9 83 F1 06 09 85 CB 57 40 00 9C D3 2C 24 80 C1 FB 21 0C 24 50 52 B8 36 C7 09 FF 05 FE 37 F6 00 F7 64 24 08 8D 84 28 B1 35 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC CD 20 BB 69 74 58 0B C1 C3
ep_only = true

[PeStubOEP v1.x]
signature = 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3
ep_only = true

[Petite 1.2]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00
ep_only = true

[Petite 1.2]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02
ep_only = true

[Petite 1.3]
signature = 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1
ep_only = true

[Petite 1.3]
signature = ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03
ep_only = true

[Petite 1.3 -> (c)1998 Ian Luck (h)]
signature = ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3
ep_only = true

[Petite 1.4]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6
ep_only = true

[Petite 1.4 -> (c)1998-99 Ian Luck]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3
ep_only = true

[Petite 1.4 -> (c)1998-99 Ian Luck (h)]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = true

[Petite 2.1]
signature = 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8
ep_only = true

[Petite 2.2 -> (c)1998-99 Ian Luck]
signature = ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66
ep_only = true

[Petite 2.2 -> (c)1998-99 Ian Luck (h)]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42
ep_only = true

[Petite v1.4]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00
ep_only = true

[PEtite v1.4]
signature = ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40
ep_only = true

[PEtite v2.0]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68
ep_only = true

[PEtite v2.1]
signature = B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v2.1 (1)]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[PEtite v2.2]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v2.2 -> www.un4seen.com/petite]
signature = B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Petite v?.? (after v1.4)]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83
ep_only = true

[PEtite vx.x]
signature = B8 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[PeX 0.99 -> bart^CrackPl]
signature = E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PEX v0.99]
signature = E9 F5 00 00 00
ep_only = true

[PEX v0.99]
signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00
ep_only = true

[PEZip v1.0 by BaGIE]
signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6
ep_only = true

[PEZip v1.0 by BaGIE]
signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51
ep_only = true

[PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[PE_Protector V2.60hying's PE-Armor V0.460 modify -> Engprog * Sign.By.fly]
signature = 55 53 51 52 56 57 E8 E1 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 0B 00 00 00 8B 9D 9B 00 00 00 03 9D 9F 00 00 00 0B DB 74 14 8B 83 7F 46 00 00 03 83 87 46 00 00 5F 5E 5A 59 5B 5D FF E0 8D 75 43 56 FF 55 54 8D B5 A3 00 00 00 56 50 FF 55 50 89 85 B0 00 00 00 8D 75 43 56 FF 55 54 8D B5 B4 00 00 00 56 50 FF 55 50 89 85 C0 00 00 00 8D 75 43 56 FF 55 54 8D B5 C4 00 00 00 56 50 FF 55 50 89 85 D0 00 00 00 6A 40 68 00 10 00 00 FF B5 97 00 00 00 6A 00 FF 95 B0 00 00 00 89 85 9B 00 00 00 55 8D 9D F2 01 00 00 53 8D 9D CC 01 00 00 FF D3 8B 74 24 04 8B 7C 24 0C F7 46 04 07 00 00 00 75 08 81 3E 27 00 00 C0 75 06 B8 00 00 00 00 C3
ep_only = true

[PGMPACK v0.13]
signature = FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true

[PGPROT]
signature = E9 J1 J1 2E ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 0E 1F 8C C0 01 ?? ?? ?? 01 ?? ?? ?? 26 ?? ?? ?? ?? 07 32 C0 33 FF B9 ?? ?? F2 AE
ep_only = true

[PH Icons file (Trilobyte)]
signature = 69 63 6F 6E 01 00 10 00 10
ep_only = true

[Phar Lap DOS Extender 1986-91]
signature = EB J3 8C D8 8E C0 B8 ?? ?? 8E D8 BB ?? ?? 8C C0 2B D8 81 ?? ?? ?? B4 4A CD 21
ep_only = true

[Phoenix Protector v1.0/v1.1 -> NTCore.com]
signature = 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF 07 73 ?? ?? ?? 0A 38 E5 FF FF FF
ep_only = true

[Phonebook configuration file Version %v3.%v4]
signature = 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? V3 ?? V4 ?? 63 6F
ep_only = true

[Phonebook configuration file Version %v3.%v4]
signature = 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF
ep_only = true

[Phonebook packed datafile]
signature = 21 50 48 32 50 41 43 4B 24
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF
ep_only = true

[PKLITE v1.00, v1.03]
signature = B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B
ep_only = true

[PKLITE v1.00c (1)]
signature = 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE
ep_only = true

[PKLITE v1.00c (2)]
signature = BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90
ep_only = true

[PKLITE v1.12, v1.15, v1.20 (1)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20
ep_only = true

[PKLITE v1.12, v1.15, v1.20 (2)]
signature = B8 ?? ?? BA ?? ?? 3B C4 73
ep_only = true

[PKLITE v1.14, v1.15, v1.20 (3)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F
ep_only = true

[PKLITE v1.14, v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20
ep_only = true

[PKLITE v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21
ep_only = true

[PKLITE v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 8B FC 81 ?? ?? ?? 57 57 52 B9 ?? ?? BE ?? ?? 8B FE FD 49 74 ?? AD 92 03 C2
ep_only = true

[PKLITE v1.20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 2D ?? ?? FA 8E D0 BC ?? ?? FB 2D ?? ?? 50 52 80
ep_only = true

[PKLITE v1.20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 8B FC 81 ?? ?? ?? 57 57 52 80
ep_only = true

[PKLITE v1.50 (Device driver compression)]
signature = B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB
ep_only = true

[PKLITE v2.00b [extra]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80
ep_only = true

[PKLITE v2.00c]
signature = 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC
ep_only = true

[PKLITE32 1.1]
signature = 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9
ep_only = true

[PKLITE32 1.1]
signature = 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true

[PKLITE32 v1.1]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8
ep_only = true

[PKLITE32 v1.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true

[PKLITE32 v1.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC
ep_only = true

[PKLITE32 v1.1]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32
ep_only = true

[Pksmart 1.0b]
signature = BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3
ep_only = true

[PKZIP Archive]
signature = 50 4B 03 04
ep_only = true

[PLINK86 1984, 1985]
signature = FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26
ep_only = true

[PluginToExe v1.00 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00
ep_only = true

[PluginToExe v1.01 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00
ep_only = true

[PluginToExe v1.02 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00
ep_only = true

[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]
signature = FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4
ep_only = true

[PMW1 Executable Image (using DOSExtender)]
signature = 50 4D 57 31
ep_only = true

[PNG Graphics format]
signature = 89 50 4E 47 0D 0A 1A 0A
ep_only = true

[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00
ep_only = true

[PocketPC ARM]
signature = F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1
ep_only = true

[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9
ep_only = true

[PocketPC ARM]
signature = 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 01 3C ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF
ep_only = true

[PocketPC SHA]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 00 08 D0 05 D4 06 D5 0B 40 09 00 10 7F 26 4F
ep_only = true

[PocketPC SHA]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09
ep_only = true

[Pohernah 1.0.0 - by Kas]
signature = 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah 1.0.1 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.2 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.3 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.3 - by Kas]
signature = 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28
ep_only = true

[Pohernah Crypter V1.0.1 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah Crypter V1.0.1 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED
ep_only = true

[Pohernah Crypter V1.0.2 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah Crypter V1.0.2 -> Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24
ep_only = true

[PolyBox C -> Anskya]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11
ep_only = true

[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations]
signature = 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB
ep_only = true

[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]
signature = 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45
ep_only = true

[PolyCryptor by SMT Version %v3.%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29
ep_only = true

[PolyCryptor by SMT Version %v3.%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 V3 ?? V4 20 62 79 20 53 4D 54 29
ep_only = true

[PoPa 0.01 (Packer on Pascal) -> bagie]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF
ep_only = true

[Portable BitMap (PBM) Graphics format]
signature = 50 36 0A
ep_only = true

[PowerBASIC/CC 3.0x]
signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85
ep_only = true

[PowerBASIC/CC 4.0]
signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03
ep_only = true

[PowerBASIC/Win 7.0x]
signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00
ep_only = true

[PowerBASIC/Win 8.00]
signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02
ep_only = true

[PPC-PROTECT 1.0 -> Alexey Gorchakov]
signature = FF 5F 2D E9
ep_only = true

[PPC-PROTECT 1.1X -> Alexey Gorchakov]
signature = FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5
ep_only = true

[Prepared by SLR (OPTLINK)]
signature = 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F
ep_only = true

[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]
signature = 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56
ep_only = true

[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]
signature = 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08
ep_only = true

[Private EXE Protector 1.8]
signature = BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0
ep_only = true

[Private exe Protector 1.8X-1.9X -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00
ep_only = true

[Private Exe Protector 1.x -> setisoft]
signature = B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3
ep_only = true

[Private EXE Protector 2.0 -> SetiSoft]
signature = 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF
ep_only = true

[Private exe Protector 2.0 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[Private exe Protector 2.15 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00
ep_only = true

[Private exe Protector V1.8 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[Private exe Protector V2.30-V2.3X -> SetiSoft Team   * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Private EXE v2.0a]
signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B
ep_only = true

[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = true

[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8
ep_only = true

[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]
signature = E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = true

[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00
ep_only = true

[PrivateEXE v2.0a]
signature = 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E
ep_only = true

[PRO-MIDI Music file]
signature = 52 49 46 46 ?? ?? ?? ?? 52 4D 49 44
ep_only = true

[PRO-PACK v2.08]
signature = 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53
ep_only = true

[PRO-PACK v2.08]
signature = 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B
ep_only = true

[ProActivate V1.0X -> TurboPower Software Company]
signature = 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33
ep_only = true

[Program Protector XP v1.0]
signature = 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D
ep_only = true

[Program Protector XP v1.0]
signature = E8 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[Protect Shareware V1.1 -> eCompserv CMS]
signature = 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00
ep_only = true

[PROTECT! EXE/COM v4.0]
signature = E9 J1 J1 E8 ?? ?? 5D 81 ED ?? ?? 33 C0 8E D8 8B F0 BF ?? ?? B9 ?? ?? FC F3 A5
ep_only = true

[PROTECT! EXE/COM v5.0]
signature = 1E 0E 0E 1F 07
ep_only = true

[Protection Plus vx.x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A
ep_only = true

[Protection Plus vx.x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85
ep_only = true

[PS-AdobeFont v.1.0]
signature = 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A
ep_only = true

[pscrambler 1.2 -> by p0ke]
signature = 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65
ep_only = true

[PseudoSigner 0.1 -> Anorganix]
signature = 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC
ep_only = true

[PseudoSigner 0.1 [ACProtect 1.09]
signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Borland Delphi 3.0]
signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]
signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]
signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9
ep_only = true

[PseudoSigner 0.1 [Morphine 1.2]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Neolite 2.0]
signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9
ep_only = true

[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]
signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9
ep_only = true

[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04
ep_only = true

[PUNiSHER V1.5 Demo-> FEUERRADER]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00
ep_only = true

[QinYingShieldLicense V1.0X-V1.21 -> Lei Peng * Sign.By.fly * 20080122]
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 FE B9 FE 00 00 00 00 00 00 00
ep_only = true

[QrYPt0r - by NuTraL]
signature = 80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01
ep_only = true

[QuickLink II Fax Graphics format]
signature = 51 4C 49 49 46 41 58 20
ep_only = true

[R!SC's Process Patcher 1.5.1]
signature = E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92
ep_only = true

[R!SC's Process Patcher v1.4]
signature = E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03
ep_only = true

[R!SC's Process Patcher v1.5.1]
signature = 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05
ep_only = true

[R-CRYPT v0.91]
signature = E9 J1 J1 68 ?? ?? 60 BF ?? ?? B9 ?? ?? B0 ?? 2E ?? ?? FE C0 47 E2 ?? 61 C7 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C3
ep_only = true

[RAR Archive]
signature = 52 61 72 21
ep_only = true

[RAR Configuration file]
signature = 52 41 52 20 43 4F 4E 46 49 47
ep_only = true

[RAR SFX]
signature = E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90
ep_only = true

[RatPacker (Glue) stub]
signature = 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF
ep_only = true

[RAZOR 1911 encruptor]
signature = E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true

[RCC II/286 v1.02]
signature = FA BD J2 J2 93 C8 ?? ?? ?? 54 62 E9
ep_only = true

[RCC II/286 v1.14 (hard)]
signature = FA BD J2 J2 B2 ?? 50 3F F2
ep_only = true

[RCC II/286 v1.14 (mild)]
signature = FA BD J2 J2 BE ?? ?? 9C 46 30 ?? ?? ?? 99
ep_only = true

[RCC II/386 v0.51]
signature = FA BC J2 J2 FE ?? ?? 0E 1F 3E ?? ?? ?? ?? ?? 3E ?? ?? ?? ?? ?? B8 ?? ?? CD 21 06 53 B8 ?? ?? CD 21 06 53 8B D5 8C C8 8E D8 B8 ?? ?? CD 21 8B D5 B8 ?? ?? CD 21 CD 01 9C
ep_only = true

[RCryptor 1.5 -> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)]
signature = 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3
ep_only = true

[RCryptor 1.6c -> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)]
signature = 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3
ep_only = true

[RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3
ep_only = true

[RCryptor 2.0 -> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3
ep_only = true

[RCryptor 2.0 -> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF
ep_only = true

[RCryptor v1.1 -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3
ep_only = true

[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50
ep_only = true

[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7
ep_only = true

[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.5 (Private) --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2
ep_only = true

[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68
ep_only = true

[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB
ep_only = true

[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68
ep_only = true

[RCryptor V1.6d -> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6x --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3
ep_only = true

[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68
ep_only = true

[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v2.0 --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD
ep_only = true

[RCryptor V2.0 Private -> Vaska&nbsp; &nbsp;* Sign.By.fly]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3
ep_only = true

[RCryptor V2.0 Private -> Vaska&nbsp; &nbsp;* Sign.By.fly]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF 59 BA ?? ?? ?? ?? F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF C0 0A ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 80 32 ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? ?? 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET] (h1)]
signature = 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85
ep_only = true

[Real Networks Video/Audio file]
signature = 2E 52 4D 46
ep_only = true

[REC v0.34 [3]
signature = 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true

[REC.Small v1.01]
signature = 8C D8 1E E8 J1 J1 5D 83 ?? ?? 81 ?? ?? ?? B9 ?? ?? 40 8E D8 2B DB B2 55
ep_only = true

[REC.Small v1.02]
signature = 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83
ep_only = true

[Reflexive Arcade Wrapper]
signature = 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF
ep_only = true

[Reflexive Arcade Wrapper]
signature = 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8
ep_only = true

[Reg2Exe 2.20/2.21 - by Jan Vorel]
signature = 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8
ep_only = true

[Reg2Exe 2.22/2.23 - by Jan Vorel]
signature = 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8
ep_only = true

[Reg2Exe 2.22/2.23 - by Jan Vorel]
signature = 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00
ep_only = true

[Reg2Exe 2.24 - by Jan Vorel]
signature = 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16
ep_only = true

[Reg2Exe 2.24 - by Jan Vorel]
signature = 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00
ep_only = true

[Reg2Exe 2.25 - by Jan Vorel]
signature = 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35
ep_only = true

[Reg2Exe 2.25 - by Jan Vorel]
signature = 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00
ep_only = true

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? :3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9 ?? ?? ?? 80 74 0E 51 56 25 ?? ?? ?? 7F 03 C3 8B F0 42 EB B2 51 03 C3 8B 38 03 FD 8B 48 04 D2 0F 30 0F 47 E2 F9 59 E2 AF 4A 74 04 5E 59 EB F7 8D 85 ?? ?? ?? ?? 5D FF E:
ep_only = true

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? :3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9 ?? ?? ?? 80 74 0E 51 56 25 ?? ?? ?? 7F 03 C3 8B F0 42 EB B2 51 03 C3 8B 38 03 FD 8B 48 04 D2 0F 30 0F 47 E2 F9 59 E2 AF 4A 74 04 5E 59 EB F7 8D 85 ?? ?? ?? ?? 5D FF E
ep_only = true

[ResCrypt v1.02]
signature = 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98
ep_only = true

[ReversingLabsProtector 0.7.4 beta -> Ap0x]
signature = 68 00 00 41 00 E8 01 00 00 00 C3 C3
ep_only = true

[RIX graphics file]
signature = 52 49 58 33
ep_only = true

[RJoiner 1.2 by Vaska (25.03.2007 16:58)]
signature = 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46
ep_only = true

[RJoiner 1.2a -> Vaska]
signature = 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00
ep_only = true

[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]
signature = E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10
ep_only = true

[RLP V0.7.3.beta -> ap0x]
signature = 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0
ep_only = true

[RLP V0.7.3.beta -> ap0x ! Sign by fly]
signature = 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56
ep_only = true

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A
ep_only = true

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5
ep_only = true

[RLPack 1.1 BasicEdition -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68
ep_only = true

[RLPack 1.18 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]
signature = 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.19 Basic Edition]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 ?? ?? 00 00 EB 0C
ep_only = true

[RLPack 1.20 Basic Edition [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00
ep_only = true

[RLPack 1.20 Basic Edition [LZMA]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83
ep_only = true

[RLPack Full Edition 1.17 (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
ep_only = true

[RLPack Full Edition 1.17 -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF
ep_only = true

[RLPack Full Edition 1.17 DLL (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34
ep_only = true

[RLPack Full Edition 1.17 DLL (LZMA)]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85
ep_only = true

[RLPack Full Edition 1.17 DLL -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true

[RLPack Full Edition 1.17 DLL [aPLib]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75
ep_only = true

[RLPack Full Edition 1.17 iBox (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
ep_only = true

[RLPack Full Edition 1.17 iBox [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34
ep_only = true

[RLPack FullEdition V1.20 (aPlib 0.43) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00
ep_only = true

[RLPack FullEdition V1.20 (BasicEdition Stub) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00
ep_only = true

[RLPack FullEdition V1.20 (LZMA 4.30) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00
ep_only = true

[RLPack V1.0.beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.11 -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.12 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.12 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60
ep_only = true

[RLPack V1.15-V1.16 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.15-V1.16 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14
ep_only = true

[RLPack V1.15-V1.17 Dll -> ap0x]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true

[RLPack V1.18 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68
ep_only = true

[RLPack v1.18 Basic DLL [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A
ep_only = true

[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83
ep_only = true

[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A
ep_only = true

[RLPack V1.18 Basic Edition (aPlib 0.43)  -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74
ep_only = true

[RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00
ep_only = true

[RLPack V1.18 Basic Edition (LZMA 4.30)  -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00
ep_only = true

[RLPack v1.18 Basic [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6
ep_only = true

[RLPack v1.18 Basic [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83
ep_only = true

[RLPack V1.18 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3
ep_only = true

[RLPack V1.19 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76
ep_only = true

[RLPack V1.19 Dll (aPlib 0.43) -> ap0x]
signature = 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x  * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA
ep_only = true

[RLPack V1.20 (aPlib 0.43) -> ap0x   * Sign.By.fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.20 (LZMA 4.30) -> ap0x   * Sign.By.fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.20 Dll (aPlib 0.43) -> ap0x   * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 6F 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.20 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;* Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 (aPlib 0.43) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 (LZMA 4.30) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 80 7C 24 08 01 0F 85 74 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.21 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;* Sign.By.fly * 20080504]
signature = 80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3
ep_only = true

[ROD High TECH -> Ayman]
signature = 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00
ep_only = true

[ROD High TECH -> Ayman]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36
ep_only = true

[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]
signature = 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1
ep_only = true

[RTPatch software update package data file]
signature = 4B 2A
ep_only = true

[S3M music file]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 53 43 52 4D
ep_only = true

[SA2 Adlib Module music file]
signature = 53 41 64 54
ep_only = true

[Safe 2.0]
signature = 83 EC 10 53 56 57 E8 C4 01 00
ep_only = true

[Safedisc V4.50.000 -> Macrovision Corporation * Sign.By.fly * 20080117]
signature = 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ?? ?? ?? FF 10 61 5D EB 47 80 7C 24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ?? 89 4C 24 04 59 EB 29 50 B8 FD ?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04 FF D0 58 B8 25 ?? ?? ?? FF 30 C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74 05 E9 91 FE FF FF C3
ep_only = true

[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]
signature = 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57
ep_only = true

[Safeguard 1.0 - 1.01 -> Simonzh]
signature = E8 00 00 00 00 EB 29
ep_only = true

[Safeguard 1.03 -> Simonzh]
signature = E8 ?? 00 00 00
ep_only = true

[SafeGuard V1.0X -> simonzh2000]
signature = E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1
ep_only = true

[Sc Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D 00
ep_only = true

[Sc Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00
ep_only = true

[SciFax Graphics file]
signature = 44 54 3D 00
ep_only = true

[Scitech Software Display Driver]
signature = 56 42 45 41 46 2E 44 52 56
ep_only = true

[Scodl Graphics format]
signature = E0 01 ?? 00 ?? ?? 00
ep_only = true

[SCRAM! v0.8a1]
signature = B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C
ep_only = true

[SCRAM! vC5]
signature = B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true

[SCRAMB v1.20]
signature = E9 J1 J1 E8 ?? ?? 5B 0E 1F 81 ?? ?? ?? 8B C3 05 ?? ?? 50 8B C8 03 D1 2B FA C3
ep_only = true

[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF
ep_only = true

[SDProtect -> Randy Li]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00
ep_only = true

[SDProtect -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05
ep_only = true

[SDProtector 1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1
ep_only = true

[SDProtector 1.x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SDProtector 1.x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41
ep_only = true

[SDProtector Basic/Pro Edition 1.10 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00
ep_only = true

[SDProtector Basic/Pro Edition 1.10 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64
ep_only = true

[SDProtector Basic/Pro Edition 1.12 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2
ep_only = true

[SDProtector Pro 1.12]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3
ep_only = true

[SDProtector Pro Edition 1.16 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8
ep_only = true

[SDProtector Pro Edition 1.16 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41
ep_only = true

[SDProtector V1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1
ep_only = true

[SDW v1.74]
signature = E9 J1 J1 54 5B 3B DC 75 ?? EB ?? 9C 5B 81 ?? ?? ?? 53 9D 9C 58
ep_only = true

[SEA-AXE]
signature = FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5
ep_only = true

[SEA-AXE]
signature = FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3
ep_only = true

[SecureEXE 3.0 -> ZipWorx]
signature = E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[SecurePE 1.X]
signature = 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3
ep_only = true

[SecuROM V7.X -> Sony DADC * Sign.By.fly * 20080114]
signature = 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 6C 24 1C C1 E2 00 8B 6C 24 0C 83 C4 18 9D ?? 74 12 81 04 24 ?? ?? ?? ?? ?? 81 04 24 C3 D1 FF 00 EB FA 6B 81 04 24 ?? ?? ?? ?? 0F AC F8 00 81 04 24 C2 04 00 3E FF 74 24 04 9D EB F5 EE 93 9D
ep_only = true

[Securom7 -> Sony DADC]
signature = B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8
ep_only = true

[SEN Debug Protector???]
signature = 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55
ep_only = true

[Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet]
signature = 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15
ep_only = true

[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]
signature = A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8
ep_only = true

[Sentinel SuperPro Dongle V5.42.0.0 -> Rainbow Technologies * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E DF 80 E8 ?? ?? ?? ?? 68 B9 10 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 12 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 07 2A A3 00 E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 88 B5 5B FF E8 ?? ?? ?? ?? 68 B9 30 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68
ep_only = true

[Sentinel UltraPro Dongle V1.1.0 -> SafeNet Inc. * Sign.By.fly]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 04 83 F8 64 7C E7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 8B 4D 00 83 C5 08 ?? ?? ?? ?? ?? ?? ?? 66 8B 75 FA ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B 55 FC 81 E1 FF FF 00 00 81 F9
ep_only = true

[Setup Factory 6.x Custom]
signature = 55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[Setup Factory v6.0.0.3 Setup Launcher]
signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45
ep_only = true

[Setup2Go Installer Stub]
signature = 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72
ep_only = true

[Sexe Crypter 1.1 - by santasdad]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79
ep_only = true

[SGI Image Graphics format]
signature = 01 DA 00 01 00 03
ep_only = true

[Sharp GPB Graphics format]
signature = 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00
ep_only = true

[Shegerd Dongle V4.78 -> MS.Co.]
signature = E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C
ep_only = true

[ShellModify 0.1 -> pll621]
signature = 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00
ep_only = true

[SHOWV20 Show-Text Utility]
signature = E9 J1 J1 B8 ?? ?? 2B ?? ?? ?? A3 ?? ?? E8 ?? ?? E8 ?? ?? E8
ep_only = true

[Shrink v1.0]
signature = 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3
ep_only = true

[Shrink Wrap v1.4]
signature = 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB
ep_only = true

[Shrinker 3.2]
signature = 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04
ep_only = true

[Shrinker 3.3]
signature = 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = true

[Shrinker 3.4]
signature = 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04
ep_only = true

[Shrinker v3.2]
signature = 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF
ep_only = true

[Sierra`s audio file]
signature = 8D 0C 53 4F 4C 00 22 56 0D
ep_only = true

[Signature = Safe 2.0]
signature = SA FE 2. 0
ep_only = true

[Silicon Realms Install Stub]
signature = 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05
ep_only = true

[Silicon Realms Install Stub]
signature = 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3
ep_only = true

[SimbiOZ -> Extranger]
signature = 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00
ep_only = true

[SimbiOZ 1.3 -> Extranger]
signature = 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3
ep_only = true

[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption]
signature = 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption]
signature = 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1
ep_only = true

[Simple UPX Cryptor v30.4.2005 [One layer encryption]
signature = 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true

[SimplePack 1.0X -> bagie]
signature = 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0
ep_only = true

[SimplePack 1.11 Method 1 -> bagie[TMX]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5
ep_only = true

[SimplePack 1.11 Method 1 -> bagie[TMX]]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC
ep_only = true

[SimplePack 1.11 Method 2(NT) -> bagie[TMX]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB
ep_only = true

[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01
ep_only = true

[SimplePack V1.1X (Method1) -> bagie]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0
ep_only = true

[SimplePack V1.1X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00
ep_only = true

[SimplePack V1.1X-V1.2X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00
ep_only = true

[SimplePack V1.21.build.09.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = true

[SimplePack V1.X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = true

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00
ep_only = true

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74
ep_only = true

[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]
signature = 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40
ep_only = true

[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]
signature = 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD
ep_only = true

[SLR (OPTLINK)]
signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21
ep_only = true

[SLR (OPTLINK)]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = true

[SLVc0deProtector 0.60 -> SLV / ICU]
signature = EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD
ep_only = true

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00
ep_only = true

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C
ep_only = true

[SLVc0deProtector v0.6 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90
ep_only = true

[SLVc0deProtector v0.61 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00
ep_only = true

[SmartE -> Microsoft]
signature = EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06
ep_only = true

[SMK movie file]
signature = 53 4D 4B 32
ep_only = true

[SND music file]
signature = 00 00 F8 2A ?? 00
ep_only = true

[SnoopStop v1.15]
signature = ?? E9 J1 J1 EB ?? 20 ?? ?? ?? 73 ?? 20 ?? ?? 41 1A 05
ep_only = true

[Soft Defender 1.1x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44
ep_only = true

[Soft Defender v1.0 - v1.1]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8
ep_only = true

[Soft Defender v1.0 - v1.1]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Soft Defender v1.12]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8
ep_only = true

[SoftComp 1.x -> BG Soft PT]
signature = E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00
ep_only = true

[SoftDefender 1.x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00
ep_only = true

[SoftProtect -> SoftProtect.by.ru]
signature = E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83
ep_only = true

[SoftProtect -> SoftProtect.by.ru]
signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C
ep_only = true

[SoftProtect -> www.softprotect.by.ru]
signature = E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01
ep_only = true

[SoftSentry v2.11]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 50
ep_only = true

[Software Compress -> BG Software]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00
ep_only = true

[Software Compress -> BG Software]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true

[Software Compress V1.2 ->  BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00
ep_only = true

[Software Compress V1.2 ->  BG Software Protect Technologies   * Sign.By.fly]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00
ep_only = true

[Software Compress v1.2 -> BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24
ep_only = true

[Software Compress V1.2 -> BG Software Protect Technologies]
signature = E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90
ep_only = true

[Software Compress V1.4 ->  BG Software Protect Technologies   * Sign.By.fly]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3
ep_only = true

[Software Compress v1.4 LITE -> BG Software Protect Technologies]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A
ep_only = true

[Software Compress v1.4 LITE -> BG Software Protect Technologies]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04
ep_only = true

[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F
ep_only = true

[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF
ep_only = true

[Solidshield Protector V1.X -> Solidshield Technologies * Sign.By.fly]
signature = 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00
ep_only = true

[Solidshield Protector V1.X DLL -> Solidshield Technologies * Sign.By.fly]
signature = 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF FF 83 FE 02 57 8B 7D 10 75 53 FF 75 24 FF 75 20 FF 75 1C FF 75 18 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 20 3C 01 75 04 8B C6 EB 6A 57 FF 75 0C E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 14 3C 01 74 DF 6A 03 5E 83 FE 03 75 1B 57 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 6A 00 FF 15 ?? ?? ?? ?? 83 FE 04 75 0D FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 59 59 83 FE 05 75 11 FF 75 30 FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 83 C4 0C 33 C0 5F 5E 5D C3
ep_only = true

[Spalsher 1.0 - 3.0 -> Amok]
signature = 9C 60 8B 44 24 24 E8 00 00 00 00
ep_only = true

[Spalsher 1.0 - 3.0 -> Amok]
signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC
ep_only = true

[Spalsher v1.0 - v3.0]
signature = 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84
ep_only = true

[Special EXE Password Protector 1.0 -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00
ep_only = true

[Sphinx C-- v?.?? 19??]
signature = E9 J1 J1 B4 34 CD 21 8C 06 ?? ?? 89 1E ?? ?? B8 ?? ?? E8 ?? ?? B8 ?? ?? BB
ep_only = true

[Sphinx C-- v?.?? 19??]
signature = EB J3 31 C0 8E C0 26 C7 06 ?? ?? ?? ?? 26 8C 0E ?? ?? E9
ep_only = true

[Splash Bitmap v1.00 (With Unpack Code) --> BoB / Bobsoft]
signature = E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40
ep_only = true

[Splash Bitmap v1.00 --> BoB / Bobsoft]
signature = E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00
ep_only = true

[Splice 1.1 - by Tw1sted L0gic]
signature = 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76
ep_only = true

[SQZ Archive]
signature = 48 4C 53 51 5A
ep_only = true

[ST Protector V1.5 -> Silent Software]
signature = 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC
ep_only = true

[StarForce -> Protection Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[StarForce 3.0 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 63
ep_only = true

[StarForce 3.0 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 57
ep_only = true

[StarForce ProActive 1.1 -> StarForce Technology]
signature = 53 55 8B E8 33 DB EB 60
ep_only = true

[StarForce V1.X-V3.X -> StarForce Copy Protection System]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00
ep_only = true

[StarForce V3.X DLL -> StarForce Copy Protection System]
signature = E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21
ep_only = true

[Ste@lth PE 1.01 -> BGCorp]
signature = ?? ?? ?? ?? ?? BA ?? ?? ?? 00
ep_only = true

[Stirling Archive]
signature = 13 5D 65 8C 3A
ep_only = true

[Stone's PE Encryptor v1.0]
signature = 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00
ep_only = true

[Stone's PE Encryptor v1.13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28
ep_only = true

[Stone`s PE Encruptor v1.13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81
ep_only = true

[Stony Brook Pascal v6.14]
signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A
ep_only = true

[Stranik 1.3 Modula/C/Pascal]
signature = E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Stranik 1.3 Modula/C/Pascal]
signature = E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB
ep_only = true

[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]
signature = 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00
ep_only = true

[SuckStop v1.11]
signature = EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B
ep_only = true

[SuckStop v1.11]
signature = 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4
ep_only = true

[Sun Icon Graphics format]
signature = 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C
ep_only = true

[Sun Raster Graphics format]
signature = 59 A6 6A 95
ep_only = true

[SuperDAT]
signature = 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23
ep_only = true

[SVK Protector v1.3x (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SVK-Protector v1.43 -> www.anticracking.sk]
signature = 78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05 6
ep_only = true

[SVKP v1.32 -> Pavol Cerven (h)]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61
ep_only = true

[SVKP v1.42 -> Pavol Cerven (h)]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67
ep_only = true

[SVKP v1.43 -> Pavol Cerven (h)]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67
ep_only = true

[SWAG Archive]
signature = ?? ?? 2D 73 77 31 2D
ep_only = true

[Symantec C v2.10, v4.00 or Zortech C v3.0r1]
signature = FA FC B8 ?? ?? 8E D8
ep_only = true

[Symantec C v4.00 + Libraries]
signature = FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26
ep_only = true

[Symantec Visual Cafe v3.0]
signature = 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15
ep_only = true

[Symantec WinFax PRO 8.3 Coverpage]
signature = 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C
ep_only = true

[SysPack v0.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? J2 J2 0E 2E ?? ?? ?? ?? 06 53 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? 74 ?? 26 ?? ?? ?? ?? ?? 5B 07
ep_only = true

[T-PACK v0.5c -m1]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE
ep_only = true

[T.P.C's COM Scrambler v1.00]
signature = ?? ?? ?? ?? ?? ?? ?? EB J3 2E ?? ?? ?? ?? 8E C0 8C D8 BE ?? ?? BF ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 0E 07 B9 ?? ?? FC F3 A4 CC
ep_only = true

[TaiShanXiangYu LockSoft V1.0 -> zlocksoft * Sign.By.fly]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8B D5 81 ?? ?? ?? ?? ?? 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[TAV]
signature = E8 ?? ?? 4D 5A CB
ep_only = true

[tElock 0.51 -> tE!]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74
ep_only = true

[tElock 0.96 -> tE!]
signature = E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C
ep_only = true

[tElock 0.98 -> tE!]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65
ep_only = true

[tElock 0.98 Special Build -> forgot & heXer]
signature = E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA
ep_only = true

[tElock 0.99 - 1.0 private -> tE!]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[tElock 0.99 - 1.0 private -> tE!]
signature = E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5
ep_only = true

[tElock 0.99 -> tE!]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05
ep_only = true

[tElock 0.99c (Private ECLIPSE) -> tE!]
signature = E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65
ep_only = true

[tElock v0.42]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true

[tElock v0.4x - v0.5x]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true

[tElock v0.70]
signature = 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70
ep_only = true

[tElock v0.71]
signature = 60 E8 ED 10 00 00 C3 83
ep_only = true

[tElock v0.71b2]
signature = 60 E8 44 11 00 00 C3 83
ep_only = true

[tElock v0.7x - v0.84]
signature = 60 E8 00 00 C3 83
ep_only = true

[tElock v0.7x - v0.84]
signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[tElock v0.92a]
signature = E9 7E E9 FF FF 00
ep_only = true

[tElock v0.92a]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00
ep_only = true

[tElock v0.95]
signature = E9 D5 E4 FF FF 00
ep_only = true

[tElock v0.96]
signature = E9 59 E4 FF FF 00
ep_only = true

[tElock v0.96]
signature = E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3
ep_only = true

[tElock v0.98]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E
ep_only = true

[tElock v0.98b1]
signature = E9 25 E4 FF FF
ep_only = true

[tElock v0.98b2]
signature = E9 1B E4 FF FF
ep_only = true

[tElock v0.99]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 77 ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[tElock v0.99 -> tE! [TMD]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[tElock v1.00]
signature = E9 E5 E2 FF FF
ep_only = true

[The aPE Inline Patch Basic, Advanced, Stealth)]
signature = B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68
ep_only = true

[The aPE Inline Patch ExtraStealth, SuperStealth)]
signature = E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
ep_only = true

[The Best Cryptor -> FsK   * Sign.By.fly]
signature = EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90
ep_only = true

[The Norton Antivirus Information file]
signature = 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65
ep_only = true

[The WiZ Cryptor v1.00a by SP0T //UCL]
signature = E9 J1 J1 FA 60 56 1E 8E D8 BE ?? ?? BF ?? ?? B8 ?? ?? 87 ?? ?? ?? AB 8C C8 87 ?? ?? ?? AB 1F 68 ?? ?? 9C 58 80 ?? ?? 50 9D FC
ep_only = true

[TheHyper's protector -> TheHyper]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8
ep_only = true

[TheHyper's protector -> TheHyper (h)]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D
ep_only = true

[TheHyper's protector -> TheHyper (h)]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D
ep_only = true

[Themida -> Oreans Technologies 2004]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8
ep_only = true

[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01
ep_only = true

[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = true

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60
ep_only = true

[Themida 1.2.0.1 (compressed) -> Oreans Technologies]
signature = B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = true

[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]
signature = B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[Themida 1.2.0.1 -> Oreans Technologies (h)]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00
ep_only = true

[Themida 1.8.x.x - 1.9.x.x -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9
ep_only = true

[Themida 1.8.x.x -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67
ep_only = true

[Themida 1.9.2.0]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9
ep_only = true

[Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00
ep_only = true

[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9
ep_only = true

[Themida/WinLicense V1.8.0.2 +  -> Oreans Technologies]
signature = B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00
ep_only = true

[Themida/WinLicense V1.8.X-V1.9.X  -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9
ep_only = true

[Themida/WinLicense V1.8.X-V1.9.X Other -> Oreans Technologies * Sign.By.fly * 20080131]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58
ep_only = true

[theWRAP - by TronDoc]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7
ep_only = true

[Thinstall 2.403 -> Jitit]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF
ep_only = true

[Thinstall 2.4x - 2.5x -> Jitit Software]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8
ep_only = true

[Thinstall 2.4x - 2.5x -> Jitit Software]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD
ep_only = true

[Thinstall 2.5xx -> Jtit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A
ep_only = true

[Thinstall 2.628 -> Jtit]
signature = E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3
ep_only = true

[Thinstall 2.736 -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00
ep_only = true

[Thinstall 3.035 -> Jtit]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3
ep_only = true

[Thinstall 3.035 -> Jtit]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00
ep_only = true

[Thinstall Embedded 1.9X -> Jitit]
signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00
ep_only = true

[Thinstall Embedded 2.0X -> Jitit]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

[Thinstall Embedded 2.2X-2.308 -> Jitit]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

[Thinstall Embedded 2.312 -> Jitit]
signature = 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

[Thinstall Embedded 2.422-2.428 -> Jitit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = true

[Thinstall Embedded 2.501 -> Jitit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = true

[Thinstall Embedded 2.545 -> Jitit]
signature = E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00
ep_only = true

[Thinstall Embedded 2.547-V2.600 -> Jitit]
signature = E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00
ep_only = true

[Thinstall Embedded 2.609 -> Jitit]
signature = E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00
ep_only = true

[Thinstall Embedded 2.620-2.623 -> Jitit]
signature = E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00
ep_only = true

[Thinstall Embedded 2.717-2.719 -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00
ep_only = true

[Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true

[Thinstall Embedded V2.312 -> Jitit ! Sign by fly]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true

[Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly]
signature = 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true

[Thinstall V2.403 -> Jitit]
signature = 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39
ep_only = true

[Thinstall V2.403 -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D
ep_only = true

[Thinstall v2.460 -> Jitit]
signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E
ep_only = true

[Thinstall V2.7X -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
ep_only = true

[Thinstall V2.7X -> Jitit]
signature = 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0
ep_only = true

[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB
ep_only = true

[Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB
ep_only = true

[Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00
ep_only = true

[Thinstall Virtualization Suite 3.0X -> Thinstall Company]
signature = 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA
ep_only = true

[Thinstall Virtualization Suite 3.0X -> Thinstall Company]
signature = 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB
ep_only = true

[Thinstall Virtualization Suite 3.0xx -> Jitit Software]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4
ep_only = true

[Thinstall Virtualization Suite V3.10X -> Thinstall Company]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9
ep_only = true

[Thinstall vx.x]
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33
ep_only = true

[Thunderbolt V0.02 -> deXep (forgot) * Sign.By.fly]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3
ep_only = true

[TIFF Graphics file (IBM)]
signature = 49 49 2A
ep_only = true

[TIFF Graphics file (Macintosh)]
signature = 4D 4D 00
ep_only = true

[Tiny Xor v0.1]
signature = E9 J1 J1 FC B8 ?? ?? BB ?? ?? B9 ?? ?? BE ?? ?? 30 04 02 C3 86 C4 86 DF 46 E2 ?? BE ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 33 C0 33 DB 33 C9 FF E6
ep_only = true

[TINYPROG v3.6, v3.9]
signature = E9 J1 J1 EB ?? C3
ep_only = true

[TLink v%v5.%v6]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 00 FB V5
ep_only = true

[TMT-Pascal's Unit file]
signature = 50 00 00 00 53 50 46 50
ep_only = true

[TopSpeed v3.01 1989]
signature = 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53
ep_only = true

[TPACK v1.7 Archive]
signature = ?? 54 50 41 43 ?? 31 2E 37
ep_only = true

[TPPpack -> clane]
signature = E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8
ep_only = true

[Trainer Creation Kit v5 Trainer]
signature = 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF
ep_only = true

[Trainer Creation Kit v5 Trainer]
signature = 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40
ep_only = true

[Trap v1.21]
signature = E8 J1 J1 5B 83 ?? ?? ?? 8B D3 E8 ?? ?? ?? 5B 2E ?? ?? ?? 74 ?? ?? ?? 8B DA B9 ?? ?? EB
ep_only = true

[Trilobyte's JPEG graphics Library]
signature = 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00
ep_only = true

[Trilobyte's RNR graphics library]
signature = 84 10 ?? ?? ?? ?? ?? ?? ?? 10
ep_only = true

[Trivial173 by SMT/SMF]
signature = EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29
ep_only = true

[TrueType Font file]
signature = 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48
ep_only = true

[TrueType Font file]
signature = 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32
ep_only = true

[TrueVision Targa Graphics format]
signature = 00 00 02 00 00 00 00 00
ep_only = true

[TSCRUNCH v3.01]
signature = EB J3 06 1E 55 57 56 52 51 53 50 16 1F 0E 07 8B F4
ep_only = true

[TTPpack]
signature = E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05
ep_only = true

[Turbo Basic v1.0 1987]
signature = 2E 8C ?? ?? ?? 2E C7
ep_only = true

[Turbo C]
signature = 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06
ep_only = true

[Turbo C 1987]
signature = FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA
ep_only = true

[Turbo C 1987]
signature = FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21
ep_only = true

[Turbo C 1988]
signature = 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC
ep_only = true

[Turbo C 1990 or Turbo C 1988]
signature = BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA
ep_only = true

[Turbo C or Borland C++]
signature = BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA
ep_only = true

[Turbo or Borland Pascal v7.0]
signature = 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68
ep_only = true

[Turbo or Borland Pascal v7.x Unit]
signature = 54 50 55 51 00
ep_only = true

[Turbo Pascal Configuration File]
signature = 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E
ep_only = true

[Turbo Pascal Desktop File]
signature = 54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70
ep_only = true

[Turbo Pascal Help File]
signature = 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50
ep_only = true

[Turbo Pascal v2.0 1984]
signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34
ep_only = true

[Turbo Pascal v3.0 1985]
signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35
ep_only = true

[Turbo Pascal v4.0 Unit]
signature = 54 50 55 30 00
ep_only = true

[Turbo Pascal v5.0 Unit]
signature = 54 50 55 35 00
ep_only = true

[Turbo Pascal v5.5 Unit]
signature = 54 50 55 36 00
ep_only = true

[Turbo Pascal v6.0 Unit]
signature = 54 50 55 39 00
ep_only = true

[Turbo Pascal Version 3.0 1985]
signature = E9 J1 J1 E8 ?? ?? 06 00 ?? ?? ?? 4B 8E 04 85 00 00 04 ?? ?? ?? ?? ?? ?? 80 ?? ?? EC E8 ?? ?? 45 1B ?? ?? ?? A6
ep_only = true

[TurboBAT v3.10 .. 5.0]
signature = BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4
ep_only = true

[TXT2COM]
signature = E8 ?? ?? CD 20
ep_only = true

[TXT2COM (Read-A-Matic v1.0)]
signature = B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21
ep_only = true

[TXT2COM v2.06]
signature = 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20
ep_only = true

[TXTMaker v1.22]
signature = EB J3 B4 ?? 33 DB CD 10 80 ?? ?? 74 ?? B0 ?? EB ?? 8B
ep_only = true

[UCEXE v2.3, v2.4]
signature = 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB
ep_only = true

[UCOMCRY]
signature = E9 J1 J1 60 06 FA E4 64 0C 40 E6 64 B8 ?? ?? 8E C0 26
ep_only = true

[Ultra Compressor`s Archive]
signature = 55 43 32 1A
ep_only = true

[UltraPro V1.0 -> SafeNet]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15
ep_only = true

[UnderGround Crypter - by Booster2000]
signature = 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0
ep_only = true

[UNITA3 (tm) by Sanitary Equipment Research]
signature = E8 ?? ?? 4D 5A 3E
ep_only = true

[Unknown by SMT]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB
ep_only = true

[Unknown encryptor (2) - "PK7Tjrvx"]
signature = 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8
ep_only = true

[Unknown encryptor (3)]
signature = ?? ?? ?? E9 J1 J1 1E 06 8C D8 05 ?? ?? 8E D8 8E C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8B E8 2E
ep_only = true

[Unknown file protector]
signature = EB J3 BE ?? ?? BF ?? ?? 2E
ep_only = true

[Unknown Joiner (sign from pinch 26.03.2007 02:12)]
signature = 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80
ep_only = true

[Unknown packer (02)]
signature = FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB
ep_only = true

[Unknown packer (03)]
signature = 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C
ep_only = true

[Unknown packer (04)]
signature = BC ?? ?? C3 2E FF 2E ?? ?? CF
ep_only = true

[Unknown packer (05)]
signature = FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27
ep_only = true

[Unknown packer (06)]
signature = FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC
ep_only = true

[Unknown packer (07)]
signature = 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83
ep_only = true

[Unknown packer (08)]
signature = 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F
ep_only = true

[Unknown Packer -> Northfox]
signature = 54 59 68 61 7A 79
ep_only = true

[Unknown Protected Mode compiler (1)]
signature = FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1
ep_only = true

[Unknown Protected Mode compiler (2)]
signature = FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3
ep_only = true

[Unknown SFX Archive (aWAW)]
signature = 61 57 41 57
ep_only = true

[Unknown SFX Archive (IDSKA32)]
signature = 69 64 73 6B 61 33 32
ep_only = true

[Unknown SFX Archive (MRI)]
signature = 4D 52 49
ep_only = true

[Unknown UPX modifyer]
signature = E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3
ep_only = true

[Unknown UPX or File modifyer]
signature = E8 02 00 00 00 CD 03 5A 81 C2 86 EA FE FF 81 C2 45 23 01 00 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3
ep_only = true

[Unnamed Scrambler 1.1C -> p0ke]
signature = 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF
ep_only = true

[Unnamed Scrambler 1.2B -> p0ke]
signature = 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10
ep_only = true

[Unnamed Scrambler 1.2C / 1.2D -> p0ke]
signature = 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65
ep_only = true

[Unnamed Scrambler 1.3B -> p0ke]
signature = 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10
ep_only = true

[Unnamed Scrambler 1.3B -> p0ke]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF
ep_only = true

[Unnamed Scrambler 1.3B -> p0ke]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00
ep_only = true

[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]
signature = 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74
ep_only = true

[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]
signature = 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8
ep_only = true

[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]
signature = 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8
ep_only = true

[UnoPiX 0.75 -> BaGiE]
signature = 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61
ep_only = true

[UnoPiX 1.03-1.10 -> BaGiE]
signature = 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00
ep_only = true

[UnoPiX 1.03-1.10 -> BaGiE]
signature = 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10
ep_only = true

[Unpacked BS-SFX Archive v1.9]
signature = 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73
ep_only = true

[Unpacked BS-SFX Archive v1.9]
signature = 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8
ep_only = true

[Upack 0.10 - 0.12 beta -> Dwing]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1
ep_only = true

[Upack 0.12 beta -> Dwing]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7
ep_only = true

[Upack 0.12 beta-->Dwing]
signature = BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1
ep_only = true

[Upack 0.1x -> Dwing]
signature = BE 48 01 40 00 AD 8B F8
ep_only = true

[Upack 0.1x / 0.20 / 0.21 / 0.24 beta -> Dwing]
signature = BE ?8 01 40 00 AD 8B F8
ep_only = true

[Upack 0.1x / 0.20 / 0.21 / 0.24 beta -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33
ep_only = true

[Upack 0.20 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3
ep_only = true

[Upack 0.20 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00
ep_only = true

[Upack 0.22 - 0.23 -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD
ep_only = true

[Upack 0.22 - 0.23 beta -> Dwing]
signature = ?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00
ep_only = true

[Upack 0.22 - 0.23 beta -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5
ep_only = true

[Upack 0.24 - 0.27 beta / 0.28 alpha -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0
ep_only = true

[Upack 0.2x -> Dwing]
signature = BE 88 01 40 00 AD 8B F8
ep_only = true

[Upack 0.2x beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95
ep_only = true

[Upack 0.38 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true

[Upack 0.399 -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true

[Upack V0.10-V0.11 -> Dwing]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5
ep_only = true

[Upack V0.10-V0.12 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0
ep_only = true

[UPack v0.11]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7
ep_only = true

[Upack v0.1x - v0.2x -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 95
ep_only = true

[Upack V0.1X-V0.2X -> Dwing]
signature = 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C
ep_only = true

[Upack v0.2 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33
ep_only = true

[Upack V0.20 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00
ep_only = true

[Upack V0.21 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00
ep_only = true

[Upack V0.22-V0.23 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 6A 07 BE ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00
ep_only = true

[Upack v0.24 ~ v0.28 Alpha -> Dwing]
signature = BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD
ep_only = true

[Upack V0.24-V0.28 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C
ep_only = true

[Upack v0.28 - 0.39 (relocated image base - Delphi, .NET, DLL or something else :) -> Dwing (h)]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C
ep_only = true

[Upack V0.28-V0.399 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0
ep_only = true

[Upack v0.29 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29
ep_only = true

[Upack v0.29 Beta ~ v0.31 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3
ep_only = true

[Upack v0.30 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30
ep_only = true

[Upack v0.31 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31
ep_only = true

[Upack v0.32 Beta (Patch) -> Dwing]
signature = BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5
ep_only = true

[Upack v0.35 alpha -> Dwing]
signature = 8B F2 8B CA 03 4C 19 1C 03 54 1A 20
ep_only = true

[Upack V0.36 -> Dwing]
signature = BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00
ep_only = true

[Upack V0.36 -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01
ep_only = true

[Upack V0.36 -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[Upack v0.36 alpha -> Dwing]
signature = AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0
ep_only = true

[Upack v0.36 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B
ep_only = true

[Upack V0.36-V0.37 (DLL) -> Dwing]
signature = 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E
ep_only = true

[Upack V0.36-V0.37 (DLL) -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00
ep_only = true

[Upack V0.37 -> Dwing]
signature = BE ?? ?? ?? ?? AD 50 FF ?? ?? EB
ep_only = true

[Upack v0.37 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F
ep_only = true

[Upack V0.37-V0.39 -> Dwing]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00
ep_only = true

[Upack v0.38 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F
ep_only = true

[Upack v0.39 final -> Dwing]
signature = FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF
ep_only = true

[Upack v0.39 final -> Sign by hot_UNP]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true

[Upack v0.399 -> Dwing]
signature = 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5
ep_only = true

[Upack v0.399 -> Dwing]
signature = 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00
ep_only = true

[Upack v0.399 -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50
ep_only = true

[Upack_Patch -> Dwing]
signature = 81 3A 00 00 00 02 00 00 00 00
ep_only = true

[Upack_Patch or any Version -> Dwing]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02
ep_only = true

[Upack_Patch or any Version -> Sign by hot_UNP]
signature = 60 E8 09 00 00 00 17 CD 00 00 E9 06 02
ep_only = true

[UPolyX 0.x -> Delikon]
signature = 81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75
ep_only = true

[UPolyX V0.1 -> Delikon]
signature = E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[UPX -> www.upx.sourceforge.net]
signature = 60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF
ep_only = true

[UPX 0.50 - 0.70]
signature = 60 E8 00 00 00 00 58 83 E8 3D
ep_only = true

[UPX 0.72]
signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E
ep_only = true

[UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]
signature = 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF
ep_only = true

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90
ep_only = true

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04
ep_only = true

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB
ep_only = true

[UPX 2.93 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90
ep_only = true

[UPX Alternative stub]
signature = B9 ?? ?? BE ?? ?? BF C0 FF FD
ep_only = true

[UPX Inliner v1.0 by GPcH]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D
ep_only = true

[UPX Inliner v1.0 by GPcH]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01
ep_only = true

[UPX Modified stub]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9
ep_only = true

[UPX Modified stub]
signature = 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD
ep_only = true

[UPX Modified Stub b -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9
ep_only = true

[UPX Modified Stub b -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC
ep_only = true

[UPX Modified Stub b -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB
ep_only = true

[UPX Modified Stub c -> Farb-rausch Consumer Consulting]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48
ep_only = true

[UPX Protector v1.0x]
signature = EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[UPX v0.51]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90
ep_only = true

[UPX v0.51]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[UPX v0.62]
signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58
ep_only = true

[UPX v0.62]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07
ep_only = true

[UPX v0.70]
signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB
ep_only = true

[UPX v0.71 [DLL]
signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83
ep_only = true

[UPX v0.72]
signature = 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB
ep_only = true

[UPX v0.76.1 [dos exe]
signature = B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC
ep_only = true

[UPX v0.80 - v0.84]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC
ep_only = true

[UPX v0.80 - v0.84]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC
ep_only = true

[UPX v0.81 - v0.84 Modified]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF
ep_only = true

[UPX v0.89.6 - v1.02 / v1.05 - v1.22]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75
ep_only = true

[UPX v0.89.6 - v1.02 / v1.05 - v1.22]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD
ep_only = true

[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true

[UPX v1.03 - v1.04]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF
ep_only = true

[Upx v1.2 -> Marcus & Lazlo]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83
ep_only = true

[UPX V1.94 -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = true

[UPX v2.0 -> Markus, Laszlo & Reiser (h)]
signature = 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = true

[UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = true

[UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00
ep_only = true

[UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56
ep_only = true

[UPX$HiT 0.0.1 -> DJ Siba]
signature = E2 FA 94 FF E0 61 00 00 00 00 00 00 00
ep_only = true

[UPX$HiT v0.0.1]
signature = 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61
ep_only = true

[Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft]
signature = 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61
ep_only = true

[UPX-SCRAMBLER 3.06 -> OnToL]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6
ep_only = true

[UPX-Scrambler RC v1.x]
signature = 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E
ep_only = true

[UPX-Shit 0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? <S PA NS TY LE =" FO NT -W EI GH T: BO LD "> 01 </ SP AN >? ?? ?? ?0 05 55 05 82 D5 36 86 97 42 07 63 02 E3 12 02 D2 07 77 77 72 E6 26 C6 16 36 B6 C6 F6 76 96 32 E6 E6 57 42 02 D2 06 36 F6 46 52 06 27 92 05 B3 53 03 06 D6 87 A5 D
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79
ep_only = true

[UPX-Shit v0.1 -> 500mhz]
signature = E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00
ep_only = true

[UPXFreak v0.1 (Borland Delphi) -> HMX0101]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00
ep_only = true

[UPXFreak V0.1 -> HMX0101]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00
ep_only = true

[UPXLock v1.1 -> CyberDoom & Bob]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60
ep_only = true

[UPXShit 0.06]
signature = B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF
ep_only = true

[USCC v1.4]
signature = E9 J1 J1 60 BB ?? ?? B9 ?? ?? 30 0F 43 E2 ?? 5D F5 F5 FC EF EE FA 4B 9E
ep_only = true

[USERNAME v3.00]
signature = E9 J1 J1 E8 ?? ?? 5D 83 ?? ?? FA FC 33 F6 8E DE BF ?? ?? 03 FD B9 ?? ?? F3 A4 8B FC
ep_only = true

[USERNAME v3.00]
signature = FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6
ep_only = true

[USSR 0.31 - by Spirit]
signature = E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3
ep_only = true

[USSR V0.31 -> SpiritST]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[v.02Packer -> tt.t]
signature = 60 E8 36 FE FF FF C3 90 ?? 00
ep_only = true

[VBOX v4.2 MTE]
signature = 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5
ep_only = true

[VBOX v4.3 - v4.6]
signature = ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40
ep_only = true

[VC8 -> Microsoft Corporation]
signature = E8 ?? ?? ?? ?? E9 ?? ?? FF FF
ep_only = true

[vcasm 1.0 - 1.1 -> vcasm]
signature = EB 01 9A 60
ep_only = true

[VcAsm Protector -> VcAsm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3
ep_only = true

[VcAsm Protector V1.0X-> VcAsm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00
ep_only = true

[Vcasm Protector V1.X -> vcasm]
signature = EB ?? 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true

[Vcasm-Protector 1.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9
ep_only = true

[Vcasm-Protector 1.0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
ep_only = true

[Vcasm-Protector 1.0a - 1.0d -> vcasm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00
ep_only = true

[Vcasm-Protector 1.0e -> vcasm]
signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true

[Vcasm-Protector 1.1 - 1.2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true

[Vcasm-Protector 1.1 - 1.2 -> vcasm]
signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00
ep_only = true

[vfp&exeNc V5.00 -> Wang JianGuo]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC
ep_only = true

[Video-Lan-Client]
signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[Virogen Crypt v0.75]
signature = 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01
ep_only = true

[Virogen Crypt v0.75]
signature = 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74
ep_only = true

[Virtual Image Maker Graphics file]
signature = 53 4F 4D 56
ep_only = true

[VIRUS - I-Worm.Bagle]
signature = 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40
ep_only = true

[VIRUS - I-Worm.Bagle]
signature = 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00
ep_only = true

[VIRUS - I-Worm.Hybris]
signature = EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15
ep_only = true

[VIRUS - I-Worm.KLEZ]
signature = 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0
ep_only = true

[VisualUPX 0.2 -> emadicius]
signature = 66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF
ep_only = true

[VITec graphics file format]
signature = 00 5B 07 20 00 00 00 2C
ep_only = true

[VMProtect 0.7x - 0.8 -> PolyTech]
signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D
ep_only = true

[VMProtect 0.x -> PolyTech]
signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20
ep_only = true

[VMProtect 1.06..1.07 -> PolyTech]
signature = 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8
ep_only = true

[VMProtect v1.25 --> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52
ep_only = true

[VOB ProtectCD]
signature = 36 3E 26 8A C0 60 E8
ep_only = true

[VPacker -> ttui]
signature = 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60
ep_only = true

[VProtector -> vcasm]
signature = 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC
ep_only = true

[VProtector 1.0X -> vcasm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00
ep_only = true

[VProtector 1.0X -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00
ep_only = true

[VProtector 1.1X -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3
ep_only = true

[vprotector 1.2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00
ep_only = true

[vprotector 1.2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00
ep_only = true

[vprotector 1.2 -> vcasm (h)]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
ep_only = true

[vprotector 1.3 -> vcasm]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68
ep_only = true

[VProtector 1.3X -> vcasm]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00
ep_only = true

[VProtector V1.0 [Build 2004.12.13]
signature = 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.0A -> vcasm]
signature = 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.0B -> vcasm]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.0D -> vcasm]
signature = 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

[VProtector V1.1 -> vcasm]
signature = B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00
ep_only = true

[VProtector V1.3X -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00
ep_only = true

[Vterminal V1.0X -> Lei Peng]
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00
ep_only = true

[Vterminal V1.0X -> Lei Peng]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68
ep_only = true

[Vterminal V1.0X -> Lei Peng]
signature = 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72
ep_only = true

[Vx: ACME (Clonewar Mutant)]
signature = FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE
ep_only = true

[Vx: Agiplan.1536]
signature = E9 J1 J1 50 B0 ?? BA ?? ?? EE BA ?? ?? EC 3C ?? 76 ?? E9 ?? ?? B8 ?? ?? CD 21 8C D8 8E C0 83 ?? ?? 75 ?? E9 ?? ?? BA ?? ?? B8 ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[Vx: ARCV.4]
signature = E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06
ep_only = true

[Vx: August 16th (Iron Maiden)]
signature = BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02
ep_only = true

[Vx: Backfont.900]
signature = E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83
ep_only = true

[Vx: Caterpillar.1575]
signature = EB J3 06 1E 8C C0 0E 1F 0E 07 A3 ?? ?? 8C D0 A3 ?? ?? B0 ?? E6 20 FC ?? C0 8E D8 ?? F6 BF ?? ?? B9 ?? ?? F2 A4 1E 17
ep_only = true

[Vx: Caz.1204]
signature = E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10
ep_only = true

[Vx: Compiler]
signature = 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E
ep_only = true

[Vx: Eddie.1530]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E
ep_only = true

[Vx: Eddie.1800]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E
ep_only = true

[Vx: Eddie.2000]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21
ep_only = true

[Vx: Eddie.2100]
signature = E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC
ep_only = true

[Vx: Eddie.based.1745]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8
ep_only = true

[Vx: EVC.161]
signature = E9 J1 J1 06 FA 33 DB 8E C3 26 ?? ?? ?? ?? 8F ?? ?? ?? 26 ?? ?? ?? ?? 8F ?? ?? ?? B8 21 25 BA ?? ?? CD 21 FB 07 BA ?? ?? CD 27
ep_only = true

[Vx: Explosion.1000]
signature = E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8
ep_only = true

[Vx: FaxFree.Topo]
signature = FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB
ep_only = true

[Vx: Gotcha.879]
signature = E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21
ep_only = true

[Vx: Grazie.883]
signature = 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21
ep_only = true

[Vx: GRUNT.1.Family]
signature = 01 B9 ?? 00 31 17
ep_only = true

[Vx: Hafen.1641]
signature = E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC
ep_only = true

[Vx: Hafen.809]
signature = E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D
ep_only = true

[Vx: Heloween.1172]
signature = E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D
ep_only = true

[Vx: Horse.1776]
signature = E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07
ep_only = true

[Vx: Hymn.1865]
signature = E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21
ep_only = true

[Vx: KBDflags.1024]
signature = 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22
ep_only = true

[Vx: Kuku.448]
signature = AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB
ep_only = true

[Vx: Lehigh.555]
signature = E9 J1 J1 E8 ?? ?? 5E 83 ?? ?? 8B DE 81 ?? ?? ?? 53 81 ?? ?? ?? B4 19 CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 4A CD 21
ep_only = true

[Vx: Lucee.1888]
signature = E9 J1 J1 E8 ?? ?? 5E 83 ?? ?? FC 50 53 B8 ?? ?? CD 21 3D ?? ?? 75 ?? E9
ep_only = true

[Vx: Manuel.based]
signature = E9 J1 J1 0E B8 ?? ?? 50 06 1E 55 E8 ?? ?? 43 60 14 ?? 02 E9 53 0C 00 ?? ?? ?? ?? ?? ?? 5D 83 ?? ?? 8D ?? ?? ?? BF ?? ?? A5 A4 B4 ?? CD 21
ep_only = true

[Vx: Mh.757]
signature = E9 J1 J1 B8 ?? ?? CD 21 3C 07 75 ?? FB B8 ?? ?? CD 21 8C C8 48 8E C0 26 ?? ?? ?? ?? ?? 74 ?? B4 ?? BB ?? ?? CD 21 81 ?? ?? ?? 72 ?? B4 ?? CD 21 72 ?? 48 8E C0 FA
ep_only = true

[Vx: Necropolis]
signature = B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0
ep_only = true

[Vx: Noon.1163]
signature = E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC
ep_only = true

[Vx: November 17.768]
signature = E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC
ep_only = true

[Vx: Number One]
signature = F9 07 3C 53 6D 69 6C 65 3E E8
ep_only = true

[Vx: Payback.dropper]
signature = E9 J1 J1 B9 ?? ?? B8 ?? ?? BE ?? ?? 49 78 ?? 30 04 86 E0 D3 C8 4E EB
ep_only = true

[Vx: Phoenix.927]
signature = E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8
ep_only = true

[Vx: Predator.2448]
signature = 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC
ep_only = true

[Vx: Quake.518]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81
ep_only = true

[Vx: Raubkopie.2219]
signature = E9 J1 J1 8C D0 2E ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 8E D0 BC ?? ?? 1E 8E D8 58 A3 ?? ?? E8 ?? ?? 8C C8 8E C0 E8 ?? ?? BA ?? ?? B4 1A CD 21
ep_only = true

[Vx: Spanz]
signature = E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84
ep_only = true

[Vx: TravJack.883]
signature = EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81
ep_only = true

[Vx: Trivial.25]
signature = B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD
ep_only = true

[Vx: Trivial.46]
signature = B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21
ep_only = true

[Vx: Trojan.Format]
signature = E9 J1 J1 B4 2A CD 21 81 F9 ?? ?? 72 ?? 80 FE ?? 72 ?? 80 FA ?? 72 ?? B8 ?? ?? BB
ep_only = true

[Vx: Trojan.Shock]
signature = E9 J1 J1 BE ?? ?? E8 ?? ?? B2 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? BE ?? ?? E8 ?? ?? B8 00 4C CD 21 ?? 50 52 AC
ep_only = true

[Vx: Trojan.Surprice]
signature = E9 J1 J1 BF ?? ?? 8B ?? ?? 8D ?? ?? ?? B9 ?? ?? 81 ?? ?? ?? AD E2
ep_only = true

[Vx: Uddy.2617]
signature = 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98
ep_only = true

[Vx: VCL]
signature = AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89
ep_only = true

[Vx: VCL]
signature = 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3
ep_only = true

[Vx: VCL (encrypted)]
signature = 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3
ep_only = true

[Vx: VirusConstructor.based]
signature = BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8
ep_only = true

[Vx: VirusConstructor.based]
signature = E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21
ep_only = true

[Vx: XPEH.4768]
signature = E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8
ep_only = true

[Vx: XRCV.1015]
signature = E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B
ep_only = true

[Vx: Zherkov.2968]
signature = E9 J1 J1 EB ?? ?? ?? ?? 53 51 52 57 06 1E E8 ?? ?? 5E 2E ?? ?? ?? 3C 00 74 ?? 8B FE 83
ep_only = true

[WARNING -> TROJAN -> HuiGeZi]
signature = 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF
ep_only = true

[WARNING -> TROJAN -> XiaoHui]
signature = 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00
ep_only = true

[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)]
signature = 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00
ep_only = true

[WarWind Save file]
signature = 57 41 52 53 41 56
ep_only = true

[WATCOM C 1988, 1989, 1990]
signature = E9 J1 J1 FB 8C C9 BB ?? ?? 8E C1 26 ?? ?? ?? ?? 26 ?? ?? ?? 3D ?? ?? 73 ?? B8 ?? ?? 03 D8 8E D1 8B E3 26 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 8B D3 D1 EA D1 EA D1 EA D1 EA 8B ?? ?? ?? 8C C0 2B C8 3B D1
ep_only = true

[WATCOM C 1991]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 83 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 03 DC
ep_only = true

[WATCOM C Protected Mode (386, 486) 1988-92]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 80 ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC
ep_only = true

[WATCOM C/C++]
signature = BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3
ep_only = true

[WATCOM C/C++]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41
ep_only = true

[Watcom C/C++]
signature = E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00
ep_only = true

[WATCOM C/C++ 16 1994]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 26 BB ?? ?? 83 ?? ?? 80 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 01 E3
ep_only = true

[WATCOM C/C++ 16 1994]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 8? ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC
ep_only = true

[WATCOM C/C++ 32 Run-Time System 1988-1994]
signature = FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21
ep_only = true

[WATCOM C/C++ 32 Run-Time System 1988-1995]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54
ep_only = true

[WATCOM C/C++ DLL]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87
ep_only = true

[Wavelet compressed bitmap]
signature = 57 49
ep_only = true

[WebCops [DLL]
signature = A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B
ep_only = true

[WIBU-Key V4.10A -> http://wibu.com/us/]
signature = F7 05 ?? ?? ?? ?? FF 00 00 00 75 12
ep_only = true

[Wicat GED Graphics format]
signature = 0D 00 40 00
ep_only = true

[Wind of Crypt 1.0 - by DarkPressure]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D
ep_only = true

[Windows 9x registry file]
signature = 43 52 45 47
ep_only = true

[Windows 9x User password file]
signature = E3 82 85 96
ep_only = true

[Windows Animation format]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF
ep_only = true

[Windows Group file]
signature = 50 4D 43 43
ep_only = true

[Windows Icon Graphics format]
signature = 00 00 01 00
ep_only = true

[Windows or OS/2 Graphics format]
signature = 42 4D
ep_only = true

[Windows PIF file]
signature = 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 02
ep_only = true

[Windows Type 1 font metric file]
signature = 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20
ep_only = true

[Windows Write file]
signature = ?? BE 00 00 00 AB 00 00 00
ep_only = true

[Winkript v1.0]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58
ep_only = true

[WinKript v1.0 -> Mr. Crimson]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[WinRAR 32-bit SFX Module]
signature = E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF
ep_only = true

[WinRAR 32-bit SFX Module]
signature = E9 ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[WinUpack v0.30 beta -> By Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 7E P_ ON LY =T RU E
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 7
ep_only = true

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33
ep_only = true

[WinUpack v0.39 final -> By Dwing c)2005]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51
ep_only = true

[WinZip (32-bit) 6.x]
signature = FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 74
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF
ep_only = true

[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20
ep_only = true

[Wise Installer Stub v1.10.1029.1]
signature = 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45
ep_only = true

[with added 'PK' signature]
signature = C7 ?? ?? ?? ?? ?? 8C D8 05
ep_only = true

[WordPerfect Graphics format]
signature = FF 57 50 43 10 00 00 00
ep_only = true

[WWPACK v3.00, v3.01 (Extractable)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC
ep_only = true

[WWPACK v3.00, v3.01 (Relocations pack)]
signature = BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC
ep_only = true

[WWPACK v3.02, v3.02a (Extractable)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3
ep_only = true

[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC
ep_only = true

[WWPACK v3.03]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53
ep_only = true

[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)]
signature = 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Extractable)]
signature = 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Modified)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Unextractable + Password checking)]
signature = 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[WWPACK v3.05c4 (Unextractable + Virus Shield)]
signature = 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true

[X-Hider 1.0 -> GlobaL]
signature = 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5
ep_only = true

[X-Hider 1.0 -> GlobaL]
signature = 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00
ep_only = true

[X-Pack v1.4.2]
signature = 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3
ep_only = true

[X-PEOR v0.99b]
signature = E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40
ep_only = true

[XCF File Format by Adeline Software]
signature = 46 72 61 6D 65 4C 65 6E F4 0F
ep_only = true

[XcomOR v0.99i]
signature = ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? D3 ?? ?? C2 ?? ?? B9 ?? ?? EB J3 0F 23 F8 0F 23 D8 0F 23 F8 0F 23 C8 E2
ep_only = true

[XCR v0.13]
signature = 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB
ep_only = true

[XE Executable Image (using DOSExtender)]
signature = 58 45
ep_only = true

[XJ / XPAL -> LiNSoN]
signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C
ep_only = true

[XMI music file]
signature = 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44
ep_only = true

[XorCom v1.0]
signature = E9 J1 J1 FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? AC 34 ?? AA E2 ?? C3
ep_only = true

[XorCopy v1.0]
signature = E9 J1 J1 B8 ?? ?? BB ?? ?? BA ?? ?? 31 07 43 40 39 D3 75 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 31 C0 31 DB 31 D2 E9
ep_only = true

[Xorer v1.0]
signature = E9 J1 J1 BE ?? ?? 8B FE B9 ?? ?? 33 DB 80 ?? ?? AC 32 C3 AA E2
ep_only = true

[Xorer v2.1]
signature = E9 J1 J1 BA ?? ?? B9 ?? ?? 51 B0 ?? E6 60 FA B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true

[XPack 1.52 - 1.64]
signature = 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB
ep_only = true

[Xtreme-Protector v1.06]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE P_ ON LY =T RU E
ep_only = true

[Xtreme-Protector v1.06]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 F
ep_only = true

[Xtreme-Protector v1.06]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4
ep_only = true

[XWD graphics format]
signature = 00 00 00 71 00 00 00 07 00 00 00 02 00 00 00
ep_only = true

[yC v1.3 by Ashkbiz Danehkar]
signature = 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[yC v1.3 by Ashkbiz Danehkar]
signature = 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[yoda's Crypter 1.3 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00
ep_only = true

[yoda's Crypter 1.3 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[yoda's Protector 1.0 beta -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00
ep_only = true

[yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00
ep_only = true

[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00
ep_only = true

[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00
ep_only = true

[yoda's Protector 1.02 -> Ashkibiz Danehlar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector 1.02 -> Ashkibiz Danehlar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector 1.03.1 -> Ashkibiz Danehlar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector 1.0b -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01
ep_only = true

[yoda's Protector 1.0x -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03
ep_only = true

[yoda's Protector 1.0x -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01
ep_only = true

[yoda's Protector v1.01 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector v1.01 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA
ep_only = true

[yoda's Protector V1.01 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[yoda's Protector v1.02 (.dll,.ocx) --> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector v1.02 (.dll,.ocx) -> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector V1.02 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector v1.02b-> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01
ep_only = true

[yoda's Protector V1.03.1 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[yoda's Protector v1.03.2 (.dll,.ocx) --> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector v1.03.2 (.dll,.ocx) -> Ashkbiz Danehkar]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?E P_ ON LY =T RU E
ep_only = true

[yoda's Protector V1.03.2 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3
ep_only = true

[yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = true

[yoda's Protector V1.03.3 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3
ep_only = true

[yoda's Protector v1.0b -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C
ep_only = true

[yoda's Protector V1.0b -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC
ep_only = true

[yP v1.0b by Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? AA E2 9C
ep_only = true

[yP v1.0b by Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8
ep_only = true

[yzpack 1.12 -> UsAr]
signature = 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00
ep_only = true

[YZPack 1.2 --> UsAr]
signature = 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9
ep_only = true

[YZPack 1.2 -> UsAr]
signature = 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C
ep_only = true

[yzpack V1.1]
signature = 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2
ep_only = true

[yzpack V2.0 -> UsAr ! Sign by fly]
signature = 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00
ep_only = true

[ZCode Win32/PE Protector v1.01]
signature = 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0
ep_only = true

[ZealPack 1.0 -> Zeal]
signature = C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4
ep_only = true

[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC]
signature = E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30
ep_only = true

[ZM-Exe Executable Image]
signature = 5A 4D
ep_only = true

[ZOO Archive]
signature = 5A 4F 4F
ep_only = true

[Zortech C]
signature = E8 ?? ?? 2E FF ?? ?? ?? FC 06
ep_only = true

[Zortech C]
signature = FA FC B8 ?? ?? ?? 8C C8 8E D8
ep_only = true

[Zortech C v2.00 1988, 1989]
signature = FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E
ep_only = true

[[MSLRH]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01
ep_only = true

[[MSLRH]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31
ep_only = true

[ؾEXEļ Աר -> ¾]
signature = 55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45
ep_only = true

[EXEļ v1.0 -> ]
signature = 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1
ep_only = true

[ļ v1.0 -> ]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44
ep_only = true

[ļ v1.0 -> ]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00
ep_only = true

[EXEϲ -> yy66]
signature = 68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30
ep_only = true

[ܥѹ 2.2b Anti -> xiaohui]
signature = EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8
ep_only = true

[ܥѹ 2.2b Anti -> xiaohui]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8
ep_only = true

[!EPack 1.4 lite (final) - by 6aHguT]
signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
ep_only = false

[* VMProtect v1.25 --> PolyTech]
signature = 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = false

[* [MSLRH] v0.1 -> emadicius]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8
ep_only = false

[* [MSLRH] v0.31a]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F
ep_only = false

[* [MSLRH] v0.32a -> emadicius]
signature = E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8
ep_only = false

[* [MSLRH] v0.32a -> emadicius]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = false

[ACProtect 1.41 -> AntiCrack Software]
signature = E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30
ep_only = false

[ACProtect 1.4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70
ep_only = false

[ACProtect 1.4x -> RISCO soft]
signature = 47 53 44 31 02 00 11 00
ep_only = false

[ACProtect v1.35 -> risco software Inc. & Anticrack Software]
signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63
ep_only = false

[ACProtect V1.3X-V1.4X -> RiSco   * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00
ep_only = false

[ACProtect v1.41]
signature = 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00
ep_only = false

[ActiveMARK 5.x -> Trymedia Systems,Inc. (h)]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48
ep_only = false

[AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3
ep_only = false

[AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15
ep_only = false

[AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = false

[AHTeam EP Protector 0.3 (fake PEtite 2.2) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50
ep_only = false

[AHTeam EP Protector 0.3 (fake Spalsher 1.x-3.x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84
ep_only = false

[AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34
ep_only = false

[AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03
ep_only = false

[AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D
ep_only = false

[AHTeam EP Protector 0.3 (fake VIRUS/I-Worm Hybris) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15
ep_only = false

[AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00
ep_only = false

[AHTeam EP Protector 0.3 (fake Xtreme-Protector 1.05) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8
ep_only = false

[AHTeam EP Protector 0.3 (fake ZCode 1.01) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35
ep_only = false

[AI1 Creator 1 Beta 2 - by MZ]
signature = E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00
ep_only = false

[AI1 Creator 1 Beta 2 - by MZ]
signature = E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = false

[Alex Protector 0.4 beta 1 by Alex]
signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68
ep_only = false

[ANDpakk2 0.18 - by Dmitry "AND" Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D
ep_only = false

[AntiDote 1.0 Demo / 1.2 -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C
ep_only = false

[AntiDote 1.0.Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00
ep_only = false

[AntiDote 1.2 Beta (Demo) -> SIS-Team]
signature = 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90
ep_only = false

[AntiDote 1.4 SE -> SIS-Team]
signature = 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60
ep_only = false

[aPack v0.98b (exe)]
signature = 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA
ep_only = false

[ARM Protector 0.1 by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0
ep_only = false

[ARM Protector 0.2-> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00
ep_only = false

[ARM Protector 0.3 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4
ep_only = false

[ARM Protector 0.3 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0
ep_only = false

[Armadillo 3.01, 3.05]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F
ep_only = false

[Armadillo 3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1
ep_only = false

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 61 69 6C 65 64 20 43 52 43 20 63 68 65 63 6B 00 00 00 00 52
ep_only = false

[Armadillo 4.40 -> Silicon Realms Toolworks (h)]
signature = 30 31 2E 30 31 00 00 04
ep_only = false

[Armadillo v1.71]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1
ep_only = false

[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24
ep_only = false

[Armadillo V5.00-V5.X Dll -> Silicon Realms Toolworks * Sign.By.fly]
signature = 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57
ep_only = false

[Armadillo V5.20 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = false

[Armadillo V5.20.Beta1 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = false

[Armadillo V5.40 -> Silicon Realms Toolworks * Sign.By.fly * 20080214]
signature = E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75
ep_only = false

[AsCrypt v0.1 -> SToRM]
signature = 83 ?? ?? E2 ?? ?? E2 ?? FF
ep_only = false

[AsCrypt v0.1 -> SToRM - needs to be added]
signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF
ep_only = false

[AsCrypt v0.1 -> SToRM - needs to be added]
signature = 83 C6 14 8B 55 FC E9 ?? FF FF FF
ep_only = false

[ASDPack -> asd * Sign.By.fly]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65
ep_only = false

[ASDPack 2.0 -> asd]
signature = 8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00
ep_only = false

[ASDPack 2.0 -> asd]
signature = 5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9
ep_only = false

[ASDPack v1.0 -> asd]
signature = 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F
ep_only = false

[ASDPack v1.0 -> asd]
signature = 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00
ep_only = false

[Aspack v2.12 -> www.aspack.com]
signature = ?? ?8 0? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?3 ?? ?? 0? ?? 0? ?? ?? ?? ?? ?? 0? ?? ?F ?? ?? ?3 0? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? 0? ?0 0? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8
ep_only = false

[ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C
ep_only = false

[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00
ep_only = false

[ASProtect v1.2 -> Alexey Solodovnikov (h1)]
signature = 90 ?? 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0
ep_only = false

[ASProtect v1.2x]
signature = 00 00 68 01 ?? ?? ?? C3 AA
ep_only = false

[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]
signature = 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40
ep_only = false

[AverCryptor 1.0 -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8
ep_only = false

[AverCryptor 1.02 beta -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F
ep_only = false

[BamBam 0.01]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = false

[BeRoEXEPacker V1.00 -> BeRo]
signature = BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74
ep_only = false

[Borland Delphi v6.0 - v7.0]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
ep_only = false

[Borland Delphi v6.0 - v7.0]
signature = 53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8
ep_only = false

[Borland Delphi v6.0 KOL]
signature = 53 8B D8 33 C0 A3 0: ?? ?? :0 6A 00 E8 0: ?? :0 FF A3 0: ?? ?? :0 A1 0: ?? ?? :0 A3 0: ?? ?? :0 33 C0 A3 0: ?? ?? :0 33 C0 A3 0: ?? ?? :0 E8
ep_only = false

[C.I Crypt V0.1 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[CDS SS 1.0 beta1 -> CyberDoom]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40
ep_only = false

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3
ep_only = false

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0
ep_only = false

[ChinaProtect -> dummy]
signature = 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3
ep_only = false

[ChinaProtect -> dummy]
signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0
ep_only = false

[Code Virtualizer 1.3.1.0 -> Oreans Technologies]
signature = 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC
ep_only = false

[codeCrypter 0.31 -> Tibbar]
signature = 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC
ep_only = false

[CreateInstall Stub vx.x]
signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40
ep_only = false

[Crunch 5 / Fusion 4 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00
ep_only = false

[Crunch/PE]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2
ep_only = false

[Crunch/PE v1.0.x.x]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = false

[Crypter 3.1 -> SLESH]
signature = 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68
ep_only = false

[Crypto-Lock 2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = false

[D1NS1G -> D1N]
signature = 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[D1NS1G -> D1N]
signature = 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00
ep_only = false

[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]
signature = E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B
ep_only = false

[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]
signature = E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03
ep_only = false

[D1S1G v1.1 beta --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00
ep_only = false

[D1S1G v1.1 beta --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00
ep_only = false

[DalKrypt 1.0 - by DalKiT]
signature = 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7
ep_only = false

[DEF v1.0]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3
ep_only = false

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00
ep_only = false

[DotFix NiceProtect vna]
signature = 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29
ep_only = false

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00
ep_only = false

[DZA Patcher v1.3 -> DZA]
signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35
ep_only = false

[Elicense System V4.0.0.0 -> ViaTech Inc]
signature = 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00
ep_only = false

[EncryptPE V2.2007.12.1 -> WFS * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 45 4D 61 69 6C 3A 20 77 66 73 23 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 00 00 00
ep_only = false

[EncryptPE V2.2007.12.1 -> WFS * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74
ep_only = false

[EncryptPE V2.2008.6.18 -> WFS * Sign.By.KuNgBiM]
signature = 68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65
ep_only = false

[ENIGMA Protector -> Sukhov Vladimir]
signature = 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31
ep_only = false

[Enigma Protector 1.0X -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70
ep_only = false

[Enigma protector 1.10/1.11 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Enigma Protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A
ep_only = false

[Enigma protector 1.12 -> Vladimir Sukhov (h)]
signature = 55 46 41 C6 D2 C1 00 00
ep_only = false

[Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Enigma protector v1.02 -> Vladimir Sukhov (h)]
signature = 55 53 20 50 54 4F 20 00
ep_only = false

[Enigma Protector v1.12 LITE]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Escargot 0.1 (final) -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05
ep_only = false

[Exe Shield 2.7b]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = false

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40
ep_only = false

[EXE Shield V0.1b-V0.8 -> SMoKE]
signature = E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00
ep_only = false

[EXE Stealth 2.74]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02
ep_only = false

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9
ep_only = false

[EXE Stealth v2.76 -> WebToolMaster]
signature = EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41
ep_only = false

[EXECryptor 2.0/2.1 (protected IAT)]
signature = A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41
ep_only = false

[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development]
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01
ep_only = false

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = false

[EXECryptor 2.2.x -> SoftComplete Developement]
signature = 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1
ep_only = false

[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50
ep_only = false

[EXECryptor 2.2/2.3 (protected IAT)]
signature = CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78
ep_only = false

[EXECryptor 2.x -> SoftComplete Developement]
signature = 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C
ep_only = false

[EXECryptor 2.xx (compressed resources)]
signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3
ep_only = false

[EXECryptor 2.xx (max. compressed resources)]
signature = 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50
ep_only = false

[EXECryptor V2.1X -> softcomplete.com]
signature = 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[ExeSafeguard v1.0 -> simonzh]
signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE
ep_only = false

[ExeSplitter 1.2 -> Bill Prisoner / TPOC]
signature = E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08
ep_only = false

[ExeSplitter 1.2 -> Bill Prisoner / TPOC]
signature = E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE
ep_only = false

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC
ep_only = false

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]
signature = 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64
ep_only = false

[eXPressor 1.0 beta -> CGSoftLabs]
signature = E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8
ep_only = false

[eXPressor 1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04
ep_only = false

[eXPressor 1.3 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04
ep_only = false

[eXPressor 1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14
ep_only = false

[eXPressor v1.2 -> CGSoftLabs]
signature = 45 78 50 72 2D 76 2E 31 2E 32 2E
ep_only = false

[eXPressor v1.3 -> CGSoftLabs]
signature = 45 78 50 72 2D 76 2E 31 2E 33 2E
ep_only = false

[eXPressor v1.4 -> CGSoftLabs]
signature = 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = false

[eXPressor V1.4.5.1 -> CGSoftLabs * Sign.By.fly]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14
ep_only = false

[eXPressor.Protection V1.6.0.1 -> CGSoftLabs&nbsp; &nbsp;* Sign.By.fly * 20080308]
signature = EB 01 ?? EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 E2 05 00 00 EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 ?? 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 ?? ?? 8B 45 F4 0F B6 ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 81 ?? ?? ?? ?? EB 01 ?? EB D4 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 FC EB 02 ?? ?? 83 7D FC 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 A0 05 00 00 A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 F8 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 FC E8 01 00 00 00 ?? 83 04 24 06 C3
ep_only = false

[FakeNinja v2.8 (Anti-Debug) -> Spirit]
signature = 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8
ep_only = false

[FakeNinja V2.8 Private -> Spirit * Sign.By.fly]
signature = 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 17 E5 FF 60
ep_only = false

[File Analyzer Compiled Datafile Version]
signature = 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E ?? V3 ?? V4
ep_only = false

[File Analyzer Extended Datafile Version]
signature = 23 03 45 58 54 44 V3 V4 3A 03
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00
ep_only = false

[FishPE V1.1X -> hellfish * Sign.By.fly]
signature = 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00
ep_only = false

[Fly-Crypter 1.0 -> ut1lz]
signature = 53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3
ep_only = false

[Fly-Crypter 1.0 -> ut1lz]
signature = 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB
ep_only = false

[Free Pascal v0.99.10]
signature = C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00
ep_only = false

[FreeBASIC 0.16b]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D
ep_only = false

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A
ep_only = false

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2
ep_only = false

[FreeJoiner 1.5.1 -> GlOFF]
signature = 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8
ep_only = false

[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]
signature = E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00
ep_only = false

[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]
signature = 86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6
ep_only = false

[FreeJoiner Small (build 014-021/024-027) -> GlOFF]
signature = E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00
ep_only = false

[FreeJoiner Small (build 014/015) -> GlOFF]
signature = 55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50
ep_only = false

[FreeJoiner Small (build 017) -> GlOFF]
signature = 55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50
ep_only = false

[FreeJoiner Small (build 023) -> GlOFF]
signature = E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF
ep_only = false

[FreeJoiner Small (build 029) -> GlOFF]
signature = 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00
ep_only = false

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40
ep_only = false

[FreeJoiner Small (build 033) -> GlOFF]
signature = 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10
ep_only = false

[FreeJoiner Small (build 035) -> GlOFF]
signature = 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10
ep_only = false

[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3
ep_only = false

[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8
ep_only = false

[FSG 1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38
ep_only = false

[FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01
ep_only = false

[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA
ep_only = false

[FSG 1.31 (Eng) -> dulek/xt]
signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3
ep_only = false

[FSG 1.31 -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB
ep_only = false

[FSG v1.00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = false

[FSG v2.0]
signature = 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75
ep_only = false

[FSG v2.0 -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE
ep_only = false

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6
ep_only = false

[Histogram graphics file]
signature = 6D 68 77 61 6E 68 00 04 01 02 01 02
ep_only = false

[hmimys Protect v1.0]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8
ep_only = false

[hmimys-Packer 1.0]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00
ep_only = false

[hmimys-Packer 1.0 -> hmimys]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07
ep_only = false

[HQR data file]
signature = 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00
ep_only = false

[Hying's PE-Armor 0.75.exe -> Hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00
ep_only = false

[Hying's PE-Armor 0.75.exe -> Hying [CCG] (h)]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C9
ep_only = false

[Hying's PE-Armor 0.76 -> Hying [CCG]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75
ep_only = false

[Hying's PE-Armor 0.76 -> Hying [CCG] (h)]
signature = 01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3
ep_only = false

[Img Software Set graphics file]
signature = 53 43 4D 49 20 20 20 31 41 54
ep_only = false

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER] (h)]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = false

[Inno Setup Module]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C
ep_only = false

[Inno Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = false

[InterLok V5.51 -> PACE Anti-Piracy * Sign.By.fly]
signature = EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7
ep_only = false

[InterLok V5.X -> PACE Anti-Piracy * Sign.By.fly]
signature = 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3
ep_only = false

[Ionic Wind Software]
signature = 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8
ep_only = false

[JAR Archive]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B
ep_only = false

[KBys Packer 0.28 Beta -> Shoooo]
signature = 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53
ep_only = false

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8
ep_only = false

[LY_WGKX * ҿ V2.X -> www.szleyu.com * Sign.By.fly * 20080122]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 01 00 4D 79 46 75 6E 00 62 73 00 00
ep_only = false

[LY_WGKX * ҿ V2.X -> www.szleyu.com * Sign.By.fly * 20080122]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00
ep_only = false

[LY_WGKX -> www.szleyu.com]
signature = 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58
ep_only = false

[Macromedia Windows Flash Projector/Player v3.0]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00
ep_only = false

[MarjinZ EXE-Scrambler SE - by MarjinZ]
signature = E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3
ep_only = false

[MarjinZ EXE-Scrambler SE - by MarjinZ]
signature = E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45
ep_only = false

[MaskPE 1.6 -> yzkzero]
signature = 36 81 2C 24 ?? ?? ?? 00 C3 60
ep_only = false

[MASM / TASM]
signature = 6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00
ep_only = false

[MASM/TASM - sig4 (h)]
signature = C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = false

[Matrix Dongle -> TDi GmbH]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2
ep_only = false

[MEW 11 SE 1.2]
signature = E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = false

[MEW 11 SE v1.0 -> Northfox]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[MEW 11 SE v1.2 -> Northfox]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC
ep_only = false

[Mew 5.0.1 -> NorthFox / HCC]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E
ep_only = false

[MicroDog Win32Shell V4.0.9.3 -> SafeNet * Sign.By.fly]
signature = 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D
ep_only = false

[MicroDog Win32Shell V4.0.9.3 Dll -> SafeNet * Sign.By.fly]
signature = 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D
ep_only = false

[MicroDog Win32Shell V4.X -> SafeNet * Sign.By.fly]
signature = 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D
ep_only = false

[Microsoft (R) Full-text index file]
signature = 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78
ep_only = false

[Microsoft Resource Cursors file]
signature = 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 C2 0C 00
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00
ep_only = false

[Microsoft Visual C++ 6.0 - 8.0]
signature = 3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3
ep_only = false

[Microsoft Visual C++ 6.0 DLL (Debug)]
signature = 8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00
ep_only = false

[Microsoft Visual C++ 7.0 - 8.0]
signature = 53 56 8B 44 24 18 0B C0 75 18 8B 4C 24 14 8B 44 24 10 33 D2 F7 F1 8B D8 8B 44 24 0C F7 F1 8B D3 EB 41 8B C8 8B 5C 24 14 8B 54 24 10 8B 44 24 0C D1 E9 D1 DB D1 EA D1 D8 0B C9 75 F4 F7 F3 8B F0 F7 64 24 18 8B C8 8B 44 24 14 F7 E6 03 D1 72 0E 3B 54 24 10 77 08 72 07
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55
ep_only = false

[Microsoft Visual C++ 7.1]
signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00
ep_only = false

[Microsoft Visual C++ 8.0]
signature = 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF ?? ?? ?? ?? 3B C7 59 73 0F 8B 06 85 C0 74 02 FF D0 83 C6 04 3B F7 72 F1
ep_only = false

[Microsoft Visual C++ 8.0]
signature = 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF
ep_only = false

[Microsoft Visual C++ v6.0 DLL]
signature = 8B 44 ?? 08
ep_only = false

[Microsoft WAV Audio file]
signature = 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74
ep_only = false

[MinGW 3.2.x (main)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00
ep_only = false

[MinGW GCC 2.x]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D
ep_only = false

[MinGW GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55
ep_only = false

[mkfpack -> llydd]
signature = E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6
ep_only = false

[MoleBox v2.3.0 -> Teggo]
signature = 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC
ep_only = false

[MoleBox v2.5.4 -> Teggo]
signature = ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = false

[MoleBoxPro 2.5.5 -> Mole Studio (h)]
signature = E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00
ep_only = false

[Morphine 2.7 -> Holy_Father & Ratter/29A]
signature = ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Morphine 3.3 -> Holy_Father & Ratter/29A]
signature = 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Morphine v1.2]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59
ep_only = false

[Morphine v1.2 - v1.3]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Morphine v2.7 -> Holy_Father & Ratter/29A (h)]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = false

[Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)]
signature = BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[MPEG movie file]
signature = 00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB
ep_only = false

[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]
signature = E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00
ep_only = false

[MSLRH]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08
ep_only = false

[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75
ep_only = false

[MSLRH v0.1 -> emadicius]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = false

[MSLRH v0.1 -> emadicius]
signature = 54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65
ep_only = false

[MSLRH v0.32a -> emadicius (h)]
signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F 70 79 72 69 67 68 74 20 62 79 20 43 48 52 69 53 54 4F 50 48 20 47 41 42 4C 45 52 20 69 6E 20 31 39 39 38 21 0D 0A 52 65 67 69 73 74 65 72 65 64 20 74 6F 20 3A 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[MSLRH v32a -> emadicius]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 $[ MU LT IE DI T` SC OM PI LE DM AC RO S= 1E AA
ep_only = false

[MSVC++ v.8 (procedure 1 recognized - h)]
signature = 55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3
ep_only = false

[N-Joiner 0.1 (Asm Version) -> NEX]
signature = 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12
ep_only = false

[N-Joy 1.1 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00
ep_only = false

[N-Joy 1.2 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00
ep_only = false

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7
ep_only = false

[nBinder v3.6.1]
signature = 6E 73 70 61 63 6B 24 40
ep_only = false

[nBinder v4.0]
signature = 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00
ep_only = false

[Ningishzida 1.0 -> CyberDoom]
signature = 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = false

[NoodleCrypt v2.0]
signature = EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01
ep_only = false

[nPack 1.1.300.2006 Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35
ep_only = false

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00
ep_only = false

[nPack V1.1.275.2006.Beta -> NEOx * Sign.By.fly * 200800212]
signature = 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3
ep_only = false

[NSPack -> Nort Star Software - url:://www.nsdsn.com/]
signature = 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08
ep_only = false

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68
ep_only = false

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD
ep_only = false

[NsPack 3.0 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40
ep_only = false

[NsPack 3.0 by North Star (Liu Xing Ping)]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95
ep_only = false

[NsPack 3.1 by North Star (Liu Xing Ping)]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5
ep_only = false

[nSpack V2.3 -> LiuXingPing]
signature = 9C 60 70 61 63 6B 24 40
ep_only = false

[nSpack V2.x -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5
ep_only = false

[NTkrnl Secure Suite -> NTkrnl team]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73
ep_only = false

[NTkrnl Secure Suite -> NTkrnl team (h)]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = false

[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79
ep_only = false

[NTkrnl Secure Suite 0.1-0.15 DLL -> NTkrnl Software]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3
ep_only = false

[NTPacker 1.0 -> ErazerZ]
signature = 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1
ep_only = false

[Nullsoft Install System 2.0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00
ep_only = false

[Nullsoft Install System 2.06]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00
ep_only = false

[Nullsoft Install System 2.0b4]
signature = 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74
ep_only = false

[Nullsoft Install System 2.0b4]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00
ep_only = false

[Nullsoft Install System v1.98]
signature = 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71
ep_only = false

[Nullsoft Install System v2.0]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52
ep_only = false

[Nullsoft Install System v2.0a0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03
ep_only = false

[Nullsoft Install System v2.0b4]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52
ep_only = false

[Nullsoft PIMP Install System v1.3x]
signature = 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74
ep_only = false

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B
ep_only = false

[Obsidium 1.3.0.21 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB
ep_only = false

[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB
ep_only = false

[Obsidium V1.3.4.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04
ep_only = false

[Obsidium V1.3.5.0 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB
ep_only = false

[Obsidium V1.3.5.2 -> Obsidium Software * Sign.By.fly]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04
ep_only = false

[Obsidium V1.3.5.3 -> Obsidium Software * Sign.By.fly * 20080120]
signature = EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04
ep_only = false

[Obsidium V1.3.5.4 -> Obsidium Software * Sign.By.fly * 200800207]
signature = EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50
ep_only = false

[Obsidium V1.4.0.0.Beta -> Obsidium Software * Sign.By.fly * 20080102]
signature = EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03
ep_only = false

[ocBat2Exe 1.0 -> OC]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF
ep_only = false

[ocBat2Exe 1.0 -> OC]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF
ep_only = false

[Open Source Code Crypter -> p0ke]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00
ep_only = false

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = false

[Packman 0.0.0.1 -> Bubbasoft]
signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00
ep_only = false

[Patch Creation Wizard v1.2 Byte Patch]
signature = E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75
ep_only = false

[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]
signature = 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3
ep_only = false

[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]
signature = 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80
ep_only = false

[PC-Guard v3.03d, v3.05d]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = false

[PDS graphics file format]
signature = 49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20
ep_only = false

[PE Encrypt 1.0 -> Liwuyue]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89
ep_only = false

[PE Protect v0.9]
signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F
ep_only = false

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B
ep_only = false

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9
ep_only = false

[PE-Armor 0.760-0.765 -> hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00
ep_only = false

[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN]
signature = C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70
ep_only = false

[PE-PROTECT 0.9]
signature = 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39
ep_only = false

[Pe123 v2006.4.4-4.12]
signature = 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0
ep_only = false

[Pelles C 2.8.x-4.5.x -> Pelle Orinius]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC
ep_only = false

[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3
ep_only = false

[Pelles C 2.x-4.x DLL -> Pelle Orinius]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10
ep_only = false

[PEncrypt 1.0 -> JunkCode]
signature = 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF
ep_only = false

[PEQuake 0.06-> forgat]
signature = E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50
ep_only = false

[PESpin 0.3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false

[PESpin 0.7 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false

[PESpin 1.3x -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false

[PeStubOEP v1.x]
signature = 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF
ep_only = false

[PeStubOEP v1.x]
signature = E8 05 00 00 00 33 C0 40 48 C3 E8 05
ep_only = false

[PeStubOEP v1.x]
signature = ?? ?? B8 ?? ?? ?? 00 FF E0
ep_only = false

[PeX 0.99 -> bart^CrackPl]
signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = false

[PE_Protector V2.60hying's PE-Armor V0.460 modify -> Engprog * Sign.By.fly]
signature = 55 53 51 52 56 57 E8 E1 00 00 00
ep_only = false

[Phonebook configuration file Version %v3.%v4]
signature = 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F
ep_only = false

[Pi Cryptor 1.0 - by Scofield]
signature = 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9
ep_only = false

[Pi Cryptor 1.0 - by Scofield]
signature = 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68
ep_only = false

[PKLITE32 v1.1]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10
ep_only = false

[PluginToExe v1.00 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF
ep_only = false

[PluginToExe v1.01 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A
ep_only = false

[PluginToExe v1.02 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A
ep_only = false

[PolyBox C -> Anskya]
signature = 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85
ep_only = false

[PolyBox C -> Anskya]
signature = 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF
ep_only = false

[PolyBox D -> Anskya]
signature = 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0
ep_only = false

[PolyBox D -> Anskya]
signature = 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF
ep_only = false

[PolyEnE 0.01+ by Lennart Hedlund]
signature = 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0
ep_only = false

[PolyEnE V0.01+ -> Lennart Hedlund]
signature = 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C
ep_only = false

[PoPa 0.01 (Packer on Pascal) -> bagie]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10
ep_only = false

[Private EXE Protector 1.8]
signature = A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3
ep_only = false

[Private EXE Protector 1.8 -> SetiSoft]
signature = A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00
ep_only = false

[Private EXE Protector 1.9.7 -> SetiSoft]
signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6
ep_only = false

[Private EXE Protector 1.9.7 -> SetiSoft (h)]
signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05
ep_only = false

[Private exe Protector V2.30-V2.3X -> SetiSoft Team * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Private exe Protector V2.5X-V2.6X -> SetiSoft Team * Sign.By.fly * 20080116]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Private exe Protector V2.5X-V2.6X -> SetiSoft Team * Sign.By.fly * 20080116]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Private EXE v2.0a]
signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D
ep_only = false

[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]
signature = E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10
ep_only = false

[Protect Shareware V1.1 -> eCompserv CMS]
signature = 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
ep_only = false

[PUNiSHER V1.5 Demo -> FEUERRADER]
signature = 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32
ep_only = false

[PuNkMoD 1.x -> PuNkDuDe]
signature = 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C
ep_only = false

[PureBasic 4.x -> Neil Hodgson]
signature = 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3
ep_only = false

[PureBasic 4.x DLL -> Neil Hodgson]
signature = 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3
ep_only = false

[PureBasic DLL -> Neil Hodgson]
signature = 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8
ep_only = false

[QinYingShieldLicense V1.0X-V1.21 -> Lei Peng * Sign.By.fly * 20080122]
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9
ep_only = false

[QrYPt0r - by NuTraL]
signature = 86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3
ep_only = false

[QrYPt0r - by NuTraL]
signature = EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04
ep_only = false

[R!SC's Process Patcher v1.4]
signature = 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83
ep_only = false

[RatPacker (Glue) stub]
signature = 40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF
ep_only = false

[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0
ep_only = false

[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = false

[RCryptor v1.5 --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F
ep_only = false

[RCryptor v2.0 (Hide EP) --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3
ep_only = false

[RCryptor v2.0 --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75
ep_only = false

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? ?3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9 ?? ?? ?? 80 74 0E 51 56 25 ?? ?? ?? 7F 03 C3 8B F0 42 EB B2 51 03 C3 8B 38 03 FD 8B 48 04 D2 0F 30 0F 47 E2 F9 59 E2 AF 4A 74 04 5E 59 EB F7 8D 85 ?? ?? ?? ?? 5D FF E
ep_only = false

[ResCrypt v1.02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? :3 F5 8B DE BA 01 ?? ?? ?? 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9
ep_only = false

[RJoiner 1.2a -> Vaska]
signature = 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11
ep_only = false

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A
ep_only = false

[RLPack 1.16 (aPLib compression) -> ap0x (h)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B
ep_only = false

[RLPack 1.16 (LZMA compression) -> ap0x (h)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2
ep_only = false

[RLPack 1.20 Basic Edition [aPLib]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3
ep_only = false

[RLPack 1.20 Basic Edition [LZMA]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59
ep_only = false

[RLPack Full Edition V1.1X -> ap0x]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F
ep_only = false

[RLPack Full Edition V1.1X -> ap0x]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10
ep_only = false

[RLPack FullEdition V1.20 (aPlib 0.43) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65
ep_only = false

[RLPack FullEdition V1.20 (BasicEdition Stub) -> ap0x * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69
ep_only = false

[RosAsm 2050a -> Betov]
signature = 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00
ep_only = false

[Rpoly crypt by Vaska (20.03.07 18:41)]
signature = 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04
ep_only = false

[RPolyCryptor V1.4.2 -> Vaska * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00
ep_only = false

[SafeDisc v4]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F
ep_only = false

[Safedisc V4.50.000 -> Macrovision Corporation * Sign.By.fly * 20080117]
signature = 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74
ep_only = false

[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]
signature = 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C
ep_only = false

[SC Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C
ep_only = false

[SDProtector 1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00
ep_only = false

[SecuROM V7.X -> Sony DADC * Sign.By.fly * 20080114]
signature = 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89
ep_only = false

[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]
signature = A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00
ep_only = false

[Sentinel SuperPro Dongle V5.42.0.0 -> Rainbow Technologies * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8
ep_only = false

[Sentinel UltraPro Dongle V1.1.0 -> SafeNet Inc. * Sign.By.fly]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4
ep_only = false

[Setup Factory 6.x Custom]
signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89
ep_only = false

[Sexe Crypter 1.1 - by santasdad]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B
ep_only = false

[SimbiOZ Poly 2.1 -> Extranger]
signature = 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90
ep_only = false

[SimbiOZ PolyCryptor v.xx-> Extranger]
signature = 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
ep_only = false

[SimplePack 1.2.build.30.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack 1.21.build.09.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack 1.X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack V1.1X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack V1.1X-V1.2X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04
ep_only = false

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00
ep_only = false

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6
ep_only = false

[SLVc0deProtector v0.6 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8
ep_only = false

[SLVc0deProtector v1.1 -> SLV (h)]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00
ep_only = false

[Solidshield Protector V1.X DLL -> Solidshield Technologies * Sign.By.fly]
signature = 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF
ep_only = false

[SPLayer v0.08]
signature = 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = false

[ST Protector V1.5 -> Silent Software]
signature = 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00
ep_only = false

[SVK Protector 1.3x (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = false

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = false

[Symantec WinFax PRO 7.5 Coverpage]
signature = 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80
ep_only = false

[Symantec WinFax PRO 8.3 Coverpage]
signature = FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65
ep_only = false

[TaiShanXiangYu LockSoft DLL V1.0 -> zlocksoft * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC
ep_only = false

[TaiShanXiangYu LockSoft DLL V1.0 -> zlocksoft * Sign.By.fly]
signature = 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3
ep_only = false

[tElock 0.51 -> tE!]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00
ep_only = false

[tElock 0.96 -> tE!]
signature = E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39
ep_only = false

[tElock 0.98 -> tE!]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00
ep_only = false

[tElock 0.98 Special Build -> forgot & heXer]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00
ep_only = false

[tElock 0.99]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00
ep_only = false

[tElock 0.99c (Private ECLIPSE) -> tE!]
signature = E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00
ep_only = false

[tElock v0.41x]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00
ep_only = false

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00
ep_only = false

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB
ep_only = false

[Themida 1.2.0.1 -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25
ep_only = false

[Themida 1.9.2.0]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00
ep_only = false

[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = false

[Themida/WinLicense V1.8.X-V1.9.X -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3
ep_only = false

[Themida/WinLicense V1.X -> Oreans Technologies   * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00
ep_only = false

[Themida/WinLicense V1.X -> Oreans Technologies * Sign.By.fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65
ep_only = false

[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25
ep_only = false

[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Thinstall 2.4x - 2.5x -> Jitit Software]
signature = 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = false

[Thinstall 2.5xx -> Jtit]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10
ep_only = false

[Thinstall 2.628 -> Jtit]
signature = E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01
ep_only = false

[Thinstall Virtualization Suite 3.0x - 3.300 -> Thinstall Inc.]
signature = CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 ?? ?? ?? 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 ?? ?? 73 0E 8B 4D F8 E8 27 01 ?? ?? 02 45 F7 AA EB E9 E8 04 01 ?? ?? 0F 82 96 ?? ?? ?? E8 F9 ?? ?? ?? 73 5B B9 04 ?? ?? ?? E8 05 01 ?? ?? 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF ?? ?? ?? 73 1B 55 BD ?? ?? ?? ?? E8 DF ?? ?? ?? 88 07 47 4D 75 F5 E8 C7 ?? ?? ?? 72 E9 5D
ep_only = false

[Thunderbolt V0.02 -> deXep (forgot) * Sign.By.fly]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00
ep_only = false

[TPAV Cryptor V1.1 -> msaha_dev * Sign.By.fly]
signature = 8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D 95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ?? 70
ep_only = false

[TTProtect V1.0X -> somuch&nbsp; &nbsp;* Sign.By.fly * 20080806]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 50 57 53 9C E8 ?? 00 00 00
ep_only = false

[TTProtect V1.0X -> somuch&nbsp; &nbsp;* Sign.By.fly * 20080807]
signature = 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0
ep_only = false

[Unnamed Scrambler 1.0 -> p0ke]
signature = 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32
ep_only = false

[Unnamed Scrambler 1.1C -> p0ke]
signature = 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10
ep_only = false

[Unnamed Scrambler 1.2B -> p0ke]
signature = 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8
ep_only = false

[Unnamed Scrambler 1.2C / 1.2D -> p0ke]
signature = 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54
ep_only = false

[Unnamed Scrambler 2.0 -> p0ke]
signature = 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00
ep_only = false

[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]
signature = 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8
ep_only = false

[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]
signature = 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1
ep_only = false

[Unnamed Scrambler 2.5A -> p0ke]
signature = 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00
ep_only = false

[UnoPiX 1.03-1.10 -> BaGiE]
signature = 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00
ep_only = false

[Upack 0.22 - 0.23 beta -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54
ep_only = false

[Upack 0.36 beta -> Dwing]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72
ep_only = false

[Upack 0.37 beta -> Dwing]
signature = BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C
ep_only = false

[UPack Alt Stub -> Dwing]
signature = 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD
ep_only = false

[Upack Upack 0.30 - 0.32 beta -> Dwing]
signature = 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84
ep_only = false

[Upack v0.10 - v0.12Beta -> Sign by hot_UNP]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false

[Upack V0.29-V0.31 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10
ep_only = false

[Upack V0.32 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = BE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 85 5C FF 16 72 57 2C 03 73 02 ?? ?? 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? ?? ?? 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 16 5A 9F 12 C0 D0 E9 74 0E ?? ?? ?? ?? ?? ?? ?? ?? ?? B5 01 FF 56 08 ?? ?? FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F ?? ?? D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 ?? ?? 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0
ep_only = false

[Upack v0.32 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5
ep_only = false

[Upack v0.32 Beta -> Dwing]
signature = BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5
ep_only = false

[Upack V0.33-V0.34 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 57 51 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF C1 ED ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3
ep_only = false

[Upack V0.35 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? ?? ?? ?? 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 A8
ep_only = false

[Upack V0.36 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 18 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 1C 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 1C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 14 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 3C E2 E3
ep_only = false

[Upack V0.37 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10
ep_only = false

[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Dwing]
signature = 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33
ep_only = false

[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Sign by hot_UNP]
signature = 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08
ep_only = false

[Upack V0.38 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 5B 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? 69 ED 00 0C 00 00 8D AC 2B 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 FB 00 00 00 04 F9 1A C0 B1 30 8B 6B 08 03 D1 FF 16 73 49 03 D1 FF 16 72 17 03 D1 FF 16 72 27 24 02 04 09 50 8B C7 2B 43 08 8A 00 E9 CD 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 24 03 04 08 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 95 00 00 00 24 03 04 07 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10
ep_only = false

[Upack v0.39 final -> Dwing]
signature = 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91
ep_only = false

[Upack V0.39-V0.399 -> Dwing&nbsp; &nbsp;* Sign.By.fly * 20080321]
signature = 58 8D 54 83 58 FF 16 72 4F 04 FD 1A D2 22 C2 3C 07 73 F6 50 0F B6 6F FF ?? ?? ?? 66 69 ED 00 03 8D AC AB 08 10 00 00 57 B0 01 E3 1F 2B 7B 08 84 0F 0F 95 C4 FE C4 8D 54 85 00 FF 16 12 C0 D0 E9 74 0E 2A E0 80 E4 01 75 E6 33 C9 B5 01 FF 56 50 33 C9 5F E9 F2 00 00 00 04 F9 1A C0 B1 30 24 03 8B 6B 08 04 08 03 D1 FF 16 73 42 03 D1 FF 16 72 14 03 D1 FF 16 72 24 0C 01 50 8B C7 2B 43 08 B1 80 8A 00 EB CE 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 8F 00 00 00 48 87 6B 0C 50 87 6B 10 8D 93 C0 0B 00 00 89 6B 14 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 B1 40 F6 E1 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5A 33 ED D1 E8 83 D5 02 48 91 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF
ep_only = false

[Upack_Patch -> Dwing]
signature = 2A A3 F2 54 CE
ep_only = false

[UPolyX -> delikon]
signature = FF 96 ?? ?? ?? 00 61 E9 ?? ?? ?? FF
ep_only = false

[UPolyX 0.3 by delikon]
signature = ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 80
ep_only = false

[UPolyX 0.4 by delikon]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 E9 ?? E2 ?? C3 00 00 00 00
ep_only = false

[UPolyx 0.4 by delikon]
signature = C3 ?? ?? ?? ?? ?? 83 EC 04 89
ep_only = false

[UPolyx 0.5 by delikon]
signature = 51 ?? C9 B9 ?? ?? ?? ?? 83 ?? 01 E2
ep_only = false

[UPolyX v0.5]
signature = ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[UPolyX v0.5]
signature = 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[UPolyX v0.5]
signature = ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[UPolyX v0.5]
signature = 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false

[UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = false

[UPX Protector v1.0x]
signature = EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB
ep_only = false

[UPX v2.0 -> Markus, Laszlo & Reiser]
signature = 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80
ep_only = false

[UPX-Scrambler RC v1.x]
signature = 66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00
ep_only = false

[USSR V0.31 -> SpiritST]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = false

[VBOX v4.3 - v4.6]
signature = 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4
ep_only = false

[VBOX v4.3 - v4.6]
signature = 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5
ep_only = false

[Video-CD file]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C
ep_only = false

[VProtector -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F
ep_only = false

[VProtector -> vcasm]
signature = 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00
ep_only = false

[VProtector 1.1A-1.2 -> vcasm]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3
ep_only = false

[VProtector 1.3X -> vcasm]
signature = 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF
ep_only = false

[VProtector V1.3X -> vcasm]
signature = 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00
ep_only = false

[VProtector V1.3X -> vcasm * Sign.By.fly]
signature = 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41
ep_only = false

[VX: Tibs/Zhelatin "StormWorm" variant]
signature = FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8
ep_only = false

[Watcom C/C++]
signature = E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20
ep_only = false

[Werus Crypter 1.0 - by Kas]
signature = BB E8 12 40 00 80 33 05 E9 7D FF FF FF
ep_only = false

[Werus Crypter 1.0 -> Kas]
signature = 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40
ep_only = false

[Werus Crypter 1.0 -> Kas]
signature = 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF
ep_only = false

[Windows Animation format]
signature = 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54
ep_only = false

[WinUpack v0.30 beta -> By Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00
ep_only = false

[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false

[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20
ep_only = false

[WWPACK v3.00, v3.01 (Extractable)]
signature = 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35
ep_only = false

[X-Hider 1.0 -> GlobaL]
signature = 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90
ep_only = false

[X-Hider 1.0 -> GlobaL]
signature = 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF
ep_only = false

[XM music file]
signature = 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A
ep_only = false

[Xtreme-Protector v1.05]
signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02
ep_only = false

[XXPack 0.1 -> bagie]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3
ep_only = false

[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75
ep_only = false

[yoda's Protector 1.0x -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01
ep_only = false

[ZealPack 1.0 -> Zeal]
signature = C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD
ep_only = false

[Zylom encrypted game -> Zylom games (h)]
signature = 2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 7A 79 6C 6D 73 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2E 7A 79 6C 6D 69 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0
ep_only = false



================================================
FILE: todo.txt
================================================
[PE]
add signature:
 1) https://github.com/phra/PEzor
 2) https://github.com/nexe/nexe

================================================
FILE: update.json
================================================
{
  "data": "Hello World!",
  "source": "github pages"
}


================================================
FILE: yara_rules/DiE_BasicHeuristics_by_DosX.yar
================================================
/*
    Author: DosX
    E-Mail: collab@kay-software.ru
    GitHub: https://github.com/DosX-dev
    Telegram: @DosX_dev
*/

// This module was written specifically for the Detect It Easy project.
// Please retain the copyright information when distributing it.

import "pe"
import "math"

rule Obfuscated__AntiILDASM {
    strings:
        $suppressIldasm = "SuppressIldasmAttribute"
    condition:
        any of them
}

rule Obfuscated__FakeSignatures {
    strings:
        $_1 = "Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode"
        $_2 = "CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute"
        $_3 = "SecureTeam.Attributes.ObfuscatedByAgileDotNetAttribute"
        $_4 = "Xenocode.Client.Attributes.AssemblyAttributes"
        $_5 = "SmartAssembly.Attributes.PoweredByAttribute"
        $_6 = "ObfuscatedByAgileDotNetAttribute"
        $_7 = "NineRays.Obfuscator.Evaluation"
        $_8 = "ObfuscatedByCliSecureAttribute"
        $_9 = "BabelObfuscatorAttribute"
        $_10 = "AsStrongAsFuckAttribute"
        $_11 = "Macrobject.Obfuscator"
        $_12 = "DotfuscatorAttribute"
        $_13 = "CodeWallTrialVersion"
        $_14 = "ConfusedByAttribute"
        $_15 = "ObfuscatedByGoliath"
        $_16 = "NETSpider.Attribute"
        $_17 = "NineRays.Obfuscator"
        $_18 = "PoweredByAttribute"
        $_19 = "RustemSoft.Skater"
        $_20 = "BabelAttribute"
        $_21 = "YanoAttribute"
        $_22 = "EMyPID_8234_"
        $_23 = "ZYXDNGuarder"
        $_24 = "Sixxpack"
        $_25 = "____KILL"
        $_26 = "Reactor"
    condition:
        2 of them
}

rule Obfuscated__Virtualization {
    strings:
        $SystemReflection = "System.Reflection"
        $GetILGenerator = "GetILGenerator"
        $BeginInvoke = "BeginInvoke"
        $EndInvoke = "EndInvoke"
        $OpCode = "OpCode"
        $Ldarg_0 = "Ldarg_0"
        $CreateDelegate = "CreateDelegate"
    condition:
        ($SystemReflection and $GetILGenerator and $BeginInvoke and $EndInvoke and $OpCode) and ($Ldarg_0 or $CreateDelegate)
}

rule Obfuscated__AntiDe4dot {
    strings:
        $moduleName = "Form0"
    condition:
        any of them
}

rule Packed__EntryPoint {
    strings:
        $pushal = { 60 }
    condition:
        $pushal at entrypoint
}

rule Packed__HighEntropy {
    condition:
        uint32(uint32(0x3C)) == 0x00004550 and
		math.entropy(0, filesize) >= 7.0
}

rule Packed__AssemblyInvoke {
    strings:
        $SystemReflection = "System.Reflection"
        $get_EP = "get_EntryPoint"
        $Assembly = "Assembly"
        $Invoke = "Invoke"
        $Load = "Load"
    condition:
        all of them
}

rule AntiAnalysis__AntiSandboxie {
    strings:
        $winApi = "GetModuleHandle"
        $dllName = "sbiedll" wide nocase
    condition:
        $winApi and $dllName
}

rule AntiAnalysis__AntiDnSpy {
    strings:
        $dnName = "dnspy" wide nocase
    condition:
        any of them
}

rule AntiAnalysis__AntiVM {
    strings:
        $vmware = "vmware" wide nocase
        $virtualbox = "virtualbox" wide nocase
    condition:
        any of them
}

rule AntiAnalysis__AntiDebug {
    strings:
        $obj = "Debugger"
        $isAttached = "get_IsAttached"
        $isLogging = "IsLogging"
    condition:
        $obj and ($isAttached or $isLogging)
}


================================================
FILE: yara_rules/DiE_InterestingThings_by_DosX.yar
================================================
/*
    Author: DosX
    E-Mail: collab@kay-software.ru
    GitHub: https://github.com/DosX-dev
    Telegram: @DosX_dev
*/

// This module was written specifically for the Detect It Easy project.
// Please retain the copyright information when distributing it.

import "pe"
import "math"

// Is PE?
private rule IsPE { condition: pe.is_pe }

// Is i386?
private rule Is32 { condition: pe.machine == 0x14c }

// Is Dynamic Link Library?
private rule IsDll { condition: pe.characteristics & 0x2000 != 0 }

// Is unmanaged/native?
private rule IsNative { condition: pe.data_directories[14].virtual_address == 0 }

// Is Rich signature present?
private rule IsRichSignPresent {
    strings: $rich_pe = { 52 69 63 68 [4-128] 50 45 00 00 } // 'Rich' ... 'PE\0\0'
    condition: for any i in (0x40..0x400) : (@rich_pe == i)
}

rule Linker__Microsoft_Linker {
    condition:
        IsRichSignPresent
}

rule Compiler__NET_Native__debug {
    condition:
        IsPE and
        IsNative and
        IsRichSignPresent and
        pe.exports("DotNetRuntimeDebugHeader")
}

rule Compiler__NET_Native__release {
    strings:
        $exc_text = "Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code."
    condition:
        IsPE and
        IsNative and
        IsRichSignPresent and
        not Compiler__NET_Native__debug and
        $exc_text in (0x40000..(pe.size_of_image - 0x8000))
}

rule Library__Qt_Framework {
    strings:
        $core_module_name = "QtCore"
        $qstring = "QString"
    condition:
        IsPE and
        IsNative and
        $core_module_name and $qstring
}

rule Tool__XVolkolak {
    condition:
        IsPE and
        IsNative and (
            for any i in (0..pe.number_of_sections - 1) : (
                pe.sections[i].name == ".xvlk"
            )
        )
}

rule Packer__UPX {
    strings: $magicVerId = "UPX!"
    condition:
        IsPE and (
            pe.sections[0].name == "UPX0" and
            pe.sections[1].name == "UPX1"
        ) or $magicVerId in (0x40..0x400)
}

rule Packer__MPRESS {
    strings:
        $pushad = { 60 }
        $pushedi = { 57 }
        $magicForNative = { 57 69 6e ?? ?? 20 2e}
        $magicForDotNet = "It's .NET EXE"
    condition:
        IsPE and (
            pe.sections[0].name == ".MPRESS1" or (
                (IsNative and $magicForNative in (0x40..0x400)) or
                (not IsNative and $magicForDotNet in (0x40..0x400))
            )
        ) and (
            not IsNative or (
                $pushad at pe.entry_point or
                $pushedi at pe.entry_point
            )
        )
}

rule Packer__VPacker {
    strings:
        $entry = { 60 E8 ?? ?? ?? ?? C3 90 01 00 00 00 2C ?? 00 00 70 ?? 00 00 25 }
    condition:
        IsPE and
        IsNative and
        $entry at pe.entry_point
}

rule Packer__XPack {
    condition:
        IsPE and
        IsNative and
        pe.sections[0].name == ".XPack0"
}

rule Packer__PEPack {
    condition:
        IsPE and
        IsNative and (
            for any i in (0..pe.number_of_sections - 1) : (
                pe.sections[i].name == "PEPACK!!"
            )
        )
}

rule Packer__SoftwareCompress {
    condition:
        IsPE and
        IsNative and (
            for any i in (0..pe.number_of_sections - 1) : (
                pe.sections[i].name == "SoftComp"
            )
        )
}

rule Packer__SimplePack {
    condition:
        IsPE and
        IsNative and (
            for any i in (0..pe.number_of_sections - 1) : (
                pe.sections[i].name == ".spack"
            )
        )
}

rule Packer__BoxedApp {
    condition:
        IsPE and
        IsNative and (
            for any i in (0..pe.number_of_sections - 1) : (
                pe.sections[i].name == ".bxpck" and
                pe.sections[i + 1].name == ".main"
            )
        )
}

rule Packer__py2exe {
    condition:
        IsPE and
        IsNative and
        not IsDll and
        pe.exports("PyArg_ParseTuple")
}

rule Protector__SecuROM {
    condition:
        IsPE and
        IsNative and
        pe.sections[pe.number_of_sections - 1].name == ".securom"
}

rule Protection__obfus_h {
    condition:
        IsPE and
        IsNative and
        not IsRichSignPresent and (
            for any i in (0..pe.number_of_sections - 1) : (
                pe.sections[i].name == ".obfh"
            ) or pe.exports("WhatSoundDoesACowMake")
        )
}

================================================
FILE: yara_rules/crypto_signature.yar
================================================
/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule Big_Numbers0 {
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 20:sized"
		date = "2016-07"
	strings:
		$c0 = /[0-9a-fA-F]{20}/ fullword ascii
	condition:
		$c0
}

rule Big_Numbers1 {
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 32:sized"
		date = "2016-07"
	strings:
		$c0 = /[0-9a-fA-F]{32}/ fullword wide ascii
	condition:
		$c0
}

rule Big_Numbers2 {
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 48:sized"
		date = "2016-07"
	strings:
		$c0 = /[0-9a-fA-F]{48}/ fullword wide ascii
	condition:
		$c0
}

rule Big_Numbers3 {
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 64:sized"
		date = "2016-07"
	strings:
        	$c0 = /[0-9a-fA-F]{64}/ fullword wide ascii
	condition:
		$c0
}

rule Big_Numbers4 {
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 128:sized"
		date = "2016-08"
	strings:
        	$c0 = /[0-9a-fA-F]{128}/ fullword wide ascii
	condition:
		$c0
}

rule Big_Numbers5 {
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 256:sized"
		date = "2016-08"
	strings:
        	$c0 = /[0-9a-fA-F]{256}/ fullword wide ascii
	condition:
		$c0
}

rule Prime_Constants_char {
	meta:
		author = "_pusher_"
		description = "List of primes [char]"
		date = "2016-07"
	strings:
		$c0 = { 03 05 07 0B 0D 11 13 17 1D 1F 25 29 2B 2F 35 3B 3D 43 47 49 4F 53 59 61 65 67 6B 6D 71 7F 83 89 8B 95 97 9D A3 A7 AD B3 B5 BF C1 C5 C7 D3 DF E3 E5 E9 EF F1 FB }
	condition:
		$c0
}

rule Prime_Constants_long {
	meta:
		author = "_pusher_"
		description = "List of primes [long]"
		date = "2016-07"
	strings:
		$c0 = { 03 00 00 00 05 00 00 00 07 00 00 00 0B 00 00 00 0D 00 00 00 11 00 00 00 13 00 00 00 17 00 00 00 1D 00 00 00 1F 00 00 00 25 00 00 00 29 00 00 00 2B 00 00 00 2F 00 00 00 35 00 00 00 3B 00 00 00 3D 00 00 00 43 00 00 00 47 00 00 00 49 00 00 00 4F 00 00 00 53 00 00 00 59 00 00 00 61 00 00 00 65 00 00 00 67 00 00 00 6B 00 00 00 6D 00 00 00 71 00 00 00 7F 00 00 00 83 00 00 00 89 00 00 00 8B 00 00 00 95 00 00 00 97 00 00 00 9D 00 00 00 A3 00 00 00 A7 00 00 00 AD 00 00 00 B3 00 00 00 B5 00 00 00 BF 00 00 00 C1 00 00 00 C5 00 00 00 C7 00 00 00 D3 00 00 00 DF 00 00 00 E3 00 00 00 E5 00 00 00 E9 00 00 00 EF 00 00 00 F1 00 00 00 FB 00 00 00 }
	condition:
		$c0
}


rule Advapi_Hash_API {
	meta:
		author = "_pusher_"
		description = "Looks for advapi API functions"
		date = "2016-07"
	strings:
		$advapi32 = "advapi32.dll" wide ascii nocase
		$CryptCreateHash = "CryptCreateHash" wide ascii
		$CryptHashData = "CryptHashData" wide ascii
		$CryptAcquireContext = "CryptAcquireContext" wide ascii
	condition:
		$advapi32 and ($CryptCreateHash and $CryptHashData and $CryptAcquireContext)
}

rule Crypt32_CryptBinaryToString_API {
	meta:
		author = "_pusher_"
		description = "Looks for crypt32 CryptBinaryToStringA function"
		date = "2016-08"
	strings:
		$crypt32 = "crypt32.dll" wide ascii nocase
		$CryptBinaryToStringA = "CryptBinaryToStringA" wide ascii
	condition:
		$crypt32 and ($CryptBinaryToStringA)
}

rule CRC32c_poly_Constant {
	meta:
		author = "_pusher_"
		description = "Look for CRC32c (Castagnoli) [poly]"
		date = "2016-08"
	strings:
		$c0 = { 783BF682 }
	condition:
		$c0
}

rule CRC32_poly_Constant {
	meta:
		author = "_pusher_"
		description = "Look for CRC32 [poly]"
		date = "2015-05"
		version = "0.1"
	strings:
		$c0 = { 2083B8ED }
	condition:
		$c0
}

rule CRC32_table {
	meta:
		author = "_pusher_"
		description = "Look for CRC32 table"
		date = "2015-05"
		version = "0.1"
	strings:
		$c0 = { 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 }
	condition:
		$c0
}

rule CRC32_table_lookup {
	meta:
		author = "_pusher_"
		description = "CRC32 table lookup"
		date = "2015-06"
		version = "0.1"
	strings:
		$c0 = { 8B 54 24 08 85 D2 7F 03 33 C0 C3 83 C8 FF 33 C9 85 D2 7E 29 56 8B 74 24 08 57 8D 9B 00 00 00 00 0F B6 3C 31 33 F8 81 E7 FF 00 00 00 C1 E8 08 33 04 BD ?? ?? ?? ?? 41 3B CA 7C E5 5F 5E F7 D0 C3 }
	condition:
		$c0
}

rule CRC32b_poly_Constant {
	meta:
		author = "_pusher_"
		description = "Look for CRC32b [poly]"
		date = "2016-04"
		version = "0.1"
	strings:
		$c0 = { B71DC104 }
	condition:
		$c0
}


rule CRC16_table {
	meta:
		author = "_pusher_"
		description = "Look for CRC16 table"
		date = "2016-04"
		version = "0.1"
	strings:
		$c0 = { 00 00 21 10 42 20 63 30 84 40 A5 50 C6 60 E7 70 08 81 29 91 4A A1 6B B1 8C C1 AD D1 CE E1 EF F1 31 12 10 02 73 32 52 22 B5 52 94 42 F7 72 D6 62 39 93 18 83 7B B3 5A A3 BD D3 9C C3 FF F3 DE E3 }
	condition:
		$c0
}


rule FlyUtilsCnDES_ECB_Encrypt {
	meta:
		author = "_pusher_"
		description = "Look for FlyUtils.CnDES Encrypt ECB function"
		date = "2016-07"
	strings:
		$c0 = { 55 8B EC 83 C4 E8 53 56 57 33 DB 89 5D E8 89 5D EC 8B D9 89 55 F8 89 45 FC 8B 7D 08 8B 75 20 8B 45 FC E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 80 7D 18 00 74 1A 0F B6 55 18 8D 4D EC 8B 45 F8 E8 ?? ?? ?? ?? 8B 55 EC 8D 45 F8 E8 ?? ?? ?? ?? 80 7D 1C 00 74 1A 0F B6 55 1C 8D 4D E8 8B 45 FC E8 ?? ?? ?? ?? 8B 55 E8 8D 45 FC E8 ?? ?? ?? ?? 85 DB 75 07 E8 ?? ?? ?? ?? 8B D8 85 F6 75 07 E8 ?? ?? ?? ?? 8B F0 53 6A 00 8B 4D FC B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F4 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 6A 00 6A 00 8B 45 F4 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 6A 00 33 C9 B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F0 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 6A 00 6A 00 56 }
	condition:
		$c0
}

rule FlyUtilsCnDES_ECB_Decrypt {
	meta:
		author = "_pusher_"
		description = "Look for FlyUtils.CnDES Decrypt ECB function"
		date = "2016-07"
	strings:
		$c0 = { 55 8B EC 83 C4 E8 53 56 57 33 DB 89 5D E8 89 5D EC 8B F9 89 55 F8 89 45 FC 8B 5D 18 8B 75 20 8B 45 FC E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 84 DB 74 18 8B D3 8D 4D EC 8B 45 F8 E8 ?? ?? ?? ?? 8B 55 EC 8D 45 F8 E8 ?? ?? ?? ?? 85 FF 75 07 E8 ?? ?? ?? ?? 8B F8 85 F6 75 07 E8 ?? ?? ?? ?? 8B F0 8B 4D FC B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F4 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 57 6A 00 33 C9 B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F0 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 6A 00 6A 00 56 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 FF 75 14 FF 75 10 8B 45 0C 50 8B 4D F8 8B 55 F0 8B 45 F4 E8 ?? ?? ?? ?? 6A 00 6A 00 8B 45 F0 E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 55 08 8B 45 F0 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB 12 E9 ?? ?? ?? ?? 8B 45 08 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 F0 33 D2 89 55 F0 E8 ?? ?? ?? ?? C3 }
	condition:
		$c0
}

rule Elf_Hash {
	meta:
		author = "_pusher_"
		description = "Look for ElfHash"
		date = "2015-06"
		version = "0.3"
	strings:
		$c0 = { 53 56 33 C9 8B DA 4B 85 DB 7C 25 43 C1 E1 04 33 D2 8A 10 03 CA 8B D1 81 E2 00 00 00 F0 85 D2 74 07 8B F2 C1 EE 18 33 CE F7 D2 23 CA 40 4B 75 DC 8B C1 5E 5B C3 }
		$c1 = { 53 33 D2 85 C0 74 2B EB 23 C1 E2 04 81 E1 FF 00 00 00 03 D1 8B CA 81 E1 00 00 00 F0 85 C9 74 07 8B D9 C1 EB 18 33 D3 F7 D1 23 D1 40 8A 08 84 C9 75 D7 8B C2 5B C3 }
		$c2 = { 53 56 33 C9 8B D8 85 D2 76 23 C1 E1 04 33 C0 8A 03 03 C8 8B C1 25 00 00 00 F0 85 C0 74 07 8B F0 C1 EE 18 33 CE F7 D0 23 C8 43 4A 75 DD 8B C1 5E 5B C3 }
		$c3 = { 53 56 57 8B F2 8B D8 8B FB 53 E8 ?? ?? ?? ?? 6B C0 02 71 05 E8 ?? ?? ?? ?? 8B D7 33 C9 8B D8 83 EB 01 71 05 E8 ?? ?? ?? ?? 85 DB 7C 2C 43 C1 E1 04 0F B6 02 03 C8 71 05 E8 ?? ?? ?? ?? 83 C2 01 B8 00 00 00 F0 23 C1 85 C0 74 07 8B F8 C1 EF 18 33 CF F7 D0 23 C8 4B 75 D5 8B C1 99 F7 FE 8B C2 85 C0 7D 09 03 C6 71 05 E8 ?? ?? ?? ?? 5F 5E 5B C3 }
		$c4 = { 53 33 D2 EB 2C 8B D9 80 C3 BF 80 EB 1A 73 03 80 C1 20 C1 E2 04 81 E1 FF 00 00 00 03 D1 8B CA 81 E1 00 00 00 F0 8B D9 C1 EB 18 33 D3 F7 D1 23 D1 40 8A 08 84 C9 75 CE 8B C2 5B C3 }
		$c5 = { 89 C2 31 C0 85 D2 74 30 2B 42 FC 74 2B 89 C1 29 C2 31 C0 53 0F B6 1C 11 01 C3 8D 04 1B C1 EB 14 8D 04 C5 00 00 00 00 81 E3 00 0F 00 00 31 D8 83 C1 01 75 E0 C1 E8 04 5B C3 }
		$c6 = { 53 33 D2 85 C0 74 38 EB 30 8B D9 80 C3 BF 80 EB 1A 73 03 80 C1 20 C1 E2 04 81 E1 FF 00 00 00 03 D1 8B CA 81 E1 00 00 00 F0 85 C9 74 07 8B D9 C1 EB 18 33 D3 F7 D1 23 D1 40 8A 08 84 C9 75 CA 8B C2 5B C3 }
	condition:
		any of them
}

rule BLOWFISH_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for Blowfish constants"
		date = "2014-01"
		version = "0.1"
	strings:
		$c0 = { D1310BA6 }
		$c1 = { A60B31D1 }	
		$c2 = { 98DFB5AC }
		$c3 = { ACB5DF98 }
		$c4 = { 2FFD72DB }
		$c5 = { DB72FD2F }
		$c6 = { D01ADFB7 }
		$c7 = { B7DF1AD0 }
		$c8 = { 4B7A70E9 }
		$c9 = { E9707A4B }
		$c10 = { F64C261C }
		$c11 = { 1C264CF6 }
	condition:
		6 of them
}

rule MD5_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for MD5 constants"
		date = "2014-01"
		version = "0.2"
	strings:
		// Init constants
		$c0 = { 67452301 }
		$c1 = { efcdab89 }
		$c2 = { 98badcfe }
		$c3 = { 10325476 }
		$c4 = { 01234567 }
		$c5 = { 89ABCDEF }
		$c6 = { FEDCBA98 }
		$c7 = { 76543210 }
		// Round 2
		$c8 = { F4D50d87 }
		$c9 = { 78A46AD7 }
	condition:
		5 of them
}

rule MD5_API {
	meta:
		author = "_pusher_"
		description = "Looks for MD5 API"
		date = "2016-07"
	strings:
		$advapi32 = "advapi32.dll" wide ascii nocase
		$cryptdll = "cryptdll.dll" wide ascii nocase
		$MD5Init = "MD5Init" wide ascii
		$MD5Update = "MD5Update" wide ascii
		$MD5Final = "MD5Final" wide ascii
	condition:
		($advapi32 or $cryptdll) and ($MD5Init and $MD5Update and $MD5Final)
}

rule RC6_Constants {
	meta:
		author = "chort (@chort0)"
		description = "Look for RC6 magic constants in binary"
		reference = "https://twitter.com/mikko/status/417620511397400576"
		reference2 = "https://twitter.com/dyngnosis/status/418105168517804033"
		date = "2013-12"
		version = "0.2"
	strings:
		$c1 = { B7E15163 }
		$c2 = { 9E3779B9 }
		$c3 = { 6351E1B7 }
		$c4 = { B979379E }
	condition:
		2 of them
}

rule RIPEMD160_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for RIPEMD-160 constants"
		date = "2014-01"
		version = "0.1"
	strings:
		$c0 = { 67452301 }
		$c1 = { EFCDAB89 }
		$c2 = { 98BADCFE }
		$c3 = { 10325476 }
		$c4 = { C3D2E1F0 }
		$c5 = { 01234567 }
		$c6 = { 89ABCDEF }
		$c7 = { FEDCBA98 }
		$c8 = { 76543210 }
		$c9 = { F0E1D2C3 }
	condition:
		5 of them
}

rule SHA1_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for SHA1 constants"
		date = "2014-01"
		version = "0.1"
	strings:
		$c0 = { 67452301 }
		$c1 = { EFCDAB89 }
		$c2 = { 98BADCFE }
		$c3 = { 10325476 }
		$c4 = { C3D2E1F0 }
		$c5 = { 01234567 }
		$c6 = { 89ABCDEF }
		$c7 = { FEDCBA98 }
		$c8 = { 76543210 }
		$c9 = { F0E1D2C3 }
		//added by _pusher_ 2016-07 - last round
		$c10 = { D6C162CA }
	condition:
		5 of them
}

rule SHA512_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for SHA384/SHA512 constants"
		date = "2014-01"
		version = "0.1"
	strings:
		$c0 = { 428a2f98 }
		$c1 = { 982F8A42 }
		$c2 = { 71374491 }
		$c3 = { 91443771 }
		$c4 = { B5C0FBCF }
		$c5 = { CFFBC0B5 }
		$c6 = { E9B5DBA5 }
		$c7 = { A5DBB5E9 }
		$c8 = { D728AE22 }
		$c9 = { 22AE28D7 }
	condition:
		5 of them
}

rule SHA2_BLAKE2_IVs {
	meta:
		author = "spelissier"
		description = "Look for SHA2/BLAKE2/Argon2 IVs"
		date = "2019-12"
		version = "0.1"
	strings:
		$c0 = { 67 E6 09 6A }
		$c1 = { 85 AE 67 BB }
		$c2 = { 72 F3 6E 3C }
		$c3 = { 3A F5 4F A5 }
		$c4 = { 7F 52 0E 51 }
		$c5 = { 8C 68 05 9B }
		$c6 = { AB D9 83 1F }
		$c7 = { 19 CD E0 5B }

	condition:
		all of them
}

rule TEAN {
	meta:
		author = "_pusher_"
		description = "Look for TEA Encryption"
		date = "2016-08"
	strings:
		$c0 = { 2037EFC6 }
	condition:
		$c0
}

rule WHIRLPOOL_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for WhirlPool constants"
		date = "2014-02"
		version = "0.1"
	strings:
		$c0 = { 18186018c07830d8 }
		$c1 = { d83078c018601818 }
		$c2 = { 23238c2305af4626 }
		$c3 = { 2646af05238c2323 }
	condition:
		2 of them
}

rule DarkEYEv3_Cryptor {
	meta:
		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
		author = "Florian Roth"
		reference = "http://darkeyev3.blogspot.fi/"
		date = "2015-05-24"
		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
		score = 55
	strings:
		$s0 = "\\DarkEYEV3-" 
	condition:
		uint16(0) == 0x5a4d and $s0
}

rule Miracl_powmod {	meta:
		author = "Maxx"
		description = "Miracl powmod"
	strings:
		$c0 = { 53 55 56 57 E8 ?? ?? ?? ?? 8B F0 8B 86 18 02 00 00 85 C0 0F 85 EC 01 00 00 8B 56 1C 42 8B C2 89 56 1C 83 F8 18 7D 17 C7 44 86 20 12 00 00 00 8B 86 2C 02 00 00 85 C0 74 05 E8 ?? ?? ?? ?? 8B 06 8B 4E 10 3B C1 74 2E 8B 7C 24 1C 57 E8 ?? ?? ?? ?? 83 C4 04 83 F8 02 7C 33 8B 57 04 8B 0E 51 8B 02 50 E8 ?? ?? ?? ?? 83 C4 08 83 F8 01 0F 84 58 01 00 00 EB 17 8B 7C 24 1C 6A 02 57 E8 ?? ?? ?? ?? 83 C4 08 85 C0 0F 84 3F 01 00 00 8B 8E C4 01 00 00 8B 54 24 18 51 52 E8 ?? ?? ?? ?? 8B 86 CC }
	condition:
		$c0
}

rule Miracl_crt {	meta:
		author = "Maxx"
		description = "Miracl crt"
	strings:
		$c0 = { 51 56 57 E8 ?? ?? ?? ?? 8B 74 24 10 8B F8 89 7C 24 08 83 7E 0C 02 0F 8C 99 01 00 00 8B 87 18 02 00 00 85 C0 0F 85 8B 01 00 00 8B 57 1C 42 8B C2 89 57 1C 83 F8 18 7D 17 C7 44 87 20 4A 00 00 00 8B 87 2C 02 00 00 85 C0 74 05 E8 ?? ?? ?? ?? 8B 46 04 8B 54 24 14 53 55 8B 08 8B 02 51 50 E8 ?? ?? ?? ?? 8B 4E 0C B8 01 00 00 00 83 C4 08 33 ED 3B C8 89 44 24 18 0F 8E C5 00 00 00 BF 04 00 00 00 8B 46 04 8B 0C 07 8B 10 8B 44 24 1C 51 52 8B 0C 07 51 E8 ?? ?? ?? ?? 8B 56 04 8B 4E 08 8B 04 }
	condition:
		$c0
}

rule CryptoPP_a_exp_b_mod_c {	meta:
		author = "Maxx"
		description = "CryptoPP a_exp_b_mod_c"
	strings:
		$c0 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? 00 00 00 56 8B B4 24 B0 00 00 00 57 6A 00 8B CE C7 44 24 0C 00 00 00 00 E8 ?? ?? ?? ?? 84 C0 0F 85 16 01 00 00 8D 4C 24 24 E8 ?? ?? ?? ?? BF 01 00 00 00 56 8D 4C 24 34 89 BC 24 A4 00 00 00 E8 ?? ?? ?? ?? 8B 06 8D 4C 24 3C 50 6A 00 C6 84 24 A8 00 00 00 02 E8 ?? ?? ?? ?? 8D 4C 24 48 C6 84 24 A0 00 00 00 03 E8 ?? ?? ?? ?? C7 44 24 24 ?? ?? ?? ?? 8B 8C 24 AC 00 00 00 8D 54 24 0C 51 52 8D 4C 24 2C C7 84 24 A8 }
		$c1 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 4C 56 57 33 FF 8D 44 24 0C 89 7C 24 08 C7 44 24 10 ?? ?? ?? ?? C7 44 24 0C ?? ?? ?? ?? 89 44 24 14 8B 74 24 70 8D 4C 24 18 56 89 7C 24 60 E8 ?? ?? ?? ?? 8B 76 08 8D 4C 24 2C 56 57 C6 44 24 64 01 E8 ?? ?? ?? ?? 8D 4C 24 40 C6 44 24 5C 02 E8 ?? ?? ?? ?? C7 44 24 0C ?? ?? ?? ?? 8B 4C 24 6C 8B 54 24 68 8B 74 24 64 51 52 56 8D 4C 24 18 C7 44 24 68 03 00 00 00 E8 ?? ?? ?? ?? 8B 7C 24 4C 8B 4C 24 48 8B D7 33 C0 F3 }
		$c2 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 34 56 57 33 FF 8D 44 24 0C 89 7C 24 08 C7 44 24 10 ?? ?? ?? ?? C7 44 24 0C ?? ?? ?? ?? 89 44 24 14 8B 74 24 58 8D 4C 24 18 56 89 7C 24 48 E8 ?? ?? ?? ?? 8B 0E C6 44 24 44 01 51 57 8D 4C 24 2C E8 ?? ?? ?? ?? 8D 4C 24 30 C6 44 24 44 02 E8 ?? ?? ?? ?? C7 44 24 0C ?? ?? ?? ?? 8B 54 24 54 8B 44 24 50 8B 74 24 4C 52 50 56 8D 4C 24 18 C7 44 24 50 03 00 00 00 E8 ?? ?? ?? ?? 8B 4C 24 30 8B 7C 24 34 33 C0 F3 AB 8B 4C }
	condition:
		any of them
}

rule CryptoPP_modulo {	meta:
		author = "Maxx"
		description = "CryptoPP modulo"
	strings:
		$c0 = { 83 EC 20 53 55 8B 6C 24 2C 8B D9 85 ED 89 5C 24 08 75 18 8D 4C 24 0C E8 ?? ?? ?? ?? 8D 44 24 0C 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D FF 56 85 CD 57 75 09 8B 53 04 8B 02 23 C1 EB 76 8B CB E8 ?? ?? ?? ?? 83 FD 05 8B C8 77 2D 33 F6 33 FF 49 85 C0 74 18 8B 53 04 8D 41 01 8D 14 8A 8B 0A 03 F1 83 D7 00 48 83 EA 04 85 C0 77 F1 6A 00 55 57 56 E8 ?? ?? ?? ?? EB 3B 33 C0 8B D1 49 85 D2 74 32 8B 54 24 10 33 DB 8D 71 01 8B 52 04 8D 3C 8A 8B 17 33 ED 0B C5 8B 6C 24 34 33 C9 53 0B CA 55 }
		$c1 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 2C 56 57 8B F1 33 FF 8D 4C 24 20 89 7C 24 08 E8 ?? ?? ?? ?? 8D 4C 24 0C 89 7C 24 3C E8 ?? ?? ?? ?? 8B 44 24 48 8D 4C 24 0C 50 56 8D 54 24 28 51 52 C6 44 24 4C 01 E8 ?? ?? ?? ?? 8B 74 24 54 83 C4 10 8D 44 24 20 8B CE 50 E8 ?? ?? ?? ?? 8B 7C 24 18 8B 4C 24 14 8B D7 33 C0 F3 AB 52 E8 ?? ?? ?? ?? 8B 7C 24 30 8B 4C 24 2C 8B D7 33 C0 C7 44 24 10 ?? ?? ?? ?? 52 F3 AB E8 ?? ?? ?? ?? 8B 4C 24 3C 83 C4 08 8B C6 64 89 }
		$c2 = { 83 EC 24 53 55 8B 6C 24 30 8B D9 85 ED 89 5C 24 08 75 18 8D 4C 24 0C E8 ?? ?? ?? ?? 8D 44 24 0C 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D FF 56 85 CD 57 75 09 8B 53 0C 8B 02 23 C1 EB 76 8B CB E8 ?? ?? ?? ?? 83 FD 05 8B C8 77 2D 33 F6 33 FF 49 85 C0 74 18 8B 53 0C 8D 41 01 8D 14 8A 8B 0A 03 F1 83 D7 00 48 83 EA 04 85 C0 77 F1 6A 00 55 57 56 E8 ?? ?? ?? ?? EB 3B 33 C0 8B D1 49 85 D2 74 32 8B 54 24 10 33 DB 8D 71 01 8B 52 0C 8D 3C 8A 8B 17 33 ED 0B C5 8B 6C 24 38 33 C9 53 0B CA 55 }
		$c3 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 1C 56 57 8B F1 33 FF 8D 4C 24 0C 89 7C 24 08 E8 ?? ?? ?? ?? 8D 4C 24 18 89 7C 24 2C E8 ?? ?? ?? ?? 8B 44 24 38 8D 4C 24 18 50 56 8D 54 24 14 51 52 C6 44 24 3C 01 E8 ?? ?? ?? ?? 8B 74 24 44 83 C4 10 8D 44 24 0C 8B CE 50 E8 ?? ?? ?? ?? 8B 4C 24 18 8B 7C 24 1C 33 C0 F3 AB 8B 4C 24 1C 51 E8 ?? ?? ?? ?? 8B 4C 24 10 8B 7C 24 14 33 C0 F3 AB 8B 54 24 14 52 E8 ?? ?? ?? ?? 8B 4C 24 2C 83 C4 08 8B C6 64 89 0D 00 00 00 }
	condition:
		any of them
}

rule FGint_MontgomeryModExp {	meta:
		author = "_pusher_"
		date = "2015-06"
		version = "0.2"
		description = "FGint MontgomeryModExp"
	strings:
		$c0 = { 55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 8B F1 8B DA 89 45 ?? 8B 7D 08 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 D4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF 8B D6 8B 45 FC E8 ?? ?? ?? ?? 8D 55 D4 8B C7 E8 ?? ?? ?? ?? 3C 02 75 0D 8D 45 D4 E8 ?? ?? ?? ?? E9 }
		$c1 = { 55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 8B F1 8B DA 89 45 ?? 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 D4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF 8B D6 8B 45 FC E8 ?? ?? ?? ?? 8D 55 D4 8B C7 E8 ?? ?? ?? ?? 3C 02 75 0D 8D 45 D4 E8 ?? ?? ?? ?? E9 }
		$c2 = { 55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 8B F1 8B DA 89 45 ?? 8B 7D 08 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 D4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF 8B D6 8B 45 ?? E8 ?? ?? ?? ?? 8D 55 D4 8B C7 E8 ?? ?? ?? ?? 3C 02 75 0D 8D 45 D4 E8 ?? ?? ?? ?? E9 }
		$c3 = { 55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 8B F1 8B DA 89 45 D0 8B 7D 08 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 47 4C 47 00 64 FF 30 64 89 20 8D 55 D4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF 8B D6 8B 45 D0 E8 ?? ?? ?? ?? 8D 55 D4 8B C7 E8 ?? ?? ?? ?? 3C 02 75 0D 8D 45 D4 E8 ?? ?? ?? ?? E9 02 02 00 00 }
	condition:
		any of them
}

rule FGint_FGIntModExp {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint FGIntModExp"
	strings:
		$c0 = { 55 8B EC 83 C4 E8 53 56 57 33 DB 89 5D ?? 8B F1 89 55 ?? 8B D8 8B 7D 08 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 46 04 8B 40 04 83 E0 01 83 F8 01 75 0F 57 8B CE 8B 55 ?? 8B C3 E8 ?? ?? ?? ?? EB ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 F4 8B C3 E8 ?? ?? ?? ?? 8B 45 }
	condition:
		$c0
}

rule FGint_MulByInt {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint MulByInt"
	strings:
		$c0 = { 53 56 57 55 83 C4 E8 89 4C 24 04 8B EA 89 04 24 8B 04 24 8B 40 04 8B 00 89 44 24 08 8B 44 24 08 83 C0 02 50 8D 45 04 B9 01 00 00 00 8B 15 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 C4 04 33 F6 8B 7C 24 08 85 FF 76 6D BB 01 00 00 00 8B 04 24 8B 40 04 8B 04 98 33 D2 89 44 24 10 89 54 24 14 8B 44 24 04 33 D2 52 50 8B 44 24 18 8B 54 24 1C ?? ?? ?? ?? ?? 89 44 24 10 89 54 24 14 8B C6 33 D2 03 44 24 10 13 54 24 14 89 44 24 10 89 54 24 14 8B 44 24 10 25 FF FF FF 7F 8B 55 04 89 04 9A 8B 44 24 10 8B 54 24 14 0F AC D0 1F C1 EA 1F 8B F0 43 4F 75 98 }
	condition:
		$c0
}

rule FGint_DivMod {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint FGIntDivMod"
	strings:
		$c0 = { 55 8B EC 83 C4 BC 53 56 57 8B F1 89 55 F8 89 45 FC 8B 5D 08 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 FC 8A 00 88 45 D7 8B 45 F8 8A 00 88 45 D6 8B 45 FC E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 8B D3 8B 45 FC E8 ?? ?? ?? ?? 8D 55 E0 8B 45 F8 E8 ?? ?? ?? ?? 8B 55 F8 8B 45 FC }
	condition:
		$c0
}

rule FGint_FGIntDestroy {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint FGIntDestroy"
	strings:
		$c0 = { 53 8B D8 8D 43 04 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B C3 }
	condition:
		$c0
}

rule FGint_Base10StringToGInt {	meta:
		author = "_pusher_"
		date = "2015-06"
		version = "0.2"
		description = "FGint Base10StringToGInt"
	strings:
		$c0 = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 8B DA 89 45 FC 8B 45 FC ?? ?? ?? ?? ?? 33 C0 55 ?? ?? ?? ?? ?? 64 FF 30 64 89 20 EB 12 8D 45 FC B9 01 00 00 00 BA 01 00 00 00 ?? ?? ?? ?? ?? 8B 45 FC 8A 00 2C 2D 74 11 04 FD 2C 0A 72 0B 8B 45 FC ?? ?? ?? ?? ?? 48 7F D4 8D 45 E4 50 B9 01 00 00 00 BA 01 00 00 00 8B 45 FC ?? ?? ?? ?? ?? 8B 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 18 C6 45 EB 00 8D 45 FC B9 01 00 00 00 BA 01 00 00 00 ?? ?? ?? ?? ?? EB 18 C6 45 EB 01 EB 12 8D 45 FC }
		$c1 = { 55 8B EC 83 C4 D8 53 56 57 33 C9 89 4D D8 89 4D DC 89 4D E0 89 4D E4 89 4D EC 8B DA 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 33 C0 55 68 0F 42 45 00 64 FF 30 64 89 20 EB 12 8D 45 FC B9 01 00 00 00 BA 01 00 00 00 E8 ?? ?? ?? ?? 8B 45 FC 8A 00 2C 2D 74 11 04 FD 2C 0A 72 0B 8B 45 FC E8 ?? ?? ?? ?? 48 7F D4 8D 45 E4 50 B9 01 00 00 00 BA 01 00 00 00 8B 45 FC E8 ?? ?? ?? ?? 8B 45 E4 BA 28 42 45 00 E8 ?? ?? ?? ?? 75 18 C6 45 EB 00 8D 45 FC B9 01 00 00 00 BA 01 00 00 00 E8 ?? ?? ?? ?? EB 18 C6 45 EB 01 }
		$c2 = { 55 8B EC 83 C4 D8 53 56 33 C9 89 4D D8 89 4D DC 89 4D E0 89 4D F8 89 4D F4 8B DA 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 33 C0 55 68 A6 32 47 00 64 FF 30 64 89 20 EB 12 8D 45 FC B9 01 00 00 00 BA 01 00 00 00 E8 ?? ?? ?? ?? 8B 45 FC 0F B6 00 2C 2D 74 11 04 FD 2C 0A 72 0B 8B 45 FC E8 ?? ?? ?? ?? 48 7F D3 8D 45 E0 50 B9 01 00 00 00 BA 01 00 00 00 8B 45 FC E8 ?? ?? ?? ?? 8B 45 E0 BA BC 32 47 00 E8 ?? ?? ?? ?? 75 18 C6 45 E9 00 8D 45 FC B9 01 00 00 00 BA 01 00 00 00 E8 ?? ?? ?? ?? EB 18 C6 45 E9 01 }

	condition:
		any of them
}

rule FGint_ConvertBase256to64 {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint ConvertBase256to64"
	strings:
		$c0 = { 55 8B EC 81 C4 EC FB FF FF 53 56 57 33 C9 89 8D EC FB FF FF 89 8D F0 FB FF FF 89 4D F8 8B FA 89 45 FC B9 00 01 00 00 8D 85 F4 FB FF FF 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 F4 FB FF FF BA FF 00 00 00 E8 ?? ?? ?? ?? 8D 45 F8 E8 ?? ?? ?? ?? 8B 45 FC E8 ?? ?? ?? ?? 8B D8 85 DB 7E 2F BE 01 00 00 00 8D 45 F8 8B 55 FC 0F B6 54 32 FF 8B 94 95 F4 FB FF FF E8 ?? ?? ?? ?? 46 4B 75 E5 EB }
	condition:
		$c0
}

rule FGint_ConvertHexStringToBase256String {	meta:
		author = "_pusher_"
		date = "2015-06"
		version = "0.2"
		description = "FGint ConvertHexStringToBase256String"
	strings:
		$c0 = { 55 8B EC 83 C4 F0 53 56 33 C9 89 4D F0 89 55 F8 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 F8 E8 ?? ?? ?? ?? 8B 45 FC E8 ?? ?? ?? ?? D1 F8 79 03 83 D0 00 85 C0 7E 5F 89 45 F4 BE 01 00 00 00 8B C6 03 C0 8B 55 FC 8A 54 02 FF 8B 4D FC 8A 44 01 FE 3C 3A 73 0A 8B D8 80 EB 30 C1 E3 04 EB 08 8B D8 80 EB 37 C1 E3 04 80 FA 3A 73 07 80 EA 30 0A DA EB 05 80 EA 37 0A DA 8D 45 F0 8B D3 }
	condition:
		$c0
}

rule FGint_Base256StringToGInt {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint Base256StringToGInt"
	strings:
		$c0 = { 55 8B EC 81 C4 F8 FB FF FF 53 56 57 33 C9 89 4D F8 8B FA 89 45 FC 8B 45 FC ?? ?? ?? ?? ?? B9 00 01 00 00 8D 85 F8 FB FF FF 8B 15 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 55 ?? ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 F8 ?? ?? ?? ?? ?? 8D 85 F8 FB FF FF BA FF 00 00 00 ?? ?? ?? ?? ?? 8B 45 FC ?? ?? ?? ?? ?? 8B D8 85 DB 7E 34 BE 01 00 00 00 8D 45 F8 8B 55 FC 0F B6 54 32 FF 8B 94 95 F8 FB FF FF ?? ?? ?? ?? ?? 46 4B 75 E5 EB 12 8D 45 F8 B9 01 00 00 00 BA 01 00 00 00 ?? ?? ?? ?? ?? 8B 45 F8 80 38 30 75 0F }
	condition:
		$c0
}

rule FGint_FGIntToBase256String {	meta:
		author = "_pusher_"
		date = "2015-06"
		version = "0.2"
		description = "FGint FGIntToBase256String"
	strings:
		$c0 = { 55 8B EC 33 C9 51 51 51 51 53 56 8B F2 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8D 55 FC E8 ?? ?? ?? ?? EB 10 8D 45 FC 8B 4D FC BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 FC E8 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 85 C0 75 D8 8B 45 FC E8 ?? ?? ?? ?? 8B D8 85 DB 79 03 83 C3 07 C1 FB 03 8B C6 E8 ?? ?? ?? ?? 85 DB 76 4B 8D 45 F4 50 B9 08 00 00 00 BA 01 00 00 00 8B 45 FC E8 ?? ?? ?? ?? 8B 55 F4 8D 45 FB E8 ?? ?? ?? ?? 8D 45 F0 8A 55 FB E8 ?? ?? ?? ?? 8B 55 F0 8B C6 E8 ?? ?? ?? ?? 8D 45 FC B9 08 00 00 00 BA 01 00 00 00 E8 ?? ?? ?? ?? 4B 75 B5 }
		$c1 = { 55 8B EC 33 C9 51 51 51 51 53 56 8B F2 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8D 55 FC E8 ?? ?? ?? ?? EB 10 8D 45 FC 8B 4D FC BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 FC E8 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 85 C0 75 D8 8B 45 FC 85 C0 74 05 83 E8 04 8B 00 8B D8 85 DB 79 03 83 C3 07 C1 FB 03 8B C6 E8 ?? ?? ?? ?? 85 DB 76 4C 8D 45 F4 50 B9 08 00 00 00 BA 01 00 00 00 8B 45 FC E8 ?? ?? ?? ?? 8B 55 F4 8D 45 FB E8 ?? ?? ?? ?? 8D 45 F0 0F B6 55 FB E8 ?? ?? ?? ?? 8B 55 F0 8B C6 E8 ?? ?? ?? ?? 8D 45 FC B9 08 00 00 00 BA 01 00 00 00 E8 }
	condition:
		any of them
}

rule FGint_ConvertBase256StringToHexString {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint ConvertBase256StringToHexString"
	strings:
		$c0 = { 55 8B EC 33 C9 51 51 51 51 51 51 53 56 57 8B F2 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B C6 E8 ?? ?? ?? ?? 8B 45 FC E8 ?? ?? ?? ?? 8B F8 85 FF 0F 8E AB 00 00 00 C7 45 F8 01 00 00 00 8B 45 FC 8B 55 F8 8A 5C 10 FF 33 C0 8A C3 C1 E8 04 83 F8 0A 73 1E 8D 45 F4 33 D2 8A D3 C1 EA 04 83 C2 30 E8 ?? ?? ?? ?? 8B 55 F4 8B C6 E8 ?? ?? ?? ?? EB 1C 8D 45 F0 33 D2 8A D3 C1 EA 04 83 C2 37 E8 ?? ?? ?? ?? 8B 55 F0 8B C6 E8 ?? ?? ?? ?? 8B C3 24 0F 3C 0A 73 22 8D 45 EC 8B D3 80 E2 0F 81 E2 FF 00 00 00 83 C2 30 E8 ?? ?? ?? ?? 8B 55 EC 8B C6 E8 ?? ?? ?? ?? EB 20 8D 45 E8 8B D3 80 E2 0F 81 E2 FF 00 00 00 83 C2 37 }
	condition:
		$c0
}


rule FGint_PGPConvertBase256to64 {	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "FGint PGPConvertBase256to64"
	strings:
		$c0 = { 55 8B EC 81 C4 E8 FB FF FF 53 56 57 33 C9 89 8D E8 FB FF FF 89 4D F8 89 4D F4 89 4D F0 8B FA 89 45 FC B9 00 01 00 00 8D 85 EC FB FF FF 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 EC FB FF FF BA FF 00 00 00 E8 ?? ?? ?? ?? 8D 45 F8 E8 ?? ?? ?? ?? 8B 45 FC 8B 00 E8 ?? ?? ?? ?? 8B D8 85 DB 7E 22 BE 01 00 00 00 8D 45 F8 8B 55 FC 8B 12 0F B6 54 32 FF 8B 94 95 EC FB FF FF E8 ?? ?? ?? ?? 46 4B 75 E3 8B 45 F8 E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 85 D2 75 0A 8D 45 F0 E8 ?? ?? ?? ?? EB 4B 8B 45 F8 E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 83 FA 04 75 1C 8D 45 F8 BA 4C 33 40 00 E8 ?? ?? ?? ?? 8D 45 F0 BA 58 33 40 00 E8 ?? ?? ?? ?? EB 1A 8D 45 F8 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 F0 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B D8 85 DB 7E 57 8D 45 F4 50 B9 06 00 00 00 BA 01 00 00 00 8B 45 F8 E8 ?? ?? ?? ?? 8D 45 EC 8B 55 F4 E8 ?? ?? ?? ?? 8D 85 E8 FB FF FF 8B 55 EC 8A 92 ?? ?? ?? ?? E8 }
	condition:
		$c0
}


rule FGint_RSAEncrypt {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "FGint RSAEncrypt"
	strings:
		$c0 = { 55 8B EC 83 C4 D0 53 56 57 33 DB 89 5D D0 89 5D DC 89 5D D8 89 5D D4 8B F9 89 55 F8 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 E0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 DC 8B C7 E8 ?? ?? ?? ?? 8B 45 DC E8 ?? ?? ?? ?? 8B D8 8D 55 DC 8B 45 FC E8 ?? ?? ?? ?? 8D 45 DC 8B 4D DC BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F3 4E EB 10 }
	condition:
		$c0
}

rule FGint_RsaDecrypt {	meta:
		author = "Maxx"
		description = "FGint RsaDecrypt"
	strings:
		$c0 = { 55 8B EC 83 C4 A0 53 56 57 33 DB 89 5D A0 89 5D A4 89 5D A8 89 5D B4 89 5D B0 89 5D AC 89 4D F8 8B FA 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 B8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 }
	condition:
		$c0
}

rule FGint_RSAVerify {	meta:
		author = "_pusher_"
		description = "FGint RSAVerify"
	strings:
		$c0 = { 55 8B EC 83 C4 E0 53 56 8B F1 89 55 F8 89 45 FC 8B 5D 0C 8B 45 FC E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 E8 8B 45 F8 E8 ?? ?? ?? ?? 8D 55 F0 8B 45 FC E8 ?? ?? ?? ?? 8D 4D E0 8B D3 8D 45 F0 E8 ?? ?? ?? ?? 8D 55 F0 8D 45 E0 E8 ?? ?? ?? ?? 8D 45 E0 50 8B CB 8B D6 8D 45 E8 E8 ?? ?? ?? ?? 8D 55 E8 8D 45 E0 E8 ?? ?? ?? ?? 8D 55 F0 8D 45 E8 E8 ?? ?? ?? ?? 3C 02 8B 45 08 0F 94 00 8D 45 E8 E8 ?? ?? ?? ?? 8D 45 F0 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? B9 03 00 00 00 E8 ?? ?? ?? ?? 8D 45 F8 BA 02 00 00 00 E8 ?? ?? ?? ?? C3 }
	condition:
		$c0
}

rule FGint_FindPrimeGoodCurveAndPoint {	meta:
		author = "_pusher_"
		date = "2015-06"
		description = "FGint FindPrimeGoodCurveAndPoint"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 F4 53 56 57 33 DB 89 5D F4 89 4D FC 8B FA 8B F0 33 C0 55 }
	condition:
		$c0
}

rule FGint_ECElGamalEncrypt {	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "FGint ECElGamalEncrypt"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 81 C4 3C FF FF FF 53 56 57 33 DB 89 5D D8 89 5D D4 89 5D D0 8B 75 10 8D 7D 8C A5 A5 A5 A5 A5 8B 75 14 8D 7D A0 A5 A5 A5 A5 A5 8B 75 18 8D 7D DC A5 A5 8B 75 1C 8D 7D E4 A5 A5 8B F1 8D 7D EC A5 A5 8B F2 8D 7D F4 A5 A5 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 A0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 8C 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 78 FF FF FF 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 64 FF FF FF 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 50 FF FF FF 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 3C FF FF FF 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 BC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 B4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 7D CF }
		$c1 = { 55 8B EC 83 C4 A8 53 56 57 33 DB 89 5D A8 89 5D AC 89 5D BC 89 5D B8 89 5D B4 89 4D F4 89 55 F8 89 45 FC 8B 75 0C 8B 45 FC E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 71 14 41 00 64 FF 30 64 89 20 8D 55 BC 8B C6 E8 ?? ?? ?? ?? 8B 45 BC E8 ?? ?? ?? ?? 8B D8 8D 55 BC 8B 45 FC E8 ?? ?? ?? ?? 8D 45 BC 8B 4D BC BA 8C 14 41 00 E8 ?? ?? ?? ?? 8B FB 4F EB 10 8D 45 BC 8B 4D BC BA 98 14 41 00 E8 ?? ?? ?? ?? 8B 45 BC }
	condition:
		$c0 or $c1
}

rule FGint_ECAddPoints {	meta:
		author = "_pusher_"
		date = "2015-06"
		description = "FGint ECAddPoints"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 A8 53 56 57 8B 75 0C 8D 7D F0 A5 A5 8B F1 8D 7D F8 A5 A5 8B F2 8D 7D A8 A5 A5 A5 A5 A5 8B F0 8D 7D BC A5 A5 A5 A5 A5 8B 5D 08 8D 45 BC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 A8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 F8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D8 8B 15 ?? ?? ?? ?? E8 }
	condition:
		$c0
}

rule FGint_ECPointKMultiple {	meta:
		author = "_pusher_"
		date = "2015-06"
		description = "FGint ECPointKMultiple"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 BC 53 56 57 33 DB 89 5D E4 8B 75 0C 8D 7D E8 A5 A5 8B F1 8D 7D F0 A5 A5 8B F2 8D 7D F8 A5 A5 8B F0 8D 7D D0 A5 A5 A5 A5 A5 8B 5D 08 8D 45 D0 8B 15 ?? ?? ?? 00 E8 ?? ?? ?? ?? 8D 45 F8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 BC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 }
	condition:
		$c0
}

rule FGint_ECPointDestroy {	meta:
		author = "_pusher_"
		date = "2015-06"
		description = "FGint ECPointDestroy"
		version = "0.1"
	strings:
		$c0 = { 53 8B D8 8B C3 E8 ?? ?? ?? ?? 8D 43 08 E8 ?? ?? ?? ?? 5B C3 }
	condition:
		$c0
}

rule FGint_DSAPrimeSearch {	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "FGint DSAPrimeSearch"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 DC 53 56 8B DA 8B F0 8D 45 F8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 4D F8 8B D6 8B C6 E8 ?? ?? ?? ?? 8D 4D E8 8B D6 8B C3 E8 ?? ?? ?? ?? 8D 55 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D E0 8D 55 E8 8B C3 E8 ?? ?? ?? ?? 8D 45 E8 E8 ?? ?? ?? ?? 8D 4D E8 8D 55 F0 8D 45 E0 E8 ?? ?? ?? ?? 8D 45 E0 E8 ?? ?? ?? ?? 8D 45 F0 E8 ?? ?? ?? ?? 8B 45 EC 8B 40 04 83 E0 01 85 C0 75 18 8D 4D E0 8B D6 8D 45 E8 E8 ?? ?? ?? ?? 8D 55 E8 8D 45 E0 E8 ?? ?? ?? ?? 8B D3 8D 45 E8 E8 ?? ?? ?? ?? C6 45 DF 00 EB 26 8D 4D E8 8D 55 F8 8B C3 E8 ?? ?? ?? ?? 8B D3 8D 45 E8 E8 ?? ?? ?? ?? 8D 4D DF 8B C3 BA 05 00 00 00 E8 ?? ?? ?? ?? 80 7D DF 00 74 D4 8D 45 F8 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? B9 04 00 00 00 E8 ?? ?? ?? ?? C3 }
	condition:
		$c0
}

rule FGint_DSASign {	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "FGint DSASign"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 CC 53 56 57 89 4D FC 8B DA 8B F8 8B 75 14 8B 45 10 E8 ?? ?? ?? ?? 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 CC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 F4 50 8B CF 8B D6 8B 45 FC E8 ?? ?? ?? ?? 8D 4D D4 8B D3 8D 45 F4 E8 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? 8D 4D F4 8B D3 8B C6 E8 ?? ?? ?? ?? 8D 55 EC 8B 45 10 E8 ?? ?? ?? ?? 8D 45 E4 50 8B CB 8D 55 D4 8B 45 18 E8 ?? ?? ?? ?? 8D 4D DC 8D 55 E4 8D 45 EC E8 ?? ?? ?? ?? 8D 45 EC E8 ?? ?? ?? ?? 8D 45 E4 E8 ?? ?? ?? ?? 8D 45 CC 50 8B CB 8D 55 DC 8D 45 F4 E8 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? 8D 45 DC E8 ?? ?? ?? ?? 8B 55 0C 8D 45 D4 E8 ?? ?? ?? ?? 8B 55 08 8D 45 CC E8 ?? ?? ?? ?? 8D 45 D4 E8 ?? ?? ?? ?? 8D 45 CC E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 CC 8B 15 ?? ?? ?? ?? B9 06 00 00 00 E8 }
	condition:
		$c0
}

rule FGint_DSAVerify {	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "FGint DSAVerify"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 B4 53 56 57 89 4D FC 8B DA 8B F0 8B 7D 08 8B 45 14 E8 ?? ?? ?? ?? 8B 45 10 E8 ?? ?? ?? ?? 8B 45 0C E8 ?? ?? ?? ?? 8D 45 F4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 EC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 DC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 CC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 BC 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 B4 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 CC 8B 45 0C E8 ?? ?? ?? ?? 8D 4D F4 8B D3 8D 45 CC E8 ?? ?? ?? ?? 8D 55 C4 8B 45 14 E8 ?? ?? ?? ?? 8D 45 EC 50 8B CB 8D 55 F4 8D 45 C4 E8 ?? ?? ?? ?? 8D 45 C4 E8 ?? ?? ?? ?? 8D 55 D4 8B 45 10 E8 ?? ?? ?? ?? 8D 45 E4 50 8B CB 8D 55 F4 8D 45 D4 E8 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? 8D 45 C4 50 8B CE 8D 55 EC 8B 45 FC E8 ?? ?? ?? ?? 8D 45 BC 50 8B CE 8D 55 E4 8B 45 18 E8 ?? ?? ?? ?? 8D 45 B4 50 8B CE 8D 55 BC 8D 45 C4 E8 ?? ?? ?? ?? 8D 45 C4 E8 }
	condition:
		$c0
}


rule DES_Long {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "DES [long]"
	strings:
		$c0 = { 10 80 10 40 00 00 00 00 00 80 10 00 00 00 10 40 10 00 00 40 10 80 00 00 00 80 00 40 00 80 10 00 00 80 00 00 10 00 10 40 10 00 00 00 00 80 00 40 10 00 10 00 00 80 10 40 00 00 10 40 10 00 00 00 }
	condition:
		$c0
}

rule DES_sbox {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "DES [sbox]"
	strings:
		$c0 = { 00 04 01 01 00 00 00 00 00 00 01 00 04 04 01 01 04 00 01 01 04 04 01 00 04 00 00 00 00 00 01 00 00 04 00 00 00 04 01 01 04 04 01 01 00 04 00 00 04 04 00 01 04 00 01 01 00 00 00 01 04 00 00 00 }
	condition:
		$c0
}

rule DES_pbox_long {	meta:
		author = "_pusher_"
		date = "2015-05"
		description = "DES [pbox] [long]"
	strings:
		$c0 = { 0F 00 00 00 06 00 00 00 13 00 00 00 14 00 00 00 1C 00 00 00 0B 00 00 00 1B 00 00 00 10 00 00 00 00 00 00 00 0E 00 00 00 16 00 00 00 19 00 00 00 04 00 00 00 11 00 00 00 1E 00 00 00 09 00 00 00 01 00 00 00 07 00 00 00 17 00 00 00 0D 00 00 00 1F 00 00 00 1A 00 00 00 02 00 00 00 08 00 00 00 12 00 00 00 0C 00 00 00 1D 00 00 00 05 00 00 00 }
	condition:
		$c0
}

rule OpenSSL_BN_mod_exp2_mont {	meta:
		author = "Maxx"
		description = "OpenSSL BN_mod_exp2_mont"
	strings:
		$c0 = { B8 30 05 00 00 E8 ?? ?? ?? ?? 8B 84 24 48 05 00 00 53 33 DB 56 8B 08 57 89 5C 24 24 89 5C 24 30 8A 01 89 5C 24 28 A8 01 89 5C 24 0C 75 24 68 89 00 00 00 68 ?? ?? ?? ?? 6A 66 6A 76 6A 03 E8 ?? ?? ?? ?? 83 C4 14 33 C0 5F 5E 5B 81 C4 30 05 00 00 C3 8B 94 24 48 05 00 00 52 E8 ?? ?? ?? ?? 8B F0 8B 84 24 54 05 00 00 50 E8 ?? ?? ?? ?? 83 C4 08 3B F3 8B F8 75 20 3B FB 75 1C 8B 8C 24 40 05 00 00 6A 01 51 E8 ?? ?? ?? ?? 83 C4 08 5F 5E 5B 81 C4 30 05 00 00 C3 3B F7 89 74 24 18 7F 04 89 }
	condition:
		$c0
}

rule OpenSSL_BN_mod_exp_mont {	meta:
		author = "Maxx"
		description = "OpenSSL BN_mod_exp_mont"
	strings:
		$c0 = { B8 A0 02 00 00 E8 ?? ?? ?? ?? 53 56 57 8B BC 24 BC 02 00 00 33 F6 8B 07 89 74 24 24 89 74 24 20 89 74 24 0C F6 00 01 75 24 68 72 01 00 00 68 ?? ?? ?? ?? 6A 66 6A 6D 6A 03 E8 ?? ?? ?? ?? 83 C4 14 33 C0 5F 5E 5B 81 C4 A0 02 00 00 C3 8B 8C 24 B8 02 00 00 51 E8 ?? ?? ?? ?? 8B D8 83 C4 04 3B DE 89 5C 24 18 75 1C 8B 94 24 B0 02 00 00 6A 01 52 E8 ?? ?? ?? ?? 83 C4 08 5F 5E 5B 81 C4 A0 02 00 00 C3 55 8B AC 24 C4 02 00 00 55 E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 8B F0 55 89 74 24 24 E8 }
	condition:
		$c0
}

rule OpenSSL_BN_mod_exp_recp {	meta:
		author = "Maxx"
		description = "OpenSSL BN_mod_exp_recp"
	strings:
		$c0 = { B8 C8 02 00 00 E8 ?? ?? ?? ?? 8B 84 24 D4 02 00 00 55 56 33 F6 50 89 74 24 1C 89 74 24 18 E8 ?? ?? ?? ?? 8B E8 83 C4 04 3B EE 89 6C 24 0C 75 1B 8B 8C 24 D4 02 00 00 6A 01 51 E8 ?? ?? ?? ?? 83 C4 08 5E 5D 81 C4 C8 02 00 00 C3 53 57 8B BC 24 EC 02 00 00 57 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B D8 83 C4 08 3B DE 0F 84 E7 02 00 00 8D 54 24 24 52 E8 ?? ?? ?? ?? 8B B4 24 EC 02 00 00 83 C4 04 8B 46 0C 85 C0 74 32 56 53 E8 ?? ?? ?? ?? 83 C4 08 85 C0 0F 84 BA 02 00 00 57 8D 44 24 28 53 }
	condition:
		$c0
}

rule OpenSSL_BN_mod_exp_simple {	meta:
		author = "Maxx"
		description = "OpenSSL BN_mod_exp_simple"
	strings:
		$c0 = { B8 98 02 00 00 E8 ?? ?? ?? ?? 8B 84 24 A4 02 00 00 55 56 33 ED 50 89 6C 24 1C 89 6C 24 18 E8 ?? ?? ?? ?? 8B F0 83 C4 04 3B F5 89 74 24 0C 75 1B 8B 8C 24 A4 02 00 00 6A 01 51 E8 ?? ?? ?? ?? 83 C4 08 5E 5D 81 C4 98 02 00 00 C3 53 57 8B BC 24 BC 02 00 00 57 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B D8 83 C4 08 3B DD 0F 84 71 02 00 00 8D 54 24 28 52 E8 ?? ?? ?? ?? 8B AC 24 BC 02 00 00 8B 84 24 B4 02 00 00 57 55 8D 4C 24 34 50 51 C7 44 24 30 01 00 00 00 E8 ?? ?? ?? ?? 83 C4 14 85 C0 0F }
	condition:
		$c0
}

rule OpenSSL_BN_mod_exp_inverse {	meta:
		author = "Maxx"
		description = "OpenSSL BN_mod_exp_inverse"
	strings:
		$c0 = { B8 18 00 00 00 E8 ?? ?? ?? ?? 53 55 56 57 8B 7C 24 38 33 C0 57 89 44 24 20 89 44 24 24 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 57 89 44 24 1C E8 ?? ?? ?? ?? 57 8B F0 E8 ?? ?? ?? ?? 57 89 44 24 28 E8 ?? ?? ?? ?? 57 8B E8 E8 ?? ?? ?? ?? 57 8B D8 E8 ?? ?? ?? ?? 8B F8 8B 44 24 54 50 89 7C 24 38 E8 ?? ?? ?? ?? 83 C4 20 89 44 24 24 85 C0 8B 44 24 2C 0F 84 78 05 00 00 85 C0 75 05 E8 ?? ?? ?? ?? 85 C0 89 44 24 1C 0F 84 63 05 00 00 8B 4C 24 14 6A 01 51 E8 ?? ?? ?? ?? 6A 00 57 E8 }
	condition:
		$c0
}

rule OpenSSL_DSA {
	meta:
		author="_pusher_"
		date="2016-08"
	strings:	
		$a0 = "bignum_data" wide ascii nocase
		$a1 = "DSA_METHOD" wide ascii nocase
		$a2 = "PDSA" wide ascii nocase
		$a3 = "dsa_mod_exp" wide ascii nocase
		$a4 = "bn_mod_exp" wide ascii nocase
		$a5 = "dsa_do_verify" wide ascii nocase
		$a6 = "dsa_sign_setup" wide ascii nocase
		$a7 = "dsa_do_sign" wide ascii nocase
		$a8 = "dsa_paramgen" wide ascii nocase
		$a9 = "BN_MONT_CTX" wide ascii nocase
	condition:
		7 of ($a*)
}

rule FGint_RsaSign {	meta:
		author = "Maxx"
		description = "FGint RsaSign"
	strings:
		$c0 = { 55 8B EC 83 C4 B8 53 56 57 89 4D F8 8B FA 89 45 FC 8B 75 0C 8B 5D 10 8B 45 FC E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 D0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 C0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 B8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 }
	condition:
		$c0
}


rule LockBox_RsaEncryptFile {	meta:
		author = "Maxx"
		description = "LockBox RsaEncryptFile"
	strings:
		$c0 = { 55 8B EC 83 C4 F8 53 56 8B F1 8B DA 6A 20 8B C8 B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 FC 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 68 FF FF 00 00 8B CB B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8A 45 08 50 8B CE 8B 55 F8 8B 45 FC E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? C3 }
	condition:
		$c0
}

rule LockBox_DecryptRsaEx {	meta:
		author = "Maxx"
		description = "LockBox DecryptRsaEx"
	strings:
		$c0 = { 55 8B EC 83 C4 F4 53 56 57 89 4D F8 89 55 FC 8B D8 33 C0 8A 43 04 0F B7 34 45 ?? ?? ?? ?? 0F B7 3C 45 ?? ?? ?? ?? 8B CE B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F4 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 55 FC 8B CE 8B 45 F4 E8 ?? ?? ?? ?? 6A 00 B1 02 8B D3 8B 45 F4 E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B C7 7E 16 B9 ?? ?? ?? ?? B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 8B C8 8B 55 F8 8B 45 F4 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 }
	condition:
		$c0
}

rule LockBox_EncryptRsaEx {	meta:
		author = "Maxx"
		description = "LockBox EncryptRsaEx"
	strings:
		$c0 = { 55 8B EC 83 C4 F8 53 56 57 89 4D FC 8B FA 8B F0 33 C0 8A 46 04 0F B7 1C 45 ?? ?? ?? ?? 8B CB B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 F8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B D7 8B 4D 08 8B 45 F8 E8 ?? ?? ?? ?? 6A 01 B1 02 8B D6 8B 45 F8 E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 3B C3 7E 16 B9 ?? ?? ?? ?? B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 8B C8 8B 55 FC 8B 45 F8 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 F8 E8 }
	condition:
		$c0
}

rule LockBox_TlbRsaKey {	meta:
		author = "Maxx"
		description = "LockBox TlbRsaKey"
	strings:
		$c0 = { 53 56 84 D2 74 08 83 C4 F0 E8 ?? ?? ?? ?? 8B DA 8B F0 33 D2 8B C6 E8 ?? ?? ?? ?? 33 C0 8A 46 04 8B 15 ?? ?? ?? ?? 0F B7 0C 42 B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 46 0C 33 C0 8A 46 04 8B 15 ?? ?? ?? ?? 0F B7 0C 42 B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 46 10 8B C6 84 DB 74 0F E8 ?? ?? ?? ?? 64 8F 05 00 00 00 00 83 C4 0C 8B C6 5E 5B C3 }
	condition:
		$c0
}

rule BigDig_bpInit {	meta:
		author = "Maxx"
		description = "BigDig bpInit"
	strings:
		$c0 = { 56 8B 74 24 0C 6A 04 56 E8 ?? ?? ?? ?? 8B C8 8B 44 24 10 83 C4 08 85 C9 89 08 75 04 33 C0 5E C3 89 70 08 C7 40 04 00 00 00 00 5E C3 }
	condition:
		$c0
}

rule BigDig_mpModExp {	meta:
		author = "Maxx"
		description = "BigDig mpModExp"
	strings:
		$c0 = { 56 8B 74 24 18 85 F6 75 05 83 C8 FF 5E C3 53 55 8B 6C 24 18 57 56 55 E8 ?? ?? ?? ?? 8B D8 83 C4 08 BF 00 00 00 80 8B 44 9D FC 85 C7 75 04 D1 EF 75 F8 83 FF 01 75 08 BF 00 00 00 80 4B EB 02 D1 EF 8B 44 24 18 56 8B 74 24 18 50 56 E8 ?? ?? ?? ?? 83 C4 0C 85 DB 74 4F 8D 6C 9D FC 8B 4C 24 24 8B 54 24 20 51 52 56 56 56 E8 ?? ?? ?? ?? 8B 45 00 83 C4 14 85 C7 74 19 8B 44 24 24 8B 4C 24 20 8B 54 24 18 50 51 52 56 56 E8 ?? ?? ?? ?? 83 C4 14 83 FF 01 75 0B 4B BF 00 00 00 80 83 ED 04 EB }
	condition:
		$c0
}

rule BigDig_mpModInv {	meta:
		author = "Maxx"
		description = "BigDig mpModInv"
	strings:
		$c0 = { 81 EC 2C 07 00 00 8D 84 24 CC 00 00 00 53 56 8B B4 24 44 07 00 00 57 56 6A 01 50 E8 ?? ?? ?? ?? 8B 8C 24 4C 07 00 00 56 8D 94 24 80 02 00 00 51 52 E8 ?? ?? ?? ?? 8D 84 24 BC 01 00 00 56 50 E8 ?? ?? ?? ?? 8B 9C 24 64 07 00 00 56 8D 4C 24 30 53 51 E8 ?? ?? ?? ?? 8D 54 24 38 56 52 BF 01 00 00 00 E8 ?? ?? ?? ?? 83 C4 34 85 C0 0F 85 ED 00 00 00 8D 44 24 0C 56 50 8D 8C 24 78 02 00 00 56 8D 94 24 48 03 00 00 51 8D 84 24 18 04 00 00 52 50 E8 ?? ?? ?? ?? 8D 8C 24 BC 01 00 00 56 8D 94 }
	condition:
		$c0
}

rule BigDig_mpModMult {	meta:
		author = "Maxx"
		description = "BigDig mpModMult"
	strings:
		$c0 = { 8B 44 24 0C 8B 4C 24 08 81 EC 98 01 00 00 8D 54 24 00 56 8B B4 24 B0 01 00 00 57 56 50 51 52 E8 ?? ?? ?? ?? 8B 84 24 C0 01 00 00 8B 94 24 B4 01 00 00 8D 3C 36 56 50 8D 4C 24 20 57 51 52 E8 ?? ?? ?? ?? 8D 44 24 2C 57 50 E8 ?? ?? ?? ?? 83 C4 2C 33 C0 5F 5E 81 C4 98 01 00 00 C3 }
	condition:
		$c0
}

rule BigDig_mpModulo {	meta:
		author = "Maxx"
		description = "BigDig mpModulo"
	strings:
		$c0 = { 8B 44 24 10 81 EC 30 03 00 00 8B 8C 24 38 03 00 00 8D 54 24 00 56 8B B4 24 40 03 00 00 57 8B BC 24 4C 03 00 00 57 50 56 51 8D 84 24 B0 01 00 00 52 50 E8 ?? ?? ?? ?? 8B 94 24 54 03 00 00 8D 4C 24 20 57 51 52 E8 ?? ?? ?? ?? 8D 44 24 2C 56 50 E8 ?? ?? ?? ?? 8D 8C 24 CC 01 00 00 56 51 E8 ?? ?? ?? ?? 83 C4 34 33 C0 5F 5E 81 C4 30 03 00 00 C3 }
	condition:
		$c0
}

rule BigDig_spModExpB {	meta:
		author = "Maxx"
		description = "BigDig spModExpB"
	strings:
		$c0 = { 53 8B 5C 24 10 55 56 BE 00 00 00 80 85 F3 75 04 D1 EE 75 F8 8B 6C 24 14 8B C5 D1 EE 89 44 24 18 74 48 57 8B 7C 24 20 EB 04 8B 44 24 1C 57 50 50 8D 44 24 28 50 E8 ?? ?? ?? ?? 83 C4 10 85 F3 74 14 8B 4C 24 1C 57 55 8D 54 24 24 51 52 E8 ?? ?? ?? ?? 83 C4 10 D1 EE 75 D0 8B 44 24 14 8B 4C 24 1C 5F 5E 89 08 5D 33 C0 5B C3 8B 54 24 10 5E 5D 5B 89 02 33 C0 C3 }
	condition:
		$c0
}

rule BigDig_spModInv {	meta:
		author = "Maxx"
		description = "BigDig spModInv"
	strings:
		$c0 = { 51 8B 4C 24 10 55 56 BD 01 00 00 00 33 F6 57 8B 7C 24 18 89 6C 24 0C 85 C9 74 42 53 8B C7 33 D2 F7 F1 8B C7 8B F9 8B DA 33 D2 F7 F1 8B CB 0F AF C6 03 C5 8B EE 8B F0 8B 44 24 10 F7 D8 85 DB 89 44 24 10 75 D7 85 C0 5B 7D 13 8B 44 24 1C 8B 4C 24 14 2B C5 5F 89 01 5E 33 C0 5D 59 C3 8B 54 24 14 5F 5E 33 C0 89 2A 5D 59 C3 }
	condition:
		$c0
}

rule BigDig_spModMult {	meta:
		author = "Maxx"
		description = "BigDig spModMult"
	strings:
		$c0 = { 8B 44 24 0C 8B 4C 24 08 83 EC 08 8D 54 24 00 50 51 52 E8 ?? ?? ?? ?? 8B 44 24 24 6A 02 8D 4C 24 10 50 51 E8 ?? ?? ?? ?? 8B 54 24 24 89 02 33 C0 83 C4 20 C3 }
	condition:
		$c0
}

rule CryptoPP_ApplyFunction {	meta:
		author = "Maxx"
		description = "CryptoPP ApplyFunction"
	strings:
		$c0 = { 51 8D 41 E4 56 8B 74 24 0C 83 C1 F0 50 51 8B 4C 24 18 C7 44 24 0C 00 00 00 00 51 56 E8 ?? ?? ?? ?? 83 C4 10 8B C6 5E 59 C2 08 00 }
		$c1 = { 51 53 56 8B F1 57 6A 00 C7 44 24 10 00 00 00 00 8B 46 04 8B 48 04 8B 5C 31 04 8D 7C 31 04 E8 ?? ?? ?? ?? 50 8B CF FF 53 10 8B 44 24 18 8D 56 08 83 C6 1C 52 56 8B 74 24 1C 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B C6 5F 5E 5B 59 C2 08 00 }
	condition:
		any of them
}

rule CryptoPP_RsaFunction {	meta:
		author = "Maxx"
		description = "CryptoPP RsaFunction"
	strings:
		$c0 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC 9C 00 00 00 8B 84 24 B0 00 00 00 53 55 56 33 ED 8B F1 57 3B C5 89 B4 24 A8 00 00 00 89 6C 24 10 BF 01 00 00 00 74 18 C7 06 ?? ?? ?? ?? C7 46 20 ?? ?? ?? ?? 89 7C 24 10 89 AC 24 B4 00 00 00 8D 4E 04 E8 ?? ?? ?? ?? 8D 4E 10 89 BC 24 B4 00 00 00 E8 ?? ?? ?? ?? 8B 06 BB ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 48 04 C7 04 31 ?? ?? ?? ?? 8B 16 8B 42 04 8B 54 24 10 83 CA 02 8D 48 E0 89 54 24 10 89 4C 30 FC 89 5C 24 18 89 7C }
		$c1 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 8B 44 24 1C 53 8B 5C 24 1C 56 8B F1 57 33 C9 89 74 24 10 3B C1 89 4C 24 0C 74 7B C7 46 04 ?? ?? ?? ?? C7 46 3C ?? ?? ?? ?? C7 46 30 ?? ?? ?? ?? C7 46 34 ?? ?? ?? ?? 3B D9 75 06 89 4C 24 28 EB 0E 8B 43 04 8B 50 0C 8D 44 1A 04 89 44 24 28 8B 56 3C C7 44 24 0C 07 00 00 00 8B 42 04 C7 44 30 3C ?? ?? ?? ?? 8B 56 3C 8B 42 08 C7 44 30 3C ?? ?? ?? ?? 8B 56 3C C7 46 38 ?? ?? ?? ?? 8B 42 04 C7 44 30 3C }
		$c2 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 8B 44 24 18 56 8B F1 57 85 C0 89 74 24 0C C7 44 24 08 00 00 00 00 74 63 C7 46 04 ?? ?? ?? ?? C7 46 3C ?? ?? ?? ?? C7 46 30 ?? ?? ?? ?? C7 46 34 ?? ?? ?? ?? 8B 46 3C C7 44 24 08 07 00 00 00 8B 48 04 C7 44 31 3C ?? ?? ?? ?? 8B 56 3C 8B 42 08 C7 44 30 3C ?? ?? ?? ?? 8B 4E 3C C7 46 38 ?? ?? ?? ?? 8B 51 04 C7 44 32 3C ?? ?? ?? ?? 8B 46 3C 8B 48 08 C7 44 31 3C ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 8D 7E 04 6A 00 8B CF }
	condition:
		any of them
}

rule CryptoPP_Integer_constructor {	meta:
		author = "Maxx"
		description = "CryptoPP Integer constructor"
	strings:
		$c0 = { 8B 44 24 08 56 83 F8 08 8B F1 77 09 8B 14 85 ?? ?? ?? ?? EB 37 83 F8 10 77 07 BA 10 00 00 00 EB 2B 83 F8 20 77 07 BA 20 00 00 00 EB 1F 83 F8 40 77 07 BA 40 00 00 00 EB 13 48 50 E8 ?? ?? ?? ?? BA 01 00 00 00 8B C8 83 C4 04 D3 E2 8D 04 95 00 00 00 00 89 16 50 E8 ?? ?? ?? ?? 8B 4C 24 0C 89 46 04 C7 46 08 00 00 00 00 89 08 8B 0E 8B 46 04 83 C4 04 49 74 0F 57 8D 78 04 33 C0 F3 AB 8B C6 5F 5E C2 08 00 8B C6 5E C2 08 00 }
		$c1 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 51 56 8B F1 89 74 24 04 C7 06 ?? ?? ?? ?? 6A 08 C7 44 24 14 00 00 00 00 C7 46 08 02 00 00 00 E8 ?? ?? ?? ?? 89 46 0C C7 46 10 00 00 00 00 C7 06 ?? ?? ?? ?? 8B 46 0C 83 C4 04 C7 40 04 00 00 00 00 8B 4E 0C 8B C6 5E C7 01 00 00 00 00 8B 4C 24 04 64 89 0D 00 00 00 00 83 C4 10 C3 }
		$c2 = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 51 56 8B F1 57 89 74 24 08 C7 06 ?? ?? ?? ?? 8B 7C 24 1C C7 44 24 14 00 00 00 00 8B CF E8 ?? ?? ?? ?? 83 F8 08 77 09 8B 14 85 ?? ?? ?? ?? EB 37 83 F8 10 77 07 BA 10 00 00 00 EB 2B 83 F8 20 77 07 BA 20 00 00 00 EB 1F 83 F8 40 77 07 BA 40 00 00 00 EB 13 48 50 E8 ?? ?? ?? ?? BA 01 00 00 00 8B C8 83 C4 04 D3 E2 85 D2 89 56 08 76 12 8D 04 95 00 00 00 00 50 E8 ?? ?? ?? ?? 83 C4 04 EB 02 33 C0 89 46 0C 8B 4F 10 89 4E 10 }
		$c3 = { 56 57 8B 7C 24 0C 8B F1 8B CF E8 ?? ?? ?? ?? 83 F8 08 77 09 8B 14 85 ?? ?? ?? ?? EB 37 83 F8 10 77 07 BA 10 00 00 00 EB 2B 83 F8 20 77 07 BA 20 00 00 00 EB 1F 83 F8 40 77 07 BA 40 00 00 00 EB 13 48 50 E8 ?? ?? ?? ?? BA 01 00 00 00 8B C8 83 C4 04 D3 E2 8D 04 95 00 00 00 00 89 16 50 E8 ?? ?? ?? ?? 8B 16 89 46 04 8B 4F 08 83 C4 04 89 4E 08 8B 4F 04 85 D2 76 0D 2B C8 8B 3C 01 89 38 83 C0 04 4A 75 F5 8B C6 5F 5E C2 04 00 }
	condition:
		any of them
}

rule RijnDael_AES {	meta:
		author = "_pusher_"
		description = "RijnDael AES"
		date = "2016-06"
	strings:
		$c0 = { A5 63 63 C6 84 7C 7C F8 }
	condition:
		$c0
}

rule RijnDael_AES_CHAR {	meta:
		author = "_pusher_"
		description = "RijnDael AES (check2) [char]"
		date = "2016-06"
	strings:
		$c0 = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 }
	condition:
		$c0
}

rule ARIA_SB2 {	meta:
		author = "spelissier"
		description = "Aria SBox 2"
		date = "2020-12"
		reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7"
	strings:
		$c0 = { E2 4E 54 FC 94 C2 4A CC 62 0D 6A 46 3C 4D 8B D1 5E FA 64 CB B4 97 BE 2B BC 77 2E 03 D3 19 59 C1 }
	condition:
		$c0
}

rule RijnDael_AES_CHAR_inv {	meta:
		author = "_pusher_"
		description = "RijnDael AES S-inv [char]"
		//needs improvement
		date = "2016-07"
	strings:
		$c0 = { 48 38 47 00 88 17 33 D2 8A 56 0D 8A 92 48 38 47 00 88 57 01 33 D2 8A 56 0A 8A 92 48 38 47 00 88 57 02 33 D2 8A 56 07 8A 92 48 38 47 00 88 57 03 33 D2 8A 56 04 8A 92 }
	condition:
		$c0
}

rule RsaRef2_NN_modExp {	meta:
		author = "Maxx"
		description = "RsaRef2 NN_modExp"
	strings:
		$c0 = { 81 EC 1C 02 00 00 53 55 56 8B B4 24 30 02 00 00 57 8B BC 24 44 02 00 00 57 8D 84 24 A4 00 00 00 56 50 E8 ?? ?? ?? ?? 8B 9C 24 4C 02 00 00 57 53 8D 8C 24 B4 00 00 00 56 8D 94 24 3C 01 00 00 51 52 E8 ?? ?? ?? ?? 57 53 8D 84 24 4C 01 00 00 56 8D 8C 24 D4 01 00 00 50 51 E8 ?? ?? ?? ?? 8D 54 24 50 57 52 E8 ?? ?? ?? ?? 8B 84 24 78 02 00 00 8B B4 24 74 02 00 00 50 56 C7 44 24 60 01 00 00 00 E8 ?? ?? ?? ?? 8D 48 FF 83 C4 44 8B E9 89 4C 24 18 85 ED 0F 8C AF 00 00 00 8D 34 AE 89 74 24 }
	condition:
		any of them
}

rule RsaRef2_NN_modInv {	meta:
		author = "Maxx"
		description = "RsaRef2 NN_modInv"
	strings:
		$c0 = { 81 EC A4 04 00 00 53 56 8B B4 24 BC 04 00 00 57 8D 84 24 ?? 00 00 00 56 50 E8 ?? ?? ?? ?? 8D 8C 24 1C 01 00 00 BF 01 00 00 00 56 51 89 BC 24 A0 00 00 00 E8 ?? ?? ?? ?? 8B 94 24 C8 04 00 00 56 8D 84 24 AC 01 00 00 52 50 E8 ?? ?? ?? ?? 8B 9C 24 D8 04 00 00 56 8D 4C 24 2C 53 51 E8 ?? ?? ?? ?? 8D 54 24 34 56 52 E8 ?? ?? ?? ?? 83 C4 30 85 C0 0F 85 ED 00 00 00 8D 44 24 0C 56 50 8D 8C 24 A0 01 00 00 56 8D 94 24 AC 02 00 00 51 8D 84 24 34 03 00 00 52 50 E8 ?? ?? ?? ?? 8D 8C 24 2C 01 }
	condition:
		$c0
}

rule RsaRef2_NN_modMult {	meta:
		author = "Maxx"
		description = "RsaRef2 NN_modMult"
	strings:
		$c0 = { 8B 44 24 0C 8B 4C 24 08 81 EC 08 01 00 00 8D 54 24 00 56 8B B4 24 20 01 00 00 56 50 51 52 E8 ?? ?? ?? ?? 8B 84 24 2C 01 00 00 56 8D 0C 36 50 8B 84 24 28 01 00 00 8D 54 24 1C 51 52 50 E8 ?? ?? ?? ?? 68 08 01 00 00 8D 4C 24 2C 6A 00 51 E8 ?? ?? ?? ?? 83 C4 30 5E 81 C4 08 01 00 00 C3 }
	condition:
		$c0
}

rule RsaRef2_RsaPrivateDecrypt {	meta:
		author = "Maxx"
		description = "RsaRef2 RsaPrivateDecrypt"
	strings:
		$c0 = { 8B 44 24 14 81 EC 84 00 00 00 8B 8C 24 94 00 00 00 56 8B 30 83 C6 07 C1 EE 03 3B CE 76 0D B8 06 04 00 00 5E 81 C4 84 00 00 00 C3 50 8B 84 24 98 00 00 00 51 8D 4C 24 0C 50 8D 54 24 14 51 52 E8 ?? ?? ?? ?? 83 C4 14 85 C0 0F 85 8B 00 00 00 39 74 24 04 74 0D B8 06 04 00 00 5E 81 C4 84 00 00 00 C3 8A 44 24 08 84 C0 75 6B 8A 4C 24 09 B8 02 00 00 00 3A C8 75 5E 8D 4E FF 3B C8 76 0D 8A 54 04 08 84 D2 74 05 40 3B C1 72 F3 40 3B C6 73 45 8B 94 24 ?? 00 00 00 8B CE 2B C8 89 0A 8D 51 0B }
	condition:
		$c0
}

rule RsaRef2_RsaPrivateEncrypt {	meta:
		author = "Maxx"
		description = "RsaRef2 RsaPrivateEncrypt"
	strings:
		$c0 = { 8B 44 24 14 8B 54 24 10 81 EC 80 00 00 00 8D 4A 0B 56 8B 30 83 C6 07 C1 EE 03 3B CE 76 0D B8 06 04 00 00 5E 81 C4 80 00 00 00 C3 8B CE B8 02 00 00 00 2B CA C6 44 24 04 00 49 C6 44 24 05 01 3B C8 76 23 53 55 8D 69 FE 57 8B CD 83 C8 FF 8B D9 8D 7C 24 12 C1 E9 02 F3 AB 8B CB 83 E1 03 F3 AA 8D 45 02 5F 5D 5B 52 8B 94 24 94 00 00 00 C6 44 04 08 00 8D 44 04 09 52 50 E8 ?? ?? ?? ?? 8B 8C 24 A4 00 00 00 8B 84 24 98 00 00 00 51 8B 8C 24 98 00 00 00 8D 54 24 14 56 52 50 51 E8 }
	condition:
		$c0
}

rule RsaRef2_RsaPublicDecrypt {	meta:
		author = "Maxx"
		description = "RsaRef2 RsaPublicDecrypt"
	strings:
		$c0 = { 8B 44 24 14 81 EC 84 00 00 00 8B 8C 24 94 00 00 00 56 8B 30 83 C6 07 C1 EE 03 3B CE 76 0D B8 06 04 00 00 5E 81 C4 84 00 00 00 C3 50 8B 84 24 98 00 00 00 51 8D 4C 24 0C 50 8D 54 24 14 51 52 E8 ?? ?? ?? ?? 83 C4 14 85 C0 0F 85 8E 00 00 00 39 74 24 04 74 0D B8 06 04 00 00 5E 81 C4 84 00 00 00 C3 8A 44 24 08 84 C0 75 6E 80 7C 24 09 01 75 67 B8 02 00 00 00 8D 4E FF 3B C8 76 0D B2 FF 38 54 04 08 75 05 40 3B C1 72 F5 8A 4C 04 08 40 84 C9 75 45 8B 94 24 ?? 00 00 00 8B CE 2B C8 89 0A }
	condition:
		$c0
}

rule RsaRef2_RsaPublicEncrypt {	meta:
		author = "Maxx"
		description = "RsaRef2 RsaPublicEncrypt"
	strings:
		$c0 = { 8B 44 24 14 81 EC 84 00 00 00 53 8B 9C 24 98 00 00 00 57 8B 38 83 C7 07 8D 4B 0B C1 EF 03 3B CF 76 0E 5F B8 06 04 00 00 5B 81 C4 84 00 00 00 C3 8B D7 55 2B D3 56 BE 02 00 00 00 C6 44 24 14 00 8D 6A FF C6 44 24 15 02 3B EE 76 28 8B 84 24 AC 00 00 00 8D 4C 24 13 50 6A 01 51 E8 ?? ?? ?? ?? 8A 44 24 1F 83 C4 0C 84 C0 74 E1 88 44 34 14 46 3B F5 72 D8 8B 94 24 A0 00 00 00 53 8D 44 34 19 52 50 C6 44 34 20 00 E8 ?? ?? ?? ?? 8B 8C 24 B4 00 00 00 8B 84 24 A8 00 00 00 51 8B 8C 24 A8 00 }
	condition:
		$c0
}

rule RsaEuro_NN_modInv {	meta:
		author = "Maxx"
		description = "RsaEuro NN_modInv"
	strings:
		$c0 = { 81 EC A4 04 00 00 53 56 8B B4 24 BC 04 00 00 57 8D 44 24 0C 56 50 E8 ?? ?? ?? ?? 8D 8C 24 1C 01 00 00 BF 01 00 00 00 56 51 89 7C 24 1C E8 ?? ?? ?? ?? 8B 94 24 C8 04 00 00 56 8D 84 24 AC 01 00 00 52 50 E8 ?? ?? ?? ?? 8B 9C 24 D8 04 00 00 56 8D 8C 24 B0 00 00 00 53 51 E8 ?? ?? ?? ?? 8D 94 24 B8 00 00 00 56 52 E8 ?? ?? ?? ?? 83 C4 30 85 C0 0F 85 F8 00 00 00 8D 84 24 ?? 00 00 00 56 50 8D 8C 24 A0 01 00 00 56 8D 94 24 AC 02 00 00 51 8D 84 24 34 03 00 00 52 50 E8 ?? ?? ?? ?? 8D 8C }
	condition:
		$c0
}

rule RsaEuro_NN_modMult {	meta:
		author = "Maxx"
		description = "RsaEuro NN_modMult"
	strings:
		$c0 = { 8B 44 24 0C 8B 4C 24 08 81 EC 08 01 00 00 8D 54 24 00 56 8B B4 24 20 01 00 00 56 50 51 52 E8 ?? ?? ?? ?? 8B 84 24 2C 01 00 00 56 8D 0C 36 50 8B 84 24 28 01 00 00 8D 54 24 1C 51 52 50 E8 ?? ?? ?? ?? 83 C4 24 5E 81 C4 08 01 00 00 C3 }
	condition:
		$c0
}

rule Miracl_Big_constructor {	meta:
		author = "Maxx"
		description = "Miracl Big constructor"
	strings:
		$c0 = { 56 8B F1 6A 00 E8 ?? ?? ?? ?? 83 C4 04 89 06 8B C6 5E C3 }
	condition:
		$c0
}

rule Miracl_mirvar {	meta:
		author = "Maxx"
		description = "Miracl mirvar"
	strings:
		$c0 = { 56 E8 ?? ?? ?? ?? 8B 88 18 02 00 00 85 C9 74 04 33 C0 5E C3 8B 88 8C 00 00 00 85 C9 75 0E 6A 12 E8 ?? ?? ?? ?? 83 C4 04 33 C0 5E C3 8B 80 38 02 00 00 6A 01 50 E8 ?? ?? ?? ?? 8B F0 83 C4 08 85 F6 75 02 5E C3 8D 46 04 8B C8 8B D0 83 E1 03 2B D1 83 C2 08 89 10 8B 44 24 08 85 C0 74 0A 56 50 E8 ?? ?? ?? ?? 83 C4 08 8B C6 5E C3 }
		$c1 = { 56 57 E8 ?? ?? ?? ?? 8B F0 8B 86 2C 02 00 00 85 C0 74 05 5F 33 C0 5E C3 8B 56 1C 42 8B C2 89 56 1C 83 F8 18 7D 17 C7 44 86 20 17 00 00 00 8B 86 40 02 00 00 85 C0 74 05 E8 ?? ?? ?? ?? 8B 86 8C 00 00 00 85 C0 75 16 6A 12 E8 ?? ?? ?? ?? 8B 46 1C 83 C4 04 48 89 46 1C 5F 33 C0 5E C3 8B 46 18 6A 01 8D 0C 85 0C 00 00 00 51 E8 ?? ?? ?? ?? 8B F8 83 C4 08 85 FF 75 0C 8B 46 1C 5F 48 89 46 1C 33 C0 5E C3 8D 47 04 8B D0 8B C8 83 E2 03 2B CA 83 C1 08 89 08 8B 44 24 0C 85 C0 74 0A 57 50 E8 }
		$c2 = { 56 57 E8 ?? ?? ?? ?? 8B F0 8B 86 18 02 00 00 85 C0 74 05 5F 33 C0 5E C3 8B 56 1C 42 8B C2 89 56 1C 83 F8 18 7D 17 C7 44 86 20 17 00 00 00 8B 86 2C 02 00 00 85 C0 74 05 E8 ?? ?? ?? ?? 8B 86 8C 00 00 00 85 C0 75 16 6A 12 E8 ?? ?? ?? ?? 8B 46 1C 83 C4 04 48 89 46 1C 5F 33 C0 5E C3 8B 86 A4 02 00 00 6A 01 50 E8 ?? ?? ?? ?? 8B F8 83 C4 08 85 FF 75 0C 8B 46 1C 5F 48 89 46 1C 33 C0 5E C3 8D 47 04 8B C8 8B D0 83 E1 03 2B D1 83 C2 08 89 10 8B 44 24 0C 85 C0 74 0A 57 50 E8 }
	condition:
		any of them
}

rule Miracl_mirsys_init {	meta:
		author = "Maxx"
		description = "Miracl mirsys init"
	strings:
		$c0 = { 53 55 57 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 DB A3 ?? ?? ?? ?? 3B C3 75 06 5F 5D 33 C0 5B C3 89 58 1C A1 ?? ?? ?? ?? BD 01 00 00 00 89 58 20 A1 ?? ?? ?? ?? 8B 50 1C 42 89 50 1C A1 ?? ?? ?? ?? 8B 48 1C C7 44 88 20 1D 00 00 00 8B 15 ?? ?? ?? ?? 89 9A 14 02 00 00 A1 ?? ?? ?? ?? 89 98 70 01 00 00 8B 0D ?? ?? ?? ?? 89 99 78 01 00 00 8B 15 ?? ?? ?? ?? 89 9A 98 01 00 00 A1 ?? ?? ?? ?? 89 58 14 8B 44 24 14 3B C5 0F 84 6C 05 00 00 3D 00 00 00 80 0F 87 61 05 00 00 50 E8 }
	condition:
		$c0
}

/* //gives many false positives sorry Storm Shadow
rule x509_public_key_infrastructure_cert {	meta:
		desc = "X.509 PKI Certificate"
		ext = "crt"
	strings:
		$c0 = { 30 82 ?? ?? 30 82 ?? ?? }
	condition: 
		$c0
}

rule pkcs8_private_key_information_syntax_standard {	meta:
		desc = "Found PKCS #8: Private-Key"
		ext = "key"
	strings: 
		$c0 = { 30 82 ?? ?? 02 01 00 }
	condition:
		$c0
}
*/

rule BASE64_table {
	meta:
		author = "_pusher_"
		description = "Look for Base64 table"
		date = "2015-07"
		version = "0.1"
	strings:
		$c0 = { 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F }
	condition:
		$c0
}

rule Delphi_Random {
	meta:
		author = "_pusher_"
		description = "Look for Random function"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { 53 31 DB 69 93 ?? ?? ?? ?? 05 84 08 08 42 89 93 ?? ?? ?? ?? F7 E2 89 D0 5B C3 }
		//x64 rad
		$c1 = { 8B 05 ?? ?? ?? ?? 69 C0 05 84 08 08 83 C0 01 89 05 ?? ?? ?? ?? 8B C9 8B C0 48 0F AF C8 48 C1 E9 20 89 C8 C3 }
	condition:
		any of them
}

rule Delphi_RandomRange {
	meta:
		author = "_pusher_"
		description = "Look for RandomRange function"
		date = "2016-06"
		version = "0.1"
	strings:
		$c0 = { 56 8B F2 8B D8 3B F3 7D 0E 8B C3 2B C6 E8 ?? ?? ?? ?? 03 C6 5E 5B C3 8B C6 2B C3 E8 ?? ?? ?? ?? 03 C3 5E 5B C3 }
	condition:
		$c0
}

rule Delphi_FormShow {
	meta:
		author = "_pusher_"
		description = "Look for Form.Show function"
		date = "2016-06"
		version = "0.1"
	strings:
		$c0 = { 53 8B D8 B2 01 8B C3 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 5B C3 }
		//x64 rad
		$c1 = { 53 48 83 EC 20 48 89 CB 48 89 D9 B2 01 E8 ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 83 C4 20 5B C3 }
	condition:
		any of them
}

rule Delphi_CompareCall {
	meta:
		author = "_pusher_"
		description = "Look for Compare string function"
		date = "2016-07"
	strings:
		$c0 = { 53 56 57 89 C6 89 D7 39 D0 0F 84 8F 00 00 00 85 F6 74 68 85 FF 74 6B 8B 46 FC 8B 57 FC 29 D0 77 02 01 C2 52 C1 EA 02 74 26 8B 0E 8B 1F 39 D9 75 58 4A 74 15 8B 4E 04 8B 5F 04 39 D9 75 4B 83 C6 08 83 C7 08 4A 75 E2 EB 06 83 C6 04 83 C7 04 5A 83 E2 03 74 22 8B 0E 8B 1F 38 D9 75 41 4A 74 17 38 FD 75 3A 4A 74 10 81 E3 00 00 FF 00 81 E1 00 00 FF 00 39 D9 75 27 01 C0 EB 23 8B 57 FC 29 D0 EB 1C 8B 46 FC 29 D0 EB 15 5A 38 D9 75 10 38 FD 75 0C C1 E9 10 C1 EB 10 38 D9 75 02 38 FD 5F 5E 5B C3 }
		//newer delphi
		$c1 = { 39 D0 74 30 85 D0 74 22 8B 48 FC 3B 4A FC 75 24 01 C9 01 C8 01 CA F7 D9 53 8B 1C 01 3B 1C 11 75 07 83 C1 04 78 F3 31 C0 5B C3}
		//x64
		$c2 = { 41 56 41 55 57 56 53 48 83 EC 20 48 89 D3 48 3B CB 75 05 48 33 C0 EB 74 48 85 C9 75 07 8B 43 FC F7 D8 EB 68 48 85 DB 75 05 8B 41 FC EB 5E 8B 79 FC 44 8B 6B FC 89 FE 41 3B F5 7E 03 44 89 EE E8 ?? ?? ?? ?? 49 89 C6 48 89 D9 E8 ?? ?? ?? ?? 48 89 C1 85 F6 7E 30 41 0F B7 06 0F B7 11 2B C2 85 C0 75 29 83 FE 01 74 1E 41 0F B7 46 02 0F B7 51 02 2B C2 85 C0 75 15 49 83 C6 04 48 83 C1 04 83 EE 02 85 F6 7F D0 90 8B C7 41 2B C5 48 83 C4 20 5B 5E 5F 41 5D 41 5E C3 }
 	condition:
		any of them
}

rule Delphi_Copy {
	meta:
		author = "_pusher_"
		description = "Look for Copy function"
		date = "2016-06"
		version = "0.1"
	strings:
		$c0 = { 53 85 C0 74 2D 8B 58 FC 85 DB 74 26 4A 7C 1B 39 DA 7D 1F 29 D3 85 C9 7C 19 39 D9 7F 11 01 C2 8B 44 24 08 E8 ?? ?? ?? ?? EB 11 31 D2 EB E5 89 D9 EB EB 8B 44 24 08 E8 ?? ?? ?? ?? 5B C2 04 00 }
		//x64 rad
		$c1 = { 53 48 83 EC 20 48 89 CB 44 89 C0 48 33 C9 48 85 D2 74 03 8B 4A FC 83 F8 01 7D 05 48 33 C0 EB 09 83 E8 01 3B C1 7E 02 89 C8 45 85 C9 7D 05 48 33 C9 EB 0A 2B C8 41 3B C9 7E 03 44 89 C9 49 89 D8 48 63 C0 48 8D 14 42 89 C8 4C 89 C1 41 89 C0 E8 ?? ?? ?? ?? 48 89 D8 48 83 C4 20 5B C3 }
	condition:
		any of them
}

rule Delphi_IntToStr {
	meta:
		author = "_pusher_"
		description = "Look for IntToStr function"
		date = "2016-04"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 81 C4 00 FF FF FF 53 56 8B F2 8B D8 FF 75 0C FF 75 08 8D 85 00 FF FF FF E8 ?? ?? ?? ?? 8D 95 00 FF FF FF 8B C6 E8 ?? ?? ?? ?? EB 0E 8B 0E 8B C6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 E8 ?? ?? ?? ?? 33 D2 8A D3 3B C2 72 E3 5E 5B 8B E5 5D C2 08 00 }
		//x64 rad
		$c1 = { 53 48 83 EC 20 48 89 CB 48 85 D2 7D 10 48 89 D9 48 F7 DA 41 B0 01 E8 ?? ?? ?? ?? EB 0B 48 89 D9 4D 33 C0 E8 ?? ?? ?? ?? 48 89 D8 48 83 C4 20 5B C3 }
	condition:
		any of them
}


rule Delphi_StrToInt {
	meta:
		author = "_pusher_"
		description = "Look for StrToInt function"
		date = "2016-06"
		version = "0.1"
	strings:
		$c0 = { 53 56 83 C4 F4 8B D8 8B D4 8B C3 E8 ?? ?? ?? ?? 8B F0 83 3C 24 00 74 19 89 5C 24 04 C6 44 24 08 0B 8D 54 24 04 A1 ?? ?? ?? ?? 33 C9 E8 ?? ?? ?? ?? 8B C6 83 C4 0C 5E 5B C3 }
		//x64 rad
		$c1 = { 55 56 53 48 83 EC 40 48 8B EC 48 89 CB 48 89 D9 48 8D 55 3C E8 ?? ?? ?? ?? 89 C6 83 7D 3C 00 74 1B 48 89 5D 20 C6 45 28 11 48 8B 0D ?? ?? ?? ?? 48 8D 55 20 4D 33 C0 E8 ?? ?? ?? ?? 89 F0 48 8D 65 40 5B 5E 5D C3 }
	condition:
		any of them
}

rule Delphi_DecodeDate {
	meta:
		author = "_pusher_"
		description = "Look for DecodeDate (DecodeDateFully) function"
		date = "2016-06"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 E8 53 56 89 4D F4 89 55 F8 89 45 FC 8B 5D 08 FF 75 10 FF 75 0C 8D 45 E8 E8 ?? ?? ?? ?? 8B 4D EC 85 C9 7F 24 8B 45 FC 66 C7 00 00 00 8B 45 F8 66 C7 00 00 00 8B 45 F4 66 C7 00 00 00 66 C7 03 00 00 33 D2 E9 F2 00 00 00 8B C1 BE 07 00 00 00 99 F7 FE 42 66 89 13 49 66 BB 01 00 81 F9 B1 3A 02 00 7C 13 81 E9 B1 3A 02 00 66 81 C3 90 01 81 F9 B1 3A 02 00 7D ED 8D 45 F2 50 8D 45 F0 66 BA AC 8E 91 E8 ?? ?? ?? ?? 66 83 7D F0 04 75 0A 66 FF 4D F0 66 81 45 F2 AC 8E 66 6B 45 F0 64 66 03 D8 8D 45 F2 50 8D 4D F0 0F B7 45 F2 66 BA B5 05 E8 ?? ?? ?? ?? 66 8B 45 F0 C1 E0 02 66 03 D8 8D 45 F2 50 8D 4D F0 0F B7 45 F2 66 BA 6D 01 E8 ?? ?? ?? ?? 66 83 7D F0 04 75 0A 66 FF 4D F0 66 81 45 F2 6D 01 66 03 5D F0 8B C3 E8 ?? ?? ?? ?? 8B D0 33 C0 8A C2 8D 04 40 8D 34 C5 ?? ?? ?? ?? 66 B8 01 00 0F B7 C8 66 8B 4C 4E FE 66 89 4D F0 66 8B 4D F2 66 3B 4D F0 72 0B 66 8B 4D F0 66 29 4D F2 40 EB DF 8B 4D FC 66 89 19 8B 4D F8 66 89 01 66 8B 45 F2 40 8B 4D F4 66 89 01 8B C2 5E 5B 8B E5 5D C2 0C 00 }
		//x64
		$c1 = { 55 41 55 57 56 53 48 83 EC 30 48 8B EC 48 89 D3 4C 89 C6 4C 89 CF E8 ?? ?? ?? ?? 48 8B C8 48 C1 E9 20 85 C9 7F 23 66 C7 03 00 00 66 C7 06 00 00 66 C7 07 00 00 48 8B 85 80 00 00 00 66 C7 00 00 00 48 33 C0 E9 19 01 00 00 4C 8B 85 80 00 00 00 41 C7 C1 07 00 00 00 8B C1 99 41 F7 F9 66 83 C2 01 66 41 89 10 83 E9 01 66 41 BD 01 00 81 F9 B1 3A 02 00 7C 14 81 E9 B1 3A 02 00 66 41 81 C5 90 01 81 F9 B1 3A 02 00 7D EC 90 66 BA AC 8E 4C 8D 45 2C 4C 8D 4D 2E E8 ?? ?? ?? ?? 66 83 7D 2C 04 75 0B 66 83 6D 2C 01 66 81 45 2E AC 8E 66 6B 45 2C 64 66 44 03 E8 0F B7 4D 2E 66 BA B5 05 4C 8D 45 2C 4C 8D 4D 2E E8 ?? ?? ?? ?? 48 0F B7 45 2C 03 C0 03 C0 66 44 03 E8 0F B7 4D 2E 66 BA 6D 01 4C 8D 45 2C 4C 8D 4D 2E E8 ?? ?? ?? ?? 66 83 7D 2C 04 75 0B 66 83 6D 2C 01 66 81 45 2E 6D 01 66 44 03 6D 2C 44 89 E9 E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 0F B6 D0 48 8D 14 52 48 8D 14 D1 66 B9 01 00 4C 0F B7 C1 4E 0F B7 44 42 FE 66 44 89 45 2C 4C 0F B7 45 2E 66 44 3B 45 2C 72 10 4C 0F B7 45 2C 66 44 29 45 2E 66 }
	condition:
		any of them
}


rule Unknown_Random {
	meta:
		author = "_pusher_"
		description = "Look for Random function"
		date = "2016-07"
	strings:
		$c0 = { 55 8B EC 52 8B 45 08 69 15 ?? ?? ?? ?? 05 84 08 08 42 89 15 ?? ?? ?? ?? F7 E2 8B C2 5A C9 C2 04 00 }
	condition:
		$c0
}

rule VC6_Random {
	meta:
		author = "_pusher_"
		description = "Look for Random function"
		date = "2016-02"
	strings:
		$c0 = { A1 ?? ?? ?? ?? 69 C0 FD 43 03 00 05 C3 9E 26 00 A3 ?? ?? ?? ?? C1 F8 10 25 FF 7F 00 00 C3 }
	condition:
		$c0
}

rule VC8_Random {
	meta:
		author = "_pusher_"
		description = "Look for Random function"
		date = "2016-01"
		version = "0.1"
	strings:
		$c0 = { E8 ?? ?? ?? ?? 8B 48 14 69 C9 FD 43 03 00 81 C1 C3 9E 26 00 89 48 14 8B C1 C1 E8 10 25 FF 7F 00 00 C3 }
	condition:
		$c0
}

rule DCP_RIJNDAEL_Init {
	meta:
		author = "_pusher_"
		description = "Look for DCP RijnDael Init"
		date = "2016-07"
	strings:
		$c0 = { 55 8B EC 51 53 56 57 89 4D FC 8B FA 8B D8 8B 75 08 56 8B D7 8B 4D FC 8B C3 E8 ?? ?? ?? ?? 8B D7 8B 4D FC 8B C3 8B 38 FF 57 ?? 85 F6 75 25 8D 43 38 33 C9 BA 10 00 00 00 E8 ?? ?? ?? ?? 8D 4B 38 8D 53 38 8B C3 8B 30 FF 56 ?? 8B C3 8B 10 FF 52 ?? EB 16 8D 53 38 8B C6 B9 10 00 00 00 E8 ?? ?? ?? ?? 8B C3 8B 10 FF 52 ?? 5F 5E 5B 59 5D C2 04 00 }
	condition:
		$c0
}

rule DCP_RIJNDAEL_EncryptECB {
	meta:
		author = "_pusher_"
		description = "Look for DCP RijnDael EncryptECB"
		date = "2016-07"
	strings:
		$c0 = { 53 56 57 55 83 C4 B4 89 0C 24 8D 74 24 08 8D 7C 24 28 80 78 30 00 75 16 B9 ?? ?? ?? ?? B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0A 89 0F 8B CA 83 C1 04 8B 09 8D 5F 04 89 0B 8B CA 83 C1 08 8B 09 8D 5F 08 89 0B 83 C2 0C 8B 12 8D 4F 0C 89 11 8B 50 58 83 EA 02 85 D2 0F 82 3B 01 00 00 42 89 54 24 04 33 D2 8B 0F 8B DA C1 E3 02 33 4C D8 5C 89 0E 8D 4F 04 8B 09 33 4C D8 60 8D 6E 04 89 4D 00 8D 4F 08 8B 09 33 4C D8 64 8D 6E 08 89 4D 00 8D 4F 0C 8B 09 33 4C D8 68 8D 5E 0C 89 0B 33 C9 8A 0E 8D 0C 8D }
	condition:
		$c0
}

rule DCP_BLOWFISH_Init {
	meta:
		author = "_pusher_"
		description = "Look for DCP Blowfish Init"
		date = "2016-07"
	strings:
		$c0 = { 53 56 57 55 8B F2 8B F8 8B CF B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8B C3 8B 10 FF 52 34 8B C6 E8 ?? ?? ?? ?? 50 8B C6 E8 ?? ?? ?? ?? 8B D0 8B C3 59 8B 30 FF 56 3C 8B 43 3C 85 C0 79 03 83 C0 07 C1 F8 03 E8 ?? ?? ?? ?? 8B F0 8B D6 8B C3 8B 08 FF 51 40 8B 47 40 8B 6B 3C 3B C5 7D 0F 6A 00 8B C8 8B D6 8B C7 8B 38 FF 57 30 EB 0D 6A 00 8B D6 8B CD 8B C7 8B 38 FF 57 30 8B 53 3C 85 D2 79 03 83 C2 07 C1 FA 03 8B C6 B9 FF 00 00 00 E8 ?? ?? ?? ?? 8B 53 3C 85 D2 79 03 83 C2 07 C1 FA 03 8B C6 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 5D 5F 5E 5B C3 }
	condition:
		$c0
}


rule DCP_BLOWFISH_EncryptCBC {
	meta:
		author = "_pusher_"
		description = "Look for DCP Blowfish EncryptCBC"
		date = "2016-07"
	strings:
		$c0 = { 55 8B EC 83 C4 F0 53 56 57 89 4D F8 89 55 FC 8B D8 80 7B 34 00 75 16 B9 ?? ?? ?? ?? B2 01 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7D 08 85 FF 79 03 83 C7 07 C1 FF 03 85 FF 7E 56 BE 01 00 00 00 6A 08 8B 45 FC 8B D6 4A C1 E2 03 03 C2 8D 4D F0 8D 53 54 E8 ?? ?? ?? ?? 8D 4D F0 8D 55 F0 8B C3 E8 ?? ?? ?? ?? 8B 55 F8 8B C6 48 C1 E0 03 03 D0 8D 45 F0 B9 08 00 00 00 E8 ?? ?? ?? ?? 8D 53 54 8D 45 F0 B9 08 00 00 00 E8 ?? ?? ?? ?? 46 4F 75 AF 8B 75 08 81 E6 07 00 00 80 79 05 4E 83 CE F8 46 85 F6 74 26 8D 4D F0 8D 53 54 8B C3 E8 ?? ?? ?? ?? 56 8B 4D F8 03 4D 08 2B CE 8B 55 FC 03 55 08 2B D6 8D 45 F0 E8 ?? ?? ?? ?? 8D 45 F0 B9 FF 00 00 00 BA 08 00 00 00 E8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2 04 00 }
	condition:
		$c0
}

rule DCP_DES_Init {
	meta:
		author = "_pusher_"
		description = "Look for DCP Des Init"
		date = "2016-02"
	strings:
		$c0 = { 55 8B EC 51 53 56 57 89 4D FC 8B FA 8B D8 8B 75 08 56 8B D7 8B 4D FC 8B C3 E8 FE F9 FF FF 8B D7 8B 4D FC 8B C3 8B 38 FF 57 5C 85 F6 75 25 8D 43 38 33 C9 BA 08 00 00 00 E8 F3 A9 FA FF 8D 4B 38 8D 53 38 8B C3 8B 30 FF 56 6C 8B C3 8B 10 FF 52 48 EB 16 8D 53 38 8B C6 B9 08 00 00 00 E8 6E A7 FA FF 8B C3 8B 10 FF 52 48 5F 5E 5B 59 5D C2 04 00 }
		$c1 = { 55 8B EC 51 53 56 57 89 4D FC 8B FA 8B D8 8B 75 08 56 8B D7 8B 4D FC 8B C3 E8 EE D4 FF FF 8B D7 8B 4D FC 8B C3 8B 38 FF 57 74 85 F6 75 2B 8D 43 40 B9 FF 00 00 00 BA 08 00 00 00 E8 ?? ?? ?? ?? 8D 4B 40 8D 53 40 8B C3 8B 30 FF 96 84 00 00 00 8B C3 8B 10 FF 52 58 EB 16 8D 53 40 8B C6 B9 08 00 00 00 E8 ?? ?? ?? ?? 8B C3 8B 10 FF 52 58 5F 5E 5B 59 5D C2 04 00 }
	condition:
		any of them
}


rule DCP_DES_EncryptECB {
	meta:
		author = "_pusher_"
		description = "Look for DCP Des EncryptECB"
		date = "2016-02"
	strings:
		$c0 = { 53 80 78 ?? 00 75 16 B9 ?? ?? ?? 00 B2 01 A1 ?? ?? ?? 00 E8 ?? ?? ?? FF E8 ?? ?? ?? FF 8D 58 ?? 53 E8 ?? ?? FF FF 5B C3 }
	condition:
		any of them
}

rule Chacha_128_constant {
    meta:
		author = "spelissier"
		description = "Look for 128-bit key Chacha stream cipher constant"
		date = "2019-12"
		reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html"
	strings:
		$c0 = "expand 16-byte k"
	condition:
		$c0
}

rule Chacha_256_constant {
    meta:
		author = "spelissier"
		description = "Look for 256-bit key Chacha stream cipher constant"
		date = "2019-12"
		reference = "https://tools.ietf.org/html/rfc8439#page-8"
	strings:
		$c0 = "expand 32-byte k"
		$split1 = "expand 3"
		$split2 = "2-byte k"
	condition:
		$c0 or ( $split1 and $split2 )
}

rule ecc_order {
    meta:
		author = "spelissier"
		description = "Look for known Elliptic curve orders"
		date = "2021-07"
		version = "0.2"
	strings:
		$secp192k1 = { FF FF FF FF FF FF FF FF FF FF FF FE 26 F2 FC 17 0F 69 46 6A 74 DE FD 8D}
		$secp192r1 = { FF FF FF FF FF FF FF FF FF FF FF FF 99 DE F8 36 14 6B C9 B1 B4 D2 28 31}
		$secp224k1 = { 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 DC E8 D2 EC 61 84 CA F0 A9 71 76 9F B1 F7}
		$secp224r1 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF 16 A2 E0 B8 F0 3E 13 DD 29 45 5C 5C 2A 3D}
		$secp256k1 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FE BA AE DC E6 AF 48 A0 3B BF D2 5E 8C D0 36 41 41 }
		$prime256v1 = { FF FF FF FF 00 00 00 00 FF FF FF FF FF FF FF FF BC E6 FA AD A7 17 9E 84 F3 B9 CA C2 FC 63 25 51 }
		$secp384r1 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF C7 63 4D 81 F4 37 2D DF 58 1A 0D B2 48 B0 A7 7A EC EC 19 6A CC C5 29 73 }
		$bls12_381_r = { 01 00 00 00 FF FF FF FF FE 5B FE FF 02 A4 BD 53 05 D8 A1 09 08 D8 39 33 48 7D 9D 29 53 A7 ED 73}
	condition:
		any of them
}

rule SHA3_constants {
	meta:
		author = "spelissier"
		description = "SHA-3 (Keccak) round constants"
		date = "2020-04"
		version = "0.1"
	strings:
		$c0  = { 0080008000000080 }
		$c1  = { 0a00008000000080 }
		$c2  = { 8080000000000080 }
		$c3  = { 8b00000000000080 }
		$c4  = { 8280000000000000 }
		$c5  = { 8980000000000080 }
		$c6  = { 0880008000000080 }
		$c7  = { 0980008000000000 }
		$c8  = { 0280000000000080 }
		$c9  = { 0a00008000000000 }
		$c10 = { 0380000000000080 }
		$c11 = { 8b80000000000000 }
		$c12 = { 0100008000000000 }
		$c13 = { 0a80000000000000 }
		$c14 = { 0980000000000080 }
		$c15 = { 8000000000000080 }
		$c16 = { 8800000000000000 }
		$c17 = { 8b80008000000000 }
		$c18 = { 8a00000000000000 }
		$c19 = { 8180008000000080 }
		$c20 = { 0100000000000000 }
		$c21 = { 8a80000000000080 }
	condition:
		10 of them
}

rule SHA3_interleaved {
	meta:
		author = "spelissier"
		description = "SHA-3 (Keccak) interleaved round constants"
		date = "2020-04"
		version = "0.1"
	strings:
		$c0  = { 010000008b800000 }
		$c1  = { 0000000081000080 }
		$c2  = { 0000000088000080 }
		$c3  = { 000000000b000000 }
		$c4  = { 0100000000800000 }
		$c5  = { 010000008b000000 }
		$c6  = { 0100000082800000 }
		$c7  = { 0000000003800000 }
		$c8  = { 010000008a000080 }
		$c9  = { 0000000082800080 }
		$c10 = { 0000000003800080 }
		$c11 = { 000000008b000080 }
		$c12 = { 0000000083000000 }
		$c13 = { 000000000a000000 }
		$c14 = { 0000000080800080 }
		$c15 = { 0100000082000080 }
		$c16 = { 010000000b000080 }
		$c17 = { 0100000088800080 }
		$c18 = { 0000000008000080 }
		$c19 = { 0100000000000000 }
		$c20 = { 0000000089000000 }
		$c21 = { 0100000081000080 }
	condition:
		10 of them
}

rule SipHash_big_endian_constants {
    meta:
		author = "spelissier"
		description = "Look for SipHash constants in big endian"
		date = "2020-07"
		reference = "https://131002.net/siphash/siphash.pdf#page=6"
	strings:
		$c0 = "uespemos"
		$c1 = "modnarod"
		$c2 = "arenegyl"
		$c3 = "setybdet"
	condition:
		2 of them
}

================================================
FILE: yara_rules/malware_analisys.yar
================================================
import "pe"

rule MALWARE_Win_Laturo {
    meta:
        author = "ditekSHen"
        description = "Laturo information stealer payload"
        clamav_sig = "MALWARE.Win.Trojan.Laturo"
    strings:
        $str1 = "cmd.exe /c ping 127.0.0.1" ascii wide
        $str2 = "cmd.exe /c start" ascii wide
        $str3 = "\\RapidLoader\\" ascii
        $str4 = "loader/gate.php" ascii wide
        $str5 = "Hwid:" ascii wide
        $str6 = "Special:" ascii wide
        $str7 = "logs=%s" ascii
        $data1 = "cookies.%u.txt" nocase ascii wide
        $data2 = "passwords.%u.txt" nocase ascii wide
        $data3 = "credentials.%u.txt" nocase ascii wide
        $data4 = "cards.%u.txt" nocase ascii wide
        $data5 = "autofill.%u.txt" nocase ascii wide
        $data6 = "loginusers.vdf" ascii wide
        $data7 = "screenshot.bmp" nocase ascii wide
        $data8 = "webcam.bmp" nocase ascii wide
    condition:
        uint16(0) == 0x5a4d and 5 of ($str*) and 1 of ($data*)
}

rule MALWARE_Win_XpertRAT {
    meta:
        author = "ditekSHen"
        description = "XpertRAT payload"
        snort_sid = "920003-920006"
        clamav_sig = "MALWARE.Win.Trojan.XpertRAT"
    strings:
        $v1 = "[XpertRAT-Mutex]" fullword wide
        $v2 = "XPERTPLUGIN" fullword wide
        $v3 = "+Xpert+3." wide
        $v4 = "keylog.tmp" fullword wide
        $v5 = "\\TempReg.reg" fullword wide
        
        $s1 = "ClsKeylogger" fullword ascii nocase
        $s2 = "clsCamShot" fullword ascii nocase
        $s3 = "ClsShellCommand" fullword ascii nocase
        $s4 = "ClsRemoteDesktop" fullword ascii nocase
        $s5 = "ClsScreenRemote" fullword ascii nocase
        $s6 = "ClsSoundRemote" fullword ascii nocase
        $s7 = "MdlHidder" fullword ascii
        $s8 = "modKeylog" fullword ascii
        $s9 = "modWipe" fullword ascii
        $s10 = "modDelProcInUse" fullword ascii
        $s11= "Socket_DataArrival" fullword ascii
        $s12 = "cZip_EndCompress" fullword ascii

    condition:
        uint16(0) == 0x5a4d and (3 of ($v*) or 6 of ($s*))
}

rule MALWARE_Win_AgentTeslaV2 {
    meta:
        author = "ditekSHen"
        description = "AgenetTesla Type 2 Keylogger payload"
    strings:
        $s1 = "get_kbHook" ascii
        $s2 = "GetPrivateProfileString" ascii
        $s3 = "get_OSFullName" ascii
        $s4 = "get_PasswordHash" ascii
        $s5 = "remove_Key" ascii
        $s6 = "FtpWebRequest" ascii
        $s7 = "logins" fullword wide
        $s8 = "keylog" fullword wide
        $s9 = "1.85 (Hash, version 2, native byte-order)" wide

        $cl1 = "Postbox" fullword ascii
        $cl2 = "BlackHawk" fullword ascii
        $cl3 = "WaterFox" fullword ascii
        $cl4 = "CyberFox" fullword ascii
        $cl5 = "IceDragon" fullword ascii
        $cl6 = "Thunderbird" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and 6 of ($s*)) or (6 of ($s*) and 2 of ($cl*))
}

rule MALWARE_Win_AveMaria {
    meta:
        author = "ditekSHen"
        description = "AveMaria variant payload"
    strings:
        $s1_1 = "PK11_CheckUserPassword" fullword ascii
        $s1_2 = "PK11_Authenticate" fullword ascii
        $s1_3 = "PK11SDR_Decrypt" fullword ascii
        $s1_4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList" fullword ascii
        $s1_5 = "AVE_MARIA" ascii wide
        $s1_6 = "127.0.0." ascii

        $s2_1 = "RDPClip" fullword wide
        $s2_2 = "Grabber" fullword wide
        $s2_3 = "Ave_Maria Stealer OpenSource" wide
        $s2_4 = "\\MidgetPorn\\workspace\\MsgBox.exe" wide
        $s2_5 = "@\\cmd.exe" wide
        $s2_6 = "/n:%temp%\\ellocnak.xml" wide
        $s2_7 = "Hey I'm Admin" wide
        $s2_8 = "warzone160" fullword ascii

        $d1 = "softokn3.dll" fullword wide
        $d2 = "nss3.dll" fullword wide
        $d3 = "logins.json" wide
        $d4 = "Asend.db" fullword wide       
    condition:
        (uint16(0) == 0x5a4d and (4 of ($s2*) and 2 of ($d*)) or (all of ($s1*))) or ((4 of ($s1*) and 2 of ($d*)) or (all of ($s1*)))
}

rule MALWARE_Win_ISRStealer {
    meta:
        author = "ditekSHen"
        description = "ISRStealer payload"
        clamav_sig = "MALWARE.Win.Trojan.ISRStealer"
    strings:
        $s1 = "&password=" wide
        $s2 = "&pcname=" wide
        $s3 = "MSVBVM60.DLL" ascii
        $s4 = "MSVBVM60.DLL" wide
        $s5 = "Core Software For : Public" wide
        $s6 = "</Host>" wide
        $s7 = "</Pass>" wide
        $s8 = "/scomma" wide
    condition:
        (uint16(0) == 0x5a4d and filesize < 4000KB and 6 of them) or all of them
}

rule MALWARE_Win_QuasarRAT {
    meta:
        author = "ditekSHen"
        description = "QuasarRAT payload"
    strings:
        $s1 = "GetKeyloggerLogsResponse" fullword ascii
        $s2 = "GetKeyloggerLogs" fullword ascii
        $s3 = "/>Log created on" wide
        $s4 = "User: {0}{3}Pass: {1}{3}Host: {2}" wide
        $s5 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide
        $s6 = "grabber_" wide
        $s7 = "<virtualKeyCode>" ascii
        $s8 = "<RunHidden>k__BackingField" fullword ascii
        $s9 = "<keyboardHookStruct>" ascii
        $s10 = "add_OnHotKeysDown" ascii
        $mutex = "QSR_MUTEX_" ascii wide
        $ua1 = "Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0" fullword wide
        $us2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A" fullword wide
    condition:
        uint16(0) == 0x5a4d and ($mutex or (all of ($ua*) and 2 of them) or 6 of ($s*))
}

rule MALWARE_Win_LimeRAT {
    meta:
        author = "ditekSHen"
        description = "LimeRAT payload"
    strings:
        $s1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr" wide
        $s2 = "\\vboxhook.dll" fullword wide
        $s3 = "Win32_Processor.deviceid=\"CPU0\"" fullword wide
        $s4 = "select CommandLine from Win32_Process where Name='{0}'" wide
        $s5 = "Minning..." fullword wide
        $s6 = "Regasm.exe" fullword wide
        $s7 = "Flood!" fullword wide
        $s8 = "Rans-Status" fullword wide
        $s9 = "cmd.exe /c ping 0"  wide
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_GuLoader {
    meta:
        author = "ditekSHen"
        description = "Shellcode injector and downloader"
    strings:
        $s1 = "wininet.dll" fullword ascii
        $s2 = "ShellExecuteW" fullword ascii
        $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii
        $s4 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" fullword ascii
        $s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
        $s6 = "Startup key" fullword ascii
        $s7 = "\\qemu-ga\\qga.state" ascii nocase
        $s8 = "\\qga\\qga.exe" ascii nocase
        $s9 = "\\Qemu-ga\\qemu-ga.exe" ascii nocase
        $s10 = "WScript.Shell" ascii

        $l1 = "shell32" fullword ascii
        $l2 = "kernel32" fullword ascii
        $l3 = "advapi32" fullword ascii
        $l4 = "user32" fullword ascii

        $o1 = "msvbvm60.dll" fullword wide
        $o2 = "\\syswow64\\" fullword wide
        $o3 = "\\system32\\" fullword wide
        $o4 = "\\Microsoft.NET\\Framework\\" fullword wide
        $o5 = "USERPROFILE=" fullword wide
        $o6 = "windir=" fullword wide
        $o7 = "APPDATA=" fullword wide
        $o8 = "RegAsm.exe" fullword wide
        $o9 = "ProgramFiles=" fullword wide
        $o10 = "TEMP=" fullword wide

        $url1 = "https://drive.google.com/uc?export=download&id=" ascii
        $url2 = "https://onedrive.live.com/download?cid=" ascii
        $url3 = "http://myurl/myfile.bin" fullword ascii
        $url4 = "http" ascii // fallback
    condition:
        (3 of ($s*) and 2 of ($l*) and 2 of ($o*) and 1 of ($url*)) or (4 of ($s*) and 3 of ($l*) and 2 of ($o*))
}

rule MALWARE_Win_Arkei {
    meta:
        author = "ditekSHen"
        description = "Detect Arkei infostealer variants"
    strings:
        $s1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
        $s2 = "/c taskkill /im " fullword ascii
        $s3 = "card_number_encrypted FROM credit_cards" ascii
        $s4 = "\\wallet.dat" ascii
        $s5 = "Arkei/" wide
        $s6 = "files\\passwords." ascii wide
        $s7 = "files\\cc_" ascii wide
        $s8 = "files\\autofill_" ascii wide
        $s9 = "files\\cookies_" ascii wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_DCRat {
    meta:
        author = "ditekSHen"
        description = "DCRat payload"
    strings:
        // DCRat
        $dc1 = "DCRatBuild" ascii
        $dc2 = "DCStlr" ascii
        $x1 = "px\"><center>DCRat Keylogger" wide
        $x2 = "DCRat-Log#" wide
        $x3 = "DCRat.Code" wide
        $string1 = "CaptureBrowsers" fullword ascii
        $string2 = "DecryptBrowsers" fullword ascii
        $string3 = "Browsers.IE10" ascii
        $string4 = "Browsers.Chromium" ascii
        $string5 = "WshShell" ascii
        $string6 = "SysMngmts" fullword ascii
        $string7 = "LoggerData" fullword ascii
        // DCRat Plugins/Libraries
        $plugin = "DCRatPlugin" fullword ascii
        // AntiVM
        $av1 = "AntiVM" ascii wide
        $av2 = "vmware" fullword wide
        $av3 = "VirtualBox" fullword wide
        $av4 = "microsoft corporation" fullword wide
        $av5 = "VIRTUAL" fullword wide
        $av6 = "DetectVirtualMachine" fullword ascii
        $av7 = "Select * from Win32_ComputerSystem" fullword wide
        // Plugin_AutoStealer, Plugin_AutoKeylogger
        $pl1 = "dcratAPI" fullword ascii
        $pl2 = "dsockapi" fullword ascii
        $pl3 = "file_get_contents" fullword ascii
        $pl4 = "classthis" fullword ascii
        $pl5 = "typemdt" fullword ascii
        $pl6 = "Plugin_AutoStealer" ascii wide
        $pl7 = "Plugin_AutoKeylogger" ascii wide
        // variant
        $v1 = "Plugin couldn't process this action!" wide
        $v2 = "Unknown command!" wide
        $v3 = "PLUGINCONFIGS" wide
        $v4 = "Saving log..." wide
        $v5 = "~Work.log" wide
        $v6 = "MicrophoneNum" fullword wide
        $v7 = "WebcamNum" fullword wide
        $v8 = "%SystemDrive% - Slow" wide
        $v9 = "%UsersFolder% - Fast" wide
        $v10 = "%AppData% - Very Fast" wide
        $v11 = /<span style=\"color: #F85C50;\">\[(Up|Down|Enter|ESC|CTRL|Shift|Win|Tab|CAPSLOCK: (ON|OFF))\]<\/span>/ wide
        $px1 = "[Browsers] Scanned elements: " wide
        $px2 = "[Browsers] Grabbing cookies" wide
        $px3 = "[Browsers] Grabbing passwords" wide
        $px4 = "[Browsers] Grabbing forms" wide
        $px5 = "[Browsers] Grabbing CC" wide
        $px6 = "[Browsers] Grabbing history" wide
        $px7 = "[StealerPlugin] Invoke: " wide
        $px8 = "[Other] Grabbing steam" wide
        $px9 = "[Other] Grabbing telegram" wide
        $px10 = "[Other] Grabbing discord tokens" wide
        $px11 = "[Other] Grabbing filezilla" wide
        $px12 = "[Other] Screenshots:" wide
        $px13 = "[Other] Clipboard" wide
        $px14 = "[Other] Saving system information" wide
    condition:
        uint16(0) == 0x5a4d and (all of ($dc*) or all of ($string*) or 2 of ($x*) or 6 of ($v*) or 5 of ($px*)) or ($plugin and (4 of ($av*) or 5 of ($pl*)))
}

rule MALWARE_Win_ObliqueRAT {
    meta:
        author = "ditekSHen"
        description = "ObliqueRAT payload"
    strings:
        $s1 = "C:\\ProgramData\\auto.txt" fullword ascii
        $s2 = "C:\\ProgramData\\System\\Dump\\" fullword ascii
        $s3 = "C:\\ProgramData\\a.txt" fullword ascii
        $s4 = "Oblique" fullword ascii
        $s5 = /(Removable|Hard|Network|CD|RAM)\sDisk\|/ ascii
        $s6 = "backed" fullword ascii
        $s7 = "restart" fullword ascii
        $s8 = "kill" fullword ascii
        $s9 = /(John|JOHN|Test|TEST|Johsnson|Artifact|Vince|Serena|Lisa|JOHNSON|VINCE|SERENA)/ ascii nocase
        $v1 = "C:\\ProgramData" fullword ascii
        $v2 = "auto" fullword ascii
        $v3 = "plit" fullword ascii
        $v4 = ":image/jpeg" fullword wide
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_FirebirdRAT {
    meta:
        author = "ditekSHen"
        description = "Firebird/Hive RAT payload"
        clamav_sig = "MALWARE.Win.Trojan.Firebird-HiveRAT"
    strings:
        $id1 = "Firebird Remote Administration Tool" fullword wide
        $id2 = "Welcome to Firebird! Your system is currently being monitored" wide
        $id3 = "Hive Remote Administration Tool" fullword wide
        $id4 = "Welcome to Hive! Your system is currently being monitored" wide
        $s1 = "REPLACETHESEKEYSTROKES" fullword wide
        $s2 = "_ENABLE_PROFILING" fullword wide
        $s3 = ": KeylogSubject" wide
        $s4 = "Firebird.CommandHandler" fullword wide        
        $s5 = "webcamenabled" fullword ascii
        $s6 = "screenlogs" fullword ascii
        $s7 = "encryptedconnection" fullword ascii
        $s8 = "monitoron" fullword ascii
        $s9 = "screenGrab" fullword ascii
        $s10 = "TCP_TABLE_OWNER_PID_ALL" fullword ascii
        $s11 = "de4fuckyou" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($id*) or 7 of ($s*))
}

rule MALWARE_Win_Phoenix {
    meta:
        author = "ditekSHen"
        description = "Phoenix/404KeyLogger keylogger payload"
        clamav_sig = "MALWARE.Win.Trojan.Phoenix-Keylogger"
    strings:
        $s1 = "FirefoxPassReader" fullword ascii
        $s2 = "StartKeylogger" fullword ascii
        $s3 = "CRYPTPROTECT_" ascii
        $s4 = "Chrome_Killer" fullword ascii
        $s5 = "Clipboardlog.txt" fullword wide
        $s6 = "Leyboardlogs.txt" fullword wide
        $s7 = "Persistence'" wide
        $s8 = "set_HKB" fullword ascii
        $s9 = "loloa" fullword ascii
        $s10 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)" fullword wide
        // Memory
        $m1 = "- Screenshot -------|" ascii wide
        $m2 = "- Clipboard -------|" ascii wide
        $m3 = "- Logs -------|" ascii wide
        $m4 = "- Passwords -------|" ascii wide
        $m5 = "PSWD" ascii wide
        $m6 = "Screenshot |" ascii wide
        $m7 = "Logs |" ascii wide
    condition:
        (uint16(0) == 0x5a4d and 6 of ($s*) or 3 of ($m*)) or 9 of them
}

rule MALWARE_Win_BackNet {
    meta:
        author = "ditekSHen"
        description = "BackNet payload"
        clamav_sig = "MALWARE.Win.Trojan.BackNet"
    strings:
        $s1 = "Slave.Commands." fullword ascii
        $s2 = "StartKeylogger" fullword ascii
        $s3 = "StopKeylogger" fullword ascii
        $s4 = "KeyLoggerCommand" fullword ascii
        $s5 = "get_keyLoggerManager" fullword ascii
        $s6 = "get_IgnoreMutex" fullword ascii
        $s7 = "ListProcesses" fullword ascii
        $s8 = "downloadurl" fullword wide
        $pdb = "\\BackNet-master\\Slave\\obj\\Release\\Slave.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and ($pdb or all of ($s*))
}

rule MALWARE_Win_AcridRain {
    meta:
        author = "ditekSHen"
        description = "AcidRain stealer payload"
    strings:
        $s1 = { 43 6f 6f 6b 69 65 73 (5c|2e) }
        $s2 = { 74 65 6d 70 6c 6f 67 69 ?? }
        $s3 = { 74 65 6d 70 50 ?? 68 }
        $s4 = "Connecting to hostname: %s%s%s" fullword ascii
        $s5 = "Found bundle for host %s: %p [%s]" fullword ascii
        $s6 = "encryptedUsernamencryptedPassworERROR Don't copy string" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Linux_ChaChaDDoS {
    meta:
        author = "ditekSHen"
        description = "ChaChaDDoS variant of XorDDoS payload"
    strings:
        $x1 = "[kworker/1:1]" ascii
        $x2 = "-- LuaSocket toolkit." ascii
        $x3 = "/etc/resolv.conf" ascii
        $x4 = "\"macaddress=\" .. DEVICE_MAC .. \"&device=\" .." ascii
        $x5 = "easy_attack_dns" ascii
        $x6 = "easy_attack_udp" ascii
        $x7 = "easy_attack_syn" ascii
        $x8 = "syn_probe" ascii
    condition:
    uint16(0) == 0x457f and 6 of them
}

rule MALWARE_Multi_Exaramel {
    meta:
        author = "ditekSHen"
        description = "Exaramel Windows/Linux backdoor payload"
        clamav_sig1 = "MALWARE_Linux.Backdoor.Exaramel"
        clamav_sig2 = "MALWARE_Win.Backdoor.Exaramel"
    strings:
        // Linux payload
        $s1 = "vendor/golang_org/x/crypto/" ascii
        $s2 = "vendor/golang_org/x/net/http2" ascii
        $s3 = "vendor/golang_org/x/text/unicode" ascii
        $s4 = "vendor/golang_org/x/text/transform" ascii
        $s5 = "config.json" ascii
        $cmd1 = "App.Update" ascii
        $cmd2 = "App.Delete" ascii
        $cmd3 = "App.SetProxy" ascii
        $cmd4 = "App.SetServer" ascii
        $cmd5 = "App.SetTimeout" ascii
        $cmd6 = "IO.WriteFile" ascii
        $cmd7 = "IO.ReadFile" ascii
        $cmd8 = "OS.ShellExecute" ascii
        $cmd9 = "awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;" ascii
        // Windows payload
        $ws1 = "/commands/@slp" wide
        $ws2 = "/commands/cmd" wide
        $ws3 = "/settings/proxy/@password" wide
        $ws4 = "/settings/servers/server[@current='true']" wide
        $ws5 = "/settings/servers/server/@current[text()='true']" wide
        $ws6 = "/settings/servers/server[text()='%s']/@current" wide
        $ws7 = "/settings/servers/server[%d]" wide
        $ws8 = "/settings/storage" wide
        $ws9 = "/settings/check" wide
        $ws10 = "/settings/interval" wide
        $ws11 = "report.txt" wide
        $ws12 = "stg%02d.cab" ascii
        $ws13 = "urlmon.dll" ascii
        $ws14 = "ReportDir" ascii
    condition:
        (uint16(0) == 0x457f and (all of ($s*) and 6 of ($cmd*))) or (uint16(0) == 0x5a4d and 12 of ($ws*))
}

rule MALWARE_Linux_HiddenWasp {
    meta:
        author = "ditekSHen"
        description = "HiddenWasp backdoor payload"
        clamav_sig1 = "MALWARE_Linux.Trojan.HiddenWasp-ELF"
        clamav_sig2 = "MALWARE_Linux.Trojan.HiddenWasp-Script"
    strings:
        $x1 = "I_AM_HIDDEN" fullword ascii
        $x2 = "HIDE_THIS_SHELL" fullword ascii
        $x3 = "NewUploadFile" ascii
        $x4 = "fake_processname" ascii
        $x5 = "swapPayload" ascii
        $x6 = /Trojan-(Platform|Machine|Hostname|OSersion)/ fullword ascii
        $s1 = "FileOpration::GetFileData" fullword ascii
        $s2 = "FileOpration::NewUploadFile" fullword ascii
        $s3 = "Connection::writeBlock" fullword ascii
        $s4 = /hiding_(hidefile|enable_logging|hideproc|makeroot)/ fullword ascii
        $s5 = "Reverse-Port" fullword ascii
        $s6 = "hidden_services" fullword ascii
        $s7 = "check_config" fullword ascii
        $s8 = "__data_start" fullword ascii
        $s9 = /patch_(suger_lib|ld|lib)/ fullword ascii
        $s10 = "hexdump -ve '1/1 \"%%.2X\"' %s | sed \"s/%s/%s/g\" | xxd -r -p > %s.tmp"
    condition:
        uint16(0) == 0x457f and (4 of ($x*) or all of ($s*) or (3 of ($x*) and 5 of ($s*)))
}

rule MALWARE_Multi_WellMess {
    meta:
        author = "ditekSHen"
        description = "WellMess Windows/Linux backdoor payload"
        clamav_sig1 = "MALWARE_Win.Trojan.WellMess_DotNet"
        clamav_sig2 = "MALWARE_Win.Trojan.WellMess_Golang"
        clamav_sig3 = "MALWARE_Linux.Trojan.WellMess_Golang"
    strings:
        // Linux and Windows payload
        $s1 = "-----BEGIN PUBLIC KEY-----" ascii
        $s2 = "-----END PUBLIC KEY-----" ascii
        $s3 = "net/http.(*persistConn).readResponse" ascii
        $s4 = "net/http/cookiejar.(*Jar).SetCookies" ascii
        $s5 = "_/home/ubuntu/GoProject/src/bot/botlib" ascii
        $s6 = "<;head;><;title;>" ascii
        $s7 = "<;title;><;service;>" ascii
        $s8 = "http://invalidlookup" ascii
        $s9 = "<autogenerated>" ascii wide
        //$ua1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" ascii
        //$ua2 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20130401 Firefox/31.0" ascii
    condition:
        (uint16(0) == 0x457f or uint16(0) == 0x5a4d) and all of them
}

rule MALWARE_Win_Konni {
    meta:
        author = "ditekSHen"
        description = "Konni payload"
    strings:
        $s1 = "uplog.tmp" fullword wide
        $s2 = "upfile.tmp" fullword wide
        $s3 = "%s-log-%s" fullword ascii wide
        $s4 = "%s-down" ascii wide
        $s5 = "%s-file-%s" fullword ascii wide
        $s6 = "\"rundll32.exe\" \"%s\" install" fullword wide
        $s7 = "subject=%s&data=" fullword ascii
        $s8 = "dll-x64.dll" fullword ascii
        $s9 = "dll-x32.dll" fullword ascii
        $pdb1 = "\\virus-dropper\\Release\\virus-dropper.pdb" ascii
        $pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or (3 of ($s*) and 1 of ($pdb*)))
}

rule MALWARE_Win_BitterRAT {
    meta:
        author = "ditekSHen"
        description = "BitterRAT payload"
        clamav_sig = "MALWARE.Win.Trojan.BitterRAT"
    strings:
        $s1 = "getfile" fullword wide
        $s2 = "getfolder" fullword wide
        $s3 = "winmgmts://./root/default:StdRegProv" fullword wide
        $s4 = "winlog" fullword wide
        $s5 = "winprt" fullword wide
        $s6 = "c:\\intel\\" fullword ascii
        $s7 = "AXE: #" fullword ascii
        $s8 = "Bld: %s.%s.%s" fullword ascii
        $s9 = "53656C656374202A2066726F6D2057696E33325F436F6D707574657253797374656D" wide nocase
        $pdb1 = "\\28NovDwn\\Release\\28NovDwn.pdb" ascii
        $pdb2 = "\\Shellcode\\Release\\Shellcode.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (7 of ($*) or (4 of ($s*) and 1 of ($pdb*)))
}

rule MALWARE_Win_TJKeylogger {
    meta:
        author = "ditekSHen"
        description = "TJKeylogger payload"
    strings:
        $s1 = "TJKeyLogger" fullword ascii
        $s2 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
        $s3 = "\\Passwords.txt" ascii
        $s4 = "TJKeyLogItem" fullword ascii
        $s5 = "TJKeyAsyncLog" fullword ascii
        $s6 = "FM_GETDSKLST" fullword ascii
        $s7 = "KL_GETMODE" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_W1RAT {
    meta:
        author = "ditekSHen"
        description = "W1 RAT payload"
    strings:
        $s1 = "/c /Ox /Fa\"%s/%s.asm\" /Fo\"%s/%s.obj\" \"%s/%s.%s\"" ascii
        $s2 = "this->piProcInfo.hProcess" fullword ascii
        $s3 = "index >= 0 && index < this->reg_tab->GetLen()" fullword ascii
        $s4 = "strcpy(log_font.lfFaceName,\"%s\");" fullword ascii
        $s5 = "WorkShop -- [%s]" fullword ascii
        $s6 = "HeaderFile.cpp" fullword ascii
        $s7 = "WndLog.cpp" fullword ascii
        $s8 = "assertion fail \"%s\" at file=%s line=%d" fullword ascii
        $s9 = "Stdin   pipe   creation   failed" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and 6 of ($s*)) or (all of them)
}

rule MALWARE_Win_Raccoon {
    meta:
        author = "ditekSHen"
        description = "Raccoon stealer payload"
    strings:
        $s1 = "inetcomm server passwords" fullword wide
        $s2 = "content-disposition: form-data; name=\"file\"; filename=\"data.zip\"" fullword ascii
        $s3 = ".?AVfilesystem_error@v1@filesystem@experimental@std@@" fullword ascii
        $s4 = "CredEnumerateW" fullword ascii
        $s5 = "%[^:]://%[^/]%[^" fullword ascii
        $s6 = "%99[^:]://%99[^/]%99[^" fullword ascii
        $s7 = "Login Data" wide
        $s8 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
        $x1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
        $x2 = "\\json.hpp" wide
        $x3 = "Microsoft_WinInet_" fullword wide
        $x4 = "Microsoft_WinInet_*" fullword wide
    condition:
        uint16(0) == 0x5a4d and ((3 of ($x*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($x*)))
}

rule MALWARE_Win_Amadey {
    meta:
        author = "ditekSHen"
        description = "Amadey downloader payload"
    strings:
        $s1 = "_ZZ14aGetProgramDirvE11UsersDirRes" fullword ascii
        $s2 = "_libshell32_a" ascii
        $s3 = "_ShellExecuteExA@4" ascii
        $s4 = "aGetTempDirvE10TempDirRes" ascii
        $s5 = "aGetHostNamevE7InfoBuf" ascii
        $s6 = "aCreateProcessPc" ascii
        $s7 = "aGetHostNamev" ascii
        $s8 = "aGetSelfDestinationiE22aGetSelfDestinationRes" ascii
        $s9 = "aGetSelfPathvE15aGetSelfPathRes" ascii
        $s10 = "aResolveHostPcE15aResolveHostRes" ascii
        $s11 = "aUrlMonDownloadPcS" ascii
        $s12 = "aWinSockPostPcS_S_" ascii
        $s13 = "aCreateProcessPc" ascii

        $v1 = "hii^" fullword ascii
        $v2 = "plugins/" fullword ascii
        $v3 = "ProgramData\\" fullword ascii
        $v4 = "&unit=" fullword ascii
        $v5 = "runas" fullword ascii wide
        $v6 = "Microsoft Internet Explorer" fullword wide
        $v7 = "stoi argument" ascii

        $av1 = "AVAST Software" fullword ascii
        $av2 = "Avira" fullword ascii
        $av3 = "Kaspersky Lab" fullword ascii
        $av4 = "ESET" fullword ascii
        $av5 = "Panda Security" fullword ascii
        $av6 = "Doctor Web" fullword ascii
        $av7 = "360TotalSecurity" fullword ascii
        $av8 = "Bitdefender" fullword ascii
        $av9 = "Norton" fullword ascii
        $av10 = "Sophos" fullword ascii
        $av11 = "Comodo" fullword ascii

        $pdb1 = "Amadey\\Release\\Amadey.pdb" ascii wide
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or (6 of ($v*) and 2 of ($av*)) or 1 of ($pdb*))
}


rule MALWARE_Win_Tefosteal {
    meta:
        author = "ditekSHen"
        description = "Tefosteal payload"
        clamav_sig = "MALWARE.Win.Trojan.Tefosteal"
    strings:
        $s1 = "netsh wlan show networks mode=bssid" nocase fullword wide
        $s2 = "LoginCredentialService.GetLoginCredentials$" ascii
        $s3 = "DefaultLoginCredentials.LoginEventUsrPw$" ascii
        $s4 = "SEC_E_NO_KERB_KEY" wide
        $s5 = "TList<System.Zip.TZipHeader>." ascii
        $s6 = "_Password.txt" fullword wide nocase
        $s7 = "_Cookies.txt" fullword wide nocase
        $f1 = "\\InfoPC\\BSSID.txt" wide
        $f2 = "\\Files\\Telegram\\" wide
        $f3 = "\\InfoPC\\Screenshot.png" wide
        $f4 = "\\InfoPC\\Systeminfo.txt" wide
        $f5 = "\\Steam\\config" wide
        $f6 = "\\delete.vbs" wide
    condition:
        uint16(0) == 0x5a4d and 4 of ($s*) and 2 of ($f*)
}

rule MALWARE_Win_CryptoStealerGo {
    meta:
        author = "ditekSHen"
        description = "CryptoStealerGo payload"
    strings:
        $s1 = "Go build ID: \"" ascii
        $s2 = "file_upload.go" ascii
        $s3 = "grequests.FileUpload" ascii
        $s4 = "runtime.newproc" ascii
        $s5 = "credit_cards" ascii
        $s6 = "zip.(*fileWriter).Write" ascii
        $s7 = "autofill_" ascii
        $s8 = "XFxVc2VyIERhdGFcXA==" ascii
        $s9 = "XFxBcHBEYXRhXFxMb2NhbFxc" ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_M00nD3v {
    meta:
        author = "ditekSHen"
        description = "M00nD3v keylogger payload"
    strings:
        $s1 = "M00nD3v Stub" ascii wide
        $s2 = "M00nD3v{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" fullword wide
        $s3 = "Anti-Keylogger Elite" wide
        $s4 = "/C TASKKILL /F /IM" wide
        $s5 = "echo.>{0}:Zone.Identifier" fullword wide
        $s6 = "> Nul & Del \"{0}\" & start \"\" \"{1}.exe\"" wide
        $s7 = "> Nul & start \"\" \"{1}.exe\"" wide
        $s8 = "Stealer" fullword wide
        $s9 = "{0}{0}++++++++++++{1} {2}++++++++++++{0}{0}" wide
        $s10 = "{4}Application: {3}{4}URL: {0}{4}Username: {1}{4}Password: {2}{4}" wide
        $s11 = "encrypted_key\":\"(?<Key>.+?)\"" wide
        $s12 = "Botkiller" fullword ascii
        $s13 = "AVKiller" fullword ascii
        $s14 = "get_pnlPawns" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and 6 of them) or (9 of them)
}

rule MALWARE_Win_VSSDestroy {
    meta:
        author = "ditekSHen"
        description = "VSSDestroy/Matrix ransomware payload"
        snort_sid = "920008-920009"
        clamav_sig = "MALWARE.Win.Ransomware.VSSDestroy"
    strings:
        $o1 = "[SHARESSCAN]" wide
        $o2 = "[LDRIVESSCAN]" wide
        $o3 = "[LOGSAVED]" wide
        $o4 = "[LPROGRESS]" wide
        $o5 = "[FINISHSAVED]" wide
        $o6 = "[ALL_LOCAL_KID]" wide
        $o7 = "[DIRSCAN" wide
        $o8 = "[GENKEY]" wide
        $s1 = "\\cmd.exe" nocase wide
        $s2 = "/C powershell \"" nocase wide
        $s3 = "%COMPUTERNAME%" wide
        $s4 = "%USERNAME%" wide
        $s5 = "Error loading Socket interface (ws2_32.dll)!" wide
        $s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide
    condition:
        (uint16(0) == 0x5a4d and 4 of ($o*) and 3 of ($s*)) or (5 of ($o*) and 4 of ($s*))
}

rule MALWARE_Win_GoldenAxe {
    meta:
        author = "ditekSHen"
        description = "GoldenAxe ransomware payload"
        clamav_sig = "MALWARE.Win.Ransomware.GoldenAxe"
    strings:
        $s1 = "Go build ID: " ascii
        $s2 = "taskkill.exe" ascii
        $s3 = "cmd.exe" ascii
        $s4 = "Speak.Speak" ascii
        $s5 = "CLNTSRVRnull" ascii
        $s6 = "-----END" ascii        
        $s7 = "-----BEGIN" ascii
        $s8 = ".EncryptFile" ascii
        $g1 = "GoldenAxe/Utils." ascii
        $g2 = "GoldenAxe/Cryptography." ascii
        $g3 = "GoldenAxe/Walker." ascii
        $g4 = "C:/Users/alpha/go/src/GoldenAxe/" ascii
        $g5 = "'Golden Axe ransomware'" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (1 of ($g*) and 1 of ($s*)))
}

rule MALWARE_Win_Robbinhood {
    meta:
        author = "ditekSHen"
        description = "Robbinhood ransomware payload"
        clamav_sig = "MALWARE.Win.Ransomware.Robbinhood"
    strings:
        $go = "Go build ID:" ascii
        $cmd1 = "cmd.exe /c" ascii
        $cmd2 = "net use * /DELETE" nocase ascii
        $cmd3 = "sc.exe stop" ascii
        $cmd4 = "vssadmin resize shadowstorage" nocase ascii
        $s1 = /Skipping\s(file|dir)/ ascii
        $s2 = "Encrypt[ERR] GET Size:" ascii
        $s3 = ".taskkilltasklistunknown(" ascii
        $s4 = ".sysvssadmin.exewevtutil.exe MB released" ascii
        $s5 = ".sysvssadmin.exewevtutil.exewinlogin.exewinlogon.exe MB released" ascii
        $s6 = ".enc_robbinhood" ascii
        $s7 = "c:\\windows\\temp\\pub.key" nocase ascii
        $s8 = "main.CoolMaker" ascii
        $s9 = "/valery/go/src/oldboy/" ascii
    condition:
        uint16(0) == 0x5a4d and ($go and 1 of ($cmd*) and 3 of ($s*))
}

rule MALWARE_Win_GetCrypt {
    meta:
        author = "ditekSHen"
        description = "GetCrypt ransomware payload"
        clamav_sig1 = "MALWARE_Win.Ransomware.GetCrypt-1"
        clamav_sig2 = "MALWARE_Win.Ransomware.GetCrypt-2"
    strings:
        $x1 = "delete shadows /all /quiet" wide
        $x2 = "C:\\Windows\\System32\\svchost.exe" fullword wide
        $x3 = "desk.bmp" fullword wide
        $x4 = ":\\Boot" fullword wide
        $x5 = "\\encrypted_key.bin" fullword wide
        $x6 = "vssadmin.exe" fullword wide
        $x7 = ":\\Recovery" fullword wide
        $s1 = "CryptEncrypt" fullword ascii
        $s2 = "NtWow64ReadVirtualMemory64" fullword ascii
        $s3 = "MPR.dll" fullword ascii
        $s4 = "%key%" fullword ascii
        $s5 = "CryptDestroyKey" fullword ascii
        $s6 = "ntdll.dll" fullword ascii
        $s7 = "WNetCancelConnection2W" fullword ascii
        $s8 = ".%c%c%c%c" fullword wide
        // is slowing down scanning
        //$s9 = /([Gg]uest|[Aa]dministrator|[Dd]eveloper|[Rr][0Oo]{2}t|[Aa]dmin)/ fullword ascii wide
        $s10 = { 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 00 00
                 cb 00 43 72 79 70 74 45 6e 63 72 79 70 74 00 00
                 c1 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f
                 6e 74 65 78 74 41 00 00 c8 00 43 72 79 70 74 44
                 65 73 74 72 6f 79 4b 65 79 00 d2 00 43 72 79 70
                 74 47 65 6e 52 61 6e 64 6f 6d 00 00 c2 00 43 72
                 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78
                 74 57 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c
                 00 00 b5 01 53 68 65 6c 6c 45 78 65 63 75 74 65
                 45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 }
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or 8 of ($s*))
}

rule MALWARE_JoeGo {
    meta:
        author = "ditekSHen"
        description = "JoeGo ransomware payload"
        clamav_sig = "MALWARE.Win.Ransomware.JoeGo"
    strings:
        $go = "Go build ID:" ascii
        $s1 = "%SystemRoot%\\system32\\%v." ascii
        $s2 = "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V" ascii
        $s3 = "/t REG_SZ /F /D %userprofile%\\" ascii
        $s4 = "(sensitive) [recovered]" ascii
        $s5 = "/dev/stderr/dev/stdout/index.html" ascii
        $s6 = "%userprofile%\\SystemApps" ascii
        $s7 = "p=<br>ACDTACSTAEDTAESTAKDTAKSTAWSTA" ascii
        $cnc1 = "/detail.php" ascii
        $cnc2 = "/checkin.php" ascii
        $cnc3 = "/platebni_brana.php" ascii
        $cnc4 = "://nebezpecnyweb.eu/" ascii
    condition:
        uint16(0) == 0x5a4d and $go and (all of ($s*) or (3 of ($s*) and 1 of ($cnc*)))
}

rule MALWARE_Win_Aurora {
    meta:
        author = "ditekSHen"
        description = "Aurora ransomware payload"
    strings:
        $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii wide
        $s2 = "#DECRYPT_MY_FILES#.txt" fullword ascii
        $s3 = "/gen.php?generate=" fullword ascii
        $s4 = "geoplugin.net/php.gp" ascii
        $s5 = "/end.php?id=" fullword ascii
        $s6 = "wotreplay" fullword ascii
        $s7 = "moneywell" fullword ascii
        $s8 = "{btc}" fullword ascii
        $s9 = ".?AV_Locimp@locale@std@@" ascii
        $s10 = ".?AV?$codecvt@DDU_Mbstatet@@@std@@" ascii
        $s11 = ".?AU_Crt_new_delete@std@@" ascii
        $pdb1 = "\\z0ddak\\Desktop\\source\\Release\\Ransom.pdb" ascii
        $pdb2 = "\\Desktop\\source\\Release\\Ransom.pdb" ascii
    condition:
         uint16(0) == 0x5a4d and ((1 of ($pdb*) and 5 of ($s*)) or (8 of them))
}

rule MALWARE_Win_Buran {
    meta:
        author = "ditekSHen"
        description = "Buran ransomware payload"
        clamav_sig = "MALWARE.Win.Ransomware.Buran"
    strings:
        // Variant 1
        $v1_1 = "U?$error_info_injector@V" ascii
        $v1_2 = "Browse for Folder (FTP)" fullword ascii
        $v1_3 = "Find/Replace in Files" fullword ascii
        $v1_4 = "PAHKLM" fullword ascii
        $v1_5 = "PAHKCR" fullword ascii
        $v1_6 = "chkOpt_" ascii
        $h1 = "Search <a href=\"location\" class=\"menu\">in this folder</a>" ascii
        $h2 = "<br>to find where the text below" ascii
        $h3 = "</a> files with these extensions (separate with semi-colons)" ascii
        $h4 = "Need help with <a href=\"" ascii
        $path = "\\work\\cr\\nata\\libs\\boost_" wide
        // Variant 2
        $v2_1 = "(ShlObj" fullword ascii
        $v2_2 = "\\StreamUnit" fullword ascii
        $v2_3 = "TReadme" fullword ascii
        $v2_4 = "TDrivesAndShares" fullword ascii
        $v2_5 = "TCustomMemoryStreamD" fullword ascii
        $v2_6 = "OpenProcessToken" fullword ascii
        $v2_7 = "UrlMon" fullword ascii
        $v2_8 = "HttpSendRequestA" fullword ascii
        $v2_9 = "InternetConnectA" fullword ascii
        $v2_10 = "FindFiles" fullword ascii
        $v2_12 = "$*@@@*$@@@$" ascii
    condition:
        uint16(0) == 0x5a4d and (((all of ($v1*) and 1 of ($h*)) or ($path and 2 of ($v1*) and 1 of ($h*)) or 10 of them) or all of ($v2*))
}

rule MALWARE_Win_MassLogger {
    meta:
        author = "ditekSHen"
        description = "MassLogger keylogger payload"
    strings:
        $s1 = "MassLogger v" ascii wide
        $s2 = "MassLogger Started:" ascii wide
        $s3 = "MassLogger Process:" ascii wide
        $s4 = "/panel/upload.php" wide
        $s5 = "ftp://" wide
        $s6 = "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}" fullword wide
        $s7 = "^(.*/)?([^/\\\\.]+/\\\\.\\\\./)(.+)$" fullword wide
        $s8 = "Bot Killer" ascii
        $s9 = "Keylogger And Clipboard" ascii
        $c1 = "costura.ionic.zip.reduced.dll.compressed" fullword ascii
        $c2 = "CHECKvUNIQUEq" fullword ascii
        $c3 = "HOOK/MEMORY6" fullword ascii
        $c4 = "Massfile" ascii wide
        $c5 = "Fz=[0-9]*'skips*" fullword ascii
        $c6 = ":=65535zO" fullword ascii
        $c7 = "!$!%!&!'!(!)!*!.!/!0!4!" fullword ascii
        $c8 = "5!9!:!<!>!@!E!G!J!K!L!N!O!P!`!" fullword ascii
        $c9 = "dllToLoad" fullword ascii
        $c10 = "set_CreateNoWindow" fullword ascii
        $c11 = "FtpWebRequest" fullword ascii
        $c12 = "encryptedUsername" fullword ascii
        $c13 = "encryptedPassword" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and 9 of ($c*)) or (5 of ($s*) or 9 of ($c*))
}

rule MALWARE_Win_Echelon {
    meta:
        author = "ditekSHen"
        description = "Echelon information stealer payload"
    strings:
        $s1 = "<GetStealer>b__" ascii
        $s2 = "clearMac" fullword ascii
        $s3 = "path2save" fullword ascii
        $s4 = "Echelon_Size" fullword ascii
        $s5 = "Echelon Stealer by" wide
        $s6 = "get__masterPassword" fullword ascii
        $s7 = "DomainDetect" fullword ascii
        $s8 = "[^\\u0020-\\u007F]" fullword wide
        $s9 = "/sendDocument?chat_id=" wide
        $s10 = "//setting[@name='Password']/value" wide
        $s11 = "Passwords_Mozilla.txt" fullword wide
        $s12 = "Passwords_Edge.txt" fullword wide
        $s13 = "@madcod" ascii wide
        $pdb = "\\Echelon-Stealer-master\\obj\\Release\\Echelon.pdb" ascii
    condition:
        (uint16(0) == 0x5a4d and (8 of ($s*) or $pdb)) or (8 of ($s*) or $pdb)
}

rule MALWARE_Win_Qulab {
    meta:
        author = "ditekSHen"
        description = "Qulab information stealer payload or artifacts"
        clamav_sig = "MALWARE.Win.Trojan.QulabZ-Stealer"
    strings:
        $x1 = "QULAB CLIPPER + STEALER" ascii wide
        $x2 = "MASAD CLIPPER + STEALER" ascii wide
        $x3 = "http://teleg.run/Qulab" ascii wide
        $x4 = "http://teleg.run/jew_seller" ascii wide
        $x5 = "BUY CLIPPER + STEALER" ascii wide
        $s1 = "\\Screen.jpg" ascii wide
        $s2 = "attrib +s +h \"" ascii wide
        $s3 = "\\x86_microsoft-windows-" ascii wide
        $s4 = "\\amd64_microsoft-windows-" ascii wide
        $s5 = "Desktop TXT File" ascii wide
        $s6 = "\\AutoFills.txt" ascii wide
        $s7 = "\\CreditCards.txt" ascii wide
        $s8 = "a -y -mx9 -ssw" ascii wide
        $s9 = "\\Passwords.txt" ascii wide
        $s10 = "\\Information.txt" ascii wide
        $s11 = "\\getMe" ascii wide
    condition:
        9 of them or ((1 of ($x*) and 4 of ($s*)) or 1 of ($x*))
}

rule MALWARE_Win_Orion {
    meta:
        author = "ditekSHen"
        description = "Orion Keylogger payload"
    strings:
        $s1 = "\\Ranger.BrowserLogging" ascii wide nocase
        $s2 = "GrabAccounts" fullword ascii
        $s3 = "DownloadFile" fullword ascii
        $s4 = "Internet Explorer Recovery" wide
        $s5 = "Outlook Recovery" wide
        $s6 = "Thunderbird Recovery" wide
        $s7 = "Keylogs -" wide
        $s8 = "WebCam_Capture.dll" wide
        $s9 = " is not installed on this computer!" wide
        $s10 = "cmd /c bfsvc.exe \"" wide
        $s11 = "/Keylogs - PC:" fullword wide
        $s12 = "/PC:" fullword wide
        $s13 = "<p style=\"color:#CC7A00\">[" wide
    condition:
        (uint16(0) == 0x5a4d and 5 of ($s*)) or (6 of ($s*))
}

rule MALWARE_Win_Aspire {
    meta:
        author = "ditekSHen"
        description = "Aspire Keylogger payload"
    strings:
        $s1 = "AspireLogger -" wide
        $s2 = "Application: @" wide
        $s3 = "encryptedUsername" wide
        $s4 = "encryptedPassword" wide
        $s5 = "Fetch users fron logins" wide
        $s6 = "URI=file:" wide
        $s7 = "signons.sqlite" wide
        $s8 = "logins.json" wide
    condition:
        (uint16(0) == 0x5a4d and 6 of ($s*)) or (7 of ($s*))
}

rule MALWARE_Win_S05Kitty {
    meta:
        author = "ditekSHen"
        description = "Sector05 Kitty RAT payload"
    strings:
        $s1 = "Execute Comand" ascii
        $s2 = "InjectExplorer" ascii
        $s3 = "targetProcess = %s" fullword ascii
        $s4 = "Process attach (%s)" fullword ascii
        $s5 = "process name: %s" fullword ascii
        $s6 = "cmd /c %s >%s" fullword ascii
        $s7 = "CmdDown: %s, failed" fullword ascii
        $s8 = "http://%s%s/%s" fullword ascii
        $s9 = "tmp.LOG" fullword ascii
        $x1 = "zerodll.dll" fullword ascii
        $x2 = "OneDll.dll" fullword ascii
        $x3 = "kkd.bat" fullword ascii
        $x4 = "%s\\regsvr32.exe /s \"%s\"" fullword ascii
        $x5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\fontchk.jse" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (8 of ($s*) or all of ($x*))
}

rule MALWARE_Win_FakeWMI {
    meta:
        author = "ditekSHen"
        description = "FakeWMI payload"
        clamav_sig = "MALWARE.Win.Trojan.Fakewmi"
    strings:
        $s1 = "-BEGIN RSA PUBLIC KEY-" ascii
        $s2 = ".exe|" ascii
        $s3 = "cmd /c wmic " ascii
        $s4 = "cmd /c sc " ascii
        $s5 = "schtasks" ascii
        $s6 = "taskkill" ascii
        $s7 = "findstr" ascii
        $s8 = "netsh interface" ascii
        $s9 = "CreateService" ascii
    condition:
       uint16(0) == 0x5a4d and (all of ($s*) and #s2 > 10)
}

rule MALWARE_Win_Baldr {
    meta:
        author = "ditekSHen"
        description = "Baldr payload"
        clamav_sig = "MALWARE.Win.Trojan.Baldr"
    strings:
        $x1 = "BALDR VERSION : {0}" fullword wide
        $x2 = "Baldr" fullword ascii wide
        $x3 = "{0}\\{1:n}.exe" fullword wide
        $x4 = ".doc;.docx;.log;.txt;" fullword wide
        $s1 = "<GetMAC>b__" ascii
        $s2 = "<ExtractPrivateKey3>b__" ascii
        $s3 = "UploadData" fullword ascii
        $s6 = "get_NetworkInterfaceType" fullword ascii
        $s5 = "get_Passwordcheck" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and all of ($x*)) or (2 of ($x*) and 4 of ($s*))
}

rule MALWARE_Win_Megumin {
    meta:
        author = "ditekSHen"
        description = "Megumin payload"
        clamav_sig = "MALWARE.Win.Trojan.Megumin"
    strings:
        $s1 = "loadpe|" fullword ascii
        $s2 = "Megumin/2.0" fullword ascii
        $s3 = "/c start /I \"\" \"" fullword ascii
        $s4 = "jsbypass|" fullword ascii

        $cnc1 = "Mozilla/5.0 (Windows NT 6.1) Megumin/2.0" fullword ascii
        $cnc2 = "/cdn-cgi/l/chk_jschl?s=" fullword ascii
        $cnc3 = "/newclip?hwid=" fullword ascii
        $cnc4 = "/isClipper" fullword ascii
        $cnc5 = "/task?hwid=" fullword ascii
        $cnc6 = "/completed?hwid=" fullword ascii
        $cnc7 = "/gate?hwid=" fullword ascii
        $cnc8 = "/addbot?hwid=" fullword ascii

        $pdb = "\\MeguminV2\\Release\\MeguminV2.pdb" ascii
    condition:
        (uint16(0) == 0x5a4d and (all of ($s*) or 5 of ($cnc*) or $pdb)) or 11 of them
}

rule MALWARE_Win_Rietspoof {
    meta:
        author = "ditekSHen"
        description = "Rietspoof payload"
        clamav_sig = "MALWARE.Win.Trojan.Rietspoof"
    strings:
        $c1 = "%s%s%s USER: user" fullword ascii
        $c2 = "cmd /c %s" fullword ascii
        $c3 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(" ascii
        $c4 = "WScript.Quit" fullword ascii
        $c5 = "CPU: %s(%d)" fullword ascii
        $c6 = "RAM: %lld Mb" fullword ascii
        $c7 = "data.dat" fullword ascii
        $c8 = "%s%s%s USER:" ascii

        $v1_1 = ".vbs" ascii
        $v1_2 = "HELLO" ascii
        $v1_3 = "Wscript.Sleep" ascii
        $v1_4 = "User-agent:Mozilla/5.0 (Windows; U;" ascii

        $v2_1 = "Xjoepxt!" ascii
        $v2_2 = "Content-MD5:%s" fullword ascii
        $v2_3 = "M9h5an8f8zTjnyTwQVh6hYBdYsMqHiAz" fullword ascii
        $v2_4 = "GET /%s?%s HTTP/1.1" fullword ascii
        $v2_5 = "GET /?%s HTTP/1.1" fullword ascii

        $pdb1 = "\\techloader\\loader\\loader.odb" ascii wide
        $pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide
    condition:
        uint16(0) == 0x5a4d and (7 of ($c*) and (3 of ($v*) or 1 of ($pdb*)))
}

rule MALWARE_Win_MoDiRAT {
    meta:
        author = "ditekSHen"
        description = "MoDiRAT payload"
    strings:
        $s1 = "add_Connected" fullword ascii
        $s2 = "Statconnected" fullword ascii
        $s3 = "StartConnect" fullword ascii
        $s4 = "TelegramTitleDetect" fullword ascii
        $s5 = "StartTitleTelegram" fullword ascii
        $s6 = "Check_titles" fullword ascii
        $s7 = "\\MoDi RAT V" ascii
        $s8 = "IsBuzy" fullword ascii
        $s9 = "Recording_Time" fullword wide
    condition:
        (uint16(0) == 0x5a4d and 7 of them) or all of them
}

rule MALWARE_DOC_KoadicDOC {
    meta:
        author = "ditekSHen"
        description = "Koadic post-exploitation framework document payload"
    strings:
        $s1 = "&@cls&@set" ascii
        $s2 = /:~\d+,1%+/ ascii
        $s3 = "Header Char" fullword wide
        $s4 = "EMBED Package" ascii
        $b1 = ".bat\"%" ascii
        $b2 = ".bat');\\\"%" ascii
        $b3 = ".bat',%" ascii
    condition:
        uint16(0) == 0xcfd0 and all of ($s*) and 2 of ($b*)
}

rule MALWARE_BAT_KoadicBAT {
    meta:
        author = "ditekSHen"
        description = "Koadic post-exploitation framework BAT payload"
    strings:
        $v1_1 = "&@cls&@set" ascii
        $v2_1 = { 26 63 6c 73 0d 0a 40 25 }
        $m1 = /:~\d+,1%+/ ascii
    condition:
        uint16(0) == 0xfeff and ((1 of ($v1*) or 1 of ($v2*)) and #m1 > 100)
}

rule MALWARE_JS_KoadicJS {
    meta:
        author = "ditekSHen"
        description = "Koadic post-exploitation framework JS payload"
    strings:
        $s1 = "window.moveTo(-" ascii
        $s2 = "window.onerror = function(sMsg, sUrl, sLine) { return false; }" fullword ascii
        $s3 = "window.onfocus = function() { window.blur(); }" fullword ascii
        $s4 = "window.resizeTo(" ascii
        $s5 = "window.blur();" fullword ascii
        $hf1 = "<hta:application caption=\"no\" windowState=\"minimize\" showInTaskBar=\"no\"" fullword ascii
        $hf2 = "<hta:application caption=\"no\" showInTaskBar=\"no\" windowState=\"minimize\" navigable=\"no\" scroll=\"no\""
        $ht1 = "<hta:application" ascii
        $ht2 = "caption=\"no\"" ascii
        $ht3 = "showInTaskBar=\"no\"" ascii
        $ht4 = "windowState=\"minimize\"" ascii 
        $ht5 = "navigable=\"no\"" ascii
        $ht6 = "scroll=\"no\"" ascii
    condition:
        all of ($s*) and (1 of ($hf*) or all of ($ht*))
}

rule MALWARE_Win_NETEAGLE {
    meta:
        author = "ditekSHen"
        description = "NETEAGLE backdoor payload"
    strings:
        $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
        $s2 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
        $s3 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
        $s4 = "/index.htm" fullword ascii
        $s5 = "Help_ME" fullword ascii
        $s6 = "GOTO ERROR" ascii
        $s7 = "127.0.0.1" fullword ascii
        $s8 = /pic\d\.bmp/ ascii wide
    condition:
        uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_WIN_BACKSPACE {
    meta:
        author = "ditekSHen"
        description = "BACKSPACE backdoor payload"
    strings:
        $s1 = "Software\\Microsoft\\PnpSetup" ascii wide
        $s2 = "Mutex_lnkword_little" ascii wide
        $s3 = "(Prxy%c-%s:%u)" fullword ascii
        $s4 = "(Prxy-No)" fullword ascii
        $s5 = "/index.htm" fullword ascii
        $s6 = "CONNECT %s:%d" ascii
        $s7 = "\\$NtRecDoc$" fullword ascii
        $s8 = "qazWSX123$%^" ascii
        $s9 = "Software\\Microsoft\\Core" ascii wide
        $s10 = "Mutex_lnkch" ascii wide
        $s11 = "Event__lnkch__" ascii wide
        $s12 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" fullword ascii
        $s13 = "User-Agent: Mozilla/5.00 (compatible; MSIE 6.0; Win32)" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_RHttpCtrl {
    meta:
        author = "ditekSHen"
        description = "RHttpCtrl backdoor payload"
    strings:
        $s1 = "%d_%04d%02d%02d%02d%02d%02d." ascii
        $s2 = "ver=%s&id=%06d&type=" ascii
        $s3 = "ver=%d&id=%s&random=%d&" ascii
        $s4 = "id=%d&output=%s" ascii
        $s5 = "Error:WinHttpCrackUrl failed!/n" ascii
        $s6 = "Error:SendRequest failed!/n" ascii
        $s7 = ".exe a %s %s" ascii
        $s8 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" fullword wide
        $pdb = "\\WorkSources\\RHttpCtrl\\Server\\Release\\svchost.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or ($pdb and 2 of ($s*)))
}

rule MALWARE_Win_PillowMint {
    meta:
        author = "ditekSHen"
        description = "PillowMint POS payload"
    strings:
        $s1 = "system32\\sysvols\\" ascii nocase
        $s2 = "Sysnative\\sysvols\\" ascii nocase
        $s3 = "critical.log" fullword ascii
        $s4 = "log.log" fullword ascii
        $s5 = "commands.txt" fullword ascii
        $s6 = "_EV0LuTi0N_" ascii
        $s7 = /(file|reg)\scmd:/ fullword ascii
        $s8 = "dumper_nologs_" ascii
        $s9 = "ReflectiveLoader" ascii
    condition:
       uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_BlackshadesRAT {
    meta:
        author = "ditekSHen"
        description = "BlackshadesRAT / Cambot POS payload"
        snort_sid = "920208-920210"
    strings:
        $s1 = "bhookpl.dll" fullword wide
        $s2 = "drvloadn.dll" fullword wide
        $s3 = "drvloadx.dll" fullword wide
        $s4 = "SPY_NET_RATMUTEX" fullword wide
        $s5 = "\\dump.txt" fullword wide
        $s6 = "AUTHLOADERDEFAULT" fullword wide
        $pdb = "*\\AC:\\Users\\Admin\\Desktop_old\\Blackshades project\\bs_bot\\bots\\bot\\bs_bot.vbp" fullword wide
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or ($pdb and 2 of ($s*)))
}

rule MALWARE_Win_GoldenSpy {
    meta:
        author = "SpiderLabs Trustwave"
        description = "GoldenSpy dropper payload"
        reference = "https://trustwave.azureedge.net/media/16908/the-golden-tax-department-and-emergence-of-goldenspy-malware.pdf"
    strings:
        $reg = "Software\\IDG\\DA" nocase wide ascii // registry entry
        $str1 = "requestStr" nocase wide ascii // POST request the machine details with this parameter
        $str2 = "nb_app_log_mutex" nocase wide ascii // Mutex 
        $str3 = { 510F4345[0-10]50518D8DCCFE[0-20]837D1C[0-20]8D45[0-15]0F4345[0-20]505157 } // Data collection and passed to requestStr in POST
    condition:
        (uint16(0) == 0x5A4D) and $reg and 2 of ($str*)
}

rule MALWARE_Win_Plurox {
    meta:
      author = "ditekSHen"
      description = "Plurox backdoor payload"
    strings:
      $s1 = "autorun.c" fullword ascii
      $s2 = "launcher.c" fullword ascii
      $s3 = "loader.c" fullword ascii
      $s4 = "stealth.c" fullword ascii
      $s5 = "RunFromMemory" fullword ascii
   condition:
      uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Avalon {
    meta:
      author = "ditekSHen"
      description = "Avalon infostealer payload"
    strings:
      $s1 = "Parsecards" fullword ascii
      $s2 = "Please_Gofuckyouself" fullword ascii
      $s3 = "GetDomainDetect" fullword ascii
      $s4 = "GetTotalCommander" fullword ascii
      $s5 = "KnownFolder" fullword ascii
      $s6 = "set_hidden" fullword ascii
      $s7 = "set_system" fullword ascii

      $l1 = "\\DomainDetect.txt" wide
      $l2 = "\\Grabber_Log.txt" wide
      $l3 = "\\Programs.txt" wide
      $l4 = "\\Passwords_Edge.txt" wide
      $l5 = "\\KL.txt" wide

      $w1 = "dont touch" fullword wide
      $w2 = "Grabber" fullword wide
      $w3 = "Keylogger" fullword wide
      $w4 = "password-check" fullword wide
      $w5 = "H4sIAAAAAAAEA" wide

      $p1 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
      $p2 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
   condition:
      uint16(0) == 0x5a4d and 8 of them 
}

rule MALWARE_Linux_Kinsing {
    meta:
      author = "ditekSHen"
      description = "Kinsing RAT payload"
    strings:
      $s1 = "backconnect" ascii
      $s2 = "connectForSocks" ascii
      $s3 = "downloadAndExecute" ascii
      $s4 = "download_and_exec" ascii
      $s5 = "masscan" ascii
      $s6 = "UpdateCommand:" ascii
      $s7 = "exec_out" ascii
      $s8 = "doTask with type %s" ascii
   condition:
      uint16(0) == 0x457f and 6 of them
}

rule MALWARE_Win_Avaddon {
    meta:
      author = "ditekSHen"
      description = "Avaddon ransomware payload"
    strings:
      $s1 = "\\IMAGEM~1.%d\\VISUA~1\\BIN\\%s.exe" ascii
      $s2 = "\\IMAGEM~1.%.2d-\\VISUA~1\\BIN\\%s.exe" ascii
      $s3 = "\\IMAGEM~1.%d-Q\\VISUA~1\\BIN\\%s.exe" ascii
      $s4 = "\\IMAGEM~1.%d\\%s.exe" ascii
      $s5 = "EW6]>mFXDS?YBi?W5] CY 4Z8Y BY7Y BZ8Z CY7Y AY8Z CZ8Y!Y:Z" ascii
      $s6 = "FY  AY 'Z      ;W      @Y  @Y 'Z    Y  @Y (Z" ascii
      $s7 = "\"rcid\":\"" fullword ascii
      $s8 = "\"ip\":\"" fullword ascii wide
      $s9 = ".?AUANEventIsGetExternalIP@@" fullword ascii
      $s10 = ".?AUANEventGetCpuMax@@" fullword ascii
   condition:
      uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_ProLock {
    meta:
      author = "ditekSHen"
      description = "ProLock ransomware payload"
      clamav_sig = "MALWARE.Win.Ransomware.ProLock"
    strings:
      $s1 = ".flat" fullword ascii
      $s2 = ".data" fullword ascii
      $s3 = ".api" fullword ascii
      $s4 = "RtlZeroMemory" fullword ascii
      $s5 = "LoadLibraryA" fullword ascii
      $s6 = "Sleep" fullword ascii
      $s7 = "lstrcatA" fullword ascii
      $s8 = { 55 89 E5 8B 45 08 EB 00 89 45 EC 8D 15 4F 10 40 00 8D 05 08 10 40 00 83 E8 08 29 C2 8B 45 EC 01 C2 31 }
   condition:
      uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_PurpleWave {
     meta:
      author = "ditekSHen"
      description = "PurpleWave infostealer payload"
    strings:
      $s1 = "/loader/" fullword ascii
      $s2 = "\\load_" fullword wide
      $s3 = "boundaryaswell" fullword ascii
      $s4 = "[passwords]" ascii
      $s5 = "[is_encrypted]" ascii
      $s6 = "[cookies]" ascii
      $s7 = ".?AVMozillaBrowser@@" fullword ascii
      $s8 = ".?AVChromeBrowser@@" fullword ascii
      $s9 = ".?AV?$money" ascii
      $s10 = "at t.me/LuckyStoreSupport" ascii
   condition:
      uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_Java_Pyrogenic {
    meta:
      author = "ditekSHen"
      description = "Pyrogenic/Qealler infostealer payload"
    strings:
      $s1 = "bbb6fec5ebef0d93" ascii wide
      $s2 = "2a898bc98aaf6c96f2054bb1eadc9848eb77633039e9e9ffd833184ce553fe9b" ascii wide
      $s3 = "addShutdownHook" ascii wide
      $s4 = "obfuscated/META-INF/QeallerV" ascii wide
      $s5 = "globalIpAddress" ascii wide
    condition:
      all of them
}

rule MALWARE_Win_AgentTeslaV3 {
    meta:
      author = "ditekSHen"
      description = "AgentTeslaV3 infostealer payload"
    strings:
      $s1 = "get_kbok" fullword ascii
      $s2 = "get_CHoo" fullword ascii
      $s3 = "set_passwordIsSet" fullword ascii
      $s4 = "get_enableLog" fullword ascii
      $s5 = "bot%telegramapi%" wide
      $s6 = "KillTorProcess" fullword ascii 
      $s7 = "GetMozilla" ascii
      $s8 = "torbrowser" wide
      $s9 = "%chatid%" wide
      $s10 = "logins" fullword wide
      $s11 = "credential" fullword wide
      $s12 = "AccountConfiguration+" wide
      $s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide

      $g1 = "get_Clipboard" fullword ascii
      $g2 = "get_Keyboard" fullword ascii
      $g3 = "get_Password" fullword ascii
      $g4 = "get_CtrlKeyDown" fullword ascii
      $g5 = "get_ShiftKeyDown" fullword ascii
      $g6 = "get_AltKeyDown" fullword ascii

      $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
      $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
      $m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
      $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
      $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
    condition:
      (uint16(0) == 0x5a4d and (8 of ($s*) or (6 of ($*) and all of ($g*)))) or (2 of ($m*))
}

rule MALWARE_Win_Taurus {
    meta:
      author = "ditekSHen"
      description = "Taurus infostealer payload"
    strings:
      $s1 = "t.me/taurus_se" ascii
      $s2 = "rus_seller@explo" ascii
      $s3 = "/c timeout /t 3  & del /f /q" ascii
      $s4 = "MyAwesomePrefix" ascii
      $txt1 = "LogInfo.txt" fullword ascii
      $txt2 = "Information.txt" fullword ascii
      $txt3 = "General\\passwords.txt" fullword ascii
      $txt4 = "General\\forms.txt" fullword ascii
      $txt5 = "General\\cards.txt" fullword ascii
      $txt6 = "Installed Software.txt" fullword ascii
      $txt7 = "Crypto Wallets\\WalletInfo.txt" fullword ascii
      $txt8 = "cookies.txt" fullword ascii
      $url1 = "/cfg/" wide
      $url2 = "/loader/complete/" wide
      $url3 = "/log/" wide
      $url4 = "/dlls/" wide
      $upat = /\.exe;;;\d;\d;\d\]\|\[http/
      
      $x1 = "Vaultcli.dll" fullword ascii
      $x2 = "Bcrypt.dll" fullword ascii
      $x3 = "*.localstor" ascii
      $x4 = "operator<=>" fullword ascii
      $x5 = ".data$rs" fullword ascii
      $x6 = "https_discordap" ascii
      $o1 = { 53 56 8b 75 08 8d 85 64 ff ff ff 57 6a ff 6a 01 }
      $o2 = { 6a 00 68 00 04 00 00 ff b5 a8 fe ff ff ff b5 ac }
      $o3 = { ff 75 0c 8d 85 44 ff ff ff 50 e8 aa f7 ff ff 8b }
      $o4 = { 8b 47 04 c6 40 19 01 8d 85 6c ff ff ff 8b 0f 50 }
      $o5 = { 8d 8d ?? ff ff ff e8 5b }
    condition:
      ((3 of ($s*) or (6 of ($txt*) and 2 of ($s*)) or ($upat and 1 of ($s*) and 2 of ($txt*)) or (all of ($url*) and (2 of ($txt*) or 1 of ($s*)))) or (uint16(0) == 0x5a4d and all of ($x*) or (all of ($o*) and 3 of ($x*))))
}

rule MALWARE_Win_RemoteUtilitiesRAT {
    meta:
      author = "ditekSHen"
      description = "RemoteUtilitiesRAT RAT payload"
      clamav_sig = "MALWARE.Win.Trojan.RemoteUtilitiesRAT"
    strings:
      $s1 = "rman_message" wide
      $s2 = "rms_invitation" wide
      $s3 = "rms_host_" wide
      $s4 = "rman_av_capture_settings" wide
      $s5 = "rman_registry_key" wide
      $s6 = "rms_system_information" wide
      $s7 = "_rms_log.txt" wide
      $s8 = "rms_internet_id_settings" wide
    condition:
      uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_SlothfulMedia {
     meta:
      author = "ditekSHen"
      description = "SlothfulMedia backdoor payload"
    strings:
      $x1 = /ExtKeylogger(Start|Stop)/ fullword ascii
      $x2 = /ExtService(Add|Delete|Start|Stop)/ fullword ascii
      $x3 = /ExtRegKey(Add|Del)/ fullword ascii
      $x4 = /ExtRegItem(Add|Del)/ fullword ascii
      $x5 = "ExtUnload" fullword ascii

      $s1 = "Local Security Process" fullword wide
      $s2 = "Global%s%d" fullword wide
      $s3 = "%s%s_%d.dat" fullword wide
      $s4 = "\\AppIni" fullword wide
      $s5 = "%s.tmp" fullword wide
      $s6  = "\\SetupUi" fullword wide
      $s7 = "%s|%s|%s|%s" fullword wide
      $s8 = "\\ExtInfo" fullword wide

      $cnc1 = "/v?m=" fullword ascii
      $cnc2 = "%s&i=%d" fullword ascii
      $cnc3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" fullword ascii
      $cnc4 = "Content-Length: %d" fullword ascii
    condition:
      uint16(0) == 0x5a4d and (3 of ($x*) or 7 of ($s*) or all of ($cnc*) or (1 of ($x*) and 4 of ($s*)))
}

rule MALWARE_Win_IRCBot {
    meta:
      author = "ditekSHen"
      description = "IRCBot payload"
    strings:
        $s1 = ".okuninstall" fullword wide
        $s2 = ".oksnapshot" fullword wide
        $s3 = "\\uspread.vbs" fullword wide
        $s4 = "KEYLogger" ascii nocase
        $s5 = "GetKeyLogs" fullword ascii
        $s6 = "GetLoocationInfo" fullword ascii
        $s7 = "CaputerScreenshot" fullword ascii
        $s8 = "get_SCRIPT_DATA" fullword ascii
        $s9 = /irc_(server|nickname|password|channle)/ fullword ascii
        $s10 = "machine_screenshot" fullword ascii
        $s11 = "CollectPassword" fullword ascii
        $s12 = "USBInfection" fullword ascii nocase

        $cnc1 = "&command=UpdateAndGetTasks&machine_id=" wide
        $cnc2 = "&machine_os=1&privateip=" wide
        $cnc3 = "&command=InsertTaskExecution&excuter_id=" wide
        $cnc4 = "&command=RegisterNewMachine" wide
        $cnc5 = "&command=UpdateNewMachine" wide
        $cnc6 = "&command=GetPayloads&keys=" wide
        $cnc7 = "&command=SaveSnapshot" wide

        $pdb = "\\Projects\\USBStarter\\USBStarter\\obj\\Release\\USBStarter.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or 3 of ($cnc*) or ($pdb and 2 of them))
}

rule MALWARE_Win_Apocalypse {
    meta:
      author = "ditekSHen"
      description = "Apocalypse infostealer payload"
    strings:
        $s1 = "OpenClipboard" fullword ascii
        $s2 = "SendARP" fullword ascii
        $s3 = "GetWebRequest" fullword ascii
        $s4 = "DotNetGuard" fullword ascii
        $s5 = "set_CreateNoWindow" fullword ascii
        $s6 = "UploadFile" fullword ascii
        $s7 = "GetHINSTANCE" fullword ascii
        $s8 = "Kill" fullword ascii
        $s9 = "GetProcesses" fullword ascii
        $s10 = "get_PrimaryScreen" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Osno {
    meta:
      author = "ditekSHen"
      description = "Osno ransomware and infostealer payload"
    strings:
        $s1 = ".HolyGate+<>c+<<FinalBoss>" ascii
        $s2 = /Osno(Keylogger|Stealer|Ransom)/ wide
        $s3 = "password,executeWebhook('Account credentials" wide
        $s4 = "-Name Osno -PropertyType" wide
        $s5 = "process.env.hook" ascii
        $s6 = "Stealer.JSON.JsonValue" ascii
        $s7 = "<DetectBrowserss>b_" ascii
        $s8 = "<TryGetDiscordPath>b_" ascii
        $s9 = "antiVM" fullword ascii
        $s10 = "downloadurl" fullword ascii
        $s11 = "set_sPassword" fullword ascii
        
        $txt0 = "{0} {1} .txt" fullword wide
        $txt1 = "\\ScanningNetworks.txt" fullword wide
        $txt2 = "\\SteamApps.txt" fullword wide
        $txt3 = "-ErrorsLogs.txt" fullword wide
        $txt4 = "-keylogs.txt" fullword wide
        $txt5 = "Hardware & Soft.txt" fullword wide

        $cnc0 = "/csharp/" ascii wide
        $cnc1 = "token=" ascii wide
        $cnc2 = "&timestamp=" ascii wide
        $cnc3 = "&session_id=" ascii wide
        $cnc4 = "&aid=" ascii wide
        $cnc5 = "&secret=" ascii wide
        $cnc6 = "&api_key" ascii wide
        $cnc7 = "&session_key=" ascii wide
        $cnc8 = "&type=" ascii wide
    condition:
        (uint16(0) == 0x5a4d and (6 of ($s*) or 4 of ($txt*) or (4 of ($s*) and 2 of ($txt*)))) or (7 of ($cnc*))
}

rule MALWARE_Win_BetaBot {
    meta:
        author = "ditekSHen"
        description = "BetaBot payload"
    strings:
        $s1 = "__restart" fullword ascii
        $s2 = "%SystemRoot%\\SysWOW64\\tapi3.dll" fullword wide
        $s3 = "%SystemRoot%\\system32\\tapi3.dll" fullword wide
        $s4 = "publicKeyToken=\"6595b64144ccf1df\"" ascii
        $s5 = "VirtualProtectEx" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 600KB and  all of them
}

rule MALWARE_Win_WSHRATPlugin {
    meta:
        author = "ditekSHen"
        description = "WSHRAT keylogger plugin payload"
        snort_sid = "920010-920012"
        clamav_sig = "MALWARE.Win.Trojan.WSHRAT-KLG"
    strings:
        $s1 = "GET /open-keylogger HTTP/1.1" fullword wide
        $s2 = "KeyboardChange: nCode={0}, wParam={1}, vkCode={2}, scanCode={3}, flags={4}, dwExtraInfo={6}" wide
        $s3 = "MouseChange: nCode={0}, wParam={1}, x={2}, y={3}, mouseData={4}, flags={5}, dwExtraInfo={7}" wide
        $s4 = "sendKeyLog" fullword ascii
        $s5 = "saveKeyLog" fullword ascii
        $s6 = "get_TotalKeyboardClick" fullword ascii
        $s7 = "get_SessionMouseClick" fullword ascii
        $pdb = "\\Android\\documents\\visual studio 2010\\Projects\\Keylogger\\Keylogger\\obj\\x86\\Debug\\Keylogger.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
}

rule MALWARE_Win_RevengeRAT {
    meta:
        author = "ditekSHen"
        description = "RevengeRAT and variants payload"
        snort_sid = "920000-920002"
    strings:
        $l1 = "Lime.Connection" fullword ascii
        $l2 = "Lime.Packets" fullword ascii
        $l3 = "Lime.Settings" fullword ascii
        $l4 = "Lime.NativeMethods" fullword ascii

        $s1 = "GetAV" fullword ascii
        $s2 = "keepAlivePing!" fullword ascii wide
        $s3 = "Revenge-RAT" fullword ascii wide
        $s4 = "*-]NK[-*" fullword ascii wide
        $s5 = "RV_MUTEX" fullword ascii wide
        $s6 = "set_SendBufferSize" fullword ascii
        $s7 = "03C7F4E8FB359AEC0EEF0814B66A704FC43FB3A8" fullword ascii
        $s8 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
        $s9 = "\\RevengeRAT\\" ascii

        $q1 = "Select * from AntiVirusProduct" fullword ascii wide
        $q2 = "SELECT * FROM FirewallProduct" fullword ascii wide
        $q3 = "select * from Win32_Processor" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($l*) and 3 of ($s*)) or (all of ($q*) and 3 of ($s*)) or 3 of ($s*))
}

rule MALWARE_Win_TRAT {
    meta:
        author = "ditekSHen"
        description = "TRAT payload"
        clamav_sig = "MALWARE.Win.Trojan.TRAT"
    strings:
        $s1 = "^STEAM_0:[0-1]:([0-9]{1,10})$" fullword wide
        $s2 = "^7656119([0-9]{10})$" fullword wide
        $s3 = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)" ascii
        $s4 = "\"schtasks\", \"/delete /tn UpdateWindows /f\");" ascii
        $s5 = "ProcessWindowStyle.Hidden" ascii
        $s6 = "+<>c+<<ListCommands>" ascii
        $s7 = "//B //Nologo *Y" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_CryptBot {
    meta:
        author = "ditekSHen"
        description = "CryptBot/Fugrafa stealer payload"
        snort2_sid = "920110"
        snort3_sid = "920108"
        clamav_sig = "MALWARE.Win.Trojan.CryptBot"
    strings:
        $s1 = "Username: %wS" fullword wide
        $s2 = "Computername: %wS" fullword wide
        $s3 = "/c rd /s /q %" wide
        $s4 = "IP: N0t_IP" fullword wide
        $s5 = "Country: N0t_Country" fullword wide
        $s6 = "password-check" fullword ascii
        $s7 = "Content-Disposition: form-data; name=\"file\"; filename=\"" ascii wide
        $s8 = "[ %wS ]" wide
        $s9 = "EXE_PATH:" wide
        $s10 = "Username (Computername):" wide
        $s11 = "Operating system language:" wide
        $s12 = "/index.php" wide
        $f1 = "*ledger*.txt" fullword wide
        $f2 = "*crypto*.xlsx" fullword wide
        $f3 = "*private*.txt" fullword wide
        $f4 = "*wallet*.dat" fullword wide
        $f5 = "*pass*.txt" fullword wide
        $f6 = "*bitcoin*.txt" fullword wide
        $p1 = "%USERPROFILE%\\Desktop\\*.txt" fullword wide
        $p2 = "%USERPROFILE%\\Desktop\\secret.txt" fullword wide 
        $p3 = "%USERPROFILE%\\Desktop\\report.doc" fullword wide
        $pattern1 = /(files_|_Files)\\(_?)(cookies|cryptocurrency|forms|passwords|system_info|screenshot|screen_desktop|information|files|wallet|cc|Coinomi)\\?(\.txt|\.jpg|\.jpeg)?/ ascii wide nocase
        $pattern2 = /%(s|ws)\\%(s|ws)\\(Login Data|Cookies|Web Data)/ fullword wide
        $pattern3 = /(_AllPasswords_list.txt|_AllForms_list.txt|_AllCookies_list.txt|_All_CC_list.txt|_Information.txt|_Info.txt|_Screen_Desktop.jpeg)/ fullword wide
    condition:
        uint16(0) == 0x5a4d and ((5 of ($s*) and 1 of ($p*)) or (4 of ($s*) and 1 of ($f*) and 1 of ($p*)) or (2 of ($pattern*) and 3 of ($s*)) or (#pattern1 > 6 and (2 of ($s*) or 1 of ($p*))))
}

rule MALWARE_Win_Matiex {
    meta:
        author = "ditekSHen"
        description = "Matiex/XetimaLogger keylogger payload"
        clamav_sig = "MALWARE.Win.Trojan.MatiexKeylogger"
    strings:
      $id = "--M-A-T-I-E-X--K-E-Y-L-O-G-E-R--" ascii wide

      $s1 = "StartKeylogger" fullword ascii
      $s2 = "_KeyboardLoggerTimer" ascii
      $s3 = "_ScreenshotLoggerTimer" ascii
      $s4 = "_VoiceRecordLogger" ascii
      $s5 = "_ClipboardLoggerTimer" ascii
      $s6 = "get_logins" fullword ascii
      $s7 = "get_processhackerFucked" fullword ascii
      $s8 = "_ThePSWDSenders" fullword ascii

      $pdb = "\\Before FprmT\\Document VB project\\FireFox Stub\\FireFox Stub\\obj\\Debug\\VNXT.pdb" ascii
    condition:
      uint16(0) == 0x5a4d and ($id or 4 of ($s*) or ($pdb and 2 of them))
}

rule MALWARE_Win_IAmTheKingKeylogger {
    meta:
        author = "ditekSHen"
        description = "IAmTheKing Keylogger payload"
        clamav_sig = "MALWARE.Win.Trojan.IAmTheKingKeylogger"
    strings:
        $s1 = "[TIME:]%d/%d/%d %02d:%02d:%02d" fullword ascii
        $s2 = "[TITLE:]" fullword ascii
        $s3 = "%s-%02d-%02d-%02d-%02d" fullword ascii
        $s4 = "[DATA]:" fullword ascii
        $s5 = "[BK]" fullword ascii
        $s6 = "Log.txt" fullword ascii
        $s7 = "sonme hting is wrong x" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_IAmTheKingScrCap {
    meta:
        author = "ditekSHen"
        description = "IAmTheKing screen capture payload"
    strings:
        $s1 = "@MyScreen.jpg" fullword wide
        $s2 = "DISPLAY" fullword wide
        $s3 = ".?AVCImage@ATL@@" fullword ascii
        $s4 = ".?AVGdiplusBase@Gdiplus@@" fullword ascii
        $s5 = ".?AVImage@Gdiplus@@" fullword ascii
        $s6 = ".?AVBitmap@Gdiplus@@" fullword ascii
        $s7 = ".?AVCAtlException@ATL@@" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_IAmTheKingKingOfHearts {
    meta:
        author = "ditekSHen"
        description = "IAmTheKing King Of Hearts payload"
    strings:
        $s1 = "write info fail!!! GetLastError-->%u" fullword ascii
        $s2 = "LookupAccountSid Error %u" fullword ascii
        $s3 = "CreateServiceErrorID:%d" fullword ascii
        $s4 = "In ControlServiceErrorID:%d" fullword ascii
        $s5 = "In QueryServiceStatus ErrorID:%d" fullword ascii
        $s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
        $s7 = "hello%s" fullword ascii
        $s8 = "additional header failed..." fullword ascii
        $s9 = "Set Option failed errcode: %ld" fullword ascii
        $s10 = "add cookie failed..." fullword ascii

        $u1 = "Mozilla/4.0 (compatible; )" fullword ascii
        $u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($u*) and 4 of ($s*)) or (all of ($u*) and 3 of ($s*)) or (5 of them))
}

rule MALWARE_Win_CobaltStrike {
    meta:
        author = "ditekSHen"
        description = "CobaltStrike payload"
    strings:
        $s1 = "%%IMPORT%%" fullword ascii
        $s2 = "www6.%x%x.%s" fullword ascii
        $s3 = "cdn.%x%x.%s" fullword ascii
        $s4 = "api.%x%x.%s" fullword ascii
        $s5 = "%s (admin)" fullword ascii
        $s6 = "could not spawn %s: %d" fullword ascii
        $s7 = "Could not kill %d: %d" fullword ascii
        $s8 = "Could not connect to pipe (%s): %d" fullword ascii
        $s9 = /%s\.\d[(%08x).]+\.%x%x\.%s/ ascii

        $pwsh1 = "IEX (New-Object Net.Webclient).DownloadString('http" ascii
        $pwsh2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or (all of ($pwsh*) and 2 of ($s*)) or (#s9 > 6 and 4 of them)) 
}

rule MALWARE_Win_RedLineDropperAHK {
    meta:
        author = "ditekSHen"
        description = "Detects AutoIt/AutoHotKey executables dropping RedLine infostealer"
        clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-AHK"
    strings:
        $s1 = ".SetRequestHeader(\"User-Agent\",\" ( \" OSName \" | \" bit \" | \" CPUNAme \"\"" ascii
        $s2 = ":= \" | Windows Defender\"" ascii
        $s3 = "WindowSpy.ahk" wide
        $s4 = ">AUTOHOTKEY SCRIPT<" fullword wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_DLAgent01 {
    meta:
      author = "ditekSHen"
      description = "Detects known downloader agent"
      snort_sid = "920007"
      clamav_sig = "MALWARE.Win.Trojan.DLAgent01"
    strings:
        $s1 = "Mozilla/5.0 Gecko/41.0 Firefox/41.0" fullword wide
        $s2 = "/Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List" fullword wide
        $s3 = "GUID.log" fullword wide
        $s4 = "NO AV" fullword wide
        $s5 = "%d:%I64d:%I64d:%I64d" fullword wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Linux_PLEAD {
    meta:
        author = "ditekSHen"
        description = "PLEAD Linux payload"
        clamav_sig = "MALWARE.Linux.Trojan.PLEAD"
    strings:
        $x1 = "CFileTransfer" ascii
        $x2 = "CFileManager" ascii
        $x3 = "CPortForward" ascii
        $x4 = "CPortForwardManager" ascii
        $x5 = "CRemoteShell" ascii
        $x6 = "CSockClient" ascii

        $s1 = "/proc/self/exe" fullword ascii
        $s2 = "/bin/sh" fullword ascii
        $s3 = "echo -e '" ascii
        $s4 = "%s    <DIR>    %s" ascii
        $s5 = "%s    %lld    %s" ascii
        $s6 = "Files: %d        Size: %lld" ascii
        $s7 = "Dirs: %d" ascii
        $s8 = "%s(%s)/" ascii
        $s9 = "%s %s %s %s" ascii
    condition:
    uint16(0) == 0x457f and (all of ($x*) or all of ($s*) or 12 of them)
}

rule MALWARE_Win_CRAT {
    meta:
        author = "ditekSHen"
        description = "Detects CRAT main DLL"
    strings:
        $s1 = "cmd /c \"dir %s /s >> %s\"" wide
        $s2 = "Set-Cookie:\\b*{.+?}\\n" wide
        $s3 = "Location: {[0-9]+}" wide
        $s4 = "Content-Disposition: form-data; name=\"%s\"; filename=\"" ascii
        $s6 = "%serror.log" wide
        $v2x_1 = "?timestamp=%u" wide
        $v2x_2 = "config.txt" wide
        $v2x_3 = "entdll.dll" wide
        $v2x_4 = "\\cmd.exe" wide
        $v2x_5 = "[MyDocuments]" wide
        $v2x_6 = "@SetWindowTextW FindFileExA" wide
        $v2x_7 = "Microsoft\\Windows\\WinX\\Group1\\*.exe" wide
        $v2s_1 = "Installed Anti Virus Programs" ascii
        $v2s_2 = "Running Processes" ascii
        $v2s_3 = "id=%u&content=" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 6 of ($v2x*) or all of ($v2s*) or (2 of ($v2s*) and 4 of ($v2x*)))
}

rule MALWARE_Win_CRATPluginKeylogger {
    meta:
        author = "ditekSHen"
        description = "Detects CRAT keylogger plugin DLL"
        clamav_sig = "MALWARE.Win.Trojan.CRAT"
    strings:
        $ai1 = "VM detected!" fullword wide
        $ai2 = "Sandbox detected!" fullword wide
        $ai3 = "Debug detected!" fullword wide
        $ai4 = "Analysis process detected!" fullword wide
        $s1 = "Create KeyLogMutex %s failure %d" wide
        $s2 = "Key Log Mutex already created! %s" wide
        $s3 = /KeyLogThread\s(started|finished|terminated)!/ wide
        $s4 = /KeyLog_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them)
}

rule MALWARE_Win_CRATPluginClipboardMonitor {
    meta:
        author = "ditekSHen"
        description = "Detects CRAT Clipboad Monitor plugin DLL"
    strings:
        $ai1 = "VM detected!" fullword wide
        $ai2 = "Sandbox detected!" fullword wide
        $ai3 = "Debug detected!" fullword wide
        $ai4 = "Analysis process detected!" fullword wide
        $s1 = "Clipboard Monitor Mutex [%s] already created!" wide
        $s2 = "ClipboardMonitorThread started!" fullword wide
        $s3 = /MonitorClipboardThread\s(finished|terminated)!/ wide
        $s4 = /ClipboardMonitor_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them)
}

rule MALWARE_Win_CRATPluginScreenCapture {
    meta:
        author = "ditekSHen"
        description = "Detects CRAT Screen Capture plugin DLL"
    strings:
        $ai1 = "VM detected!" fullword wide
        $ai2 = "Sandbox detected!" fullword wide
        $ai3 = "Debug detected!" fullword wide
        $ai4 = "Analysis process detected!" fullword wide
        $s1 = "User is inactive!, give up capture" wide
        $s2 = "Capturing screen..." wide
        $s3 = "%s\\P%02d%lu.tmp" fullword wide
        $s4 = "CloseHandle ScreenCaptureMutex failure! %d" fullword wide
        $s5 = "ScreenCaptureMutex already created! %s" fullword wide
        $s6 = "Create ScreenCaptureMutex %s failure %d" fullword wide
        $s7 = /ScreenCaptureThread\s(finished|terminated)!/ wide
        $s8 = /ScreenCapture_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 6 of them)
}

rule MALWARE_Win_CRATPluginRansomHansom {
    meta:
        author = "ditekSHen"
        description = "Detects CRAT Hansom Ransomware plugin DLL"
    strings:
        $cmd1 = "/f /im \"%s\"" wide
        $cmd2 = "add HKLM\\%s /v %s /t REG_DWORD /d %d /F" wide
        $cmd3 = "add HKCU\\%s /v %s /t REG_DWORD /d %d /F" wide
        $cmd4 = "\"%s\" a -y -ep -k -r -s -ibck -df -m0 -hp%s -ri1:%d \"%s\" \"%s\"" wide
        $s1 = "\\hansom.jpg" wide
        $s2 = "HansomMain" fullword ascii wide
        $s3 = "ExtractHansom" fullword ascii wide
        $s4 = "Hansom2008" fullword ascii
        $s5 = ".hansomkey" fullword wide
        $s6 = ".hansom" fullword wide
        $s7 = /Ransom_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((2 of ($cmd*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($cmd*)) or 6 of them)
}

rule MALWARE_Win_AlienCrypter {
    meta:
        author = "ditekSHen"
        description = "Detects AlienCrypter injector/downloader/obfuscator"
    strings:
        $s1 = ".AlienRunPE." ascii wide
        $s2 = "RunAsNewUser_RunDLL" fullword wide
        $s3 = { 00 50 52 4f 43 45 53 53 5f 53 55 53 50 45 4e 44 5f 52 45 53 55 4d 45 00 64 6e 6c 69 62 2e 50 45 00 }
        $s4 = { 2e 41 6c 69 65 6e 52 75 6e 50 45 00 50 52 4f 43 45 53 53 5f 54 45 52 4d 49 4e 41 54 45 00 }
        $s5 = "@@@http" wide
        $resp1 = "</p><p>@@@77,90," ascii wide
        $resp2 = "</p><p>@@@HH,JA," ascii wide
    condition:
        (uint16(0) == 0x5a4d and 3 of them) or (1 of ($resp*) and 2 of ($s*))
}

rule MALWARE_Win_Ficker {
    meta:
        author = "ditekSHen"
        description = "Detects Ficker infostealer"
        clamav_sig = "MALWARE.Win.Trojan.Ficker"
    strings:
        $s1 = "JNOde\\" ascii
        $s2 = "\"SomeNone" fullword ascii
        $s3 = "kindmessage" fullword ascii
        $s4 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writting non-UTF-8 byte sequences" ascii
        $s5 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii
        $s6 = "(os error other os erroroperation interrruptedwrite zerotimed" ascii
        $s7 = "(os error other os erroroperation interruptedwrite zerotimed" ascii
        $s8 = "nPipeAlreadyExistsWouldBlockInvalidInputInvalidDataTimedOutWriteZeroInterruptedOtherN" fullword ascii
        $s9 = "_matherr(): %s in %s(%g, %g)  (retval=%g)" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_Xorist {
     meta:
        author = "ditekSHen"
        description = "Detects Xorist ransomware"
        clamav_sig = "MALWARE.Win.Ransomware.Xorist"
    strings:
        $x1 = { 00 4d 00 41 00 47 00 45 00 0b 00 50 00 55 00 
                53 00 53 00 59 00 4c 00 49 00 43 00 4b 00 45
                00 52 00 }
        $x2 = { 30 70 33 6e 53 4f 75 72 63 33 20 58 30 72 31 35
                37 2c 20 6d 6f 74 68 65 72 66 75 63 6b 65 72 21
                00 70 75 73 73 79 6c 69 63 6b 65 72 00 2e 62 6d
                70 00 2e 00 2e 2e 00 6f 70 65 6e 00 2e 65 78 65 }
        $s1 = "\\shell\\open\\command" fullword ascii
        $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii
        $s3 = "CRYPTED!" fullword ascii
        $s4 = "Attention!" fullword ascii
        $s5 = "Password:" fullword ascii
        $s6 = { 43 6f 6d 53 70 65 63 00 2f 63 20 64 65 6c 20 22 00 22 20 3e 3e 20 4e 55 4c }
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
}

rule MALWARE_Win_PYSA {
     meta:
        author = "ditekSHen"
        description = "Detects PYSA/Mespinoza ransomware"
        clamav_sig = "MALWARE.Win.Ransomware.PYSA"
    strings:
        $s1 = "%s\\Readme.README" fullword wide
        $s2 = "Every byte on any types of your devices was encrypted" ascii
        $s3 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 74 65 78 74 00 (50|70) (59|79) (53|73) (41|61) }
        $s4 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 63 61 70 74 69 6f 6e 00 00 (50|70) (59|79) (53|73) (41|61) }
        $s5 = { 2e 62 61 74 00 00 6f 70 65 6e 00 00 00 00 53
                4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f
                66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72
                65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69
                63 69 65 73 5c 53 79 73 74 65 6d 00 00 00 }
        $f1 = ".?AVPK_EncryptorFilter@CryptoPP@@" ascii
        $f2 = ".?AV?$TF_EncryptorImpl@" ascii
        $f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii
    condition:
        uint16(0) == 0x5a4d and all of ($f*) and 3 of ($s*)
}

rule MALWARE_Win_Polar {
    meta:
        author = "ditekSHen"
        description = "Detects Polar ransomware"
        clamav_sig = "MALWARE.Win.Ransomware.Polar"
    strings:
        $s1 = "Encrypt Failed ! ErrorMessage :" wide
        $s2 = ".locked" fullword wide
        $s3 = ".cryptd" fullword wide
        $s4 = "$SysReset" fullword wide
        $s5 = "Polar.Properties.Resources" ascii wide
        $s6 = "AES_EnDecryptor.Basement" fullword ascii
        $s7 = "RunCMDCommand" fullword ascii
        $s8 = "killerps_list" fullword ascii
        $s9 = "clearlog" fullword ascii
        $s10 = "encryptFile" fullword ascii
        $s11 = "changeBackPictrue" fullword ascii
        $pdb1 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x86\\Release\\Encode.pdb" ascii
        $pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (8 of ($s*) or (1 of ($pdb*) and 2 of ($s*)))
}

rule MALWARE_Win_BitRAT {
    meta:
        author = "ditekSHen"
        description = "Detects BitRAT RAT"
        clamav_sig = "MALWARE.Win.Trojan.BitRAT"
    strings:
        $s1 = "\\plg\\" fullword ascii
        $s2 = "klgoff_del" fullword ascii
        $s3 = "files_delete" ascii
        $s4 = "files_zip_start" fullword ascii
        $s5 = "files_exec" fullword ascii
        $s6 = "drives_get" fullword ascii
        $s7 = "srv_list" fullword ascii
        $s8 = "con_list" fullword ascii
        $s9 = "ddos_stop" fullword ascii
        $s10 = "socks5_srv_start" fullword ascii
        $s11 = "/getUpdates?offset=" fullword ascii
        $s12 = "Action: /dlex" fullword ascii
        $s13 = "Action: /clsbrw" fullword ascii
        $s14 = "Action: /usb" fullword ascii
        $s15 = "/klg" fullword ascii
        $s16 = "klg|" fullword ascii
        $s17 = "Slowloris" fullword ascii
        $s18 = "Bot ID:" ascii
        $t1 = "<sz>N/A</sz>" fullword ascii
        $t2 = "<silent>N/A</silent>" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or (4 of ($s*) and 1 of ($t*)))
}

rule MALWARE_Win_Poullight {
    meta:
        author = "ditekSHen"
        description = "Detects Poullight infostealer"
        snort2_sid = "920074-920075"
        snort3_sid = "920074-920075"
        clamav_sig = "MALWARE.Win.Trojan.Poullight"
    strings:
        $s1 = "zipx" fullword wide
        $s2 = "{0}Windows Defender.exe" fullword wide
        $s3 = "pll_test" fullword wide
        $s4 = "loginusers.vdf" wide
        $s5 = "Stealer by Nixscare" wide
        $s6 = "path_lad" fullword ascii
        $s7 = "<CheckVM>" ascii
        $s8 = "Poullight.Properties" ascii
        $s9 = "</ulfile>" fullword wide
        $s10 = "{0}processlist.txt" fullword wide
        $s11 = "{0}Browsers\\Passwords.txt" fullword wide
    condition:
        uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_Win_SnakeKeylogger {
    meta:
        author = "ditekSHen"
        description = "Detects Snake Keylogger"
        clamav_sig = "MALWARE.Win.Trojan.SnakeKeylogger"
    strings:
        $id1 = "SNAKE-KEYLOGGER" fullword ascii
        $id2 = "----------------S--------N--------A--------K--------E----------------" ascii
        $s1 = "_KPPlogS" fullword ascii
        $s2 = "_Scrlogtimerrr" fullword ascii
        $s3 = "_Clpreptimerr" fullword ascii
        $s4 = "_clprEPs" fullword ascii
        $s5 = "_kLLTIm" fullword ascii
        $s6 = "_TPSSends" fullword ascii
        $s7 = "_ProHfutimer" fullword ascii
        $s8 = "GrabbedClp" fullword ascii
        $s9 = "StartKeylogger" fullword ascii
        // Snake Keylogger Stub New
        $x1 = "$%SMTPDV$" wide
        $x2 = "$#TheHashHere%&" wide
        $x3 = "%FTPDV$" wide
        $x4 = "$%TelegramDv$" wide
        $x5 = "KeyLoggerEventArgs" ascii
        $m1 = "| Snake Keylogger" ascii wide
        $m2 = /(Screenshot|Clipboard|keystroke) Logs ID/ ascii wide
        $m3 = "SnakePW" ascii wide
        $m4 = "\\SnakeKeylogger\\" ascii wide
    condition:
        (uint16(0) == 0x5a4d and (all of ($id*) or 6 of ($s*) or (1 of ($id*) and 3 of ($s*)) or 4 of ($x*))) or (2 of ($m*))
}

rule MALWARE_Linux_XORDDoS {
    meta:
        author = "ditekSHen"
        description = "Detects XORDDoS"
    strings:
        $s1 = "for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done" fullword ascii
        $s2 = "cp /lib/libudev.so /lib/libudev.so.6" fullword ascii
        $s3 = "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab" fullword ascii
        $s4 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" fullword ascii
    condition:
      uint32(0) == 0x464c457f and 3 of them
}

rule MALWARE_Win_BlackNET {
    meta:
        author = "ditekSHen"
        description = "Detects BlackNET RAT"
        snort2_sid = "920079-920082"
        snort3_sid = "920079-920082"
        clamav_sig = "MALWARE.Win.Trojan.BlackNET"
    strings:
        $s1 = "SbieCtrl" fullword wide
        $s2 = "SpyTheSpy" fullword wide
        $s3 = "\\BlackNET.dat" fullword wide
        $s4 = "StartDDOS" fullword wide
        $s5 = "UDPAttack" fullword wide
        $s6 = "ARMEAttack" fullword wide
        $s7 = "TCPAttack" fullword wide
        $s8 = "HTTPGetAttack" fullword wide
        $s9 = "RetriveLogs" fullword wide
        $s10 = "StealPassword" fullword wide
        $s11 = "/create /f /sc ONSTART /RL HIGHEST /tn \"'" fullword wide
        $b1 = "DeleteScript|BN|" fullword wide
        $b2 = "|BN|Online" fullword wide
        $b3 = "NewLog|BN|" fullword wide
        $cnc1 = "/getCommand.php?id=" fullword wide
        $cnc2 = "/upload.php?id=" fullword wide
        $cnc3 = "connection.php?data=" fullword wide
        $cnc4 = "/receive.php?command=" fullword wide
    condition:
        uint16(0) == 0x5a4d and (9 of ($s*) or all of ($cnc*) or all of ($b*) or 12 of them)
}

rule MALWARE_Win_StormKitty {
    meta:
        author = "ditekSHen"
        description = "Detects StormKitty infostealer"
        clamav_sig = "MALWARE.Win.Trojan.StormKitty"
    strings:
        $x1 = "\\ARTIKA\\Videos\\Chrome-Password-Recovery" ascii
        $x2 = "https://github.com/LimerBoy/StormKitty" fullword ascii
        $x3 = "StormKitty" fullword ascii
        $s1 = "GetBSSID" fullword ascii
        $s2 = "GetAntivirus" fullword ascii
        $s3 = "C:\\Users\\Public\\credentials.txt" fullword wide
        $s4 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" fullword wide
        $s5 = "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" fullword wide
        $s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 5 of ($s*) or (3 of ($s*) and 1 of ($x*)))
}

rule MALWARE_Win_Bulz01 {
    meta:
        author = "ditekSHen"
        description = "Detects trojan loader"
    strings:
        $s1 = "DisableTrivet.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and all of ($s*) and (
            pe.exports("Ordinal") or pe.exports("Chechako") or pe.exports("Originator") or pe.exports("Repressions")
        )
}

rule MALWARE_Win_RevCodeRAT {
    meta:
        author = "ditekSHen"
        description = "Detects RevCode/WebMonitor RAT"
        snort2_sid = "920070"
        snort3_sid = "920070"
        clamav_sig = "MALWARE.Win.Trojan.RevCodeRAT"
    strings:
        $x1 = "rev-novm.dat" fullword wide
        $x2 = "WebMonitor-" fullword wide
        $x3 = "WebMonitor Client" fullword wide
        $x4 = "Launch WebMonitor" fullword wide

        $s1 = "KEYLOG_DEL" fullword ascii
        $s2 = "KEYLOG_STREAM_START" fullword ascii
        $s3 = "send_keylog_del" fullword ascii
        $s4 = "send_keylog_stream_" ascii
        $s5 = "send_shell_exec" fullword ascii
        $s6 = "send_file_download_exec" fullword ascii
        $s7 = "send_pdg_exec" fullword ascii
        $s8 = "send_app_cmd_upd" fullword ascii
        $s9 = "send_webcamstream_start" fullword ascii
        $s10 = "send_screenstream_start" fullword ascii
        $s11 = "send_clipboard_get" fullword ascii
        $s12 = "send_pdg_rev_proxy_stop" fullword ascii
        $s13 = "send_shell_stop" fullword ascii
        $s14 = "send_wnd_cmd" fullword ascii
        $s15 = "SCREEN_STREAM_LEGACY(): Started..." fullword ascii
        $s16 = "SYSTEM_INFORMATION(): Failed! (Error:" fullword ascii
        $s17 = "TARGET_HOST_UPDATE(): Sync successful!" fullword ascii
        $s18 = "PLUGIN_PROCESS_REVERSE_PROXY: Plugin" ascii
        $s19 = "PLUGIN_PROCESS: Plugin" ascii
        $s20 = "PLUGIN_EXEC: Plugin" ascii
        $s21 = "PLUGIN_PROCESS_SCREEN_STREAM: Plugin" ascii

        $cnc1 = "?task_id=" fullword ascii
        $cnc2 = "&operation=" fullword ascii
        $cnc3 = "&filesize=" fullword ascii
        $cnc4 = "pos=" fullword ascii
        $cnc5 = "&mode=" fullword ascii
        $cnc6 = "&cmp=1" fullword ascii
        $cnc7 = "&cmp=0" fullword ascii
        $cnc8 = "&enc=1" fullword ascii
        $cnc9 = "&enc=0" fullword ascii
        $cnc10 = "&user=" fullword ascii
        $cnc11 = "&uid=" fullword ascii
        $cnc12 = "&key=" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or all of ($cnc*) or 8 of ($s*) or (1 of ($x*) and 6 of ($s*)) or (6 of ($cnc*) and 6 of ($s*)))
}

rule MALWARE_Win_PowerPool_STG1 {
    meta:
        author = "ditekSHen"
        description = "Detects first stage PowerPool backdoor"
        snort2_sid = "920088"
        snort3_sid = "920086"
        clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-1"
    strings:
        $s1 = "cmd /c powershell.exe $PSVersionTable.PSVersion > \"%s\"" fullword wide
        $s2 = "cmd /c powershell.exe \"%s\" > \"%s\"" fullword wide
        $s3 = "rar.exe a -r %s.rar -ta%04d%02d%02d%02d%02d%02d -tb%04d%02d%02d%02d%02d%02d" fullword wide
        $s4 = "MyDemonMutex%d" fullword wide
        $s5 = "MyScreen.jpg" fullword wide
        $s6 = "proxy.log" fullword wide
        $s7 = "myjt.exe" fullword wide
        $s8 = "/?id=%s&info=%s" fullword wide
        $s9 = "auto.cfg" fullword ascii
        $s10 = "Mozilla/5.0 (Windows NT 6.1; WOW64)" fullword wide
        $s11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)" fullword wide
        $s12 = "CMD COMMAND EXCUTE ERROR!" fullword ascii
        $c1 = "run.afishaonline.eu" fullword wide
        $c2 = "home.Sports-Collectors.com" fullword wide
        $c3 = "about.Sports-Collectors.com" fullword
        $c4 = "179.43.158.15" fullword wide
        $c5 = "185.227.82.35" fullword wide        
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (1 of ($c*) and 5 of ($s*)))
}

rule MALWARE_Win_PowerPool_STG2 {
    meta:
        author = "ditekSHen"
        description = "Detects second stage PowerPool backdoor"
        snort2_sid = "920089-920091"
        snort3_sid = "920087-920089"
        clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-2"
    strings:
        $s1 = "write info fail!!! GetLastError-->%u" fullword ascii
        $s2 = "LookupAccountSid Error %u" fullword ascii
        $s3 = "Mozilla/4.0 (compatible; )" fullword ascii
        $s4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
        $s5 = "Content-Disposition: form-data; name=\"%s\"" fullword ascii
        $s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
        $s7 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
        $s8 = "in Json::Value::find" fullword ascii
        $s9 = "in Json::Value::resolveReference" fullword ascii
        $s10 = "in Json::Value::duplicateAndPrefixStringValue" fullword ascii
        $s11 = ".?AVLogicError@Json@@" fullword ascii
        $s12 = ".?AVRuntimeError@Json@@" fullword ascii
        $s13 = "http:\\\\82.221.101.157:80" ascii
        $s14 = "http://172.223.112.130:80" ascii
        $s15 = "http://172.223.112.130:443" ascii
        $s16 = "http://info.newsrental.net:80" ascii
        $s17 = "%s|%I64d" ascii
        $s18 = "open internet failed..." ascii
        $s19 = "connect failed..." ascii
        $s20 = "handle not opened..." ascii
        $s21 = "corrupted regex pattern" fullword ascii
        $s22 = "add cookie failed..." ascii
    condition:
        uint16(0) == 0x5a4d and 14 of them
}

rule MALWARE_Win_Egregor {
    meta:
        author = "ditekSHen"
        description = "Detects Egregor ransomware variants"
        clamav_sig = "MALWARE.Win.Ransomware.Egregor"
    strings:
        $s1 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
        $p1 = "--deinstall" fullword wide
        $p2 = "--del" fullword wide
        $p3 = "--exit" fullword wide
        $p4 = "--kill" fullword wide
        $p5 = "--loud" fullword wide
        $p6 = "--nooperation" fullword wide
        $p7 = "--nop" fullword wide
        $p8 = "--skip" fullword wide
        $p9 = "--useless" fullword wide
        $p10 = "--yourmommy" fullword wide
        $p11 = "-passegregor" ascii wide
        $p12 = "-peguard" ascii wide
        $p13 = "--nomimikatz" ascii wide
        $p14 = "--multiproc" ascii wide
        $p15 = "--killrdp" ascii wide
        $p16 = "--nonet" ascii wide
        $p17 = "--norename" ascii wide
        $p18 = "--greetings" ascii wide
    condition:
        (uint16(0) == 0x5a4d and pe.is_dll() and ((all of ($s*) and 1 of ($p*)) or
                (
                    2 of them and filesize < 1000KB and 
                    for any i in (0 .. pe.number_of_sections) : (
                        (
                            pe.sections[i].name == ".00cfg"
                        )
                    )
                )
            )
        ) or 8 of ($p*)
}

rule MALWARE_Win_DLAgent02 {
    meta:
      author = "ditekSHen"
      description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
      clamav_sig = "MALWARE.Win.Trojan.DLAgent02"
    strings:
        $x1 = "/c timeout {0}" fullword wide
        $x2 = "^(https?|ftp):\\/\\/" fullword wide
        $x3 = "{0}{1}{2}{3}" wide
        $x4 = "timeout {0}" fullword wide
        $s1 = "HttpWebRequest" fullword ascii
        $s2 = "GetResponseStream" fullword ascii
        $s3 = "set_FileName" fullword ascii
        $s4 = "set_UseShellExecute" fullword ascii
        $s5 = "WebClient" fullword ascii
        $s6 = "set_CreateNoWindow" fullword ascii
        $s7 = "DownloadString" fullword ascii
        $s8 = "WriteByte" fullword ascii
        $s9 = "CreateUrlCacheEntryW" fullword ascii
        $s10 = "HttpStatusCode" fullword ascii
        $s11 = "FILETIME" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 5000KB and ((2 of ($x*) and 2 of ($s*)) or (#x3 > 2 and 4 of ($s*)))
}

rule MALWARE_Win_RedLineDropperEXE {
    meta:
      author = "ditekSHen"
      description = "Detects executables dropping RedLine infostealer"
      clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-EXE"
    strings:
        $s1 = "Wizutezinod togeto0Rowadufevomuki futenujilazem jic lefogatenezinor" fullword wide
        $s2 = "6Tatafamobevofaj bizafoju peyovavacoco lizine kezakajuj" fullword wide
        $s3 = "Lawuherusozeru kucu zam0Zorizeyuk lepaposupu gala kinarusot ruvasaxehuwo" fullword wide
        $s4 = "ClearEventLogW" fullword ascii
        $s5 = "ProductionVersion" fullword wide
        $s6 = "Vasuko)Yugenizugilobo toxocivoriye yexozoyohuzeb" wide
        $s7 = "Yikezevavuzus gucajanesan#Rolapucededoxu xewulep fuwehofiwifi" wide
    condition:
        uint16(0) == 0x5a4d and (pe.exports("_fgeek@8") and 2 of them) or 
        (
            2 of them and 
            for any i in (0 .. pe.number_of_sections) : (
                (
                    pe.sections[i].name == ".rig"
                )
            )
        )
}

rule MALWARE_Win_Nibiru {
    meta:
      author = "ditekSHen"
      description = "Detects Nibiru ransomware"
      clamav_sig = "MALWARE.Win.Ransomware.Nibiru"
    strings:
        $s1 = ".encrypt" fullword wide
        $s2 = "crypted" fullword wide
        $s3 = ".Nibiru" fullword wide
        $s4 = "Encryption Complete" fullword wide
        $s5 = "All your files,documents,important datas,mp4,mp3 and anything valuable" ascii
        $s6 = "EncryptOrDecryptFile" fullword ascii
        $s7 = "get_hacker" ascii
        $s8 = "/C choice /C Y /N /D Y /T 3 & Del \"" fullword wide
        $s9 = "Once You pay,you get the KEY to decrypt files" ascii
        $pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (7 of them or ($pdb and 2 of ($s*)))
}

rule MALWARE_Win_MedusaLocker {
    meta:
        author = "ditekshen"
        description = "Detects MedusaLocker ransomware"
        clamav_sig = "MALWARE.Win.Ransomware.MedusaLocker"
    strings:
        $x1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii
        $x2 = "SOFTWARE\\Medusa" wide
        $x3 = "=?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?=" ascii
        $s1 = "Recovery_Instructions.mht" fullword wide
        $s2 = "README_LOCK.TXT" fullword wide
        $s3 = "C:\\Users\\Public\\Desktop" wide
        $s4 = "[LOCKER] " wide
        $s5 = "TmV3LUl0ZW0gJ2" ascii
        $s6 = "<HEAD>=20" ascii
        $s7 = "LIST OF ENCRYPTED FILES" ascii
        $s8 = "KEY.FILE" ascii
        $cmd1 = { 2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
        $cmd2 = "vssadmin.exe delete" wide nocase
        $cmd3 = "bcdedit.exe /set {default}" wide
        $cmd4 = "wbadmin delete systemstatebackup" wide nocase
        $mut1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
        $mut2 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide
        $mut3 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide
        $ext1 = { 2e 00 52 00 65 00 61 00 64 00 49 00 6e 00 73 00 
                  74 00 72 00 75 00 63 00 74 00 69 00 6f 00 6e 00
                  73 00 00 00 00 00 00 00 2e 00 6b 00 65 00 76 00
                  65 00 72 00 73 00 65 00 6e }
        $ext2 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii
    condition:
      uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and (4 of ($s*) or 1 of ($mut*))) or 6 of ($s*) or (1 of ($mut*) and 2 of ($cmd*)) or (1 of ($ext*) and 5 of them))
}

rule MALWARE_Win_RansomEXX {
    meta:
        author = "ditekshen"
        description = "Detects RansomEXX ransomware"
        clamav_sig = "MALWARE.Win.Ransomware.RansomEXX"
    strings:
        $id = "ransom.exx" ascii
        $s1 = "!TXDOT_READ_ME!.txt" fullword wide
        $s2 = "debug.txt" fullword wide
        $s3 = ".txd0t" fullword wide
        $s4 = "crypt_detect" fullword wide
        $s5 = "powershell.exe" fullword wide
        $s6 = "cipher.exe" fullword ascii wide
        $s7 = "?ReflectiveLoader@@" ascii
    condition:
      uint16(0) == 0x5a4d and (($id and 3 of ($s*)) or all of ($*))
}

rule MALWARE_Win_QuasarStealer {
    meta:
        author = "ditekshen"
        description = "Detects Quasar infostealer"
        clamav_sig = "MALWARE.Win.Trojan.QuasarStealer"
    strings:
        $s1 = "PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null" fullword ascii
        $s2 = "DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
        $s3 = "Process already elevated." fullword wide
        $s4 = "get_PotentiallyVulnerablePasswords" fullword ascii
        $s5 = "GetKeyloggerLogsDirectory" ascii
        $s6 = "set_PotentiallyVulnerablePasswords" fullword ascii
        $s7 = "BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>" ascii
    condition:
      uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_RedLine {
    meta:
        author = "ditekSHen"
        description = "Detects RedLine infostealer"
        snort2_sid = "920072-920073"
        snort3_sid = "920072-920073"
        clamav_sig = "MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2"
    strings:
        $s1 = { 23 00 2b 00 33 00 3b 00 43 00 53 00 63 00 73 00 }
        $s2 = { 68 10 84 2d 2c 71 ea 7e 2c 71 ea 7e 2c 71 ea 7e
                32 23 7f 7e 3f 71 ea 7e 0b b7 91 7e 2b 71 ea 7e
                2c 71 eb 7e 5c 71 ea 7e 32 23 6e 7e 1c 71 ea 7e
                32 23 69 7e a2 71 ea 7e 32 23 7b 7e 2d 71 ea 7e }
        $s3 = { 83 ec 38 53 b0 ?? 88 44 24 2b 88 44 24 2f b0 ??
                88 44 24 30 88 44 24 31 88 44 24 33 55 56 8b f1
                b8 0c 00 fe ff 2b c6 89 44 24 14 b8 0d 00 fe ff
                2b c6 89 44 24 1c b8 02 00 fe ff 2b c6 89 44 24
                18 b3 32 b8 0e 00 fe ff 2b c6 88 5c 24 32 88 5c
                24 41 89 44 24 28 57 b1 ?? bb 0b 00 fe ff b8 03
                00 fe ff 2b de 2b c6 bf 00 00 fe ff b2 ?? 2b fe
                88 4c 24 38 88 4c 24 42 88 4c 24 47 c6 44 24 34
                78 c6 44 24 35 61 88 54 24 3a c6 44 24 3e 66 c6
                44 24 41 33 c6 44 24 43 ?? c6 44 24 44 74 88 54
                24 46 c6 44 24 40 ?? c6 44 24 39 62 c7 44 24 10 }
        $s4 = "B|BxBtBpBlBhBdB`B\\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B" fullword wide
        $s5 = " delete[]" fullword ascii
        $s6 = "constructor or from DllMain." ascii

        $x1 = "RedLine.Reburn" ascii
        $x2 = "RedLine.Client." ascii
        $x3 = "hostIRemotePanel, CommandLine: " fullword wide
        $u1 = "<ParseCoinomi>" ascii
        $u2 = "<ParseBrowsers>" ascii
        $u3 = "<GrabScreenshot>" ascii
        $u4 = "UserLog" ascii nocase
        $u5 = "FingerPrintT" fullword ascii
        $u6 = "InstalledBrowserInfoT" fullword ascii
        $u7 = "RunPE" fullword ascii
        $u8 = "DownloadAndEx" fullword ascii
        $u9 = ".Data.Applications.Wallets" ascii
        $u10 = ".Data.Browsers" ascii
        $u11 = ".Models.WMI" ascii
        $u12 = "DefenderSucks" wide

        $pat1 = "(((([0-9.])\\d)+){1})" fullword wide
        $pat2 = "^(?:2131|1800|35\\\\d{3})\\\\d{11}$" fullword wide
        $pat3 = "6(?:011|5[0-9]{2})[0-9]{12}$/C" fullword wide
        $pat4 = "Telegramprofiles^(6304|6706|6709|6771)[0-9]{12,15}$" fullword wide
        $pat5 = "host_key^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$" fullword wide
        $pat6 = "^3(?:0[0-5]|[68][0-9])[0-9]{11}$" wide
        $pat7 = "settingsprotocol^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$" wide
        $pat8 = "Opera GX4[0-9]{12}(?:[0-9]{3})?$cookies" wide
        $pat9 = "^9[0-9]{15}$Coinomi" wide
        $pat10 = "wallets^(62[0-9]{14,17})$" wide
        $pat11 = "hostpasswordUsername_value" wide
        $pat12 = "credit_cards^389[0-9]{11}$" wide
        $pat13 = "NWinordVWinpn.eWinxe*WinhostUsername_value" wide
        $pat14 = /(\/|,\s)CommandLine:/ wide
        // another variant
        $v2_1 = "ListOfProcesses" fullword ascii
        $v2_2 = /get_Scan(ned)?(Browsers|ChromeBrowsersPaths|Discord|FTP|GeckoBrowsersPaths|Screen|Steam|Telegram|VPN|Wallets)/ fullword ascii
        $v2_3 = "GetArguments" fullword ascii
        $v2_4 = "VerifyUpdate" fullword ascii
        $v2_5 = "VerifyScanRequest" fullword ascii
        $v2_6 = "GetUpdates" fullword ascii
        // yet another variant
        $v3_1 = "localhost.IUserServiceu" fullword ascii
        $v3_2 = "ParseNetworkInterfaces" fullword ascii
        $v3_3 = "ReplyAction0http://tempuri.org/IUserService/GetUsersResponse" fullword ascii
        $v3_4 = "Action(http://tempuri.org/IUserService/GetUsersT" fullword ascii
        $v3_5 = "basicCfg" fullword wide
        // more variants
        $vx4_1 = "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\AddInProcess32.exe" fullword wide
        $v4_2 = "isWow64" fullword ascii
        $v4_3 = "base64str" fullword ascii
        $v4_4 = "stringKey" fullword ascii
        $v4_5 = "BytesToStringConverted" fullword ascii
        $v4_6 = "FromBase64" fullword ascii
        $v4_7 = "xoredString" fullword ascii
        $v4_8 = "procName" fullword ascii
        $v4_9 = "base64EncodedData" fullword ascii
        // another variant 2021-10-23
        $v5_1 = "DownloadAndExecuteUpdate" fullword ascii
        $v5_2 = "ITaskProcessor" fullword ascii
        $v5_3 = "CommandLineUpdate" fullword ascii
        $v5_4 = "DownloadUpdate" fullword ascii
        $v5_5 = "FileScanning" fullword ascii
        $v5_6 = "GetLenToPosState" fullword ascii
        $v5_7 = "RecordHeaderField" fullword ascii
        $v5_8 = "EndpointConnection" fullword ascii
        $v5_9 = "BCRYPT_KEY_LENGTHS_STRUCT" fullword ascii
        // another variant (v11?)
        $v6_1 = "%localappdata%\\" fullword wide
        $v6_2 = "GetDecoded" fullword ascii
        $v6_3 = "//settinString.Removeg[@name=\\PasswString.Removeord\\]/valuString.RemoveeROOT\\SecurityCenter" fullword wide
        $v6_4 = "AppData\\Roaming\\ //settString.Replaceing[@name=\\UString.Replacesername\\]/vaString.Replaceluemoz_cookies" wide
        $v6_5 = "<GetWindowsVersion>g__HKLM_GetString|11_0" fullword ascii
        $v6_6 = "net.tcp://" fullword wide
    condition:
        (uint16(0) == 0x5a4d and (all of ($s*) or 2 of ($x*) or 7 of ($u*) or 7 of ($pat*) or (1 of ($x*) and (5 of ($u*) or 2 of ($pat*))) or 5 of ($v2*) or 4 of ($v3*) or (3 of ($v2*) and (2 of ($pat*) or 2 of ($u*)) or (1 of ($vx4*) and 5 of ($v4*)) or 5 of ($v4*) or 6 of ($v5*)) or 5 of ($v6*) or (4 of ($v6*) and 3 of them ))) or ((all of ($x*) and 4 of ($s*)) or (4 of ($v6*) and 4 of them))
}

rule MALWARE_Win_Bandook {
    meta:
        author = "ditekshen"
        description = "Detects Bandook backdoor"
        clamav_sig = "MALWARE.Win.Trojan.Bandook"
    strings:
        $s1 = "\"%sLib\\dpx.pyc\" \"%ws\" \"%ws\" \"%ws\" \"%ws\" \"%ws\"" fullword wide
        $s2 = "%s\\usd\\dv-%s.dat" fullword ascii
        $s3 = "%sprd.dat" fullword ascii
        $s4 = "%sfile\\shell\\open\\command" fullword ascii
        $s5 = "explorer.exe , %s" fullword ascii

        $f1 = "CaptureScreen" fullword ascii
        $f2 = "StartShell" fullword ascii
        $f3 = "ClearCred" fullword ascii
        $f4 = "GrabFileFromDevice" fullword ascii
        $f5 = "PutFileOnDevice" fullword ascii
        $f6 = "ChromeInject" fullword ascii
        $f7 = "StartFileMonitor" fullword ascii
        $f8 = "DisableMouseCapture" fullword ascii
        $f9 = "StealUSB" fullword ascii
        $f10 = "DDOSON" fullword ascii
        $f11 = "InstallMac" fullword ascii
        $f12 = "SendCam" fullword ascii

        $x1 = "RTC-TGUBP" fullword ascii
        $x2 = "AVE_MARIA" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 6 of ($f*) or (2 of ($s*) and 3 of ($f*)) or (all of ($x*) and (2 of ($f*) or 3 of ($s*))))
}

rule MALWARE_Win_Kimsuky {
    meta:
        author = "ditekshen"
        description = "Detects Kimsuky backdoor"
        clamav_sig = "MALWARE.Win.Trojan.Kimsuky"
    strings:
        $s1 = "Win%d.%d.%dx64" fullword ascii
        $s2 = ".zip" fullword ascii
        $s3 = ".enc" fullword ascii
        $s4 = "&p2=a" fullword ascii
        $s5 = "Content-Disposition: form-data; name=\"binary\"; filename=\"" fullword ascii
        $s6 = "%s/?m=a&p1=%s&p2=%s-%s-v%d" fullword ascii
        $s7 = "/?m=b&p1=" fullword ascii
        $s8 = "/?m=c&p1=" fullword ascii
        $s9 = "/?m=d&p1=" fullword ascii
        $s10 = "http://%s/%s/?m=e&p1=%s&p2=%s&p3=%s" fullword ascii
        $s11 = "taskkill.exe /im iexplore.exe /f" fullword ascii
        $s12 = "GetParent" fullword ascii
        $s13 = "DllRegisterServer" fullword ascii
        $dll1 = "AutoUpdate.dll" fullword ascii
        $dll2 = "dropper-ie64.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($dll*) and 7 of ($s*)) or (11 of ($*)))
}

rule MALWARE_Win_DLAgent03 {
    meta:
      author = "ditekSHen"
      description = "Detects known Delphi downloader agent downloading second stage payload, notably from discord"
      clamav_sig = "MALWARE.Win.Trojan.DLAgent03"
    strings:
        $delph1 = "FastMM Borland Edition" fullword ascii
        $delph2 = "SOFTWARE\\Borland\\Delphi" ascii
        $v1_1 = "InternetOpenUrlA" fullword ascii
        $v1_2 = "CreateFileA" fullword ascii
        $v1_3 = "WriteFile" fullword ascii
        $v2_1 = "WinHttp.WinHttpRequest.5.1" fullword ascii
        $v2_2 = { 6f 70 65 6e ?? ?? ?? ?? ?? 73 65 6e 64 ?? ?? ?? ?? 72 65 73 70 6f 6e 73 65 74 65 78 74 }
        // $pat is slowing down scanning
        //$pat = /[a-f0-9]{168}/ fullword ascii
        $url1 = "https://discord.com/" fullword ascii
        $url2 = "http://www.superutils.com" fullword ascii
        $url3 = "http://www.xboxharddrive.com" fullword ascii
    condition:
        //uint16(0) == 0x5a4d and 1 of ($delph*) and $discord and ((all of ($v1*) or all of ($v2*)) or $pat)
        uint16(0) == 0x5a4d and 1 of ($delph*) and 1 of ($url*) and (all of ($v1*) or 1 of ($v2*))
}

rule MALWARE_Win_Salfram {
    meta:
        author = "ditekSHen"
        description = "Detects Salfram executables"
        snort2_sid = "920085-920087"
        snort3_sid = "920085"
        clamav_sig = "MALWARE.Win.Trojan.Salfram"
    strings:
        $s1 = "!This Salfram cannot be run in DOS mode." fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_HawkEyeV9 {
    meta:
        author = "ditekshen"
        description = "Detects HawkEyeV9 payload"
        clamav_sig = "MALWARE.Win.Trojan.HawkEyeV9"
    strings:
        $id1 = "HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \\ {2}" wide
        $id2 = "HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" wide
        $str1 = "_PasswordStealer" ascii
        $str2 = "_KeyStrokeLogger" ascii
        $str3 = "_ScreenshotLogger" ascii
        $str4 = "_ClipboardLogger" ascii
        $str5 = "_WebCamLogger" ascii
        $str6 = "_AntiVirusKiller" ascii
        $str7 = "_ProcessElevation" ascii
        $str8 = "_DisableCommandPrompt" ascii
        $str9 = "_WebsiteBlocker" ascii
        $str10 = "_DisableTaskManager" ascii
        $str11 = "_AntiDebugger" ascii
        $str12 = "_WebsiteVisitorSites" ascii
        $str13 = "_DisableRegEdit" ascii
        $str14 = "_ExecutionDelay" ascii
        $str15 = "_InstallStartupPersistance" ascii
    condition:
        int16(0) == 0x5a4d and (1 of ($id*) or 5 of ($str*))
}

rule MALWARE_Win_HyperBro {
    meta:
        author = "ditekSHen"
        description = "Detects HyperBro (class names) payload"
        clamav_sig = "MALWARE.Win.Trojan.HyperBro"
    strings:
        $s1 = "VTClipboardInfo" ascii wide
        $s2 = "VTClipboardMgr" ascii wide
        $s3 = "VTFileRename" ascii wide
        $s4 = "VTFileRetime" ascii wide
        $s5 = "VTKeyboardInfo" ascii wide
        $s6 = "VTKeyboardMgr" ascii wide
        $s7 = "VTRegeditKeyInfo" ascii wide
        $s8 = "VTRegeditMgr" ascii wide
        $s9 = "VTRegeditValueInfo" ascii wide
        $s10 = "VTFileDataRes" ascii wide
    condition:
        uint16(0) == 0x5a4d and 9 of them
}

rule MALWARE_Linux_UNK01 {
    meta:
        author = "ditekSHen"
        description = "Detects unknown/unidentified Linux malware"
    strings:
        $f1 = "%sresponse.php?status" ascii
        $f2 = "%supstream.php?mid=%s&os=%s" ascii fullword
        $f3 = "%supstream.php?tid=%" ascii
        $f4 = "%sindex.php?token=%.32s&flag=%d&name=%s" ascii fullword
        $f5 = "%sactive_off.php?id=%d&uniqu=%d" ascii fullword
        $s1 = "lock:%i usable num:%i n:%i" fullword ascii
        $s2 = "tid:%.*s tNumber:%i" fullword ascii
        $s3 = "init.php" fullword ascii
        $s4 = "mod_drone" fullword ascii
        $s5 = "new_mid" fullword ascii
        $s6 = "&exists[]=" fullword ascii
        $s7 = "&mod[]=" fullword ascii
        $s8 = "shutdown" fullword ascii
        $s9 = "&mac[]=%02X%02X%02X%02X%02X%02X" fullword ascii
    condition:
        uint16(0) == 0x457f and (3 of ($f*) or 6 of ($s*))
}

rule MALWARE_Linux_UNK02 {
    meta:
        author = "ditekSHen"
        description = "Detects unknown/unidentified Linux malware"
    strings:
        $rf1 = "[]A\\A]A^A_" ascii
        $rf2 = "[A\\A]A^A_]" ascii
        $f1 = "/bin/basH" ascii fullword
        $f2 = "/proc/seH" ascii fullword
        $f3 = "/dev/ptsH" ascii fullword
        $f4 = "pqrstuvwxyzabcde" ascii fullword
        $f5 = "libnss_%s.so.%d.%d" ascii fullword
    condition:
        uint16(0) == 0x457f and (all of ($f*) and #rf1 > 3 and #rf2 > 3)
}

rule MALWARE_Win_iTranslatorEXE {
    meta:
        author = "ditekSHen"
        description = "Detects iTranslator EXE payload"
        clamav_sig = "MALWARE.Win.Trojan.iTranslator_EXE"
    strings:
        $s1 = "\\itranslator\\wintrans.exe" fullword wide
        $s2 = "\\SuperX\\SuperX\\Obj\\Release\\SharpX.pdb" fullword ascii
        $s3 = "\\itranslator\\itranslator.dll" fullword ascii
        $s4 = ":Intoskrnl.exe" fullword ascii
        $s5 = "InjectDrv.sys" fullword ascii
        $s6 = "SharpX.dll" fullword wide
        $s7 = "GetMicrosoftEdgeProcessId" ascii
        $s8 = ".php?type=is&ch=" ascii
        $s9 = ".php?uid=" ascii
        $s10 = "&mc=" fullword ascii
        $s11 = "&os=" fullword ascii
        $s12 = "&x=32" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 8 of ($s*)
}

rule MALWARE_Win_iTranslatorDLL {
    meta:
        author = "ditekSHen"
        description = "Detects iTranslator DLL payload"
        clamav_sig = "MALWARE.Win.Trojan.iTranslator_DLL"
    strings:
        $d1 = "system32\\drivers\\%S.sys" fullword wide
        $d2 = "\\windows\\system32\\winlogon.exe" fullword ascii
        $d3 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\%s" fullword wide
        $d4 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\webssx" fullword wide
        $d5 = "\\Device\\CtrlSM" fullword wide
        $d6 = "\\DosDevices\\CtrlSM" fullword wide
        $d7 = "\\driver_wfp\\CbFlt\\Bin\\CbFlt.pdb" ascii
        $d8 = ".php" ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWWARE_Win_Octopus {
    meta:
        author = "ditekSHen"
        description = "Detects Octopus trojan payload"
        clamav_sig = "MALWARE.Win.Trojan.Octopus"
    strings:
        $s1 = "\\Mozilla\\Firefox\\Profiles\\" fullword wide
        $s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
        $s3 = "\\wbem\\WMIC.exe" fullword wide
        $s4 = ".profiles.ini" fullword wide
        $s5 = "PushEBP_" ascii
        $s6 = "MovEBP_ESP_" ascii
        $s7 = "Embarcadero Delphi for Win32 compiler" ascii
        $s8 = "TempWmicBatchFile.bat" fullword wide
        $wq1 = "computersystem get Name /format:list" wide
        $wq2 = "os get installdate /format:list" wide
        $wq3= "get serialnumber /format:list" wide
        $wq4 = "\\\\\\\\.\\\\PHYSICALDRIVE" wide
        $wq5= "path CIM_LogicalDiskBasedOnPartition" wide
        $wq6 = "get Antecedent,Dependent" wide
        $wq7 = "path win32_physicalmedia" wide
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) and 5 of ($wq*))
}

rule MALWARE_Win_CasperTroy {
    meta:
        author = "ditekSHen"
        description = "Detects CasperTroy payload"
    strings:
        $s1 = "DllTroy.dll" fullword ascii
        $s2 = "Content-Disposition: form-data; name=\"image\"; filename=\"title.gif\"" fullword ascii
        $s3 = "Content-Disposition: form-data; name=\"COOKIE_ID\"" fullword ascii
        $s4 = "Content-Disposition: form-data; name=\"PHP_SESS_ID\"" fullword ascii
        $s5 = "Content-Disposition: form-data; name=\"SESS_ID\"" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Rasftuby {
    meta:
        author = "ditekSHen"
        description = "Detects Rasftuby/DarkCrystal"
        clamav_sig = "MALWARE.Win.Trojan.DarkCrystal.RAT-Rasftuby"
    strings:
        $s1 = "/DCRS/main.php?data=active" fullword ascii wide
        $s2 = "/socket.php?type=__ds_" ascii wide
        $s3 = "/uploader.php" fullword ascii wide
        $s4 = "del \\\"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System.lnk\\\"" fullword ascii wide
        $s5 = "Host:{0},Port:{1},User:{2},Pass:{3}<STR>" fullword ascii wide
        $s6 = "keyloggerstart_status" fullword ascii wide
        $s7 = "keyloggerstop_status" fullword ascii wide
        $s8 = "[PRINT SCREEN]" fullword ascii wide
        $s9 = "DCS.Internal" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of ($s*)
}

rule MALWARE_Win_ProtonBot {
    meta:
        author = "ditekSHen"
        description = "Detects ProtonBot loader"
        clamav_sig = "MALWARE.Win.Trojan.ProtonBot"
    strings:
        $x1 = "\\PROTON\\Release\\build.pdb" ascii
        $x2 = "\\proton\\proton bot\\json.hpp" wide
        $x3 = "proton bot" ascii wide
        $s1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
        $s2 = "ranges.size() == 2 or ranges.size() == 4 or ranges.size() == 6" fullword wide
        $s3 = "ref_stack.back()->is_array() or ref_stack.back()->is_object()" fullword wide
        $s4 = "ktmw32.dll" fullword ascii
        $s5 = "@detail@nlohmann@@" ascii
        $s6 = "urlmon.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or (all of ($s*) and 1 of ($x*)))
}

rule MALWARE_Win_ImminentRAT {
    meta:
        author = "ditekSHen"
        description = "Detects ImminentRAT"
    strings:
        $x1 = "abuse@imminentmethods.net" ascii
        $x2 = "Imminent-Monitor-" ascii
        $x3 = "AddressChangeListener" fullword ascii
        $x4 = "SevenZipHelper" fullword ascii
        $x5 = "WrapNonExceptionThrows" fullword ascii
        $s1 = "_ENABLE_PROFILING" wide
        $s2 = "Anti-Virus: {0}" wide
        $s3 = "File downloaded & executed" wide
        $s4 = "Chat - You are speaking with" wide
        $s5 = "\\Imminent\\Plugins" wide
        $s6 = "\\Imminent\\Path.dat" wide
        $s7 = "\\Imminent\\Geo.dat" wide
        $s8 = "DisableTaskManager = {0}" wide
        $s9 = "This client is already mining" wide
        $s10 = "Couldn't get AV!" wide
        $s11 = "Couldn't get FW!" wide
    condition:
        uint16(0) == 0x5a4d and (4 of ($x*) or 5 of ($s*))
}

rule MALWARE_Win_WarzoneRAT {
    meta:
        author = "ditekSHen"
        description = "Detects AveMaria/WarzoneRAT"
    strings:
        $s1 = "RDPClip" fullword wide
        $s2 = "Grabber" fullword wide
        $s3 = "Ave_Maria Stealer OpenSource" wide
        $s4 = "\\MidgetPorn\\workspace\\MsgBox.exe" wide
        $s5 = "@\\cmd.exe" wide
        $s6 = "/n:%temp%\\ellocnak.xml" wide
        $s7 = "Hey I'm Admin" wide
        $s8 = "warzone160" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of ($s*)
}

rule MALWARE_Win_KaraganyCore {
    meta:
        author = "ditekSHen"
        description = "Detects Karagany/xFrost core plugin"
    strings:
        $s1 = "127.0.0.1" fullword ascii
        $s2 = "port" fullword ascii
        $s3 = "C:\\Windows\\System32\\Kernel32.dll" fullword ascii
        $s4 = "kernel32.dll" fullword ascii
        $s5 = "http" ascii
        $s6 = "Move" fullword ascii
        $s7 = "<supportedOS Id=\"{" ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_KaraganyKeylogger {
    meta:
        author = "ditekSHen"
        description = "Detects Karagany/xFrost keylogger plugin"
    strings:
        $s1 = "__klg__" fullword wide
        $s2 = "__klgkillsoft__" fullword wide
        $s3 = "CLIPBOARD_PASTE" wide
        $s4 = "%s\\k%d.txt" wide
        $s5 = "\\Update\\Tmp" wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_KaraganyScreenUtil {
    meta:
        author = "ditekSHen"
        description = "Detects Karagany/xFrost ScreenUtil module"
    strings:
        $s1 = "__pic__" ascii wide
        $s2 = "__pickill__" ascii wide
        $s3 = "\\picture.png" fullword wide
        $s4 = "%d.jpg" wide
        $s5 = "\\Update\\Tmp" wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_KaraganyListrix {
    meta:
        author = "ditekSHen"
        description = "Detects Karagany/xFrost Listrix module"
    strings:
        $s1 = "\\Update\\Tmp\\" wide
        $s2 = "*pass*.*" fullword wide
        $s3 = ">> NUL" wide
        $s4 = "%02d.%02d.%04d %02d:%02d" wide
        $s5 = "/c del" wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Osx_MacSearch {
    meta:
        author = "ditekSHen"
        description = "Detects MacSearch adware"
    strings:
        $s1 = "open -a safari" ascii
        $s2 = "/INDownloader" ascii
        $s3 = "/safefinder" ascii
        $s4 = "/INEncryptor" ascii
        $s5 = "/INInstallerFlow" ascii
        $s6 = "/INConfiguration" ascii
        $s7 = "/INChromeAndFFSetter" ascii
        $s8 = "/INSafariSetter" ascii
        $s9 = "/bin/launchctl" fullword ascii
        $s10 = "/usr/bin/csrutil" fullword ascii
        $s11 = "_Tt%cSs%zu%.*s%s" fullword ascii
        $s12 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
        $s13 = "/macap/safefinder_Obf/safefinder/" ascii
        $s14 = "/safefinder.build/Release/macsearch.build/" ascii
    condition:
        uint16(0) == 0xfacf and 10 of them
}

rule MALWARE_Osx_Genieo {
    meta:
        author = "ditekSHen"
        description = "Detects LinqurySearch/Genieo adware"
        clamav_sig = "MALWARE.Osx.Trojan.Genieo"
    strings:
        $s1 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
        $s2 = "U1QQFXAfCxAfRUNCH1JZXh9" ascii
        $s3 = "XVFTQ1VRQlNYH" ascii
        $s4 = "dF9HXlxfUVQQVUJCX0IQHRB" ascii
        $s5 = "Value:forHTTPHeaderField:" ascii
        $s6 = "postContent:::" fullword ascii
        $s7 = "postLog:" fullword ascii
        $s8 = "initWithBase64EncodedString:options:" fullword ascii
        $s9 = "do shell script \"%@\" with administrator privileges" fullword ascii
        $s10 = /LinqurySearch-[a-f0-9]{40,}/
    condition:
        uint16(0) == 0xfacf and 6 of them
}

rule MALWARE_Osx_AMCPCVARK {
    meta:
        author = "ditekSHen"
        description = "Detects OSX TechyUtils/PCVARK adware"
        clamav_sig = "MALWARE.Osx.Adware.AMC-PCVARK-TechyUtils"
    strings:
        $s1 = "Mac Auto Fixer.app" fullword ascii
        $s2 = "com.techyutil.macautofixer" fullword ascii
        $s3 = "com.findApp.findApp" ascii
        $s4 = "Library/Preferences/%@.plist" fullword ascii
        $s5 = "Library/%@/%@" fullword ascii
        $s6 = "Library/Application Support/%@/%@" fullword ascii
        $s7 = "sleep 3; rm -rf \"%@\"" fullword ascii
        $s8 = "Silently calling url: %@" ascii

        $cnc1 = "cloudfront.net/getdetails" ascii
        $cnc2 = "trk.entiretrack.com/trackerwcfsrv/tracker.svc/trackOffersAccepted/?" ascii
        $cnc3 = "pxl=%@&x-count=1&utm_source=%@&lpid=0&utm_content=&utm_term=&x-base=&utm_medium=%@&utm_publisher=%@&offerpxl=&x-fetch=1&utm_campaign=@&affiliateid=&x-at=&btnid=" ascii

        $x1 = "mafsysinfo" fullword ascii
        $x2 = "MAF4497_MAF4399_MAF2204" ascii

        $developerid = "Developer ID Application: Rahul Gahlot (RZ74UYT742)" ascii
    condition:
        uint16(0) == 0xfacf and (6 of ($s*) or 2 of ($cnc*) or all of ($x*) or $developerid)
}

rule MALWARE_Osx_RealtimeSpy {
    meta:
        author = "ditekSHen"
        description = "Detects macOS RealtimeSpy monitoring app"
        clamav_sig = "MALWARE.Osx.Trojan.RealtimeSpy"
    strings:
        $x1 = "SPYAGENT4HASHCIPHER" fullword ascii
        $x2 = ":username:password:acctid:compUser:compName:" ascii
        $x3 = ":username:password:acctid:compName:" ascii
        $x4 = "://www.realtime-spy-mac.com/" ascii
        $x5 = "/Users/spytech/" ascii
        $x6 = "shell script \"touch /private/var/db/.AccessibilityAPIEnabled\" password \"pwd\" with administrator privileges" ascii
        $x7 = "Content-Disposition: form-data; name=\"raptor_" ascii

        $c1 = "_OBJC_CLASS_$_LocationLogger" fullword ascii
        $c2 = "_OBJC_CLASS_$_MonitoringFunctions" fullword ascii
        $c3 = "_OBJC_CLASS_$_ProcessLogger" fullword ascii
        $c4 = "_OBJC_CLASS_$_RealtimeLoggingFunctions" fullword ascii
        $c5 = "_OBJC_CLASS_$_Realtime_SpyAppDelegate" fullword ascii
        $c6 = "_OBJC_CLASS_$_ScreenshotLogger" fullword ascii
        $c7 = "_OBJC_CLASS_$_Uploader" fullword ascii
        $c8 = "_OBJC_CLASS_$_UsageLogger" fullword ascii
        $c9 = "_OBJC_CLASS_$_WebsiteLogger" fullword ascii
    condition:
        uint16(0) == 0xfacf and (2 of ($x*) or 2 of ($c*))
}

rule MALWARE_Osx_MaxOfferDeal {
    meta:
        author = "ditekSHen"
        description = "Detects macOS MaxOfferDeal adware"
        clamav_sig = "MALWARE.Osx.Adware.MaxOfferDeal"
    strings:
        $s1 = "clEvE15obfuscated_data" ascii
        $s2 = "%.*s.%.*s" fullword ascii
        $s3 = "_Tt%cSs%zu%.*s%s" fullword ascii
        $s4 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
        $s5 = "__ZL20tFirefoxProfilesPath" ascii
        $s6 = "__ZL22tFirefoxSearchFileName" ascii
        $s7 = "__ZL37tFirefoxDefaultProfileFolderExtension" ascii
        $s8 = "__ZL21tFirefoxPrefsFileName" ascii
        $s9 = "__GLOBAL__sub_I_Firefox.mm" ascii
        $s10 = "add_image_hook_" ascii
        $s11 = "/Library/Caches/com.apple.xbs/Sources/arclite/arclite-66/source/" fullword ascii
    condition:
        uint16(0) == 0xfacf and all of them
}

rule MALWARE_Osx_WindTrail {
    meta:
        author = "ditekSHen"
        description = "Detects WindTrail OSX trojan"
        clamav_sig = "MALWARE.Osx.Trojan.WindTrail"
    strings:
        $s1 = "m_ComputerName_UserName" fullword ascii
        $s2 = "m_uploadURL" fullword ascii
        $s3 = "m_logString" fullword ascii
        $s4 = "GenrateDeviceName" fullword ascii
        $s5 = "open -a" fullword ascii
        $s6 = "AESEncryptFile:toFile:usingPassphrase:error:" fullword ascii
        $s7 = "scheduledTimerWithTimeInterval:target:selector:userInfo:repeats:" fullword ascii
        $s8 = "_kLSSharedFileListSessionLoginItems" fullword ascii
        $developerid = "Developer ID Application: warren portman (95RKE2AA8F)" ascii
    condition:
        uint16(0) == 0xfacf and (all of ($s*) or $developerid)
}

rule MALWARE_Osx_TechyUtils {
    meta:
        author = "ditekSHen"
        description = "Detects TechyUtils OSX packages"
        clamav_sig = "MALWARE.Osx.Trojan.TechyUtils"
    strings:
        $s1 = "__ZL58__arclite_NSMutableDictionary__" ascii
        $s2 = "__ZL46__arclite_NSDictionary_" ascii
        $s3 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
        $s4 = "/productprice.svc/GetCountryCode" ascii
        $s5 = "@_pthread_mutex_lock" fullword ascii
        $s6 = "_mh_execute_header" fullword ascii
        $s7 = "/Users/prasoon/Documents/" ascii
        $developerid = "Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)" ascii
    condition:
        uint16(0) == 0xfacf and (all of ($s*) or $developerid)
}

rule MALWARE_Osx_LamePyre {
    meta:
        description = "Detects LamePyre"
    strings:
        // wFlow
        $s1 = "/Automator/Run Shell" ascii
        $s2 = "curl " ascii
        $s3 = "base64" ascii
        $s4 = "screencapture" ascii
        $s5 = "handler.php"
        $s6 = "zip" ascii
        // Persistence scripts
        $ps1 = "base64.b64decode" ascii
        $ps2 = "dXJsbGliM" ascii         // urllib2
        $ps3 = "c3VicHJvY2Vz" ascii      // subprocess
        $ps4 = "aW5kZXguYXN" ascii       // index.asp
        $sp5 = "YWRkaGVhZGVy" ascii      // addheader
    condition:
        all of ($ps*) or 5 of ($s*)
}

rule MALWARE_Win_DLAgent04 {
    meta:
      author = "ditekSHen"
      description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
      clamav_sig = "MALWARE.Win.Trojan.DLAgent04"
    strings:
        $x1 = "@@@http" ascii wide
        $s1 = "HttpWebRequest" fullword ascii
        $s2 = "GetResponseStream" fullword ascii
        $s3 = "set_FileName" fullword ascii
        $s4 = "set_UseShellExecute" fullword ascii
        $s5 = "WebClient" fullword ascii
        $s6 = "set_CreateNoWindow" fullword ascii
        $s7 = "DownloadString" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and #x1 > 1 and 4 of ($s*)
}

rule MALWARE_Win_GDriveRAT {
    meta:
        author = "ditekSHen"
        description = "Detects GDriveRAT"
        clamav_sig = "MALWARE.Win.Trojan.GDriveRAT"
    strings:
        $h1 = "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart" fullword wide
        $h2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword wide
        $h3 = "multipart/related; boundary=\"boundary_tag\"" fullword wide
        $h4 = "https://www.googleapis.com/drive/v3/files" fullword wide
        $s1 = "move gdrive.exe \"C:\\Users\\" fullword wide
        $s2 = "file_data" fullword ascii
        $s3 = "comp_id" fullword ascii
        $s4 = "file_name" fullword ascii
        $s5 = "refresh_token" fullword ascii
        $s6 = "commands" fullword ascii
        $s7 = "execute" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 3 of ($h*) and 5 of ($s*)
}

rule MALWARE_Win_STOP {
    meta:
        author = "ditekSHen"
        description = "Detects STOP ransomware"
        snort2_sid = "920113"
        snort3_sid = "920111"
        clamav_sig = "MALWARE.Win.Ransomware.STOP"
    strings:
        $x1 = "C:\\SystemID\\PersonalID.txt" fullword wide
        $x2 = "/deny *S-1-1-0:(OI)(CI)(DE,DC)" wide
        $x3 = "e:\\doc\\my work (c++)\\_git\\encryption\\" ascii wide nocase
        $s1 = "\" --AutoStart" fullword ascii wide
        $s2 = "--ForNetRes" fullword wide
        $s3 = "--Admin" fullword wide
        $s4 = "%username%" fullword wide
        $s5 = "?pid=" fullword wide
        $s6 = /&first=(true|false)/ fullword wide
        $s7 = "delself.bat" ascii
        $mutex1 = "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}" fullword ascii
        $mutex2 = "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}" fullword ascii
        $mutex3 = "{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((2 of ($x*) and 1 of ($mutex*)) or (all of ($x*)) or (6 of ($s*) and (1 of ($x*) or 1 of ($mutex*))) or (9 of them))
}

rule MALWARE_Win_ParallaxRAT {
    meta:
        author = "ditekSHen"
        description = "Detects ParallaxRAT"
        clamav_sig = "MALWARE.Win.Trojan.ParallaxRAT"
    strings:
       $s1 = "[Clipboard End]" fullword wide
       $s2 = "[Ctrl +" fullword wide
       $s3 = "[Alt +" fullword wide
       $s4 = "Clipboard Start" wide
       $s5 = "(Wscript.ScriptFullName)" wide
       $s6 = "CSDVersion" fullword ascii
       $s7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword ascii
       $x1 = { 2e 65 78 65 00 00 84 00 00 4d 5a 90 00 }
       $x2 = "This program cannot be run in DOS mode" ascii
    condition:
        ((uint16(0) == 0x5a4d and all of ($s*)) or all of them)
}

rule MALWARE_Win_Meterpreter {
    meta:
        author = "ditekSHen"
        description = "Detects Meterpreter payload"
    strings:
        $s1 = "PACKET TRANSMIT" fullword ascii
        $s2 = "PACKET RECEIVE" fullword ascii
        $s3 = "\\\\%s\\pipe\\%s" fullword ascii wide
        $s4 = "%04x-%04x:%s" fullword wide
        $s5 = "server.dll" fullword ascii
        //$s6 = "tcp://" wide
    condition:
        (uint16(0) == 0x5a4d and all of them) or (filesize < 300KB and all of them)
}

/*
rule MALWARE_Win_Raccoon {
    meta:
        author = "ditekSHen"
        description = "Detects Raccoon/Racealer infostealer"
        clamav_sig = "MALWARE.Win.Trojan.Raccoon"
    strings:
        $s1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
        $s2 = "inetcomm server passwords" fullword wide
        $s3 = "\\json.hpp" wide
        $s4 = "CredEnumerateW" fullword ascii
        $s5 = "Microsoft_WinInet_" fullword wide
        $s6 = "already connected" fullword ascii
        $s7 = "copy_file" fullword ascii
        $s8 = "\"; filename=\"" fullword ascii
        $s9 = "%[^:]://%[^/]%[^" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}
*/

rule MALWARE_Win_Trojan_ExpressCMS {
    meta:
        author = "ditekSHen"
        description = "Detects ExpressCMS"
        clamav_sig = "MALWARE.Win.Trojan.ExpressCMS"
    strings:
        $s1 = "/click.php?cnv_id=" fullword wide
        $s2 = "/click.php?key=" wide
        $s3 = "jdlnb" fullword wide
        $s4 = "Gkjfdshfkjjd: dsdjdsjdhv" fullword wide
        $s5 = "--elevated" fullword wide
        $s6 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" wide
        $s7 = "\\Microsoft\\Manager.exe" fullword wide
        $s8 = "\\Microsoft\\svchost.exe" fullword wide
    condition:
       uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_MeterpreterStager {
    meta:
        author = "ditekSHen"
        description = "Detects Meterpreter stager payload"
    strings:
        $s1 = "PAYLOAD:" fullword ascii
        $s2 = "AQAPRQVH1" fullword ascii
        $s3 = "ws2_32" fullword ascii
        $s4 = "KERNEL32.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them and filesize < 100KB
}

rule MALWARE_Win_Ziggy {
    meta:
        author = "ditekSHen"
        description = "Detects Ziggy ransomware"
        snort2_sid = "920098"
        snort3_sid = "920096"
        clamav_sig = "MALWARE.Win.Ransomware.Ziggy"
    strings:
        $id1 = "/Ziggy Info;component/mainwindow.xaml" fullword wide
        $id2 = "AZiggy Info, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
        $id3 = "Ziggy Ransomware" fullword wide
        $id4 = "clr-namespace:Zeggy" fullword ascii
        $s1 = "GetCooldown" fullword ascii
        $s2 = "checkCommandMappings" fullword ascii
        $s3 =  "add_OnExecuteCommand" fullword ascii
        $s4 = "MindLated.jpg" fullword wide
        $s5 = "http://fixfiles.xyz/ziggy/api/info.php?id=" fullword wide
        $s6 = "Reamaining time:" fullword wide
        $msg1 = "<:In case of no answer in 12 hours write us to this e-mail" ascii
        $msg2 = "Free decryption as guarantee" fullword ascii
        $msg3 = "# Do not try to decrypt your data using third party software, it may cause permanent data loss" ascii
        $msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($id*) or 4 of ($s*) or 3 of ($msg*))
}

rule MALWARE_Win_NWorm {
    meta:
        author = "ditekSHen"
        description = "Detects NWorm/N-W0rm payload"
        clamav_sig = "MALWARE.Win.Trojan.NWorm"
    strings:
        $id1 = "N-W0rm" ascii
        $id2 = "N_W0rm" ascii
        $x1 = "pongPing" fullword wide
        $x2 = "|NW|" fullword wide
        $s1 = "runFile" fullword wide
        $s2 = "runUrl" fullword wide
        $s3 = "killer" fullword wide
        $s4 = "powershell" fullword wide
        $s5 = "wscript.exe" fullword wide
        $s6 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File \"" fullword wide
        $s7 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
        $s8 = "Start-Sleep -Seconds 1.5; Remove-Item -Path '" fullword wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($id*) and (1 of ($x*) or 3 of ($s*))) or (all of ($x*) and 2 of ($s*)) or 7 of ($s*) or 10 of them)
}

rule MALWARE_Win_QakBot {
    meta:
        author = "ditekSHen"
        description = "Detects variants of QakBot payload"
    strings:
        $s1 = "stager_1.dll" fullword ascii
        $s2 = "_vsnwprintf" fullword ascii
        $s3 = "DllRegisterServer" fullword ascii
        $s4 = "Win32_PnPEntity" fullword wide
        $s5 = "0>user32.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Fonix {
    meta:
        author = "ditekSHen"
        description = "Detects Fonix ransomware"
        clamav_sig = "MALWARE.Win.Ransomware.Fonix"
    strings:
        $s1 = "dontcryptanyway" fullword wide
        $s2 = "Cpriv.key" ascii wide
        $s3 = "Cpub.key" ascii wide
        $s4 = "NetShareEnum() failed!Error: % ld" fullword wide
        $s5 = "<div class='title'> Attention!</div><ul><li><u><b>DO NOT</b> pay" wide
        $s6 = "Encryption Completed !!!" fullword wide
        $s7 = "kill process" fullword ascii
        $s8 = "Copy SystemID C:\\ProgramData\\SystemID" ascii
        $id1 = "].FONIX" fullword wide
        $id2 = "xinofconfig.txt" fullword ascii wide
        $id3 = "XINOF4MUTEX" wide
        $id4 = ":\\Fonix\\cryptoPP\\" ascii
        $id5 = "schtasks /CREATE /SC ONLOGON /TN fonix" ascii
        $id6 = "Ransomware\\Fonix" ascii
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or 3 of ($id*) or (1 of ($id*) and 3 of ($s*)))
}

rule MALWARE_Win_Bobik {
    meta:
        author = "ditekSHen"
        description = "Detects Bobik infostealer"
        clamav_sig = "MALWARE.Win.Trojan.Bobik"
    strings:
        $s1 = "@Default\\Login Data" fullword ascii
        $s2 = "@Default\\Cookies" fullword ascii
        $s3 = "@logins.json" fullword ascii
        $s4 = "@[EXECUTE]" fullword ascii
        $s5 = "@C:\\Windows\\System32\\cmd.exe" fullword ascii
        $s6 = /(CHROME|OPERA|FIREFOX)_BASED/ fullword ascii
        $s7 = "threads.nim" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_RunningRAT {
    meta:
        author = "ditekSHen"
        description = "Detects RunningRAT"
        clamav_sig = "MALWARE.Win.Trojan.RunningRAT"
    strings:
        $s1 = "%s%d.dll" fullword ascii
        $s2 = "/c ping 127.0.0.1 -n" ascii
        $s3 = "del /f/q \"%s\"" ascii
        $s4 = "GUpdate" fullword ascii
        $s5 = "%s\\%d.bak" fullword ascii
        $s6 = "\"%s\",MainThread" ascii
        $s7 = "rundll32.exe" fullword ascii
        $rev1 = "emankcosteg" fullword ascii
        $rev2 = "ini.revreS\\" fullword ascii
        $rev3 = "daerhTniaM,\"s%\" s%" ascii
        $rev4 = "s% etadpUllD,\"s%\" 23lldnuR" ascii
        $rev5 = "---DNE yromeMmorFdaoL" fullword ascii
        $rev6 = "eMnigulP" fullword ascii
        $rev7 = "exe.23lldnuR\\" fullword ascii
        $rev8 = "dnammoc\\nepo\\llehs\\" ascii
        $rev9 = "\"s%\" k- exe.tsohcvs\\23metsyS\\%%tooRmetsyS%" ascii
        $rev10 = "emanybtsohteg" fullword ascii
        $rev11 = "tekcosesolc" fullword ascii
        $rev12 = "tpokcostes" fullword ascii
        $rev13 = "emantsohteg" fullword ascii
        // variant
        $v2_1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword ascii
        $v2_2 = "LoadFromMemory END---" fullword ascii
        $v2_3 = "hmProxy!= NULL" fullword ascii
        $v2_4 = "Rundll32 \"%s\",DllUpdate %s" fullword ascii
        $v2_5 = "ipip.website" fullword ascii
        $v2_6 = "%d*%sMHz" fullword ascii
        $v2_7 = "\\Server.ini" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 5 of ($rev*) or 6 of ($v*) or 8 of them)
}

rule MALWARE_Win_DLAgent05 {
    meta:
        author = "ditekSHen"
        description = "Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable"
        clamav_sig = "MALWARE.Win.Trojan.DLAgent05"
    strings:
        $s1 = "MARCUS.dll" fullword ascii wide
        $s2 = "GZipStream" fullword ascii
        $s3 = "MemoryStream" fullword ascii
        $s4 = "proj_name" fullword ascii
        $s5 = "res_name" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Nemty {
    meta:
        author = "ditekSHen"
        description = "Detects Nemty/Nefilim ransomware"
    strings:
        $s1 = "Go build ID:" ascii
        $s2 = "GOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianSaurasht" ascii
        $s3 = "crypto/x509.ExtKeyUsage" ascii
        $s4 = "crypto/x509.KeyUsageContentCommitment" ascii
        $s5 = "DEK-Info header" ascii
        $s6 = "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" fullword ascii
        $s7 = "*( -  <  =  >  k= m=%: +00+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12..." ascii
        $s8 = "Go cmd/compile go1.10" fullword ascii
        $s9 = ".dllprogramdatarecycle.bin" ascii
        $s10 = ".dll.exe.lnk.sys.url" ascii
        $vx1_1 = "Fa1led to os.OpenFile()" ascii
        $vx1_2 = "-HELP.txt" ascii
        $vf1_1 = "main.CTREncrypt" fullword ascii
        $vf1_2 = "main.FileSearch" fullword ascii
        $vf1_3 = "main.getdrives" fullword ascii
        $vf1_4 = "main.RSAEncrypt" fullword ascii
        $vf1_5 = "main.SaveNote" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (9 of ($s*) or (all of ($vx*) and 2 of ($s*)) or all of ($vf*))
}

rule MALWARE_Win_QnapCrypt {
    meta:
        author = "ditekSHen"
        description = "Detects QnapCrypt/Lockedv1/Cryptfile2 ransomware"
    strings:
        $go = "Go build ID:" ascii
        $s1 = "Encrypting %s..." ascii
        $s2 = "\\Start Menu\\Programs\\StartUp\\READMEV" ascii
        $s3 = "main.deleteRecycleBin" ascii
        $s4 = "main.encryptFiles" ascii
        $s5 = "main.antiVirtualBox" ascii
        $s6 = "main.antiVmware" ascii
        $s7 = "main.deleteShadows" ascii
        $s8 = "main.delUAC" ascii
        $s9 = "main.KillProcess" ascii
        $s10 = "main.delExploit" ascii
        $s11 = "main.encrypt" ascii
        $s12 = "main.ClearLogDownload" ascii
        $s13 = "main.ClearLog" ascii
        $s14 = "main.EndEncrypt" ascii
        $s15 = "main.RunFuckLogAndSoft" ascii
        $s16 = "main.ClearUsercache" ascii
        $s17 = "main.FirstDuty" ascii
        $s18 = ".lockedv1" ascii
        $s19 = "WSAStartup\\clear.bat\\ngrok.exe\\video.mp4" ascii
        $s20 = "net stop " ascii
    condition:
        uint16(0) == 0x5a4d and $go and 6 of ($s*)
}

rule MALWARE_Win_Alfonoso {
    meta:
        author = "ditekSHen"
        description = "Detects Alfonoso / Shurk / HunterStealer infostealer"
        snort2_sid = "920102"
        snort3_sid = "920100"
        clamav_sig = "MALWARE.Win.Trojan.Alfonso"
    strings:
        $s1 = "%s\\etilqs_" fullword ascii
        $s2 = "SELECT name, rootpage, sql FROM '%q'.%s" fullword ascii
        $s3 = "%s-mj%08X" fullword ascii
        $s4 = "| Site:" ascii
        $s5 = "| Login:" ascii
        $s6 = "| Password:" ascii
        $s7 = "| BUILD NAME:" ascii
        $s8 = "recursive_directory_iterator" ascii
        $s9 = { 2e 7a 69 70 00 00 00 00 2e 7a 6f 6f 00 00 00 00
                2e 61 72 63 00 00 00 00 2e 6c 7a 68 00 00 00 00
                2e 61 72 6a 00 00 00 00 2e 67 7a 00 2e 74 67 7a
                00 00 00 00 }
        $s10 = "Shurk Steal" fullword ascii
        $s11 = ":memory:" fullword ascii
        $s12 = "current_path()" fullword ascii
        $s13 = "vtab:%p:%p" fullword ascii
        $f1 = "chatlog.txt" ascii
        $f2 = "servers.fav" ascii
        $f3 = "\\USERDATA.DAT" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (8 of ($s*) or (6 of ($s*) and 2 of ($f*)) or (all of ($f*) and 5 of ($s*)))
}

rule MALWARE_Win_Vidar {
    meta:
        author = "ditekSHen"
        description = "Detects Vidar / ArkeiStealer"
    strings:
        $s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii
        $s2 = "screenshot.jpg" fullword wide
        $s3 = "Content-Disposition: form-data; name=\"" ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Babuk {
    meta:
        author = "ditekSHen"
        description = "Detects Babuk ransomware"
    strings:
        $s1 = "ecdh_pub_k.bin" wide
        $s2 = "How To Restore Your Files.txt" wide
        $s3 = /(babuk|babyk)\s(ransomware|locker)/ ascii nocase
        $s4 = "/login.php?id=" ascii
        $s5 = "http://babuk" ascii
        $s6 = "bootsect.bak" fullword wide
        $s7 = "Can't open file after killHolder" ascii
        $s8 = "Can't OpenProcess" ascii
        $s9 = "DoYouWantToHaveSexWithCuongDong" ascii
        $arg1 = "-lanfirst" fullword ascii
        $arg2 = "-lansecond" fullword ascii
        $arg3 = "-nolan" fullword ascii
        $arg4 = "shares" fullword wide
        $arg5 = "paths" fullword wide
        $arg6 = "gdebug" fullword wide
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or (3 of ($arg*) and 2 of ($s*)))
}

rule MALWARE_Win_Nitol {
    meta:
        author = "ditekSHen"
        description = "Detects Nitol backdoor"
    strings:
        $s1 = "%$#@!.aspGET ^&*().htmlGET" ascii
        $s2 = "Applications\\iexplore.exe\\shell\\open\\command" fullword ascii
        $s3 = "taskkill /f /im rundll32.exe" fullword ascii
        $s4 = "\\Tencent\\Users\\*.*" fullword ascii
        $s5 = "[Pause Break]" fullword ascii
        $s6 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
        $s7 = "GET %s HTTP/1.1" fullword ascii
        $s8 = "GET %s%s HTTP/1.1" fullword ascii
        $s9 = "Accept-Language: zh-cn" fullword ascii
        $s10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)" fullword ascii
        $s11 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
        $s12 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
        $w1 = ".aspGET" ascii
        $w2 = ".htmGET" ascii
        $w3 = ".htmlGET" ascii
        $domain = "www.xy999.com" fullword ascii
        $v2_1 = "loglass" fullword ascii
        $v2_2 = "rlehgs" fullword ascii
        $v2_3 = "eherrali" fullword ascii
        $v2_4 = "agesrlu" fullword ascii
        $v2_5 = "lepejagas" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or (all of ($v2*)) or ($domain and 3 of them) or (#w1 > 2 and #w2 > 2 and #w3 > 2 and 3 of ($s*)))
}

rule MALWARE_Win_StrongPity {
    meta:
        author = "ditekSHen"
        description = "Detects StrongPity"
    strings:
        $s1 = "Boundary%08X" ascii wide
        $s2 = "Content-Disposition: form-data; name=\"file\";" fullword ascii
        $s3 = "%sfilename=\"%ls\"" fullword ascii
        $s4 = "name=%ls&delete=" fullword ascii
        $s5 = "Content-Type: application/octet-stream" fullword ascii
        $s6 = "cmd.exe /C ping" wide
        $s7 = "& rmdir /Q /S \"" wide
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_JSSLoader {
    meta:
        author = "ditekSHen"
        description = "Detects JSSLoader RAT/backdoor"
    strings:
        $cmd1 = "Cmd_UPDATE" fullword ascii
        $cmd2 = "Cmd_IDLE" fullword ascii
        $cmd3 = "Cmd_EXE" fullword ascii
        $cmd4 = "Cmd_VBS" fullword ascii
        $cmd5 = "Cmd_JS" fullword ascii
        $cmd6 = "Cmd_PWS" fullword ascii
        $cmd7 = "Cmd_RAT" fullword ascii
        $cmd8 = "Cmd_UNINST" fullword ascii
        $cmd9 = "Cmd_RunDll" fullword ascii
        $s1 = "ANSWER_OK" fullword ascii
        $s2 = "GatherDFiles" ascii
        $s3 = "CommandCd" fullword ascii
        $s4 = "URL_GetCmd" fullword ascii
        $s5 = "\"host\": \"{0}\", \"domain\": \"{1}\", \"user\": \"{2}\"" wide
        $s6 = "pc_dns_host_name" wide
        $s7 = "\"adinfo\": { \"adinformation\":" wide
        $e1 = "//e:vbscript" wide
        $e2 = "//e:jscript" wide
        $e3 = "/c rundll32.exe" wide
        $e4 = "/C powershell" wide
        $e5 = "C:\\Windows\\System32\\cmd.exe" wide
        $e6 = "echo del /f" wide
        $e7 = "AT.U() {0}. format" wide
    condition:
        uint16(0) == 0x5a4d and (5 of ($cmd*) or 5 of ($s*) or all of ($e*) or 7 of them)
}

rule MALWARE_Win_CHUWI_Seth {
    meta:
        author = "ditekSHen"
        description = "Detects detected unknown RAT. Called CHUWI based on PDB, and promoted to Seth Ransomware."
        snort2_sid = "920103-920105"
        snort3_sid = "920101-920103"
        notes = "First sighting on 2020-01-05 didn't include ransomware artificats. Second sighting on 2020-01-24 with several correlations between the two samples now include ransomware artifacts."
    strings:
        // First sighting on 2020-01-05
        // No ransomware artifcats
        // 80104e0ad490b44a632a15e5875e7626db7f35fa94d7aadf19c45a621d75c7e0
        $cmd1 = "shell_command" fullword ascii
        $cmd2 = "check_command" fullword ascii
        $cmd3 = "down_exec" fullword ascii
        $cmd4 = "open_link" fullword ascii
        $cmd5 = "down_exec" fullword ascii
        $cmd6 = "exe_link" fullword ascii
        $cmd7 = "shellCommand" fullword ascii
        $cmd8 = "R_CMMAND" fullword ascii
        $cnc1 = "/check_command.php?HWID=" ascii
        $cnc2 = "&act=get_command" ascii
        $cnc3 = "/get_command.php?hwid=" ascii
        $cnc4 = "&command=down_exec" ascii
        $cnc5 = "&command=message" ascii
        $cnc6 = "&command=open_link" ascii
        $cnc7 = "&command=down_exec" ascii
        $cnc8 = "&command=shell" ascii
        $pdb = "\\Users\\CHUWI\\Documents\\CPROJ\\Downloader\\svchost" ascii

        // Second sighting on 2020-01-24
        // Includes ransomware artificats
        // 58c852525bf3bea185db34a79c2c5640c02f8291cdbdbe8dd7c0a9d4682f4b2c
        $rcnc1 = "inc/check_command.php" ascii
        $rcnc2 = "inc/get_command.php" ascii
        $rcnc3 = "php?btc" ascii
        $rcnc4 = "php?hwid" ascii
        $x1 = "> %USERPROFILE%\\Desktop\\HOW_DECRYPT_FILES.seth.txt" ascii
        $x2 = "/C dir /b %USERPROFILE%\\Documents > %temp%\\doc.txt" ascii
        $x3 = "/C dir /b %USERPROFILE%\\Desktop > %temp%\\desk.txt" ascii
        $x4 = "/C dir /b %USERPROFILE%\\Downloads > %temp%\\downs.txt" ascii
        $x5 = "/C dir /b %USERPROFILE%\\Pictures > %temp%\\pics.txt" ascii
        $x6 = "for /F \"delims=\" %%a in ('mshta.exe \"%~F0\"') do set \"HTA=%%a\"" ascii
        $x7 = "\\svchost.exe" fullword ascii
        $x8 = ".seth" fullword ascii
        $x9 = "MyAgent" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ($pdb or 5 of ($cmd*) or 4 of ($cnc*) or all of ($rcnc*) or 5 of ($x*) or 8 of them)
}

rule MALWARE_Win_Gulpix {
    meta:
        author = "ditekSHen"
        description = "Detects Gulpix/HyperPlus backddor"
    strings:
        $x1 = "MainServer.dll" fullword ascii
        $x2 = "NvSmartMax.dat" fullword wide
        $x3 = "NvSmartMax.dll" fullword wide
        $x4 = "http://+:80/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7/" fullword wide
        $s1 = "IP retriever" fullword wide
        $s2 = "\\cmd.exe" fullword wide
        $s3 = "\\msnetwork-cache.db" fullword wide
        $s4 = "http://+:" wide
        $s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" fullword wide
        // UAC Bypass
        $s6 = "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" ascii
        $s7 = "Got a unknown request for %ws" wide
        $s8 = "HttpReceiveRequestEntityBody failed with %lu" wide
        $s9 = "FD873AC4-CF86-4FED-84EC-4BD59C6F17A7" wide
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or 6 of ($s*) or (2 of ($x*) and 4 of ($s*)) or
             (
                 2 of them and 
                 pe.exports("daemon") and 
                 pe.exports("run") and 
                 pe.exports("session") and 
                 pe.exports("work")
            )
        )
}

rule MALWARE_Linux_RansomExx {
    meta:
        author = "ditekshen"
        description = "Detects RansomEXX ransomware"
        clamav_sig = "MALWARE.Linux.Ransomware.RansomEXX"
    strings:
        $c1 = "crtstuff.c" fullword ascii
        $c2 = "cryptor.c" fullword ascii
        $c3 = "ransomware.c" fullword ascii
        $c4 = "logic.c" fullword ascii
        $c5 = "enum_files.c" fullword ascii
        $c6 = "readme.c" fullword ascii
        $c7 = "ctr_drbg.c" fullword ascii
        
        $s1 = "regenerate_pre_data" fullword ascii
        $s2 = "g_RansomHeader" fullword ascii
        $s3 = "CryptOneBlock" fullword ascii
        $s4 = "RansomLogic" fullword ascii
        $s5 = "CryptOneFile" fullword ascii
        $s6 = "encrypt_worker" fullword ascii
        $s7 = "list_dir" fullword ascii
        $s8 = "ctr_drbg_update_internal" fullword ascii
    condition:
        uint16(0) == 0x457f and (5 of ($c*) or 6 of ($s*) or (3 of ($c*) and 3 of ($s*)))
}

rule MALWARE_Win_TrickbotModule {
    meta:
        author = "ditekshen"
        description = "Detects Trickbot modules"
    strings:
        $mc = "<moduleconfig>" ascii
        $s1 = "<autostart>" ascii
        $s2 = "<nohead>" ascii
        $s3 = "<needinfo" ascii
        $s4 = "<conf ctl" ascii
        $s5 = "<limit>" ascii
        $w1 = "<sys>yes</sys>" ascii
        $w2 = "<sys>no</sys>" ascii
        $w3 = "<autostart>yes</autostart>" ascii
        $w4 = "<autostart>no</autostart>" ascii
        $w5 = "<nohead>yes</nohead>" ascii
        $w6 = "<nohead>no</nohead>" ascii
        $w7 = /<limit>\d+<\/limit>/ ascii
        $w8 = "<moduleconfig> </moduleconfig" ascii
    condition:
        uint16(0) == 0x5a4d and $mc and (2 of ($s*) or (1 of ($s*) and 1 of ($w*)) or 1 of ($w*))
}

rule MALWARE_Win_Gaudox {
    meta:
        author = "ditekshen"
        description = "Detects Gaudox RAT"
    strings:
        $s1 = "hdr=%s&tid;=%s&cid;=%s&trs;=%i" ascii wide
        $s2 = "\\\\\\\\.\\\\PhysicalDrive%u" ascii wide
        //$s3 = "Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0" ascii wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Phobos {
    meta:
        author = "ditekshen"
        description = "Detects Phobos ransomware"
    strings:
        $x1 = "\\\\?\\UNC\\\\\\e-" fullword wide
        $x2 = "\\\\?\\ :" fullword wide
        $x3 = "POST" fullword wide
        $s1 = "ELVL" fullword wide
        $s2 = /SUP\d{3}/ fullword wide
        $s3 = { 41 31 47 ?? 41 2b }
    condition:
        uint16(0) == 0x5a4d and all of ($x*) and 1 of ($s*)
}

rule MALWARE_Win_Ratty {
    meta:
        author = "ditekshen"
        description = "Detects Ratty Java RAT"
    strings:
        $s1 = "/rat/RattyClient.class" ascii
        $s2 = "/rat/ActiveConnection.class" ascii
        $s3 = "/rat/attack/" ascii
        $s4 = "/rat/gui/swing/Ratty" ascii
        $s5 = "/rat/packet/PasswordPacket" ascii
        $s6 = "/rat/packet/" ascii
        $e1 = "/engine/Keyboard.class" ascii
        $e2 = "/engine/IMouseListener.class" ascii
        $e3 = "/engine/Screen$ResizeBehavior.class" ascii
        $e4 = "/engine/fx/ISoundListener.class" ascii
        $e5 = "/engine/net/TCPServer.class"  ascii
        $e6 = "/engine/noise/PerlinNoise.class" ascii
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0xcfd0 or uint16(0) == 0x4b50) and (3 of ($s*) or all of ($e*))
}

rule MALWARE_Win_FatDuke {
    meta:
        author = "ditekSHen"
        description = "Detects FatDuke"
    strings:
        $s1 = "\\\\?\\Volume" fullword ascii
        $s2 = "WINHTTP_AUTOPROXY_OPTIONS@@PAUWINHTTP_PROXY_INFO@@" ascii
        $s3 = "WINHTTP_CURRENT_USER_IE_PROXY_CONFIG@@" ascii
        $s4 = "Cannot write a Cannot find the too long string mber of records Log malfunction! Cannot create ain an invalid ra Internal sync iright function iWaitForSingleObjffsets" ascii
        $pattern = "()$^.*+?[]|\\-{},:=!" ascii
        $b64 = "eyJjb25maWdfaWQiOi" wide
        //$decoded = "{\"config_id\"" base64wide
    condition:
        //uint16(0) == 0x5a4d and (3 of ($s*) or (($b64 or $decoded) and 2 of them) or (#pattern > 3 and 2 of them))
        uint16(0) == 0x5a4d and (3 of ($s*) or ($b64 and 2 of them) or (#pattern > 3 and 2 of them))
}

rule MALWARE_Win_MiniDuke {
    meta:
        author = "ditekSHen"
        description = "Detects MiniDuke"
    strings:
        $s1 = "DefPipe" fullword ascii
        $s2 = "term %5d" fullword ascii
        $s3 = "pid %5d" fullword ascii
        $s4 = "uptime %5d.%02dh" fullword ascii
        $s5 = "login: %s\\%s" fullword ascii
        $s6 = "Software\\Microsoft\\ApplicationManager" ascii
        $s7 = { 69 64 6c 65 ?? 00 73 74 6f 70 ?? 00 61 63 63 65 70 74 ?? 00 63 6f 6e 6e 65 63 74 ?? 00 6c 69 73 74 65 6e ?? 00 }

        $net1 = "salesappliances.com" ascii
        $net2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" fullword ascii
        $net3 = "http://10." ascii
        $net4 = "JiM9t8g7j8KoJkLJlKqka8dbo7q5z4v5u3o4z" ascii
        $net5 = "application/octet-stream" ascii
        $net6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or 4 of ($net*) or 7 of them)
}

rule MALWARE_Win_PolyglotDuke {
    meta:
        author = "ditekSHen"
        description = "Detects PolyGlotDuke"
    strings:
        $s1 = { 48 b9 ff ff ff ff ff ff ff ff 51 48 23 8c 24 ?? 00 00 00 48 89 8C 24 00 00 00 00 }
        $s2 = { 56 be ff ff ff ff 56 81 e6 7f }
        $s3 = { 48 8b 05 19 ?4 4b 00 48 05 48 83 00 00 4c 8b 44 24 50 8b 54 24 48 48 8b }
        //$s4 = { 48 8B 84 24 ?? 00 00 00 48 ?? ?? 24 ?? 00 00 00 48 89 84 24 }
    condition:
        uint16(0) == 0x5a4d and (all of ($s*)) or
         (
                 2 of them and 
                 pe.exports("InitSvc")
        )
}

rule MALWARE_Win_Guidlma {
    meta:
        author = "ditekSHen"
        description = "Detects Guildma"
    strings:
        $v1_1 = "marxvxinhhm98.dll" fullword wide
        $v1_2 = "marxvxinhhmxa.gif" fullword wide
        $v1_3 = "marxvxinhhmxb.gif" fullword wide
        $v1_4 = "c:\\programdata" fullword wide
        $v1_5 = "\\tempa\\" fullword wide
        $v2_1 = "C:\\Windows\\System32\\dllhost.exe" fullword ascii
        $v2_2 = "C:\\Windows\\SysWOW64\\dllhost.exe" fullword ascii
        $v2_3 = "C:\\Users\\Public\\go" fullword ascii
        $v2_4 = ":%:*:/:>:C:H:W:\\:a:p:u:z:" fullword ascii
        $v2_5 = ": :%:*:9:>:C:R:W:\\:k:p:u:" fullword ascii
        $v2_6 = ":*:/:4:C:H:M:\\:a:f:u:z:" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 3 of ($v1*) or 5 of ($v2*)
}

rule MALWARE_Win_CyberGate {
    meta:
        author = "ditekSHen"
        description = "Detects CyberGate/Spyrat/Rebhip RTA"
    strings:
        $s1 = "UnitInjectLibrary" ascii
        $s2 = "TLoader" fullword ascii
        $s3 = "\\\\.\\SyserDbgMsg" fullword ascii
        $s4 = "\\\\.\\SyserBoot" fullword ascii
        $s5 = "\\signons" ascii
        $s6 = "####@####" ascii
        $s7 = "XX-XX-XX-XX" fullword ascii
        $s8 = "EditSvr" ascii
        $s9 = "_x_X_PASSWORDLIST_X_x_" fullword ascii
        $s10 = "L$_RasDefaultCredentials#0" fullword ascii
        $s11 = "password" nocase ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_WSHRATJS {
    meta:
        author = "ditekSHen"
        description = "Detects WSHRAT JS variants"
    strings:
        $charset_full = "us-ascii" nocase ascii
        $charset_begin = "\"us-\"" nocase ascii
        $charset_end = "Array(97,115,99,105,105)" nocase ascii
        $wsc_object1 = "WScript.CreateObject(\"System.Text.UTF8Encoding" nocase ascii
        $wsc_object2 = "WScript.CreateObject(\"Adodb.Stream" nocase ascii
        $wsc_object3 = "WScript.CreateObject(\"Microsoft.XmlDom" nocase ascii
        $s1 = "function(){return" ascii
        $s2 = "}catch(err){" ascii
        $s3 = "{item: \"bin.base64\"}" nocase ascii
        $s4 = "* 1].item =" ascii
    condition:
        filesize < 400KB and ($charset_full or ($charset_begin and $charset_end)) and 2 of ($wsc_object*) and 3 of ($s*)
}

rule MALWARE_Win_AsyncRAT {
    meta:
        author = "ditekSHen"
        description = "Detects AsyncRAT"
    strings:
        $x1 = "AsyncRAT" fullword ascii
        $x2 = "AsyncRAT 0." wide
        $x3 = /AsyncRAT\s[0-9]\.[0-9]\.[0-9][A-Z]/ fullword wide

        $s1 = "/create /sc onlogon /rl highest /tn" fullword wide
        $s2 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
        $s3 = "{{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }}" fullword wide
        $s4 = "Stub.exe" fullword ascii wide
        $s5 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS\\UCKH" ascii wide
        $s6 = "VirtualBox" fullword ascii wide
        $s7 = "/target:winexe /platform:x86 /optimize+" fullword ascii wide
        $s8 = "Win32_ComputerSystem" ascii wide
        $s9 = "Win32_Process Where ParentProcessID=" ascii wide
        $s10 = "etirWgeR.llehShsW" ascii wide
        $s11 = "usbSpread" fullword ascii wide

        $cnc1 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0" fullword ascii wide
        $cnc2 = "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1" fullword ascii wide
        $cnc3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" fullword ascii wide
        $cnc4 = "POST / HTTP/1.1" fullword ascii wide
    condition:
        ((uint16(0) == 0x5a4d and filesize < 4000KB) and (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))) or (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))
}

rule MALWARE_Win_QuilClipper {
    meta:
        author = "ditekSHen"
        description = "Detects QuilClipper variants mostly in memory or extracted AutoIt script"
    strings:
        $cnc1 = "QUILCLIPPER by" ascii
        $cnc2 = "/ UserName:" ascii
        $cnc3 = "/ System:" ascii
        $s1 = "DLLCALL ( \"kernel32.dll\" , \"handle\" , \"CreateMutexW\" , \"struct*\"" ascii
        $s2 = "SHELLEXECUTE ( @SCRIPTFULLPATH , \"\" , \"\" , FUNC_" ascii
        $s3 = "CASE BITROTATE" ascii
        $s4 = "CASE BITXOR" ascii
        $s5 = "CLIP( FUNC_" ascii
        $s6 = "CLIPPUT (" ascii
        $s7 = "FUNC _CLIPPUTFILE(" ascii
        $s8 = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Schedule" ascii
    condition:
        all of ($cnc*) or all of ($s*)
}

rule MALWARE_Win_SpyEye {
    meta:
        author = "ditekSHen"
        description = "Detects SpyEye"
    strings:
        $x1 = "_CLEANSWEEP_" ascii wide
        $x2 = "config.datUT" fullword ascii
        $x3 = "webinjects.txtUT" fullword ascii
        $s1 = "confirm:processCommand" fullword ascii
        $s2 = "Smth wrong with navigate to REF-PAGE (err code: %d). 0_o" fullword ascii
        $s3 = "(UTC%s%2.2f) %s" fullword wide
        $s4 = "M\\F;u`r" fullword ascii
        $s5 = "]YH0%Yn" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)))
}

// requires Yara v4.0.2+
rule MALWARE_Win_Renamer {
    meta:
        author = "ditekSHen"
        description = "Detects Renamer/Tainp variants"
    strings:
        $s1 = "shell\\open\\command=" fullword wide
        $s2 = "icon=%SystemRoot%\\system32\\SHELL32.dll,4" fullword wide
        $s3 = "DropTarget" ascii
        $s4 = "C:\\Windows\\Paint" fullword wide
        $s5 = "hold.inf" fullword wide
        $s6 = "Dropped" ascii
    condition:
        uint16(0) == 0x5a4d and all of ($s*) or 
        (
            4 of ($s*) and
            for any directory in pe.data_directories : 
            (
                directory.virtual_address != 0 and
                directory.size == 0
            )
        )
}

rule MALWARE_Win_Epsilon {
    meta:
        author = "ditekSHen"
        description = "Detects Epsilon ransomware"
    strings:
        $s1 = ".Speak \"" wide
        $s2 = "chkUpdateRegistry" fullword wide
        $s3 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
        $s4 = "CreateObject(\"sapi.spvoice\")" fullword wide
        $s5 = "READ_ME.hta" wide
        $s6 = "WScript.Sleep(" wide
        $s7 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
        $s8 = "<div class='bold'>Files are encrypted* but not deleted.</div>" ascii
        $e1 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 2e 00 65 00
                78 00 65 00 00 09 2e 00 74 00 78 00 74 00 00 09
                2e 00 64 00 6f 00 63 00 00 0b 2e 00 64 00 6f 00
                63 00 78 00 00 09 2e 00 78 00 6c 00 73 00 00 0d
                2e 00 69 00 6e 00 64 00 65 00 78 00 00 09 2e 00
                70 00 64 00 66 00 00 09 2e 00 7a 00 69 00 70 00
                00 09 2e 00 72 00 61 00 72 00 00 09 2e 00 63 00
                73 00 73 00 00 09 2e 00 6c 00 6e 00 6b 00 00 0b
                2e 00 78 00 6c 00 73 00 78 00 00 09 2e 00 70 00
                70 00 74 00 00 0b 2e 00 70 00 70 00 74 00 78 00
                00 09 2e 00 6f 00 64 00 }
        $e2 = { 68 00 74 00 6d 00 00 07 2e 00 6d 00 6c 00 00 07
                43 00 3a 00 5c 00 00 07 44 00 3a 00 5c 00 00 07
                45 00 3a 00 5c 00 00 07 46 00 3a 00 5c 00 00 07
                47 00 3a 00 5c 00 00 07 5a 00 3a 00 5c 00 00 07
                41 00 3a 00 5c 00 00 0f 63 00 6d 00 64 00 2e 00
                65 00 78 00 65 }
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or (all of ($e*) and 4 of ($s*)))
}

rule MALWARE_Win_CoreBot {
    meta:
        author = "ditekSHen"
        description = "Detects CoreBot"
        snort_sid = "920211-920212"
    strings:
        $f1 = "core.cert_fp" fullword ascii
        $f2 = "core.crash_handler" fullword ascii
        $f3 = "core.delay" fullword ascii
        $f4 = "core.guid" fullword ascii
        $f5 = "core.inject" fullword ascii
        $f6 = "core.installed_file" fullword ascii
        $f7 = "core.plugins_dir" fullword ascii
        $f8 = "core.plugins_key" fullword ascii
        $f9 = "core.safe_mode" fullword ascii
        $f10 = "core.server" fullword ascii
        $f11 = "core.servers" fullword ascii
        $f12 = "core.test_env" fullword ascii
        $f13 = "core.vm_detect" fullword ascii
        $f14 = "core.vm_detect_skip" fullword ascii
        $s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko" fullword wide
        $s2 = "\\Microsoft\\Windows\\AppCache" wide
        $s3 = "crash_flag" fullword wide
        $s4 = "container.dat" fullword wide
        $s5 = "INJECTED" fullword ascii
        $s6 = "tmp.delete_file" fullword ascii
        // variant
        $x1 = "CoreBot v" wide
        $x2 = "BotName" fullword ascii
        $x3 = "RunBotKiller" fullword ascii
        $x4 = "botv" fullword ascii
        $x5 = "\\CoreBot\\CoreBot\\obj\\" ascii
        $v1_1 = "newtask" fullword wide
        $v1_2 = "drivers\\etc\\hosts" fullword wide
        $v1_3 = "/C schtasks /create /tn \\" wide
        $v1_4 = "/st 00:00 /du 9999:59 /sc once /ri 1 /f" wide
        $v1_5 = "AntivirusInstalled" fullword ascii
        $v1_6 = "payload" fullword ascii
        $v1_7 = "DownloadFile" fullword ascii
        $v1_8 = "RemoveFile" fullword ascii
        $v1_9 = "AutoRunName" fullword ascii
        $v1_10 = "EditHosts" fullword ascii
        $v1_11 = /127\.0\.0\.1 (avast|mcafee|eset|avira|bitdefender|bullguard|safebrowse)\.com/ fullword wide
        $cnc1 = "&os=" fullword wide
        $cnc2 = "&pv=" fullword wide
        $cnc3 = "&ip=" fullword wide
        $cnc4 = "&cn=" fullword wide
        $cnc5 = "&lr=" fullword wide
        $cnc6 = "&ct=" fullword wide
        $cnc7 = "&bv=" fullword wide
        $cnc8 = "&op=" fullword wide
        $cnc9 = "&td=" fullword wide
        $cnc10 = "&uni=" fullword wide
    condition:
        uint16(0) == 0x5a4d and (5 of ($f*) or all of ($s*) or (3 of ($s*) and 2 of ($f*)) or 3 of ($x*) or 8 of ($v1*) or (4 of ($cnc*) and 4 of ($v1*)) or 12 of them)
}

rule MALWARE_Win_DLLLoader {
    meta:
        author = "ditekSHen"
        description = "Detects unknown DLL Loader"
    strings:
        $s1 = "LondLibruryA" fullword ascii
        $s2 = "LdrLoadDll" fullword ascii
        $s3 = "snxhk.dll" fullword ascii
        $s4 = "DisableThreadLibraryCalls" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Farfli {
    meta:
        author = "ditekSHen"
        description = "Detects Farfli backdoor"
    strings:
        $s1 = "%ProgramFiles%\\Google\\" fullword ascii
        $s2 = "%s\\%d.bak" fullword ascii
        $s3 = "%s Win7" fullword ascii
        $s4 = "%s:%d:%s" fullword ascii
        $s5 = "C:\\2.txt" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Warezov {
    meta:
        author = "ditekSHen"
        description = "Detects Warezov worm/downloader"
    strings:
        $s1 = "ft\\Windows\\CurrentVersion\\Run" wide
        $s2 = "DIR%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $s3 = "%WINDIR%\\sqhos32.wmf" wide
        $s4 = "Accept: */*" fullword ascii
        $s5 = "Range: bytes=" fullword ascii
        $s6 = "module.exe" fullword ascii
        $s7 = { 25 73 25 73 2e 25 73 ?? ?? 22 22 26 6c 79 79 56 00 00 00 00 25 73 25 30 34 64 25 30 32 64 25 30 32 64 00 }
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Arechclient2 {
    meta:
        author = "ditekSHen"
        description = "Detects Arechclient2 RAT"
    strings:
        $s1 = "\\Google\\Chrome\\User Data\\copiedProf\"" wide
        $s2 = "\",\"BotName\":\"" wide
        $s3 = "\",\"BotOS\":\"" wide
        $s4 = "\",\"URLData\":\"" wide
        $s5 = "{\"Type\":\"ConnectionType\",\"ConnectionType\":\"Client\",\"SessionID\":\"" wide
        $s6 = "{\"Type\":\"TestURLDump\",\"SessionID\":\"" wide
        $s7 = "<ReceiveParticipantList>" ascii
        $s8 = "<potocSkr>" ascii
        $s9 = "fuck_sd" fullword ascii
        $s10 = "HandleBotKiller" fullword ascii
        $s11 = "RunBotKiller" fullword ascii
        $s12 = "ConnectToServer" fullword ascii
        $s13 = "KillBrowsers" fullword ascii
        $s14 = "keybd_event" fullword ascii
        $s15 = "FuckCodeImg" fullword ascii
        $v1_1 = "grabber@" fullword ascii
        $v1_2 = "<BrowserProfile>k__" ascii
        $v1_3 = "<SystemHardwares>k__" ascii
        $v1_4 = "<geoplugin_request>k__" ascii
        $v1_5 = "<ScannedWallets>k__" ascii
        $v1_6 = "<DicrFiles>k__" ascii
        $v1_7 = "<MessageClientFiles>k__" ascii
        $v1_8 = /<Scan(Browsers|Wallets|Screen|VPN)>k__BackingField/ fullword ascii
        $v1_9 = "displayName[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}Local Extension Settingshost" wide
        $v1_10 = "\\sitemanager.xml MB or SELECT * FROM Cookiesconfig" wide
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or 7 of ($v1*) or (6 of ($v1*) and 1 of ($s*)))
}

rule MALWARE_Win_KillMBR {
    meta:
        author = "ditekSHen"
        description = "Detects KillMBR"
    strings:
        $s1 = "\\\\.\\PhysicalDrive" ascii
        $s2 = "/logger.php" ascii
        $s3 = "Ooops! Your MBR was been rewritten" ascii
        $s4 = "No, this ransomware dont encrypt your files, erases it" ascii
    condition:
        uint16(0) == 0x5a4d and (2 of them and #s1 > 10)
}

rule MALWARE_Win_LCPDot {
    meta:
        author = "ditekSHen"
        description = "Detects LCPDot"
    strings:
        $s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
        $s2 = "Cookie: SESSID=%s" fullword ascii
        $s3 = "Cookie=Enable" fullword ascii
        $s4 = "Cookie=Enable&CookieV=%d&Cookie_Time=32" fullword ascii
        $s5 = ".?AVTShellCodeRuner@@" fullword ascii
        $s6 = ".?AVTHashEncDecoder@@" fullword ascii
        $s7 = ".?AVTWebAddressList@@" fullword ascii
        $s8 = "WinMain.dll" fullword ascii
        $s9 = "HotPlugin" wide
        $o0 = { 4c 89 6c 24 08 4c 89 34 24 44 8d 77 01 44 8d 6f }
        $o1 = { 8b f0 e8 58 34 00 00 48 8b f8 48 85 c0 74 0c 48 }
        $o2 = { c7 44 24 30 47 49 46 38 c7 44 24 34 39 61 27 00 }
    condition:
        uint16(0) == 0x5a4d and 6 of ($s*) or (all of ($o*) and 3 of ($s*))
}

rule MALWARE_Win_Torisma {
    meta:
        author = "ditekSHen"
        description = "Detects Torisma"
    strings:
        $s1 = "ACTION=PREVPAGE&CODE=C%s&RES=%d" fullword ascii
        $s2 = "ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d" fullword ascii
        $s3 = "ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%d" fullword ascii
        $s4 = "Your request has been accepted. ClientID: {" ascii
        $s5 = "Proxy-Connection: Keep-Alive" fullword wide
        $s6 = "Content-Length: %d" fullword wide
        $o0 = { f7 f9 8b c2 89 44 24 34 48 63 44 24 34 48 8b 4c }
        $o1 = { 48 c7 00 ff ff ff ff 48 8b 84 24 90 }
        $o2 = { f3 aa 83 7c 24 30 01 75 34 c7 44 24 20 01 }
    condition:
        uint16(0) == 0x5a4d and 4 of ($s*) or (all of ($o*) and 3 of ($s*))
}

rule MALWARE_Win_Thanos {
    meta:
        author = "ditekSHen"
        description = "Detects Thanos / Prometheus / Spook ransomware"
    strings:
        $f1 = "<WorkerCrypter2>b__" ascii
        $f2 = "<Encrypt2>b__" ascii
        $f3 = "<Killproc>b__" ascii
        $f4 = "<GetIPInfo>b__" ascii
        $f5 = "<MacAddress>k__" ascii
        $f6 = "<IPAddress>k__" ascii
        $f7 = "<Crypt>b__" ascii
        $s1 = "Aditional KeyId:" wide
        $s2 = "process call create cmd.exe /c \\\\" wide
        $s3 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide
        $s4 = "\\HOW_TO_DECYPHER_FILES." wide
        $s5 = "Client Unique Identifier Key:" wide
        $s6 = "/s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk" fullword wide
        $s7 = "NtOpenProcess" fullword wide
        $s8 = "Builder_Log" fullword wide
        $s9 = "> Nul & fsutil file setZeroData offset=0 length=" wide
        $s10 = "3747bdbf-0ef0-42d8-9234-70d68801f407" wide // mutex
        $s11 = "4b195894-0f06-4fdd-afb4-b17fb9246a59" wide
        $s12 = "cec564ff-2433-4771-b918-15f58ef6e26c" wide
        $s13 = "56258a19-7489-468b-86ee-e7899203d67c" wide
        $s14 = "WalkDirectoryTree" fullword ascii
        $s15 = "hashtableLock" fullword ascii
        $s16 = "get_ParentFrn" fullword ascii
        $m1 = "SW5mb3JtYXRpb24uLi" wide
        $m2 = "QWxsIHlvdXIgZmlsZXMgd2VyZSBlbmNyeXB0" wide
    condition:
        uint16(0) == 0x5a4d and (5 of ($f*) or 5 of ($s*) or (4 of ($f*) and 2 of ($s*) or (all of ($m*) and 3 of them)) or 8 of them)
}

rule MALWARE_Win_TManager {
    meta:
        author = "ditekSHen"
        description = "Detects TManager RAT. Associated with TA428"
    strings:
        $s1 = "WSAStartup Error!" fullword wide
        $s2 = "KB3112342.LOG" fullword wide
        $s3 = "\\cmd.exe -c" fullword wide
        $s4 = "sock_hmutex" fullword wide
        $s5 = "cmd_hmutex" fullword wide
        $s6 = "powershell" fullword wide
        $s7 = "%s_%d.bmp" fullword wide
        $s8 = "!Error!" fullword wide
        $s9 = "[Execute]" fullword ascii
        $s10 = "[Snapshot]" fullword ascii
        $s11 = "GetLanIP error!" fullword ascii
        $s12 = "chcp & exit" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_Sn0wLogger {
    meta:
        author = "ditekSHen"
        description = "Detects Sn0w Logger"
    strings:
        $s1 = "\\SnowP\\Example\\Secured\\" ascii
        $s2 = "{0}{3}Content-Type: {4}{3}Content-Disposition: form-data; name=\"{1}\"{3}{3}{2}{3}" wide
        $s3 = "\"encrypted_key\":\"(.*?)\"" fullword wide
        $s4 = "<SendToDiscord>d__" ascii
        $s5 = "_urlWebhook" ascii
        $r1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword wide
        $r2 = "^\\w+([-+.']\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*$" fullword wide
        $r3 = "mfa\\.[\\w-]{84}" fullword wide
        $r4 = "(\\w+)=(\\d+)-(\\d+)$" fullword wide
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or (all of ($r*) and 2 of ($s*)) or 7 of them)
}

rule MALWARE_Win_DanaBot {
    meta:
        author = "ditekSHen"
        description = "Detects DanaBot variants"
    strings:
        $s1 = "ms ie ftp passwords" fullword wide
        $s2 = "CookieEntryEx_" fullword wide
        $s3 = "winmgmts:\\\\localhost\\root\\cimv2" fullword wide
        $s4 = "S-Password.txt" fullword wide
        $s5 = "del_ini://Main|Password|" fullword wide
        $s6 = "cmd.exe /c start chrome.exe --no-sandbox" wide
        $s7 = "cmd.exe /c start firefox.exe -no-remote" wide
        $s8 = "\\rundll32.exe shell32.dll,#" wide
        $s9 = "S_Error:TORConnect" wide
        $s10 = "InjectionProcess" fullword ascii
        $s11 = "proxylogin" fullword wide
        $s12 = "\\FS_Morff\\FS_Temp\\" wide
        $ds1 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
        $ds2 = "PExtended4" fullword ascii
        $ds3 = "%s-%s" fullword wide
        $ds4 = "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF" fullword wide
        //$o1 = { 55 8b ec 33 c0 55 68 d7 60 4f 00 64 ff 30 64 89 }
        //$o2 = { e8 45 ec f0 ff e8 3c e2 f0 ff 68 00 04 00 00 e8 }
        //$o3 = { e8 98 3a f2 ff 84 c0 74 0a 8d 44 24 0c 50 e8 fe }
        //$o4 = { ba 80 d7 4f 00 a1 54 90 4f 00 e8 7e 4a f1 ff e9 }
        //$o5 = { 80 bc 24 4a 01 00 00 01 75 14 ba 80 d7 4f 00 a1 }
        //$o6 = { ba 80 d7 4f 00 a1 80 8f 4f 00 e8 4c 4a f1 ff e9 }
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or all of ($ds*))
}

rule MALWARE_Win_Klackring {
    meta:
        author = "ditekSHen"
        description = "Detects Klackring variants. Associated with ZINC / Lazarus"
    strings:
        $s1 = "%s\\%s.dll" fullword wide
        $s2 = "cmd.exe /c move /Y %s %s" fullword wide
        $s3 = "%s\\win32k.sys" fullword wide
        $s4 = "NetSvcInst_Rundll32.dll" fullword ascii
        $s5 = "Spectrum.dll" fullword ascii wide
        $s6 = "%s\\cmd.exe" fullword wide
        $s7 = ".?AVA5Stream@@" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_ComeBacker {
    meta:
        author = "ditekSHen"
        description = "Detects ComeBacker variants. Associated with ZINC / Lazarus"
    strings:
        $s1 = "ENGINE_get_RAND" ascii
        $s2 = "./{IES" fullword ascii
        $s3 = "TODO: <Company name>" fullword wide
        $s4 = "@Microsoft Corperation. All rights reserved." fullword wide
        $s5 = "Microsoft@Windows@Operating System" fullword wide
        $x1 = "C:\\Windows\\System32\\rundll32.exe %s,%s %s %s" fullword ascii wide
        $x2 = "ASN2_TYPE_new" fullword ascii wide
        $x3 = "SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or all of ($x*))
}

rule MALWARE_Win_SunCrypt {
    meta:
        author = "ditekSHen"
        description = "Detects SunCrypt ransomware"
    strings:
        $s1 = "-noshares" fullword wide
        $s2 = "-nomutex" fullword wide
        $s3 = "-noreport" fullword wide
        $s4 = "-noservices" fullword wide
        $s5 = "$Recycle.bin" fullword wide
        $s6 = "YOUR_FILES_ARE_ENCRYPTED.HTML" fullword wide
        $s7 = "\\\\?\\%c:" fullword wide
        $s8 = "locker.exe" fullword ascii
        $s9 = "DllRegisterServer" fullword ascii
        $g1 = "main.EncFile" fullword ascii nocase
        $g2 = "main.detectName" fullword ascii nocase
        $g3 = "main.detectIP" fullword ascii nocase
        $g4 = "main.detectDebugProc" fullword ascii nocase
        $g5 = "main.Bypass" ascii nocase
        $g6 = "main.allocateMemory" fullword ascii nocase
        $g7 = "main.killAV" fullword ascii nocase
        $g8 = "main.disableShadowCopy" fullword ascii nocase
        $g9 = "main.(*windowsDrivesModel).LoadDrives" fullword ascii nocase
        $g10 = "main.IsFriends" fullword ascii nocase
        $g11 = "main.walkMsg" fullword ascii nocase
        $g12 = "main.makeSecretMessage" fullword ascii nocase
        $g13 = "main.stealFiles" fullword ascii nocase
        $g14 = "main.newKey" fullword ascii nocase
        $g15 = "main.openBrowser" fullword ascii nocase
        $g16 = "main.killProc" fullword ascii nocase
        $g17 = "main.selfRemove" fullword ascii nocase
        $m1 = "<h2>\\x20Offline\\x20HowTo\\x20</h2>\\x0a\\x09\\x09\\x09\\x09<p>Copy\\x20&\\x20Paste\\x20this\\x20message\\x20to" ascii
        $m2 = "\\x20restore\\x20your\\x20files." ascii
        $m3 = "\\x20your\\x20documents\\x20and\\x20files\\x20encrypted" ascii
        $m4 = "\\x20lose\\x20all\\x20of\\x20your\\x20data\\x20and\\x20files." ascii
        $m5 = ",'/#/client/','<h2>\\x20Whats\\x20Happen" ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or 6 of ($g*) or 3 of ($m*))
}

rule MALWARE_Win_Zegost {
    meta:
        author = "ditekSHen"
        description = "Detects Zegost"
    strings:
        $s1 = "rtvscan.exe" fullword ascii
        $s2 = "ashDisp.exe" fullword ascii
        $s3 = "KvMonXP.exe" fullword ascii
        $s4 = "egui.exe" fullword ascii
        $s5 = "avcenter.exe" fullword ascii
        $s6 = "K7TSecurity.exe" fullword ascii
        $s7 = "TMBMSRV.exe" fullword ascii
        $s8 = "RavMonD.exe" fullword ascii
        $s9 = "kxetray.exe" fullword ascii
        $s10 = "mssecess.exe" fullword ascii
        $s11 = "QUHLPSVC.EXE" fullword ascii
        $s12 = "360tray.exe" fullword ascii
        $s13 = "QQPCRTP.exe" fullword ascii
        $s14 = "knsdtray.exe" fullword ascii
        $s15 = "V3Svc.exe" fullword ascii
        $s16 = "??1_Winit@std@@QAE@XZ" fullword ascii
        $s17 = "ClearEventLogA" fullword ascii
        $s18 = "SeShutdownPrivilege" fullword ascii
        $s19 = "%s\\shell\\open\\command" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_GENERIC01 {
    meta:
        author = "ditekSHen"
        description = "Detects known unamed malicious executables, mostly DLLs"
    strings:
        $s1 = "\\wmkawe_%d.data" ascii
        $s2 = "\\resmon.resmoncfg" ascii
        $s3 = "ByPassUAC" fullword ascii
        $s4 = "rundll32.exe C:\\ProgramData\\Sandboxie\\SbieMsg.dll,installsvc" fullword ascii nocase
        $s5 = "%s\\SbieMsg." ascii
        $s6 = "Stupid Japanese" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_GENERIC02 {
    meta:
        author = "ditekSHen"
        description = "Detects known unamed malicious executables"
    strings:
        $s1 = "{%s-%d-%d}" fullword wide
        $s2 = "update" fullword wide
        $s3 = "https://" fullword wide
        $s4 = "http://" fullword wide
        $s5 = "configure" fullword ascii
        $s6 = { 8d 4f 02 e8 8c ff ff ff 8b d8 81 fb 00 dc 00 00 }
        $s7 = { 83 c1 02 e8 3c ff ff ff 8b c8 ba ff 03 00 00 8d }
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_DLAgent06 {
    meta:
      author = "ditekSHen"
      description = "Detects known downloader agent downloading encoded binaries in patches"
      snort2_sid = "920122"
      snort3_sid = "920119"
    strings:
        $s1 = "totallist" fullword ascii wide
        $s2 = "LINKS_HERE" fullword wide
        $s3 = "[SPLITTER]" fullword wide
        $var2_1 = "DownloadWeb" fullword ascii
        $var2_2 = "WriteByte" fullword ascii
        $var2_3 = "MemoryStream" fullword ascii
        $var2_4 = "DownloadString" fullword ascii
        $var2_5 = "WebClient" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($s*) and 2 of ($var2*)) or (4 of ($var2*) and 2 of ($s*)))
}

rule MALWARE_Win_PWSH_PoshKeylogger {
    meta:
      author = "ditekSHen"
      description = "Detects PowerShell PoshKeylogger"
    strings:
        $s1 = "::GetKeyboardState" ascii
        $s2 = "GetAsyncKeyState(" ascii
        $s3 = "::MapVirtualKey(" ascii
        $s4 = "::GetAsyncKeyState" ascii
        $s5 = "Start-Sleep" ascii
        $s6 = "send-mailmessage" ascii
        $s7 = "[System.IO.File]::AppendAllText($" ascii
        $s8 = "new-object Management.Automation.PSCredential $" ascii
    condition:
        6 of them
}

rule MALWARE_Win_FujinamaRAT {
    meta:
      author = "ditekSHen"
      description = "Detects FujinamaRAT"
      snort2_sid = "920124"
      snort3_sid = "920121"
    strings:
       $s1 = "GetAsyncKeyState" fullword ascii
       $s2 = "HTTP/1.0" fullword wide
       $s3 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" fullword wide
       $s4 = "frmMain" fullword ascii
       $s5 = "G<=>?@ABGGGGGGGGGGGGGGGGGGGGGGGGGGCDEF" fullword ascii
       $s6 = "VBA6.DLL" fullword ascii
       $s7 = "t_save" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_Phorpiex {
    meta:
      author = "ditekSHen"
      description = "Detects Phorpiex variants"
    strings:
       $s1 = "ShEllExECutE=__\\DriveMgr.exe" fullword wide nocase
       $s2 = "/c start __ & __\\DriveMgr.exe & exit" fullword wide nocase
       $s3 = "%s\\autorun.inf" fullword wide
       $s4 = "svchost." wide
       $s5 = "%ls\\%d%d" wide
       $s6 = "bitcoincash:" ascii
       $s7 = "%ls:*:Enabled:%ls" fullword wide
       $s8 = "%s\\%s\\DriveMgr.exe" fullword wide
       $s9 = "api.wipmania.com" ascii
       $v1_1 = "%appdata%" fullword wide
       $v1_2 = "(iPhone;" ascii
       $v1_3 = "/tst.php" ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or all of ($v1*))
}

rule MALWARE_Win_EXEPWSH_DLAgent {
    meta:
        author = "ditekSHen"
        description = "Detects SystemBC"
    strings:
        $pwsh = "powershell" fullword ascii
        $bitstansfer = "Start-BitsTransfer" ascii wide
        $s1 = "GET %s HTTP/1" ascii
        $s2 = "User-Agent:" ascii
        $s3 = "-WindowStyle Hidden -ep bypass -file \"" fullword ascii
        $s4 = "LdrLoadDll" fullword ascii
        $v1 = "BEGINDATA" fullword ascii
        $v2 = /HOST\d:/ ascii
        $v3 = /PORT\d:/ ascii
        $v4 = "TOR:" fullword ascii
        $v5 = "Fwow64" fullword ascii
        $v6 = "start" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (($pwsh and ($bitstansfer or 2 of ($s*))) or (5 of ($v*)))
}

rule MALWARE_Win_HDLocker {
    meta:
        author = "ditekSHen"
        description = "Detects HDLocker ransomware"
    strings:
        $s1 = "HDLocker_" fullword ascii
        $s2 = ".log" fullword ascii
        $s3 = "Scripting.FileSystemObject" fullword ascii
        $s4 = "Boot" fullword ascii
        $s5 = "hellwdo" fullword ascii
        $s6 = "blackmoon" fullword ascii
        $s7 = "BlackMoon RunTime Error:" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_Vovalex {
    meta:
        author = "ditekSHen"
        description = "Detects Vovalex ransomware"
    strings:
        $s1 = "README.VOVALEX.txt" fullword ascii
        $s2 = "\\src\\phobos\\std\\" ascii
        $s3 = "LoadLibraryA(\"Advapi32.dll\")" fullword ascii
        $s4 = "Failed to spawn process \"" fullword ascii
        $s5 = "=== Bypassed ===" fullword ascii
        $s6 = "If you don't know where to buy" ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Dharma {
    meta:
        author = "ditekSHen"
        description = "Detects Dharma ransomware"
    strings:
        $s1 = "C:\\crysis\\Release\\PDB\\payload.pdb" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_CryptoLocker {
    meta:
        author = "ditekSHen"
        description = "Detects Cryptolocker ransomware variants (Betarasite)"
    strings:
        $x1 = "CryptoLocker" fullword wide
        $x2 = ".betarasite" fullword wide
        $x3 = "CMSTPBypass" fullword ascii
        $s1 = "CommandToExecute" fullword ascii
        $s2 = "SetInfFile" fullword ascii
        $s3 = "SchoolPrject1" ascii
        $s4 = "$730d5f64-bd57-47c1-9af4-d20aec714d02" fullword ascii
        $s5 = "Encrypt" fullword ascii
        $s6 = "Invalide Key! Please Try Again." fullword wide
        $s7 = "RegAsm" fullword wide
        $s8 = "Your key will be destroyed" wide
        $s9 = "encrypted using RC4 and RSA-2048" wide
        $c1 = "https://coinbase.com" fullword wide
        $c2 = "https://localbictoins.com" fullword wide
        $c3 = "https://bitpanda.com" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or all of ($s*) or (2 of ($x*) and 5 of ($s*)) or (all of ($c*) and 1 of ($x*) and 2 of ($s*)))
}

rule MALWARE_Win_PWSH_PoshWiFiStealer {
    meta:
        author = "ditekSHen"
        description = "Detects PowerShell PoshWiFiStealer"
    strings:
        $s1 = "netsh wlan export profile" ascii
        $s2 = "Send-MailMessage" ascii
        $u1 = "https://github.com/axel05869/Wifi-Grab" ascii
        $u2 = "/exploitechx/wifi-password-extractor" ascii
    condition:
        all of ($s*) or all of ($u*)
}

rule MALWARE_Win_SteamHook {
    meta:
        author = "ditekSHen"
        description = "Detects potential Steam stealer"
    strings:
        $s1 = "Mozilla/4.0 (compatible; )" fullword ascii
        $s2 = "/steam/upload.php" ascii
        $s3 = ".*?(ssfn\\d+)" fullword ascii
        $s4 = "add cookie failed..." fullword ascii
        $s5 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
        $pdb1 = "\\SteamHook\\Install\\" ascii
        $pdb2 = "\\SteamHook\\dll\\" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or all of ($pdb*) or (1 of ($pdb*) and 3 of ($s*)))
}

rule MALWARE_Win_NetWire {
    meta:
        author = "ditekSHen"
        description = "Detects NetWire RAT"
    strings:
        $x1 = "SOFTWARE\\NetWire" fullword ascii
        $x2 = { 4e 65 74 57 69 72 65 00 53 4f 46 54 57 41 52 45 5c 00 }
        $s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
        $s2 = "filenames.txt" fullword ascii
        $s3 = "GET %s HTTP/1.1" fullword ascii
        $s4 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
        $s5 = "Host.exe" fullword ascii
        $s6 = "-m \"%s\"" fullword ascii
        $g1 = "HostId" fullword ascii
        $g2 = "History" fullword ascii
        $g3 = "encrypted_key" fullword ascii
        $g4 = "Install Date" fullword ascii
        $g5 = "hostname" fullword ascii
        $g6 = "encryptedUsername" fullword ascii
        $g7 = "encryptedPassword" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or all of ($x*) or (1 of ($x*) and 2 of ($s*)) or (all of ($g*) and (2 of ($s*) or 1 of ($x*))))
}

rule MALWARE_Win_BreakStaf {
    meta:
        author = "ditekSHen"
        description = "Detects BreakStaf ransomware"
    strings:
        $s1 = "C:\\Program files" wide
        $s2 = "C:\\Program files (x86)" wide
        $s3 = "C:\\System Volume Information" wide
        $s4 = "C:\\$Recycle.Bin" wide
        $s5 = "C:\\Windows" wide
        $s6 = ".?AVRandomNumberGenerator@Crypto" ascii
        $s7 = ".?AV?$SymmetricCipherFinal@" ascii
        $s8 = ".breakstaf" fullword wide nocase
        $s9 = "readme.txt" fullword wide nocase
        $s10 = ".VHD" fullword wide nocase
        $s11 = ".vhdx" fullword wide nocase
        $s12 = ".BAK" fullword wide nocase
        $s13 = ".BAC" fullword wide nocase
    condition:
        uint16(0) == 0x5a4d and 12 of them
}

rule MALWARE_Win_Kitty {
    meta:
        author = "ditekSHen"
        description = "Detects HelloKitty ransomware, triggers on FIVEHANDS"
    strings:
        $s1 = "Kitty" wide
        $s2 = "-path" fullword wide
        $s3 = "select * from Win32_ShadowCopy" fullword wide
        $s4 = "Win32_ShadowCopy.ID='%s'" fullword wide
        $s5 = "programdata" fullword wide
        $s6 = "$recycle.bin" fullword wide
        $s7 = ".crypt" fullword wide
        $s8 = "%s/secret/%S" wide
        $s9 = "decrypts3nln3tic.onion" wide
        $n1 = "read_me_lkd.txt" wide
        $n2 = "DECRYPT_NOTE.txt" wide
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or 1 of ($n*) and 4 of ($s*))
}

rule MALWARE_Win_DLAgent07 {
    meta:
        author = "ditekSHen"
        description = "Detects delf downloader agent"
    strings:
        $s1 = "C:\\Users\\Public\\Libraries\\temp" fullword ascii
        $s2 = "SOFTWARE\\Borland\\Delphi" ascii
        $s3 = "Mozilla/5.0(compatible; WinInet)" fullword ascii
        $o1 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 40 }
        $o2 = { e8 83 d5 ff ff 8b 15 34 40 41 00 89 10 89 58 04 }
        $o3 = { c3 8b c0 53 51 e8 f1 ff ff ff 8b d8 85 db 74 3e }
        $o4 = { e8 5c e2 ff ff 8b c3 e8 b9 ff ff ff 89 04 24 83 }
        $o5 = { 85 c0 74 1f e8 62 ff ff ff a3 98 40 41 00 e8 98 }
        $o6 = { 85 c0 74 19 e8 be ff ff ff 83 3d 98 40 41 00 ff }
        $x1 = "22:40:08        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\"" ascii
        $x2 = "uuid:A9BD8E384B2FDE118D26E6EE744C235C\" stRef:documentID=\"uuid:A8BD8E384B2FDE118D26E6EE744C235C\"/>" ascii
    condition:
        uint16(0) == 0x5a4d and ((2 of ($s*) and 5 of ($o*)) or (all of ($s*) and 2 of ($o*)) or (all of ($x*) and 2 of them))
}

rule MALWARE_Win_Clop {
    meta:
        author = "ditekSHen"
        description = "Detects Clop ransomware variants"
    strings:
        $x1 = "Cllp^_-" ascii
        $s2 = "temp.dat" fullword wide
        $s3 = "README_README.txt" wide
        $s4 = "BEGIN PUBLIC KEY" ascii
        $s5 = "runrun" wide
        $s6 = "wevtutil.exe" ascii
        $s7 = "%s%s.Cllp" fullword wide
        $s8 = "WinCheckDRVs" fullword wide
        $o1 = { 6a ff 56 89 9d 28 dd ff ff ff d0 a1 64 32 41 00 }
        $o2 = { 56 89 9d 28 dd ff ff ff 15 78 32 41 00 eb 07 43 }
        $o3 = { 68 ?? 34 41 00 8d 85 58 dd ff ff 50 ff d7 85 c0 }
        $o4 = { 68 d0 34 41 00 50 ff d6 8b bd 28 d5 ff ff 83 c4 }
        $o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b }
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (1 of ($x*) and (3 of ($s*) or 4 of ($o*))) or (all of ($o*) and 2 of ($s*)) or (4 of ($s*) and 4 of ($o*)))
}

rule MALWARE_Win_Maktub {
    meta:
        author = "ditekSHen"
        description = "Detects Maktub ransomware"
    strings:
        $s1 = "Content-Disposition: attachment; filename=" ascii
        $s2 = "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0" fullword ascii
        $s3 = "/tor/status-vote/current/consensus" ascii
        $s4 = "/tor/server/fp/" ascii
        $s5 = "/tor/rendezvous2/" ascii
        $s6 = "404 Not found" fullword ascii
        $s7 = /_request@\d+/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_PWSHLoader_RunPE01 {
    meta:
        author = "ditekSHen"
        description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
    strings:
        $rp1 = "GetType('RunPe.RunPe'" ascii
        $rp2 = "GetType(\"RunPe.RunPe\"" ascii
        $rm1 = "GetMethod('Run'" ascii
        $rm2 = "GetMethod(\"Run\"" ascii
        $s1 = ".Invoke(" ascii
        $s2 = "[Reflection.Assembly]::Load(" ascii
    condition:
        all of ($s*) and 1 of ($rp*) and 1 of ($rm*)
}

rule MALWARE_Win_PWSHLoader_RunPE02 {
    meta:
        author = "ditekSHen"
        description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
    strings:
        $s1 = "'.Replace('" ascii nocase
        $s2 = "'aspnet_compiler.exe'" ascii
        $s3 = "[Byte[]]$" ascii
        $pe1 = "(77,90," ascii
        $pe2 = "='4D5A" ascii
    condition:
        all of ($s*) and (#pe1 > 1 or #pe2 > 1) and #s1 > 4
}

rule MALWARE_Win_PELoader_RunPE {
    meta:
        author = "ditekSHen"
        description = "Detects PE loader / injector. Observed Gorgon TTPs"
    strings:
        $s1 = "commandLine'" fullword ascii
        $s2 = "RunPe.dll" fullword ascii
        $s3 = "HandleRun" fullword ascii
        $s4 = "inheritHandles" fullword ascii
        $s5 = "BlockCopy" fullword ascii
        $s6 = "WriteProcessMemory" fullword ascii
        $s7 = "startupInfo" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_PELoader_INF {
    meta:
        author = "ditekSHen"
        description = "Detects PE loader / injector. Potentical HCrypt. Observed Gorgon TTPs"
    strings:
        $x1 = "Managament.inf" fullword ascii
        $x2 = "rOnAlDo" fullword ascii
        $x3 = "untimeResourceSet" fullword ascii
        $x4 = "3System.Resources.Tools.StronglyTypedResourceBuilder" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_DLAgent08 {
    meta:
      author = "ditekSHen"
      description = "Detects known downloader agent downloading encoded binaries in patches"
      snort2_sid = "920122"
      snort3_sid = "920119"
    strings:
        $pat = /\/base\/[A-F0-9]{32}\.html/ ascii wide
    condition:
        uint16(0) == 0x5a4d and $pat and #pat > 1
}

rule MALWARE_Win_DoejoCrypt {
    meta:
        author = "ditekSHen"
        description = "Detects DoejoCrypt / DearCry ransomware"
    strings:
        $s1 = "DEARCRY!" fullword ascii
        $s2 = ".CRYPT" fullword ascii
        $s3 = "\\EncryptFile -svcV2\\" ascii
        $s4 = "please send me the following hash!" ascii
        $s5 = "dear!!!" fullword ascii
        $s6 = "/readme.txt" fullword ascii
        $o1 = { c3 8b 65 e8 c7 45 fc fe ff ff ff 8b b5 f4 e9 ff }
        $o2 = { 0f 8c 27 ff ff ff 33 db 57 e8 7b 36 00 00 eb 0a }
        $o3 = { 0f 8c 2a ff ff ff 53 57 e8 b7 42 00 00 8b 4c 24 }
    condition:
        uint16(0) == 0x5a4d and 4 of ($s*) or (all of ($o*) and (2 of ($s*)))
}

rule MALWARE_Win_SunShuttle {
    meta:
        author = "ditekSHen"
        description = "Detects SunShuttle / GoldMax"
    strings:
        $s1 = "main.beaconing" fullword ascii
        $s2 = "main.clean_file" fullword ascii
        $s3 = "main.decrypt" fullword ascii
        $s4 = "main.define_internal_settings" fullword ascii
        $s5 = "main.delete_empty" fullword ascii
        $s6 = "main.encrypt" fullword ascii
        $s7 = "main.false_requesting" fullword ascii
        $s8 = "main.removeBase64Padding" fullword ascii
        $s9 = "main.resolve_command" fullword ascii
        $s10 = "main.retrieve_session_key" fullword ascii
        $s11 = "main.save_internal_settings" fullword ascii
        $s12 = "main.send_command_result" fullword ascii
        $s13 = "main.send_file_part" fullword ascii
        $s14 = "main.wget_file" fullword ascii
        $s15 = "main.write_file" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them      
}

rule MALWARE_Win_RanzyLocker {
    meta:
        author = "ditekSHen"
        description = "Detects RanzyLocker / REntS ransomware"
    strings:
        $hr1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii                             // wbadmin DELETE SYSTEMSTATEBACKUP
        $hr2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii                         // wmic.exe SHADOWCOPY /nointeractive
        $hr3 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii   // bcdedit.exe /set {default} recoveryenabled No
        $hr4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii // wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        $hr5 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573" ascii // bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        $hr6 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii               // vssadmin.exe Delete Shadows /All /Quiet
        $hx1 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii        // Global\35355FA5-07E9-428B-B5A5-1C88CAB2B488 (mutex)
        $hx2 = "534F4654574152455C4D6963726F736F66745C45524944" ascii                                               // SOFTWARE\Microsoft\ERID
        $hx3 = "227375626964223A22" ascii // subid
        $hx4 = "226E6574776F726B223A22" ascii // network
        $hx5 = "726561646D652E747874" ascii // readme.txt
        $hx6 = "-nolan" fullword wide
        $o1 = { 8d 45 e9 89 9d 54 ff ff ff 88 9d 44 ff ff ff 3b }
        $o2 = { 8b 44 24 2? 8b ?c 24 34 40 8b 54 24 38 89 44 24 }
        $o3 = { 8b 44 24 2? 8b ?c 24 1c 89 44 24 34 8b 44 24 28 }
        $o4 = { 8b 44 24 2? 8b ?c 24 34 05 00 00 a0 00 89 44 24 }
    condition:
        uint16(0) == 0x5a4d and (all of ($hx*) or (2 of ($hr*) and 2 of ($hx*)) or (all of ($o*) and 2 of ($h*)))
}

rule MALWARE_Win_WobbyChipMBR {
    meta:
        author = "ditekSHen"
        description = "Detects WobbyChipMBR / Covid-21 ransomware"
    strings:
        $x1 = "You became a Victim of the Covid-21 Ransomware" ascii wide
        $x2 = "Reinstalling Windows has been blocked" ascii wide
        $x3 = "Enter Decryption Key:" ascii wide
        $x4 = "encrypted with military grade encryption" ascii wide
        $s1 = "schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR" ascii
        $s2 = "\\EFI\\Boot\\bootx64.efi" ascii wide
        $s3 = "DumpHex" fullword ascii
        $s4 = "TFTP Error" fullword wide
        $s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or all of ($s*) or (1 of ($x*) and 2 of ($s*)))
}

rule MALWARE_Win_Snatch {
    meta:
        author = "ditekSHen"
        description = "Detects Snatch / GoRansome / MauriGo ransomware"
    strings:
        $s1 = "main.encryptFile" ascii
        $s2 = "main.encryptFileExt" ascii
        $s3 = "main.deleteShadowCopy" ascii
        $s4 = "main.Shadow" fullword ascii
        $s5 = "main.RecoverMe" fullword ascii
        $s6 = "main.EncryptWithPublicKey" ascii
        $s7 = "main.EncoderLookupDir" fullword ascii
        $s8 = "main.ALIGNUP" fullword ascii
        $s9 = "main.encrypt" fullword ascii
        $s10 = "github.com/mauri870/ransomware" ascii
        $m1 = "Dear You, ALl Your files On YOUR network computers are encrypted" ascii
        $m2 = "You have to pay the ransom of %s USD in bitcoins to the address" ascii
        $m3 = "REMEMBER YOU FILES ARE IN SAVE HANDS AND WILL BE RESTORED OR RECOVERED ONCE PAYMENT IS DONE" ascii
        $m4 = ":HELP FEEED A CHILD:" ascii
        $m5 = ">SYSTEM NETWORK ENCRYPTED<" ascii
        $m6 = "YOUR IDENTIFICATION : %s" ascii
        $m7 = "convince you of our honesty" ascii
        $m8 = "use TOR browser to talk with support" ascii
        $m9 = "encrypted and attackers are taking" ascii
        $p1 = "/Go/src/kitty/kidrives/" ascii
        $p2 = "/LGoGo/encoder.go" ascii nocase
        $p3 = "/Go/src/kitty/kidata/" ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or 2 of ($m*) or (1 of ($m*) and 1 of ($s*)) or (all of ($p*) and (1 of ($s*) or 1 of ($m*))))
}

rule MALWARE_Win_Meteorite {
    meta:
        author = "ditekSHen"
        description = "Detects Meteorite downloader"
    strings:
        $x1 = "MeteoriteDownloader" fullword ascii wide
        $x2 = "Meteorite Downloader" fullword ascii wide
        $x3 = "Meteorite Downloader v" wide
        $s1 = "regwrite" fullword wide
        $s2 = "urlmon" fullword ascii
        $s3 = "wscript.shell" fullword wide
        $s4 = "modMain" fullword ascii
        $s5 = "VBA6.DLL" fullword ascii
        $s6 = "^_http" ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or (5 of ($s*)))
}

rule MALWARE_Win_LegionLocker {
     meta:
        author = "ditekSHen"
        description = "Detects LegionLocker ransomware"
    strings:
        $m1 = "+Do not run task manager, powershell, cmd etc." ascii wide
        $m2 = "3 hours your files will be deleted." ascii wide
        $m3 = "files have been encrypted by Legion Locker" ascii wide
        $s1 = "passwordBytes" fullword ascii
        $s2 = "_start_enc_" ascii
        $s3 = "_del_desktop_" ascii
        $s4 = "Processhacker" wide
        $s5 = "/k color 47 && del /f /s /q %userprofile%\\" wide
        $s6 = "Submit code" fullword wide
        $pdb1 = "\\obj\\Debug\\LegionLocker.pdb" ascii
        $pdb2 = "\\obj\\Release\\LegionLocker.pdb" ascii
    condition:
      uint16(0) == 0x5a4d and (1 of ($m*) or 1 of ($pdb*) or 4 of ($s*))
}

rule MALWARE_Win_DLAgentGo {
    meta:
        author = "ditekSHen"
        description = "Detects Go-based downloader"
    strings:
        $s1 = "main.downloadFile" fullword ascii
        $s2 = "main.fetchFiles" fullword ascii
        $s3 = "main.createDefenderAllowanceException" fullword ascii
        $s4 = "main.unzip" fullword ascii
        $s5 = "HideWindow" fullword ascii
        $s6 = "/go/src/installwrap/main.go" ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_BlackMoon {
    meta:
        author = "ditekSHen"
        description = "Detects executables using BlackMoon RunTime"
    strings:
        $s1 = "blackmoon" fullword ascii
        $s2 = "BlackMoon RunTime Error:" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_IceID {
    meta:
        author = "ditekSHen"
        description = "Detects IceID / Bokbot variants"
    strings:
       $n1 = "POST" fullword wide
       $n2 = "; _gat=" fullword wide
       $n3 = "; _ga=" fullword wide
       $n4 = "; _u=" fullword wide
       $n5 = "; __io=" fullword wide
       $n6 = "; _gid=" fullword wide
       $n7 = "Cookie: __gads=" fullword wide
       $s1 = "c:\\ProgramData" ascii
       $s2 = "loader_dll_64.dll" fullword ascii
       $s3 = "loader_dll_32.dll" fullword ascii
       $s4 = "/?id=%0.2X%0.8X%0.8X%s" ascii
       $s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($n*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($n*)))
}

rule MALWARE_Win_Purge {
    meta:
        author = "ditekSHen"
        description = "Detects Purge ransomware"
    strings:
        $n1 = "imagesave/imagesize.php" ascii
        $n2 = "imageinfo.html" ascii
        $n3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" ascii
        $n4 = "Content-Type: application/x-www-form-urlencoded" ascii
        $m1 = "YOUR_ID: %x%x" wide
        $m2 = "Specially for your PC was generated personal" wide
        $m3 = "which is on our Secret Server" wide
        $m4 = "wait for a miracle and get your price" wide
        $s1 = "%s\\SpyHunter Remove Ransomware" wide
        $s2 = "$recycle.bin" fullword wide
        $s3 = "TheEnd" fullword wide
        $s4 = "%s\\HELP_DECRYPT_YOUR_FILES.TXT" fullword wide
        $s5 = "%s.id_%x%x_email_" wide
        $s6 = "scmd" fullword wide
        $s7 = "process call create \"%s\"" wide
        $s8 = "FinishEnds" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or all of ($n*) or 2 of ($m*) or (3 of ($s*) and (1 of ($n*) or 1 of ($m*))))
}

rule MALWARE_Win_NjRAT {
    meta:
        author = "ditekSHen"
        description = "Detects NjRAT / Bladabindi / NjRAT Golden"
    strings:
        $x1 = /Njrat\s\d+\.\d+\sGolden\s/ wide
        $s1 = /\sfirewall\s(add|delete)\sallowedprogram/ wide
        $s2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 (63|6b) 00 20 00 70 00 69 00 6e 00 67 }
        $s3 = "Execute ERROR" wide
        $s4 = "Download ERROR" wide
        $s5 = "[kl]" fullword wide
        $s6 = "UploadValues" fullword wide
        $s7 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
        $s8 = "HideM" fullword wide 
        $s9 = "No Antivirus" fullword wide 
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_DarkTrackRAT {
    meta:
        author = "ditekSHen"
        description = "Detects OzoneRAT / DarkTrack / DarkSky"
    strings:
        $x1 = "Klog.dat" ascii
        $x2 = "I_AM_DT" ascii
        $x3 = " Alien" ascii
        $x4 = "Local Victim" ascii
        $x5 = "Dtback\\AlienEdition\\Server\\SuperObject.pas" ascii
        $x6 = "].encryptedUsername" ascii
        $x7 = "].encryptedPassword" ascii
        $x8 = { 49 41 4d [6] 44 41 52 [0-2] 4b [6] 44 54 41 43 4b }
        $s1 = "AntiVirusProduct" ascii
        $s2 = "AntiSpywareProduct" ascii
        $s3 = "ConnectServer" ascii
        $s4 = "ExecQuery" ascii
        $s5 = "\\Drivers\\Etc\\Hosts" fullword ascii
        $s6 = "BTMemoryLoadLibary: Get DLLEntyPoint" ascii
        $s7 = "\\\\.\\SyserDbgMsg" fullword ascii
        $s8 = "\\\\.\\SyserBoot" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($x*) or 6 of ($s*))
}

rule MALWARE_Win_Godzilla {
    meta:
        author = "ditekSHen"
        description = "Detects Godzilla loader"
    strings:
        $x1 = "MSVBVM60.DLL" fullword ascii
        $x2 = "Loginserver8" fullword ascii
        $x3 = "Proflogger7" fullword ascii
        $s1 = "Badgeless5" fullword ascii
        $s2 = "Montebrasite3" fullword ascii
        $s3 = "Atelomyelia4" fullword ascii
        $s4 = "Xxencoded5" fullword ascii
        $s5 = "Garneau2" fullword ascii
        $s6 = "Hypostasis0" fullword ascii
        $s7 = "Piarhemia4" fullword ascii
        $s8 = "Foredestine8" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of ($x*) and 2 of ($s*)
}

rule MALWARE_Win_UNK03 {
    meta:
        author = "ditekSHen"
        description = "Detects unknown malware"
    strings:
        $s1 = "Software\\Microsoft\\Windows\\CurrentVersion" ascii
        $s2 = "rundll32.exe C:\\Windows\\System32\\shimgvw.dll,ImageView_Fullscreen %s" ascii
        $s3 = "%s.jpg" ascii
        $s4 = "%s\\sz.txt" ascii
        $s5 = "ChromeSecsv9867%d7.exe" ascii
        $s6 = "%s\\appl%c.jpg" ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_UNK04 {
    meta:
        author = "ditekSHen"
        description = "Detects unknown malware (proxy tool)"
    strings:
        $x1 = "127.0.0.1/%d" fullword ascii
        $x2 = "SYSTEM\\CurrentControlSet\\SERVICES\\PORTPROXY\\V4TOV4\\TCP" fullword ascii
        $x3 = "%s rundll32.exe" fullword ascii
        $s1 = "kxetray.exe" fullword ascii
        $s2 = "ksafe.exe" fullword ascii
        $s3 = "Mcshield.exe" fullword ascii
        $s4 = "Miner.exe" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of ($x*) and 2 of ($s*)
}

rule MALWARE_Win_Karkoff {
    meta:
        author = "ditekSHen"
        description = "Detects Karkoff"
    strings:
        $x1 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide
        $x2 = "CMD.exe" fullword wide
        $x3 = "Karkoff.ProjectInstaller.resources" fullword ascii
        $s1 = /try\shttp(s)?\s(ip|domain)/ fullword wide
        $s2 = "Reg cleaned!" fullword wide nocase
        $s3 = "Content-Disposition: form-data; name=\"{1}\"" fullword wide
        $s4 = "^[A-Fa-f0-9]{8}-([A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}$" fullword wide
        $s5 = "new backdoor" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or 4 of ($s*) or (2 of ($x*) and 2 of ($s*)))
}

rule MALWARE_Win_DLAgent09 {
    meta:
        author = "ditekSHen"
        description = "Detects known downloader agent"
    strings:
        $h1 = "//:ptth" ascii wide nocase
        $h2 = "//:sptth" ascii wide nocase
        $s1 = "DownloadString" fullword ascii wide
        $s2 = "StrReverse" fullword ascii wide
        $s3 = "FromBase64String" fullword ascii wide
        $s4 = "WebClient" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and (1 of ($h*) and all of ($s*))
}

rule MALWARE_Win_CoinMiningBot {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining bot"
    strings:
        $s1 = "FullScreenDetect" fullword ascii
        $s2 = "GetChildProcesses" fullword ascii
        $s3 = "HideBotPath" fullword ascii
        $s4 = "Inject" fullword ascii
        $s5 = "DownloadFile" fullword ascii
        $s6 = "/Data/GetUpdateInfo" wide
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_FYAnti {
    meta:
        author = "ditekSHen"
        description = "Hunt for FYAnti third-stage loader DLLs"
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and pe.exports("FuckYouAnti")
}

rule MALWARE_Win_DLAgent10 {
    meta:
        author = "ditekSHen"
        description = "Detects known downloader agent"
    strings:
        $s1 = "powershell.exe" ascii wide nocase
        $s2 = ".DownloadFile(" ascii wide nocase
        $s3 = "_UseShellExecute" ascii wide nocase
        $s4 = "_CreateNoWindow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_PureLoader {
    meta:
        author = "ditekSHen"
        description = "Detects Pure loader / injector"
    strings:
        $s1 = "InvokeMember" fullword wide
        $s2 = "ConcatProducer" fullword wide
        $s3 = ".Classes.Resolver" wide
        $s4 = "get_DLL" fullword ascii
        $s5 = "BufferedStream" fullword ascii
        $s6 = "GZipStream" fullword ascii
        $s7 = "MemoryStream" fullword ascii
        $s8 = "Decompress" fullword ascii
        $s9 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_VBS_DLAgent01 {
    meta:
        author = "ditekSHen"
        description = "Detects VBS MSHTA downloader"
    strings:
        $s1 = "llehS.tpircsW" ascii
        $s2 = ".Run" ascii
        $s3 = "mshta http" ascii nocase
        $s4 = "StrReverse" ascii
    condition:
        all of them
}

rule MALWARE_Win_RanumBot {
    meta:
        author = "ditekSHen"
        description = "Detects RanumBot / Windigo / GoStealer"
    strings:
        // variant 1
        $f1 = "main.addSchedulerTaskSSH" fullword ascii
        $f2 = "main.attackRouter" fullword ascii
        $f3 = "main.decryptPassword" fullword ascii
        $f4 = "main.handleScanRequest" fullword ascii
        $f5 = "main.scanNetwork" fullword ascii
        $f6 = "main.extractCredentials" fullword ascii
        $s1 = "H_T= H_a= H_g= MB,  W_a= and  h_a= h_g= h_t= max= ptr  siz= tab= top= u_a= u_g=%s/16%s:%d%s:22+0330+0430+0530+0545+0630+0845+10" ascii
        $s2 = "<== as  at  fp= is  lr: of  on  pc= sp: sp=) = ) m=+Inf, n -Inf00%x112212343125: p=ABRTACDTACSTAEDTAESTAKDTAKSTALRMAWSTAhomAtoiCESTChamDashEESTGOGCJulyJuneKILLLEAFLisuMiaoModiNZDTNZSTNewaPIPEQUITSASTSEGVTERMThai" ascii
        $s3 = "W*struct { P *big.Int; Q *big.Int; G *big.Int; Y *big.Int; Rest []uint8 \"ssh:\\\"rest\\\"\" }" ascii
        $s4 = "policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write" ascii
        $s5 = "/Users/alexander/go/src/mikrotik/winbox.go" ascii
        // variant 2
        $xf1 = "main.readConfig" fullword ascii
        $xf2 = "main.ensureRunningAsUser" fullword ascii
        $xf3 = "main.configRegPath" fullword ascii
        $xf4 = "main.oldConfigRegPath" fullword ascii
        $uf1 = "main.locateChrome" fullword ascii
        $uf2 = "main.decryptAndUploadProfile" fullword ascii
        $uf3 = "main.decryptCookies" fullword ascii
        $uf4 = "main.extractPasswords" fullword ascii
        $uf5 = "main.getFirefoxProfile" fullword ascii
        $uf6 = "main.postBrowsersData" fullword ascii
        $uf7 = "main.uploadFirefoxProfile" fullword ascii
        $uf8 = "main.zipFirefoxProfile" fullword ascii
        $uf9 = /main\.detect(Browsers|Chrome|Coccoc|Edge|Firefox|InternetExplorer|Opera|Yandex)/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($f*) or 4 of ($s*) or (2 of ($f*) and 2 of ($s*)) or (all of ($xf*) and 1 of ($uf*)) or 6 of ($uf*))
}

rule MALWARE_Win_DllHijacker01 {
    meta:
        author = "ditekSHen"
        description = "Hunt for VSNTAR21 / DllHijacker01 IronTiger / LuckyMouse / APT27 malware"
    strings:
        $s1 = "libvlc_add_intf" fullword ascii
        $s2 = "libvlc_dllonexit" fullword ascii
        $s3 = "libvlc_getmainargs" fullword ascii
        $s4 = "libvlc_initenv" fullword ascii
        $s5 = "libvlc_set_app_id" fullword ascii
        $s6 = "libvlc_set_app_type" fullword ascii
        $s7 = "libvlc_set_user_agent" fullword ascii
        $s8 = "libvlc_wait" fullword ascii
        $s9 = "dll.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_HyperBro02 {
    meta:
        author = "ditekSHen"
        description = "Detects HyperBro IronTiger / LuckyMouse / APT27 malware"
    strings:
        $s1 = "\\cmd.exe /A" fullword wide
        $s2 = "C:\\windows\\explorer.exe" fullword wide
        $s3 = "\\\\.\\pipe\\testpipe" fullword wide
        $s4 = "Elevation:Administrator!new:{" wide
        $s5 = "log.log" fullword wide
        $s6 = "%s\\%d.exe" fullword wide
        $s7 = ".?AVTPipeProtocol@@" fullword ascii
        $s8 = ".?AVTCaptureMgr@@" fullword ascii
        $s9 = "system-%d" fullword wide
        $s10 = "[test] %02d:%02d:%02d:%03d %s" fullword wide
        $s11 = "\\..\\data.dat" fullword wide
        $s12 = "\\..\\config.ini" fullword wide
        $s13 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 77 00 6f 00 72 00 6b 00 65 00 72 00 }
        $s14 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 }
        $cnc1 = "https://%s:%d/ajax" fullword wide
        $cnc2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" fullword wide
        $cnc3 = "139.180.208.225" fullword wide
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or (2 of ($cnc*) and 2 of ($s*)))
}

/*
Too many FPs
rule MALWARE_Win_HyperBro03 {
    meta:
        author = "ditekSHen"
        description = "Hunt HyperBro IronTiger / LuckyMouse / APT27 malware"
    strings:
        //$h1 = "HControl" ascii wide
        //$h2 = "HSleep" ascii wide
        //$h3 = "HTrans" ascii wide
        $i1 = "IAgent" ascii wide
        $i2 = "ITcpAgent" ascii wide
        $i3 = "IAgentListener" ascii wide
        $t1 = "TCommon" ascii
        $t2 = "TFileInfo" ascii
        $t3 = "TFileRename" ascii
        $t4 = "TFileUpload" ascii
        $t5 = "TServicesInfo" ascii
        $t6 = "TListUser" ascii
        $t7 = "TTransmit" ascii
        $vc1 = "CSSLAgent" ascii wide
        $vc2 = "CSocks5" ascii wide
        $vc3 = "CTcpAgent" ascii wide
        $cm1 = "CMCapture" ascii wide
        $cm2 = "CMFile" ascii wide
        $cm3 = "CMPipeClient" ascii wide
        $cm4 = "CMPipeServer" ascii wide
        $cm5 = "CMProcess" ascii wide
        $cm6 = "CMServices" ascii wide
        $cm7 = "CMShell" ascii wide
    condition:
        uint16(0) == 0x5a4d and (all of ($i*) or 6 of ($t*) or 6 of ($cm*) or all of ($vc*))
        //uint16(0) == 0x5a4d and (all of ($h*) or all of ($i*) or 6 of ($t*) or 6 of ($cm*) or all of ($vc*))
}
*/

rule MALWARE_Win_DllHijacker02 {
    meta:
        author = "ditekSHen"
        description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware"
    strings:
        $s1 = "ServiceCrtMain" fullword ascii
        $s2 = "mpsvc.dll" fullword ascii
        $o1 = { 84 db 0f 85 4c ff ff ff e8 14 06 00 00 8b f0 83 }
        $o2 = { f7 c1 00 ff ff ff 75 c5 eb 13 0f ba 25 10 20 01 }
        $o3 = { 8d 04 b1 8b d9 89 45 fc 8d 34 b9 a1 18 20 01 10 }
        $o4 = { b0 01 c3 68 b8 2c 01 10 e8 83 ff ff ff c7 04 24 }
        $o5 = { eb 34 66 0f 12 0d 00 fe 00 10 f2 0f 59 c1 ba cc }
        $o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 }
    condition:
        uint16(0) == 0x5a4d and all of ($s*) and 5 of ($o*)
}

rule MALWARE_Win_Zeoticus {
    meta:
        author = "ditekSHen"
        description = "Detects Zeoticus ransomware"
    strings:
        $s1 = "Dear %s" fullword wide
        $s2 = "\\??\\UNC\\%s\\%s\\" wide
        $s3 = "\\\\%ws\\admin$\\%ws" wide
        $s4 = "%s /node:\"%ws\" /user:\"%ws\" /password:" wide
        $s5 = "process call create" wide
        $s6 = ">----===Zeoticus" ascii
        $s7 = "ZEOTICUSV2" ascii
        $s8 = "GetExtendedTcpTable" fullword ascii
        $s9 = "SHAMROckSWTF" ascii
        $s10 = "NTDLL.RtlAllocateHeap" fullword ascii
        $s11 = ".pandora" fullword wide
        $s12 = { 70 00 20 00 72 00 20 00 69 00 20 00 76 00 20 00 65 00 20 00 74 }
        $pdb = "_cryptor\\shell_gen\\Release\\" ascii
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or ($pdb))
}

rule MALWARE_Win_DLAgent11 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader agent"
    strings:
        $pdb = "\\loader2\\obj\\Debug\\loader2.pdb" ascii
        $s1 = "DownloadFile" fullword ascii
        $s2 = "ZipFile" fullword ascii
        $s3 = "WebClient" fullword ascii
        $s4 = "ExtractToDirectory" fullword ascii
        $s5 = "System Clear" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (($pdb) and 4 of ($s*)))
}

rule MALWARE_Win_SoftCNApp {
    meta:
        author = "ditekSHen"
        description = "Detects SoftCNApp"
    strings:
        $s1 = "\\\\.\\PIPE\\SOC%d" fullword ascii
        $s2 = "Mozilla/5.0 (Windows NT 6.1)" fullword ascii
        $s3 = "Param: sl=%d; sl=%d; sl=%d; sl=%d; sl=%d;" fullword ascii
        $s4 = ".?AVCHPPlugin@@" fullword ascii
        $s5 = ".?AVCHPCmd@@" fullword ascii
        $s6 = ".?AVCHPExplorer@@" fullword ascii
        $s7 = "%s\\svchost.exe -O" fullword wide
        $s8 = "\"%s\\%s\" -P" fullword ascii
        $n1 = "45.63.58.34" fullword ascii
        $n2 = "127.0.0.1" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or (all of ($n*) and 2 of ($s*)))
}

rule MALWARE_Win_CovenantGruntStager {
     meta:
        author = "ditekSHen"
        description = "Detects Covenant Grunt Stager"
    strings:
        $x1 = "VXNlci1BZ2VudA" ascii wide
        $x2 = "cGFnZT17R1VJRH0mdj0x" ascii wide
        $x3 = "0eXBlPXtHVUlEfSZ2PTE" ascii wide
        $x4 = "tZXNzYWdlPXtHVUlEfSZ2PTE" ascii wide
        $x5 = "L2VuLXVzL" ascii wide
        $x6 = "L2VuLXVzL2luZGV4Lmh0bWw" ascii wide
        $x7 = "L2VuLXVzL2RvY3MuaHRtbD" ascii wide
        $s1 = "ExecuteStager" ascii
        $s2 = "UseCertPinning" fullword ascii
        $s3 = "FromBase64String" fullword ascii
        $s4 = "ToBase64String" fullword ascii
        $s5 = "DownloadString" fullword ascii
        $s6 = "UploadString" fullword ascii
        $s7 = "GetWebRequest" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or all of ($s*) or (1 of ($x*) and 5 of ($s*)))
}

rule MALWARE_Win_Fabookie {
     meta:
        author = "ditekSHen"
        description = "Detects Fabookie / ElysiumStealer"
    strings:
        $s1 = "rwinssyslog" fullword wide
        $s2 = "_kasssperskdy" fullword wide
        $s3 = "[Title:%s]" fullword wide
        $s4 = "[Execute]" fullword wide
        $s5 = "[Snapshot]" fullword wide
        $s6 = "Mozilla/4.0 (compatible)" fullword wide
        $s7 = "d-k netsvcs" fullword wide
        $s8 = "facebook.websmails.com" fullword wide
        $s9 = "CUdpClient::Start" fullword ascii
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x0805) and 6 of them
}

rule MALWARE_Win_CobianRAT {
     meta:
        author = "ditekSHen"
        description = "Detects CobianRAT, a fork of Njrat"
    strings:
        $s1 = "1.0.40.7" fullword wide
        $s2 = "DownloadData" fullword wide
        $s3 = "Executed As" fullword wide
        $s4 = "\\Plugins" fullword wide
        $s5 = "LOGIN" fullword wide
        $s6 = "software\\microsoft\\windows\\currentversion\\run" wide
        $s7 = "Hidden" fullword wide
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_Cuba {
    meta:
        author = "ditekSHen"
        description = "Detects Cuba ransomware"
    strings:
        $s1 = ".cuba" fullword wide
        $s2 = "\\\\%d.%d.%d.%d" fullword wide
        $s3 = "!!FAQ for Decryption!!.txt" fullword wide
        $s4 = "vmcompute" fullword wide
        $s5 = "MSExchange" wide
        $s6 = "glocal" fullword wide
        $s7 = "network" fullword wide
        $s8 = "\\$Recycle.Bin\\" fullword wide
        $s9 = "NetShareEnum" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_Leivion {
    meta:
        author = "ditekSHen"
        description = "Detects Leivion"
    strings:
        $s1 = "/var/lib/veil/go/src/runtime/mem_windows.go" fullword ascii
        $s2 = "/var/lib/veil/go/src/internal/singleflight/singleflight.go" fullword ascii
        $s3 = "/var/lib/veil/go/src/net/http/sniff.go" fullword ascii
        $s4 = "/var/lib/veil/go/src/net/sendfile_windows.go" fullword ascii
        $s5 = "/var/lib/veil/go/src/os/exec_" ascii
        $s6 = "/var/lib/veil/go/src/runtime/mgcsweep.go" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Banload {
    meta:
        author = "ditekSHen"
        description = "Detects Banload"
    strings:
        $s1 = "main.die" fullword ascii
        $s2 = "main.postResults" fullword ascii
        $s3 = "main.checkin" fullword ascii
        $s4 = "RegQueryValueExWRemoveDirectoryWSETTINGS_TIMEOUTTerminateProcessUpgrade RequiredUser-Agent: %s" ascii
        $s5 = "pcuser-agentws2_32.dll (targetpc= DigestType ErrCode=%v" ascii
        $s6 = "invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrie" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_TYRAT {
    meta:
        author = "ditekSHen"
        description = "Detects TYRAT"
    strings:
        $s1 = "C:\\$MSIRecycle.Bin\\" fullword ascii
        $s2 = "Range: bytes=%d-" fullword ascii
        $s3 = "GET%sHTTP/1.1" fullword ascii
        $s4 = "DllServer.dll" fullword ascii
        $s5 = ".Bin\\bnch" ascii
        $s6 = "User-Agent: wget" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_InfinityLock {
    meta:
        author = "ditekSHen"
        description = "Detects InfinityLock ransomware"
    strings:
        $s1 = "_Encrypted$" fullword ascii
        $s2 = "PublicKeyToken=" fullword ascii nocase
        $s3 = "GenerateHWID" fullword ascii
        $s4 = "CreateKey" fullword ascii
        $d1 = "ProgrammFiles" fullword ascii
        $d2 = "OneDrive" fullword ascii
        $d3 = "ProgrammsX86" fullword ascii
        $d4 = "UserDirs" fullword ascii
        $d5 = "B_Drive" fullword ascii
        $pdb1 = "F:\\DESKTOP!\\ChkDsk\\ChkDsk\\obj\\" ascii
        $pdb2 = "\\ChkDsk\\obj\\Debug\\PremiereCrack.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($s*) and 1 of ($d*)) or (4 of ($d*) and 2 of ($s*)) or (any of ($pdb*) and 1 of ($s*) and 1 of ($d*)))
}

rule MALWARE_Win_MountLocker {
    meta:
        author = "ditekSHen"
        description = "Detects MountLocker ransomware"
    strings:
        $s1 = "] locker.dir.check > " ascii wide
        $s2 = "] locekr.kill." ascii wide
        $s3 = "] locker.worm" ascii wide
        $s4 = "%CLIENT_ID%" fullword ascii
        $s5 = "RecoveryManual.html" ascii wide
        $s6 = "RECOVERY MANUAL" ascii
        $s7 = ".ReadManual.%0.8X" ascii wide
        $s8 = "/?cid=%CLIENT_ID%" ascii
    condition:
        uint16(0) == 0x5a4d and 3 of them
}

rule MALWARE_Win_PingBack {
    meta:
        author = "ditekSHen"
        description = "Detects PingBack ICMP backdoor"
    strings:
        $s1 = "Sniffer ok!" fullword ascii
        $s2 = "recv icmp packet!" fullword ascii
        $s3 = "WSASocket() failed: %d" fullword ascii
        $s4 = "file on remote computers success" ascii
        $s5 = "listen port error!" fullword ascii
        $s6 = "\\PingBackService" ascii
        $c1 = "exec" fullword ascii
        $c2 = "rexec" fullword ascii
        $c3 = "exep" fullword ascii
        $c4 = "download" fullword ascii
        $c5 = "upload" fullword ascii
        $c6 = "shell" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or all of ($c*) or (4 of ($c*) and 2 of ($s*)))
}

rule MALWARE_Win_BazarLoader {
    meta:
        author = "ditekSHen"
        description = "Detects BazarLoader variants"
    strings:
        $s1 = "Startdelay for %d ms to avoid some dynamic AV detects!" ascii
        $s2 = "Use Debug for moving faster!" ascii
        $s3 = "Logging Mutex %s to %s" ascii
        $s4 = "FIRST AND ONLY COPY RUNNING! Mutex %s" ascii
        $s5 = "the most secret 3d GetWinApiPointers line in the world!" ascii
        $s6 = "[+] makeMD5hash. " ascii
    condition:
        uint16(0) == 0x5a4d and 3 of ($s*)
}

rule MALWARE_Win_CoinMiner01 {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining malware"
    strings:
        $s1 = "-o pool." ascii wide
        $s2 = "--cpu-max-threads-hint" ascii wide
        $s3 = "-P stratum" ascii wide
        $s4 = "--farm-retries" ascii wide
        $dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or ($dl))
}

rule PUA_Win_UltraSurf {
    meta:
        author = "ditekSHen"
        description = "Detects UltraSurf / Ultrareach PUA"
    strings:
        $s1 = "Ultrareach Internet Corp." ascii
        $s2 = "UltrasurfUnionRectUrlFixupWUse Proxy" ascii
        $s3 = "Ultrasurf UnlockFileUrlEscapeWUser-Agent" ascii wide
        $s4 = "Ultrasurf0#" ascii
        $m1 = "main.bindata_read" fullword ascii
        $m2 = "main.icon64_png" fullword ascii
        $m3 = "main.setProxy" fullword ascii
        $m4 = "main.openbrowser" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($s*) or (all of ($m*) and 1 of ($s*)))
}

rule MALWARE_Win_Hello {
    meta:
        author = "ditekSHen"
        description = "Hunt for Hello / WickrMe ransomware"
    strings:
        $s1 = "DeleteBackupFiles" ascii wide
        $s2 = "GetEncryptFiles" ascii wide
        $s3 = "DeleteVirtualDisks" ascii wide
        $s4 = "DismountVirtualDisks" ascii wide
    condition:
        uint16(0) == 0x5a4d and 3 of them
}

rule MALWARE_Win_ButeRAT {
    meta:
        author = "ditekSHen"
        description = "Detects ButeRAT"
    strings:
        $x1 = "TVqQAAMAA" ascii
        $s1 = "ipinfo.io/geo" wide
        $s2 = "/index.php" wide
        $s3 = "Copy-Item -Path" wide
        $s4 = ";Start-Process" wide
        $s5 = "Microsoft\\Windows\\Start Menu\\Programs\\Startup" wide
        $s6 = "LOCALAPPDATA" fullword wide
        $s7 = "passwords.json" wide
        $s8 = "Scripting.FileSystemObject" fullword wide
        $z1 = /(edge|chrome|opera|exodus|jaxx|atomic|coinomi)\.zip/ ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) or 1 of ($z*)) and (4 of ($s*)) or (6 of ($s*)) or (#z1 > 4 and 2 of them))
}

rule MALWARE_Win_CookieStealer {
    meta:
        author = "ditekSHen"
        description = "Detects generic cookie stealer"
    strings:
        $s1 = "([\\S]+?)=([^;|^\\r|^\\n]+)" fullword ascii
        $s2 = "(.+?): ([^;|^\\r|^\\n]+)" fullword ascii
        $s3 = "Set-Cookie: ([^\\r|^\\n]+)" fullword ascii
        $s4 = "cmd.exe /c taskkill /f /im chrome.exe" fullword ascii
        $s5 = "FIREFOX.EXE|Google Chrome|IEXPLORE.EXE" ascii
        $pdb1 = "F:\\facebook_svn\\trunk\\database\\Release\\DiskScan.pdb" fullword ascii
        $pdb2 = "D:\\Projects\\crxinstall\\trunk\\Release\\spoofpref.pdb" fullword ascii
        $ua1 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" fullword ascii
        $ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($s*) and 1 of ($pdb*) and 1 of ($ua*)) or (all of ($ua*) and 1 of ($pdb*) and 2 of ($s*)))
}

rule MALWARE_Win_BitCoinGrabber {
    meta:
        author = "ditekSHen"
        description = "Detects generic bitcoin stealer"
    strings:
        $s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $s2 = "Bitcoin-Grabber" ascii
        $s3 = "Bitcoin_Grabber" ascii
        $s4 = "encrypt resources [compress]T" fullword ascii
        $s5 = "code control flow obfuscationT" fullword ascii
        $s6 = "\\Users\\lakol\\Desktop\\a\\Crypto Currency Wallet Changer\\" ascii
        $pat1 = "\\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\\b" fullword wide
        $pat2 = "\\b0x[a-fA-F0-9]{40}\\b" fullword wide
        $pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide
    condition:
        uint16(0) == 0x5a4d and 4 of ($s*) or (all of ($pat*) and 2 of ($s*))
}

rule MALWARE_Win_FOXGRABBER {
    meta:
        author = "ditekSHen"
        description = "Detects FOXGRABBER utility"
    strings:
        $s1 = "start grabbing" wide
        $s2 = "end grabbing in" wide
        $s3 = "error of copying files from comp:" wide
        $s4 = "\\Firefox\\" wide nocase
        $pdb1 = "\\obj\\Debug\\grabff.pdb" ascii
        $pdb2 = "\\obj\\Release\\grabff.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
}

rule MALWARE_Win_BrowserGrabber {
    meta:
        author = "ditekSHen"
        description = "Hunt for FOXGRABBER-like samples but for various browsers"
    strings:
        $s1 = "start grabbing" wide
        $s2 = "end grabbing in" wide
        $s3 = "error of copying files from comp:" wide
        $s4 = /(Chrome|Edge)/ wide
        $ff = "\\Firefox\\" wide nocase
        $pdb1 = "\\obj\\Debug\\grab" ascii
        $pdb2 = "\\obj\\Release\\grab" ascii
    condition:
        uint16(0) == 0x5a4d and not ($ff) and (all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
}

rule MALWARE_Win_DeathRansom {
    meta:
        author = "ditekSHen"
        description = "Detects known DeathRansom ransomware"
    strings:
        $s1 = "%s %f %c" fullword ascii
        $pdb1 = ":\\wud.pdb" ascii
        $spdb2 = "\\crypt_server\\runtime\\crypt" ascii
        $spdb3 = "\\bin\\nuvin.pdb" ascii
        $h1 = "#Dunubeyokunov" wide
        $h2 = "^Neyot dehipijakeyelih" wide
        $h3 = "talin%Sanovurenofibiw" wide
        $h4 = "WriteFile" fullword ascii
        $h5 = "ClearEventLogA" fullword ascii
        $h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide
    condition:
        uint16(0) == 0x5a4d and (all of ($pdb*) or (all of ($s*) and 1 of ($pdb*)) or 5 of ($h*))
}

rule MALWARE_Win_UnlockYourFiles {
    meta:
        author = "ditekSHen"
        description = "Detects UnlockYourFiles ransomware"
    strings:
        $s1 = "filesx0" wide
        $s2 = "_auto_file" wide
        $s3 = "<EncyptedKey>" fullword wide
        $s4 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\" wide
        $s5 = "DecryptAllFile" fullword ascii
        $s6 = "AES_Only_Decrypt_File" fullword ascii
        $m1 = "Free files decrypted" wide
        $m2 = "Restore my files" wide
        $m3 = "Type tour password..." wide
        $m4 = "files encrypted by strong password" ascii
        $m5 = "buy bitcoin" ascii
        $m6 = "Unlock File" fullword wide
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or 5 of ($m*) or (2 of ($s*) and 2 of ($m*)))
}

rule MALWARE_Win_DecryptMyFiles {
    meta:
        author = "ditekSHen"
        description = "Detects DecryptMyFiles ransomware"
    strings:
        $s1 = "FILES ENCRYPTED" wide
        $s2 = "pexplorer.exe" fullword wide
        $s3 = "uniquesession" fullword ascii
        $s4 = ".[decryptmyfiles.top]." fullword ascii
        $s5 = "decrypt 1 file" ascii
        $s6 = "(databases,backups, large excel" ascii
        $c1 = "api/connect.php" ascii
        $c2 = "decryptmyfiles.top" ascii
        $c3 = "/contact/" ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or all of ($c*) or (2 of ($c*) and 2 of ($s*)))
}

rule MALWARE_Win_Motocos {
    meta:
        author = "ditekSHen"
        description = "Detects Motocos ransomware"
    strings:
        $s1 = "Block Investigation Tools" wide
        $s2 = "powershell.exe,taskmgr.exe,procexp.exe,procmon.exe" wide
        $s3 = "google.com,youtube.com,baidu.com,facebook.com,amazon.com,360.cn,yahoo.com,wikipedia.org,zoom.us,live.com,reddit.com,netflix.com,microsoft.com,instagram.com,vk.com," wide
        $s4 = "START ----" wide
        $s5 = "TEngine.Clear_EventLog_Result" wide
        $s6 = "TEngine.EncryptLockFiles" wide
        $s7 = "TEngine.CleanShadowFiles" wide
        $s8 = "TDNSUtils.SendCommand" wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_DLAgent12 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader agent"
    strings:
        $s1 = "WebClient" fullword ascii
        $s2 = "DownloadData" fullword ascii
        $s3 = "packet_server" fullword wide
    condition:
        uint16(0) == 0x5a4d and all of them and filesize < 50KB
}

rule MALWARE_Win_DLInjector01 {
    meta:
        author = "ditekSHen"
        description = "Detects specific downloader injector shellcode"
    strings:
        $s1 = "process call create \"%s\"" ascii wide
        $s2 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\" ascii wide
        $s3 = "%systemroot%\\system32\\ntdll.dll" ascii wide
        $s4 = "qemu-ga.exe" ascii wide
        $s5 = "prl_tools.exe" ascii wide
        $s6 = "vboxservice.exe" ascii wide
        $o1 = { 75 04 74 02 38 6e 8b 34 24 83 c4 04 eb 0a 08 81 }
        $o2 = { 16 f8 f7 ba f0 3d 87 c7 95 13 b7 64 22 be e1 59 }
        $o3 = { 8b 0c 24 83 c4 04 eb 05 ea f2 eb ef 05 e8 ad fe }
        $o4 = { eb 05 1d 51 eb f5 ce e8 80 fd ff ff 77 a1 f4 cd }
        $o5 = { eb 05 6e 33 eb f5 73 e8 64 f6 ff ff 77 a1 f4 77 }
        $o6 = { 59 eb 05 fd 98 eb f4 50 e8 d5 f5 ff ff 3b b9 00 }
        $o7 = "bYkoDA7G" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and all of ($o*)) or (all of ($s*))
}

rule MALWARE_Win_DLInjector02 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader injector"
    strings:
        $x1 = "In$J$ct0r" fullword wide
        $x2 = "%InJ%ector%" fullword wide
        $a1 = "WriteProcessMemory" fullword wide
        $a2 = "URLDownloadToFileA" fullword ascii
        $a3 = "Wow64SetThreadContext" fullword wide
        $a4 = "VirtualAllocEx" fullword wide
        $s1 = "RunPE" fullword wide
        $s2 = "SETTINGS" fullword wide
        $s3 = "net.pipe" fullword wide
        $s4 = "vsmacros" fullword wide
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or (all of ($a*) and 3 of ($s*)))
}

rule MALWARE_Win_Nermer {
    meta:
        author = "ditekSHen"
        description = "Detects Nermer ransomware"
    strings:
        $x1 = "gPROTECT_INFO.TXT" fullword wide
        $x2 = ".nermer" fullword wide
        $s1 = "db_journal" fullword wide
        $s2 = "quicken2015backup" fullword wide
        $s3 = "mysql" fullword wide
        $s4 = "sas7bdat" fullword wide
        $s5 = "httpd.exe" fullword wide
        $s6 = "Intuit.QuickBooks.FCS" fullword wide
        $s7 = "convimage" fullword wide
        $s8 = ".?AV?$_Binder@U_Unforced@std@@P8shares_t@" ascii
        $s9 = "BgIAAACkAABSU0ExAAgAAAEAAQCt" ascii
        $m1 = "YOUR FILES WERE ENCRYPTED" ascii
        $m2 = "MARKED BY EXTENSION .nermer" ascii
        $m3 = "send us your id: >> {id} <<" ascii
        $m4 = "email us: >> {email} <<" ascii
        $c1 = "/repeater.php" ascii
        $c2 = "HTTPClient/0.1" fullword ascii
        $c3 = "94.156.35.227" ascii
        $c4 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($m*) or all of ($c*) or all of ($s*)  or (4 of ($s*) and (1 of ($x*) or 1 of ($m*) or 2 of ($c*))) or 14 of them)
}

rule MALWARE_Win_Beastdoor {
    meta:
        author = "ditekSHen"
        description = "Detects Beastdoor backdoor"
    strings:
        $s1 = "shellx.pif" fullword ascii nocase
        $s2 = "Beasty" fullword ascii
        $s3 = "* Boot:[" ascii
        $s4 = "^ Shut Down:[" ascii
        $s5 = "set cdaudio door" ascii
        $s6 = "This \"Portable Network Graphics\" image is not valid" wide
        $n1 = ".aol.com" ascii
        $n2 = "web.icq.com" ascii
        $n3 = "&fromemail=" fullword ascii
        $n4 = "&subject=" fullword ascii
        $n5 = "&Send=" fullword ascii
        $n6 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword ascii
        $n7 = "mirabilis.com" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 5 of ($n*) or (3 of ($s*) and 3 of ($n*)))
}

rule MALWARE_Win_GravityRAT {
    meta:
        author = "ditekSHen"
        description = "Detects GravityRAT"
    strings:
        $s1 = "/GX/GX-Server.php?VALUE=2&Type=" wide
        $s2 = "&SIGNATUREHASH=" wide
        $s3 = "Error => CommonFunctionClass => Upload()" wide
        $s4 = "/GetActiveDomains.php" wide
        $s5 = "DetectVM" ascii wide
        $s6 = "/c {0} > {1}" wide
        $s7 = "DRIVEUPLOADCOMPLETED => TOTALFILES={0}, FILESUPLOADED={1}" wide
        $s8 = "Program => RunAFile()" wide
        $s9 = "DoViaCmd" ascii
        $s10 = ".msoftupdates.com:" wide
        $f1 = "<RootJob>b__" ascii
        $f2 = "<GetFiles>b__" ascii
        $f3 = "<UpdateServer>b__" ascii
        $f4 = "<EthernetId>b__" ascii
        $f5 = "<MatchMacAdd>b__" ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or (all of ($f*) and 1 of ($s*)))
}

rule MALWARE_Win_FatalRAT {
    meta:
        author = "ditekSHen"
        description = "Detects FatalRAT"
    strings:
        $x1 = "XXAcQbcXXfRSScR" fullword ascii
        $s1 = "CHROME_NO_DATA" fullword ascii
        $s2 = "CHROME_UNKNOW" fullword ascii
        $s3 = "-Thread running..." ascii
        $s4 = "InetCpl.cpl,ClearMyTracksByProcess" ascii nocase
        $s5 = "MSAcpi_ThermalZoneTemperature" ascii nocase
        $s6 = "taskkill /f /im rundll32.exe" fullword ascii nocase
        $s7 = "del /s /f %appdata%\\Mozilla\\Firefox" ascii nocase
        $s8 = "\\\\%s\\C$\\" ascii
        $s9 = "fnGetChromeUserInfo" fullword ascii
        $s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
}

rule MALWARE_Win_WinGo {
    meta:
        author = "ditekSHen"
        description = "Detects malicious Golang executables"
    strings:
        $s1 = "Go build ID:" ascii
        $s2 = /main\.[a-z]{9}Delete/ fullword ascii
        $s3 = /main\.[a-z]{9}Update/ fullword ascii
        $s4 = /main\.[a-z]{9}rundll/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of them and #s2 > 2 and #s3 > 2 and #s4 > 2)
}

rule MALWARE_Win_GENERIC03 {
    meta:
        author = "ditekSHen"
        description = "Detects unknown malicious executables"
    strings:
        $s1 = "lbroscfg.dll" wide
        $s2 = "cmd /c ping 127.0.0.1 & del /f /q \"" fullword wide
        $s3 = "E:\\Data\\Sysceo\\AD\\" fullword ascii
        $s4 = "C++\\Browser_noime\\" ascii
    condition:
        uint16(0) == 0x5a4d and 3 of them
}

rule MALWARE_Win_PandaStealer {
    meta:
        author = "ditekSHen"
        description = "Detects Panda Stealer"
    strings:
        $s1 = "\\tokens.txt" fullword ascii
        $s2 = "user.config" fullword ascii
        $s3 = "Discord\\" ascii
        $s4 = "%s\\etilqs_" fullword ascii
        $s5 = "buildSettingGrabber" ascii
        $s6 = "buildSettingSteam" ascii
        $s7 = ".?AV?$_Ref_count_obj2@U_Recursive_dir_enum_impl@filesystem@std@@@" ascii
        $s8 = "UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr" ascii
        $s9 = "|| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_Gelsemine {
    meta:
        author = "ditekSHen"
        description = "Detects Gelsemine"
    strings:
        $s1 = "If any of these steps fails.only pick one of the targets for configuration\"If you want to just get on with it*which also use [ " wide
        $s2 = "A make implementation+with core modules (please read NOTES.PER_L)2The per_l Text::Template (please read NOTES.PER_L)" wide
        $s3 = "NOTES.VMS (OpenVMS)!NOTES.WIN (any supported Windows)%NOTES.DJGPP (DOS platform with DJGPP)'NOTES.ANDROID (obviously Android [ND" wide
        $s4 = "A simple example would be this)which is to be understood as one of these" fullword wide
        $s5 = "bala bala bala" fullword wide
        $s6 = "echo FOO" fullword wide
        $s7 = "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V" ascii
        $o1 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
        $o2 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
        $o3 = { 8b 76 08 2b f0 a1 34 ff 40 00 03 f0 89 35 38 ff }
        $o4 = { 83 c4 34 c3 8b 4e 20 6a 05 e8 73 10 00 00 8b 76 }
        $o5 = { 8b 44 24 44 2b d1 03 d0 8b f2 e9 14 ff ff ff 8d }
        $o6 = { 68 00 06 00 00 6a 00 e8 d3 ff ff ff a2 48 00 41 }
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or (all of ($o*) and 2 of ($s*)))
}

rule MALWARE_Win_Gelsenicine {
    meta:
        author = "ditekSHen"
        description = "Detects Gelsenicine"
    strings:
        $s1 = "System/" fullword wide
        $s2 = "Windows/" fullword wide
        $s3 = "CommonAppData/" fullword wide
        $s5 = ".?AUEmbeddedResource@@" fullword ascii
        $ms1 = "pulse" fullword wide
        $ms2 = "mainpath" fullword wide
        $ms3 = "mainpath64" fullword wide
        $ms4 = "pluginkey" fullword wide
        $o1 = { 48 8d 54 24 68 48 8b 4c 39 10 e8 4d ff ff ff 44 }
        $o2 = { 48 8d 54 24 30 48 8b cb e8 34 f2 ff ff 84 c0 74 }
        $o3 = { 48 c7 44 24 ?? fe ff ff ff 49 8b f0 48 8b d9 ?? }
        $o4 = { 89 44 24 30 89 44 24 34 48 8b 53 08 48 85 d2 48 }
        $o5 = { ff ff ff ff 49 f7 d1 4c 23 f8 8b 43 10 48 8b e9 }
        $o6 = { 83 c4 24 85 c0 74 3c 8b 0b 8b 41 34 8b 4d 34 2b }
        $o7 = { 8b 45 34 8b 53 fc 50 8b cf 6a 04 68 00 10 00 00 }
        $o8 = { 80 74 1f 8b 4e 34 8b 54 24 18 25 ff ff 00 00 51 }
        $o9 = { eb 47 8b 4c 24 14 8b 56 34 52 8d 3c 08 8b 44 24 }
        $o10 = { 8b 44 24 0c 5d 5e 5b 83 c4 10 c3 8b 4e 34 51 57 }
        $o11 = { 6a 03 53 53 56 68 34 00 e4 74 ff 15 80 d0 e3 74 }
    condition:
        uint16(0) == 0x5a4d and ((all of ($s*) and (3 of ($ms*) or 4 of ($o*))) or (all of ($ms*) and 2 of ($s*) and 3 of ($o*)))
}

rule MALWARE_Win_Gelsevirine {
    meta:
        author = "ditekSHen"
        description = "Detects Gelsevirine"
    strings:
        $s1 = /64loadpath(xp|sv|7)/ fullword wide
        $s2 = "{\"Actions\":[]}" fullword wide
        $s3 = "PlatformsChunk" fullword wide
        $s4 = "CurrentPluginCategory" fullword wide
        $s5 = "CurrentOperationPlatform" fullword wide
        $s6 = "PersistencePlugins" fullword wide
        $s7 = "memory_library_file" fullword wide
        $s8 = "LoadPluginBP" fullword ascii
        $s9 = "GetOperationBasicInformation" fullword ascii
        $s10 = "commonappdata/Intel/Runtime" wide
        $s11 = "cfsst x64" fullword wide
        $s12 = "ForkOperation" fullword ascii
        $c1 = "domain.dns04.com:8080;domain.dns04.com:443;acro.ns1.name:80;acro.ns1.name:1863;" wide
        $c2 = "<base64 content=\"" fullword ascii
        $c3 = "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
        $m1 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
        $m2 = "46EBBDC3-EEDC-42D4-BA1D-D454DFCE8E42" ascii wide
        $m3 = "135054C6-8036-42C7-A97C-31F37D7728BD" ascii wide
        $m4 = "DC7FDDF7-B2F1-4B99-BE6A-AA683FF11CE6" ascii wide
        $m5 = "131C8113-E083-4C7F-BEAF-82D73B01F2C5" ascii wide
        $m6 = "4CCF506D-2F61-4C3A-B9C6-9FA47D43A3FC" ascii wide
        $m7 = "B2DC745A-66AE-4A19-B11C-AD74D46B7EE0" ascii wide
        $m8 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or (2 of ($c*) and 4 of ($s*)) or (5 of ($m*) and (1 of ($c*) or 3 of ($s*))))
}

rule MALWARE_Win_IPsecHelper {
    meta:
        author = "ditekSHen"
        description = "Detects IPsecHelper backdoor"
    strings:
        $s1 = "rundll32.exe advapi32.dll,ProcessIdleTasks" wide
        $s2 = "CommandExecute" fullword ascii
        $s3 = "DownloadExecuteUrl" fullword ascii
        $s4 = "DownloadExecuteFile" fullword ascii
        $s5 = "CmdExecute" fullword ascii
        $s6 = "ExecuteProcessWithResult" fullword ascii
        $s7 = "IsFirstInstance ==> checked" fullword wide
        $s8 = "del \"%PROG%%SERVICENAME%\".*" fullword wide
        $s9 = ".CreateConfig" wide
        $s10 = ".SelfDelete" wide
        $c1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; EmbeddedWB 14.52 from: http://www.google.com/ EmbeddedWB 14.52;" wide
        $c2 = "boot.php" wide
        $c3 = "lastupdate.php" wide
        $c4 = "main.php" wide
        $c5 = "InternetNeeded" wide
        $c6 = "DeviceIdSalt" wide
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or 4 of ($c*) or 8 of them)
}

rule MALWARE_Win_Apostle {
    meta:
        author = "ditekSHen"
        description = "Detects Apsotle"
    strings:
        $s1 = "bytesToBeEncrypted" fullword ascii
        $s2 = "SelfDelete" fullword ascii
        $s3 = "ReadMeFileName" ascii
        $s4 = "DesktopFileName" ascii
        $s5 = "SetWallpaper" fullword ascii
        $s6 = "get_EncryptionKey" fullword ascii
        $s7 = "disall" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_DEADWOOD {
    meta:
        author = "ditekSHen"
        description = "Detects DEADWOOD"
    strings:
        $s1 = "Service Start Work !!!!" fullword ascii
        $s2 = "Error GetTokenInformation : " fullword ascii
        $s3 = "\\Windows\\System32\\net.exe" fullword wide
        $s4 = "App Start Work !!!!" fullword ascii
        $s5 = "vmmouse" fullword wide
        $s6 = "CDPUserSvc_" wide
        $s7 = "WpnUserService_" wide
        $s8 = "User is :" wide
        $s9 = "\\params" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_Turian {
    meta:
        author = "ditekSHen"
        description = "Hunt for Turian / Qurian"
        hash1 = "d1218ab9d608ee0212e880204e4d7d75f29f03b77248bca7648d111d67405759"
        cnc_domain = "windowsupdate[.]dyndns[.]info"
        cnc_ip = "58[.]158[.]177[.]102"
    strings:
        $s1 = "%s a -m5 -hp1qaz@WSX3edc -r %s %s\\*.*" ascii wide
        $s2 = "%s a -m5 -hpMyHost-1 -r %s %s\\*.*" ascii wide
        $s3 = "%s a -m5 -hp1qaz@WSX3edc -ta%04d%02d%02d000000 -r %s c:" ascii wide
        $s4 = "%s a -m5 -hpMyHost-1 -ta%04d%02d%02d000000 -r %s c:"
        $s5 = "cmd /c dir /s /O:D %s>>\"%s\"" ascii wide
        $s6 = "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v %s /t REG_SZ /d \"%s\" /f" fullword ascii
        $s7 = "Not Connect!" fullword ascii
        $p1 = "RECYCLER\\S-1-3-33-854245398-2067806209-0000980848-2003\\" ascii wide
        $p2 = "%sRECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
        $p3 = "\\RECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
        $p4 = "\\RECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
        $p5 = "%sRECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
        $c1 = "CONNECT %s:%u HTTP/1." ascii wide
        $c2 = "User-Agent: Mozilla/4.0" ascii wide
        $m1 = "winsupdatetw" fullword ascii wide
        $m2 = "clientsix" fullword ascii wide
        $m3 = "updatethres" fullword ascii wide
        $m4 = "uwatchdaemon" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or (all of ($c*) and (2 of ($s*) or 1 of ($m*) or 1 of ($p*))) or (1 of ($m*) and 1 of ($s*) and (1 of ($c*) or 1 of ($p*))))
}

/*
Too many FPs
rule MALWARE_Win_DLAgent13 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader agent. Observed to drop AceRAT"
    strings:
        $x1 = "Dropper" fullword ascii
        $x2 = "/C chcp 65001 && ping 127.0.0.1 && DEL" wide
        $x3 = "&& ping 127.0.0.1 && DEL /F /S /Q /A \"" wide
        $s1 = "WebClient" fullword ascii
        $s2 = "DownloadFile" fullword ascii
        $s3 = "ProcessStartInfo" fullword ascii
        $s4 = "set_FileName" fullword ascii
        $s5 = "GetTempPath" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or all of($x*) or (2 of ($x*) and 3 of ($s*)))
}
*/

rule MALWARE_Win_DLAgent14 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader injector"
    strings:
        $s1 = "%ProgramData%\\AVG" fullword wide
        $s2 = "%ProgramData%\\AVAST Software" fullword wide
        $s3 = "%wS\\%wS.vbs" fullword wide
        $s4 = "%wS\\%wS.exe" fullword wide
        $s5 = "CL,FR,US,CY,FI,HR,HU,RO,PL,IT,PT,ES,CA,DK,AT,NL,AU,AR,NP,SE,BE,NZ,SK,GR,BG,NO,GE" ascii
        $s6 = "= CreateObject(\"Microsoft.XMLHTTP\")" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_MarkiRAT {
    meta:
        author = "ditekSHen"
        description = "Detects MarkiRAT"
    strings:
        $pdb = "\\mfcmklg.pdb" ascii
        $s1 = "runinhome Completed" wide
        $s2 = "ERROR find next file<br>" wide
        $s3 = "<br><mark>Hello: %s</mark>" wide
        $s4 = "<br><mark>CLIPBOARD[" wide
        $s5 = "@userhome@" wide
        $s6 = "Global\\{2194ABA1-BFFA-4e6b-8C26-D1BB20190312}" wide
        $s7 = "taskkill /im svehost.exe /t /f" fullword ascii
        $s8 = "taskkill /im keepass.exe /t /f" fullword ascii
        $ba = /bitsadmin \/(addfile|cancel|SetPriority|resume)/ ascii wide
        $c1 = "/ech/client.php?u=" wide
        $c2 = "/up/uploadx.php?u=" wide
        $c3 = "/ech/echo.php?req=rr&u=" wide
        $c4 = "/ech/rite.php" wide
        $c5 = "http://microsoft.com-view.space/i.php?u=" wide
        $c6 = "Content-Disposition: form-data; name=\"uploadedfile\"; filename=\"" ascii
    condition:
        uint16(0) == 0x5a4d and (($pdb and any of them) or (5 of ($s*)) or (3 of ($c*)) or ((#ba > 3 and 4 of them)))
}

rule MALWARE_Win_KlingonRAT {
    meta:
        author = "ditekSHen"
        description = "Detects KlingonRAT"
    strings:
        $go = "Go build ID:" ascii
        $s1 = "/UCRelease/src/client/uac/once/"
        $s2 = "%T\\AppData\\Local\\Windows Update\\"
        $s3 = "%TSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"
        $s4 = "wmic /namespace:'\\\\root\\subscription' PATH"
        $s5 = "C:\\Windows\\System32\\fodhelper.exeCaption,ParentProcessId,ProcessId"
        $s6 = "ldpro.exelsass.exeluall.exeluspt.exe"
        $s7 = "scangui.exedeps/lsass.exeetrustcipe.exefile"
        $s8 = "alogserv.exeaplica32.exeapvxdwin.exeatro55en.exeautodown.exeavconsol.exeavgserv9.exeavkwctl9.exeavltmain.exeavpdos32.exeavsynmgr.exeavwupd32.exeavwupsrv.exe"
        $c1 = "%s/keyLogger?machineId=%s" ascii
        $c2 = "%s/stealer?machineId=%s" ascii
        $c3 = "%s/lsass?machineId=%s" ascii
        $c4 = "%s/logger?machineId=%s" ascii
        $c5 = "%s/machineInfo?machineId=%s" ascii
        $c6 = "failurehttps://%s:%d/botif-modified-sinceillegal" ascii
    condition:
        uint16(0) == 0x5a4d and ($go) and (3 of ($c*) or 5 of ($s*) or (3 of ($s*) and 1 of ($c*)))
}

rule MALWARE_Win_XFiles {
    meta:
        author = "ditekSHen"
        description = "Detects X-Files infostealer (formerly BotSh1zoid)"
    strings:
        $x1 = "\\BotSh1zoid\\" ascii
        $x2 = "\\BuildPacker.pdb" ascii
        $x3 = "\\Svc_host.pdb" ascii nocase
        $s1 = "WDefender" fullword ascii
        $s2 = "CheckDefender" fullword ascii
        $s3 = "RunPS" fullword ascii
        $s4 = "DownloadFile" fullword ascii
        $v1_1 = "<Pass encoding=\"base64\">(.*)</Pass>" wide
        $v1_2 = "Grabber\\" wide
        $v1_3 = "/log.php" wide
        $v1_4 = /Browsers\\(Logins|Cards|Cookies)/ wide
        $v1_5 = "<StealSteam>b__" ascii
        $v1_6 = "record_header_field" fullword ascii
        $v1_7 = "JavaScreenshotiptReader" fullword ascii
        $v1_8 = "HTTPDebuggerPro" wide
        $v1_9 = "IEInspector" wide
        $v1_10 = "Fiddler" wide
        $v2_1 = /get_(Cookie|Logins|Cards)Path/ fullword ascii
        $v2_2 = "get_AllScreens" fullword ascii
        $v2_3 = "{0}_{1}_{2}.zip" fullword wide
        $v2_4 = "\\Stealer" fullword wide
        $g1 = "$983a3552-4ec3-4936-bd4a-8e6fd67b4c67" fullword ascii
        $g2 = "$a5d9ca4d-400f-4e07-8c09-a916b548f2e3" fullword ascii
        $g3 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v1*) or 3 of ($v2*))) or 7 of ($v1*) or 3 of ($v2*) or (2 of ($g*) and 3 of them))
}

rule MALWARE_Win_AllaKore {
     meta:
        author = "ditekSHen"
        description = "Detects AllaKore"
    strings:
        $x1 = "AllaKore Remote - Chat" fullword wide
        $x2 = "AllaKore Remote - Share Files" fullword wide
        $x3 = "CYRUS - Chat" fullword wide
        $x4 = "CYRUS - Share Files" fullword wide
        $x5 = "<|REDIRECT|><|GETFOLDERS|>" fullword wide
        $x6 = "<|REDIRECT|><|DOWNLOADFILE|>" fullword wide
        $x7 = "<|REDIRECT|><|WHEELMOUSE|>" fullword wide
        $x8 = "<|REDIRECT|><|SETMOUSE" wide
        $x9 = "<|CHECKIDPASSWORD|>" fullword wide
        $x10 = "<|KEYBOARDSOCKET|>" fullword wide
        $x11 = "<|REDIRECT|><|CLIPBOARD|>" fullword wide
        $x12 = "<|IDEXISTS!REQUESTPASSWORD|>" fullword wide
        $x13 = "<|GETFULLSCREENSHOT|>" fullword wide
        $x14 = "<|MAINSOCKET|>" fullword ascii
        $s1 = "You can not connect with yourself!" wide
        $s2 = "Waiting for authentication..." wide
        $s3 = "Connected support!" wide
        $s4 = "ID does nor exists." wide
        $s5 = "Finding the ID..." wide
        $s6 = "PC is Busy!" wide
        $s7 = "Upload &  Execute" fullword ascii
        $s8 = "Download file selected" fullword ascii
        $s9 = "CaptureKeys_TimerTimer" fullword ascii
        $s10 = "Remote File Manager" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($x*) or 4 of ($s*) or (3 of ($s*) and 2 of ($x*)))
}

rule MALWARE_Win_ReverseRAT {
     meta:
        author = "ditekSHen"
        description = "Detects ReverseRAT"
    strings:
        $pdb1 = "\\ReverseRat.pdb" ascii nocase
        $pdb2 = "\\ReverseRat\\obj\\" ascii nocase
        $s1 = "processCmd" fullword ascii
        $s2 = "CmdOutputDataHandler" fullword ascii
        $s3 = "sendingProcess" fullword ascii
        $s4 = "SetStartup" fullword ascii
        $s5 = "RunServer" fullword ascii
        $s6 = "_OutputDataReceived" ascii
        $s7 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 
                00 03 0a 00 00 13 74 00 65 00 72 00 6d 00
                69 00 6e 00 61 00 74 00 65 00 00 09 65 00
                78 00 69 00 74 00 }
    condition:
        uint16(0) == 0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or 5 of ($s*))
}

rule MALWARE_Win_SmokeLoader {
    meta:
        author = "ditekSHen"
        description = "Detects SmokeLoader variants"
    strings:
        $x1 = "G2A/CLP/05/RYS" fullword wide // mutex
        $x2 = "0N1Y/53R10U5/BU51N355" fullword wide // mutex
        $x3 = "CH4PG3PB-6HT2VI9C-O2NL2NO5-QP1BW0EG" fullword wide // mutex
        $s1 = "Azure-Update-Task" fullword wide
        $s2 = "C:\\Windows\\System32\\schtasks.exe" fullword wide
        $s3 = "/C /create /F /sc minute /mo 1 /tn \"" fullword wide
        $s4 = "\\Microsoft\\Network" fullword wide
        $s5 = "\\Microsoft\\TelemetryServices" fullword wide
        $s6 = "\" /tr \"" fullword wide
        $e1 = "\\sqlcmd.exe" fullword wide
        $e2 = "\\sihost.exe" fullword wide
        $e3 = "\\fodhelper.exe" fullword wide
        //$o1 = { 6a 34 59 66 39 0e 75 7c 0f b7 46 02 6a 30 5a 83 }
        //$o2 = { 5e c9 c3 56 8d 85 f8 fd ff ff 50 8d 85 f0 fb ff }
        //$o3 = { 8b d9 eb 03 8b 5d ec 0f b7 c2 89 45 ec 0f b7 c2 }
        //$o4 = { 8b 5d fc 66 89 04 77 46 eb 2a 8b 5d fc 85 db 74 }
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($e*)))
}

rule MALWARE_Win_DLInjector03 {
    meta:
        author = "ditekSHen"
        description = "Detects unknown loader / injector"
    strings:
        $x1 = "LOADER ERROR" fullword ascii
        $s1 = "_ZN6curlpp10OptionBaseC2E10CURLoption" fullword ascii
        $s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_CoinMiner02 {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining malware"
    strings:
        $s1 = "%s/%s (Windows NT %lu.%lu" fullword ascii
        $s2 = "\\Microsoft\\Libs\\WR64.sys" wide
        $s3 = "\\\\.\\WinRing0_" wide
        $s4 = "pool_wallet" ascii
        $s5 = "cryptonight" ascii
        $s6 = "mining.submit" ascii
        $c1 = "stratum+ssl://" ascii
        $c2 = "daemon+http://" ascii
        $c3 = "stratum+tcp://" ascii
        $c4 = "socks5://" ascii
        $c5 = "losedaemon+https://" ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) and 1 of ($c*))
}

rule MALWARE_Win_Mercurial {
    meta:
        author = "ditekSHen"
        description = "Detects Mercurial infostealer"
    strings:
        $x1 = "mercurial grabber" wide nocase
        $x2 = "\"text\":\"Mercurial Grabber |" wide
        $x3 = "/nightfallgt/mercurial-grabber" wide
        $s1 = "/LimerBoy/Adamantium-Thief/" ascii
        $s2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0" fullword wide
        $s3 = "StealCookies" fullword ascii
        $s4 = "StealPasswords" fullword ascii
        $s5 = "DetectDebug" fullword ascii
        $s6 = "CaptureScreen" fullword ascii
        $s7 = "WebhookContent" fullword ascii
        $s8 = /Grab(Token|Product|IP|Hardware)/ fullword ascii
        $p1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword ascii wide
        $p2 = "mfa\\.[\\w-]{84}" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or 5 of ($s*) or (all of ($p*) and 3 of ($s*)))
}

rule MALWARE_Win_Phonzy {
    meta:
        author = "ditekSHen"
        description = "Detects specific downloader agent"
    strings:
        $ua1 = "User-Agent: Mozilla/5.0 (X11; Linux" wide
        $s1 = "<meta name=\"keywords\" content=\"([\\w\\d ]*)\">" fullword wide
        $s2 = "WebClient" fullword ascii
        $s3 = "WriteAllText" fullword ascii
        $s4 = "DownloadString" fullword ascii
        $s5 = "WriteByte" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (1 of ($ua*) and ($s1) and 2 of ($s*)))
}

rule MALWARE_Win_Hive {
    meta:
        author = "ditekSHen"
        description = "Detects Hive ransomware"
    strings:
        $url1 = "http://hivecust" ascii
        $url2 = "http://hiveleakdb" ascii
        $s1 = "encrypt_files.go" ascii
        $s2 = "erase_key.go" ascii
        $s3 = "kill_processes.go" ascii
        $s4 = "remove_shadow_copies.go" ascii
        $s5 = "stop_services_windows.go" ascii
        $s6 = "remove_itself_windows.go" ascii
        $x1 = "/encryptor/" ascii
        $x2 = "HOW_TO_DECRYPT.txt" ascii
        $x3 = "FilesEncrypted" fullword ascii
        $x4 = "EncryptionStarted" fullword ascii
        $x5 = "encryptFilesGroup" fullword ascii
        $x6 = "Your data will be undecryptable" ascii
        $x7 = "- Do not fool yourself. Encryption has perfect secrecy" ascii
        $v1_1 = ".EncryptFiles." ascii
        $v1_2 = ".EncryptFilename." ascii
        $v1_3 = ")*struct { F uintptr; .autotmp_14 string }" ascii
        $v1_4 = "D*struct { F uintptr; data *[]uint8; seed *uint8; fnc *main.decFunc }" ascii
        $v1_5 = "golang.org/x/sys/windows.getSystemWindowsDirectory" ascii
        $v1_6 = "path/filepath.WalkDir" ascii
        $v2_1 = "taskkill /f /im" ascii
        $v2_2 = "schtasks /delete /tn" ascii
        $v2_3 = "encfile.txt" ascii
        $v2_4 = "README.html" ascii
        $v2_5 = "total encrypt %v/%v" ascii
        $v2_6 = "<b>ITSSHOWKEY</b>" ascii
        $v2_7 = "Recovery your files." ascii
        $v2_8 = "yaml:\"send_host\"" ascii  // send_host: "45.76.99.222:80"
        $v2_9 = "yaml:\"ignore_dir\"" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($url*) or all of ($s*) or 4 of ($x*) or 5 of ($v1*) or 5 of ($v2*) or (4 of ($v2*) and #v2_1 > 10))
}

rule MALWARE_Win_Spyro {
    meta:
        author = "ditekSHen"
        description = "Detects Spyro / VoidCrypt / Limbozar ransomware"
    strings:
        $s1 = "Decrypt-info.txt" ascii wide
        $s2 = "AbolHidden" ascii wide
        $s3 = "C:\\ProgramData\\prvkey" ascii wide
        $s4 = ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP" ascii
        $s5 = "C:\\Users\\LEGION\\" ascii
        $s6 = "C:\\ProgramData\\pkey.txt" fullword ascii
        $s7 = ".Spyro" fullword ascii
        $m1 = "Go to C:\\ProgramData\\ or in Your other Drives" wide
        $m2 = "saving prvkey.txt.key file will cause" wide
        $m3 = "in Case of no Answer:" wide
        $m4 = "send us prvkey*.txt.key" wide
        $m5 = "Somerhing went wrong while writing payload on disk" ascii
        $m6 = "this country is forbidden.\"}" ascii
        $c1 = "Voidcrypt/1.0" ascii
        $c2 = "h1dd3n.cc" ascii
        $c3 = "/voidcrypt/index.php" ascii
        $c4 = "&user=" ascii
        $c5 = "&disk-size=" ascii
        $c6 = "unique-id=" ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or 4 of ($c*) or 3 of ($m*) or 8 of them)
}

rule MALWARE_Win_DarkVNC {
    meta:
        author = "ditekSHen"
        description = "Detects DarkVNC"
    strings:
        $s1 = "USR-%s(%s)_%S-%S%u%u" fullword wide
        $s2 = "BOT-%s(%s)_%S-%S%u%u" fullword wide
        $s3 = "USR-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
        $s4 = "BOT-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
        $s5 = "PRM_STRG" fullword wide
        $s6 = "bot_shell >" ascii
        $s7 = "monitor_off / monitor_on" ascii
        $s8 = "kbd_off / kbd_on" ascii
        $s9 = "ActiveDll: Dll inject thread for process 0x%x terminated with status: %u" ascii
        $s10 = "PsSup: File %s successfully started with parameter \"%s\"" ascii
        $s11 = "PsSup: ShellExecute failed. File: %s, error %u" ascii
        $s12 = "#hvnc" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_RSJON {
    meta:
        author = "ditekSHen"
        description = "Detects RSJON / Ryzerlo / HiddenTear ransomware"
    strings:
        $pdb1 = "C:\\Users\\brknc\\source\\repos\\" ascii
        $pdb2 = "\\rs-jon\\obj\\Debug\\rs-jon.pdb" ascii
        $pdb3 = "\\rs-jon\\obj\\Release\\rs-jon.pdb" ascii
        $x1 = "READ_ME_PLZ.txt" wide
        $x2 = "Files has been encrypted with rs-jon" wide
        $x3 = ".rsjon" wide
        $x4 = "bitcoins or kebab" wide
        $x5 = /rs[-_]jon/ fullword ascii wide
        $s1 = "SPIF_UPDATEINIFILE" fullword ascii
        $s2 = "SPI_SETDESKWALLPAPER" fullword ascii
        $s3 = "bytesToBeEncrypted" fullword ascii // Same as Apsotle
        $s4 = "SendPassword" fullword ascii
        $s5 = "EncryptFile" ascii
        $s6 = "fWinIni" fullword ascii
        $s7 = "BTCAdress" fullword ascii
        $s8 = "self_destruck" fullword ascii // Simialr to Apsotle (SelfDelete)
        $c1 = "?computer_name=" wide
        $c2 = "&serialnumber=" wide
        $c3 = "&password=" wide
        $c4 = "&allow=ransom" wide
        $c5 = "://darkjon.tk/" wide
        $c6 = "/rnsm/write.php" wide
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or 6 of ($s*) or 4 of ($c*) or (2 of ($c*) and 4 of ($s*)) or (1 of ($pdb*) and 1 of them))
}

rule MALWARE_Win_BoxCaon {
    meta:
        author = "ditekSHen"
        description = "Detects IndigoZebra BoxCaon"
    strings:
        $s1 = "<RetCMD null>" fullword wide
        $s2 = "<txt null>" fullword wide
        $s3 = "C:\\Users\\Public\\%d\\" fullword wide
        $s4 = "api.dropboxapi.com" fullword wide
        $s5 = "/2/files/upload" fullword wide
        $ts1 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" ascii wide
        $ts2 = "%s /A /C \"%s\" > %s" ascii wide
        $ts3 = "ersInfo" ascii wide
        $ts4 = "%svmpid%d.log" ascii wide
        $ts5 = "%scscode%d.log" ascii wide
    condition:
        (uint16(0) == 0x5a4d and all of ($s*)) or all of ($ts*)
}

rule MALWARE_Win_AvosLocker {
    meta:
        author = "ditekSHen"
        description = "Hunt for AvosLocker ransomware"
    strings:
        $s1 = "GET_YOUR_FILES_BACK.txt" ascii wide
        $s2 = ".avos" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Diavol {
    meta:
        author = "ditekSHen"
        description = "Detects Diavol ransomware"
    strings:
        $s1 = "README_FOR_DECRYPT.txt" ascii wide nocase
        $s2 = ".lock64" fullword ascii wide
        $s3 = "LockMainDIB" ascii wide
        $s4 = "locker.divided" ascii wide
        $s5 = "%tob_dic%/" wide
        $s6 = "%cid_bot%" wide
        $m1 = "GENBOTID" ascii wide
        $m2 = "SHAPELISTS" ascii wide
        $m3 = "REGISTER" ascii wide
        $m4 = "FROMNET" ascii wide
        $m5 = "SERVPROC" ascii wide
        $m6 = "SMBFAST" ascii wide
        $c1 = "/Bnyar8RsK04ug/" fullword ascii
        $c2 = "/landing" fullword ascii
        $c3 = "/wipe" fullword ascii
        $c4 = "&ip_local1=111.111.111.111&ip_local2=222.222.222.222&ip_external=2.16.7.12" fullword ascii
        $c5 = "&group=" fullword ascii
        $c6 = "/BnpOnspQwtjCA/register" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or 5 of ($m*) or 4 of ($c*) or 7 of them)
}

rule MALWARE_Win_MargulasRAT {
    meta:
        author = "ditekSHen"
        description = "Detects MargulasRAT"
    strings:
        $pdb1 = "G:\\VP-S-Fin\\memory\\" ascii
        $pdb2 = "G:\\VP-S-Fin\\Margulas\\" ascii
        $pdb3 = "G:\\VP-S-Fin\\remote" ascii
        $pdb4 = "G:\\VP-S-Fin\\" ascii
        $s1 = "/C choice /C Y /N /D Y /T 1 & Del " fullword wide
        $s2 = "strToHash" fullword ascii
        $s3 = "\\socking" fullword wide
        $s4 = "\\wininets" fullword wide
        $s5 = "ClientSocket" fullword ascii
        $s6 = "new Stream()" fullword wide
        $s7 = "CipherText" fullword ascii
        $s8 = "WriteAllBytes" fullword ascii
        $s9 = { 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00}
        $s10 = "pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp" wide
        $c1 = "149.248.52.61" wide
        $c2 = "://vpn.nic.in" wide
        $c3 = "://www.mod.gov.in/dod/sites/default/files/" wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($pdb*) and (1 of ($c*) or 3 of ($s*))) or (1 of ($c*) and 3 of ($s*)) or (6 of ($s*)))
}

rule MALWARE_Win_LilithRAT {
    meta:
        author = "ditekSHen"
        description = "Detects LilithRAT"
        hash1 = "132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a"
        hash2 = "ab7b6e0b28995bdeea44f20c0aba47f95e1d6ba281af3541cd2c04dc6c2a3ad9" // actor testing?
        hash3 = "b2eeb487046ba1d341fb964069b7e83027b60003334e04e41b467e35c3d2460f"
        hash4 = "cebcda044c60b709ba4ee0fa9e1e7011a6ffc17285bcc0948d27f866ec8d8f20"
    strings:
        $pdb1 = "c:\\Users\\Groovi\\Documents\\Visual Studio 2008\\Projects\\TestDll\\" ascii
        $pdb2 = "C:\\Users\\iceberg\\Downloads\\RAT-Server-master\\RAT-Server-master\\RAT\\Debug\\RAT.pdb" ascii
        $pdb3 = "C:\\Users\\Samy\\Downloads\\Compressed\\Lilith-master\\Debug\\Lilith.pdb" ascii
        $s1 = "log.txt" fullword ascii
        $s2 = "keylog.txt" fullword ascii
        $s3 = "File Listing Completed Successfully." fullword ascii
        $s4 = "Download Execute" fullword ascii
        $s5 = "File Downloaded and Executed Successfully." fullword ascii
        $s6 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
        $s7 = "CMD session closed" ascii
        $s8 = "Restart requested: Restarting self" fullword ascii
        $s9 = "Termination requested: Killing self" fullword ascii
        $s10 = "Couldn't write to CMD: CMD not open" fullword ascii
        $s11 = "keydump" fullword ascii
        $s12 = "remoteControl" fullword ascii
        $s13 = "packettype" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($pdb*) or 6 of ($s*) or (1 of ($pdb*) and 4 of ($s*)))
}

rule MALWARE_Win_EpicenterRAT {
    meta:
        author = "ditekSHen"
        description = "Detects EpicenterRAT"
    strings:
        $pdb1 = "c:\\Users\\Zombie\\Desktop\\MutantNinja\\" ascii
        $pdb2 = "\\Epicenter Client\\" ascii
        $s1 = "PROCESS_LIST<%SEP%>" fullword wide
        $s2 = "GETREADY_RECV_FILE<%SEP%>" fullword wide
        $s3 = "DISPLAY<%SEP%>" wide
        $s4 = "GETSCREEN<%SEP%>" fullword wide
        $s5 = "dumpImageName" fullword ascii
        $s6 = "dumpLoc" fullword ascii
        $s7 = "EXPECT<%SEP%>filelist<%SEP%>" fullword wide
        $s8 = "<%FSEP%>FOLDER<%FSEP%>-<%SEP%>" fullword wide
        $s9 = "KILLPROC<%SEP%>" fullword wide
        $s10 = "LAUNCHPROC<%SEP%>" fullword wide
        $s11 = "cmd.exe /c start /b " fullword wide
        $s12 = "savservice" fullword wide
        $s13 = "getvrs" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($pdb*) or 5 of ($s*))
}

rule MALWARE_Win_LastConn {
    meta:
        author = "ditekSHen"
        description = "Detects LastConn"
    strings:
        $s1 = "System.Net.Http.SysSR" fullword wide
        $s2 = "System.Net.Http.WrSR" fullword wide
        $s3 = "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK" fullword wide
        $s4 = { 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0c 6e
               00 6f 00 74 00 69 00 66 00 79 00 04 06 12 80 e8
               05 00 00 12 80 e8 08 75 00 73 00 65 00 72 00 08
               74 00 65 00 61 00 6d 00 06 61 00 70 00 70 00 0c
               6e 00 6f 00 61 00 75 00 74 00 68 00 }
        $s5 = { 68 00 69 00 64 00 64 00 65 00 6e 00 10 64 00 69
               00 73 00 61 00 6c 00 6c 00 6f 00 77 00 0e 65 00
               78 00 74 00 65 00 6e 00 64 00 73 00 04 69 00 64
               00 16 75 00 6e 00 69 00 71 00 75 00 65 00 49 00
               74 00 65 00 6d 00 73 }
        $s6 = "<RunFileOnes>d__" ascii
        $s7 = "<UploadFile>d__" ascii
        $s8 = "<ChunkUpload>d__" ascii
        $s9 = "<StartFolder>d__" ascii
        $s10 = "<ReadFileAlw>d__" ascii
        $s12 = "<WriteFileToD>d__" ascii
        $s13 = "<ReadFile>d__" ascii
        $s14 = "<GetUpload>d__" ascii
        $s15 = "CDropbox.Api.DropboxRequestHandler+<RequestJsonStringWithRetry>d__" ascii
    condition:
        uint16(0) == 0x5a4d and 12 of them
}

rule MALWARE_Win_CrimsonRAT {
    meta:
        author = "ditekSHen"
        description = "Detects CrimsonRAT"
    strings:
        $s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" fullword wide
        $s2 = "system volume information|" fullword wide
        $s3 = "program files (x86)|" fullword wide
        $s4 = "program files|" fullword wide
        $s5 = "<SAVE_AUTO<|" fullword wide
        $s6 = "add_up_files" fullword ascii
        $s7 = "see_folders" ascii
        $s8 = "see_files" ascii
        $s9 = "see_scren" ascii
        $s10 = "see_recording" ascii
        $s11 = "see_responce" ascii
        $s12 = "pull_data" ascii
        $s13 = "do_process" ascii
        $s14 = "do_updated" ascii
        $s15 = "IPSConfig" fullword ascii
        $s16 = "#Runing|ver#" wide
        $s17 = "|fileslog=" wide
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_ActionRAT {
    meta:
        author = "ditekSHen"
        description = "Detects ActionRAT, CSharp and Delfi variants"
    strings:
        $x1 = /<action>(connect|command|drives|getfiles|upload|execute|download)<action>/ fullword wide
        $x2 = "aHR0cDovLzE0NC45MS42NS4xMDAv" wide
        $x3 = "aHR0cDovL21mYWhvc3QuZGRucy5uZXQv" wide
        $f1 = "<updateCommand>b__" ascii
        $f2 = "<getDrives>b__" ascii
        $f3 = "<getStatus>b__" ascii
        $f4 = "<getDirectories>b__" ascii
        $f5 = "<updateUpload>b__" ascii
        $f6 = "<infinity>b__" ascii
        $f7 = "<uploadFile>b__" ascii
        $s1 = "beaconURL" ascii
        $s2 = "PingReply" ascii
        $s3 = "updateUpload" ascii
        $s4 = "updateCommand" ascii
        $s5 = "runCommand" ascii
        $s6 = "uploadFile" ascii
        $s7 = "SELECT * FROM MSFT_NetAdapter WHERE ConnectorPresent = True AND DeviceID = '{0}'" fullword wide
        $s8 = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $s9 = "Mozilla/3.0" fullword wide
        $s10 = "|directory|N/A|" fullword wide
        $s11 = "cmd.exe /c" fullword wide
        $c1 = /Content-Disposition: form-data; name=(hostname|hid|id|action|secondary)/ fullword wide
        $c2 = /(classification|updatecs|update|beacon)\.php/ wide
        $c3 = "Content-Disposition: form-data;name=\"{0}\";filename=\"{1}\"filepath=\"{2}\"" fullword wide
        $pdb1 = "D:\\Projects\\C#\\HTTP-Simple\\WindowsMediaPlayer - HTTP - " ascii
        $pdb2 = "\\WindowsMediaPlayer10\\obj\\x86\\Release\\winow4.pdb" ascii
    condition:
        uint16(0) == 0x5a4d and (#x1 > 5 or (all of ($f*) and (1 of ($s*) or 2 of ($c*))) or 7 of ($s*) or all of ($c*) or (all of ($pdb*) and 4 of them) or ( 2 of ($x*) and 5 of them))
}

rule MALWARE_Win_Nodachi {
    meta:
        author = "ditekSHen"
        description = "Detects Nodachi infostealer"
    strings:
        $x1 = "//AppData//Roaming//kavachdb//kavach.db" ascii
        $s1 = "/upload/drive/v3/files/{fileId}" ascii
        $s2 = "main.getTokenFromWeb" ascii
        $s3 = "main.tokenFromFile" ascii
        $s4 = "/goLazagne/" ascii
        $s5 = "/extractor/withoutdrive/main.go" ascii
        $s6 = "struct { Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
        $s7 = "C://Users//public//cred.json" ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*)) or (4 of ($s*)))
}

rule MALWARE_Win_IAmTheKingQueenOfHearts {
    meta:
        author = "ditekSHen"
        description = "IAmTheKing Queen Of Hearts payload"
    strings:
        $s1 = "{'session':[{'name':'" ascii
        $s2 = "begin mainthread ok" wide
        $s3 = "getcommand error" wide
        $s4 = "querycode error" wide
        $s5 = "Code = %d" wide
        $s6 = "cookie size :%d" wide
        $s7 = "send request error:%d" wide
        $s8 = "PmMytex%d" wide
        $s9 = "%s_%c%c%c%c_%d" wide
        $s10 = "?what@exception@std@@UBEPBDXZ" ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_IAmTheKingQueenOfClubs {
    meta:
        author = "ditekSHen"
        description = "IAmTheKing Queen Of Clubs payload"
    strings:
        $s1 = "Not Support!" fullword wide
        $s2 = "%s|%s|%s|%s" fullword wide
        $s3 = "cmd.exe" fullword wide
        $s4 = "for(;;){$S=Get-Content \"%s\";IF($S){\"\" > \"%s\";$t=iex $S 2>\"%s\";$t=$t+' ';echo $t >>\"%s\";}sleep -m " wide
        $s5 = "PowerShell.exe -nop -c %s" fullword wide
        $s6 = "%s \"%s\" Df" fullword wide
        $s7 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_IAmTheKing {
    meta:
        author = "ditekSHen"
        description = "IAmTheKing payload"
    strings:
        $s1 = "DeleteFile \"%s\" Failed,Err=%d" wide
        $s2 = "DeleteFile \"%s\" Success" wide
        $s3 = "ExcuteFile \"%s\" Failed,Err=%d" wide
        $s4 = "ExcuteFile \"%s\" Success" wide
        $s5 = "CreateDownLoadFile \"%s\" Failed,Error=%d" wide
        $s6 = "uploadFile \"%s\" Failed,errorcode=%d" wide
        $s7 = "CreateUpLoadFile \"%s\" Success" wide
        $s8 = "im the king" ascii
        $s9 = "dont disturb me" fullword ascii
        $s10 = "kill me or love me" fullword ascii
        $s11 = "please leave me alone" fullword ascii
        $s12 = "calculate the NO." fullword ascii
        $s13 = "\\1-driver-vmsrvc" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_Win_GoBrut {
    meta:
        author = "ditekSHen"
        description = "Detects unknown Go multi-bruteforcer bot (StealthWorker / GoBrut) against multiple systems: QNAP, MagOcart, WordPress, Opencart, Bitrix, Postgers, MySQL, Drupal, Joomla, SSH, FTP, Magneto, CPanel"
    strings:
        $x1 = "/src/StealthWorker/Worker" ascii
        $x2 = "/go/src/Cloud_Checker/" ascii
        $x3 = "brutXmlRpc" ascii
        $s1 = "main.WPBrut" ascii
        $s2 = "main.WPChecker" ascii
        $s3 = "main.WooChecker" ascii
        $s4 = "main.StandartBrut" ascii
        $s5 = "main.StandartBackup" ascii
        $s6 = "main.WpMagOcartType" ascii
        $s7 = "main.StandartAdminFinder" ascii
        $w1 = "/WorkerQnap_brut/main.go" ascii
        $w2 = "/WorkerHtpasswd_brut/main.go" ascii
        $w3 = "/WorkerOpencart_brut/main.go" ascii
        $w4 = "/WorkerBitrix_brut/main.go" ascii
        $w5 = "/WorkerPostgres_brut/main.go" ascii
        $w6 = "/WorkerMysql_brut/main.go" ascii
        $w7 = "/WorkerFTP_brut/main.go" ascii
        $w8 = "/WorkerSSH_brut/main.go" ascii
        $w9 = "/WorkerDrupal_brut/main.go" ascii
        $w10 = "/WorkerJoomla_brut/main.go" ascii
        $w11 = "/WorkerMagento_brut/main.go" ascii
        $w12 = "/WorkerWHM_brut/main.go" ascii
        $w13 = "/WorkerCpanel_brut/main.go" ascii
        $w14 = "/WorkerPMA_brut/main.go" ascii
        $w15 = "/WorkerWP_brut/main.go" ascii
        $p1 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=cpanel" ascii
        $p2 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=ftpBrut" ascii
        $p3 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=mysql_b" ascii
        $p4 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=qnapBrt" ascii
        $p5 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=OCartBrt" ascii
        $p6 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=phpadmin" ascii
        $p7 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=bitrixBrt" ascii
        $p8 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=drupalBrt" ascii
        $p9 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=joomlaBrt" ascii
        $p10 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=htpasswdBrt" ascii
        $p11 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=magentoBrt" ascii
        $p12 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=postgres_b" ascii
        $p13 = "AUTH_FORM=Y&TYPE=AUTH&USER_LOGIN=%s&USER_PASSWORD=%s&Login=&captcha_sid=&captcha_word=" ascii
        $p14 = "%qlog=%s&pwd=%s&wp-submit=Log In&redirect_to=%s/wp-admin/&testcookie=1" ascii
        $p15 = "name=%s&pass=%s&form_build_id=%s&form_id=user_login_form&op=Log" ascii
        $p16 = "username=%s&passwd=%s&option=com_login&task=login&return=%s&%s=1" ascii
        $v1_1 = "brutC" fullword ascii
        $v1_2 = "XmlRpc" fullword ascii
        $v1_3 = "shouldRetry$" ascii
        $v1_4 = "HttpC|%" ascii
        $v1_5 = "ftpH%_" ascii
        $v1_6 = "ssh%po" ascii
        $v1_7 = "?sevlyar/4-da" ascii
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x457f) and ((2 of ($x*) and 3 of ($s*)) or all of ($s*) or 6 of ($w*) or 6 of ($p*) or 6 of ($v1*) or 12 of them)
}

rule MALWARE_Win_BioPass_Dropper {
    meta:
        author = "ditekSHen"
        description = "Detects Go BioPass dropper"
    strings:
        $go = "Go build ID:" ascii
        $s1 = "main.NetWorkStatus" ascii
        $s2 = "main.NoErrorRunFunction" ascii
        $s3 = "main.FileExist" ascii
        $s4 = "main.execute" ascii
        $s5 = "main.PsGenerator" ascii
        $s6 = "main.downFile" ascii
        $s7 = "main.Unzip" ascii
        $url1 = "https://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/" ascii
        $x1 = "SCHTASKS /Run /TN SYSTEM_CDAEMON" ascii
        $x2 = "SCHTASKS /Run /TN SYSTEM_SETTINGS" ascii
        $x3 = "SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST" ascii
        $x4 = ".exe /install /quiet /norestart" ascii
        $x5 = "exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\\''http" ascii
        $x6 = "powershell.exe -Command $" ascii
        $x7 = ".Path ='-----BEGIN RSA TESTING KEY-----" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 5 of ($x*) or (1 of ($url*) and ($go)) or 9 of them)
}

rule MALWARE_Win_A310Logger {
    meta:
        author = "ditekSHen"
        description = "Detects A310Logger"
        snort_sid = "920204-920207"
    strings:
        $s1 = "Temporary Directory * for" fullword wide
        $s2 = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*RD_" wide
        $s3 = "@ENTIFIER=" wide
        $s4 = "ExecQuery" fullword wide
        $s5 = "MSXML2.ServerXMLHTTP.6.0" fullword wide
        $s6 = "Content-Disposition: form-data; name=\"document\"; filename=\"" wide
        $s7 = "CopyHere" fullword wide
        $s8 = "] Error in" fullword wide
        $s9 = "shell.application" fullword wide nocase
        $s10 = "SetRequestHeader" fullword wide
        $s11 = "\\Ethereum\\keystore" fullword wide
        $s12 = "@TITLE Removing" fullword wide
        $s13 = "@RD /S /Q \"" fullword wide
        $en1 = "Unsupported encryption" fullword wide
        $en2 = "BCryptOpenAlgorithmProvider(SHA1)" fullword wide
        $en3 = "BCryptGetProperty(ObjectLength)" fullword wide
        $en4 = "BCryptGetProperty(HashDigestLength)" fullword wide
        // varaint 1
        $v1_1 = "PW\\FILES\\SC::" wide
        $v1_2 = "AddAttachment" fullword wide
        $v1_3 = "Started:" fullword wide
        $v1_4 = "Ended:" fullword wide
        $v1_5 = "sharedSecret" fullword wide
        $v1_6 = "\":\"([^\"]+)\"" fullword wide
        $v1_7 = "\\credentials.txt" fullword wide
        $v1_8 = "WritePasswords" fullword ascii
        $v1_9 = "sGeckoBrowserPaths" fullword ascii
        $v1_10 = "get_sPassword" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or (3 of ($en*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($en*)) or 5 of ($v1*) or (4 of ($v1*) and 2 of ($s*) and 2 of ($en*)))
}

rule MALWARE_Win_CryLock {
    meta:
        author = "ditekSHen"
        description = "Detects CryLock ransomware"
    strings:
        $s1 = "Encrypted by BlackRabbit. (BR-" ascii
        $s2 = "{ENCRYPTENDED}" ascii
        $s3 = "{ENCRYPTSTART}" ascii
        $s4 = "<%UNDECRYPT_DATETIME%>" ascii
        $s5 = "<%RESERVE_CONTACT%>" ascii
        $s6 = "how_to_decrypt.hta" ascii wide
        $s7 = "END ENCRYPT ONLY EXTENATIONS" ascii
        $s8 = "END UNENCRYPT EXTENATIONS" ascii
        $s9 = "END COMMANDS LIST" ascii
        $s10 = "END PROCESSES KILL LIST" ascii
        $s11 = "END SERVICES STOP LIST" ascii
        $s12 = "END PROCESSES WHITE LIST" ascii
        $s13 = "END UNENCRYPT FILES LIST" ascii
        $s14 = "END UNENCRYPT FOLDERS LIST" ascii
        $s15 = "Encrypted files:" ascii
        $s16 = { 65 78 74 65 6e 61 74 69 6f 6e 73 00 ff ff ff ff
                 06 00 00 00 63 6f 6e 66 69 67 00 00 ff ff ff ff
                 (0a|0d 0a) 00 00 00 63 6f 6e 66 69 67 2e 74 78 
                 74 00 00 ff ff ff ff 03 00 00 00 68 74 61 }
        $p1 = "-exclude" fullword
        $p2 = "-makeff" fullword
        $p3 = "-full" fullword
        $p4 = "-nolocal" fullword
        $p5 = "-nolan" fullword
        $p6 = "\" -id \"" fullword
        $p7 = "\" -wid \"" fullword
        $p8 = "\"runas\"" fullword
        $p9 = " -f -s -t 00" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or 6 of ($p*))
}

rule MALWARE_Win_DeepRats {
    meta:
        author = "ditekSHen"
        description = "Detects DeepRats ("
        hash1 = "1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6"
    strings:
        $s1 = "https://freegeoip.live/json/https://myexternalip.com/rawin" ascii
        $s2 = "github.com/cretz/bine" ascii
        $s3 = "github.com/kbinani/screenshot" ascii
        $s4 = "socks5://%s:%d" ascii
        $s5 = "socks5://%s:%s@%s:%d" ascii
        $s6 = "http://%s:%d" ascii
        $s7 = "http://%s@%s:%d" ascii
        $s8 = "%SystemRoot%\\system32\\--CookieAuthentication" ascii
        $s9 = "tor_addr_" ascii
        $f1 = ".GetVnc" ascii
        $f2 = ".GetCommand" ascii
        $f3 = ".GetPayload" ascii
        $f4 = ".ListenCommands" ascii
        $f5 = ".ReceiveFile" ascii
        $f6 = ".RegisterImplant" ascii
        $f7 = ".Screenshot" ascii
        $f8 = ".SendFile" ascii
        $f9 = ".StartShell" ascii
        $f10 = ".UnregisterImplant" ascii
        $f11 = ".VncInstalled" ascii
        $f12 = ".PingPong" ascii
        $f13 = ".ListenCMD" ascii
    condition:
        uint16(0) == 0x5a4d and (7 of ($s*) or 8 of ($f*))
}

rule MALWARE_Win_Gasket {
    meta:
        author = "ditekSHen"
        description = "Detects Gasket"
    strings:
        $s1 = "main.checkGasket" ascii
        $s2 = "main.connectGasket" ascii
        $s3 = "/cert/trust/dev/stderr/dev/stdout/index.html" ascii
        $f1 = ".SetPingHandler." ascii
        $f2 = ".SetPongHandler." ascii
        $f3 = ".computeMergeInfo." ascii
        $f4 = ".computeDiscardInfo." ascii
        $f5 = ".readPlatformMachineID." ascii
        $f6 = ".(*Session).establishStream." ascii
        $f7 = ".(*Session).handleGoAway." ascii
        $f8 = ".(*Stream).processFlags." ascii
        $f9 = ".(*Session).handlePing." ascii
        $f10 = ".(*windowsService).Install." ascii
        $f11 = ".(*windowsService).Uninstall." ascii
        $f12 = ".(*windowsService).Status." ascii
        $f13 = ".getStopTimeout." ascii
        $f14 = ".DialContext." ascii
        $f15 = ".WriteControl." ascii
        $f16 = ".(*Server).authenticate." ascii
        $f17 = ".(*Server).ServeConn." ascii
        $f18 = ".(*TCPProxy).listen." ascii
        $f19 = ".UserPassAuthenticator.Authenticate." ascii
        $f20 = ".(*InfoPacket).XXX_" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 16 of ($f*))
}

rule MALWARE_Win_SilentMoon {
    meta:
        author = "ditekSHen"
        description = "Detects SilentMoon"
    strings:
        $s1 = "\\\\.\\Global\\PIPE\\" fullword wide
        $s2 = "REMOTE_NS:ERROR:%d" fullword ascii
        $s3 = "REMOTE:ERROR:%d" fullword ascii
        $s4 = "COMNAP,COMNODE,SQLQUERY,SPOOLSS,LLSRPC,browser" fullword wide
        $s5 = "Mem alloc err" fullword ascii
        $s6 = "block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d" ascii
        $x1 = "ACTION:UNSUPPORTED" fullword ascii
        $x2 = "?ServiceMain@@YAXKPAPA_W@Z" fullword ascii
        $x3 = "?ServiceCtrlHandler@@YGKKKPAX0@Z" fullword ascii
        $x4 = "%d socks, %d sorted, %d scanned" ascii
        $x5 = "GoldenSky" fullword wide
        $x6 = "SilentMoon" fullword wide
        $x7 = "internalstoragerpc" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 3 of ($x*))
}

rule MALWARE_Win_Lu0Bot {
    meta:
        author = "ditekSHen"
        description = "Detects Lu0Bot"
    strings:
        $s1 = "WinExec" fullword ascii
        $s2 = "AlignRects" fullword ascii
        $o1 = { be 00 20 40 00 89 f7 89 f0 81 c7 a? 01 00 00 81 }
        $o2 = { 53 50 e8 b0 01 00 00 e9 99 01 00 00 e8 ae 01 00 }
    condition:
        uint16(0) == 0x5a4d and filesize < 4KB and 1 of ($s*) and all of ($o*)
}

rule MALWARE_Win_ShellcodeDLEI {
    meta:
        author = "ditekSHen"
        description = "Detects shellcode downloader, executer, injector"
    strings:
        $s1 = "PPidSpoof" fullword ascii
        $s2 = "ProcHollowing" fullword ascii
        $s3 = "CreateProcess" fullword ascii
        $s4 = "DynamicCodeInject" fullword ascii
        $s5 = "PPIDDynCodeInject" fullword ascii
        $s6 = "MapAndStart" fullword ascii
        $s7 = "PPIDAPCInject" fullword ascii
        $s8 = "PPIDDLLInject" fullword ascii
        $s9 = "CopyShellcode" fullword ascii
        $s10 = "GetEntryFromBuffer" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and 5 of ($s*)
}

rule MALWARE_Win_BlueBot {
    meta:
        author = "ditekSHen"
        description = "Detects BlueBot"
    strings:
        $x1 = "Blue_Botnet" wide
        $x2 = "5-START-http" ascii
        $x3 = "*300-END-" ascii
        $x4 = "botlogger.php" wide
        $s1 = "//TARGET//" wide
        $s2 = "//BLOG//" wide
        $s3 = "MCBOTALPHA" wide
        $s4 = "//IPLIST//" wide
        $s5 = "Host: //BLOG//" wide
        $s6 = "User-Agent: //USERAGENT//" wide
        $s7 = "<string>//TARGET//</string>" wide
        $s8 = "POST //URL// HTTP/1.1/r/n" wide
        $v1 = "<attack>b__" ascii
        $v2 = "PressData" fullword ascii
        $v3 = "POSTPiece" fullword ascii
        $v4 = /(load|tcp|udp)Stuff/ fullword ascii
        $v5 = "isAttacking" fullword ascii
        $v6 = "DoSAttack" fullword ascii
        $v7 = "prv_attack" fullword ascii
        $v8 = "blogList"fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 5 of ($s*) or 5 of ($v*) or 9 of them)
}

rule MALWARE_Win_UNKCobaltStrike {
    meta:
        author = "ditekSHen"
        description = "Detects unknown malware, potentially CobaltStrike related"
    strings:
        $s1 = "https://%hu.%hu.%hu.%hu:%u" ascii wide
        $s2 = "https://microsoft.com/telemetry/update.exe" ascii wide
        $s3 = "\\System32\\rundll32.exe" ascii wide
        $s4 = "api.opennicproject.org" ascii wide
        $s5 = "%s %s,%s %u" ascii wide
        $s6 = "User32.d?" ascii wide
        $s7 = "StrDupA" fullword ascii wide
        $s8 = "{6d4feed8-18fd-43eb-b5c4-696ad06fac1e}" ascii wide
        $s9 = "{ac41592a-3d21-46b7-8f21-24de30531656}" ascii wide
        $s10 = "bd526:3b.4e32.57c8.9g32.35ef41642767~" ascii wide
        $s11 = { 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 97 } // BITS
        $s12 = { 0d 4c e3 5c c9 0d 1f 4c 89 7c da a1 b7 8c ee 7c } // BITS
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_EXEPWSHDL {
    meta:
        author = "ditekSHen"
        description = "Detects executable downloaders using PowerShell"
    strings:
        $x1 = "[Ref].Assembly.GetType(" ascii wide
        $x2 = ".SetValue($null,$true)" ascii wide
        $s1 = "replace" ascii wide
        $s2 = "=@(" ascii wide
        $s3 = "[System.Text.Encoding]::" ascii wide
        $s4 = ".substring" ascii wide
        $s5 = "FromBase64String" ascii wide
        $d1 = "New-Object" ascii wide
        $d2 = "Microsoft.XMLHTTP" ascii wide
        $d3 = ".open(" ascii wide
        $d4 = ".send(" ascii wide
    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and all of ($x*) and (3 of ($s*) or all of ($d*))
}

rule MALWARE_Win_MB150 {
    meta:
        author = "ditekSHen"
        description = "Detects MB150? Go ransomware"
    strings:
        $x1 = /main\.evade_(clicks_count|cpu_count|disk_size|foreground_window|hostname|mac|printer|screen_size|system_memory|time_acceleration|tmp|utc)/ fullword ascii
        $x2 = /main\.sandbox_(hostname|mac_addresses)/ fullword ascii
        $x3 = "main.drop_ransom_note" fullword ascii
        $x4 = "main.ransom_amount" fullword ascii
        $x5 = "main.create_encryption_key" fullword ascii
        $x6 = "main.encrypt" fullword ascii
        $x7 = "main.encrypt_encryption_key" fullword ascii
        $x8 = "main.encrypt_file" fullword ascii
        $x9 = "main.ext_blacklist" fullword ascii
        $mac1 = "00:03:FF00:05:6900:0C:2900:16:3E00:1C:1400:1C:4200:50:56" ascii nocase
        $mac2 = "00-03-FF00-05-6900-0C-2900-16-3E00-1C-1400-1C-4200-50-56" ascii nocase
        $mac3 = "0003FF000569000C2900163E001C14001C42005056" ascii nocase
        $go = "Go build ID:" ascii
        $s1 = "main.MB150" ascii
        $s2 = "http://1.1.1.1" ascii
        $s3 = "your personnal ID" ascii
        $s4 = "ransom amount" ascii
        $s5 = "binance.com" ascii
        $s6 = "getmonero.org" ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($x*) or ($go and 4 of ($s*)) or (1 of ($mac*) and (2 of ($x*) or 3 of ($s*))))
}

rule MALWARE_Win_Chaos {
    meta:
        author = "ditekSHen"
        description = "Detects Chaos ransomware"
    strings:
        $s1 = "<EncyptedKey>" fullword wide
        $s2 = "<EncryptedKey>" fullword wide
        $s3 = "C:\\Users\\" fullword wide
        $s4 = "read_it.txt" fullword wide
        $s5 = "#base64Image" fullword wide
        $s6 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" fullword wide
        $s7 = /check(Spread|Sleep|AdminPrivilage|deleteShadowCopies|disableRecoveryMode|deleteBackupCatalog)/ fullword ascii nocase
        $s8 = /(delete|disable)(ShadowCopies|RecoveryMode|BackupCatalog)/ fullword ascii nocase
        $s9 = "spreadName" fullword ascii
        $s10 = "processName" fullword ascii
        $s11 = "sleepOutOfTempFolder" fullword ascii
        $s12 = "AlreadyRunning" fullword ascii
        $s13 = "random_bytes" fullword ascii
        $s14 = "encryptDirectory" fullword ascii nocase
        $s15 = "EncryptFile" fullword ascii nocase
        $s16 = "intpreclp" fullword ascii
        $s17 = "bytesToBeEncrypted" fullword ascii
        $s18 = "textToEncrypt" fullword ascii
        $m1 = "Chaos is" wide
        $m2 = "Payment informationAmount:" wide
        $m3 = "Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com" wide
        $m4 = "where do I get Bitcoin" wide
    condition:
        uint16(0) == 0x5a4d and 6 of ($s*) or all of ($m*) or (2 of ($m*) and 4 of ($s*))
}

rule MALWARE_Win_HorusEyesRAT {
    meta:
        author = "ditekSHen"
        description = "Detects HorusEyesRAT"
    strings:
        $x1 = "\\HorusEyesRat-" ascii
        $x2 = "\\HorusEyesRat.pdb" ascii
        $x3 = "get_horus_eye" ascii
        $s1 = "get_Type_Packet" fullword ascii
        $s2 = "PacketLib" fullword ascii nocase
        $s3 = "System.Net.Sockets" fullword ascii
        $s4 = "PROCESS_MODE_BACKGROUND_BEGIN" fullword ascii
        $s5 = "EXECUTION_STATE" fullword ascii
        $s6 = /Plugins\\[A-Z]{2}.dll/ fullword wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 3 of ($s*)) or (4 of ($s*) and #s6 > 4))
}

rule MALWARE_Win_BreakWin {
    meta:
        author = "ditekSHen"
        description = "Detects BreakWin Wiper"
    strings:
        $s1 = "Started wiping file %s with %s." fullword wide
        $s2 = "C:\\Program Files\\Lock My PC" wide
        $s3 = "Stardust is still alive." fullword wide
        $s4 = "Failed to terminate the locker process." fullword wide
        $s5 = "C:\\Windows\\System32\\cmd.exe" fullword wide
        $s6 = "Process created successfully. Executed command: %s." fullword wide
        $s7 = "locker_background_image_path" fullword ascii
        $s8 = "takeown.exe /F \"C:\\Windows\\Web\\Screen\" /R /A /D Y" fullword ascii
        $s9 = "icacls.exe \"C:\\Windows\\Web\\Screen\" /reset /T" fullword ascii
        $s10 = "takeown.exe /F \"C:\\ProgramData\\Microsoft\\Windows\\SystemData\" /R /A /D Y" fullword ascii
        $s11 = ".?AVProcessSnapshotCreationFailedException@@" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

/*
rule MALWARE_Win_zgRAT {
    meta:
        author = "ditekSHen"
        description = "Detects zgRAT"
    strings:
        $s1 = "file:///" fullword wide
        $s2 = "{11111-22222-10009-11112}" fullword wide
        $s3 = "{11111-22222-50001-00000}" fullword wide
        $s4 = "get_Module" fullword ascii
        $s5 = "Reverse" fullword ascii
        $s6 = "BlockCopy" fullword ascii
        $s7 = "ReadByte" fullword ascii
        $s8 = { 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00
                00 0b 46 00 69 00 6e 00 64 00 20 00 00 13 52 00
                65 00 73 00 6f 00 75 00 72 00 63 00 65 00 41 00
                00 11 56 00 69 00 72 00 74 00 75 00 61 00 6c 00
                20 00 00 0b 41 00 6c 00 6c 00 6f 00 63 00 00 0d
                57 00 72 00 69 00 74 00 65 00 20 00 00 11 50 00
                72 00 6f 00 63 00 65 00 73 00 73 00 20 00 00 0d
                4d 00 65 00 6d 00 6f 00 72 00 79 00 00 0f 50 00
                72 00 6f 00 74 00 65 00 63 00 74 00 00 0b 4f 00
                70 00 65 00 6e 00 20 00 00 0f 50 00 72 00 6f 00
                63 00 65 00 73 00 73 00 00 0d 43 00 6c 00 6f 00
                73 00 65 00 20 00 00 0d 48 00 61 00 6e 00 64 00
                6c 00 65 00 00 0f 6b 00 65 00 72 00 6e 00 65 00
                6c 00 20 00 00 0d 33 00 32 00 2e 00 64 00 6c 00
                6c }
    condition:
        uint16(0) == 0x5a4d and all of them
}
*/

rule MALWARE_Win_CoinMiner03 {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining malware"
    strings:
        $s1 = "UnVzc2lhbiBTdGFuZGFyZCBUaW1l" wide
        $s2 = "/xmrig" wide
        $s3 = "/gminer" wide
        $s4 = "-o {0} -u {1} -p {2} -k --cpu-priority 0 --threads={3}" wide
        $s5 = "--algo ethash --server" wide
        $s6 = "--algo kawpow --server" wide
        $cnc1 = "/delonl.php?hwid=" fullword wide
        $cnc2 = "/gateonl.php?hwid=" fullword wide
        $cnc3 = "&cpuname=" fullword wide
        $cnc4 = "&gpuname=" fullword wide
        $cnc5 = "{0}/gate.php?hwid={1}&os={2}&cpu={3}&gpu={4}&dateinstall={5}&gpumem={6}" fullword wide
        $cnc6 = "/del.php?hwid=" fullword wide
        $f1 = "<StartGpuethGminer>b__" ascii
        $f2 = "<StartGpuetcGminer>b__" ascii
        $f3 = "<StartGpurvnGminer>b__" ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($cnc*) or (2 of ($f*) and (1 of ($s*) or 1 of ($f*))) or all of ($f*) or 5 of ($s*))
}

rule MALWARE_Win_Zeppelin {
    meta:
        author = "ditekSHen"
        description = "Detects Zeppelin (Delphi) ransomware"
    strings:
        $s1 = "TUnlockAndEncrypt" ascii
        $s2 = "TExcludeFiles" ascii
        $s3 = "TExcludeFolders" ascii
        $s4 = "TDrivesAndShares" ascii
        $s5 = "TTaskKiller" ascii
        $x1 = "!!! D !!!" ascii
        $x2 = "!!! LOCALPUBKEY !!!" ascii
        $x3 = "!!! ENCLOCALPRIVKEY !!!" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or all of ($x*) or (2 of ($x*) and 2 of ($s*)))
}

rule MALWARE_Win_SlackBot {
    meta:
        author = "ditekSHen"
        description = "Detects SlackBot"
    strings:
        $x1 = "lp0o4bot v" ascii
        $x2 = "slackbot " ascii
        $s1 = "cpu: %lumhz %s, uptime: %u+%.2u:%.2u, os: %s" fullword ascii
        $s2 = "%s, running for %u+%.2u:%.2u" fullword ascii
        $s3 = "PONG :%s" fullword ascii
        $s4 = "PRIVMSG %s :%s" fullword ascii
        $s5 = "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" fullword ascii
        $m1 = "saving %s to %s" ascii
        $m2 = "visit number %u failed" ascii
        $m3 = "sending %s packets of %s bytes to %s with a delay of %s" ascii
        $m4 = "file executed" ascii
        $m5 = "packets sent" ascii
        $m6 = "upgrading to %s" ascii
        $m7 = "rebooting..." ascii
        $c1 = "!@remove" fullword ascii
        $c2 = "!@restart" fullword ascii
        $c3 = "!@reboot" fullword ascii
        $c4 = "!@rndnick" fullword ascii
        $c5 = "!@exit" fullword ascii
        $c6 = "!@sysinfo" fullword ascii
        $c7 = "!@upgrade" fullword ascii
        $c8 = "!@login" fullword ascii
        $c9 = "!@run" fullword ascii
        $c10 = "!@webdl" fullword ascii
        $c11 = "!@cycle" fullword ascii
        $c12 = "!@clone" fullword ascii
        $c13 = "!@visit" fullword ascii
        $c14 = "!@udp" fullword ascii
        $c15 = "!@nick" fullword ascii
        $c16 = "!@say" fullword ascii
        $c17 = "!@quit" fullword ascii
        $c18 = "!@part" fullword ascii
        $c19 = "!@join" fullword ascii
        $c20 = "!@raw" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or all of ($s*) or all of ($m*) or (10 of ($c*) and (1 of ($x*) or 3 of ($s*) or 2 of ($m*))))
}

rule MALWARE_Win_SweetyStealer {
    meta:
        author = "ditekSHen"
        description = "Detects SweetyStealer"
    strings:
        $s1 = "SWEETY STEALER" wide
        $s2 = "\\SWEETYLOG.zip" fullword wide
        $s3 = "\\SWEETY STEALER\\SWEETY\\" ascii
        $s4 = "\\Sweety" fullword wide
        $s5 = "SWEETYSTEALER." ascii
        $s6 = "in Virtual Environment, so we prevented stealing" wide
        $s7 = ":purple_square:" wide
        $f1 = "<GetDomainDetect>b__" ascii
        $f2 = "<GetAllProfiles>b__" ascii
        $f3 = "<ProcessExtraFieldZip64>b__" ascii
        $f4 = "<PostExtractCommandLine>k__" ascii
    condition:
        uint16(0) == 0x5a4d and 3 of ($s*) or (3 of ($f*) and 1 of ($s*))
}

rule MALWARE_Win_GENIRCBot {
    meta:
        author = "ditekSHen"
        description = "Detects generic IRCBots"
    strings:
        $s1 = "@login" ascii nocase
        $s2 = "PRIVMSG" fullword ascii
        $s3 = "JOIN" fullword ascii
        $s4 = "PING :" fullword ascii
        $s5 = "NICK" fullword ascii
        $s6 = "USER" fullword ascii
        $x1 = "irc.danger.net" fullword ascii nocase
        $x2 = "evilBot" fullword ascii nocase
        $x3 = "#evilChannel" fullword ascii nocase
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or 2 of ($x*))
}

rule MALWARE_Win_Nitro {
    meta:
        author = "ditekSHen"
        description = "Detects Nitro Ransomware"
    strings:
        $x1 = ".givemenitro" wide
        $x2 = "Nitro Ransomware" ascii wide
        $x3 = "\\NitroRansomware.pdb" ascii
        $x4 = "NitroRansomware" ascii wide nocase
        $s1 = "Valid nitro code was received" wide
        $s2 = "discord nitro" ascii wide nocase
        $s3 = "Starting file encryption" wide
        $s4 = "NR_decrypt.txt" wide
        $s5 = "open it unless you have the decryption key." ascii
        $s6 = "<EncryptAll>b__" ascii
        $s7 = "<DecryptAll>b__" ascii
        $s8 = "DECRYPT_PASSWORD" fullword ascii
        $s9 = "IsEncrypted" fullword ascii
        $s10 = "CmdProcess_OutputDataReceived" fullword ascii
        $s11 = "encryptedFileLog" fullword ascii
        $s12 = "Encrypting:" fullword wide
        $s13 = "decryption key. If you do so, your files may get corrupted" ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or (3 of ($s*) and 1 of ($x*)) or (7 of ($s*)))
}

rule MALWARE_Win_NanoCore {
    meta:
        author = "ditekSHen"
        description = "Detects NanoCore"
    strings:
        $x1 = "NanoCore Client" fullword ascii
        $x2 = "NanoCore.ClientPlugin" fullword ascii
        $x3 = "NanoCore.ClientPluginHost" fullword ascii
        $i1 = "IClientApp" fullword ascii
        $i2 = "IClientData" fullword ascii
        $i3 = "IClientNetwork" fullword ascii
        $i4 = "IClientAppHost" fullword ascii
        $i5 = "IClientDataHost" fullword ascii
        $i6 = "IClientLoggingHost" fullword ascii
        $i7 = "IClientNetworkHost" fullword ascii
        $i8 = "IClientUIHost" fullword ascii
        $i9 = "IClientNameObjectCollection" fullword ascii
        $i10 = "IClientReadOnlyNameObjectCollection" fullword ascii
        $s1 = "ClientPlugin" fullword ascii
        $s2 = "EndPoint" fullword ascii
        $s3 = "IPAddress" fullword ascii
        $s4 = "IPEndPoint" fullword ascii
        $s5 = "IPHostEntr" fullword ascii
        $s6 = "get_ClientSettings" fullword ascii
        $s7 = "get_Connected" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 8 of ($i*) or all of ($s*) or (1 of ($x*) and (3 of ($i*) or 2 of ($s*))))
}

rule MALWARE_Win_Satan {
    meta:
        author = "ditekSHen"
        description = "Detects Satan ransomware"
    strings:
        $s1 = "S:(ML;;NRNWNX;;;LW)" fullword wide
        $s2 = "recycle.bin" fullword wide
        $s3 = "tmp_" fullword wide
        $s4 = "%s%08x.%s" fullword wide
        $s5 = "\"%s\" %s" fullword wide
        $s6 = "/c \"%s\"" fullword wide
        $s7 = "Global\\" fullword wide
        $s8 = "rd /S /Q \"%s\"" fullword ascii
        $s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" fullword ascii
        $e1 = "*pdf*" fullword wide
        $e2 = "*rtf*" fullword wide
        $e3 = "*doc*" fullword wide
        $e4 = "*docx*" fullword wide
        $e5 = "*xlsx*" fullword wide
        $e6 = "*pptx*" fullword wide
        $e7 = "*moneywell*" fullword wide
        $o1 = { 56 8d 54 24 34 b9 9e f0 ea be e8 c1 f9 ff ff 8d }
        $o2 = { b9 34 f6 40 00 e8 ea 0b 00 00 85 c0 0f 84 91 }
        $o3 = { 53 8d 84 24 34 01 00 00 b9 01 00 00 80 50 a1 64 }
    condition:
        uint16(0) == 0x5a4d and ((8 of ($s*) and 4 of ($e*)) or all of ($s*) or (all of ($e*) and 5 of ($s*)) or (all of ($o*) and 8 of them))
}

rule MALWARE_Win_Neshta {
    meta:
        author = "ditekSHen"
        description = "Detects Neshta"
    strings:
        $s1 = "Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus." fullword ascii
        $s2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Linux_HelloKitty {
    meta:
        author = "ditekSHen"
        description = "Detects Linux version of HelloKitty ransomware"
    strings:
        $s1 = "exec_pipe:%s" ascii
        $s2 = "Error InitAPI !!!" fullword ascii
        $s3 = "No Files Found !!!" fullword ascii
        $s4 = "Error open log File:%s" fullword ascii
        $s5 = "%ld - Files Found  " fullword ascii
        $s6 = "Total VM run on host:" fullword ascii
        $s7 = "error:%d open:%s" fullword ascii
        $s8 = "work.log" fullword ascii
        $s9 = "esxcli vm process kill" ascii
        $s10 = "readdir64" fullword ascii
        $s11 = "%s_%d.block" fullword ascii
        $s12 = "EVP_EncryptFinal_ex" fullword ascii
        $s13 = ".README_TO_RESTORE" fullword ascii
        $m1 = "COMPROMISED AND YOUR SENSITIVE PRIVATE INFORMATION WAS STOLEN" ascii nocase
        $m2 = "damage them without special software" ascii nocase
        $m3 = "leaking or being sold" ascii nocase
        $m4 = "Data will be Published and/or Sold" ascii nocase
    condition:
        uint16(0) == 0x457f and (6 of ($s*) or (2 of ($m*) and 2 of ($s*)) or 8 of them)
}

rule MALWARE_Win_BlackMatter {
    meta:
        author = "ditekSHen"
        description = "Detects BlackMatter ransomware"
    strings:
        $s1 = "C:\\Windows\\System32\\*.drv" fullword wide
        $s2 = "NYbr-Vk@" fullword ascii
        $s3 = ":7:=:H:Q:W:\\:b:&;O;^;v;" fullword ascii
        $o1 = { b0 34 aa fe c0 e2 fb b9 03 }
        $o2 = { fe 00 ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 }
        $o3 = { 6a 00 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe ff }
        $o4 = { ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe }
        $o5 = { 53 56 57 8d 85 70 ff ff ff 83 c0 0f 83 e0 f0 89 }
        $o6 = { c7 85 68 ff ff ff 00 04 00 00 8b 85 6c ff ff ff }
        //SOFTWARE\Microsoft\Crypt
        //Volume{
        //*recycle*
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) and all of ($o*))
}

rule MALWARE_Win_DLInjector04 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader / injector"
    strings:
        $s1 = "Runner" fullword ascii
        $s2 = "DownloadPayload" fullword ascii
        $s3 = "RunOnStartup" fullword ascii
        $a1 = "Antis" fullword ascii
        $a2 = "antiVM" fullword ascii
        $a3 = "antiSandbox" fullword ascii
        $a4 = "antiDebug" fullword ascii
        $a5 = "antiEmulator" fullword ascii
        $a6 = "enablePersistence" fullword ascii
        $a7 = "enableFakeError" fullword ascii
        $a8 = "DetectVirtualMachine" fullword ascii
        $a9 = "DetectSandboxie" fullword ascii
        $a10 = "DetectDebugger" fullword ascii
        $a11 = "CheckEmulator" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($s*) and 5 of ($a*)) or 10 of ($a*))
}

rule MALWARE_Win_DarkComet {
    meta:
        author = "ditekSHen"
        description = "Detects DarkComet"
    strings:
        $s1 = "%s, ClassID: %s" ascii
        $s2 = "%s, ProgID: \"%s\"" ascii
        $s3 = "#KCMDDC51#" ascii
        $s4 = "#BOT#VisitUrl" ascii
        $s5 = "#BOT#OpenUrl" ascii
        $s6 = "#BOT#Ping" ascii
        $s7 = "#BOT#RunPrompt" ascii
        $s8 = "#BOT#CloseServer" ascii
        $s9 = "#BOT#SvrUninstall" ascii
        $s10 = "#BOT#URLUpdate" ascii
        $s11 = "#BOT#URLDownload" ascii
        $s12 = /BTRESULT(Close|Download|HTTP|Mass|Open|Ping\|Respond|Run|Syn|UDP|Uninstall\|uninstall|Update|Visit)/ ascii
        $s13 = "dclogs\\" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Macoute {
    meta:
        author = "ditekSHen"
        description = "Detects Macoute"
    strings:
        $s1 = "scp%s%s%s%s" ascii
        $s2 = "putfile %s %s" ascii
        $s3 = "pscp|%s|%s:%s" ascii
        $s4 = "connect %host %port\\n" ascii
        $s5 = "/ecoute/spool/%s-%lu" ascii
        $s6 = "<f n=\"%s\" s=\"%lu\" d=\"%d-%d-%d\"/>" ascii
        $s7 = "CMPT;%s;%s;%s;%s;%s" ascii
        $s8 = "%s\\apoScreen%lu.dll" ascii
        $s9 = "/cap/%s%lu.jpg" ascii
        $s10 = "INFO;%u;%u;%u;%d;%d;%d;%d;%d;%d;%d;%s" ascii
        $s11 = "SUBJECT: %s is comming!" ascii
        $s12 = "Content-type: multipart/mixed; boundary=\"#BOUNDARY#\"" ascii
        $s13 = "FROM: %s@yahoo.com" ascii
        $s14 = "<html><script language=\"JavaScript\">window.open(\"readme.eml\", null,\"resizable=no,top=6000,left=6000\")</script></html>" ascii
        $s15 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" ascii
    condition:
        uint16(0) == 0x5a4d and 10 of them
}

rule MALWARE_Win_CoinMiner04 {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining malware"
    strings:
        $s1 = "createDll" fullword ascii
        $s2 = "getTasks" fullword ascii
        $s3 = "SetStartup" fullword ascii
        $s4 = "loadUrl" fullword ascii
        $s5 = "Processer" fullword ascii
        $s6 = "checkProcess" fullword ascii
        $s7 = "runProcess" fullword ascii
        $s8 = "createDir" fullword ascii
        $cnc1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
        $cnc2 = "?hwid=" fullword wide
        $cnc3 = "?timeout=1" fullword wide
        $cnc4 = "&completed=" fullword wide
        $cnc5 = "/cmd.php" wide
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) and 1 of ($cnc*))
}

rule MALWARE_Win_SideWalk {
    meta:
        author = "ditekSHen"
        description = "Detects SideWalk"
    strings:
        $s1 = "Decommit" fullword ascii
        $s2 = "Shellc0deRunner" fullword ascii
        $s3 = "shellc0de" fullword ascii
        $s4 = "C:\\Windows\\System32\\msdt.exe" fullword wide
        $s5 = "StartProcessWOPid" fullword ascii
        $s6 = "StartProcessWithParent" fullword ascii
        $m1 = "alloctype" fullword ascii
        $m2 = "ThreadIoPriority" fullword ascii
        $m3 = "PebAddress" fullword ascii
        $m4 = "dotnet.4.x64.dll" fullword wide
        $m5 = "LogonNetCredentialsOnly" fullword ascii
        $m6 = "ThreadIdealProcessor" fullword ascii
        $m7 = "LogonWithProfile" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or all of ($m*) or (11 of them))
}

rule MALWARE_Win_VanillaRAT {
    meta:
        author = "ditekSHen"
        description = "Detects VanillaRAT"
    strings:
        $stub = "VanillaStub." ascii wide
        $s1 = "Client.Send: " wide
        $s2 = "Connected to chat" fullword wide
        $s3 = "GetStoredPasswords" fullword wide
        $s4 = "Started screen locker." fullword wide
        $s5 = "[<\\MOUSE>]" fullword wide
        $s6 = "YOUR SCREEN HAS BEEN LOCKED!" fullword wide
        $s7 = "record recsound" fullword wide
        $f1 = "<StartRemoteDestkop>d__" ascii
        $f2 = "<ConnectLoop>d__" ascii
        $f3 = "<Scan0>k__" ascii
        $f4 = "<RemoteShellActive>k__" ascii
        $f5 = "KillClient" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (($stub and (2 of ($s*) or 2 of ($f*))) or 6 of ($s*) or all of ($f*))
}

rule MALWARE_Win_SectopRAT {
    meta:
        author = "ditekSHen"
        description = "Detects SectopRAT"
    strings:
        $s1 = "\\\\.\\root\\cimv2:Win32_Process" wide
        $s2 = "\\\\.\\root\\cimv2:CIM_DataFile.Name=" wide
        $s3 = "^.*(?=Windows)" fullword wide
        $s4 = "C:\\Windows\\System32\\cmd.exe" wide
        $s5 = "C:\\Windows\\explorer.exe" wide
        $s6 = "Disabling IE protection" wide
        $s7 = "stream started succces" wide
        $b1 = "/C start Firefox" wide
        $b2 = "/C start chrome" wide
        $b3 = "/C start iexplore" wide
        $m1 = "DefWindowProc" fullword ascii
        $m2 = "AuthStream" fullword ascii
        $m3 = "KillBrowsers" fullword ascii
        $m4 = "GetAllNetworkInterfaces" fullword ascii
        $m5 = "EnumDisplayDevices" fullword ascii
        $m6 = "RemoteClient.Packets" fullword ascii
        $m7 = "IServerPacket" fullword ascii
        $m8 = "keybd_event" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((5 of ($s*) and 2 of ($b*)) or all of ($s*) or (all of ($b*) and (4 of ($s*) or 5 of ($m*))))
}

rule MALWARE_Win_Neptune {
    meta:
        author = "ditekSHen"
        description = "Detects Neptune keylogger / infostealer"
    strings:
        $x1 = "your keylogger has been freshly installed on" wide
        $x2 = "Attached is a screenshot of the victim" wide
        $x3 = "color: rgb(2, 84, 138);'>Project Neptune</span><br>" wide
        $x4 = ">{Monitor Everything}</span><br><br>" wide
        $x5 = "[First Run] Neptune" wide
        $x6 = "Neptune - " wide
        $s1 = "Melt" fullword wide
        $s2 = "Hide" fullword wide
        $s3 = "SDDate+" fullword wide
        $s4 = "DelOff+" fullword wide
        $s5 = "MsgFalse+" fullword wide
        $s6 = "Clipboard:" fullword wide
        $s7 = "information is valid and working!" wide
        $s8 = ".exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" wide
        $s9 = "http://www.exampleserver.com/directfile.exe" fullword wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 7 of ($s*) or (1 of ($x*) and 5 of ($s*)))
}

rule MALWARE_Win_Tomiris {
    meta:
        author = "ditekSHen"
        description = "Detects Tomiris"
    strings:
        $f1 = "main.workPath" ascii
        $f2 = "main.selfName" ascii
        $f3 = "main.infoServerAddr" ascii
        $f4 = "main.configFileName" ascii
        $s1 = "C:/Projects/go/src/Tomiris/main.go" ascii
        $s2 = "C:/GO/go1.16.2/src/os/user/lookup_windows.go" ascii
        $s3 = "C:\\GO\\go1.16.2" ascii
        $s4 = ".html.jpeg.json.wasm.webp/p/gf/p/kk1562515" ascii
        $s5 = "\" /ST 10:00alarm clockassistQueueavx512vbmi2avx512vnniwbad" ascii
        $s6 = "write /TR \" Value addr= alloc base  code= ctxt: curg= free  goid  jobs= list= m->p=" ascii
        $t1 = "SCHTASKS /DELETE /F /TN \"%s\"" ascii
        $t2 = "SCHTASKS /CREATE /SC DAILY /TN" ascii
        $t3 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"%s\" /ST %s" ascii
        $t4 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"'%s' %s\" /ST %s" ascii
        $r1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones" ascii
        $r2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($f*) and 3 of ($s*) and 2 of ($t*) and 1 of ($r*)) or (4 of ($s*) and 2 of ($t*) and 1 of ($r*)) or 12 of them)
}

rule MALWARE_Win_JennLog {
    meta:
        author = "ditekSHen"
        description = "Detects JennLog loader"
    strings:
        $x1 = "%windir%\\system32\\rundll32.exe advapi32.dll,ProcessIdleTasks" fullword wide
        $x2 = "https://fkpageintheworld342.com" fullword wide
        $s1 = "ExecuteInstalledNodeAndDelete" fullword ascii
        $s2 = "ProcessExsist" fullword ascii
        $s3 = "helloworld.Certificate.txt" fullword wide
        $s4 = "ASCII85 encoded data should begin with '" fullword wide
        $s5 = "] WinRE config file path: C:\\" ascii
        $s6 = "] Parameters: configWinDir: NULL" ascii
        $s7 = "] Update enhanced config info is enabled." ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*) or (all of ($x*) and 2 of ($s*)))
}

rule MALWARE_Win_LockFile {
    meta:
        author = "ditekSHen"
        description = "Detects LockFile ransomware"
    strings:
        $x1 = "LOCKFILE" fullword ascii
        $x2 = "25a01bb859125507013a2fe9737d3c33" fullword ascii
        $s1 = "</key>" fullword ascii
        $s2 = "<computername>%s</computername>" fullword ascii
        $s3 = "<blocknum>%d</blocknum>" fullword ascii
        $s4 = "%s\\%s-%s-%d%s" fullword ascii
        $s5 = ">RAC=OQD:S>P@:AO?R:EEOS:ARDD=N?EENSB" ascii wide
        $m1 = "<title>LOCKFILE</title>" ascii wide nocase
        $m2 = "<hta:application id=LOCKFILE applicationName=LOCKFILE" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or all of ($s*) or (1 of ($x*) and (2 of ($s*) or 1 of ($m*))) or (1 of ($m*) and (1 of ($x*) or 2 of ($s*))))
}

rule MALWARE_Win_HUNT_FoggyWeb {
    meta:
        author = "ditekSHen"
        description = "Attempt on hunting FoggyWeb"
    strings:
        $u1 = "/adfs/portal/images/theme/light01/" ascii wide
        $u2 = "/adfs/services/trust/2005/samlmixed/upload" ascii wide
        $s1 = "ProcessGetRequest" ascii wide
        $s2 = "ProcessPostRequest" ascii wide
        $s3 = "UrlGetFileNames" ascii wide
        $s4 = "GetWebpImage" ascii wide
        $s5 = "GetWebpHeader" ascii wide
        $s6 = "ExecuteAssemblyRoutine" ascii wide
        $s7 = "ExecuteBinary" ascii wide
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_HUNT_Apostle {
    meta:
        author = "ditekSHen"
        description = "Attempt on hunting new variants of Apostle"
    strings:
        $x1 = "://t.me/x4ran" ascii wide nocase
        $x2 = "43JuFUyzfcKQwTzCTHpQoA8uLGtbwFBLyeeXoYEEU5dZLhLT1cZJDk4cytjcgQT7kdjSerJqpEp2gUcH91bjLcoq2bqik3j" ascii wide
    condition:
        any of them
}

rule MALWARE_Win_HUNT_GhostEmperor_RemoteControlPayload {
    meta:
        author = "ditekSHen"
        description = "Attempt on hunting GhostEmperor Stage 4 Remote Control Payload"
        reference = "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf"
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and pe.number_of_exports == 2 and pe.exports("1") and pe.exports("__acrt_iob_func")
}

rule MALWARE_Win_Alkhal {
    meta:
        author = "ditekSHen"
        description = "Detects Alkhal ransomware"
    strings:
        $s1 = "ReadMe.txt" fullword wide
        $s2 = "Recovery.bmp" fullword wide
        $d1 = "\\$RECYCLE.BIN\\" fullword wide
        $d2 = "\\BOOT\\" fullword wide
        $d3 = "\\RECOVERY\\" fullword wide
        $d4 = "\\MICROS~1\\" fullword wide
        $d5 = "\\CODECA~1\\js\\" fullword wide
        $a1 = "takeown.exe" fullword wide
        $a2 = "AppLaunch.exe" fullword wide
        $a3 = "MpCmdRun.exe" fullword wide
        $a4 = "wordpad.exe" fullword wide
        $a5 = "winload.exe" fullword wide
        $a6 = "prevhost.exe" fullword wide
        $a7 = "credwiz.exe" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) and 4 of ($d*) and 3 of ($a*))
}

rule MALWARE_Win_Unicorn {
    meta:
        author = "ditekSHen"
        description = "Detects Unicorn infostealer"
    strings:
        $x1 = "WinHTTP Downloader/1.0" fullword wide
        $x2 = "[CTRL + %c]" fullword wide
        $x3 = "\\UnicornLog.txt" fullword wide
        $x4 = "/*INITIALIZED*/" fullword wide
        $s1 = { 2f 00 63 00 20 00 22 00 43 00 4f 00 50 00 59 00
               20 00 2f 00 59 00 20 00 2f 00 42 00 20 00 22 00
               25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00
               22 00 00 00 63 00 6d 00 64 00 2e 00 65 00 78 00
               65 }
        $s2 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00
               2e 00 65 00 78 00 65 00 00 00 00 00 25 00 73 00
               20 00 22 00 25 00 73 00 22 00 2c 00 25 00 68 00
               73 } 
        $s3 = "%*[^]]%c%n" fullword ascii
        $s4 = "file://%s%s%s" fullword ascii
        $s5 = "%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
        $s6 = "regex_start_injects" fullword ascii
        $s7 = "DLEXEC" fullword ascii
        $s8 = "^((((3|1)[A-Za-z0-9]{33}))(\\s|$)|(bc1q)[A-Za-z0-9]{38}(\\s|$))" fullword ascii
        $s9 = "^(0x)?[A-Za-z0-9]{40}(\\s|$)" fullword ascii
        $s10 = "clipRegex" fullword ascii
        $s11 = "%s?k=%s&src=clip&id=%s" fullword ascii
        $s12 = "http://izuw6rclbgl2lwsh.onion/o.php" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or 8 of ($s*) or (3 of ($x*) and 5 of ($s*)))
}

rule MALWARE_Win_Spectre {
    meta:
        author = "ditekSHen"
        description = "Detects Spectre infostealer"
        snort_sid = "920233-920234"
    strings:
        $s1 = "\\../../../json.h" wide
        $s2 = "static_cast<std::size_t>(index) < kCachedPowers.size()" fullword wide
        $s3 = " cmd.exe" fullword wide
        $s4 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
        $h1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" fullword wide
        $h2 = "----974767299852498929531610575" ascii wide
        $h3 = "Content-Disposition: form-data; name=\"file\"; filename=\"" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and ((all of ($s*) and 1 of ($h*)) or (all of ($h*) and 2 of ($s*)))) or (6 of them)
}

rule MALWARE_Win_HUNT_BlackByte {
    meta:
        author = "ditekSHen"
        description = "Attempt on hunting BlackByte ransomware"
    strings:
        $s1 = "WalkDirAndEncrypt" ascii wide nocase
        $s2 = "FileEncrypt" ascii wide nocase
        $s3 = "BlackByte." ascii wide nocase
        $s4 = "EnumerateDirAndEncrypt" ascii wide nocase
        $s5 = "Dismount-DiskImage" ascii wide nocase
        $s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_DLInjector05 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader / injector (NiceProcess)"
    strings:
        $s1 = "pidhtmpfile.tmp" fullword ascii
        $s2 = "pidhtmpdata.tmp" fullword ascii
        $s3 = "pidHTSIG" fullword ascii
        $s4 = "Taskmgr.exe" fullword ascii
        $s5 = "[HP][" ascii
        $s6 = "[PP][" ascii
        $s7 = { 70 69 64 68 74 6d 70 66 69 6c 65 2e 74 6d 70 00
                2e 64 6c 6c 00 00 00 00 70 69 64 48 54 53 49 47
                00 00 00 00 ?? ?? 00 00 54 61 73 6b 6d 67 72 2e
                65 78 65 }
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Kutaki {
    meta:
        author = "ditekSHen"
        description = "Detects Kutaki"
    strings:
        $x1 = "AASEaHR0cDovL29qb3JvYmlhLmNsdWIvbGFwdG9wL2xhcHRvcC5waHA" ascii
        $x2 = "aHR0cDovL3RlcmViaW5uYWhpY2MuY2x1Yi9zZWMva29vbC50eHQ" ascii
        $s1 = "wewqeuuiwe[XXXXXXX]" ascii
        $s2 = "alt|aHR0cD" ascii
        $s3 = "<rdf:Description about='uuid:fb761dc9-9daf-11d9-9a32-fcf1da45dca2'" ascii
        $s4 = "<rdf:Description about='uuid:0ab54f47-96d6-11d9-a59c-cbc93330e07e'" ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 1 of ($s*)) or (all of ($s*)))
}

rule MALWARE_Win_DLInjector06 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader / injector"
    strings:
        $s1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" ascii wide
        $s2 = "Content-Type: application/x-www-form-urlencoded" wide
        $s3 = "https://ipinfo.io/" wide
        $s4 = "https://db-ip.com/" wide
        $s5 = "https://www.maxmind.com/en/locate-my-ip-address" wide
        $s6 = "https://ipgeolocation.io/" wide
        $s7 = "POST" fullword wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_Crown {
     meta:
        author = "ditekSHen"
        description = "Detects Crown Tech Support Scam"
        snort_sid = "920251-920261"
    strings:
        $d1 = "//prodownload.live" ascii
        $c1 = "&uid=" ascii
        $c2 = "&ver=" ascii
        $c3 = "&mcid=" ascii
        $c4 = ".php?uid=" ascii
        $c5 = ".php?ip=" ascii
        $s1 = "Operating System Support ID:" ascii
        $s2 = "taskkill /IM explorer.exe -f" ascii nocase
        $s3 = "/C taskkill /IM Taskmgr.exe -f" ascii nocase
        $s4 = "FastSuport" fullword ascii
        $s5 = "Support Override!" fullword wide
        $s6 = "Support Assistance Override Activated!" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($c*) or 4 of ($s*) or (1 of ($d*) and (3 of ($c*) or 2 of ($s*))))
}

rule MALWARE_Win_FloodFix {
     meta:
        author = "ditekSHen"
        description = "Detects FloodFix"
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and (pe.exports("FloodFix") or pe.exports("FloodFix2")) and pe.exports("crc32")
}

rule MALWARE_Win_UNK_InfoStealer {
    meta:
        author = "ditekSHen"
        description = "Detects unknown information stealer"
        snort_sid = "920263"
        hash1 = "b7a2cb34d3bc42d6d4c9d9af7dd406e2a5caef8ea46e5d09773feeb9920a6b21"
        hash2 = "dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d"
        hash3 = "12f790d9a0775b5e62effc6ea9e55bbef345fffbfb2f671f85098c4f7661dd0f"
        hash4 = "0a4cea763dffde451c75a434143fc5d014c32c6d1f8f34920ea5f2854e62118f"
    strings:
        $s1 = "%s\\%s\\%s-Qt" fullword wide
        $s2 = "%s\\%s.json" fullword wide
        $s3 = "*.mmd*" fullword wide
        $s4 = "%s\\%s.vdf" fullword wide
        $s5 = "%-50s %s" fullword wide
        $s6 = "dISCORD|lOCAL" fullword ascii nocase
        $s7 = "sTORAGE|LEVELDB" fullword ascii nocase
        $s8 = ".coin" fullword ascii
        $s9 = ".emc" fullword ascii
        $s10 = ".lib" fullword ascii
        $s11 = ".bazar" fullword ascii
        $s12 = "id=%d" fullword ascii
        $s13 = "2:?/v /v /v /^Y" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_DECAF {
    meta:
        author = "ditekSHen"
        description = "Detects DECAF ransomware"
    strings:
        $s1 = "main.EncWorker" fullword ascii
        $s2 = "Paths2Encrypt" fullword ascii
        $s3 = "/cmd/encryptor/main.go" ascii
        $s4 = "*win.FileUtils; .autotmp_41 *lib.Encryptor; .autotmp_" ascii
        $s5 = "\"Microsoft Window" fullword wide
        $s6 = "Legal_Policy_Statement" fullword wide
        $s7 = ").Encrypt." ascii
        $s8 = "*struct { F uintptr; pw *os.File; c *" ascii
        $s9 = ".ListFilesToEnc." ascii
        $m1 = "WINNER WINNER CHICKEN DINNER" ascii
        $m2 = "All your servers and computers are encrypted" ascii
        $m3 = "We guarantee to decrypt one image file for free." ascii
        $m4 = "We WILL NOT be able to RESTORE them." ascii
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or 3 of ($m*) or (1 of ($m*) and 2 of ($s*)))
}

rule MALWARE_Win_WinDealer {
    meta:
        author = "ditekSHen"
        description = "Detects WinDealer"
        snort_sid = "920264"
    strings:
        $d1 = "downfile" fullword ascii
        $d2 = "getmypath" fullword ascii
        $d3 = "content-type: monitor" fullword ascii
        $d4 = "content-type: UsedType" fullword ascii
        $d5 = "write command error" fullword ascii
        $d6 = "C:\\WINDOWS\\system32\\kernel32.dll" fullword ascii
        $l1 = "currentconfig" fullword ascii
        $l2 = "remotedomain" fullword ascii
        $l3 = "reserveip" fullword ascii
        $l4 = "otherinfo" fullword ascii
        $l5 = "filelen" fullword ascii
        $l6 = "%s%s.bak" fullword wide
        $l7 = "localmachine" fullword ascii
        $l8 = "remoteip" fullword ascii
        $l9 = "datastate" fullword ascii
        $l10 = "SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\%s\\Connection" fullword ascii
        $s1 = "%s\\%s\\V5_History.dat" fullword wide
        $s2 = "%s\\%s\\history2.dat" fullword wide
        $s3 = "%s\\%s\\history.imw" fullword wide
        $s4 = "%s\\%s\\main.imw" fullword wide
        $s5 = "%s%d.%d.%d.%dWindows/%u" fullword ascii
        $s6 = "%s\\%c_%s_tmp" fullword wide
        $s7 = "%s\\%s\\main.db" fullword wide
    condition:
        uint16(0) == 0x5a4d and ((4 of ($d*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($d*)) or 6 of ($l*) or (pe.exports("DealC") and pe.exports("DealR") and pe.exports("DealS") and 1 of them))
}

rule MALWARE_Win_ExMatter {
    meta:
        author = "ditekSHen"
        description = "Detects BlackMatter data exfiltration tool"
        hash1 = "4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30"
        hash2 = "a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8"
    strings:
        $s1 = "Renci.SshNet." ascii
        $s2 = "DirNotEmpty" fullword ascii
        $s3 = "MkDir" fullword ascii
        $s4 = "RmDir" fullword ascii
        $s5 = "get_MainWindowHandle" fullword ascii
        $s6 = "GetCurrentProcess" fullword ascii
        $s7 = "]]>]]>" fullword wide
        $s8 = "1.3.132.0.35" fullword wide
        $s9 = "1.3.132.0.34" fullword wide
        $s10 = "1.2.840.10045.3.1.7" fullword wide
        $x1 = "sender2.pdb" fullword ascii
        $x2 = { 64 00 61 00 74 00 61 00 ?? 72 00 6f 00 6f 00 74 }
        $x3 = "157.230.28.192" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (1 of ($x*) and 7 of ($s*)))
}

rule MALWARE_Win_BrbBot {
    meta:
        author = "ditekSHen"
        description = "Detects BrbBot"
        snort_sid = "920265"
    strings:
        $x1 = "brbconfig.tmp" fullword ascii
        $x2 = "brbbot" fullword ascii
        $s1 = "%s?i=%s&c=%s&p=%s" fullword ascii
        $s2 = "exec" fullword ascii
        $s3 = "CONFIG" fullword ascii wide
        $s4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)" fullword ascii
        $s5 = { 43 4f 4e 46 49 47 00 00 65 6e 63 6f 64 65 00 00
                73 6c 65 65 70 00 00 00 65 78 69 74 00 00 00 00
                63 6f 6e 66 00 00 00 00 66 69 6c 65 00 00 00 00
                65 78 65 63 }
    condition:
        uint16(0) == 0x5a4d and ((all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 4 of ($s*)) or all of ($s*))
}

rule MALWARE_Win_BabylonRAT {
    meta:
        author = "ditekSHen"
        description = "Detects BabylonRAT / CollectorStealer / ParadoxRAT"
    strings:
        $x1 = "Babylon RAT Client" wide nocase
        $x2 = "ParadoxRAT_Client" fullword ascii
        $s1 = "@ConfigsEx" fullword wide
        $s2 = "ClipBoard.txt" fullword wide
        $s3 = "[%02d/%02d/%d %02d:%02d:%02d] [%s] (%s):" fullword wide
        $s4 = "\\%Y %m %d - %I %M %p" fullword wide
        $s5 = "[%02d/%02d/%d %02d:%02d:%02d] (%s)" fullword wide
        $s6 = " c:\\Windows\\system32\\cmd.exe" fullword wide
        $s7 = "Update Failed [OpenProcess]" wide
        $s8 = "DoS Already Active..." fullword wide
        $s9 = "File Downloaded and Execut" wide
        $s10 = "LgDError33x98dGetProcAddress" fullword wide
        $s11 = "@SPYNET" fullword wide
        $s12 = "Recovery.Recovery" fullword wide
        $s13 = "GetChrome" fullword wide
        $s14 = "\\drivers\\etc\\HOSTS" fullword ascii
        $s15 = "plugin-container.exe" fullword ascii
        $s16 = "bss_server.usrRelay" fullword ascii
        $s17 = "sckRelay" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 8 of ($s*))
}

rule MALWARE_Win_NetSupport {
    meta:
        author = "ditekSHen"
        description = "Detects NetSupport client"
        snort_sid = "920266-920267"
    strings:
        $s1 = ":\\nsmsrc\\nsm\\" fullword ascii
        $s2 = "name=\"NetSupport Client Configurator\"" fullword ascii
        $s3 = "<description>NetSupport Manager Remote Control.</description>" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 2 of them
}

rule MALWARE_Win_GoBrutLoader {
    meta:
        author = "ditekSHen"
        description = "Detects GoBrut StealthWorker laoder"
    condition:
        uint16(0) == 0x5a4d and pe.exports("@SetFirstEverVice@8")
}

rule MALWARE_Win_Milan {
    meta:
        author = "ditekSHen"
        description = "Detects Milan Lyceum backdoor"
        hash1 = "21ab4357262993a042c28c1cdb52b2dab7195a6c30fa8be723631604dd330b29"
        hash2 = "a2754d7995426b58317e437f8ed6770cd7bb7b18d971e23b2b300b75e34fa086"
        hash3 = "b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249"
        hash4 = "b54a67062bdcd32dfa9f3d7b69780d2e6e4925777290bc34e8f979a1b4b72ea2"
        hash5 = "b766522dd4189fef7775d663e5649ba9d8be8e03022039d20848fcbc3643e5f2"
        hash6 = "d3606e2e36db0a0cb1b8168423188ee66332cae24fe59d63f93f5f53ab7c3029"
        hash7 = "857e2f63a1078d49adc59a03482f7b362563f16fb251f174bdaa7759ed47922a"
        hash8 = "4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248"
    strings:
        $ua1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)" fullword wide
        $ua2 = "Mozilla/5.0 (Android; Mobile; rv:28.0) Gecko/28.0 Firefox/28.0" fullword wide
        $ua3 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch; NOKIA; Lumia 520)" fullword wide
        $ua4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)" fullword wide
        $ua5 = "Mozilla/5.0 (IE 11.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; rv:11.0) like Gecko" fullword wide
        $ua6 = "Mozilla/5.0 (iPad; U; CPU OS 5_1_1 like Mac OS X; en-us) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3" fullword wide
        $ua7 = "Mozilla/5.0 (Linux; Android 4.1; Galaxy Nexus Build/JRN84D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Mobile Safari/535.19" fullword wide
        $ua8 = "Mozilla/5.0 (Linux; Android 7.1.1; ASUS_X017DA Build/NGI77B; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/1.5.1(11790) Chrome/74.0.3729.157 Mobile Safari/537.36" fullword wide
        $ua9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0" fullword wide
        $ua10 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" fullword wide
        $ua11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword wide
        $ua12 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0" fullword wide
        $n1 = "charset={[A-Za-z0-9\\-_]+}" fullword wide
        $n2 = "Content-Length: {[0-9]+}" fullword wide
        $n3 = "Location: {[0-9]+}" fullword wide
        $n4 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
        $n5 = "{<html>}" fullword wide
        $n6 = "&formid=" fullword ascii
        $n7 = "/?id=" fullword ascii
        $p1 = "\\milan\\Debug\\Milan.pdb" ascii
        $p2 = "\\milan\\Release\\Milan.pdb" ascii
        $p3 = "\\BackDor Last\\" ascii
        $p4 = "\\BackDorLast\\" ascii
        $s1 = "/q \"%s\" & waitfor" wide
        $s2 = "/q \"%s\" & schtasks /delete" wide
        $s3 = "*BOT@;" fullword ascii
        $s4 = "mofcomp \"" fullword ascii
        $s5 = "\"WQL\";};instance of " ascii
        $s6 = "</svalue>" fullword wide
        $s7 = "cmd.exe /C " wide nocase
        $d1 = "akastatus.com" ascii
        $d2 = "centosupdatecdn.com" ascii
        $d3 = "checkinternet.org" ascii
        $d4 = "cybersecnet.co.za" ascii
        $d5 = "cybersecnet.org" ascii
        $d6 = "defenderlive.com" ascii
        $d7 = "defenderstatus.com" ascii
        $d8 = "digitalmarketingagency.net" ascii
        $d9 = "dnsanalizer.com" ascii
        $d10 = "dnscatalog.net" ascii
        $d11 = "dnscdn.org" ascii
        $d12 = "dnsstatus.org" ascii
        $d13 = "excsrvcdn.com" ascii
        $d14 = "hpesystem.com" ascii
        $d15 = "livednscdn.com" ascii
        $d16 = "micrsoftonline.net" ascii
        $d17 = "ndianmombais.com" ascii
        $d18 = "online-analytic.com" ascii
        $d19 = "securednsservice.net" ascii
        $d20 = "sysadminnews.info" ascii
        $d21 = "uctpostgraduate.com" ascii
        $d22 = "updatecdn.net" ascii
        $d23 = "web-traffic.info" ascii
        $d24 = "windowsupdatecdn.com" ascii
        $d25 = "wsuslink.com" ascii
        $d26 = "zonestatistic.com" ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($p*) and (2 of ($s*) or 2 of ($ua*))) or (5 of ($n*) and (2 of ($ua*) or 1 of ($p*) or 1 of ($s*))) or (3 of ($s*) and (2 of ($ua*) or 5 of ($n*))) or (2 of ($d*) and 6 of them))
}

rule MALWARE_Win_UNK05 {
    meta:
        author = "ditekSHen"
        description = "Detects potential BazarLoader"
    strings:
        $s1 = "/api/get" ascii wide
        $s2 = "PARENTCMDLINE" fullword ascii 
        $s3 = "https://microsoft.com/telemetry/update.exe" ascii wide
        $s4 = "api.opennicproject.org" fullword ascii wide
        $s5 = "https://%hu.%hu.%hu.%hu:%u" fullword ascii wide
        $s6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" ascii wide
        $s7 = "PARENTJOBID" fullword ascii wide
        $s8 = "\\System32\\rundll32.exe" fullword ascii wide
        $s9 = "{ccc38b40-5b04-4fb1-a684-07c7e448d4df}" fullword ascii wide // mutex
        $s10 = "{065f6686-990b-46fc-829c-a53ec188a723}" fullword ascii wide // mutex
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_ClipBanker01 {
    meta:
        author = "ditekSHen"
        description = "Detects ClipBanker infostealer"
    strings:
        $s1 = "Clipper" fullword wide
        $s2 = "Ushell" fullword wide
        $s3 = "Banker" fullword wide
        $s4 = "ClipPurse" fullword wide nocase
        $s5 = "SelfClip" fullword wide
        $s6 = "Cliper" fullword wide
        $s7 = "FHQD4313-33DE-489D-9721-6AFF69841DEA" fullword wide
        $s8 = "Remove.bat" fullword wide
        $s9 = "\\w{1}\\d{12}" fullword wide
        $s10 = "SELECT * FROM Win32_ComputerSystem" fullword wide
        $s11 = "red hat" fullword wide
        $s12 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00
                 2e 00 65 00 78 00 65 00 00 ?? 2f 00 63 00 72 00
                 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00
                 20 00 00 ?? 20 00 2f 00 6d 00 6f 00 20 00 00 ??
                 20 00 2f 00 72 00 6c 00 20 00 00 ?? 20 00 2f 00
                 74 00 6e 00 20 00 00 ?? 20 00 2f 00 74 00 72 00
                 20 00 00 ?? 20 00 ?? 00 ?? 00 00 ?? 2f 00 64 00
                 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00
                 6e }
        $s13 = "ClipChanger" fullword ascii
        $s14 = "CheckVirtual" fullword ascii
        $s15 = "InjReg" fullword ascii
        $s16 = "SuicideFile" fullword ascii
        $s17 = "HideFile" fullword ascii
        $s18 = "AntiVm" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_Win_ZombieBoy {
    meta:
        author = "ditekSHen"
        description = "Detects ZombieBoy Downloader"
    strings:
        $s1 = ":\\Users\\ZombieBoy\\" ascii wide
        $s2 = "RookIE/1.0" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_PCRat {
    meta:
        author = "ditekSHen"
        description = "Detects PCRat / Gh0st"
    strings:
        $s1 = "ClearEventLogA" fullword ascii
        $s2 = "NetUserAdd" fullword ascii
        $s3 = "<H1>403 Forbidden</H1>" fullword ascii
        $s4 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
        $s5 = "Mozilla/4.0 (compatible)" fullword ascii
        $s6 = "<Enter>" fullword ascii
        $s7 = "\\cmd.exe" fullword ascii
        $s8 = "Program Files\\Internet Explorer\\IEXPLORE.EXE" fullword ascii
        $s9 = "Collegesoft ScenicPlayer" fullword wide
        $a1 = "360tray.exe" fullword ascii
        $a2 = "avp.exe" fullword ascii
        $a3 = "RavMonD.exe" fullword ascii
        $a4 = "360sd.exe" fullword ascii
        $a5 = "Mcshield.exe" fullword ascii
        $a6 = "egui.exe" fullword ascii
        $a7 = "kxetray.exe" fullword ascii
        $a8 = "knsdtray.exe" fullword ascii
        $a9 = "TMBMSRV.exe" fullword ascii
        $a10 = "avcenter.exe" fullword ascii
        $a11 = "ashDisp.exe" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of ($s*) and 6 of ($a*)
}

rule MALWARE_Win_Rapid {
    meta:
        author = "ditekSHen"
        description = "Detects Rapid ransomware"
    strings:
        $s1 = "encblklen" fullword ascii
        $s2 = ".rapid" fullword ascii
        $s3 = "BgIAAACkAABSU0E" ascii
        $s4 = "IFdlIHNlbmQ" ascii
        $s5 = "Software\\EncryptKeys" fullword ascii
        $s6 = "local_enc_private_key" fullword ascii
        $s7 = "local_public_key" fullword ascii
        $s8 = "How Recovery Files.txt" ascii
        $s9 = "recovery.txt" ascii
        $s10 = "thr %i run %s" fullword ascii
        $s11 = " /TN Encrypter" ascii
        $s12 = /Encrypter_\d+/ fullword ascii
        $s13 = "BleepingComputer_rapid" ascii wide
        $m1 = "tell us your unique ID - ID-" ascii
        $m2 = "really want to restore your files?" ascii
    condition:
        uint16(0) == 0x5a4d and (6 of ($s*) or (1 of ($m*) and 4 of ($s*)))
}

rule MALWARE_Win_Satana {
    meta:
        author = "ditekSHen"
        description = "Detects Satana ransomware"
        snort_sid = "920269-920270"
    strings:
        $bf1 = "Try Decrypt: uc_size = %d, c_size = %d" ascii
        $bf2 = "dwMailSelector = %d  dwBtcSelector = %d" ascii
        $bf3 = "%s: Error DecB: 0x%X" ascii
        $bf4 = "MBR written to Disk# %d" ascii
        $bf5 = "!SATANA!" ascii wide nocase
        $bf6 = "1 -th start" fullword ascii
        $bf7 = "id=%d&code=%d&sdata=%d.%d.%d %d %d %s %s %d&name=%s&md5=%s&dlen=%s" ascii
        $bf8 = "threadAdminFlood: %s %s %s" wide
        $bf9 = "%s: NET RES FOUND: %s" wide
    condition:
        (uint16(0) == 0x5a4d and 4 of ($bf*)) or (5 of ($bf*))
}

rule MALWARE_Win_VirLock {
    meta:
        author = "ditekSHen"
        description = "Detects VirLock ransomware"
    strings:
        $x1 = "BThere are two ways to pay a fine:" fullword wide
        $x2 = "^Es gibt zwei M" fullword wide
        $x3 = "glichkeiten, eine Strafe zahlen." fullword wide
        $x4 = /usertile\d+\.bmp/ fullword wide
        $s1 = "WinSock 2.0" fullword ascii
        $s2 = "Running" fullword ascii
        $s3 = "echo WScript.Sleep(50)>%TEMP%/file.vbs" fullword ascii
        $s4 = "cscript %TEMP%/file.vbs" fullword ascii
        $s5 = "del /F /Q file.js" fullword ascii
        $s6 = "del /F /Q %1" fullword ascii
        $s7 = "del /F /Q %0" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and ((2 of ($x*) and 2 of ($s*)) or (5 of ($s*) and 1 of ($x*)))) or (8 of them)
}

rule MALWARE_Win_PirateStealer {
    meta:
        author = "ditekSHen"
        description = "Detects PirateStealer"
    strings:
        $s1 = "PirateStealerBTW" wide
        $s2 = "/PirateStealer/main/src/" wide
        $s3 = "%WEBHOOK_LINK%" fullword wide
        $s4 = "your_webhook_here" fullword wide
        $s5 = "PirateMonsterInjector" ascii wide
        $s6 = "DiscordProcesses" fullword ascii
        $s7 = "GetDiscords" fullword ascii
        $s8 = { 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 47
               65 74 46 6f 6c 64 65 72 50 61 74 68 00 57 65 62
               68 6f 6f 6b 00 4b 69 6c 6c 00 50 72 6f 67 72 61
               6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 }
    condition:
        uint16(0) == 0x5a4d and 3 of them
}

rule MALWARE_Win_NGLite {
    meta:
        author = "ditekSHen"
        description = "Detects NGLite"
    strings:
        $x1 = "/lprey/main.go" ascii
        $x2 = "/NGLiteV1.01/lprey/" ascii
        $x3 = "/ng.com/lprey/" ascii
        $x4 = "/mnt/hgfs/CrossC2-2.2/src/" ascii
        $x5 = "WHATswrongwithUu" ascii
        $s1 = "main.Preylistener" fullword ascii
        $s2 = "main.Runcommand" fullword ascii
        $s3 = "main.RandomPass" fullword ascii
        $s4 = "main.AesEncode" fullword ascii
        $s5 = "main.RsaEncode" fullword ascii
        $s6 = "main.AesDecode" fullword ascii
        $s7 = "main.initonce" fullword ascii
        $s8 = "main.SendOnce" fullword ascii
        $s9 = "main.clientConf" fullword ascii
        $s10 = "main.Sender" fullword ascii
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x457f or uint16(0) == 0xfacf) and ((1 of ($x*) and 2 of ($s*)) or (6 of ($s*)))
}

rule MALWARE_Win_KdcSponge {
    meta:
        author = "ditekSHen"
        description = "Detects KdcSponge"
        hash1 = "e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c"
    strings:
        $x1 = "\\share\\kdcdll\\user641.pdb" ascii
        $x2 = "5ADSelf@tech*7890" fullword wide
        $kdc1 = "KdcVerifyEncryptedTimeStamp" ascii wide nocase
        $kdc2 = "KerbHashPasswordEx3" ascii wide nocase
        $kdc3 = "KerbFreeKey" ascii wide nocase
        $r1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
        $r2 = "KDC Service" fullword ascii
        $s1 = "download//symbols//%S//%S//%S" fullword wide
        $s2 = "c:\\windows\\system32\\kdcsvc.dll" fullword wide nocase
        $s3 = /WinHttp(Send|Receive)(Request|Response) failed (0x%.8X)/ fullword wide
    condition:
        uint16(0) == 0x5a4d and (
            (1 of ($x*) and 2 of them) or (all of ($kdc*) and (1 of ($x*) or all of ($r*) or 2 of ($s*))) or (8 of them) or
            (
                pe.exports("MainFun") and 
                pe.exports("NetApiBufferFree") and 
                pe.exports("BeaEngineRevision") and 
                pe.exports("BeaEngineVersion") and 
                pe.exports("Disasm") and 
                pe.exports("DllRegisterServer") and 
                pe.exports("DsGetDcName") and
                2 of them
            )
        )
}

rule MALWARE_Win_Chinotto {
    meta:
        author = "ditekSHen"
        description = "Detects Chinotto"
    strings:
        $x1 = "xxxchinotto" ascii wide
        $x2 = "\\Chinotto.pdb" ascii wide
        $x3 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31
                0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e
                67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 74 65
                0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f
                7a 69 6c 6c 61 2f 34 2e 30 28 63 6f 6d 70 61 74
                69 62 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20
                57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20
                53 56 31 29 0d 0a 41 63 63 65 70 74 3a 20 69 6d
                61 67 65 2f 67 69 66 2c 20 69 6d 61 67 65 2f 78
                2d 78 62 69 74 6d 61 70 2c 20 69 6d 61 67 65 2f
                6a 70 65 67 2c 20 69 6d 61 67 65 2f 70 6a 70 65
                67 2c 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78
                2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68
                2c 20 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67
                75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 43 6f 6e
                74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69
                70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 62
                6f 75 6e 64 61 72 79 3d 25 73 0d 0a 48 6f 73 74
                3a 20 25 73 3a 25 64 0d 0a 43 6f 6e 74 65 6e 74
                2d 4c 65 6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e
                6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c
                69 76 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72
                6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a
                00 00 00 00 48 54 54 50 2f 31 2e 31 20 32 30 30
                20 4f 4b 00 0d 0a 0d 0a 00 00 00 00 65 72 72 6f
                72 3c 2f 62 3e }
        $s1 = "Run /v xxxzexs /t REG_SZ /d %s /f" ascii wide
        $s2 = "ShellExecute Error, ret" ascii wide
        $s3 = "Run app succeed" ascii
        $s4 = "cleartemp:" fullword ascii
        $s5 = "wakeup:" fullword ascii
        $s6 = "updir:" fullword ascii
        $s7 = "regstart:" fullword ascii
        $s8 = "chdec:" fullword ascii
        $s9 = "cmd:" fullword ascii
        $s10 = "error</b>" fullword ascii
        $c1 = "Host: %s:%d" ascii wide
        $c2 = "Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1; SV1)" ascii wide
        $c3 = "Mozilla/5.0(Windows NT 10.0; Win64; x64)AppleWebKit/537.36(KHTML, like Gecko)Chrome/78.0.3904.108 Safari/537.36" ascii wide
        $c4 = "id=%s&type=hello&direction=send" ascii wide
        $c5 = "id=%s&type=command&direction=receive" ascii wide
        $c6 = "id=%s&type=file&direction=" ascii wide
        $c7 = "id=%s&type=result&direction=" ascii wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 2 of ($c*))) or 4 of ($c*) or 5 of ($s*))
}

rule MALWARE_Win_Tardigrade {
    meta:
        author = "ditekSHen"
        description = "Detects Tardigrade"
        hash1 = "c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858"
        hash2 = "966b2c7c72a28310acd58bb23af4d3c893b2afca264b2d9c0ec42db815c77487"
        hash3 = "88be5da274df704dc7fd9882c661a0afdd35f1ce0a7145e30f51c292abd2a86b"
        hash4 = "cf88926b7d5a5ebbd563d0241aaf83718b77cec56da66bdf234295cc5a91c5fe"
        hash5 = "4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30"
    strings:
        $x1 = "cmd.exe /c echo kOJAdtQoDcMuogIZIl>\"%s\"&exit" fullword ascii
        $x2 = "cmd.exe /c echo HBnBcZPeUevCDQmKGzXxYJHqpzRAbRCQCihOxiLi>\"%s\"&exit" fullword ascii
        $x3 = "cmd.exe /c set kpUUCjoLWLZvJFc=3167 & reg add HKCU\\SOFTWARE\\EQwIobTRgsJ /v PDMXPmqSYnUx /t REG_DWORD /d 10080 & exit" fullword ascii
        //$x4 = "DEMOBLABLA" fullword ascii
        $s1 = "ReplaceFileA" ascii
        $s2 = "FlushFileBuffers" ascii
        $s3 = "WaitNamedPipeA" ascii
        $s4 = "ImpersonateNamedPipeClient" ascii
        $s5 = "RegFlushKey" ascii
        $s6 = /cmd\.exe \/c (echo|set)/ ascii
        $s7 = ">\"%s\"&exit" ascii
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and (1 of ($x*) or 6 of ($s*)) and 
        (
            pe.exports("DllGetClassObject") and 
            pe.exports("DllMain") and 
            pe.exports("DllRegisterServer") and 
            pe.exports("DllUnregisterServer") and 
            pe.exports("InitHelperDll") and 
            pe.exports("StartW")
        )
}

rule MALWARE_Win_ClipBanker02 {
    meta:
        author = "ditekSHen"
        description = "Detects ClipBanker infostealer"
    strings:
        $x1 = "\\Allcome\\Source code\\Clipper\\" ascii nocase
        $x2 = "\\cleaper\\Release\\cleaper.pdb" ascii nocase
        $v1_1 = "&username=" fullword ascii
        $v1_2 = "/card.php?data=" fullword ascii
        $v1_3 = "/Create /tn MicrosoftDriver /sc MINUTE /tr" fullword ascii
        $v1_4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" fullword ascii
        $v1_5 = "/API/Clipper/ykesqk0o.php?cf6zrlhn=" fullword ascii
        $v1_6 = "&di7ztth6=" fullword ascii
        $v1_7 = "/API/Clipper/hr627gzk.php?v6etwxo5=" fullword ascii
        $v2_1 = "bitcoincash:" fullword ascii
        $v2_2 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ascii
        $re1 = "^[0-9]{16}$" fullword ascii
        $re2 = "^[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}" fullword ascii
        $re3 = "^\\d{2}\\D\\d{2}" fullword ascii
        $re4 = "^[0-9]{3}" fullword ascii
        $re5 = "([\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?)" fullword ascii
        $re6 = "(\\d{2}\\D\\d{2})" fullword ascii
        $re7 = "(\\d{3})" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and (5 of ($v1*) or all of ($v2*))) or (3 of ($re*) and (2 of ($v1*) or 2 of ($v2*))))
}

rule MALWARE_Win_BadJoke {
    meta:
        author = "ditekSHen"
        description = "Detects BadJoke / Witch"
    strings:
        $s1 = "msdownld.tmp" fullword ascii
        $s2 = "UPDFILE%lu" fullword ascii
        $s3 = "Command.com /c %s" fullword ascii
        $s4 = "launch.cmd" fullword ascii
        $s5 = "virus.vbs" fullword ascii
        $s6 = "virus.py" fullword ascii
        $m1 = "Message from Google Virus" ascii
        $m2 = "you cannot get rid of this virus" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($m*) or all of ($s*) or (1 of ($m*) and 2 of ($s*)))
}

rule MALWARE_Win_Heracles {
    meta:
        author = "ditekSHen"
        description = "Detects Heracles infostealer"
    strings:
        $x1 = "aHR0cHM6Ly9uYWNrZXIudG9hbnNlY3UuY29tL3VwbG9hZHM/a2V5PX" wide
        $b1 = "XEdvb2dsZVxDaHJvbWVc" wide
        $b2 = "XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcl" wide
        $b3 = "XENvY0NvY1xCcm93c2VyX" wide
        $b4 = "VXNlciBEYXRh" wide
        $b5 = "RGVmYXVsdA" wide
        $b6 = "UHJvZmlsZQ" wide
        $b7 = "Q29va2llcw" wide
        $b8 = "TG9naW4gRGF0YQ" wide
        $b9 = "TG9jYWwgU3RhdGU" wide
        $b10 = "bG9jYWxzdGF0ZQ" wide
        $b11 = "bG9naW5kYXRh" wide
        $s1 = "encrypted_key" fullword wide
        $s2 = "<GetIpInfoAsync>d__" ascii
        $s3 = "<reqHTML>5__" ascii
        $s4 = "<idHardware>5__" ascii
        $s5 = "<profilePaths>5__" ascii
        $s6 = "<cookieFile>5__" ascii
        $s7 = "<loginDataFile>5__" ascii
        $s8 = "<localStateFile>5__" ascii
        $s9 = "<postData>5__" ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or 8 of ($s*) or (4 of ($b*) and 4 of ($s*)))
}

rule MALWARE_Win_OnlyLogger {
    meta:
        author = "ditekSHen"
        description = "Detects OnlyLogger loader variants"
    strings:
        $s1 = { 45 6c 65 76 61 74 65 64 00 00 00 00 4e 4f 54 20 65 6c 65 76 61 74 65 64 }
        $s2 = "\" /f & erase \"" ascii
        $s3 = "/c taskkill /im \"" ascii
        $s4 = "KILLME" fullword ascii
        $s5 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
        $gn = ".php?pub=" ascii
        $ip = /\/1[a-z0-9A-Z]{4,5}/ fullword ascii
        $h1 = "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1" fullword ascii
        $h2 = "Accept-Language: ru-RU,ru;q=0.9,en;q=0.8" fullword ascii
        $h3 = "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1" fullword ascii
        $h4 = "Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0" fullword ascii
        $h5 = "Content-Type: application/x-www-form-urlencoded" fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (#ip > 5 and ($gn or 3 of ($s*) or all of ($h*))) or (all of ($h*) and 3 of ($s*)))
}

rule MALWARE_Win_BlackByteGo {
    meta:
        author = "ditekSHen"
        description = "Detects BlackByte ransomware Go variants"
    strings:
        $x1 = "BlackByteGO/_cgo_gotypes.go" fullword ascii
        //$x2 = "_cgo_dummy_export" fullword ascii
        $x3 = "BlackByteGO/" ascii nocase
        $s1 = ".Disconnect" ascii
        $s2 = ".OpenService" ascii
        $s3 = ".ListServices" ascii
        $s4 = ".Start" ascii
        $s5 = ".Encrypt" ascii
        $s6 = ".Decrypt" ascii
        $s7 = ".MustFindProc" ascii
        $s8 = ".QuoRem" ascii
        $s9 = "C:\\Windows\\regedit.exe" fullword wide
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or all of ($s*))
        //uint16(0) == 0x5a4d and (1 of ($x*) or all of ($s*) or (1 of ($x*) and 5 of ($s*)))
}

rule MALWARE_Win_Vulturi {
    meta:
        author = "ditekSHen"
        description = "Detects Vulturi infostealer"
    strings:
        $x1 = "Vulturi_" ascii wide
        $x2 = "VulturiProject" fullword ascii
        $s1 = { 5b 00 2d 00 5d 00 20 00 53 00 65 00 72 00 76 00
               65 00 72 00 20 00 ?? ?? 20 00 69 00 73 00 20 00
               6f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 2e 00
               2e 00 2e 00 00 ?? 5b 00 2b 00 5d 00 20 00 53 00
               65 00 72 00 76 00 65 00 72 00 20 00 00 ?? ?? 00
               69 00 73 00 20 00 6f 00 6e 00 6c 00 69 00 6e 00
               65 00 }
        $s2 = "Writing is not alowed" wide
        $s3 = "System\\ProcessList.txt" fullword wide
        $s4 = "[X] GetSSL ::" fullword wide
        $s5 = "Failed to steal " wide
        $s6 = "StealerStub" fullword ascii
        $s7 = "/C chcp 65001 && netsh" wide
        $n1 = "fetch_options" fullword wide
        $n2 = "send_report" fullword wide
        $n3 = "?username=" fullword wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and any of them) or all of ($n*) or 5 of ($s*) or (1 of ($n*) and 3 of ($s*)))
}

rule MALWARE_Win_Tofsee {
    meta:
        author = "ditekSHen"
        description = "Detects Tofsee"
    strings:
        $s1 = "n%systemroot%\\system32\\cmd.exe" fullword wide
        $s2 = "loader_id" fullword ascii
        $s3 = "start_srv" fullword ascii
        $s4 = "lid_file_upd" fullword ascii
        $s5 = "localcfg" fullword ascii
        $s6 = "Incorrect respons" fullword ascii
        $s7 = "mx connect error" fullword ascii
        $s8 = "Error sending command (sent = %d/%d)" fullword ascii
        $s9 = "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_Khonsari {
    meta:
        author = "ditekSHen"
        description = "Detects Khonsari ransomware"
    strings:
        $x1 = ".khonsari" fullword wide nocase
        $s1 = "Encrypt" fullword ascii
        $s2 = "CreateEncryptor" fullword ascii
        $s3 = "GenerateKey" fullword ascii
        $s4 = "277e5e6a-4da6-4138-97fa-3fecbdad0176" ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 2 of ($s*)) or (all of ($s*)))
}

rule MALWARE_Win_Quantum {
    meta:
        author = "ditekSHen"
        description = "Detects Quantum locker / ransomware"
    strings:
        $x1 = "\\t<title>Quantum</title>" ascii wide
        $x2 = "Quantum Locker.<br><br>" ascii wide
        $s1 = "ERROR" fullword wide
        $s2 = ".log" fullword wide
        $s3 = "SLOW" fullword wide
        $s4 = "Create" fullword wide
        $s5 = "Integrity" fullword wide
        $s6 = "Disabled" fullword wide
        $s7 = "Deny" fullword wide
        $s8 = "FAST" fullword wide
        $s9 = "Mandatory" fullword wide
        $s10 = "plugin.dll" fullword ascii
        $s11 = "NetGetDCName" fullword ascii
        $s12 = "NetShareEnum" fullword ascii
        $s13 = "NetGetJoinInformation" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and (all of ($x*) or 9 of ($s*) or (pe.number_of_exports == 2 and pe.exports("RunW") and pe.exports("runW") and 5 of ($s*)))) or all of ($x*)
}

rule MALWARE_Win_Owowa {
    meta:
        author = "ditekSHen"
        description = "Detects Owowa"
    strings:
        $u1 = "jFuLIXpzRdateYHoVwMlfc" fullword ascii wide
        $u2 = "Fb8v91c6tHiKsWzrulCeqO" fullword ascii wide
        $u3 = "dEUM3jZXaDiob8BrqSy2PQO1" fullword ascii wide
        $s1 = "powershell.exe" fullword wide
        $s2 = "<RSAKeyValue><Modulus>" wide
        $s3 = "HealthMailbox" fullword wide
        $s4 = "6801b573-4cdb-4307-8d4a-3d1e2842f09f" ascii
        $s5 = "<PreSend_RequestContent>b__" ascii
        $s6 = "ClearHeaders" fullword ascii
        $s7 = "get_UserHostAddress" fullword ascii
        $s8 = "ExtenderControlDesigner" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($u*) or (2 of ($u*) and 3 of ($s*)) or 6 of ($s*))
}

rule MALWARE_Win_Chebka {
    meta:
        author = "ditekSHen"
        description = "Detects Chebka"
    strings:
        $s1 = "-k netsvcs" wide
        $s2 = "%ssvchost.exe -k SystemNetworkService" wide
        $s3 = "Mozilla/4.0 (compatible)" wide
        $s4 = "_kasssperskdy" wide
        $s5 = "winssyslog" wide
        $s6 = "LoaderDll%d" wide
        $s7 = "cmd.exe /c rundll32.exe shell32.dll," wide
        $s8 = /cmd.exe \/c start (chrome|msedge|firefox|iexplorer)\.exe/ wide
        $f1 = ".?AVCHVncManager@@" fullword ascii
        $f2 = ".?AVCNetstatManager@@" fullword ascii
        $f3 = ".?AVCTcpAgentListener@@" fullword ascii
        $f4 = ".?AVIUdpClientListener@@" fullword ascii
        $f5 = ".?AVCShellManager@@" fullword ascii
        $f6 = ".?AVCScreenSpy@@" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or all of ($f*) or (3 of ($f*) and 3 of ($s*)) or (#s8 > 2 and 5 of them))
}

rule MALWARE_Win_Flagpro {
    meta:
        author = "ditekSHen"
        description = "Detects Flagpro"
    strings:
        $s1 = "download...." fullword ascii
        $s2 = "~MYTEMP" fullword wide
        $s3 = ".?AVCV20_LoaderApp@@" fullword ascii
        $s4 = ".?AVCV20_LoaderDlg@@" fullword ascii
        $s5 = "ExecYes" fullword ascii
        $s6 = /<BODY ID=CV\d+_LoaderDlg BGCOLOR=/ ascii
        $n1 = "://139.162.87.180" wide
        $n2 = "://172.104.109.217" wide
        $n3 = "://org.misecure.com/index.html" wide
        $b1 = /(get all|click|close|maybe|get_outerHTML|download\d) (finished|pass|ok|windows|failed)!/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of ($s*) or (1 of ($n*) and (2 of ($s*) or 1 of ($b*))) or (2 of ($s*) and 1 of ($b*))
}

rule MALWARE_Win_NPlusMiner {
    meta:
        author = "ditekSHen"
        description = "Detects PowerShell based NPlusMiner"
        snort_sid = "920284"
    strings:
        $s1 = "$Core | Add-Member @{IsReadOnly = $((Get-ItemProperty -Path \".\\Includes\\Core.ps1\").IsReadOnly)} -Force" fullword ascii
        $s2 = "$Core | Add-Member @{MinerCustomConfig = $((Get-Content \".\\Config\\MinerCustomConfig.json\" -Raw))} -Force" fullword ascii
        $s3 = "If ($Variables.CheatGuy -and $Core.corehash -in $Hashes -and $Core.ScriptStartDate -le (Get-Date)" ascii
        $s4 = "Try{(Get-ItemProperty -Path \".\\Includes\\Core.ps1\").IsReadOnly = $false} catch {}" fullword ascii
        $s5 = " NPlusMiner/" ascii
    condition:
        3 of them
}

rule MALWARE_Win_PWSH_PoshCookieStealer {
    meta:
        author = "ditekSHen"
        description = "Detects PowerShell PoshCookieStealer"
    strings:
        $s1 = "\\User Data\\default\\Network\\Cookies" ascii nocase
        $s2 = "Send-ToEmail" ascii
        $s3 = "[Security.Cryptography.ProtectedData]::Unprotect($" ascii
        $s4 = "$($env:LOCALAPPDATA)\\" ascii
        $s5 = "$($env:HOMEPATH)\\" ascii
        $s6 = "|ForEach-Object ToString X2) -join ''" ascii
        $s7 = ".Attachments.Add($" ascii
    condition:
        5 of them
}

rule MALWARE_Win_GarrantDecrypt {
    meta:
        author = "ditekSHen"
        description = "Detects GarrantDecrypt ransomware"
    strings:
        $x1 = "%appdata%\\_uninstalling_.png" fullword wide
        $x2 = "C:\\Windows\\sysnative\\vssadmin.exe" fullword wide
        $x3 = /(ICQ|Skype) (@nuncatarde|@supersuso|@Whitehorsedecryption|@likeahorse|@Konwarszawski|@zipzipulya|Whitehorsedecryption|LIKEAHORSE DECRYPTION|Zip Zipulya)/ ascii
        $s1 = "your unique ID" ascii
        $s2 = "Google market ICQ" ascii
        $s3 = "If you want to restore them, install ICQ" ascii
        $s4 = "Write to our ICQ @" ascii
    condition:
        uint16(0) == 0x5a4d and ((2 of ($x*) and 1 of ($s*)) or all of ($s*))
}

rule MALWARE_Win_Locked {
    meta:
        author = "ditekSHen"
        description = "Detects Locked ransomware"
    strings:
        $x1 = "http://xxxx.onion/xxxx-xxxx-xxxx-xxxx" ascii
        $x2 = "http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion" ascii
        $x3 = "dHA6Ly94eHh4Lm9uaW9uL3h4eHgteHh4eC14eHh4LXh4eHg" ascii
        $s1 = "choice /t 1 /d y /n >nul" ascii
        $s2 = ".locked" fullword ascii
        $s3 = "c:\\system volume information" fullword ascii
        $s4 = "__$$RECOVERY_README$$__.html" fullword ascii
        $s5 = "Trunc..." fullword ascii
        $s6 = /C:\\windows\\temp\\[a-z0-9A-Z]{6}\.tmp/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or all of ($s*) or (1 of ($x*) and 4 of ($s*)) or (#s6 > 1 and 4 of them))
}

rule MALWARE_Win_Maze {
    meta:
        author = "ditekSHen"
        description = "Detects Maze ransomware"
    strings:
        $x1 = "Uc32nbspacec97c98c99c100c101c102c103c104c105c106c107c108c109c110c" ascii
        $s1 = "\"%s\" shadowcopy delete" wide
        $s2 = "[%windir%\\system32\\wbem\\wmic" wide
        $s3 = "process call create \"cmd /c start %s\"" wide
        $s4 = "DECRYPT-FILES.html" fullword wide
        $s5 = "Dear %s, your files" wide
        $s6 = "%s! Alert! %s! Alert!" wide
        $s7 = "%BASE64_PLACEHOLDER%" fullword ascii
        $s8 = "-orDGorX0or" fullword ascii
        $s9 = { 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31
               0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73
               0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 43 6f 6e 6e
               65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69
               76 65 0d 0a 0d 0a 00 50 4f 53 54 20 2f 25 73 20
               48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41
               67 65 6e 74 3a 20 25 73 0d 0a 48 6f 73 74 3a 20
               25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65
               3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65
               6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e 6e 65 63
               74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65
               0d 0a 0d 0a 00 0d 0a 0d 0a 00 43 6f 6e 74 65 6e
               74 2d 4c 65 6e 67 74 68 3a 20 00 }
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
}

rule MALWARE_Win_TeslaRevenge {
    meta:
        author = "ditekSHen"
        description = "Detects TeslaRevenge ransomware"
    strings:
        $s1 = "autospreadifnoav=" ascii wide
        $s2 = "autospread=" ascii wide
        $s3 = "noencryptext=" ascii wide
        $s4 = "teslarvng" wide
        $s5 = "finished encrypting" wide nocase
        $s6 = "net scan" wide nocase
        $s7 = "for /f %%x in ('wevtutil el') do wevtutil cl" ascii
        $s8 = "tasklist | find /i \"SDELETE.exe\"" ascii
        $e1 = "mshta.exe" ascii wide nocase
        $e2 = "sc.exe" ascii wide nocase
        $e3 = "vssadmin.exe" ascii wide nocase
        $e4 = "wbadmin.exe" ascii wide nocase
        $e5 = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and (4 of ($s*) or (all of ($e*) and 2 of ($s*)))
}

rule MALWARE_Win_LokiLocker {
    meta:
        author = "ditekSHen"
        description = "Detects LokiLocker ransomware"
    strings:
        $x1 = "SOFTWARE\\Loki" fullword wide
        $x2 = "Cpriv.Loki" fullword wide
        $x3 = "Loki/" wide
        $x4 = /loki(\s)?locker/ fullword wide nocase
        $s1 = "Restore-My-Files.txt" wide
        $s2 = "loading encryption keys" wide
        $s3 = "Kill switch -> enabled" wide
        $s4 = "ScanSMBShares" fullword ascii
        $s5 = "RewriteMBR" fullword ascii
        $s6 = /Encrypt(Drives|File|WinVolume|OsDrive)/ fullword ascii
        $n1 = "unique-id=" ascii wide
        $n2 = "&disk-size=" ascii wide
        $n3 = "&user=Darwin&cpu-name=" ascii wide
        $n4 = "&ram-size=" ascii wide
        $n5 = "&os-name=" ascii wide
        $n6 = "&chat-id=" ascii wide
        $n7 = "&msg-id=" ascii wide
        $n8 = "&elapsed-time=" ascii wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 4 of ($s*) or 6 of ($n*) or (3 of ($s*) and 3 of ($n*)) or (1 of ($x*) and (2 of ($s*) or 2 of ($n*))))
}

rule MALWARE_Osx_DazzleSpy {
    meta:
        author = "ditekSHen"
        description = "Attemp at hunting for DazzleSpy"
    strings:
        $x1 = "/osxrk_commandline/" ascii wide nocase
        $x2 = "/Users/wangping/pangu/" ascii wide nocase
        $s1 = "heartbeat" ascii wide
        $s2 = "scanFiles" ascii wide
        $s3 = "restartCMD" ascii wide
        $s4 = "downloadFile" ascii wide
        $s5 = "RDPInfo" ascii wide
    condition:
        uint16(0) == 0xfacf and (all of ($x*) or all of ($s*) or (1 of ($x*) and 3 of ($s*)))
}

rule MALWARE_Win_BHunt {
    meta:
        author = "ditekSHen"
        description = "Detects BHunt infostealer"
    strings:
        $x1 = "BHUNT.Resources.resources" fullword ascii
        $x2 = "//minecraftsquid.hopto.org/" wide
        $s1 = "chaos_crew" ascii wide
        $s2 = "golden7" ascii wide
        $s3 = "mrpropper" ascii wide
        $s4 = "/ifo.php?" ascii wide
        $s5 = "bonanza=:=" ascii wide
        $s6 = "blackjack=:=" ascii wide
        $s7 = "SendPostData" fullword ascii
        $c1 = "cmd /c REG ADD" wide
        $c2 = "taskkill /F /IM" wide
        $c3 = "cmd.exe /c wmic" wide
        $g1 = "$ca9a291d-266c-41dc-9f1c-93cfe0dcac16" fullword ascii
        $g2 = "$6d0feb35-213d-4b9f-afc7-06d168cfcb5e" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (1 of ($x*) and (5 of ($s*) or 2 of ($c*))) or (6 of ($s*) and 2 of ($c*)) or (all of ($g*) and 2 of them))
}

rule MALWARE_Win_Lorenz {
    meta:
        author = "ditekSHen"
        description = "Detects Lorenz ransomware"
    strings:
        $x1 = "143.198.117.43" fullword ascii
        $x2 = "157.90.147.28" fullword ascii
        $x3 = "//kpb3ss3vwvfejd4g3gvpvqo6ad7nnmvcqoik4mxt2376yu2adlg5fwyd.onion" ascii
        $x4 = "http://lorenz" ascii
        $x5 = "\\lora\\Release\\lora.pdb" ascii
        $x6 = "--MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" ascii
        $x7 = "/USER:'HOMEOFFICE.COM\\" ascii
        $x8 = "/USER:'Sentinel.com\\" ascii
        $s1 = "to->_What == nullptr && to->_DoFree == false" fullword wide
        $s2 = "*it == '\\0'" fullword wide
        $s3 = "process call create 'cmd.exe /c" ascii
        $s4 = "\\Control Panel\\Desktop\" /V Wallpaper /T REG_SZ /F /D" ascii
        $s5 = "HELP_SECURITY_EVENT.html" ascii
        $s6 = "<br>[+] Whats Happen?" ascii
        $s7 = /\.Lorenz\.sz\d+$/ fullword ascii
        $s8 = "TW9Vc29Db3JlV29ya2VyLmV4ZQ==" fullword ascii
        $s9 = ".Speak(\"You've been hack" ascii nocase
        $s10 = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAo" ascii
        $n1 = "ame_serv=" ascii
        $n2 = "&ip=" ascii
        $n3 = "&winver=Windows" ascii
        $n4 = "&list_drive=" ascii
        $n5 = "&file=" ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 8 of ($s*) or (4 of ($n*) and 2 of them) or (1 of ($x*) and 6 of them))
}

rule MALWARE_Win_BlackCat {
    meta:
        author = "ditekSHen"
        description = "Detects BlackCat ransomware"
    strings:
        $x1 = "{\"config_id\":\"\",\"public_key\":\"MIIBIjANBgkqhkiG9w0BAQEFAAO" ascii
        $x2 = "C:\\Users\\Public\\All Usersdeploy_note_and_image_for_all_users=" fullword ascii
        $s1 = "encrypt_app::windows" ascii
        $s2 = /locker::core::os::windows::(desktop_note|self_propagation|privilege_escalation|psexec|shadow_copy)/ ascii
        $s3 = "uac_bypass::shell_exec=" ascii
        $s4 = "-u-p-s-d-f-cpropagate::attempt=" ascii
        $s5 = "masquerade_peb" ascii
        $s6 = "RECOVER-${EXTENSION}-FILES.txt" ascii
        $s7 = ".onion/?access-key=${ACCESS_KEY}" ascii
        $s8 = "-vm-killno-vm-snapshot-killno-vm-kill-" ascii
        $s9 = "esxi_vm_killenable_esxi_vm_snapshot_killstrict_" ascii
        $s10 = /enum_(shares|servers)_sync::ok/ fullword ascii
        $s11 = "hidden_partitions::mount_all::mounting=" ascii
        //bcdedit /set {default}bcdedit /set {default} recoveryenabled No
        //kill_all::found=
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x457f) and (all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
}

rule MALWARE_Win_Koxic {
    meta:
        author = "ditekSHen"
        description = "Detects Koxic ransomware"
    strings:
        $c1 = " INFO: >> %TEMP%\\" ascii wide
        $c2 = "cmd /c \"wmic" ascii wide
        $c3 = "cmd /c \"echo" ascii wide
        $c4 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"%s\"" fullword wide
        $c5 = /sc config.{1,30}start=disabled/ fullword ascii wide
        $s1 = "Container: %s" fullword wide
        $s2 = "Shotcut dir : %s" fullword wide
        $s3 = "\\Microsoft\\Windows\\Network Shortcuts\\" fullword wide
        $s4 = "Thread %d started." fullword ascii
        $s5 = "ADD our TOXID:" wide
        $s6 = "[Recommended] Using an email" wide
    condition:
        uint16(0) == 0x5a4d and ((4 of ($s*) and 1 of ($c*)) or (2 of ($s*) and (#c1 > 5 or #c2 > 5 or #c3 > 5 or #c5 > 5)))
}

rule MALWARE_Win_TimeTime {
    meta:
        author = "ditekSHen"
        description = "Detects TimeTime ransomware"
    strings:
        $s1 = "@_DECRYPTOR_@" ascii wide
        $s2 = "@__RECOVER_YOUR_FILES__@" wide
        $s3 = "\\TimeTime.pdb" ascii
        $s4 = "runCommand" fullword ascii
        $s5 = "decryptor_file_name" fullword ascii
        $s6 = "encryption_hiding_process" fullword ascii
        $s7 = "admin_hiding_process" fullword ascii
        $s8 = "security_vaccine" fullword ascii
        $s9 = "EncrFiles_Load" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_StrifeWater {
    meta:
        author = "ditekSHen"
        description = "Detects StrifeWater RAT"
    strings:
        $s1 = "example/1.0" fullword wide
        $s2 = "coname:" fullword ascii
        $s3 = "*elev:" fullword ascii
        $s4 = "*uname:" fullword ascii
        $s5 = "--BoundrySign" ascii  
        $s6 = "000000c:\\users\\public\\libraries\\tmp.bi" ascii
        $s7 = "9c4arSBr32g6IOni" fullword ascii
        $pdb = "\\win8\\Desktop\\ishdar_win8\\" ascii
        $xn1 = "techzenspace.com" fullword wide
        $xn2 = "87.120.8.210" wide
        $xn3 = "192.168.40.27" wide
        $n1 = /RVP\/index\d+\.php/ fullword wide
        $n2 = "tid=%d&code=%s&fname=%s&apiData=%s" fullword ascii
        $n3 = "code=%s&tid=%d&fname=%s&apiData=%s" fullword ascii
        $n4 = "Content-Disposition: form-data; name=\"token\"" fullword ascii
        $n5 = "Content-Disposition: form-data; name=\"apiData\"" fullword ascii
        $n6 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii
        $n7 = "Content-Disposition: form-data; name=\"tid\"" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($xn*) or 6 of ($s*) or 6 of ($n*) or (1 of ($xn*) and 4 of them) or ($pdb and 4 of them) or (3 of ($s*) and 3 of ($n*)))
}

rule MALWARE_Win_Surtr {
    meta:
        author = "ditekSHen"
        description = "Detects Surtr ransomware. Ransom note is similar to LockFile"
    strings:
        $s1 = "<title>SurtrRansomware</title>" ascii
        $s2 = "<HTA:APPLICATION ID=\"SurtrRansomware\"" ascii
        $s3 = "APPLICATIONNAME=\"SurtrRansomware\"" ascii
        $s4 = "src=\"data:image/jpeg; base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wCEAAgICAgJCAkKCgkNDgwODRMREBARExwUFhQWFBwrGx8bGx8bKyYuJSMlLiZENS8v" ascii
        $s5 = "4rbgxisigb4pxnloxzc265rmzaj7fslrhyouegtrph2a7xhh55r6xaid.onion" ascii
        $s6 = "schtasks /CREATE /SC ONLOGON /TN svchos" wide
        $s7 = "reg add HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ /v \"svchos" ascii
        $s8 = "reg add HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ /v \"svchos" ascii
        $s9 = "SURTR_README.txt" wide
        $s10 = "surtr-decrypt.top" ascii
        $s11 = /(Public|Private|ID)_DATA\.surt/ wide
        // Dropper
        //$d1 = "AES SMALL decryption - %s failed: 0x%08x"
        //$d2 = "Payload successfully decrypted"
        //$d3 = "\\Dev\\source\\repos\\Dropper\\x64\\Release\\Dropper.pdb"
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_UDPRat {
    meta:
        author = "ditekSHen"
        description = "Detects UDPRat"
    strings:
        $s1 = "\\code\\UDP\\Client\\" ascii
        $s2 = "ssdp:discover" ascii
        $s3 = ": Device:" ascii
        $s4 = "for the SNMP U encountered" ascii
        $s5 = "privat:InternetGatewayelink" fullword ascii
        $s6 = "schemas A jet error was" ascii
        $s7 = "msidentity" fullword ascii
        $s8 = "microsoftonliser-based Securi" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_JesterStealer {
    meta:
        author = "ditekSHen"
        description = "Detects JesterStealer"
    strings:
        $s1 = /\[(Credman|Networks|Screenshot|Vault)\]\s\{0\}/ fullword wide
        $s3 = "encoding=\"base64\"" fullword wide
        $s4 = "/json/list" fullword wide
        $s5 = "/L1ghtM4n/TorProxy/" ascii wide
        $s6 = "<EnumerateCredentials>" ascii
        $s7 = "<EnumerateBrowsers>" ascii
        $s8 = "<PerformSelfDestruct>" ascii
        $s9 = "<get_GrabberCount>" ascii
        $s10 = "AnalyzeData" fullword ascii
        $s11 = "CheckCard" fullword ascii
        $s12 = "CreateGrabberZipPath" fullword ascii
        $s13 = "Jester" fullword ascii
        $s14 = /Stealer\.(Recovery|Grabber|Investigation)\./ ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_SoranoStealer {
    meta:
        author = "ditekSHen"
        description = "Detects SoranoStealer / HogGrabber. Available on Github: /Alexuiop1337/SoranoStealer"
    strings:
        $x1 = "OiCuntJollyGoodDayYeHavin_" ascii
        $x2 = { 00 56 4d 50 72 6f 74 65 63 74 00 52 65 61 63 74
                6f 72 00 64 65 34 66 75 63 6b 79 6f 75 00 42 61
                62 65 6c 4f 62 66 75 73 63 61 74 6f 72 41 74 74
                72 69 62 75 74 65 00 43 72 79 74 70 6f 4f 62 66
                75 73 63 61 74 6f 72 00 }
        $x3 = { 00 4f 62 66 75 73 63 61 74 65 64 42 79 47 6f 6c
                69 61 74 68 00 42 65 64 73 2d 50 72 6f 74 6f 72 00 }
        $s1 = ".Binaries.whysosad" ascii
        $s2 = "Adminstrator permissons are required" wide
        $s3 = "12:03:33:4A:04:AF" fullword wide
        $s4 = "RemoveEXE" fullword ascii
        $s5 = "$340becfa-1688-4c32-aa49-30fdb4005e4b" fullword ascii
        $s6 = "$99cffbcc-6ad7-4d32-bd1f-450967cf4a6b" fullword ascii
        $s7 = "\"cam\": " ascii
        $s8 = " - 801858595527371999762718088" fullword ascii
        $s9 = "  - 96188142294460126639341306" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (2 of ($x*) and 3 of ($s*)) or 5 of ($s*))
}

rule MALWARE_Win_GloomaneStealer {
    meta:
        author = "ditekSHen"
        description = "Detects GloomaneStealer"
    strings:
        $x1 = "=GLOOMANE STEALER=" wide
        $x2 = "Maded by GLOOMANE" wide
        $s1 = "\\44CALIBER" ascii
        $s2 = "Ethernet()" fullword wide
        $s3 = ":spy: NEW LOG FROM" wide
        $s4 = ":eye: IP:" wide
        $s5 = ":file_folder: Grabbed Files" wide
        $s6 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
        $s7 = "$3b0e2d3d-3d66-42bb-8f9c-d6e188f359ae" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
}

rule MALWARE_Win_LockDown {
    meta:
        author = "ditekSHen"
        description = "Detects Lockdown / cantopen ransomware"
    strings:
        $s1 = "BgIAAACkAABSU0E" wide
        $s2 = ".cantopen" fullword wide
        $s3 = "\\HELP_DECRYPT_YOUR_FILES.txt" wide
        $s4 = "SALT" fullword wide
        $s5 = "$4e677664-9a63-458e-a365-deb792509557" fullword ascii
        $s6 = "CreateEncryptor" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_UnamedStealer {
    meta:
        author = "ditekSHen"
        description = "Detects unknown infostealer. Observed as 2nd stage and injects into .NET AppLaunch.exe"
    strings:
        $s1 = "HideMelt" fullword ascii
        $s2 = ".Implant" ascii
        $s3 = "SetUseragent" fullword ascii
        $s4 = "SendReport" fullword ascii
        $s5 = "cookiesList" fullword ascii
        $s6 = "WriteAppsList" fullword ascii
        $s7 = "Timeout /T 2 /Nobreak" fullword wide
        $s8 = "Directory not exists" wide
        $s9 = "### {0} ### ({1})" wide
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_ZXShell_Loader {
    meta:
        author = "ditekSHen"
        description = "Detects ZXShell kernel driver loader"
        hash1 = "a6020794bd6749e0765966cd65ca6d5511581f47cc2b38e41cb1e7fddaa0b221"
    strings:
        $s1 = "KillAvpProcess" ascii wide nocase
        $s2 = "ProtectDllFile" ascii wide nocase
        $s3 = "LoadSys"ascii wide nocase
        $s4 = "CallDriver" ascii wide nocase
        $s5 = "DoRVA" fullword ascii wide
        $s6 = "TdiProxy" ascii // "\\\\.\\TdiProxy0" fullword ascii
        $s7 = "res.ini" fullword ascii
        $s8 = "res.dat" fullword ascii
        $s9 = "google64.p" fullword ascii
        $s10 = "google32.p" fullword ascii
        $s11 = "OneSelfKey" fullword ascii
        $x1 = "antiscan" ascii
        $x2 = "removeprocessnotify" ascii
        $x3 = "setprocessnotify" ascii
        $x4 = "antiantigp" ascii
        $x5 = "hideproc" ascii
        $x6 = "hidekey" ascii
        $x7 = "hidefile" ascii
        $x8 = "sc create %s binpath= \"%%SystemRoot%%\\System32\\svchost.exe -k %s\" type= share start= auto" fullword ascii
        $m1 = "St4rtServ1ce" ascii
        $m2 = "ch3ck dr1ver failed" ascii
        $m3 = "L0ad dr1ver failed" ascii
        $m4 = "Write Dr1ver Failed" ascii
        $m5 = "over writed succ3ssfully" ascii
        $m6 = "can k1ll the pr0cessId" ascii
    condition:
        uint16(0) == 0x5a4d and (
            3 of ($m*) or
            5 of ($s*) or
            5 of ($x*) or
            (3 of ($s*) and 3 of ($x*)) or
            (2 of ($s*) and 1 of ($x*) and 1 of ($m*)) or
            (pe.exports("KillAvpProcess") and pe.exports("ProtectDllFile") and pe.exports("LoadSys")) or (
                3 of them and (
                    pe.exports("KillAvpProcess") or
                    pe.exports("ProtectDllFile") or
                    pe.exports("LoadSys") or
                    pe.exports("CallDriver") or
                    pe.exports("DoRVA")
                )
            )
        )
}

rule MALWARE_Win_Bandit {
    meta:
        author = "ditekSHen"
        description = "Detects Bandit Infostealer"
    strings:  
       $x1 = "@Banditshopbot" ascii
       $x2 = "BANDIT STEALER" ascii
       $x3 = "Banditstealer" ascii
       $n1 = "bandit/browsers." ascii
       $n2 = "bandit/crypto." ascii
       $n3 = "bandit/decrypt." ascii
       $n4 = "bandit/messenger." ascii
       $n5 = "bandit/userdata." ascii
       $n6 = "bandit/utils." ascii
       $f1 = "main.sendZipToTelegram" fullword ascii
       $f2 = "main.killProcessHoldingFileHandle" fullword ascii
       $f3 = "main.killProcessByName" fullword ascii
       $f4 = "main.killProcessesHoldingFile" fullword ascii
       $f5 = "main.deleteDir" fullword ascii
       $f6 = "main.deleteUserDataDirs" fullword ascii
       $path = /bandit\/(browsers|common|crypto|messenger|userdata|utils)\/(browsers|common|crypto|messenger|userdata|utils)\.go/ ascii
       $m1 = "banditbot" ascii wide nocase
       $m2 = "blackListedIPS = [" ascii wide nocase
       $m3 = "blackListedPCNames = [" ascii wide nocase
       $m4 = "blackListedMacs = [" ascii wide nocase
       $m5 = "blacklisted_hwids = [" ascii wide nocase
       $m6 = "blacklisted_users = [" ascii wide nocase
       $m7 = "blacklisted_processes = [" ascii wide nocase
       $s1 = "User-AgentVirtualBox" ascii
       $s2 = "%s%sBinanceChainWallet" ascii
       $s3 = "coinbaseWalletcontent-lengthdata" ascii
       $s4 = "coinbaseWalletExtensioncommand" ascii
       $s5 = "\\s+pid:\\s+(\\d+)\\s+" ascii
       $s6 = "/user:Administrator" ascii
    condition:
      uint16(0) == 0x5a4d and (2 of ($x*) or 4 of ($n*) or 5 of ($f*) or ($path and (1 of ($n*) or 1 of ($f*))) or (1 of ($x*) and (1 of ($n*) or 1 of ($f2*))) or 6 of ($m*) or (all of ($s*)))
}

rule MALWARE_Win_LapLas {
    meta:
        author = "ditekSHen"
        description = "Detects LapLas Infostealer"
        clamav_sig1 = "MALWARE.Win.LapLas-DotNET"
        clamav_sig2 = "MALWARE.Win.LapLas-GoLang"
    strings:
        // Go variant
        $c1 = "/bot/" ascii
        $c2 = "key=" ascii
        $f1 = "main.isRunning" fullword ascii
        $f2 = "main.writePid" fullword ascii
        $f3 = "main.isStartupEnabled" fullword ascii
        $f4 = "main.enableStartup" fullword ascii
        $f5 = "main.waitOpenClipboard" fullword ascii
        $f6 = "main.clipboardWrite" fullword ascii
        $f7 = "main.setOnline" fullword ascii
        $f8 = "main.getRegex" fullword ascii
        // .NET variant
        $v2_1 = "{0}/bot/{1}?{2}" wide
        $v2_2 = /\{0\}\\\{1\}\.(exe|pid)/ wide
        $v2_3 = "schtasks /create /tn" wide
        $v2_4 = "SetOnline" fullword ascii
        $v2_5 = "IsAutoRunInstance" fullword ascii
        $v2_6 = "GetNewAddress" fullword ascii
        $v2_7 = "RefreshRegex" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($c*) and 5 of ($f*)) or (1 of ($c*) and 7 of ($f*)) or (6 of ($v2*)))
}

rule MALWARE_Win_Mystic {
    meta:
        author = "ditekSHen"
        description = "Hunt for Mystic Infostealer"
    strings:  
        $s1 = "LaStFiLe:)" ascii wide
        $s2 = "LaStPrOcEsS:)" ascii wide
        $s3 = "credit_cards" ascii wide
        $s4 = "number_of_processors" ascii wide
        $s5 = "computername" ascii wide
        $p1 = "G:\\Projects\\Python\\morpher\\" ascii wide
        $p2 = /G:\\Projects\\stealer\\.{15}\\Release\\.{5,25}\.pdb/ ascii wide
    condition:
        (uint16(0) == 0x5a4d and (4 of ($s*) or (1 of ($p*) and 3 of ($s*)))) or (all of ($s*))
}

rule MALWARE_Linux_Buhti {
    meta:
        author = "ditekSHen"
        description = "Detects Buhti Ransomware"
    strings:
        $x1 = "buhtiRansom" ascii
        $x2 = "://satoshidisk.com/pay/" ascii
        $s1 = "main.encrypt_file" fullword ascii
        $s2 = "/path/to/be/encrypted" ascii
        $s3 = "Restore-My-Files.txt" ascii
        $s4 = ".buhti390625" ascii
    condition:
        uint16(0) == 0x457f and (all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of them)
}

rule MALWARE_Win_CommonMagic {
    meta:
        author = "ditekSHen"
        description = "Detects CommonMagic and Modules"
    strings:
        $p1 = "\\\\.\\pipe\\PipeMd" wide
        $p2 = "\\\\.\\pipe\\PipeCrDtMd" wide
        $p3 = "\\\\.\\pipe\\PipeDtMd" wide
        $s1 = "graph.microsoft.com" fullword wide
        $s2 = "CreateNamedPipe" ascii
        $s3 = "\\CommonCommand\\" wide
        $ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36" wide
        $ua2 = "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136" wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($p*) and 1 of ($s*)) or (1 of ($ua*) and 1 of ($s*) and 1 of ($p*))
}

rule MALWARE_Win_GreetingGhoul {
    meta:
        author = "ditekSHen"
        description = "Detects GreetingGhoul Cryptocurrency Infostealer"
    strings:
        $s1 = "peer_list" fullword ascii
        $s2 = "seed_hash" fullword ascii
        $s3 = "pool_id" fullword ascii
        $s4 = "%smutex=%s:%lu" ascii
        $s5 = "miner.cfg" fullword ascii
        $s6 = "{\"method\": \"%s\"%s}" ascii
        $s7 = "/app/manager/%s" ascii
        $s8 = "X-VNC-STATUS" fullword ascii
        $s9 = "%s\\%lu.zip" fullword ascii
        $s10 = "\\??\\%programdata%\\" wide
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_Multi_Family_InfoStealer {
    meta:
        author = "ditekSHen"
        description = "Detects Prynt, WorldWind, DarkEye, Stealerium and ToxicEye / TelegramRAT infostealers"
    strings:
        $n1 = /Prynt|WorldWind|DarkEye(\s)?Stealer/ ascii wide
        $n2 = "Stealerium" ascii wide
        $x1 = "@FlatLineStealer" ascii wide
        $x2 = "@CashOutGangTalk" ascii wide
        $x3 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
        $x4 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
        $s1 = "Timeout /T 2 /Nobreak" fullword wide
        $s2 =  /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
        $s3 = "Downloading file: \"{file}\"" wide
        $s4 = "/bot{0}/getUpdates?offset={1}" wide
        $s5 = "send command to bot!" wide
        $s6 = " *Keylogger " fullword wide
        $s7 = "*Stealer" wide
        $s8 = "Bot connected" wide
        $s9 = "### {0} ### ({1})" wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_WorldWind {
    meta:
        author = "ditekSHen"
        description = "Detects WorldWind infostealer"
    strings:
        $c1 = /WorldWind(\s)?Stealer/ ascii wide
        $x2 = "@FlatLineStealer" ascii wide
        $x3 = "@CashOutGangTalk" ascii wide
        $m1 = ".Passwords.Targets." ascii
        $m2 = ".Modules.Keylogger" ascii
        $m3 = ".Modules.Clipper" ascii
        $m4 = ".Modules.Implant" ascii
        $s1 = "--- Clipper" wide
        $s2 = "Downloading file: \"{file}\"" wide
        $s3 = "/bot{0}/getUpdates?offset={1}" wide
        $s4 = "send command to bot!" wide
        $s5 = " *Keylogger " fullword wide
        $s6 = "*Stealer" wide
        $s7 = "Bot connected" wide
    condition:
        uint16(0) == 0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
}

rule MALWARE_Win_Prynt {
    meta:
        author = "ditekSHen"
        description = "Detects Prynt infostealer"
    strings:
        $c1 = /Prynt(\s)?Stealer/ ascii wide
        $x2 = "@FlatLineStealer" ascii wide
        $x3 = "@CashOutGangTalk" ascii wide
        $m1 = ".Passwords.Targets." ascii
        $m2 = ".Modules.Keylogger" ascii
        $m3 = ".Modules.Clipper" ascii
        $m4 = ".Modules.Implant" ascii
        $s1 = "--- Clipper" wide
        $s2 = "Downloading file: \"{file}\"" wide
        $s3 = "/bot{0}/getUpdates?offset={1}" wide
        $s4 = "send command to bot!" wide
        $s5 = " *Keylogger " fullword wide
        $s6 = "*Stealer" wide
        $s7 = "Bot connected" wide
    condition:
        uint16(0) == 0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
}

rule MALWARE_Win_DarkEye {
    meta:
        author = "ditekSHen"
        description = "Detects DarkEye infostealer"
    strings:
        $c1 = /Prynt(\s)?Stealer/ ascii wide
        $c2 = /WorldWind(\s)?Stealer/ ascii wide
        $c3 = "ToxicEye" ascii wide
        $x2 = "@FlatLineStealer" ascii wide
        $x3 = "@CashOutGangTalk" ascii wide
        $s1 = "--- Clipper" wide
        $s2 = "Downloading file: \"{file}\"" wide
        $s3 = "/bot{0}/getUpdates?offset={1}" wide
        $s4 = "send command to bot!" wide
        $s5 = " *Keylogger " fullword wide
        $s6 = "*Stealer" wide
        $s7 = "Bot connected" wide
    condition:
        uint16(0) == 0x5a4d and not any of ($c*) and ((1 of ($x*) and 2 of ($s*)) or (4 of ($s*)))
}

rule MALWARE_Win_InvalidPrinter {
   meta:
      author= "ditekSHen"
      description = "Invalid Printer (in2al5d p3in4er) Loader"
      clamav_sig = "MALWARE.Win.InvalidPrinter"
   strings:
      $s1 = "in2al5d p3in4er" fullword ascii
      $s2 = "CreateDXGIFactory" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 15000KB and all of them
}

rule MALWARE_Win_RaccoonV2 {
    meta:
        author = "ditekSHen"
        description = "Detects Raccoon Stealer 2.0, also referred to as RecordBreaker"
    strings:
        $f1 = "sgnl_" fullword ascii
        $f2 = "tlgrm_" fullword ascii
        $f3 = "ews_" fullword ascii
        $f4 = "grbr_" fullword ascii
        $f5 = "dscrd_" fullword ascii
        $f6 = "wlts_" fullword ascii
        $f7 = "scrnsht_" fullword ascii
        $f8 = "sstmnfo_" fullword ascii
        $s1 = "machineId=" fullword ascii
        $s2 = "&configId=" fullword ascii
        $s3 = "URL:%s" fullword ascii
        $s4 = "USR:%s" fullword ascii
        $s5 = "PASS:%s" fullword ascii
        $s6 = "Content-Type: application/x-object" fullword ascii
    condition:
        ((uint16(0) == 0x5a4d and (4 of ($f*) or all of ($s*) or 7 of them)) or 10 of them)
}

rule MALWARE_Win_TrueBot {
    meta:
        author = "ditekSHen"
        description = "Detects TrueBot"
    strings:
        $s1 = "%s\\rundll32.exe" fullword wide
        $s2 = "ChkdskExs" fullword wide
        $s3 = "n=%s&o=%s&a=%d&u=%s&p=%s&d=%s" ascii
        $s4 = "KLLS" fullword ascii
        $s5 = "%s\\%08x-%08x.ps1" fullword ascii
        $s6 = ".JSONIP" ascii
        $s7 = "CreateProcessAsUserW res %d err %d" fullword ascii
        $s8 = "ldr_sys64.dll" fullword ascii
        $s9 = "SVCHOST" fullword ascii
        $s10 = "WINLOGON" fullword ascii
        $s11 = { 67 6f 6f 67 6c 65 2e 63 6f 6d 00 00 00 00 00 00 
                2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 
                20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_LummaStealer {
    meta:
        author = "ditekSHen"
        description = "Detects Lumma Stealer"
        snort1 = "2023813001"
        snort2 = "2023813002"
        clamav1 = "MALWARE.Win.Trojan.LummaStealer"
    strings:
        $x1 = /Lum[0-9]{3}xedmaC2,\sBuild/ ascii
        $x2 = /LID\(Lu[0-9]{3}xedmma\sID\):/ ascii
        $s1 = /os_c[0-9]{3}xedrypt\.encry[0-9]{3}xedpted_key/ fullword ascii
        $s2 = "c2sock" wide
        $s3 = "c2conf" wide
        $s4 = "TeslaBrowser/" wide
        $s5 = "Software.txt" fullword wide
        $s6 = "SysmonDrv" fullword
        $s7 = "*.eml" fullword wide nocase
        $s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" wide
        $s9 = "- Screen Resoluton:" ascii
        $s10 = "lid=%s" ascii
        $s11 = "&ver=" ascii
        $s12 = "769cb9aa22f4ccc412f9cbc81feedd" fullword wide
        $s13 = "gapi-node.io" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (1 of ($x*) and 2 of ($s*)) or 5 of ($s*) or 7 of them)
}

rule MALWARE_Win_XWorm {
    meta:
        author = "ditekSHen"
        description = "Detects XWorm"
        clamav_sig = "MALWARE.Win.XWorm"
    strings:
        $x1 = "XWorm " wide nocase
        $x2 = /XWorm\s(V|v)\d+\.\d+/ fullword wide
        $s1 = "RunBotKiller" fullword wide
        $s2 = "XKlog.txt" fullword wide
        $s3 = /(shell|reg)fuc/ fullword wide
        $s4 = "closeshell" fullword ascii
        $s5 = { 62 00 79 00 70 00 73 00 73 00 00 ?? 63 00 61 00 6c 00 6c 00 75 00 61 00 63 00 00 ?? 73 00 63 00 }
        $s6 = { 44 00 44 00 6f 00 73 00 54 00 00 ?? 43 00 69 00 6c 00 70 00 70 00 65 00 72 00 00 ?? 50 00 45 00 }
        $s7 = { 69 00 6e 00 6a 00 52 00 75 00 6e 00 00 ?? 73 00 74 00 61 00 72 00 74 00 75 00 73 00 62 }
        $s8 = { 48 6f 73 74 00 50 6f 72 74 00 75 70 6c 6f 61 64 65 72 00 6e 61 6d 65 65 65 00 4b 45 59 00 53 50 4c 00 4d 75 74 65 78 78 00 }
        $v2_1 = "PING!" fullword wide
        $v2_2 = "Urlhide" fullword wide
        $v2_3 = /PC(Restart|Shutdown)/ fullword wide
        $v2_4 = /(Start|Stop)(DDos|Report)/ fullword wide
        $v2_5 = /Offline(Get|Keylogger)/ wide
        $v2_6 = "injRun" fullword wide
        $v2_7 = "Xchat" fullword wide
        $v2_8 = "UACFunc" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v2*))) or 6 of them)
}

rule MALWARE_Win_ClipBanker03 {
    meta:
        author = "ditekSHen"
        description = "Detects ClipBanker"
    strings:
        $s1 = "UNIC_KEY" fullword wide
        $s2 = "[StartUp]" fullword wide
        $s3 = "[Kill]" fullword wide
        $s4 = "[antivm]" fullword wide
        $s5 = "AntiVM" fullword ascii
        $s6 = "AntiKill" fullword ascii
        $s7 = "hWndRemove" fullword ascii
        $s8 = "/Clip(watch|Chang|Mon)/" fullword ascii
        $w1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
        $w2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0" fullword wide
        $w3 = "/create /sc MINUTE /mo 1 /tn \"Windows Service\" /tr \"" fullword wide
        $w4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" fullword wide
        $w5 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
    condition:
        uint16(0) == 0x5a4d and (5 of ($s*) or all of ($w*) or 6 of them)
}

rule MALWARE_Win_dotRunpeX {
    meta:
        author = "ditekSHen"
        description = "Detects dotRunpeX injector"
    strings:
        $s1 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" fullword wide
        $s2 = "KoiVM" ascii
        $s3 = "RunpeX.Stub.Framework" wide
        $s4 = "ExceptionServices.ExceptionDispatchInfo" wide
        $s5 = "Kernel32.Dll" wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_CyberStealer {
    meta:
        author = "ditekSHen"
        description = "Detects CyberStealer infostealer"
    strings:
        $x1 = "\\Cyber Stealer\\" ascii
        $s1 = "[Virtualization]" fullword wide
        $s2 = "\"encryptedPassword\":\"([^\"]+)\"" fullword wide
        $s3 = "CreditCard" fullword ascii
        $s4 = "DecryptPassword" fullword ascii
        $s5 = "_modTime" fullword ascii
        $s6 = "_pathname" fullword ascii
        $s7 = "_pathnameInZip" fullword ascii
        $s8 = "GetBookmarksDBPath" fullword ascii
        $s9 = "GrabberImages" fullword ascii
        $r1 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide // Crypto Wallet Address
        $r2 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide // Crypto Wallet Address
        $r3 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
        $r4 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and (2 of ($s*) or 2 of ($r*))) or 7 of ($s*) or (5 of ($s*) and 2 of ($r*)) or (all of ($r*) and 4 of ($s*)))
}

rule MALWARE_Win_ArrowRAT {
    meta:
        author = "ditekSHen"
        description = "Detects ArrowRAT"
    strings:
        $s1 = "29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb" wide
        $s2 = "Software\\Classes\\ms-settings\\shell\\open\\command" wide
        $s3 = "DelegateExecute" fullword wide
        $s4 = "powershell" wide
        $s5 = "DESKTOP_HOOKCONTROL" fullword ascii
        $s6 = "PROCESS_INFORMATION" fullword ascii
        $s7 = "STARTUP_INFORMATION" fullword ascii
        $s8 = /(Venom|Pandora)\shVNC/ fullword wide
        $s9 = "cmd.exe /k START" fullword wide
        $s10 = "ExclusionWD" fullword ascii
        $s11 = "WinExec" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_DuckTail {
    meta:
        author = "ditekSHen"
        description = "Detects DuckTail"
    strings:
        $s1 = "&global_scope_id=" wide
        $s2 = "#ResolveMyIpAll" wide
        $s3 = "#ApproveInvitesHandler" wide
        $s4 = "#ProcessShareCok" wide
        $s5 = "#InviteEmpHandler" wide
        $s6 = "__activeScenarioIDs=%" wide
        $s7 = "&__a=1&fb_dtsg=" wide
        $s8 = "adAccountLimit\":(.*?)}" wide
        $s9 = "|PUSH|" fullword wide
        $s10 = "|SCREEN|" fullword wide
        $s11 = "|SCREEC|" fullword wide
        $s12 = "_ad_accounts>k__" ascii
        $s13 = "get_Pwds" fullword ascii
        $s14 = "Telegram.Bot" ascii
        $s15 = { 2f 00 7b 00 43 00 59 00 52 00 7d 00 2e 00 74 00
               78 00 74 00 00 15 2f 00 7b 00 4c 00 4f 00 47 00
               7d 00 2e 00 74 00 78 00 74 00 00 15 2f 00 7b 00
               43 00 46 00 47 00 7d 00 2e 00 74 00 78 00 74 00
               00 15 2f 00 7b 00 50 00 52 00 53 00 7d 00 2e 00
               74 00 78 00 74 00 00 15 2f 00 7b 00 53 00 43 00
               52 00 7d 00 2e 00 6a 00 70 00 67 }
    condition:
        uint16(0) == 0x5a4d and 13 of them
}

rule MALWARE_Win_Grum {
    meta:
      author = "ditekSHen"
      description = "Detect Grum spam bot"
    strings:
        $s1 = "loader_id" fullword ascii
        $s2 = "start_srv" fullword ascii
        $s3 = "lid_file_upd" fullword ascii
        $s4 = "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX" fullword ascii
        $s5 = "rcpt to:<%s>" fullword ascii
        $s6 = "ehlo %s" fullword ascii
        $s7 = "%OUTLOOK_BND_" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and 5 of them) or (all of them)
}

rule MALWARE_Win_DLInjector07 {
    meta:
        author = "ditekSHen"
        description = "Detects downloader injector"
    strings:
        $x1 = "23lenrek[||]lldtn[||]daerhTemuseR[||]txetnoCdaerhTteS46woW[||]txetnoCdaerhTteS[||]txetnoCdaerhTteG46woW[||]txetnoCdaerhTteG[||]xEcollAlautriV[||]yromeMssecorPetirW[||]yromeMssecorPdaeR[||]noitceSfOweiVpamnUwZ[||]AssecorPetaerC" wide
        $l1 = "[||]" wide
        $r1 = "yromeMssecorPetirW" wide
        $r2 = "xEcollAlautriV" wide
        $r3 = "daerhTemuseR" ascii wide
        $r4 = "noitceSfOweiVpamnUwZ" wide
        $s1 = "Debugger Detected" fullword wide
        $s2 = "payload" fullword ascii
        $s3 = "_ENABLE_PROFILING" fullword wide // Confuser Anti-Debug
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or (1 of ($l*) and 2 of ($r*)) or 6 of them)
}

rule MALWARE_Win_Stealerium {
    meta:
        author = "ditekSHen"
        description = "Detects Stealerium infostealer"
    strings:
        $x1 = "Stealerium" ascii wide
        $x2 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
        $x3 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
        $s1 = "Timeout /T 2 /Nobreak" fullword wide
        $s2 = "Directory not exists" wide
        $s3 = "### {0} ### ({1})" wide
        $s4 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
        $s5 = " *Keylogger " fullword wide
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (2 of ($x*) and all of ($s*)))
}

rule MALWARE_Linux_GobRAT {
    meta:
        author = "ditekSHen"
        description = "Detects GobRAT"
    strings:
        $x1 = "BotList" ascii
        $x2 = "BotCount" ascii
        $x3 = "/etc/services/zone/bot.log" ascii
        $x4 = "aaa.com/bbb/me" ascii
        $s1 = "encoding/gob." ascii
        $s2 = ".GetMacAddress" ascii
        $s3 = ".IpString2Uint32" ascii
        $s4 = ".RegisterLogFile" ascii
        $s5 = ".UniqueAppendString" ascii
        $s6 = ".NewDaemon" ascii
        $s7 = ".SimpleCommand" ascii
    condition:
        uint16(0) == 0x457f and (3 of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or all of ($s*))
}

rule MALWARE_Win_HakunaMatata {
    meta:
        author = "ditekSHen"
        description = "Detects HakunaMatata ransomware"
    strings:
        $s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $s2 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" wide
        $s3 = "<RSAKeyValue><Modulus>" wide
        $s4 = "HAKUNA MATATA" ascii wide
        $s5 = "EXCEPTIONAL_FILE" ascii
        $s6 = "TRIPLE_ENCRYPT" ascii
        $s7 = "FULL_ENCRYPT" ascii
        $s8 = "TARGETED_EXTENSIONS" ascii
        $s9 = "CHANGE_PROCESS_NAME" ascii
        $s10 = "KILL_APPS_ENCRYPT_AGAIN" ascii
        $s11 = "<ALL_DRIVES>b__" ascii
        $s12 = "dataToEncrypt" ascii
        $s13 = "<RECURSIVE_DIRECTORY_LOOK>" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_HakunaMatata_Builder {
    meta:
        author = "ditekSHen"
        description = "Detects HakunaMatata ransomware builder"
    strings:
        $s1 = "ENCRYPT FILES IN PROCESS" wide
        $s2 = "#TARGET_FILES" ascii wide
        $s3 = "HAKUNA MATATA" ascii wide nocase
        $s4 = "#PRIVATE_KEY" ascii wide
        $s5 = "/target:winexe /platform:anycpu /optimize+" wide
        $s6 = "/win32icon:" fullword wide
        $s7 = "SkippedFolders" ascii
        $s8 = "RECURSIVE_DIRECTORY_LOOK(" ascii
        $s9 = "DRAW_WALLPAPER(" ascii
        $s10 = "startupKey.SetValue(MESSAGE_FILE.Split('.')[0], executablePath);" ascii
        $s11 = /\\obj\\(Debug|Release)\\Hakuna\sMatata\.pdb/ ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_TWarBot {
    meta:
        author = "ditekSHen"
        description = "Detect TWarBot IRC Bot"
    strings:
        $x1 = "TWarBot" fullword ascii
        $s1 = "PRIVMSG #" ascii
        $s2 = "C:\\marijuana.txt" fullword ascii
        $s3 = "C:\\rar.bat" fullword ascii
        $s4 = "C:\\zip.bat" fullword ascii
        $s5 = "software\\microsoft\\windows\\currentversion\\app paths\\winzip32.exe" ascii
        $s6 = "software\\microsoft\\windows\\currentversion\\app paths\\WinRAR.exe" ascii
        $s7 = "a -idp -inul -c- -m5" ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
}

rule MALWARE_Win_G0Crypt {
    meta:
        author = "ditekSHen"
        description = "Detects G0Crypt / BRG0SNet / NovaGP ransomware"
    strings:
        $x1 = "G0Crypt/go/" ascii
        $x2 = "BRG0SNet" ascii
        $x3 = "/NovaGroup" ascii
        $x4 = "novagroup@onionmail.org" ascii nocase
        $x5 = "# Nova Group" ascii
        $f1 = "main.HaveRun" ascii
        $f2 = "main.FindFile" ascii
        $f3 = "main.deriveKey" ascii
        $f4 = "main.Pwd" fullword ascii
        $f5 = "/ClearBashFile" ascii
        $f6 = "/ClearUserTempFiles" ascii
        $f7 = "/KillProccess" ascii
        $f8 = "/Encryptor" ascii
        $f9 = "/NoDirEncrypt" ascii
        $f10 = "/RunCmdEexecutable" ascii
        $f11 = "/StopImportantServices" ascii
        $f12 = "/GetPwd" ascii
        $s1 = "\\$Recycle.Bin"
        $s2 = ".README.txt"
        $s3 = "\\BRSPATH.exe"
        $s4 = "taskkill /F /IM sql*"
        $s5 = "C:\\inetpub\\logs\\"
        $s6 = "shutdown /r"
        $s7 = ":\\Program Files\\VMware\\"
        $s8 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Message /t REG_SZ /d"
        $s9 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v DelLogSoft /t REG_SZ /d"
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or 7 of ($f*) or (1 of ($x*) and (5 of ($f*) or 5 of ($s*))) or (6 of ($f*) and 4 of ($s*)) or 12 of them)
}

rule MALWARE_Win_SNAKE {
    meta:
        author = "ditekSHen"
        description = "Detects Snake implant"
    strings:
        $c1 = { 25 73 23 31 }
        $c2 = { 25 73 23 32 }
        $c3 = { 25 73 23 33 }
        $c4 = { 25 73 23 34 }
        $c5 = { 2e 74 6d 70 }
        $c6 = { 2e 73 61 76 }
        $c7 = { 2e 75 70 64 }
        $s1 = "tapisetschema.dll" fullword wide
        $s2 = "\\\\.\\%s\\\\" fullword ascii wide
        $s3 = "\\BaseNamedObjects\\%S" fullword wide
        $s4 = "{CACE3174-CF88-4906-921A-A16A7DC8CF4B}.{B6066E99-37D7-4668-9B06-301CE2C1D367}.crmlog" ascii
        $s5 = "-crash-" fullword ascii
        $s6 = "rcv_buf=%d%c" fullword ascii
        $s7 = "write_peer_nfo=%s:%d%cfrag_no_scrambling=Y%c" fullword ascii
    condition:
        (uint16(0) == 0x5a4d and (all of ($s*) or (all of ($c*) and 1 of ($s*)))) or (all of ($c*) and 1 of ($s*))
}

rule MALWARE_Win_ModiLoader {
    meta:
        author = "ditekSHen"
        description = "Detects ModiLoader"
    strings:
        $x1 = "*()%@5YT!@#G__T@#$%^&*()__#@$#57$#!@" fullword wide
        $x2 = "dntdll" fullword wide
        $x3 = "USERPROFILE" fullword wide
        $s1 = "%s, ProgID: \"%s\"" ascii
        $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
        $s3 = "responsetext" ascii
        $s4 = "C:\\Users\\Public\\" ascii
        $s5 = "[InternetShortcut]" fullword ascii
        $c1 = "start /min powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command \"Add-MpPreference -ExclusionPath 'C:\\Users'\" & exit" ascii  nocase
        $c2 = "mkdir \"\\\\?\\C:\\Windows \"" ascii nocase
        $c3 = "mkdir \"\\\\?\\C:\\Windows \\System32\"" ascii nocase
        $c4 = "ECHO F|xcopy \"" ascii nocase
        $c5 = "\"C:\\Windows \\System32\" /K /D /H /Y" ascii nocase
        $c6 = "ping 127.0.0.1 -n 6 > nul" ascii nocase
        $c7 = "del /q \"C:\\Windows \\System32\\*\"" ascii nocase
        $c8 = "rmdir \"C:\\Windows \\System32\"" ascii nocase
        $c9 = "rmdir \"C:\\Windows \"" ascii nocase
        $g1 = "powershell" ascii nocase
        $g2 = "mkdir \"\\\\?\\C:\\" ascii nocase
        $g3 = "\" /K /D /H /Y" ascii nocase
        $g4 = "ping 127.0.0.1 -n" ascii nocase
        $g5 = "del /q \"" ascii nocase
        $g6 = "rmdir \"" ascii nocase
    condition:
        uint16(0) == 0x5a4d and
        (
            (2 of ($x*) and (all of ($g*) or (2 of ($s*) and 2 of ($c*)))) or
            (all of ($s*) and (2 of ($c*) or all of ($g*))) or
            (4 of ($c*) and (1 of ($x*) or 2 of ($s*))) or
            (all of ($g*) and 4 of ($c*)) or
            13 of them
        )         
}

rule MALWARE_Win_Akira {
    meta:
        author = "ditekSHen"
        description = "Detects Akira Ransomware Windows"
    strings:
        $x1 = "https://akira" ascii
        $x2 = ":\\akira\\" ascii
        $x3 = ".akira" ascii
        $x4= "akira_readme.txt" ascii
        $x5 = "\\akira\\asio\\include\\asio\\impl\\co_spawn.hpp" ascii
        $s1 = "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" ascii
        $s2 = "Win32_ProcessStartup" fullword wide
        $s3 = /Failed\sto\smake\s(part|full|spot)\sencrypt/ ascii wide
        $s4 = "--encryption_" ascii
        $s5 = "--share_file" ascii
        $s6 = { 24 00 52 00 45 00 43 00 59 00 43 00 4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 6? 6? 6? 00 (24|57) 00 (52|69) 00 }
        $s7 = " PUBLIC KEY-----" ascii
        $s8 = ".onion" ascii
        $s9 = "/Esxi_Build_Esxi6/./" ascii nocase
        $s10 = "No path to encrypt" ascii
        $s11 = "-fork" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
}

rule MALWARE_Linux_Akira {
    meta:
        author = "ditekSHen"
        description = "Detects Akira Ransomware Linux"
    strings:
        $x1 = "https://akira" ascii
        $x2 = ":\\akira\\" ascii
        $x3 = ".akira" ascii
        $x4= "akira_readme.txt" ascii
        $s1 = "--encryption_" ascii
        $s2 = "--share_file" ascii
        $s3 = { 00 24 52 65 63 79 63 6c 65 2e 42 69 6e 00 24 52 45 43 59 43 4c 45 2e 42 49 4e 00 }
        $s4 = " PUBLIC KEY-----" ascii
        $s5 = ".onion" ascii
        $s6 = "/Esxi_Build_Esxi6/./" ascii nocase
        $s7 = "No path to encrypt" ascii
        $s8 = "-fork" fullword ascii
    condition:
        uint16(0) == 0x457f and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
}

rule MALWARE_Win_Underground {
    meta:
        author = "ditekSHen"
        description = "Detects Underground ransomware"
    strings:
        $x1 = "Underground team" ascii
        $ip1 = "172.16.10." ascii
        $ip2 = "10.10.10." ascii
        $s1 = "temp.cmd" ascii wide
        $s2 = "%s\\!!readme!!!.txt" wide
        $s3 = "VIPinfo.txt" wide
        $s4 = "File opening error is:%d" wide
        $s5 = "\\\\?\\%s" fullword wide
        $s6 = "http://undgr" ascii
        $s7 = "password:" ascii
        $s8 = "login:" ascii
        $s9 = ".onion" ascii
        $b1 = "\\microsoft\\" fullword wide
        $b2 = "\\google\\chrome" fullword wide
        $b3 = "\\mozilla\\firefox" fullword wide
        $b4 = "\\opera\\" fullword wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and ((all of ($ip*) and 2 of ($s*)) or 4 of ($s*) or (2 of ($b*) and 2 of ($s*)))) or 7 of ($s*) or (3 of ($b*) and 4 of ($s*)) or (1 of ($ip*) and 2 of ($b*) and 2 of ($s*)))
}

rule MALWARE_Win_RomCom_Loader {
    meta:
        author = "ditekShen"
        description = "Hunt for RomCom loader"
    //strings:
        //$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes" wide nocase
        //$s2 = "\\REGISTRY\\USER" wide nocase
        //$s3 = "CreateToolhelp32Snapshot" fullword ascii
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and (
            pe.exports("DllCanUnloadNow") and pe.exports("DllGetClassObject")
            and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer")
            and pe.exports("GetProxyDllInfo")
        ) and for any fn in pe.export_details: (
            fn.forward_name contains "Dll"
        )
}

rule MALWARE_Win_RomCom_Worker {
    meta:
        author = "ditekShen"
        description = "Hunt for RomCom worker"
    strings:
        $s1 = "UpdateProcThreadAttribute" fullword ascii
        $s2 = "WriteFile" fullword ascii
        $s3 = "GetAdaptersAddresses" fullword ascii nocase
        $s4 = /inflate\s\d+\.\d+\.\d+\sCopyright/ ascii
        $s5 = "SetHandleInformation" fullword ascii
        $s6 = "PeekNamedPipe" fullword ascii
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and pe.number_of_exports == 1 and pe.exports("Main") and all of them
}

rule MALWARE_Win_RomCom_Dropper {
    meta:
        author = "ditekShen"
        description = "Hunt for RomCom worker"
    strings:
        $s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes" wide nocase
        $s2 = "\\REGISTRY\\USER" wide nocase
        $s3 = "BINARY" fullword wide
        $s4 = "POST" fullword wide
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and pe.number_of_exports == 1 and pe.exports("Main") and 3 of them
}

rule MALWARE_Win_STEALDEAL {
    meta:
        author = "ditekShen"
        description = "Hunt for STEALDEAL stealer"
    strings:
        $x1 = "stealDll.dll" fullword ascii
        $s1 = "SqlExec" fullword ascii
        $s2 = "etilqs_" fullword ascii
        $s3 = "SUBQUERY %u" fullword ascii
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and pe.exports("stub") and (1 of ($x*) or all of ($s*))
}

rule MALWARE_Win_DarkCloud {
    meta:
        author = "ditekSHen"
        description = "Detects DarkCloud infostealer"
    strings:
        $x1 = "=DARKCLOUD=" wide
        $x2 = "#DARKCLOUD#" wide
        $x3 = "DARKCLOUD" wide
        $s1 = "DC-Creds" fullword wide
        $s2 = "shell.application" fullword wide
        $s3 = "VBSQLite3.dll" ascii wide nocase
        $s4 = "getbinaryvalue" fullword wide
        $s5 = "sqlite_exec" fullword ascii
        $i1 = "RegWrite" fullword wide
        $i2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $i3 = "\\Templates\\Stub\\Project" wide
        $i4 = "\\Credentials" wide
        $i5 = "SELECT " wide
        $i6 = "\\163MailContacts.txt" fullword wide
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($i*))) or (all of ($s*) and 1 of ($i*)) or (4 of ($s*) and 4 of ($i*)))
}

rule MALWARE_Win_ARCrypt {
    meta:
        author = "ditekSHen"
        description = "Detects ARCrypt / ChileLocker ransomware"
    strings:
        $c1 = "readme_for_unlock.txt" wide
        $c2 = "vssadmin.exe delete shadows /all /quiet" wide
        $c3 = "START /b \"\" cmd /c wmic /node:" wide
        $c4 = "START /b \"\" cmd /c DEL \"" wide
        $c5 = "process call create cmd /c START" wide
        $c6 = "net config server /autodisconnect:" wide
        $c7 = "/NOBREAK>NUL) ELSE (START /b \"\" cmd /c DEL \"%~f" ascii
        $c8 = ":\\_ARC\\_WorkSolution\\cryptopp" ascii // or just \\cryptopp
        $e1 = /\.crYpt([A-F]{0,1}(\d+)?)?/ fullword wide
        $e2 = ".dnt___.crYpt" wide nocase
        $s1 = "create_directory" fullword ascii
        $s2 = "create_directories" fullword ascii
        $s3 = "NoClose" fullword ascii
        $s4 = "StartMenuLogOff" fullword ascii
        $s5 = "NoLogOff" fullword ascii
        $s6 = "DisableTaskMgr" fullword ascii
        $s7 = "DisableChangePassword" fullword ascii
        $s8 = "HideFastUserSwitching" fullword ascii
        $s9 = "RemotePath" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (5 of ($c*) or 7 of ($s*) or (3 of ($c*) and 4 of ($s*)) or (1 of ($e*) and (1 of ($c*) and 1 of ($s*))) or (all of ($e*) and (1 of ($c*) or 1 of ($s*))))
}

rule MALWARE_Win_RootTeamStealer {
    meta:
        author = "ditekSHen"
        description = "Detects RootTeam infostealer"
    strings:
        $x1 = "RootTeamStl" ascii
        $x2 = "Bot: https://t.me/rootteam_bot" ascii
        $x3 = "rootteam_bot" ascii
        $x4 = "Root Team" ascii
        $s1 = "-ldflags=\"-s -w -H windowsgui -X" ascii
        $s2 = "'RootTeamStl/vars." ascii
        $s3 = "{ Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
        $s4 = "\\Program Files (x86)\\Steam\\config\\loginusers.vdf" ascii
        $s5 = /RootTeamStl\/managers\/(browser|coldwallets|discord|filegrabber|steam|userinformation)?/ ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($s*) or 5 of them)
}

rule MALWARE_Win_StrelaStealer {
    meta:
      author = "ditekSHen"
      description = "Detects StrelaStealer"
      clamav_sig = "MALWARE.Win.StrelaStealer"
    strings:
        $x1 = "strela" fullword ascii
        $s1 = "/server.php" fullword ascii
        $s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" ascii
        $s3 = "SOFTWARE\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" ascii
        $s4 = "%s%s\\logins.json" fullword ascii
        $s5 = "%s%s\\key4.db" fullword ascii
        $s6 = /IMAP\s(Server|User|Password)/ fullword ascii
        $s7 = "\\Thunderbird\\Profiles\\" fullword ascii
        $s8 = "%s,%s,%s" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 1 of ($s*)) or (7 of ($s*)))
}

rule MALWARE_Win_EspioLoader {
    meta:
        author = "ditekSHen"
        description = "Detects Espio loader and obfuscator"
        clamav_sig = "MALWARE.Win.EspioLoader"
    strings:
        $pdb = /\\loader\\x64\\(Release|Debug)\\Espio\.pdb/ ascii
        $s1 = "obfuscatedPayload" fullword wide
        $s2 = "OBFUSCATEDPAYLOAD" fullword wide
        $s3 = "\\??\\C:\\Windows\\System32\\werfault.exe" fullword wide
        $s4 = "C:\\windows\\system32\\ntdll.dll" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ($pdb or 3 of ($s*))
}

rule MALWARE_Win_CelestyBinderLoader {
    meta:
        author = "ditekSHen"
        description = "Detects Celesty Binder loader"
    strings:
        $s1 = "\\DarkCoderSc\\Desktop\\Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
        $s2 = "DROPIN" fullword ascii wide
        $s3 = "EXEC" fullword ascii wide
        $s4 = "RBIND" fullword ascii wide
        $s5 = "%LAPPDATA%" fullword ascii wide
        $s6 = "%USERDIR%" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_BlitzGrabber {
    meta:
        author = "ditekSHen"
        description = "Detects BlitzGrabber infostealer"
    strings:
       $x1 = "**BLITZED GRABBER V" wide
       $x2 = "\\BlitzedGrabberV" ascii
       $x3 = "Kyanite" ascii wide nocase
       $s1 = /;\/\/(SCREENSHOT|PASSWORDS|FORKBOMB|MELTSTUB)\/\// ascii wide
       $s2 = "KryptedWare" wide
       $s3 = "chckcopyTemp" wide
       $s4 = "chckscreenShot" wide
       $s5 = "Plugin.Banking." ascii
       $s6 = "sChromiumPswPaths" ascii
       $s7 = ".CreateDownloadLink(" ascii
       $s8 = "CaptureScreen()" ascii
       $s9 = ".UploadFile(\"https://api.anonfiles.com/upload\"" ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) and 3 of ($s*)) or (7 of ($s*))
}

rule MALWARE_Win_Bagle {
    meta:
        author = "ditekSHen"
        description = "Detect Bagle / Beagle email worm"
    strings:
        $s1 = "SOFTWARE\\DateTime" fullword ascii
        $s2 = "%s?p=%lu" fullword ascii
        $s3 = "-upd" ascii
        $s4 = "[%RAND%]" fullword ascii
        $s5 = "MAIL FROM:<%s>" fullword ascii
        $s6 = "RCPT TO:<%s>" fullword ascii
        $s7 = "Message-ID: <%s%s>" fullword ascii
        $s8 = "Content-Disposition: attachment; filename=\"%s%s\"" fullword ascii
        $s9 = "http://www.%s" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_RageStealer {
    meta:
        author = "ditekShen"
        description = "Detect Rage / Priv8 infostealer"
    strings:
        $x1 = "\\RageStealer\\obj\\" ascii
        $x2 = "Priv8 Stealer" wide
        $s1 = "\\Screen.png" wide
        $s2 = "Content-Disposition: form-data; name=\"document\"; filename=\"{1}\"" wide
        $s3 = "NEW LOG FROM" wide
        $s4 = "GRABBED SOFTWARE" wide
        $s5 = "DOMAINS DETECTED" wide
        $s6 = "snder" ascii
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) and 4 of ($s*))
}

rule MALWARE_Win_AbubasbanditBot {
    meta:
        author = "ditekSHen"
        description = "Detects Abubasbandit Bot. Observed to drop cryptocurrency miner detected by MALWARE_Win_CoinMiner02"
    strings:
        $x1 = "magickeycmd" ascii
        $x2 = "chat_id" ascii
        $x3 = "GetTempPathW" ascii
        $x4 = "Add-MpPreference" ascii
        $x5 = "-Command" ascii
        $s1 = "application/x-www-form-urlencoded" ascii
        $s2 = "gzip, deflate/index.html" ascii
        $s3 = "powershellAdd-MpPreference -ExclusionPath" ascii
        $s4 = "tar-xf-C" ascii
        $s5 = "temp_file.bin" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (4 of ($x*) and 2 of ($s*)) or ((all of ($s*) and 3 of ($x*))) or (8 of them))
}

rule MALWARE_Win_OracRAT {
    meta:
        author = "ditekSHen"
        description = "Detects OracRAT / Comfoo / Babar"
    strings:
        $s1 = "\\\\.\\DevCtrlKrnl" fullword ascii
        $s2 = "SOFTWARE\\Microsoft\\IE4\\Setup" fullword ascii
        $s3 = "\\PLUGINS" fullword ascii
        $s4 = "\\config\\sam" fullword ascii
        $s5 = "\\iexplore.exe\" about:blank" fullword ascii
        $s6 = "usbak.sys" fullword ascii
        $s7 = "userctfm" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_PhemedroneStealer {
    meta:
        author = "ditekSHen"
        description = "Detects Phemedrone Stealer infostealer"
    strings:
        $p1 = /\{ file = \{(0|file)\}, data = \{(1|data)\} \}/ ascii wide
        $p2 = "{ <>h__TransparentIdentifier0 = {0}, match = {1} }" wide
        $p3 = "{ <>h__TransparentIdentifier1 = {0}, encrypted = {1} }" wide
        $p4 = "{<>h__TransparentIdentifier0}, match = {match} }" ascii
        $p5 = "{<>h__TransparentIdentifier1}, encrypted = {encrypted} }" ascii
        $s1 = "<KillDebuggers>b__" ascii
        $s2 = "<ParseExtensions>b__" ascii
        $s3 = "<ParseDiscordTokens>b__" ascii
        $s4 = "<IsVM>b__" ascii
        $s5 = "<Key3Database>b__" ascii
        $s6 = "masterPass" ascii
        $s7 = "rootLocation" ascii
        $s8 = "rgsServiceNames" ascii
        $s9 = "rgsFilenames" ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($p*) and 3 of ($s*)) or (3 of ($p*) and 4 of ($s*)) or (7 of ($s*)))
}

rule MALWARE_Win_WSHRAT {
    meta:
        author = "ditekSHen"
        description = "Detects WASHRAT"
    strings:
        $x1 = "WSH Rat v" wide
        $x2 = "SOFTWARE\\WSHRat" wide
        $x3 = "WSH Remote" wide nocase
        $x4 = "WSHRAT" wide nocase
        $s1 = "shellobj.regwrite \"HKEY_" ascii nocase
        $s2 = "shellobj.run(\"%comspec% /c" ascii nocase
        $s3 = "objhttpdownload.setrequestheader \"user-agent:\"," ascii nocase
        $s4 = "WScript.CreateObject(\"Shell.Application\").ShellExecute" ascii nocase
        $s5 = "objwmiservice.ExecQuery(\"select" ascii nocase
        $s6 = "httpobj.open(\"post\",\"http" ascii nocase
        $s7 = /(rdp|keylogger|get-pass|uvnc)\|http/ wide
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)) or (6 of ($s*)))
}

rule MALWARE_Win_RustyStealer {
    meta:
        author = "ditekSHen"
        description = "Detect Rusty / Luca stealer"
    strings:
        $s1 = "EdgeMicrosoftedgechromiumChromium7star7StaramigoAmigobraveBrave" ascii
        $s2 = "BrowserchromeChromekometaKometaorbitumOrbitumsputnikSputniktorchTorchucozmediaUranuCozMediavivaldiVivaldiatom" ascii
        $s3 = ".kdbx.pdf.doc.docx.xls.xlsx.ppt.pptx.odt.odp\\logscx\\sensfiles.zip" ascii
        $s4 = "dumper.rs" ascii
        $s5 = "decryption_core.rs" ascii
        $s6 = "anti_emulation.rs" ascii
        $s7 = "discord.rs" ascii
        $s8 = /\\logscx\\(passwords_|cookies_|creditcards_)/ ascii
        $s9 = "VirtualBoxVBoxVMWareVMCountry" ascii
        $s10 = "New Log From ( /  )" ascii
        $s11 = "BrowserChromeKometaOrbitumSputnikTorchUranuCozMediaVivaldiAtomMail" ascii
        $s12 = "BrowserBraveSoftwareCentBrowserChedotChrome" ascii
        $s13 = "ChromeKometaOrbitumSputnikTorchUranuCozMediaVivaldi" ascii
        $s14 = "hostnameencryptedUsernameencryptedPasswordstruct" ascii
        $s15 = "encryptedPassword" fullword ascii
        $s16 = "AutoFill@~" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_SimplePacker {
    meta:
        author = "ditekSHen"
        description = "Detects Hydrochasma packer / dropper"
    strings:
        $p1 = "\\cloud-compiler-" ascii
        $p2 = "\\deps\\simplepacker.pdb" ascii
        $s1 = "uespemosarenegylmodnarodsetybdetqueue" ascii
        $s2 = "None{\"" ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($p*) or (1 of ($p*) and all of ($s*)))
}

/*
rule MALWARE_Win_Fabookie_01 {
    meta:
        author = "ditekSHen"
        description = "Detects Fabookie. Camouflages as Windows native 'cttune.exe'"
    strings:
        $s1 = "SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services" fullword ascii wide
        $s2 = "Elevation:Administrator!new:%s" fullword ascii wide
        $s3 = "Software\\Microsoft\\Avalon.Graphics" fullword ascii wide
        $s4 = "SELECT * FROM" fullword ascii wide
        $s5 = /win:(Start|Stop|Informational)/ fullword wide
        $s6 = "CTWIZWINCLASS" wide
    condition:
        uint16(0) == 0x5a4d and 5 of them
}
*/

rule MALWARE_Win_Fabookie_02 {
    meta:
        author = "ditekSHen"
        description = "Detects Fabookie / NAPAgent"
    strings:
        $s1 = "\"%1\\control.exe\" ncpa.cpl%2" wide
        $s2 = "Elevation:Administrator!new:%s" wide
        $s3 = "quar_qclintfy_mtx" wide
        $s4 = "Software\\Microsoft\\NetworkAccessProtection\\UI\\Branding\\%" wide
        $s5 = "napagent" fullword wide
        $s6 = "napstat.pdb" fullword ascii
        /*
        $fk1 = "GetKeyState" fullword ascii // keystrokes capture
        $fs1 = "CreateCompatibleDC" // screen capture
        $fs2 = "CreateCompatibleBitmap"  // screen capture
        $fs3 = "GetSystemMetrics" // screen capture
        */
    condition:
        uint16(0) == 0x5a4d and 4 of ($s*)
        //uint16(0) == 0x5a4d and 4 of ($s*) or (2 of ($s*) and 1 of ($fk1) and 2 of ($fs2))
}

rule MALWARE_Multi_GolangBypassAV {
    meta:
        author = "ditekSHen"
        description = "Detect Go executables using GolangBypassAV"
        clamav1 = "MALWARE.Win.Trojan.GolangBypassAV"
        clamav2 = "MALWARE.Linux.Trojan.GolangBypassAV"
    strings:
        $s1 = "/GolangBypassAV/gen/" ascii
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x457f) and 1 of them
}

rule MALWARE_Win_BlankStealer {
    meta:
        author = "ditekSHen"
        description = "Detects BlankStealer / BlankGrabber / Blank-c Stealer"
        snort = "923829001"
    strings:
        $s1 = "Blank-c" ascii
        $s2 = "Stealer License" ascii
        $s3 = "UID=" ascii
        $h1 = { 42 6c 61 6e 6b 2d 63 0a 53 74 65 61 6c 65 72 20 4c 69 63 65 6e 73 65 0a 55 49 44 3d }
    condition:
        (uint16(0) == 0x4152 and 2 of them) or (all of ($s*) or 1 of ($h*))
}

rule MALWARE_Linux_GetShell {
    meta:
        author = "ditekSHen"
        description = "Detect GetShell Linux backdoor"
        clamav1 = "MALWARE.Linux.Trojan.GetShell"
    strings:
        $x1 = "cat <(echo '@reboot echo socks5_backconnect" ascii
        $x2 = "(cd  && )') <(sed '/socks5_backconnect" ascii
        $s1 = "cat <(echo '@" ascii
        $s2 = "(cd  && )') <(sed '" ascii
        $s3 = "PORT1:" ascii
        $s4 = "HOST1:" ascii
        $s5 = "queryheader" ascii
        $s6 = "qsectionpost" ascii
        $s7 = "packedip" ascii
        $s8 = "copydata" ascii
        $s9 = "synsend" ascii
        $s10 = "bc_connect" ascii
    condition:
        uint16(0) == 0x457f and ((all of ($x*) and 1 of ($s*)) or 5 of ($s*))
}

rule MALWARE_Win_SolarMarker {
    meta:
        author = "ditekSHen"
        description = "Detects SolarMarker"
    strings:
        $x1 = "token_type" fullword ascii
        $x2 = "request_data" fullword ascii
        $x3 = "request_timeout" fullword ascii
        $x4 = { 74 6f 6b 65 6e 73 00 66 72 6f 6d 00 74 6f 00 73 5f (66|72) }
        $s1 = "set_UseShellExecute" fullword ascii
        $s2 = "<Select>b__0" fullword ascii
        $s3 = "<get>b__e" fullword ascii
        $s4 = "<get>b__10" fullword ascii
        $s5 = "<get>b__f" fullword ascii
        $s6 = "<set>b__0" fullword ascii
        $s7 = "<set>b__1" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) and 4 of ($s*))
}

rule MALWRE_Win_DarkGate {
    meta:
        author = "ditekSHen"
        description = "Detects DarkGate infostealer and coinminer"
    strings:
        $x1 = "SYSTEM Elevation: Completed, new DarkGate connection with SYSTEM privileges" ascii
        $x2 = "-u 0xDark" ascii
        $x3 = "DarkGate" ascii
        $x4 = "/c cmdkey /generic:\"127.0.0.2\" /user:\"SafeMode\" /pass:\"darkgatepassword0\"" ascii
        $s1 = "c:\\temp\\crash.txt" ascii
        $s2 = "/cookiesfile \"" ascii
        $s3 = "/c rmdir /s /q \"" ascii
        $s4 = "/c xcopy /E /I /Y \"%s\" \"%s\" && exit" ascii
        $s5 = "U_MemScan" ascii
        $s6 = "U_Google_AD" ascii
        $s7 = "untBotUtils" ascii
        $s8 = "____padoru____" ascii
        $s9 = "u_SysHook" ascii
        $s10 = "zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+=" ascii
        $s11 = "C:\\Windows\\System32\\ntdll.dll" fullword ascii
        $s12 = /(SYSTEM )?Elevation: (Cannot|I already|AT RAW|FAILURE)/ ascii
        $s13 = /Stub: (WARNING:|Configuration updated:|Global Ping Invoked)/ ascii
    condition:
        (uint16(0) == 0x5a4d and ((3 of ($x*)) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))) or (10 of them)
}

rule MALWARE_Win_RookIE_Downloader {
    meta:
        author = "ditekSHen"
        description = "Detect malware downlaoder, variant of ZombieBoy downloader"
        clamav1 = "MALWARE.Win.Trojan.RookIE-Downloader"
    strings:
        $s1 = "shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" fullword ascii
        $s2 = "taskkill /f /im hh.exe" fullword ascii
        $s3 = "RookIE/1.0" fullword ascii
        $s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0" fullword ascii
        $s5 = "#32770" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_Fiber {
    meta:
        author = "ditekSHen"
        description = "Detects Fiber .NET injector"
    strings:
        $x1 = "Fiber.dll" fullword ascii
        $s1 = "-WindowStyle Hidden Copy-Item -Path *.vbs -Destination" wide
        $s2 = "-WindowStyle Hidden {0} -WindowStyle Hidden Start-Sleep 5; Start-Process {1}" wide
        $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $s4 = "WScript.Shell" fullword wide
        $s5 = "{0}_{1:N}.lnk" fullword wide
        $s6 = "notepad.exe,0" fullword wide
        $i1 = "AppLaunch.exe" fullword wide
        $i2 = "aspnet_regbrowsers.exe" fullword wide
        $i3 = "cvtres.exe" fullword wide
        $i4 = "ilasm.exe" fullword wide
        $i5 = "jsc.exe" fullword wide
        $i6 = "MSBuild.exe" fullword wide
        $i7 = "RegAsm.exe" fullword wide
        $i8 = "RegSvcs.exe" fullword wide
        $v1 = "is tampered" wide
        $v2 = "Debugger Detected" wide
        $v3 = "RepositoryUrl" ascii
        $v4 = { 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00
                74 00 75 00 61 00 6c 00 20 00 00 0b 41 00 6c 00
                6c 00 6f 00 63 00 00 0d 57 00 72 00 69 00 74 00
                65 00 20 00 00 11 50 00 72 00 6f 00 63 00 65 00
                73 00 73 00 20 00 00 0d 4d 00 65 00 6d 00 6f 00
                72 00 79 00 00 0f 50 00 72 00 6f 00 74 00 65 00
                63 00 74 00 00 0b 4f 00 70 00 65 00 6e 00 20 00
                00 0f 50 00 72 00 6f 00 63 00 65 00 73 00 73 00
                00 0d 43 00 6c 00 6f 00 73 00 65 00 20 00 00 0d
                48 00 61 00 6e 00 64 00 6c 00 65 00 00 0f 6b 00
                65 00 72 00 6e 00 65 00 6c }
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*) and 2 of ($i*)) or (4 of ($s*) and 4 of ($i*)) or (2 of ($s*) and 6 of ($i*)) or (1 of ($x*) and 3 of ($v*)) or (all of ($v*)))
}

rule MALWARE_Win_Unknown_PackedLoader_01 {
    meta:
        author = "ditekShen"
        description = "Detects unknown loader / packer. Observed running LummaStealer"
    strings:
        $s1 = "Error at hooking API \"%S\"" wide
        $s2 = "Dumping first %d bytes:" wide
        $s3 = "Error at initialization of bundled DLL: %s" wide
        $s4 = "GetMemoryForDLL()" ascii
        $s5 = "type=activation&code=" ascii
        $s6 = "activation.php?code=" ascii
        $s7 = "&hwid=" ascii
        $s8 = "&hash=" ascii
        $s9 = "type=deactivation&hash=" ascii
        $s10 = "deactivation.php?hash=" ascii
        $s11 = "BANNED" fullword ascii
        $s12 = "GetAdaptersInfo" ascii
    condition:
        uint16(0) == 0x5a4d and 11 of them
}

rule MALWARE_Win_LOLKEK {
    meta:
        author = "ditekShen"
        description = "Detects LOLKEK / GlobeImposter ransowmare"
    strings:
        $s1 = "$Recycle.bin" fullword wide
        $s2 = "\\\\?\\%c:" fullword wide
        $s3 = ".MMM" fullword wide
        $s4 = "ReadMe.txt" fullword wide
        $s5 = "select * from Win32_ShadowCopy" fullword wide
        $s6 = "Win32_ShadowCopy.ID='%s'" fullword wide
        $s7 = "W3CRYPTO LOCKER" ascii
        $s8 = "http://mmcb" ascii
        $s9 = "yip.su/2QstD5" ascii
        $s10 = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" ascii
    condition:
        uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_Win_Spacecolon {
    meta:
        author = "ditekSHen"
        description = "Detects Spacecolon ransomware"
    strings:
        $s1 = "eraseext" fullword ascii
        $s2 = "*.encrypted" fullword ascii
        $s3 = "TIMATOMA#" fullword wide
        $s4 = ".Encrypted" fullword wide
        $s5 = "Already Encrypted" wide
        $s6 = "note.txt" fullword wide
        $s7 = "HOW TO RECOVERY FILES.TXT" fullword wide
        $s8 = "taskkill /f /im \"" wide nocase
        $s9 = "\\kill.bat" wide
        $s10 = "Search cancelled -" fullword wide
        $s11 = "%d folder(s) searched and %d file(s) found - %.3f second(s)" fullword wide
        $s12 = "Our TOX ID :" ascii
        $s13 = "tufhackteam@gmail.com" ascii
    condition:
        uint16(0) == 0x5a4d and 8 of them
}

rule MALWARE_Win_Rhysida {
    meta:
        author = "ditekSHen"
        description = "Detects Rhysida ransomware" 
    strings:
        $s1 = "cmd.exe /c reg add \"HK" ascii
        $s2 = "rundll32.exe user32.dll,UpdatePerUserSystemParameters" fullword ascii
        $s3 = "C:/Users/Public/bg.jpg" fullword ascii
        $s4 = "CriticalBreachDetected.pdf" fullword ascii
        $s5 = "rhysida" ascii
        $s6 = "cmd.exe /c reg delete \"HKCU\\Cont" ascii
        $s7 = "Rhysida-" ascii
    condition:
        uint16(0) == 0x5a4d and 5 of ($s*) or (3 of ($s*) and #s1 > 5)
}

rule MALWARE_Win_PovertyStealer {
    meta:
        author = "ditekSHen"
        description = "Detects PovertyStealer"
        clamav1 = "MALWARE.Win.Trojan.PovertyStealer"
    strings:
        $x1 = "Poverty is the parent of crime." ascii
        $s2 = "OperationSystem: %d:%d:%d" ascii
        $s3 = "ScreenSize: {lWidth=%d, lHeight=%d}" ascii
        $s4 = "VideoAdapter #%d: %s" ascii
        $s5 = "$d.log" fullword wide
    condition:
        ((uint16(0) == 0x5a4d and (1 of ($x*) or all of ($s*))) or all of them)
}

rule MALWARE_Win_JanelaRAT {
    meta:
        author = "ditekSHen"
        description = "Detects JanelaRAT"
    strings:
        $x1 = "<Janela>k__" ascii
        $x2 = "janela" fullword ascii
        $x3 = "\\CSHARP\\RAT\\" ascii
        $s1 = "<SystemInfos>k__" ascii
        $s2 = "<SendKeepAlives>b__" ascii
        $s3 = "hookStruct" fullword ascii
        $s4 = "[^a-zA-Z]" fullword wide
        $s5 = "GetRecycled" fullword ascii
        $s6 = "import \"bcl.proto\";" wide
        $s7 = "\\KL_FINAL\\" ascii
        $s8 = "\\KL_FASEAVAST" ascii
        $s9 = "\\kl c++" ascii
        $s10 = "VisaoAPP" ascii wide
    condition:
        uint16(0) == 0x5a4d and (all of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))
}

rule MALWARE_Win_QwixxRAT {
    meta:
        author = "ditekSHen"
        description = "Detects QwixxRAT. Uses ToxicEye / TelegramRAT as base (MALWARE_Win_TelegramRAT)"
    strings:
        $s1 = /Qwixx(\s)?Stealer/ ascii wide
        $s2 = "discord.gg/UXVFHzTjYe" wide
        $s3 = "t.me/QwixxTwixx" wide
        $s4 = "Secret Qwixx" wide
        $s5 = "\\Qwixx Rat\\" ascii
    condition:
        uint16(0) == 0x5a4d and 2 of them
}

rule MALWARE_Win_ToxicEye {
    meta:
        author = "ditekSHen"
        description = "Detects ToxicEye / TelegramRAT. Observed used as the basis for many infostealers"
    strings:
        $s1 = "[~] Handling command" wide 
        $s2 = "[?] Sleeping {0}" wide 
        $s3 = "GETPASSWORDS" wide 
        $s4 = "FORKBOMB" wide 
        $s5 = "SENDKEYPRESS" wide 
        $s6 = "KEYLOGGER" wide 
        $s7 = "/ToxicEye/master/TelegramRAT/" wide 
        $s8 = "desktopScreenshot" ascii 
        $s9 = "MeltFile" ascii 
        $s10 = "AutoStealer" ascii 
        $s11 = /\/LimerBoy\/(ToxicEye|Adamantium-Thief|hackpy)/ wide
    condition:
        uint16(0) == 0x5a4d and 7 of them
}

/*
rule MALWARE_Win_RDPCredsStealer {
    meta:
        author = "ditekSHen"
        description = "Detects RDP Credentials Stealer"
        clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer"
    strings:
        $x1 = "MyCredUnPackAuthenticationBufferW Hooked Function" ascii
        $x2 = "\\RDPCredsStealerDLL\\" ascii
        $x3 = "\\RDPCreds.txt" ascii
        $s1 = "CredUnPackAuthenticationBufferW" ascii
        $s2 = "Installing Hooked Function" ascii
        $s3 = "SymLoadModule64" fullword ascii
        $s4 = "memmove" fullword ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or 3 of ($s*))
}
*/

rule MALWARE_Win_RDPCredsStealerInjector {
    meta:
        author = "ditekSHen"
        description = "Detects RDP Credentials Stealer injector"
        clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer-Injector"
    strings:
        $s1 = "\\APIHookInjectorBin\\" ascii
        $s2 = "\\RDPCredsStealerDLL.dll" ascii
        $s3 = "DLL Injected" ascii
        $s4 = "Code Injected" ascii
        $s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii
    condition:
        uint16(0) == 0x5a4d and 3 of them
}

rule MALWARE_Win_KrakenStealer {
    meta:
        author = "ditekSHen"
        description = "Detect Kraken infostealer"
        snort = "923828002"
    strings:
        $x1 = /Kraken(_)?(Stub|Keyboard|Clipboard|GeneratorMachine|PostLogs|Screenshot|Keylogs|Password)/ ascii wide
        $s1 = /(get|set)_(Clipboard|Keyboard|Screen)Recorder/ fullword ascii
        $s2 = /Dumping(FileZilla|360_China|Opera|Epic|CocCoc|Thunderbird|Brave)/ fullword ascii
        $s3 = "ScreenPostData" fullword ascii
        $s4 = "encrypt_data" fullword ascii
        $s5 = "KeyboardProc" fullword ascii
        $s6 = "UploadsKeyboard" fullword ascii
        $s7 = "ClpUploader" fullword ascii
        $s8 = "StartKeylogger" fullword ascii
        $s9 = "ClipoDetectedRemover" fullword ascii
        $s10 = "Disable_Regis" fullword ascii
        $s11 = "RecordedClips" fullword ascii
        $s12 = "HoneyPotStatus" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 9 of ($s*))
}

rule MALWARE_Win_WhiffyRecon {
    meta:
        author = "ditekSHen"
        description = "Detects Whiffy Recon"
    strings:
        $s1 = "WLANSVC" fullword wide
        $s2 = "f02fe1c0-137a-4802-8881-55dd300c5022" fullword wide
        $s3 = "\\wlan.lnk" fullword wide
        $s4 = "str-12.bin" wide
        $s5 = "/geolocation/v1/geolocate?key=" wide
        $s6 = "/wlan" fullword wide
        $s7 = "/scanned" fullword wide
        $s8 = "/bots/" fullword wide
        $s9 = "wlan.pdb" fullword ascii
        $s10 = "botId" fullword ascii
        $s11 = "wifiAccessPoints" fullword ascii
        $s12 = "considerIp" fullword ascii
        $s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" fullword wide
    condition:
        uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_QuiteRAT {
    meta:
        author = "ditekSHen"
        description = "Detects QuiteRAT"
    strings:
        $x1 = "< No Pineapple! >" ascii // error message
        $x2 = ".?AVPineapple" ascii
        $x3 = ".?AVApple@@" ascii
        $s1 = "XgsdCwsRFxZF" ascii // http
        $s2 = "XggZChkVRQ==" ascii // http
        $s3 = "RxUZERQRHEU=" ascii // http
        $s4 = "XhkbDBEXFkU" ascii  // http
    condition:
        uint16(0) == 0x5a4d and ((all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 3 of ($s*)))
}

rule MALWARE_PWSH_CUMII {
    meta:
        author = "ditekSHen"
        description = "Detects multi-dropper PowerShell"
        clamav = "ditekSHen.MALWARE.PWSH.CUMII"
    strings:
        $s1 = ".('{1}{$}'.replace('$','0')" ascii nocase
        $s2 = ",'I').replace('!','ex')" ascii nocase
        $s3 = "'.replace('*','0001')" ascii nocase
        $s4 = "Remove-Item $" ascii nocase
        $s5 = "the File will start cumiing" ascii nocase
        $b1 = "011001100111010101101110011*" ascii
        $b2 = "0101001000*1110110*010011111" ascii
        $b3 = "01001101010110101001*11*0000" ascii
    condition:
       (3 of ($s*) and 1 of ($b*))
}

rule MALWARE_Win_AgnianeStealer {
    meta:
        author = "ditekSHen"
        description = "Detects Agniane infostealer"
        snort = "923828001"
        clamav = "ditekSHen.MALWARE.Win.AgnianeStealer"
    strings:
        $x1 = "Agniane.pdb" ascii
        $x2 = "IEnumerable<Agniane.Classes.LogRecord>." ascii
        $x3 = "Agniane Stealer" wide
        $x4 = "cinoshibot" wide
        $x5 = "yqbiguuno2zp5jxsmqbev4rwckvy27bqws5cgm3hiid7xolt65j72kqd.onion" wide
        $s1 = "<Pass encoding=\"base64\">" wide
        $s2 = "Domain Detect: detected {0}" wide
        $s3 = "DOMAINDETECTCOOKIES" ascii
        $s4 = /(Opera|Edge|Chrome|Brave|Vivaldi|Blink|Universal|Gecko|OperaGx|Firefox)Grabber/ fullword ascii
        $u1 = "/antivm.php?id=" wide
        $u2 = "/ferr.php?id=" wide
        $u3 = ".php?ownerid=" wide
        $u4 = "&buildid=" wide
        $u5 = "&username=" wide
        $u6 = "&BSSID=" wide
        $u7 = "&rndtoken=" wide
        $u8 = "&domaindetects=" wide
    condition:
       uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 3 of ($u*))) or (all of ($s*) and 3 of ($u*)) or (7 of ($u*)))
}

rule MALWARE_Win_TOITOIN_KritaLoader {
    meta:
        author = "ditekSHen"
        description = "Detects TOITOIN KritaLoader"
        clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
    strings:
       $p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
       $p2 = "DLL_Start_OK.pdb" ascii
       $s1 = "krita_main" fullword ascii
    condition:
       uint16(0) == 0x5a4d and (1 of ($p*) and 1 of ($s*))
}

rule MALWARE_Win_TOITOIN_InjectorDLL {
    meta:
        author = "ditekSHen"
        description = "Detects TOITOIN InjectorDLL"
        clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
    strings:
       $p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
       $p2 = "DLL_START_IN.pdb" ascii
       $s1 = ".ini" fullword ascii
       $s2 = "\\users\\Public\\Documents\\" fullword ascii
    condition:
       uint16(0) == 0x5a4d and (1 of ($p*) and all of ($s*))
}

rule MALWARE_Win_TOITOIN_Downloader {
    meta:
        author = "ditekSHen"
        description = "Detects TOITOIN Downloader"
        clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
    strings:
       $p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
       $s1 = { 20 2f 63 20 22 [6-15] 63 00 6d 00 64 00 00 00 6f 00 70 00 65 00 6e }
       $o1 = { 48 83 fa 10 72 34 48 8b 8d 10 ?? 00 00 48 ff c2 }
    condition:
       uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_VenomRAT {
    meta:
        author = "ditekSHen"
        description = "Detects VenomRAT"
    strings:
       $x1 = "Venom RAT + HVNC" fullword ascii
       $x2 = "Venom" fullword ascii
       $x3 = "VenomByVenom" fullword wide
       $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide
       $s2 = "UmVjZWl2ZWQ" wide
       $s3 = "Pac_ket" fullword wide
       $s4 = "Po_ng" fullword wide
    condition:
       uint16(0) == 0x5a4d and (1 of ($x*) and 2 of ($s*))
}

rule MALWARE_Win_SapphireStealer {
    meta:
        author = "ditekSHen"
        description = "Detects SapphireStealer"
    strings:
       $s1 = "Sapphire.Modules." ascii
       $s2 = "sapphire\\" wide
       $s3 = "by r3vengerx0" wide
       $s4 = "Sapphire\\obj\\" ascii
       $s5 = "[ERROR_GETSECRETKEY_METHOD]" fullword wide
       $s6 = "[ERROR_CANT_GET_PASSWORD]" fullword wide
       $s7 = "<h2>------NEW LOGS------</h2>" wide
       $s8 = "[ERROR] can't create grab directory" wide
       $s9 = "<UploadToTelegram>d__" ascii
       $s10 = "UploadToTelegram" ascii
       $s11 = ".SendLog+<UploadToTelegram>d__" ascii
    condition:
       uint16(0) == 0x5a4d and 5 of them
}

rule MALWARE_Win_R77 {
    meta:
        author = "ditekSHen"
        description = "Detects r77 rootkit"
    strings:
        $s1 = "startup" fullword wide
        $s2 = "process_names" fullword wide
        $s3 = "paths" fullword wide
        $s4 = "service_names" fullword wide
        $s5 = "tcp_local" fullword wide
        $s6 = "tcp_remote" fullword wide
        $s7 = "\\\\.\\pipe\\" wide
        $s8 = "SOFTWARE\\" wide
    condition:
        uint16(0) == 0x5a4d and (
            all of ($s*) or 
            (5 of them and pe.exports("ReflectiveDllMain")) or
            (5 of them and 
                for any i in (0 .. pe.number_of_sections) : (
                    (
                        pe.sections[i].name == ".detourd"
                    )
                )
            )
        )
}

rule MALWARE_Win_Disco_NightClub {
    meta:
        author = "ditekSHen"
        description = "Hunts for Disco NightClub"
    strings:
        $s1 = "\\OfficeBroker\\OfficeBroker.exe" ascii wide nocase
        $s2 = "\\EDGEUPDATE\\EDGEAOUT" ascii wide nocase
        $s3 = "\\EDGEUPDATE\\update" ascii wide nocase
        $s4 = "windows.system.update.com" ascii wide nocase
        $s5 = "edgeupdate-security-windows.com" ascii wide nocase
        $s6 = "nightclub::" ascii wide nocase
        $s7 = "EncryptedPasswordFlt" ascii wide nocase
        $s8 = "Microsoft\\def\\Gfr45.cfg" ascii wide nocase
        $s9 = "::keylog::" ascii wide nocase
        $pdb1 = "\\AbcdMainProject\\Rootsrc\\Projects\\MainS\\Ink\\" ascii wide nocase
        $pdb2 = "\\Autogen\\Kh\\AutogenAlg\\" ascii wide nocase
    condition: 
        uint16(0) == 0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or (4 of ($s*)))
}

rule MALWARE_Win_RisePro {
    meta:
        author = "ditekShen"
        description = "Detects RisePro infostealer"
    strings:
        $x1 = "t.me/riseprosupport" ascii wide nocase
        $s1 = "failed readpacket" fullword wide
        $s2 = "faield sendpacket" fullword wide
        $s3 = "PersistWal" fullword wide
        $s4 = /CRED_ENUMERATE_(ALL|SESSION)_CREDENTIALS/ fullword ascii
        $s5 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" fullword wide
        $s6 = { 4c 00 6f 00 67 00 69 00 6e 00 20 00 44 00 61 00 
                74 00 61 [10] 57 00 65 00 62 00 20 00 44 00 61 00
                74 00 61 [2] 48 00 69 00 73 00 74 00 6f 00 72 00
                79 [21] 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 }
        $s7 = { 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00
                69 00 6f 00 6e 00 2f 00 78 00 2d 00 77 00 77 00
                77 00 2d 00 66 00 6f 00 72 00 6d 00 2d 00 75 00
                72 00 6c 00 65 00 6e 00 63 00 6f 00 64 00 65 00
                64 00 3b 00 20 00 63 00 68 00 61 00 72 00 73 00
                65 00 74 00 3d 00 75 00 74 00 66 00 2d 00 38 00
                42 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74
                00 69 00 6f 00 6e 00 2f 00 6a 00 73 00 6f 00 6e
                00 2c 00 20 00 74 00 65 00 78 00 74 00 2f 00 70
                00 6c 00 61 00 69 00 6e 00 2c 00 20 00 2a 00 2f
                00 2a }
        $s8 = /_(SET|GET)_(GRABBER|LOADER)/ wide
        $s9 = /catch (save )?(windows cred|screen|pluginscrypto|historyCC|autofill|cookies|passwords|passwords sql|autofills sql|dwnlhistory sql|discordToken|quantum|isDropped)/ fullword wide
    condition:
        uint16(0) == 0x5a4d and (1 of ($x*) or 6 of ($s*))
}

rule MALWARE_Win_GraphicalProton_rsockstun {
    meta:
        author = "ditekShen"
        description = "Detects GraphicalProton custom rsockstun"
    strings:
        $m1 = "main.connectviaproxy" ascii
        $m2 = "main.connectForSocks" ascii
        $m3 = "main.listenForClients" ascii
        $m4 = "main.listenForSocks" ascii
        $s1 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
        $s2 = "Server: nginx/1.14.1" ascii
        $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ascii
        $s4 = "wine_get" ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($m*) and 2 of ($s*)) or (all of ($s*) and 1 of ($m*)) or 7 of them)
}

rule MALWARE_Win_PWSHDLLDL {
    meta:
        author = "ditekShen"
        description = "Detects downloader"
    strings:
        $s1 = "powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file " fullword wide nocase
        $s2 = "objShell.run \"powershell -WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase
        $s3 = "cmd.exe /c schtasks.exe /create /tn \"" fullword wide nocase
        $s4 = "-WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase
        $s6 = "\" /tr \"wscript.exe //b //nologo '" fullword wide nocase
        $s7 = "\" -Value \"Powershell.exe -WindowStyle hidden \"\"& '" fullword wide nocase
        $op0 = { 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 }
        $op1 = { 4b 04 00 00 34 01 00 00 7f 05 00 00 1a }
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and 5 of them
}

rule MALWARE_Win_NPPSpy {
    meta:
        author = "ditekShen"
        description = "Detects NPPSpy / Ntospy"
    strings:
        $s1 = "ntskrnl.dll" fullword ascii
        $s2 = "PasswordStealing.dll" fullword ascii
        $s3 = "ntoskrnl.dll" fullword ascii
        $s4 = "\\programdata\\packag~" ascii
        $s5 = "NPPSPY.dll" fullword ascii
        $s6 = "MSControll.dll" fullword ascii
        $s7 = "\\Windows\\Temp\\" ascii
        $s8 = "\\NPPSpy\\" ascii
        // hunt
        $s9 = "NPGetCaps" fullword ascii
        $s10 = "NPLogonNotify" fullword ascii
        // C:\Users\GrzegorzTworek\source\repos\NPPSpy\x64\Release\NPPSPY.pdb
        $path = "\\GrzegorzTworek\\" ascii
    condition:
      uint16(0) == 0x5a4d and ((pe.is_dll() and filesize < 110KB and pe.number_of_exports == 2 and ((pe.exports("NPGetCaps") and pe.exports("NPLogonNotify")) or (1 of ($s*) and (pe.exports("NPGetCaps") or pe.exports("NPLogonNotify"))))) or (($path) and any of ($s*)))
}

rule MALWARE_Win_AgentRacoon {
    meta:
        author = "ditekShen"
        description = "Detects AgentRacoon. Not Raccoon"
    strings:
        $s1 = "UdpClient" fullword ascii
        $s2 = "IPEndPoint" fullword ascii
        $s3 = "get_Client" fullword ascii
        $s4 = "set_ReceiveTimeout" fullword ascii
        $s5 = "Command failed:" wide
        $s6 = "uploaded" wide
        $s7 = "downloaded" wide
        $s8 = ".telemetry." wide
        $s9 = "xn--" wide
    condition:
      uint16(0) == 0x5a4d and 7 of them
}

rule MALWARE_Win_Simda {
    meta:
        author = "ditekShen"
        description = "Detects Simda / Shifu infostealer"
    strings:
        $s1 = "command=auth_loginByPassword&back_command=&back_custom1=&" fullword ascii
        $s2 = "iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clma" ascii
        $s3 = "debug_%s_%s.log" fullword ascii
        $s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"report\"" ascii
        $s5 = "name=%s&port=%u" ascii
        $s6 = "id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d" ascii
        $s7 = "{BotVer:" fullword ascii
        $s8 = "software\\microsoft\\windows nt\\currentversion\\winlogon" ascii
        $s9 = /(!|&|data_)inject(=ok)?/ fullword ascii
    condition:
      uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_VBSDownloader {
    meta:
        author = "ditekShen"
        description = "Detects second stage VBS downloader of third stage VBS"
    strings:
        $s1 = "CreateObject(\"MSXML2.ServerXMLHTTP\")" wide
        $s2 = ".Open \"GET\"," wide
        $s3 = ".Send" wide
        $s4 = ".responseText" wide
        $s5 = "ExecuteGlobal" wide
    condition:
       filesize < 50KB and all of them 
}

rule MALWARE_Win_UmbralStealer {
    meta:
        author = "ditekShen"
        description = "Detects Umbral infostealer"
    strings:
        $x1 = "Umbral Stealer" wide
        $x2 = "Umbral.payload." ascii
        $s1 = "U2V0LU1wUHJlZmVyZW5jZ" wide
        $s2 = "{{ Key = {0}, Value = {1} }}" wide
        $s3 = "csproduct get uuid" wide
        $s4 = "0.0.0.0 www." 
        $s5 = /(set|get)_Take(Screen|WebcamSnap)shot/ fullword ascii
        $s6 = "still_pin" fullword ascii
        $c1 = "kaspersky.com" wide
        $c2 = "bitdefender.com" wide
        $c3 = "virustotal.com" wide
        $c4 = "malwarebytes.com" wide
        $c5 = "clamav.net" wide
        $c6 = "trendmicro.com" wide
    condition:
       uint16(0) == 0x5a4d and (1 of ($x*) or 5 of ($s*) or (3 of ($s*) and 4 of ($c*))) 
}

rule MALWARE_Win_MetaStealer {
    meta:
        author = "ditekSHen"
        description = "Detects MetaStealer infostealer"
    strings:
        $s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
        $s2 = "{0}{1}{2}" fullword wide
        $s3 = "localhost" fullword wide
        $s4 = "\\tdata" fullword wide
        $s5 = "DecryptBlob" fullword ascii
        $s6 = "GetMac" fullword ascii
        $s7 = "GetHdc" fullword ascii
        $s8 = "FindProc" fullword ascii
        $s9 = "targetPid" fullword ascii
        $s10 = "MessageSecurityOverTcp" fullword ascii
        $s11 = "ListOfProcesses" fullword ascii
        $s12 = "ListOfPrograms" fullword ascii
        $s13 = "browserPaths" fullword ascii
        $s14 = "configs" fullword ascii
        $s15 = "scanners" fullword ascii
        $s16 = "FileScannerRule" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 7 of ($s*)
}

rule MALWARE_Win_MediaPI {
    meta:
        author = "ditekSHen"
        description = "Detects MediaPI"
    strings:
        $s1 = "SomeFunction" ascii
        $s2 = "\"stealth" ascii
        $s3 = "\"ServAddr" ascii
        $s4 = "\"ServPort" ascii
        $s5 = "\"ServIp" ascii
        $s6 = "\"wsaData" ascii
        $s7 = "\"-socket" ascii
    condition:
        uint16(0) == 0x5a4d and pe.is_dll() and ((6 of them) or (3 of them and pe.exports("SomeFunction")))
}

rule MALWARE_Win_BlackHunt {
    meta:
        author = "ditekSHen"
        description = "Detects BlackHunt ransomware"
    strings:
        $s1 = /#BlackHunt_(Logs|BG|Icon|Public|Private|ID|ReadMe|Update)\.(txt|jpg|ico|key|hta)/ ascii wide
        $s2 = /-(biggame|noencrypt|netinfo|nospread)/ fullword wide
        $s3 = "/v \"*BlackHunt\" /t REG_SZ /d" wide
        $s4 = "/sc onstart /TN \"Windows Critical Update\" /TR \"'%s' %s\" /F" wide
        $s5 = "/v \"DisableChangePassword\" /t REG_DWORD /d" wide
        $s6 = "<span> %s </span>this ID (<span> %s </span>)" wide
        $s7 = "}div.header h1 span#hunter" wide
        $s8 = "BLACK_HUNT_MUTEX" fullword ascii
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_ScoutElite {
    meta:
        author = "ditekSHen"
        description = "Detects ScoutElite"
        reference = "https://github.com/ditekshen/back-in-2017"
    strings:
        $cmd1 = "command=scote_ping" fullword ascii
        $cmd2 = "command=scote_info_ipconfig" fullword ascii
        $cmd3 = "command=scote_info_systeminfo" fullword ascii
        $cmd4 = "command=scote_connection|hwid=" fullword ascii
        $cmd5 = "command=ping" fullword wide
        $cmd6 = "command=screen_capture_init" fullword wide
        $cmd7 = "command=screen_capture" fullword wide
        $cmd8 = "command=silence_screenshot" fullword wide
        $cmd9 = "command=silence_keylogger" fullword wide
        $cmd10 = "command=silence_password" fullword wide
        $cmd11 = "command=screen_thumb" fullword wide
        $cmd12 = "command=filemanager_upload_tcp" fullword wide
        $cmd13 = "command=filemanager_download" fullword wide
        $cmd14 = "command=filemanager_init" fullword wide
        $cmd15 = "command=filemanager_root" fullword wide
        $cmd16 = "command=filemanager_folder_filemanager_file" fullword wide
        $cmd17 = "command=filemanager_thumb" fullword wide
        $cmd18 = "command=keylogger_init" fullword wide
        $cmd19 = "command=keylogger_file" fullword wide
        $cmd20 = "command=password_firefox" fullword wide
        $cmd21 = "command=password_opera" fullword wide
        $cmd22 = "command=password_chrome" fullword wide
        $cmd23 = "command=password_all" fullword wide
        $cmd24 = "command=password_init" fullword wide
        $cmd25 = "command=misc_init" fullword wide
        $cmd26 = "command=misc_process" fullword wide
        $cmd27 = "command=misc_cmd" fullword wide
        $cmd28 = "command=new_rcs" fullword wide
        $cmd29 = "command=microphone_capture" fullword wide
        $cmd30 = "command=microphone_capture_init" fullword wide
        $cmd31 = "command=rvmedia_capture_init" fullword wide
        $cmd32 = "command=rvmedia_list" fullword wide
        $cmd33 = "command=rvmedia_resolution" fullword wide
        $cmd34 = "command=webcam_capture_init" fullword wide
        $cmd35 = "command=webcam_list" fullword wide
        $cmd36 = "command=webcam_resolution" fullword wide
        $cmd37 = "command=webcam_capture" fullword wide

        $gcmd1 = "filemanager_download_ftp" fullword wide
        $gcmd2 = "download_file_ftp" fullword wide
        $gcmd3 = "filemanager_upload_http" fullword wide
        $gcmd4 = "upload_file_http" fullword wide
        $gcmd5 = "upload_url" fullword wide
        $gcmd6 = "filemanager_delete" fullword wide
        $gcmd7 = "filemanager_execute_file" fullword wide
        $gcmd8 = /(microphone|webcam|rvmedia|keylogger|password|screen|filemanager)_(host|port|guid)/ nocase

        $confs1 = "[nick_name]" fullword ascii
        $confe1 = "[/nick_name]" fullword ascii wide
        $confs2 = "[install_name]" fullword ascii wide
        $confe2 = "[/install_name]" fullword ascii wide
        $confs3 = "[install_folder]" fullword ascii wide
        $confe3 = "[/install_folder]" fullword ascii wide
        $confs4 = "[reg_startup]" fullword ascii wide
        $confe4 = "[/reg_startup]" fullword ascii wide
        $confs5 = "[folder_startup]" fullword ascii wide
        $confe5 = "[/folder_startup]" fullword ascii wide
        $confs6 = "[task_startup]" fullword ascii wide
        $confe6 = "[/task_startup]" fullword ascii wide
        $confs7 = "[injection]" fullword ascii wide
        $confe7 = "[/injection]" fullword ascii wide
        $confs8 = "[injection_process]" fullword ascii wide
        $confe8 = "[/injection_process]" fullword ascii wide
        $confs9 = "[connection]" fullword ascii wide
        $confe9 = "[/connection]" fullword ascii wide
    condition:
        (uint16(0) == 0x5a4d and (2 of ($cmd*) or 7 of ($gcmd*) or (2 of ($confs*) and 2 of ($confe*)) or (pe.exports("__elite") and 2 of them))) or (15 of them)
}


rule MALWARE_Win_ScoutElitePS {
    meta:
        author = "ditekshen"
        description = "Detects actor PowerShell tool designed to steal browsers session cookie and passwords on-disk and in-memory"
        reference = "https://github.com/ditekshen/back-in-2017"
    strings:
        $cnc1 = "http://beginpassport.com" ascii wide nocase
        $cnc2 = "f_dump.php" ascii wide nocase
        $cnc3 = "c_dump.php" ascii wide nocase
        $cnc4 = "o_dump.php" ascii wide nocase
        $db1 = "\\Google\\Chrome\\User Data\\Default\\Cookies" ascii wide nocase
        $db2 = "\\Mozilla\\Firefox\\Profiles\\*.default" ascii wide nocase
        $db3 = "\\Opera Software\\Opera Stable\\Cookies" ascii wide nocase
        $db4 = "$($env:LOCALAPPDATA)\\Google\\Chrome\\User Data\\Default" ascii nocase
        $db5 = "$($env:APPDATA)\\Mozilla\\Firefox\\Profiles\\*.default" ascii nocase
        $db6 = "$($env:APPDATA)\\Opera Software\\Opera Stable" ascii nocase
        $cond1 = "SSID" ascii wide
        $cond2 = "MSPAuth" ascii wide
        $cond3 = "\"'T'\"" ascii wide
        $cond4 = "SNS_AA" ascii wide
        $cond5 = "X-APPLE-WEBAUTH-TOKEN" ascii wide
        $sql1 = "SELECT * FROM 'cookies' WHERE host_key LIKE $" ascii wide nocase
        $sql2 = "SELECT * FROM 'moz_cookies' WHERE host LIKE $" ascii wide nocase
        $sql3 = "SELECT origin_url, username_value ,password_value FROM 'logins'" ascii nocase
        $def1 = "Add-Type -AssemblyName System.Security" ascii wide nocase
        $def2 = "System.Security.SecureString" ascii wide nocase
        $def3 = "ConvertFrom-SecureString" ascii wide nocase
        $def4 = "[System.Security.Cryptography.ProtectedData]::Unprotect(" ascii wide nocase
        $def5 = "[Security.Cryptography.DataProtectionScope]::LocalMachine" ascii wide nocase
        $def6 = "[Security.Cryptography.DataProtectionScope]::CurrentUser" ascii wide nocase
        $def7 = "System.Data.SQLite.SQLiteConnection" ascii wide nocase
        $def8 = "[Environment]::OSVersion.ToString().Replace(\"Microsoft Windows \"," ascii wide nocase
        $def9 = "Start-Sleep" ascii wide nocase
 condition:
     (1 of ($cnc*) and any of ($db*) and any of ($cond*) and any of ($sql*) and 7 of ($def*)) or (all of them)
}

rule MALWARE_Andr_Landroid {
    meta:
        author = "ditekshen"
        description = "Detects Landroid"
        reference = "https://github.com/ditekshen/back-in-2017"
    strings:
        $dex_header = { 64 65 78 }
        $cnc1 = "phonebooks.site" fullword ascii /* found in .dex and .apk */
        $cnc2 = "/full_data.php" ascii /* found in .dex */
        $cnc3 = "/upload.php" ascii /* found in .dex */
        $package = "com.androDiv." wide /* found in .apk */
        $exfil1 = /ContDB?[A-Z]?/ fullword ascii
        $exfil2 = "[X]" fullword ascii
        $exfil3 = "/~RIP_" fullword ascii
        $exfil4 = /^(.|\/)rip$/ fullword ascii
        $http1 = "%s-retry [timeout=%s]" fullword ascii
        $http2 = "%s-timeout-giveup [timeout=%s]" fullword ascii
        $http3 = "HTTP response for request=<%s> [lifetime=%d], [size=%s], [rc=%d], [retryCount=%s]" fullword ascii
        $http4 = "Cache[maxSize=%d,hits=%d,misses=%d,hitRate=%d%%]" fullword ascii
        $s1 = "Landroid" fullword ascii
        $s2 = "Lorg" fullword ascii
        $s3 = "fileToUpload" fullword ascii
        $s4 = "xtcp://" fullword ascii
        $s5 = "/which su" fullword ascii
        $s6 = "/Superuser.apk" fullword ascii
    condition:
        (($dex_header at 0 and (2 of ($cnc*) or (all of ($exfil*) and (all of ($http*)) and (3 of ($s*))))) or (uint16(0) == 0x4b50 and $package and 1 of ($cnc*)))
}

rule MALWARE_Win_HoudiniConfig {
    meta:
        author = "ditekshen"
        description = "Detects Houdini Trojan configurations"
        reference = "https://github.com/ditekshen/back-in-2017"
    strings:
        $s1 = "install_name="
        $s2 = "nick_name="
        $s3 = "install_folder="
        $s4 = "reg_startup="
        $s5 = "startup_folder_startup="
        $s6 = "task_startup="
        $s7 = "injection="
        $s8 = "injection_process"
    condition:
        (uint16(0) == 0x5a4d and 5 of them) or (all of them)
}

rule MALWARE_Win_Houdini {
    meta:
        author = "ditekshen"
        description = "Detects the raw binary of the Houdini Trojan Delphi variant"
        reference = "https://github.com/ditekshen/back-in-2017"
     strings:
         $hc = "houdiniclient" ascii wide nocase
         // module keylogger
         $mk1 = "keylogger_thread" fullword ascii
         $mk2 = "keyloger_host" fullword ascii
         $mk3 = "keylogger_port" fullword ascii
         $mk4 = "keylogger_thread" fullword ascii
         $mk5 = "keylogger_init" fullword wide
         $mk6 = "keylogger_stop" fullword wide
         $mk7 = "keylogger_offline" fullword wide
         $mk8 = "silence_keylogger" fullword wide
         // module screenshot
         $ms1 = "screenshot_thread" fullword ascii
         $ms2 = "screen_host" fullword ascii
         $ms3 = "screen_port" fullword ascii
         $ms4 = "screenshot_init" fullword wide
         $ms5 = "screenshot_start" fullword wide
         $ms6 = "screenshot_stop" fullword wide
         $ms7 = "screen_thumb" fullword wide
         $ms8 = "silence_screenshot" fullword wide
         // module file
         $mf1 = "file_manager_init" fullword wide
         $mf2 = "file_manager_root" fullword wide
         $mf3 = "file_manager_faf" fullword wide
         $mf4 = "file_manager_download" fullword wide
         $mf5 = "file_manager_upload" fullword wide
         $mf6 = "file_manager_stop" fullword wide
         $mf7 = "file_manager_delete_folder" fullword wide
         $mf8 = "file_manager_rename_folder" fullword wide
         $mf9 = "file_manager_rename_file" fullword wide
         $mf10 = "file_manager_delete_file" fullword wide
         $mf11 = "file_manager_execute_file" fullword wide
         $mf12 = "file_manager_thumb" fullword wide
         $mf13 = "file_manager_upload_http" fullword wide
         $mf14 = "file_manager_upload_tcp" fullword wide
         $mf15 = "upload_file_tcp" fullword wide
         $mf16 = "download_file_tcp" fullword wide
         $mf17 = "upload_file_http" fullword wide
         $mf18 = "filemanager_host" fullword ascii
         $mf19 = "filemanager_port" fullword ascii
         $mf20 = "filemanager_thread" fullword ascii
         // module password
         $mp1 = "password_value" fullword wide
         $mp2 = "password_init" fullword wide
         $mp3 = "password_stop" fullword wide
         $mp4 = "password_firefox" fullword wide
         $mp5 = "password_chrome" fullword wide
         $mp6 = "password_all" fullword wide
         $mp7 = "password_host" fullword ascii
         $mp8 = "password_port" fullword ascii
         $mp9 = "password_thread" fullword ascii
         // module miscellaneous 
         $mm1 = "misc_init" fullword wide
         $mm2 = "misc_stop" fullword wide
         $mm3 = "misc_process_list" fullword wide
         $mm4 = "misc_module_list" fullword wide
         $mm5 = "misc_process_terminate" fullword wide
         $mm6 = "misc_host" fullword ascii
         $mm7 = "misc_port" fullword ascii
         $mm8 = "misc_thread" fullword ascii
         // plugins
         $pl1 = "plugin_file_init" fullword wide
         $pl2 = "plugin_url_init" fullword wide
         $pl3 = "plugin_stop" fullword wide
     condition:
         uint16(0) == 0x5a4d and 4 of them
}

rule MALWARE_Win_LightHand {
    meta:
        author = "ditekshen"
        description = "Detects LightHand"
    strings:
        $x1 = "27.102." ascii
        $x2 = "109.248.150.179" fullword ascii
        $s1 = /Hello (Client|Server)/ fullword ascii
        $s2 = "%s|%s|%s|%s|%s|%s|" fullword wide
        $s3 = "%s\\cmd.exe" fullword wide
        $s4 = "Remote PC" fullword wide
        $s5 = { 2e 62 61 74 [3-4] 3a 4c 31 0d 0a 64 65 6c
                20 2f 46 20 22 25 73 22 0d 0a 69 66 20 65 78 69
                73 74 20 22 25 73 22 20 67 6f 74 6f 20 4c 31 0d
                0a 64 65 6c 20 2f 46 20 22 25 73 22 0d 0a 00 00
                6f 70 65 6e }
        $s6 = { 25 00 2e 00 32 00 66 00 47 00 42 00 00 00 00 00
                25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00
                0a 00 00 00 00 00 00 00 5c 00 2a 00 2e 00 2a 00
                00 00 00 00 0a 00 00 00 2e 00 00 00 2e 00 2e 00
                00 00 00 00 00 00 00 00 46 00 6f 00 6c 00 64 00
                65 00 72 00 00 00 00 00 25 00 73 00 5c 00 25 00
                73 00 00 00 00 00 00 00 25 00 64 00 42 00 00 00
                25 00 2e 00 31 00 66 00 4b 00 42 00 00 00 00 00
                25 00 2e 00 31 00 66 00 4d 00 42 }
    condition:
        uint16(0) == 0x5a4d and ((5 of ($s*)) or (1 of ($x*) and 3 of ($s*)))
}

rule MALWARE_Win_ValidAlpha {
    meta:
        author = "ditekshen"
        description = "Detects ValidApha / BlackRAT"
    strings:
        $x1 = "RAT/Black/" ascii
        $x2 = "RAT/Black/Client_Go/" ascii
        $s1 = "main.RunTask" fullword ascii
        $s2 = "main.CmdShell" fullword ascii
        $s3 = "main.SelfDelete" fullword ascii
        $s4 = "main.RecvPacket" fullword ascii
        $s5 = "main.FileDownload" fullword ascii
        $s6 = "main.CaptureScreen" fullword ascii
        $s7 = "main.PeekNamedPipe" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ((1 of ($x*) and 2 of ($s*)) or (6 of ($s*)))
}

rule MALWARE_Win_TigerRAT {
    meta:
        author = "ditekshen"
        description = "Detects TigerRAT"
    strings:
        $m0 = ".?AVCryptorRC4@@" fullword ascii
        $m1 = ".?AVModuleShell@@" fullword ascii
        $m2 = ".?AVModuleKeyLogger@@" fullword ascii
        $m3 = ".?AVModuleSocksTunnel@@" fullword ascii
        $m4 = ".?AVModuleScreenCapture@@" fullword ascii
        $m5 = ".?AVModulePortForwarder@@" fullword ascii
        $s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
        $s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
        $s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
        $s4 = "~KPTEMP" fullword wide
        $s5 = "del \"%s\"%s \"%s\" goto " ascii
    condition:
        uint16(0) == 0x5a4d and ((all of ($s*)) or (5 of ($m*)) or (3 of ($m*) and 2 of ($s*)) or (5 of them))
}

rule MALWARE_Win_KTLVdoor {
    meta:
        author = "ditekshen"
        description = "Detects KTLVdoor"
    strings:
        $s1 = "/cmd/acc/agent_acc" ascii
        $s2 = "main.DLLWMain" ascii
        $s3 = "main.checkSilent" ascii
        $h1 = ".handleInteractiveShell" ascii
        $h2 = ".handleNetstat" ascii
        $h3 = ".handleProcess" ascii
        $h4 = ".handleRefreshHostInfo" ascii
        $h5 = ".handleTimestomp" ascii
        $h6 = ".handleSoInject" ascii
        $h7 = ".HandleRegInfo" ascii
        $h8 = ".handlePortscan" ascii
        $h9 = ".handleReflectDllInject" ascii
        $h10 = ".handleFileDownload" ascii
        $f1 = ".RdpWithNTLM." ascii
        $f2 = ".FingerPrintOs." ascii
        $f3 = ".ScanWMI." ascii
        $f4 = ".ScanWinRM." ascii
        $f5 = ".ScanWeb." ascii
        $f6 = ".ScanSmb2." ascii
        $f7 = ".ScanRDP." ascii
        $f8 = ".ScanPing." ascii
        $f9 = ".ScanOxid." ascii
        $f10 = ".ScanMssql." ascii
        $f11 = ".ScanBanner." ascii
        $fr1 = /\.proxy[CS]2[CS](TC|UD)P/ ascii
        $fr2 = /\.Scan(WMI|WinRM|Web|Smb2|RDP|Ping|Oxid|Mssql|Banner)\./ ascii
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x457f) and ((6 of ($h*)) or (12 of ($f*)) or (2 of ($h*) and 4 of ($f*)) or (1 of ($s*) and (4 of ($h*) or 4 of ($f*))) or (13 of them))
}

rule MALWARE_Win_FakeCaptcha_Downloader {
    meta:
        author = "ditekshen"
        description = "Detects downloader executables dropped by fake captcha"
    strings:
        $s1 = "</script>MZ" ascii
        $s2 = "window.close();" ascii
        $s3 = "eval(" ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule MALWARE_Win_XenoRAT {
    meta:
        author = "ditekshen"
        description = "Detects Blacksuit"
    strings:
        $x1 = "xeno rat client" wide
        $x2 = "xeno_rat_client." ascii
        $x3 = "xeno rat client" ascii
        $s1 = "+<AddToStartupNonAdmin>" ascii
        $s2 = "+<ConnectAndSetupAsync>" ascii
        $s3 = "+<SendUpdateInfo>" ascii
        $s4 = "+<RecvAllAsync_ddos_" ascii
        $s5 = "Plugin.Chromium+<Get" ascii
    condition: 
        uint16(0) == 0x5a4d and ((1 of ($x*) and 2 of ($s*)) or (4 of ($s*)) or (2 of ($x*)))
}

rule MALWARE_Multi_POOLRAT {
    meta:
        author = "ditekshen"
        description = "Detects POOLRAT"
        clamav1 = "MALWARE.Osx.Trojan.POOLRAT"
        clamav2 = "MALWARE.Linux.Trojan.POOLRAT"
    strings:
        $s1 = "MSG_CmdP" ascii
        $s2 = "MSG_WriteConfigP" ascii
        $s3 = "MSG_SecureDelP" ascii
        $s4 = "ConnectToProxyP" ascii
        $s5 = "MSG_KeepConP" ascii
        $s6 = "MSG_SleepP" ascii
        $s7 = "MSG_TestP" ascii
        $s8 = "MSG_SetPathP" ascii
    condition: 
        (uint16(0) == 0x457f or uint16(0) == 0xfacf or uint16(0) == 0xfeca) and 7 of them
}

rule MALWARE_Multi_PondRAT {
    meta:
        author = "ditekshen"
        description = "Detects PondRAT"
        clamav1 = "MALWARE.Osx.Trojan.PondRAT"
        clamav2 = "MALWARE.Linux.Trojan.PondRAT"
    strings:
        $s1 = "MsgDown" ascii
        $s2 = "MsgUp" ascii
        $s3 = "MsgRun" ascii
        $s4 = "MsgCmd" ascii
        $s5 = "CryptPayload" ascii
        $s6 = "RecvPayload" ascii
        $s7 = "csleepi" ascii
        $s8 = "FConnectProxy" ascii
    condition: 
        (uint16(0) == 0x457f or uint16(0) == 0xfacf or uint16(0) == 0xfeca) and 7 of them
}

rule MALWARE_Win_Cicada3301 {
    meta:
        author = "ditekshen"
        description = "Detects Cicada3301"
        clamav1 = "MALWARE.Win.Ransomware.Cicada3301"
    strings:
        $s1 = "cmd/Cchcp 65001 >nulnet view \\\\"
        $s2 = "create_file_recovery"
        $s3 = "ecnrypted_files_full"
        $s4 = "get_excluded_directories"
        $s5 = "collect_files_except"
        $s6 = ".exe4d5a" ascii
        $s7 = "-accepteula -s -d \"\" --" ascii
        $s8 = "[*.exe*.EXE*.DLL*.ini*.inf*.pol*.cmd*.ps1*.vbs*.bat*.pagefile.sys*.hiberfil.sys*.drv" ascii
        $s9 = "memtasveeamsvc$backupsqlvssmsexchangesql$mysqlmysql$sophosMSExchange" ascii
        $s10 = "-DATA.txt" ascii
        $s11 = /--no_(local|net|impl)/ fullword ascii
        $c1 = "fsutil" ascii
        $c2 = "iisreset" ascii
        $c3 = "vssadmin" ascii
        $c4 = "wmic" ascii
        $c5 = "bcdedit" ascii
        $c6 = "wevtutil" ascii
    condition: 
        uint16(0) == 0x5a4d and (6 of ($s*) or (4 of ($c*) and 4 of ($s*)) or (all of ($c*) and 2 of ($s*)) or 9 of them)
}

rule MALWARE_Win_FPSpy {
    meta:
        author = "ditekshen"
        description = "FPSpy"
        clamav1 = "MALWARE.Win.Trojan.FPSpy"
    strings:
        $f1 = "[Analys_Spy]" wide
        $f2 = "[DeletePoorDll]" wide
        $f3 = "[DownloadProc]" wide
        $f4 = "[DragWarp]" wide
        $f5 = "[GetCoolDir]" wide
        $f6 = "[JackSleep]" wide
        $f7 = "[KillCmdExe]" wide
        $f8 = "[PsDownProc]" wide
        $f9 = "[PsUpProc]" wide
        $f10 = "[ReadFileFromPacket]" wide
        $f11 = "[RemoteDropExec]" wide
        $f12 = "[RemoteExec]" wide
        $f13 = "[RemoteInject]" wide
        $f14 = "[SendHttpForUpload]" wide
        $s1 = "MazeFunc" fullword ascii
        $s2 = /(Exit|Update|Drop)_EVT/ fullword ascii
        $s3 = "Key.dat" fullword ascii
        $s4 = "%sSysInfo_%02d_%02d_%02d.txt" fullword ascii
        $s5 = "cmd /c systeminfo >> %s" fullword ascii
        $s6 = "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"" fullword ascii
        $s7 = "FPSpy" fullword wide
    condition: 
        uint16(0) == 0x5a4d and ((pe.exports("MazeFunc") and 2 of ($f*) and 1 of ($s*)) or (6 of ($f*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($f*)) or (8 of ($f*)))
}

rule MALWARE_Win_KLogExe {
    meta:
        author = "ditekshen"
        description = "Detects KLogExe"
        clamav1 = "MALWARE.Win.Trojan.KLogExe"
    strings:
        $s1 = "[clip_s]: %s" ascii
        $s2 = "------ %d/%d/%d : %d/%d ------" ascii
        $s3 = "[RWin+]" ascii
        $s4 = "[Too many clip_tail]" ascii
        $s5 = "name=\"userfile\"; filename=\"%s\"" ascii
        $s6 = "Origin: http://" wide
        $s7 = "%s_%d_%d_%d_%d" wide
        $s8 = "/wp-content/include.php?_sys_" wide
        $s9 = "\\desktops.ini" wide
        $s10 = "KLogExe" wide nocase
        $s11 = "dynamic_import.cpp [resolve_call] can`nt" wide
    condition: 
        uint16(0) == 0x5a4d and 6 of them
}

rule MALWARE_Win_BabyLockerKZ {
    meta:
        author = "ditekshen"
        description = "Detects BabyLockerKZ"
    strings:
        $s1 = ":\\locker\\bin\\stub_win_x64_encrypter.pdb" ascii
        $s2 = "taskkill /f /im explorer.exe" fullword wide
        $s3 = "\\SysWOW64\\cmd.exe /c %windir%\\" wide
        $s4 = "[!] Failed to RunNonElevated: %s, error 0x%X" fullword wide
        $s5 = "[!] Failed to run sync command: %s, error 0x%X" fullword wide
        $s6 = "[-] RunNonElevated: %s" fullword wide
        $s7 = "[!][Encrypt] Not" fullword
        $s8 = "[-] sALLUSERSPROFILE: %s" fullword wide
        $s9 = "[!] WNetGetConnection failed 0x%X" fullword wide
        $s10 = "[!][Scan] " wide
        $s11 = "[-] Start encrypt" wide
    condition: 
        uint16(0) == 0x5a4d and 4 of them
}

================================================
FILE: yara_rules/packer.yar
================================================
/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.

*/

import "pe"

rule emotet_packer {
   meta:
      description = "recent Emotet packer pdb string"
      author = "Marc Salinas (@Bondey_m)"
      reference = "330fb2954c1457149988cda98ca8401fbc076802ff44bb30894494b1c5531119"
	  reference = "d08a4dc159b17bde8887fa548b7d265108f5f117532d221adf7591fbad29b457"
	  reference = "7b5b8aaef86b1a7a8e7f28f0bda0bb7742a8523603452cf38170e5253f7a5c82"
	  reference = "e6abb24c70a205ab471028aee22c1f32690c02993b77ee0e77504eb360860776"
	  reference = "5684850a7849ab475227da91ada8ac5741e36f98780d9e3b01ae3085a8ef02fc"
	  reference = "acefdb67d5c0876412e4d079b38da1a5e67a7fcd936576c99cc712391d3a5ff5"
	  reference = "14230ba12360a172f9f242ac98121ca76e7c4450bfcb499c2af89aa3a1ef7440"
	  reference = "4fe9b38d2c32d0ee19d7be3c1a931b9448904aa72e888f40f43196e0b2207039"
	  reference = "e31028282c38cb13dd4ede7e9c8aa62d45ddae5ebaa0fe3afb3256601dbf5de7"
      date = "2017-12-12"
    strings:
		$pdb1 = "123EErrrtools.pdb"
		$pdb2=  "gGEW\\F???/.pdb"

    condition:
       $pdb1 or $pdb2
}

rule silent_banker : banker {
      meta:
		author="malware-lu"
    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"

    condition:
        $a or $b or $c
}

rule zbot : banker {
      meta:
		author="malware-lu"
     strings:
        $a = "__SYSTEM__" wide
        $b = "*tanentry*"
        $c = "*<option"
        $d = "*<select"
        $e = "*<input"

     condition:
        ($a and $b) or ($c and $d and $e)
}

rule banbra : banker {
      meta:
		author="malware-lu"
    strings:
        $a = "senha" fullword nocase
        $b = "cartao" fullword nocase
        $c = "caixa"
        $d = "login" fullword nocase
        $e = ".com.br"

     condition:
        #a > 3 and #b > 3 and #c > 3 and #d > 3 and #e > 3
}

rule Borland {
      meta:
		author="malware-lu"
	strings:
		$patternBorland = "Borland" wide ascii
	condition:
		$patternBorland
}

rule MSLRHv032afakePCGuard4xxemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule EnigmaProtector1XSukhovVladimirSergeNMarkin {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }

condition:
		$a0
}

rule SPLayerv008 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }

condition:
		$a0
}

rule DxPackV086Dxd {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualC60 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
	$a1 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
	$a2 = { 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 }
	$a3 = { C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B }
	$a4 = { D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E }
	$a5 = { E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 }
	$a6 = { EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 }
	$a7 = { EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8 }
	$a8 = { EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
	$a9 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point or $a5 at pe.entry_point or $a6 at pe.entry_point or $a7 at pe.entry_point or $a8 at pe.entry_point or $a9 at pe.entry_point
}

rule TPPpackclane {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualC6070 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 }
	$a1 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00 }
	$a2 = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
	$a3 = { F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 }
	$a4 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point
}

rule Thinstall24x25xJititSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8 }

condition:
		$a0 at pe.entry_point
}

rule LocklessIntroPack {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03faketElock061FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02 }

condition:
		$a0 at pe.entry_point
}

rule ExeStealth275aWebtoolMaster {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 }

condition:
		$a0 at pe.entry_point
}

rule PEArmor046Hying {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
	$a1 = { E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule eXPressorv13CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
	$a1 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule Upackv032BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5 }
	$a1 = { BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 }

condition:
		$a0 or $a1
}

rule MSLRHV031emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv184 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

condition:
		$a0 at pe.entry_point
}

rule PCGuardforWin32v500SofProBlagojeCeklic {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

condition:
		$a0 at pe.entry_point
}

rule WiseInstallerStub {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
	$a1 = { 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20 }
	$a2 = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2
}

rule AnskyaNTPackerGeneratorAnskya {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }

condition:
		$a0
}

rule ThinstallVirtualizationSuite30493080ThinstallCompany {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule NsPack14byNorthStarLiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }

condition:
		$a0
}

rule FSGv110EngbartxtWatcomCCEXE {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }

condition:
		$a0 at pe.entry_point
}

rule AcidCrypt: Packer {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }
	$a1 = { BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule eXPressorv1451CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
	$a1 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule BeRoEXEPackerv100LZMABeRoFarbrausch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

condition:
		$a0 at pe.entry_point
}

rule PackanoidArkanoid {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 }

condition:
		$a0 at pe.entry_point
}

rule DAEMONProtectv067 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 }

condition:
		$a0 at pe.entry_point
}

rule EmbedPEV100V124cyclotron {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule VProtectorV10Avcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}

rule EncryptPE2200481022005314WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 7A }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02JDPack1xJDProtect09Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }

condition:
		$a0 at pe.entry_point
}

rule EmbedPEV1Xcyclotron {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule EncryptPEV220070411WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MicrosoftVisualBasic60DLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }

condition:
		$a0 at pe.entry_point
}

rule NsPack14Liuxingping {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00 }

condition:
		$a0 at pe.entry_point
}

rule VxTrivial46 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21 }

condition:
		$a0 at pe.entry_point
}

rule STUDRC410JamieEditionScanTimeUnDetectablebyMarjinZ {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00 }

condition:
		$a0 at pe.entry_point
}

rule VxSonikYouth {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule UPXShit006 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule SetupFactoryv6003SetupLauncher {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }

condition:
		$a0
}

rule CrypKeyV61XDLLCrypKeyCanadaInc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule VcAsmProtectorVcAsm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }

condition:
		$a0 at pe.entry_point
}

rule PECompact2xxSlimLoaderBitSumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }

condition:
		$a0 at pe.entry_point
}

rule ENIGMAProtectorV11V12SukhovVladimir {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorv10bAshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule PEDiminisherv01 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 }
	$a1 = { 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule SOFTWrapperforWin9xNTEvaluationVersion {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF }

condition:
		$a0 at pe.entry_point
}

rule Armadillov200 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov201 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule FreeJoinerSmallbuild014021024027GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule SDProtector1xRandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 }

condition:
		$a0 at pe.entry_point
}

rule NSISInstallerNullSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE }

condition:
		$a0 at pe.entry_point
}

rule PEXv099 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81 }

condition:
		$a0 at pe.entry_point
}

rule IMPPacker10MahdiHezavehiIMPOSTER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }

condition:
		$a0
}

rule PEProtectv09 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3 }
	$a1 = { E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F }

condition:
		$a0 at pe.entry_point or $a1
}

rule nbuildv10soft {
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01StelthPE101Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule IProtect10FxSubdllmodebyFuXdas {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF }

condition:
		$a0 at pe.entry_point
}

rule MSVisualCv8DLLhsmallsig2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01 }

condition:
		$a0 at pe.entry_point
}

rule MSVisualCv8DLLhsmallsig1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv16xVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3 }

condition:
		$a0 at pe.entry_point
}

rule UPXv20MarkusLaszloReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 }

condition:
		$a0
}

rule BladeJoinerv15 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85 }

condition:
		$a0 at pe.entry_point
}

rule FSGv133Engdulekxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF }
	$a1 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule FSGv13 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }

condition:
		$a0 at pe.entry_point
}

rule FSGv12 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule FSGv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 }

condition:
		$a0 at pe.entry_point
}

rule FSGv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }

condition:
		$a0 at pe.entry_point
}

rule FSGv120EngdulekxtMicrosoftVisualC6070 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }

condition:
		$a0 at pe.entry_point
}

rule SuperDAT: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D }

condition:
		$a0 at pe.entry_point
}

rule PECompactv200alpha38 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }

condition:
		$a0
}

rule RCryptor16cVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}

rule TheGuardLibrary {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }

condition:
		$a0 at pe.entry_point
}

rule FreeCryptor01build001GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

condition:
		$a0
}

rule PseudoSigner02BJFNT12Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }

condition:
		$a0 at pe.entry_point
}

rule DingBoysPElockPhantasmv08 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }

condition:
		$a0 at pe.entry_point
}

rule Thinstall2736Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }

condition:
		$a0 at pe.entry_point
}

rule UnnamedScrambler11Cp0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10 }

condition:
		$a0
}

rule y0dasCrypterv1xModified {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }

condition:
		$a0 at pe.entry_point
}

rule Armadillov252b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24 }

condition:
		$a0 at pe.entry_point
}

rule Upackv036betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
	$a1 = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule VxNecropolis {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }

condition:
		$a0 at pe.entry_point
}

rule WinUpackv039finalrelocatedimagebaseByDwingc2005h2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv1061bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }

condition:
		$a0 at pe.entry_point
}

rule aPackv062 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }

condition:
		$a0 at pe.entry_point
}

rule tElockv071 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ED 10 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}

rule tElockv070 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 }

condition:
		$a0 at pe.entry_point
}

rule Ningishzida10CyberDoom {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }

condition:
		$a0 at pe.entry_point
}

rule ASProtectSKE21xdllAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PAVCryptorPawningAntiVirusCryptormasha_dev {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3 }

condition:
		$a0
}

rule ExeShieldCryptor13RCTomCommander {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

condition:
		$a0 at pe.entry_point
}

rule CrinklerV01V02RuneLHStubbeandAskeSimonChristensen {
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9 }

condition:
		$a0 at pe.entry_point
}

rule VxGRUNT4Family {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }

condition:
		$a0 at pe.entry_point
}

rule nPackV112002006BetaNEOxuinC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule VxEddie1800 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }

condition:
		$a0 at pe.entry_point
}

rule EncryptPEV22006115WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35 }

condition:
		$a0
}

rule PrincessSandyv10eMiNENCEProcessPatcherPatch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }

condition:
		$a0
}

rule aPackv082 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }

condition:
		$a0 at pe.entry_point
}

rule NJoiner01AsmVersionNEX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00 }

condition:
		$a0 at pe.entry_point
}

rule Obsiduim1304ObsiduimSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02FSG131Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01CodeSafe20Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01NorthStarPEShrinker13Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule ocBat2Exe10OC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF }

condition:
		$a0
}

rule ASDPack20asd {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }
	$a1 = { 5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9 }
	$a2 = { 8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 }

condition:
		$a0 or $a1 or $a2 at pe.entry_point
}

rule EXECryptor2021protectedIAT {
      meta:
		author="malware-lu"
strings:
		$a0 = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 }

condition:
		$a0
}

rule ShrinkWrapv14 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB }

condition:
		$a0 at pe.entry_point
}

rule UnknownbySMT {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01VOBProtectCD5Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule SimplePack10Xbagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }

condition:
		$a0 at pe.entry_point
}

rule ThemidaWinLicenseV18XV19XOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9 }

condition:
		$a0 at pe.entry_point
}

rule EXEjoinerAmok {
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }

condition:
		$a0 at pe.entry_point
}

rule EmbedPEv124cyclotron {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00 }

condition:
		$a0 at pe.entry_point
}

rule tElockv04xv05x {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov301v305 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }

condition:
		$a0 at pe.entry_point
}

rule DingBoysPElockv007 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 }

condition:
		$a0 at pe.entry_point
}

rule mPack003DeltaAziz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5 }

condition:
		$a0 at pe.entry_point
}

rule SixtoFourv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }

condition:
		$a0 at pe.entry_point
}

rule FreeJoinerSmallbuild029GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule ThemidaWinLicenseV1XNoCompressionSecureEngineOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule WinUpackv030betaByDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
	$a1 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }

condition:
		$a0 or $a1
}

rule Armadillov260b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C }

condition:
		$a0 at pe.entry_point
}

rule Armadillov260b1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC }

condition:
		$a0 at pe.entry_point
}

rule ExeLockerv10IonIce {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV10betaap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

condition:
		$a0 at pe.entry_point
}

rule PellesC300400450EXEX86CRTDLL {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB }

condition:
		$a0 at pe.entry_point
}

rule BeRoEXEPackerv100LZBRRBeRoFarbrausch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov190a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4Modified {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule APatchGUIv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 31 C0 E8 FF FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule ExeSafeguardv10simonzh {
      meta:
		author="malware-lu"
strings:
		$a0 = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }

condition:
		$a0
}

rule PseudoSigner01CDCopsIIAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeVIRUSIWormHybrisFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1322ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04 }

condition:
		$a0 at pe.entry_point
}

rule PrivateEXEProtector20SetiSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF }

condition:
		$a0
}

rule NTkrnlSecureSuite01015DLLNTkrnlSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 }

condition:
		$a0
}

rule UPXHiTv001DJSiba {
      meta:
		author="malware-lu"
strings:
		$a0 = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }

condition:
		$a0
}

rule Vpackerttui {
      meta:
		author="malware-lu"
strings:
		$a0 = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }

condition:
		$a0
}

rule IProtect10FxlibdllmodebyFuXdas {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02DxPack10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SecureEXE30ZipWorx {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorv12CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
	$a1 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
	$a2 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }

condition:
		$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule NullsoftPIMPInstallSystemv13x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD }

condition:
		$a0 at pe.entry_point
}

rule Enigmaprotector110111VladimirSukhov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
	$a1 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A }

condition:
		$a0 or $a1
}

rule PECompactv140b5v140b6 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }

condition:
		$a0 at pe.entry_point
}

rule VxExplosion1000 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }

condition:
		$a0 at pe.entry_point
}

rule PKZIPSFXv11198990 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }

condition:
		$a0 at pe.entry_point
}

rule PEBundlev20b5v23 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD }

condition:
		$a0 at pe.entry_point
}

rule PUNiSHERV15DemoFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule HACKSTOPv110v111 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1336ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 }

condition:
		$a0
}

rule DualseXeEncryptor10bDual {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50 }

condition:
		$a0 at pe.entry_point
}

rule MarjinZEXEScramblerSEbyMarjinZ {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3 }

condition:
		$a0
}

rule nPack111502006BetaNEOx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }

condition:
		$a0 at pe.entry_point
}

rule DingBoysPElockPhantasmv15b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }

condition:
		$a0 at pe.entry_point
}

rule ShellModify01pll621 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MacromediaFlashProjector60Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }

condition:
		$a0 at pe.entry_point
}

rule Packman0001Bubbasoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }

condition:
		$a0
}

rule aPackv098bDSESnotsaved {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }

condition:
		$a0
}

rule ASProtectvIfyouknowthisversionpostonPEiDboardh2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule Aluwainv809 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC 1E E8 ?? ?? 9D 5E }

condition:
		$a0 at pe.entry_point
}

rule AntiDote12DLLDemoSISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }

condition:
		$a0
}

rule MSLRHv032afakeMicrosoftVisualCemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule SoftwareCompressV12BGSoftwareProtectTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }

condition:
		$a0 at pe.entry_point
}

rule Themida1201OreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }

condition:
		$a0
}

rule PECompactv126b1v126b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }

condition:
		$a0 at pe.entry_point
}

rule Cruncherv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB }

condition:
		$a0 at pe.entry_point
}

rule AntiDote1214SEDLLSISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }

condition:
		$a0 at pe.entry_point
}

rule ASProtectSKE21xexeAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule DBPEv210DingBoy {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }

condition:
		$a0 at pe.entry_point
}

rule NsPacKV37LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule tElock099tE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 }

condition:
		$a0 at pe.entry_point
}

rule WinZipSelfExtractor22personaleditionWinZipComputing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }

condition:
		$a0 at pe.entry_point
}

rule ZipWorxSecureEXEv25ZipWORXTechnologiesLLC {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117iBoxaPLibAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }

condition:
		$a0 at pe.entry_point
}

rule Alloyv1x2000 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B }

condition:
		$a0 at pe.entry_point
}

rule FreeJoiner153Stubengine171GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02MicrosoftVisualC70DLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }

condition:
		$a0 at pe.entry_point
}

rule EYouDiDaiYueHeiFengGao {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptorV21Xsoftcompletecom {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
	$a1 = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule PCShrinkerv045 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorV1033AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }

condition:
		$a0 at pe.entry_point
}

rule SoftSentryv211 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 50 }

condition:
		$a0 at pe.entry_point
}

rule FSGv120EngdulekxtBorlandDelphiBorlandC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeStonesPEEncryptor20FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov300 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv11Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 }
	$a1 = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 or $a1
}

rule Fusion10jaNooNi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }

condition:
		$a0 at pe.entry_point
}

rule UpxLock1012CyberDoomTeamXBoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }

condition:
		$a0 at pe.entry_point
}

rule PCPEEncryptorAlphapreview {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }

condition:
		$a0 at pe.entry_point
}

rule VxKeypress1212 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }

condition:
		$a0 at pe.entry_point
}

rule SoftwareCompressv12BGSoftwareProtectTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }

condition:
		$a0 at pe.entry_point
}

rule NsPackV14LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }

condition:
		$a0 at pe.entry_point
}

rule VProtectorV11Avcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1300ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00 }

condition:
		$a0 at pe.entry_point
}

rule XXPack01bagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3 }

condition:
		$a0 at pe.entry_point
}

rule ExeLocker10IonIce {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorV101AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv2001AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 72 05 00 00 EB 4C }

condition:
		$a0 at pe.entry_point
}

rule USERNAMEv300 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }

condition:
		$a0 at pe.entry_point
}

rule nSpackV2xLiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }

condition:
		$a0
}

rule GameGuardv20065xxdllsignbyhot_UNP {
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00 }

condition:
		$a0 at pe.entry_point
}

rule Upack_PatchoranyVersionDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 }

condition:
		$a0 at pe.entry_point
}

rule PCPECalpha {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4Unextractable {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule Escargot01finalMeat {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 }

condition:
		$a0 at pe.entry_point
}

rule MetrowerksCodeWarriorv20GUI {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }

condition:
		$a0
}

rule UnnamedScrambler21Beta211p0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }

condition:
		$a0
}

rule NoodleCryptv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
	$a1 = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 }

condition:
		$a0 at pe.entry_point or $a1
}

rule PoPa001PackeronPascalbagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF }

condition:
		$a0 at pe.entry_point
}

rule BlindSpot10s134k {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50 }

condition:
		$a0
}

rule GamehouseMediaProtectorVersionUnknown {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule tElockv042 {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv274WebToolMaster {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D }

condition:
		$a0 at pe.entry_point
}

rule EXEManagerVersion301994cSolarDesigner {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }

condition:
		$a0 at pe.entry_point
}

rule Upackv02BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }

condition:
		$a0 at pe.entry_point
}

rule DEFv100Engbartxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule AnslymCrypter {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3 }

condition:
		$a0 at pe.entry_point
}

rule ARMProtectorv02SMoKE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }

condition:
		$a0 at pe.entry_point
}

rule CrypKeyV56XDLLKenonicControlsLtd {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule PEiDBundlev102v104BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}

rule VxHeloween1172 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D }

condition:
		$a0 at pe.entry_point
}

rule PackedwithPKLITEv150withCRCcheck1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 }

condition:
		$a0 at pe.entry_point
}

rule Pe123v2006412 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }

condition:
		$a0 at pe.entry_point
}

rule DropperCreatorV01Conflict {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 }

condition:
		$a0
}

rule XCRv013 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }

condition:
		$a0 at pe.entry_point
}

rule XCRv012 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D }

condition:
		$a0 at pe.entry_point
}

rule InnoSetupModulev129 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov3xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }

condition:
		$a0 at pe.entry_point
}

rule dUP2xPatcherwwwdiablo2oo2cjbnet {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 }

condition:
		$a0
}

rule PseudoSigner02PEProtect09Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }

condition:
		$a0 at pe.entry_point
}

rule pscrambler12byp0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor2223compressedcodewwwstrongbitcom {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
	$a1 = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3 }

condition:
		$a0 or $a1
}

rule Armadillov265b1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117aPLibAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }

condition:
		$a0 at pe.entry_point
}

rule PolyCryptPE214b215JLabSoftwareCreationshoep {
      meta:
		author="malware-lu"
strings:
		$a0 = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }

condition:
		$a0
}

rule yodasProtector10xAshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule Upack_UnknownDLLDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }

condition:
		$a0 at pe.entry_point
}

rule AINEXEv21 {
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }

condition:
		$a0 at pe.entry_point
}

rule AppProtectorSilentTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }

condition:
		$a0 at pe.entry_point
}

rule RODHighTECHAyman {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ICrypt10byBuGGz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65 }

condition:
		$a0 at pe.entry_point
}

rule PEPackv099 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV115V117LZMA430ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14 }

condition:
		$a0 at pe.entry_point
}

rule VxQuake518 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4UnextractableVirusShield {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium13013ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV130XObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }

condition:
		$a0 at pe.entry_point
}

rule MetrowerksCodeWarriorv20Console {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }

condition:
		$a0
}

rule PESpinv07Cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}

rule SimpleUPXCryptorV3042005MANtiCORE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 }

condition:
		$a0 at pe.entry_point
}

rule WinRAR32bitSFXModule {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF }

condition:
		$a0 at pe.entry_point
}

rule iPBProtect013017forgot {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeASPack211demadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule Upackv036alphaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }

condition:
		$a0
}

rule CrinklerV03V04RuneLHStubbeandAskeSimonChristensen {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 42 00 31 DB 43 EB 58 }

condition:
		$a0 at pe.entry_point
}

rule DingBoysPElockPhantasmv10v11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }

condition:
		$a0 at pe.entry_point
}

rule PECompactV2XBitsumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }

condition:
		$a0 at pe.entry_point
}

rule CRYPTVersion17cDismember {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }

condition:
		$a0 at pe.entry_point
}

rule VxXPEH4768 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }

condition:
		$a0 at pe.entry_point
}

rule PECrypt32v102 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PESHiELD025Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }

condition:
		$a0 at pe.entry_point
}

rule NETDLLMicrosoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25 }

condition:
		$a0
}

rule MSLRH: Packer PEiD {
      meta:
		author="malware-lu"
        note="Added some checks"
strings:
		$a0 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 }
        $b = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
        $c = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }

condition:
		for any of ($*) : ( $ at pe.entry_point )
}

rule BeRoEXEPackerv100DLLLZMABeRoFarbrausch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02ExeSmasherAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV125ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv107bDLLAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 }

condition:
		$a0 at pe.entry_point
}

rule MicroJoiner17coban2k {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeVOBProtectCDFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F }

condition:
		$a0 at pe.entry_point
}

rule CelsiusCrypt21Z3r0 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }
	$a1 = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }

condition:
		$a0 at pe.entry_point or $a1
}

rule Armadillov260 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov261 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeASPack212emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule RatPackerGluestub {
      meta:
		author="malware-lu"
strings:
		$a0 = { 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF }

condition:
		$a0 at pe.entry_point
}

rule CreateInstallv200335 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }

condition:
		$a0
}

rule SPECb3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }

condition:
		$a0 at pe.entry_point
}

rule SPECb2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }

condition:
		$a0 at pe.entry_point
}

rule UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}

rule PseudoSigner01MicrosoftVisualBasic5060Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule UPXModifiedStubbFarbrauschConsumerConsulting {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC }

condition:
		$a0 at pe.entry_point
}

rule E2CbyDoP {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3 }

condition:
		$a0 at pe.entry_point
}

rule SVKProtectorv111 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }

condition:
		$a0 at pe.entry_point
}

rule PCShrinkerv071 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }

condition:
		$a0 at pe.entry_point
}

rule Petite21 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }

condition:
		$a0
}

rule BeRoEXEPackerv100DLLLZBRRBeRoFarbrausch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }

condition:
		$a0 at pe.entry_point
}

rule hmimysPackerV12hmimys {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 95 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 ?? ?? ?? ?? E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 ?? ?? ?? ?? 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3 }

condition:
		$a0 at pe.entry_point
}

rule EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PureBasicDLLNeilHodgson {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8 }

condition:
		$a0 at pe.entry_point
}

rule HPA {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov310 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }

condition:
		$a0 at pe.entry_point
}

rule Upack012betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1 }

condition:
		$a0 at pe.entry_point
}

rule VxNcuLi1688 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }

condition:
		$a0 at pe.entry_point
}

rule VProtectorvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C }
	$a1 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00 }
	$a2 = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 }

condition:
		$a0 or $a1 or $a2
}

rule XPackv142 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3 }

condition:
		$a0
}

rule W32JeefoPEFileInfector {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }

condition:
		$a0 at pe.entry_point
}

rule ExeSplitter13SplitCryptMethodBillPrisonerTPOC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
	$a1 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule AntiDote12BetaDemoSISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv211bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor224StrongbitSoftCompleteDevelopmenth1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor224StrongbitSoftCompleteDevelopmenth2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor224StrongbitSoftCompleteDevelopmenth3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0
}

rule ProActivateV10XTurboPowerSoftwareCompany {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33 }

condition:
		$a0 at pe.entry_point
}

rule PackMasterv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
	$a1 = { 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule DBPEv153 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA }

condition:
		$a0 at pe.entry_point
}

rule FreeJoiner152Stubengine16GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv12AlexeySolodovnikovh1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 }

condition:
		$a0
}

rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }

condition:
		$a0 at pe.entry_point
}

rule PENightMare2Beta {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

condition:
		$a0 at pe.entry_point
}

rule MinGWGCC3x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55 }

condition:
		$a0 at pe.entry_point
}

rule PIRITv15 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }

condition:
		$a0 at pe.entry_point
}

rule Reg2Exe224byJanVorel {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }

condition:
		$a0 at pe.entry_point
}

rule SVKProtectorv13xEngPavolCerven {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded2609Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }

condition:
		$a0 at pe.entry_point
}

rule UPXcrypterarchphaseNWC {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule StarForceProtectionDriverProtectionTechnology {
      meta:
		author="malware-lu"
strings:
		$a0 = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule FishPEV10Xhellfish {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PECrypter {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D EB 26 }

condition:
		$a0 at pe.entry_point
}

rule tElockv051 {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

condition:
		$a0 at pe.entry_point
}

rule LY_WGKXwwwszleyucom {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 79 46 75 6E 00 62 73 }

condition:
		$a0
}

rule ASProtect13321RegisteredAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV111ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualC4xLCCWin321x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }

condition:
		$a0 at pe.entry_point
}

rule dePACKdeNULL {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 }
	$a1 = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule EXECryptorv1401 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakePELockNT204emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule PELockNTv203 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule Reg2Exe220221byJanVorel {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8 }

condition:
		$a0 at pe.entry_point
}

rule PELockNTv201 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD }

condition:
		$a0 at pe.entry_point
}

rule PELockNTv204 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3 }

condition:
		$a0 at pe.entry_point
}

rule UPXFreakv01BorlandDelphiHMX0101 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 }
	$a1 = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Obsidium13017Obsidiumsoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }

condition:
		$a0 at pe.entry_point
}

rule Petite22c199899IanLuck {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }

condition:
		$a0 at pe.entry_point
}

rule PluginToExev101BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00 }

condition:
		$a0 at pe.entry_point
}

rule Enigmaprotector110unregistered {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
	$a1 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35 }

condition:
		$a0 or $a1
}

rule Obsidium1341ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule WebCopsDLLLINKDataSecurity {
      meta:
		author="malware-lu"
strings:
		$a0 = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PackMaster10PEXCloneAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule Upackv037v038BetaStripbaserelocationtableOptionDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }

condition:
		$a0
}

rule AHTeamEPProtector03fakeSVKP13xFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 }

condition:
		$a0 at pe.entry_point
}

rule InstallShieldCustom {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }

condition:
		$a0 at pe.entry_point
}

rule Petitevafterv14 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }

condition:
		$a0 at pe.entry_point
}

rule ExeToolsv21EncruptorbyDISMEMBER {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74 }

condition:
		$a0 at pe.entry_point
}

rule NTkrnlSecureSuiteNTkrnlteam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }

condition:
		$a0
}

rule PESpinv0b {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }

condition:
		$a0 at pe.entry_point
}

rule VXTibsZhelatinStormWormvariant {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakePEX099emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule NSPack3xLiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv25RetailBitsumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0 at pe.entry_point
}

rule WARNINGTROJANXiaoHui {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 }

condition:
		$a0 at pe.entry_point
}

rule NFOv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }

condition:
		$a0 at pe.entry_point
}

rule PMODEWv112116121133DOSextender {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4 }

condition:
		$a0 at pe.entry_point
}

rule AaseCrypterbysantasdad {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF }

condition:
		$a0
}

rule aPackv098bJibz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }

condition:
		$a0
}

rule UPackv011Dwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }

condition:
		$a0
}

rule NsPacKNetLiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }

condition:
		$a0
}

rule PseudoSigner02PENightMare2BetaAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule DJoinv07publicRC4encryptiondrmist {
      meta:
		author="malware-lu"
strings:
		$a0 = { C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule UPXv103v104 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }

condition:
		$a0 at pe.entry_point
}

rule PEDiminisherV01Teraphy {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4ExtrPasswcheckVirshield {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule ExeGuarderv18Exeiconcom {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }

condition:
		$a0 at pe.entry_point
}

rule codeCrypter031Tibbar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }

condition:
		$a0 at pe.entry_point
}

rule RLPv073betaap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }

condition:
		$a0
}

rule PEnguinCryptv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 }

condition:
		$a0 at pe.entry_point
}

rule MetrowerksCodeWarriorDLLv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }

condition:
		$a0
}

rule PECrc32088ZhouJinYu {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv123b3v1241 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 }

condition:
		$a0 at pe.entry_point
}

rule Noodlecrypt2rsc {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 76 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPack120BasicEditionLZMAAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PENightMare2BetaAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeXtremeProtector105FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule RLPackv118BasicDLLLZMAAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

condition:
		$a0 at pe.entry_point
}

rule CrypKeyv5v6 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }

condition:
		$a0 at pe.entry_point
}

rule InnoSetupModulev109a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV1300ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 }
	$a1 = { EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PCryptv351 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded2312Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4Extractable {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule RLPackAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A }
	$a1 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A }
	$a2 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
	$a3 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A }
	$a4 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A }
	$a5 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point or $a5 at pe.entry_point
}

rule PseudoSigner02VOBProtectCD5Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PESpinv04x {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B }

condition:
		$a0
}

rule PseudoSigner02WatcomCCDLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }

condition:
		$a0 at pe.entry_point
}

rule yodasCrypter13AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

condition:
		$a0 at pe.entry_point
}

rule D1NS1GD1N {
      meta:
		author="malware-lu"
strings:
		$a0 = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule FSGv110EngdulekxtMicrosoftVisualC6070ASM {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv102aAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MinGWGCC2xAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov253 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
	$a1 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Armadillov252 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 }
	$a1 = { 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Armadillov251 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov250 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1331ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule CExev10a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }

condition:
		$a0 at pe.entry_point
}

rule DIETv144v145f {
      meta:
		author="malware-lu"
strings:
		$a0 = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv098 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv099 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }

condition:
		$a0 at pe.entry_point
}

rule NsPacKV30LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualBasic5060 {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv090 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv092 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv094 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }

condition:
		$a0 at pe.entry_point
}

rule PeX099bartCrackPl {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV1304ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SoftwareCompressv14LITEBGSoftwareProtectTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
	$a1 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule FixupPakv120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }

condition:
		$a0 at pe.entry_point
}

rule ARCSFXArchive {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }

condition:
		$a0 at pe.entry_point
}

rule MoleBoxv230Teggo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC }

condition:
		$a0
}

rule VxIgor {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }

condition:
		$a0 at pe.entry_point
}

rule FACRYPTv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01WATCOMCCEXEAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 90 90 90 90 57 41 E9 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV115V117aPlib043ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

condition:
		$a0 at pe.entry_point
}

rule EmbedPEv113cyclotron {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 }

condition:
		$a0 at pe.entry_point
}

rule eXcaliburv103forgotus {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 }

condition:
		$a0 at pe.entry_point
}

rule Petite14 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }

condition:
		$a0
}

rule Petite12 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }

condition:
		$a0 at pe.entry_point
}

rule Petite13 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 }

condition:
		$a0
}

rule Upack021betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }

condition:
		$a0 at pe.entry_point
}

rule WebCopsEXELINKDataSecurity {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02FSG10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }

condition:
		$a0 at pe.entry_point
}

rule ThemidaOreansTechnologies2004 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 }

condition:
		$a0 at pe.entry_point
}

rule VxNumberOne {
      meta:
		author="malware-lu"
strings:
		$a0 = { F9 07 3C 53 6D 69 6C 65 3E E8 }

condition:
		$a0 at pe.entry_point
}

rule WinKriptv10MrCrimson {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule tElockv085f {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02 }

condition:
		$a0 at pe.entry_point
}

rule RosAsm2050aBetov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00 }

condition:
		$a0
}

rule Obsidium13021ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv211dAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv211cAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ACProtect14xRISCOsoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 }

condition:
		$a0
}

rule SplashBitmapv100BoBBobsoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00 }

condition:
		$a0 at pe.entry_point
}

rule PEZipv10byBaGIE {
      meta:
		author="malware-lu"
strings:
		$a0 = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }

condition:
		$a0
}

rule LamerStopv10ccStefanEsser {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }

condition:
		$a0 at pe.entry_point
}

rule ACProtectV14Xrisco {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 7C 83 04 24 06 C3 }

condition:
		$a0 at pe.entry_point
}

rule VxGRUNT2Family {
      meta:
		author="malware-lu"
strings:
		$a0 = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeMicrosoftVisualC70FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3 }

condition:
		$a0 at pe.entry_point
}

rule InstallStub32bit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29 }

condition:
		$a0 at pe.entry_point
}

rule VcasmProtector10evcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakePEBundle20x24xemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule Armadillov190b4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule UPXv103v104Modified {
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF }

condition:
		$a0 at pe.entry_point
}

rule NsPackV2XLiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6E 73 70 61 63 6B 24 40 }

condition:
		$a0
}

rule ThemidaWinLicenseV1000V1800OreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PACKWINv101p {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63 }

condition:
		$a0 at pe.entry_point
}

rule MicroJoiner15coban2k {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule ANDpakk2018byDmitryANDAndreev {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b5 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }

condition:
		$a0 at pe.entry_point
}

rule NJoy10NEX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b7 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b6 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 }

condition:
		$a0 at pe.entry_point
}

rule KBysPacker028BetaShoooo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }

condition:
		$a0
}

rule nPack113002006BetaNEOx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02BorlandC1999Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv100bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }

condition:
		$a0 at pe.entry_point
}

rule SEAAXEv22 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5 }

condition:
		$a0 at pe.entry_point
}

rule PureBasic4xDLLNeilHodgson {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }

condition:
		$a0 at pe.entry_point
}

rule EXEPackerv70byTurboPowerSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE }

condition:
		$a0 at pe.entry_point
}

rule VxSYP {
      meta:
		author="malware-lu"
strings:
		$a0 = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }

condition:
		$a0 at pe.entry_point
}

rule DSHIELD: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E }

condition:
		$a0 at pe.entry_point
}

rule kkrunchy023alphaRyd {
      meta:
		author="malware-lu"
strings:
		$a0 = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0 }

condition:
		$a0 at pe.entry_point
}

rule NJoy12NEX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

rule AntiDote12DemoSISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B }

condition:
		$a0
}

rule EXE32Packv137 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }

condition:
		$a0 at pe.entry_point
}

rule EXE32Packv136 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }

condition:
		$a0 at pe.entry_point
}

rule AINEXEv230 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded20XJitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptorv151x {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

condition:
		$a0 at pe.entry_point
}

rule Obsidiumv1304ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
	$a1 = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule CopyProtectorv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }

condition:
		$a0 at pe.entry_point
}

rule EXE32Packv139 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 }

condition:
		$a0 at pe.entry_point
}

rule EXE32Packv138 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtBorlandC1999 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded2547V2600Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }

condition:
		$a0 at pe.entry_point
}

rule FSGv131Engdulekxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }

condition:
		$a0 at pe.entry_point
}

rule SDProtectorBasicProEdition110RandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }

condition:
		$a0 at pe.entry_point
}

rule Petite12c1998IanLuck {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }

condition:
		$a0 at pe.entry_point
}

rule PcSharev40 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 }

condition:
		$a0 at pe.entry_point
}

rule VProtector0X12Xvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }

condition:
		$a0
}

rule STNPEE113 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }

condition:
		$a0 at pe.entry_point
}

rule SoftDefenderV11xRandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }

condition:
		$a0 at pe.entry_point
}

rule CDCopsII {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }

condition:
		$a0 at pe.entry_point
}

rule RLPack11BasicEditionap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }

condition:
		$a0 at pe.entry_point
}

rule EXE32Packv13x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED }

condition:
		$a0 at pe.entry_point
}

rule VxInvoluntary1349 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }

condition:
		$a0 at pe.entry_point
}

rule WinZip32bit6x {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }

condition:
		$a0 at pe.entry_point
}

rule NsPacKV36LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02LCCWin321xAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }

condition:
		$a0 at pe.entry_point
}

rule EXECrypt10ReBirth {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }

condition:
		$a0 at pe.entry_point
}

rule NJoy11NEX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PEcryptbyarchphase {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF }

condition:
		$a0 at pe.entry_point
}

rule CrunchPEv30xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74 }

condition:
		$a0 at pe.entry_point
}

rule LameCryptLaZaRus {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0 }

condition:
		$a0 at pe.entry_point
}

rule NsPack29NorthStar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

condition:
		$a0 at pe.entry_point
}

rule BeRoEXEPackerv100LZBRSBeRoFarbrausch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtBorlandC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }
	$a1 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule VIRUSIWormKLEZ {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }

condition:
		$a0
}

rule YZPack12UsAr {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02LocklessIntroPackAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }

condition:
		$a0 at pe.entry_point
}

rule PKLITE3211 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }

condition:
		$a0 at pe.entry_point
}

rule FSGv20bartxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeSVKP111emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMASM32TASM32MicrosoftVisualBasic {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor239DLLminimumprotection {
      meta:
		author="malware-lu"
strings:
		$a0 = { 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87 }

condition:
		$a0 at pe.entry_point
}

rule Frusionbiff {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 }

condition:
		$a0 at pe.entry_point
}

rule OpenSourceCodeCrypterp0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00 }

condition:
		$a0
}

rule QrYPt0rbyNuTraL {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01 }
	$a1 = { 86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3 }
	$a2 = { EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04 }

condition:
		$a0 or $a1 or $a2 at pe.entry_point
}

rule EXECryptor2xxmaxcompressedresources {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }

condition:
		$a0
}

rule Upackv024v028AlphaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded24222428Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }

condition:
		$a0 at pe.entry_point
}

rule SVKProtectorv1051 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeZCode101FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 }

condition:
		$a0 at pe.entry_point
}

rule PEPacker {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 }

condition:
		$a0 at pe.entry_point
}

rule ProgramProtectorXPv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50 }

condition:
		$a0 at pe.entry_point
}

rule SimplePack111Method2NTbagieTMX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032aemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
	$a1 = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
	$a2 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C }

condition:
		$a0 or $a1 or $a2 at pe.entry_point
}

rule VxHafen1641 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }

condition:
		$a0 at pe.entry_point
}

rule NativeUDPacker11ModdedPoisonIvyShellcodeokkixot {
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor2xxcompressedresources {
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }

condition:
		$a0
}

rule NXPEPackerv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00 }

condition:
		$a0 at pe.entry_point
}

rule PolyBoxCAnskya {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }

condition:
		$a0
}

rule UPolyXv05 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a1 = { 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
	$a2 = { BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a3 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a4 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a5 = { EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 or $a1 or $a2 or $a3 or $a4 or $a5
}

rule beriav007publicWIPsymbiont {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }

condition:
		$a0 at pe.entry_point
}

rule PCGuardv405dv410dv415d {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 }

condition:
		$a0 at pe.entry_point
}

rule asscrypterbysantasdad {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45 }

condition:
		$a0 at pe.entry_point
}

rule CopyControlv303 {
      meta:
		author="malware-lu"
strings:
		$a0 = { CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C }

condition:
		$a0 at pe.entry_point
}

rule FSGv110Engbartxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }

condition:
		$a0 at pe.entry_point
}

rule Elanguage {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }

condition:
		$a0 at pe.entry_point
}

rule EXELOCK66615 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }

condition:
		$a0 at pe.entry_point
}

rule AdysGluev010 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }

condition:
		$a0 at pe.entry_point
}

rule SVKProtectorv132 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv114v115v1203 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }

condition:
		$a0 at pe.entry_point
}

rule SafeGuardV10Xsimonzh2000 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1 }

condition:
		$a0 at pe.entry_point
}

rule PEiDBundlev102v103DLLBoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule FreeJoinerSmallbuild023GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PrivatePersonalPackerPPP102ConquestOfTroycom {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }

condition:
		$a0
}

rule DIETv102bv110av120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}

rule UPXECLiPSElayer {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1334ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 }
	$a1 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PKLITEv150Devicedrivercompression {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }

condition:
		$a0 at pe.entry_point
}

rule VxGrazie883 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }

condition:
		$a0 at pe.entry_point
}

rule PROTECTEXECOMv60 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule ENIGMAProtectorSukhovVladimir {
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }

condition:
		$a0
}

rule CRYPToCRACksPEProtectorV093LukasFleischer {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv147v150 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 }

condition:
		$a0 at pe.entry_point
}

rule PocketPCMIB {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4ExtractableVirusShield {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule VxNoon1163 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }

condition:
		$a0 at pe.entry_point
}

rule PuNkMoD1xPuNkDuDe {
      meta:
		author="malware-lu"
strings:
		$a0 = { 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C }

condition:
		$a0
}

rule PECrypt32Consolev10v101v102 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

condition:
		$a0 at pe.entry_point
}

rule InnoSetupModulev2018 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }

condition:
		$a0
}

rule Nakedbind10nakedcrew {
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }

condition:
		$a0 at pe.entry_point
}

rule NsPacKV31LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }

condition:
		$a0 at pe.entry_point
}

rule AntiVirusVaccinev103 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }

condition:
		$a0 at pe.entry_point
}

rule VxKuku448 {
      meta:
		author="malware-lu"
strings:
		$a0 = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv12xNewStrain {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }

condition:
		$a0 at pe.entry_point
}

rule AntiDote10Demo12SISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }

condition:
		$a0
}

rule FSGv110EngbartxtWinRARSFX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
	$a1 = { EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule BJFntv11b {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded26202623Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SLVc0deProtector11xSLVICU {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule RJoinerbyVaskaSignfrompinch250320071700 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 }

condition:
		$a0 at pe.entry_point
}

rule AverCryptor10os1r1s {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }

condition:
		$a0 at pe.entry_point
}

rule nSpackV23LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 70 61 63 6B 24 40 }

condition:
		$a0
}

rule SENDebugProtector {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8 }

condition:
		$a0 at pe.entry_point
}

rule xPEP03xxIkUg {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 53 56 51 52 57 E8 16 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule AntiDote14SESISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }

condition:
		$a0 at pe.entry_point
}

rule NsPack30NorthStar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

condition:
		$a0 at pe.entry_point
}

rule ORiENV212FisunAV {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5D 01 00 00 CE D1 CE CD 0D }

condition:
		$a0 at pe.entry_point
}

rule NsPackv23NorthStar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
	$a1 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }

condition:
		$a0 or $a1
}

rule ObsidiumV1342ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SplashBitmapv100WithUnpackCodeBoBBobsoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40 }

condition:
		$a0 at pe.entry_point
}

rule KBySV028shoooo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV12XObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

condition:
		$a0 at pe.entry_point
}

rule NsPackV13LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PENinja131Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }

condition:
		$a0 at pe.entry_point
}

rule Obsidiumv1300ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
	$a1 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Feokt {
      meta:
		author="malware-lu"
strings:
		$a0 = { 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule NTkrnlSecureSuite01015NTkrnlSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }

condition:
		$a0
}

rule PEPROTECT09 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

condition:
		$a0 at pe.entry_point
}

rule EXERefactorV01random {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }

condition:
		$a0 at pe.entry_point
}

rule CrunchPEv40 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

condition:
		$a0
}

rule NullsoftPIMPInstallSystemv1x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule Pohernah100byKas {
      meta:
		author="malware-lu"
strings:
		$a0 = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }

condition:
		$a0 at pe.entry_point
}

rule dUP2diablo2oo2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01ASPack2xxHeuristicAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }

condition:
		$a0 at pe.entry_point
}

rule eXpressorv145CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C }

condition:
		$a0 at pe.entry_point
}

rule hmimysProtectv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 }
	$a1 = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1
}

rule VProtectorV10Evcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01LCCWin32DLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }

condition:
		$a0 at pe.entry_point
}

rule CodeCryptv014b {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

condition:
		$a0 at pe.entry_point
}

rule PellesC450DLLX86CRTLIB {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75 }

condition:
		$a0 at pe.entry_point
}

rule EEXEVersion112 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }

condition:
		$a0 at pe.entry_point
}

rule FSGv120EngdulekxtMASM32TASM32 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }

condition:
		$a0 at pe.entry_point
}

rule PEDiminisherv01Teraphy {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02VBOX43MTEAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }

condition:
		$a0 at pe.entry_point
}

rule SEAAXE {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3 }

condition:
		$a0 at pe.entry_point
}

rule UpackV010V011Dwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakePCGuard403415FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule SimplePack111Method1bagieTMX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
	$a1 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule MASM32: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20 }

condition:
		$a0 at pe.entry_point
}

rule SoftDefenderv10v11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8 }

condition:
		$a0 at pe.entry_point
}

rule XtremeProtectorv106 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }

condition:
		$a0 at pe.entry_point
}

rule VcasmProtector1112vcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D }

condition:
		$a0 at pe.entry_point
}

rule Obsidiumv1111 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 E7 1C 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxEddie1530 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }

condition:
		$a0 at pe.entry_point
}

rule KBySV028DLLshoooo {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PEncrypt10JunkCode {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }

condition:
		$a0 at pe.entry_point
}

rule PEPasswordv02SMTSMF {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }

condition:
		$a0 at pe.entry_point
}

rule EncryptPE22006710220061025WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv16Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 D0 68 ?? ?? ?? ?? FF D2 }
	$a1 = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PEPaCKv10CCopyright1998byANAKiN {
      meta:
		author="malware-lu"
strings:
		$a0 = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }

condition:
		$a0
}

rule YodasProtectorv1032Beta2AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxMTEnonencrypted {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01FSG131Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv212AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
	$a1 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Upack022023betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
	$a1 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
	$a2 = { AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

condition:
		$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule PseudoSigner01CodeLockAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv100c1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakenSPack13emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv100c2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90 }

condition:
		$a0 at pe.entry_point
}

rule kkrunchyv017FGiesen {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC FF 4D 08 31 D2 8D 7D 30 BE }

condition:
		$a0
}

rule ACProtectv190gRiscosoftwareInc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }

condition:
		$a0 at pe.entry_point
}

rule UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium133720070623ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv2000AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 70 05 00 00 EB 4C }

condition:
		$a0 at pe.entry_point
}

rule Armadillov4000053SiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov160a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule ACProtectUltraProtect10X20XRiSco {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }

condition:
		$a0
}

rule Thinstall3035Jtit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PENinjav10DzAkRAkerTNT {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded19XJitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptorv13045 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 }
	$a1 = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Obsidium1338ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPV073betaap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }

condition:
		$a0
}

rule yCv13byAshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

condition:
		$a0
}

rule PCPECalphapreview {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }

condition:
		$a0 at pe.entry_point
}

rule AlexProtectorv10Alex {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B }

condition:
		$a0 at pe.entry_point
}

rule Shrinkv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3 }

condition:
		$a0 at pe.entry_point
}

rule AHPack01FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00 }

condition:
		$a0 at pe.entry_point
}

rule SentinelSuperProAutomaticProtectionv640Safenet {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 }

condition:
		$a0 at pe.entry_point
}

rule DxPack10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 }

condition:
		$a0 at pe.entry_point
}

rule Pohernah103byKas {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV1258ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule nPackv11150200BetaNEOx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PerlApp602ActiveState {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55 }
	$a1 = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }

condition:
		$a0 or $a1
}

rule UPXProtectorv10x2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }

condition:
		$a0
}

rule ThinstallEmbedded2501Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }

condition:
		$a0 at pe.entry_point
}

rule CodeVirtualizer1310OreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC }

condition:
		$a0
}

rule VProtector13Xvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
	$a1 = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule Packman0001bubba {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SimplePackV11XV12XMethod1bagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }

condition:
		$a0 at pe.entry_point
}

rule PEEncryptv40bJunkCode {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 ?? ?? 00 66 83 ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule PEQuake006forgat {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 }

condition:
		$a0
}

rule Kryptonv02 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakePELockNT204FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB }

condition:
		$a0 at pe.entry_point
}

rule eXPressorPacK150XCGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }

condition:
		$a0 at pe.entry_point
}

rule D1S1Gv11BetaScrambledEXED1N {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B }

condition:
		$a0
}

rule ReversingLabsProtector074betaAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 00 41 00 E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule ACProtect109gRiscosoftwareInc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }

condition:
		$a0 at pe.entry_point
}

rule NorthStarPEShrinker13Liuxingping {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorV13CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 }

condition:
		$a0 at pe.entry_point
}

rule FreeJoinerSmallbuild035GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule Upack020betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 }

condition:
		$a0 at pe.entry_point
}

rule UPX20030XMarkusOberhumerLaszloMolnarJohnReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}

rule WinUpackv039finalByDwingc2005h1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule UnnamedScrambler12Bp0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8 }

condition:
		$a0
}

rule Upack010012betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }

condition:
		$a0 at pe.entry_point
}

rule PEArmorV07Xhying {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }

condition:
		$a0 at pe.entry_point
}

rule LauncherGeneratorv103 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }

condition:
		$a0
}

rule yodasProtector102103AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 }

condition:
		$a0 at pe.entry_point
}

rule NakedPacker10byBigBoote {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }

condition:
		$a0
}

rule tElockv080 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 F9 11 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01YodasProtector102Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 90 90 E9 }

condition:
		$a0 at pe.entry_point
}

rule VProtector11Xvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMASM32 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }

condition:
		$a0 at pe.entry_point
}

rule Pohernah102byKas {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

condition:
		$a0 at pe.entry_point
}

rule ActiveMARK5xTrymediaSystemsInc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }

condition:
		$a0
}

rule RCryptorv20HideEPVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov172v173 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule AsCryptv01SToRM2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2 }

condition:
		$a0
}

rule AsCryptv01SToRM3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2 }

condition:
		$a0
}

rule ASProtectV2XDLLAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD }

condition:
		$a0 at pe.entry_point
}

rule AsCryptv01SToRM4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2 }

condition:
		$a0
}

rule yzpack20UsAr {
      meta:
		author="malware-lu"
strings:
		$a0 = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28 }

condition:
		$a0 at pe.entry_point
}

rule PasswordprotectormySMT {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV1258V133XObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }

condition:
		$a0 at pe.entry_point
}

rule ReflexiveArcadeWrapper {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 }

condition:
		$a0 at pe.entry_point
}

rule VxTrojanTelefoon {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }

condition:
		$a0 at pe.entry_point
}

rule Upackv030betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 }

condition:
		$a0 at pe.entry_point
}

rule VxACMEClonewarMutant {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }

condition:
		$a0 at pe.entry_point
}

rule Armadillov2xxCopyMemII {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }

condition:
		$a0 at pe.entry_point
}

rule TPACKv05cm1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv271 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }

condition:
		$a0 at pe.entry_point
}

rule TPACKv05cm2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD }

condition:
		$a0 at pe.entry_point
}

rule ExeJoiner10Yodaf2f {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv101bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }

condition:
		$a0 at pe.entry_point
}

rule MacromediaWindowsFlashProjectorPlayerv30 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06 }

condition:
		$a0 at pe.entry_point
}

rule PESpinV11cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E }

condition:
		$a0 at pe.entry_point
}

rule RLPack118aPlib043ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule DotFixNiceProtectvna {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 }

condition:
		$a0 at pe.entry_point
}

rule Upackv032betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 }

condition:
		$a0 at pe.entry_point
}

rule PackItBitch10archphase {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule JDPack2xJDPack {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RPolyCryptv10personalpolycryptorsignfrompinch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }

condition:
		$a0 at pe.entry_point
}

rule Upackv031betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 }

condition:
		$a0 at pe.entry_point
}

rule Packmanv0001 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PEPack099Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor239minimumprotection {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualC60ASM {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }

condition:
		$a0 at pe.entry_point
}

rule HaspdongleAlladin {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }

condition:
		$a0 at pe.entry_point
}

rule SafeDiscv4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }

condition:
		$a0
}

rule PKLITEv112v115v1201 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv112v115v1202 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 3B C4 73 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptorv153 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

condition:
		$a0
}

rule MSLRHv032afakeEXE32Pack13xemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule eXpressorv11CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 }

condition:
		$a0 at pe.entry_point
}

rule NsPackV11LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PrivatePersonalPackerPPPv102ConquestOfTroycom {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }

condition:
		$a0 at pe.entry_point
}

rule VxHorse1776 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }

condition:
		$a0 at pe.entry_point
}

rule PEShit: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF }

condition:
		$a0 at pe.entry_point
}

rule DrWebVirusFindingEngineInSoftEDVSysteme {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }

condition:
		$a0 at pe.entry_point
}

rule PluginToExev100BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv15PrivateVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}

rule NeoLitev200 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv200bextra {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80 }

condition:
		$a0 at pe.entry_point
}

rule Crunch5Fusion4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8 }

condition:
		$a0
}

rule MSLRHv032afakePEBundle023xemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule PEMangle {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv302v302av304Relocationspack {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }

condition:
		$a0 at pe.entry_point
}

rule UPXProtectorv10x {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }

condition:
		$a0 at pe.entry_point
}

rule NorthStarPEShrinkerv13byLiuxingping {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }

condition:
		$a0
}

rule CodeCryptv015b {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117Ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF }

condition:
		$a0 at pe.entry_point
}

rule PECompactv100 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeASProtect10FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D }

condition:
		$a0 at pe.entry_point
}

rule KGCryptvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74 }

condition:
		$a0 at pe.entry_point
}

rule VxKBDflags1024 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorV102AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1311ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MicrosoftVisualC620Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }

condition:
		$a0 at pe.entry_point
}

rule MEGALITEv120a {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90 }

condition:
		$a0 at pe.entry_point
}

rule GoatsMutilatorV16Goat_e0f {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D }

condition:
		$a0 at pe.entry_point
}

rule Armadillo430aSiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }

condition:
		$a0
}

rule Upackv038betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
	$a1 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule DCryptPrivate09bdrmist {
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }

condition:
		$a0 at pe.entry_point
}

rule kkrunchyV02XRyd {
      meta:
		author="malware-lu"
strings:
		$a0 = { BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 }

condition:
		$a0 at pe.entry_point
}

rule SkDUndetectabler3NoFSG2MethodSkD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74 }

condition:
		$a0 at pe.entry_point
}

rule NTPacker10ErazerZ {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31 }

condition:
		$a0 at pe.entry_point
}

rule SexeCrypter11bysantasdad {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79 }

condition:
		$a0 at pe.entry_point
}

rule VxGotcha879 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }

condition:
		$a0 at pe.entry_point
}

rule MZ0oPE106bTaskFall {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 }
	$a1 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule SoftDefenderv11xRandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }

condition:
		$a0 at pe.entry_point
}

rule Upackv010v012BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeBorlandDelphi6070FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule STProtectorV15SilentSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }

condition:
		$a0
}

rule ASPackv105bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor226minimumprotection {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB }

condition:
		$a0 at pe.entry_point
}

rule PEProtector093CRYPToCRACk {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PellesC300400450EXEX86CRTLIB {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }

condition:
		$a0 at pe.entry_point
}

rule RLPackv118BasicaPLibAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

condition:
		$a0 at pe.entry_point
}

rule vfpexeNcV500WangJianGuo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }

condition:
		$a0 at pe.entry_point
}

rule FreeJoiner153Stubengine17GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

condition:
		$a0 at pe.entry_point
}

rule TheHypersprotectorTheHyper {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 }

condition:
		$a0 at pe.entry_point
}

rule ANDpakk2006DmitryAndreev {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }

condition:
		$a0
}

rule Thinstall2628Jtit {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
	$a1 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule UPXModifierv01x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1333ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
	$a1 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PureBasic4xNeilHodgson {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }

condition:
		$a0 at pe.entry_point
}

rule VxAugust16thIronMaiden {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }

condition:
		$a0 at pe.entry_point
}

rule VProtector10Xvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PEPACK099 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }

condition:
		$a0 at pe.entry_point
}

rule Freshbindv20gFresh {
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }

condition:
		$a0 at pe.entry_point
}

rule UPXSCRAMBLER306OnToL {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }

condition:
		$a0 at pe.entry_point
}

rule PECompact2xxBitSumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0 at pe.entry_point
}

rule PESpinv01Cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule VxEddie2100 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC }

condition:
		$a0 at pe.entry_point
}

rule NETexecutableMicrosoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }

condition:
		$a0
}

rule tElockv098 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E }

condition:
		$a0 at pe.entry_point
}

rule AZProtect0001byAlexZakaAZCRC {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 }
	$a1 = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C }

condition:
		$a0 at pe.entry_point or $a1
}

rule UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
	$a1 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule MEW510Northfox {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 }

condition:
		$a0 at pe.entry_point
}

rule tElockv090 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1258ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SVKProtectorv132EngPavolCerven {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

condition:
		$a0 at pe.entry_point
}

rule ExeSplitter12BillPrisonerTPOC {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08 }

condition:
		$a0
}

rule COPv10c1988 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv25RetailSlimLoaderBitsumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }

condition:
		$a0 at pe.entry_point
}

rule Morphinev27Holy_FatherRatter29A {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a1 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }

condition:
		$a0 or $a1
}

rule diPackerV1XdiProtectorSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01REALBasicAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule PPCPROTECT11XAlexeyGorchakov {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }

condition:
		$a0 at pe.entry_point
}

rule nPackV111502006BetaNEOxuinC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule EnigmaProtector11X13XSukhovVladimirSergeNMarkin {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }

condition:
		$a0
}

rule HardlockdongleAlladin {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov190c {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Upack_PatchDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 3A 00 00 00 02 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ExeJoinerV10Yodaf2f {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PCShrink071beta {
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMASM32TASM32 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B }
	$a1 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PEiDBundlev101BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}

rule UPX072 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }

condition:
		$a0 at pe.entry_point
}

rule AdFlt2: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD }

condition:
		$a0 at pe.entry_point
}

rule RLPack120BasicEditionaPLibAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }

condition:
		$a0 at pe.entry_point
}

rule AsCryptv01SToRM1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB }

condition:
		$a0
}

rule SmartEMicrosoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }

condition:
		$a0 at pe.entry_point
}

rule PE_Admin10EncryptPE12003518SoldFlyingCat {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule MacromediaWindowsFlashProjectorPlayerv40 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

condition:
		$a0 at pe.entry_point
}

rule WWPack32v100v111v112v120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 }

condition:
		$a0 at pe.entry_point
}

rule VProtectorV11vcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule MaskPE16yzkzero {
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 81 2C 24 ?? ?? ?? 00 C3 60 }

condition:
		$a0
}

rule bambam001bedrock {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MEW11SE10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }

condition:
		$a0
}

rule PseudoSigner01BorlandDelphi6070Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV12ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 77 1E 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PEProtect09Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }

condition:
		$a0 at pe.entry_point
}

rule WWPack32v1x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 55 8B E8 33 DB EB 60 }

condition:
		$a0 at pe.entry_point
}

rule ChSfxsmallv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }

condition:
		$a0 at pe.entry_point
}

rule UPXModifiedStubcFarbrauschConsumerConsulting {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02NorthStarPEShrinker13Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule tElockv098tE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualBasicMASM32 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }

condition:
		$a0 at pe.entry_point
}

rule Upackv022v023BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }

condition:
		$a0 at pe.entry_point
}

rule VxVirusConstructorbased {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8 }
	$a1 = { E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PESHiELD02 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02Gleam100Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

condition:
		$a0 at pe.entry_point
}

rule DBPEv233DingBoy {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PEtite2xlevel0Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }

condition:
		$a0 at pe.entry_point
}

rule EPack14litefinalby6aHguT {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule tElock098tE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }

condition:
		$a0 at pe.entry_point
}

rule UnnamedScrambler10p0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }

condition:
		$a0
}

rule WARNINGTROJANADinjector {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }

condition:
		$a0 at pe.entry_point
}

rule TopSpeedv3011989 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }

condition:
		$a0 at pe.entry_point
}

rule CodeCryptv0164 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }

condition:
		$a0 at pe.entry_point
}

rule UPXHiT001DJSiba {
      meta:
		author="malware-lu"
strings:
		$a0 = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule PseudoSigner01ASProtectAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }

condition:
		$a0 at pe.entry_point
}

rule PocketPCARM {
      meta:
		author="malware-lu"
strings:
		$a0 = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule AnskyaBinderv11Anskya {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

condition:
		$a0 at pe.entry_point
}

rule VProtectorV10Bvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}

rule SecurePE1Xwwwdeepzoneorg {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }

condition:
		$a0 at pe.entry_point
}

rule yPv10bbyAshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }

condition:
		$a0
}

rule MSLRHv031a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
	$a1 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule Upackv039finalDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
	$a1 = { FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF }

condition:
		$a0 or $a1
}

rule vprotector12vcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 }
	$a1 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule FakeNinjav28Spirit {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 }

condition:
		$a0
}

rule PECompactv133 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }

condition:
		$a0 at pe.entry_point
}

rule DragonArmorOrient {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 }

condition:
		$a0
}

rule ThemidaWinLicenseV1802OreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule SoftDefender1xRandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }

condition:
		$a0 at pe.entry_point
}

rule PellesC2x4xDLLPelleOrinius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }

condition:
		$a0 at pe.entry_point
}

rule UPX290LZMADelphistubMarkusOberhumerLaszloMolnarJohnReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV119aPlib043ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }

condition:
		$a0 at pe.entry_point
}

rule VirogensPEShrinkerv014 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtBorlandDelphiBorlandC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 }
	$a1 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
	$a2 = { EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule PseudoSigner01ACProtect109Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorV16dVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}

rule Upackv032BetaPatchDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }

condition:
		$a0
}

rule Apex30alpha500mhz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3 }

condition:
		$a0
}

rule SimbiOZPoly21Extranger {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov184 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov183 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov182 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov180 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule ExeSplitter13SplitMethodBillPrisonerTPOC {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC }
	$a1 = { E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule RJoiner12aVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11 }

condition:
		$a0
}

rule VxVirusConstructorIVPbased {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }

condition:
		$a0 at pe.entry_point
}

rule EncryptPE12003518WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv168v184 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 }

condition:
		$a0 at pe.entry_point
}

rule SDProtectorProEdition116RandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
	$a1 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Reg2Exe222223byJanVorel {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule FSGv120EngdulekxtBorlandDelphiMicrosoftVisualC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }

condition:
		$a0 at pe.entry_point
}

rule CrunchPE: Packer PEiD {
      meta:
		author="malware-lu"
        note="Added extra checks"
strings:
		$a0 = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 }
        $b = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2 }

condition:
		for any of ($*) : ( $ at pe.entry_point )
}

rule CICompressv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 }

condition:
		$a0 at pe.entry_point
}

rule ExeShieldv27b {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }

condition:
		$a0 at pe.entry_point
}

rule UPXInlinerv10byGPcH {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 }

condition:
		$a0
}

rule PKLITEv114v120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20 }

condition:
		$a0 at pe.entry_point
}

rule ExeToolsCOM2EXE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallEmbedded2545Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxARCV4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }

condition:
		$a0 at pe.entry_point
}

rule Armadillo3X5XSiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakePESHiELD025emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule Armadillov252beta2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24 }

condition:
		$a0 at pe.entry_point
}

rule CipherWallSelfExtratorDecryptorConsolev15 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }

condition:
		$a0 at pe.entry_point
}

rule PCShrinkerv029 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40 }

condition:
		$a0 at pe.entry_point
}

rule NsPacKV33LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74 }

condition:
		$a0 at pe.entry_point
}

rule CopyMinderMicrocosmLtd {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }

condition:
		$a0 at pe.entry_point
}

rule Crunchv5BitArts {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }

condition:
		$a0 at pe.entry_point
}

rule PCShrinkerv020 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 }

condition:
		$a0 at pe.entry_point
}

rule Armadillo500SiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }

condition:
		$a0 at pe.entry_point
}

rule SLVc0deProtector060SLVICU {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }

condition:
		$a0
}

rule Kryptonv03 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }

condition:
		$a0 at pe.entry_point
}

rule CrackStopv101cStefanEsser1997 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }

condition:
		$a0 at pe.entry_point
}

rule Kryptonv05 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF }

condition:
		$a0 at pe.entry_point
}

rule Kryptonv04 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06 }

condition:
		$a0 at pe.entry_point
}

rule PassLock2000v10EngMoonlightSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }

condition:
		$a0 at pe.entry_point
}

rule Upackv029Betav031BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }

condition:
		$a0
}

rule AlexProtector10beta2byAlex {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 }

condition:
		$a0
}

rule MoleBoxv254Teggo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }

condition:
		$a0
}

rule Obsidium1337ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PESpinv03Engcyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 }
	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PseudoSigner02PEPack099Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }

condition:
		$a0 at pe.entry_point
}

rule VxVCL {
      meta:
		author="malware-lu"
strings:
		$a0 = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }

condition:
		$a0 at pe.entry_point
}

rule VterminalV10XLeiPeng {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 }

condition:
		$a0 at pe.entry_point
}

rule PEEncrypt10Liwuyue {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 }

condition:
		$a0 at pe.entry_point
}

rule InstallAnywhere61ZeroGSoftwareInc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
	$a1 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule iLUCRYPTv4018exe {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02ASProtectAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }

condition:
		$a0 at pe.entry_point
}

rule EncryptPEV22006710WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Themida10xx18xxnocompressionOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
	$a1 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }

condition:
		$a0 or $a1
}

rule StonesPEEncryptorv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }

condition:
		$a0 at pe.entry_point
}

rule PolyBoxDAnskya {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }

condition:
		$a0
}

rule Mew10execoder10NorthfoxHCC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 }

condition:
		$a0 at pe.entry_point
}

rule PECrypt102 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 }

condition:
		$a0 at pe.entry_point
}

rule DIETv100d {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV119LZMA430ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }

condition:
		$a0 at pe.entry_point
}

rule ENIGMAProtectorV112SukhovVladimir {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeASPack212FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

condition:
		$a0 at pe.entry_point
}

rule MacromediaWindowsFlashProjectorPlayerv50 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }

condition:
		$a0 at pe.entry_point
}

rule IDApplicationProtector12IDSecuritySuite {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4ExtractablePasswordchecking {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule HASPHLProtectionV1XAladdin {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 }
	$a1 = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule ASProtectv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE }

condition:
		$a0 at pe.entry_point
}

rule Armadillov275a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner0132Lite003Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }

condition:
		$a0 at pe.entry_point
}

rule VxDoom666 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }

condition:
		$a0 at pe.entry_point
}

rule VxSpanz {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84 }

condition:
		$a0 at pe.entry_point
}

rule BeRoEXEPackerv100DLLLZBRSBeRoFarbrausch {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

condition:
		$a0 at pe.entry_point
}

rule Pksmart10b {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule PELockv106 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }

condition:
		$a0 at pe.entry_point
}

rule LaunchAnywherev4001 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 }

condition:
		$a0 at pe.entry_point
}

rule Upackv033v034BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }

condition:
		$a0 at pe.entry_point
}

rule GameGuardnProtect {
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorV1032AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

condition:
		$a0 at pe.entry_point
}

rule nBinderv40 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 }

condition:
		$a0
}

rule AnslymFUDCrypter {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A }

condition:
		$a0 at pe.entry_point
}

rule EPExEPackV10EliteCodingGroup {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 }

condition:
		$a0 at pe.entry_point
}

rule SimplePack12build3009Method2bagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule WinZip32bitSFXv6xmodule {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }

condition:
		$a0 at pe.entry_point
}

rule VxEinstein {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }

condition:
		$a0 at pe.entry_point
}

rule VideoLanClient {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF }

condition:
		$a0 at pe.entry_point
}

rule CrunchPEv10xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 }

condition:
		$a0 at pe.entry_point
}

rule VxTravJack883 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }

condition:
		$a0 at pe.entry_point
}

rule RSCsProcessPatcherv151 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }

condition:
		$a0
}

rule kryptor9 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

condition:
		$a0 at pe.entry_point
}

rule SecuPackv15 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }

condition:
		$a0 at pe.entry_point
}

rule kryptor5 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0 }

condition:
		$a0 at pe.entry_point
}

rule kryptor6 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }

condition:
		$a0 at pe.entry_point
}

rule ACProtectV13Xrisco {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 50 E8 01 00 00 00 75 83 }

condition:
		$a0 at pe.entry_point
}

rule PELockNTv202c {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02MinGWGCC2xAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }

condition:
		$a0 at pe.entry_point
}

rule FreeBASIC016b {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv16bv16cVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 }
	$a1 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule FileShield: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 1E EB ?? 90 00 00 8B D8 }

condition:
		$a0 at pe.entry_point
}

rule SDC12SelfDecryptingBinaryGeneratorbyClaesMNyberg {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv1501 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }

condition:
		$a0 at pe.entry_point
}

rule Inbuildv10hard {
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }

condition:
		$a0 at pe.entry_point
}

rule ExeShieldvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv20Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD }

condition:
		$a0 at pe.entry_point
}

rule PECompactv125 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv1Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 }
	$a1 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PECompactv122 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }

condition:
		$a0 at pe.entry_point
}

rule Packmanv10BrandonLaCombe {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B }

condition:
		$a0 at pe.entry_point
}

rule SpecialEXEPaswordProtectorV101EngPavolCerven {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }

condition:
		$a0 at pe.entry_point
}

rule ExeSmashervxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }

condition:
		$a0 at pe.entry_point
}

rule PEArmor046ChinaCrackingGroup {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }

condition:
		$a0 at pe.entry_point
}

rule VMProtect106107PolyTech {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }

condition:
		$a0
}

rule USSR031bySpirit {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3 }

condition:
		$a0
}

rule PeCompact253DLLSlimLoaderBitSumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32 }

condition:
		$a0 at pe.entry_point
}

rule LameCryptv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }

condition:
		$a0 at pe.entry_point
}

rule Cygwin32: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 04 83 3D }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv123RC4build0807exeAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule Armadillov210b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov190 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorProtection150XCGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB }

condition:
		$a0
}

rule VxNecropolis1963 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 }

condition:
		$a0 at pe.entry_point
}

rule Shrinkv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02UPX06Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PESpinV071cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E }

condition:
		$a0 at pe.entry_point
}

rule XHider10GlobaL {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00 }
	$a1 = { 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90 }

condition:
		$a0 at pe.entry_point or $a1
}

rule PseudoSigner01MicrosoftVisualC70DLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }

condition:
		$a0 at pe.entry_point
}

rule EXEShieldV05Smoke {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule UnnamedScrambler25Ap0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00 }

condition:
		$a0
}

rule Armadillov177 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule VxTrivial25 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }

condition:
		$a0 at pe.entry_point
}

// 20150909 - Issue #39 - Commented because of High FP rate
/*
rule Armadillov171 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 }

condition:
		$a0 at pe.entry_point
}
*/

rule KBySV022shoooo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule InnoSetupModule {
      meta:
		author="malware-lu"
strings:
		$a0 = { 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 }
	$a1 = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF }

condition:
		$a0 at pe.entry_point or $a1
}

rule piritv15 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 24 55 50 44 FB 32 2E 31 5D }

condition:
		$a0 at pe.entry_point
}

rule SoftSentryv30 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }

condition:
		$a0 at pe.entry_point
}

rule EncryptPEV22007411WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov19x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov285 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }

condition:
		$a0 at pe.entry_point
}

rule ASProtectvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD }

condition:
		$a0 at pe.entry_point
}

rule ExeShieldv17 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 }

condition:
		$a0 at pe.entry_point
}

rule Splasherv10v30 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }

condition:
		$a0 at pe.entry_point
}

rule FreeCryptor01build002GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

condition:
		$a0
}

rule EXEShieldV06SMoKE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PseudoSigner02MicrosoftVisualBasic5060Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPack118DllLZMA430ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv100v103 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B }

condition:
		$a0 at pe.entry_point
}

rule Shrinkerv34 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
	$a1 = { BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Shrinkerv32 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF }

condition:
		$a0 at pe.entry_point
}

rule Shrinkerv33 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01JDPack1xJDProtect09Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule Upack024027beta028alphaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01LocklessIntroPackAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov250b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }

condition:
		$a0 at pe.entry_point
}

rule PEBundlev02v20x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 }

condition:
		$a0 at pe.entry_point
}

rule SoftProtectwwwsoftprotectbyru {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01 }

condition:
		$a0 at pe.entry_point
}

rule NTPackerV2XErazerZ {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00 }

condition:
		$a0
}

rule SiliconRealmsInstallStub {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 }

condition:
		$a0
}

rule Armadillov430v440SiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
	$a1 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule MoleBoxv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 60 E8 4F }

condition:
		$a0
}

rule FucknJoyv10cUsAr {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
	$a1 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PseudoSigner02VideoLanClientAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }

condition:
		$a0 at pe.entry_point
}

rule SoftWrap {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F }

condition:
		$a0 at pe.entry_point
}

rule AI1Creator1Beta2byMZ {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0
}

rule JAMv211 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB }

condition:
		$a0 at pe.entry_point
}

rule PECompactv0978 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }

condition:
		$a0 at pe.entry_point
}

rule Setup2GoInstallerStub {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }

condition:
		$a0
}

rule themida1005httpwwworeanscom {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorv1033exescrcomAshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

condition:
		$a0 at pe.entry_point
}

rule ORiENv211DEMO {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

condition:
		$a0 at pe.entry_point
}

rule PECompactv0977 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }

condition:
		$a0 at pe.entry_point
}

rule PESpinv13betaCyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv13bVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 }
	$a1 = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule mkfpackllydd {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }

condition:
		$a0
}

rule PESpinV03cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02BorlandDelphiSetupModuleAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PELOCKnt204 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }

condition:
		$a0 at pe.entry_point
}

rule MacromediaWindowsFlashProjectorPlayerv60 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

condition:
		$a0 at pe.entry_point
}

rule IMPostorPack10MahdiHezavehi {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }

condition:
		$a0 at pe.entry_point
}

rule PluginToExev102BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }

condition:
		$a0 at pe.entry_point
}

rule PrivateexeProtectorV18SetiSoftTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0
}

rule PENinjamodified {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }

condition:
		$a0 at pe.entry_point
}

rule DotFixNiceProtect21GPcHSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }

condition:
		$a0
}

rule EXEStealthv276WebToolMaster {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor239DLLcompressedresources {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10 }

condition:
		$a0 at pe.entry_point
}

rule UnoPiX103110BaGiE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 }

condition:
		$a0 at pe.entry_point
}

rule IonicWindSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8 }

condition:
		$a0 at pe.entry_point
}

rule SimplePackV11XMethod2bagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 }
	$a1 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0 or $a1
}

rule PCGuardv500d {
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

condition:
		$a0 at pe.entry_point
}

rule PESHiELDv0251 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5D 83 ED 06 EB 02 EA 04 8D }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117DLLaPLibAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv110b4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02PEX099Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallVirtualizationSuite30XThinstallCompany {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA }
	$a1 = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule NullsoftInstallSystemv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }

condition:
		$a0
}

rule SLVc0deProtectorv11SLV {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C }
	$a1 = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }

condition:
		$a0 at pe.entry_point or $a1
}

rule FreeJoinerSmallbuild031032GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule SLVc0deProtectorv06SLV {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90 }

condition:
		$a0 at pe.entry_point
}

rule PEArmor04600759hying {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }

condition:
		$a0
}

rule RpolycryptbyVaska2003071841 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04 }

condition:
		$a0
}

rule DBPEvxxxDingBoy {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED }

condition:
		$a0 at pe.entry_point
}

rule SoftwareCompressBGSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4UnextrPasswcheckVirshield {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule Upackv0399Dwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 }
	$a1 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
	$a2 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule UPXModifiedstub {
      meta:
		author="malware-lu"
strings:
		$a0 = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }

condition:
		$a0 at pe.entry_point
}

rule Cryptic20Tughack {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3 }

condition:
		$a0 at pe.entry_point
}

rule KGBSFX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv20betaJeremyCollake {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule DevCv4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }

condition:
		$a0
}

rule DevCv5 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }

condition:
		$a0
}

rule CRYPToCRACksPEProtectorV092LukasFleischer {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }

condition:
		$a0 at pe.entry_point
}

rule UpackV037Dwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 }
	$a1 = { 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E }
	$a2 = { BE ?? ?? ?? ?? AD 50 FF ?? ?? EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule Obsidiumv13037ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 }

condition:
		$a0 at pe.entry_point
}

rule VxCompiler {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }

condition:
		$a0 at pe.entry_point
}

rule BJFntv13 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakePEtite21emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule UPXShitv01500mhz {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
	$a1 = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
	$a2 = { E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule PackmanV0001Bubbasoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 }

condition:
		$a0 at pe.entry_point
}

rule DJoinv07publicxorencryptiondrmist {
      meta:
		author="malware-lu"
strings:
		$a0 = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule FreeJoinerSmallbuild033GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

rule AnticrackSoftwareProtectorv109ACProtect {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule UnderGroundCrypterbyBooster2000 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }

condition:
		$a0
}

rule MicroJoiner16coban2k {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B }

condition:
		$a0 at pe.entry_point
}

rule WiseInstallerStubv11010291 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }

condition:
		$a0 at pe.entry_point
}

rule PrivateEXEProtector18 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0 }

condition:
		$a0
}

rule SimpleUPXCryptorv3042005multilayerencryptionMANtiCORE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
	$a1 = { 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule Themida1201compressedOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv155 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }

condition:
		$a0 at pe.entry_point
}

rule PolyCryptPE214b215JLabSoftwareCreationshsigned {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }

condition:
		$a0
}

rule PECompactv156 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }

condition:
		$a0 at pe.entry_point
}

rule PGMPACKv013 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }

condition:
		$a0 at pe.entry_point
}

rule PGMPACKv014 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner0232Lite003Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakePEtite22FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}

rule MEW10byNorthfox {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }

condition:
		$a0
}

rule theWRAPbyTronDoc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }

condition:
		$a0 at pe.entry_point
}

rule Petitev211 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}

rule Petitev212 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}

rule MaskPEV20yzkzero {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3 }

condition:
		$a0
}

rule PseudoSigner01Morphine12Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule EZIPv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C }

condition:
		$a0 at pe.entry_point
}

rule y0dasCrypterv12 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }

condition:
		$a0 at pe.entry_point
}

rule ChinaProtectdummy {
      meta:
		author="malware-lu"
strings:
		$a0 = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }

condition:
		$a0
}

rule BopCryptv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule MinkeV101Codius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }

condition:
		$a0
}

rule PseudoSigner02BorlandDelphiDLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

rule bambam004bedrock {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117DLLLZMAAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 }

condition:
		$a0 at pe.entry_point
}

rule PEtitev22 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}

rule PEtitev20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68 }

condition:
		$a0 at pe.entry_point
}

rule PEtitev21 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}

rule ElicenseSystemV4000ViaTechInc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 }

condition:
		$a0
}

rule VProtectorV10Build20041213testvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}

rule Themida18xxOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 }
	$a1 = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule EXEJoinerv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule MicroJoiner11coban2k {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01FSG10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov200b2200b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule RAZOR1911encruptor {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}

rule tElock051tE {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }

condition:
		$a0 at pe.entry_point
}

rule SDProtectorBasicProEdition112RandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }

condition:
		$a0 at pe.entry_point
}

rule VxFaxFreeTopo {
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02MEW11SE10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }

condition:
		$a0 at pe.entry_point
}

rule Joinersignfrompinch250320072010 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01 }

condition:
		$a0 at pe.entry_point
}

rule VxSK {
      meta:
		author="malware-lu"
strings:
		$a0 = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }

condition:
		$a0 at pe.entry_point
}

rule PEStubOEPv1x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3 }

condition:
		$a0
}

rule MoleBoxV23XMoleStudiocom {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 E8 4F 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxHymn1865 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }

condition:
		$a0 at pe.entry_point
}

rule kkrunchyRyd {
      meta:
		author="malware-lu"
strings:
		$a0 = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }

condition:
		$a0 at pe.entry_point
}

rule PECryptv100v101 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

condition:
		$a0 at pe.entry_point
}

rule CERBERUSv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor2117StrongbitSoftCompleteDevelopment {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }

condition:
		$a0
}

rule WWPACKv303 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53 }

condition:
		$a0 at pe.entry_point
}

rule GHFProtectorpackonlyGPcH {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3 }
	$a1 = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }

condition:
		$a0 at pe.entry_point or $a1
}

rule yzpackV11UsAr {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }

condition:
		$a0 at pe.entry_point
}

rule VxDanishtiny {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }

condition:
		$a0 at pe.entry_point
}

rule UPXV194MarkusOberhumerLaszloMolnarJohnReiser {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}

rule yzpack112UsAr {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02YodasProtector102Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 90 90 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02PESHiELD025Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }

condition:
		$a0 at pe.entry_point
}

rule NsPacKV34V35LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84 }

condition:
		$a0 at pe.entry_point
}

rule DualseXe10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 }

condition:
		$a0 at pe.entry_point
}

rule NoodleCryptv200EngNoodleSpa {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }

condition:
		$a0 at pe.entry_point
}

rule SoftComp1xBGSoftPT {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }

condition:
		$a0
}

rule Petite13c1998IanLuck {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }

condition:
		$a0 at pe.entry_point
}

rule PENightMarev13 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9 }

condition:
		$a0 at pe.entry_point
}

rule Armadillo50DllSiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }

condition:
		$a0 at pe.entry_point
}

rule ObsidiumV1350ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv123RC1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule PUNiSHERv15DEMOFEUERRADERAHTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
	$a1 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PECompactv140b2v140b4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11 }

condition:
		$a0 at pe.entry_point
}

rule NullsoftInstallSystemv198 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 2C 81 40 }

condition:
		$a0 at pe.entry_point
}

rule CryptoLockv202EngRyanThian {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 }
	$a1 = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
	$a2 = { 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule vfpexeNcv600WangJianGuo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }

condition:
		$a0 at pe.entry_point
}

rule XPEORv099b {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00 }
	$a1 = { E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PEiDBundlev100BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}

rule PeCompact2253276BitSumTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }

condition:
		$a0
}

rule PseudoSigner02CodeLockAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }

condition:
		$a0 at pe.entry_point
}

rule FSGv100Engdulekxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01BorlandDelphi50KOLMCKAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule FlyCrypter10ut1lz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3 }
	$a1 = { 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule MSLRHv032afakePECompact14xemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule muckisprotectorIImucki {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3 }

condition:
		$a0 at pe.entry_point
}

rule VcasmProtector10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }

condition:
		$a0 at pe.entry_point
}

rule NullsoftInstallSystemv20b2v20b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 }

condition:
		$a0 at pe.entry_point
}

rule VProtectorV10Dvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}

rule GardianAngel10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }

condition:
		$a0 at pe.entry_point
}

rule eXpressorv12CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 }

condition:
		$a0 at pe.entry_point
}

rule RSCsProcessPatcherv14 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 }

condition:
		$a0
}

rule Armadillov190b1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov190b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov190b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCASM {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }

condition:
		$a0 at pe.entry_point
}

rule Thinstall25xxJtit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
	$a1 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule hmimysPacker10hmimys {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 }

condition:
		$a0
}

rule ACProtectV20risco {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV112V114LZMA430ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60 }

condition:
		$a0
}

rule JDPack: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45 }

condition:
		$a0 at pe.entry_point
}

rule PESpinv1304Cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}

rule ScObfuscatorSuperCRacker {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule tElock098SpecialBuildforgotheXer {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01DEF10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02REALBasicAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov260c {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov260a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4 }

condition:
		$a0 at pe.entry_point
}

rule ThemidaWinLicenseV10XV17XDLLOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9 }

condition:
		$a0 at pe.entry_point
}

rule eXPressor12CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }

condition:
		$a0 at pe.entry_point
}

rule NeoLitev10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25 }

condition:
		$a0 at pe.entry_point
}

rule ExeBundlev30standardloader {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }

condition:
		$a0 at pe.entry_point
}

rule ProtectionPlusvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptorV22Xsoftcompletecom {
      meta:
		author="malware-lu"
strings:
		$a0 = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }

condition:
		$a0
}

rule ThinstallVirtualizationSuite30353043ThinstallCompany {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01CrunchPEHeuristicAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule FSGv120EngdulekxtBorlandC {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }

condition:
		$a0 at pe.entry_point
}

rule EXEPACKv405v406 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }

condition:
		$a0 at pe.entry_point
}

rule PeStubOEPv1x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF }
	$a1 = { E8 05 00 00 00 33 C0 40 48 C3 E8 05 }

condition:
		$a0 or $a1
}

rule EXEShieldv01bv03bv03SMoKE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }

condition:
		$a0 at pe.entry_point
}

rule PEArmor049Hying {
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv14x {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

condition:
		$a0 at pe.entry_point
}

rule PocketPCSHA {
      meta:
		author="malware-lu"
strings:
		$a0 = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorV1451CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D }

condition:
		$a0 at pe.entry_point
}

rule Thinstall25 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }

condition:
		$a0 at pe.entry_point
}

rule SuckStopv111 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }

condition:
		$a0 at pe.entry_point
}

rule DEFv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 }
	$a1 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 }

condition:
		$a0 at pe.entry_point or $a1
}

rule UnnamedScrambler251Beta2252p0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }

condition:
		$a0
}

rule Crunchv40 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

condition:
		$a0 at pe.entry_point
}

rule PrivateEXEProtector18SetiSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }

condition:
		$a0
}

rule PseudoSigner02Armadillo300Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }

condition:
		$a0 at pe.entry_point
}

rule hmimyssPEPack01hmimys {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv146 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02XCR011Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }

condition:
		$a0 at pe.entry_point
}

rule EXEPACKLINKv360v364v365or50121 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }

condition:
		$a0 at pe.entry_point
}

rule SpecialEXEPasswordProtectorv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }

condition:
		$a0 at pe.entry_point
}

rule RCryptor15Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}

rule ExeJoiner10Yoda {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV119DllaPlib043ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }

condition:
		$a0 at pe.entry_point
}

rule CrypKeyV56XKenonicControlsLtd {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8 }

condition:
		$a0 at pe.entry_point
}

rule Safe20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 10 53 56 57 E8 C4 01 00 }

condition:
		$a0
}

rule MicrosoftVisualCV80 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }

condition:
		$a0 at pe.entry_point
}

rule MZ_Crypt10byBrainSt0rm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0 }

condition:
		$a0
}

rule EPWv130 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }

condition:
		$a0 at pe.entry_point
}

rule WindofCrypt10byDarkPressure {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D }

condition:
		$a0 at pe.entry_point
}

rule NTKrnlPackerAshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }

condition:
		$a0
}

rule PseudoSigner01LCCWin321xAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }

condition:
		$a0 at pe.entry_point
}

rule NME11Publicbyredlime {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62 }

condition:
		$a0
}

rule PEtitev13 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }

condition:
		$a0 at pe.entry_point
}

rule PEtitev12 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv134v140b1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeMSVC70DLLMethod3emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule PEtitev14 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC }
	$a1 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule SoftProtectSoftProtectbyru {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02CDCopsIIAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }

condition:
		$a0 at pe.entry_point
}

rule RLPack118LZMA430ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv108xAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02BorlandCDLLMethod2Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule ARMProtector01bySMoKE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }

condition:
		$a0 at pe.entry_point
}

rule tElock099cPrivateECLIPSEtE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }

condition:
		$a0 at pe.entry_point
}

rule XPack152164 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv123RC4build0807dllAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov253b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }

condition:
		$a0 at pe.entry_point
}

rule Imploderv104BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}

rule PEiDBundlev100v101BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}

rule JExeCompressor10byArashVeyskarami {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0 }

condition:
		$a0 at pe.entry_point
}

rule Alloy4xPGWareLLC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 }

condition:
		$a0 at pe.entry_point
}

rule ThinstallV2403Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
	$a1 = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule FakeNinjav28AntiDebugSpirit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF }

condition:
		$a0
}

rule ExeLockv100 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 }

condition:
		$a0 at pe.entry_point
}

rule PEtitevxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}

rule EnigmaProtector10XSukhovVladimir {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }

condition:
		$a0
}

rule ThinstallEmbedded27172719Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv102bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }
	$a1 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PEProtect09byCristophGabler1998 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }

condition:
		$a0
}

rule VxPredator2448 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeMSVC60DLLemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv16dVaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 }
	$a1 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1
}

rule Enigmaprotector112VladimirSukhov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }

condition:
		$a0
}

rule hyingsPEArmorV076hying {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule JDPackV200JDPack {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}

rule Upackv01xv02xDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 ?? ?? AD 8B F8 95 }

condition:
		$a0 at pe.entry_point
}

rule VcasmProtectorV1Xvcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 5B 56 50 72 6F 74 65 63 74 5D }

condition:
		$a0 at pe.entry_point
}

rule kkrunchy023alpha2Ryd {
      meta:
		author="malware-lu"
strings:
		$a0 = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF }
	$a1 = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PolyEnEV001LennartHedlund {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }

condition:
		$a0
}

rule Winkriptv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 }

condition:
		$a0 at pe.entry_point
}

rule TrainerCreationKitv5Trainer {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }

condition:
		$a0
}

rule EXEStealthv272 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv273 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 }

condition:
		$a0
}

rule PseudoSigner02DEF10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }

condition:
		$a0 at pe.entry_point
}

rule AHpack01FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv274 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 }

condition:
		$a0
}

rule ThinstallEmbedded22X2308Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

condition:
		$a0 at pe.entry_point
}

rule PolyCryptorbySMTVersionv3v4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29 }

condition:
		$a0 at pe.entry_point
}

rule ProtectSharewareV11eCompservCMS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 }

condition:
		$a0
}

rule Upackv035alphaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }

condition:
		$a0
}

rule ASPackv10801AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D }
	$a1 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D }
	$a2 = { 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule ENIGMAProtectorV11SukhovVladimir {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }

condition:
		$a0 at pe.entry_point
}

rule PEncrypt20junkcode {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 }

condition:
		$a0 at pe.entry_point
}

rule SimbiOZExtranger {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }

condition:
		$a0 at pe.entry_point
}

rule InnoSetupModulev304betav306v307 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }

condition:
		$a0
}

rule ASPackv107bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE }

condition:
		$a0 at pe.entry_point
}

rule PROPACKv208emphasisonpackedsizelocked {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }

condition:
		$a0 at pe.entry_point
}

rule HACKSTOPv110p1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB }

condition:
		$a0 at pe.entry_point
}

rule AdysGlue110 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }

condition:
		$a0 at pe.entry_point
}

rule VxEddiebased1745 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }

condition:
		$a0 at pe.entry_point
}

rule ASDPackv10asd {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F }

condition:
		$a0
}

rule ORiENV1XV2XFisunAV {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }

condition:
		$a0
}

rule StonesPEEncryptorv113 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv302v302aExtractable {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule ARMProtector03bySMoKE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }

condition:
		$a0
}

rule VxSlowload {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }

condition:
		$a0 at pe.entry_point
}

rule AntiDote10BetaSISTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }

condition:
		$a0 at pe.entry_point
}

rule DzAPatcherv13Loader {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }

condition:
		$a0
}

rule CDSSS10beta1CyberDoom {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50 }

condition:
		$a0 at pe.entry_point
}

rule y0dasCrypterv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }

condition:
		$a0 at pe.entry_point
}

rule y0dasCrypterv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }

condition:
		$a0 at pe.entry_point
}

rule NullsoftPiMPInstallSystemv1x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 }

condition:
		$a0
}

rule ExeBundlev30smallloader {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 }

condition:
		$a0 at pe.entry_point
}

rule UPXAlternativestub {
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }

condition:
		$a0 at pe.entry_point
}

rule EmbedPE113cyclotron {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor2223protectedIAT {
      meta:
		author="malware-lu"
strings:
		$a0 = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 }

condition:
		$a0
}

rule PseudoSigner01Armadillo300Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

condition:
		$a0 at pe.entry_point
}

rule EXECryptorvxxxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }

condition:
		$a0 at pe.entry_point
}

rule Morphinev33SilentSoftwareSilentShieldc2005 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
	$a1 = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

condition:
		$a0 or $a1
}

rule DEF10bartxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv0971v0976 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }

condition:
		$a0 at pe.entry_point
}

rule PCShrinkv040b {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakePECrypt102emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule ORiENv211212FisunAlexander {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

condition:
		$a0 at pe.entry_point
}

rule StonesPEEncruptorv113 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv11MTEc {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 1B ?? ?? ?? E9 FC }

condition:
		$a0 at pe.entry_point
}

rule CreateInstallStubvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 }

condition:
		$a0 at pe.entry_point
}

rule WinZip32bitSFXv8xmodule {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }

condition:
		$a0 at pe.entry_point
}

rule Upxv12MarcusLazlo {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 }

condition:
		$a0 at pe.entry_point
}

rule PEPACKv10byANAKiN1998 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule NeoLitev20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakeSpalsher1x3xFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv10803AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
	$a1 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }
	$a2 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD }
	$a3 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point
}

rule VMProtect07x08PolyTech {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }

condition:
		$a0
}

rule ExeShieldProtectorV36wwwexeshieldcom {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }

condition:
		$a0 at pe.entry_point
}

rule WerusCrypter10Kas {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

condition:
		$a0
}

rule Themida10xx1800compressedengineOreansTechnologies {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
	$a1 = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule CHECKPRGc1992 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }

condition:
		$a0 at pe.entry_point
}

rule eXPressor11CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxEddie1028 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }

condition:
		$a0 at pe.entry_point
}

rule PEQuakev006byfORGAT {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }

condition:
		$a0
}

rule LTCv13 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 }

condition:
		$a0 at pe.entry_point
}

rule tElockv071b7 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 48 11 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}

rule tElockv071b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 44 11 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}

rule UnknownJoinersignfrompinch260320070212 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80 }

condition:
		$a0 at pe.entry_point
}

rule DIETv100v100d {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}

rule APEX_CBLTApex40500mhz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 }

condition:
		$a0 at pe.entry_point
}

rule StealthPEv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2 }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117DLLAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }

condition:
		$a0 at pe.entry_point
}

rule Anti007V26LiuXingPing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }

condition:
		$a0
}

rule AppEncryptorSilentTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }

condition:
		$a0 at pe.entry_point
}

rule VirogenCryptv075 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov300a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv300v301Extractable {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC }

condition:
		$a0 at pe.entry_point
}

rule VxUddy2617 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98 }

condition:
		$a0 at pe.entry_point
}

rule PLINK8619841985 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv10804AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 41 06 00 00 EB 41 }

condition:
		$a0 at pe.entry_point
}

rule aPackv098m {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }

condition:
		$a0
}

rule BamBamv001Bedrock {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

condition:
		$a0
}

rule PESHiELDv02v02bv02b2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv27 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv25 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }

condition:
		$a0
}

rule VxHaryanto {
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }

condition:
		$a0 at pe.entry_point
}

rule ASPRStripperv2xunpacked {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01UPX06Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule Shrinker33 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }

condition:
		$a0
}

rule Shrinker32 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }

condition:
		$a0
}

rule Shrinker34 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }

condition:
		$a0
}

rule PESPinv13Cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}

rule PECompactv160v165 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorv120b {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }

condition:
		$a0
}

rule EPWv12 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv12x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 68 01 ?? ?? ?? C3 AA }

condition:
		$a0 at pe.entry_point
}

rule Packanoidv1Arkanoid {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }

condition:
		$a0 at pe.entry_point
}

rule EscargotV01Meat {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 40 30 2E 31 60 68 61 }

condition:
		$a0 at pe.entry_point
}

rule SCObfuscatorSuperCRacker {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C }

condition:
		$a0
}

rule EXEStealth275WebtoolMaster {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PasswordProtectorcMiniSoft1992 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }

condition:
		$a0 at pe.entry_point
}

rule VxEddie2000 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21 }

condition:
		$a0 at pe.entry_point
}

rule VideoLanClientUnknownCompiler {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorv14CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
	$a1 = { 65 58 50 72 2D 76 2E 31 2E 34 2E }

condition:
		$a0 at pe.entry_point or $a1
}

rule SkDUndetectablerPro20NoUPXMethodSkD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40 }

condition:
		$a0 at pe.entry_point
}

rule RJcrushv100 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 }

condition:
		$a0 at pe.entry_point
}

rule ExeShieldv27 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }

condition:
		$a0 at pe.entry_point
}

rule ExeShieldv29 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }

condition:
		$a0 at pe.entry_point
}

rule PEiDBundlev102v103BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtMicrosoftVisualC5060 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}

rule PUNiSHERV15FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }

condition:
		$a0
}

rule ExcaliburV103forgot {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }

condition:
		$a0 at pe.entry_point
}

rule RLPack10betaap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 }
	$a1 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule nMacrorecorder10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }

condition:
		$a0
}

rule PrivateEXEv20a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 E8 00 00 00 00 5B 8B C3 2D }
	$a1 = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }
	$a2 = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule PackmanV10BrandonLaCombe {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PEX099Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule PAKSFXArchive {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }

condition:
		$a0 at pe.entry_point
}

rule ASPackv2xxAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
	$a1 = { A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule SimbiOZ13Extranger {
      meta:
		author="malware-lu"
strings:
		$a0 = { 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3 }

condition:
		$a0 at pe.entry_point
}

rule muckisprotectorImucki {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9 }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1339ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule LOCK98V10028keenvim {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08 }

condition:
		$a0 at pe.entry_point
}

rule iPBProtectv013 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }

condition:
		$a0
}

rule PrivateEXEProtector197SetiSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }

condition:
		$a0
}

rule ASPackv21AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv103bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }

condition:
		$a0 at pe.entry_point
}

rule FSGv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }

condition:
		$a0
}

rule PseudoSigner01PEIntro10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }

condition:
		$a0 at pe.entry_point
}

rule tElockv099SpecialBuildheXerforgot {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
	$a1 = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule VxBackfont900 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 }

condition:
		$a0 at pe.entry_point
}

rule CrunchPEv20xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26 }

condition:
		$a0 at pe.entry_point
}

rule Litev003a {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68 }

condition:
		$a0 at pe.entry_point
}

rule SimplePack1XMethod2bagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule PEncryptv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }

condition:
		$a0 at pe.entry_point
}

rule BJFntv12RC {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }

condition:
		$a0 at pe.entry_point
}

rule FishPEShield112116HellFish {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B }
	$a1 = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule CodeCryptv016bv0163b {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

condition:
		$a0 at pe.entry_point
}

rule VOBProtectCD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F }

condition:
		$a0 at pe.entry_point
}

rule diProtectorV1XdiProtectorSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }

condition:
		$a0 at pe.entry_point
}

rule PrivateexeProtector20SetiSoftTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }

condition:
		$a0
}

rule AHTeamEPProtector03fakekkryptor9kryptoraFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

condition:
		$a0 at pe.entry_point
}

rule PEBundlev310 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01 }

condition:
		$a0
}

rule NsPack34NorthStar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }

condition:
		$a0 at pe.entry_point
}

rule PellesC280290EXEX86CRTLIB {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV115V117Dllap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }

condition:
		$a0 at pe.entry_point
}

rule PellesC28x45xPelleOrinius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC }

condition:
		$a0 at pe.entry_point
}

rule Thinstallv2460Jitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }

condition:
		$a0 at pe.entry_point
}

rule FSGv110Engdulekxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
	$a1 = { E8 01 00 00 00 ?? ?? E8 ?? 00 00 00 }
	$a2 = { EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule PECompactv2xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0
}

rule ASPackv10802AlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }

condition:
		$a0 at pe.entry_point
}

rule Armadillo440SiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 }

condition:
		$a0
}

rule Armadillov1xxv2xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }

condition:
		$a0 at pe.entry_point
}

rule HACKSTOPv111c {
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }

condition:
		$a0 at pe.entry_point
}

rule EXEStealth276UnregisteredWebtoolMaster {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }

condition:
		$a0
}

rule PseudoSigner02LCCWin32DLLAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }

condition:
		$a0 at pe.entry_point
}

rule CDSSSv10Beta1CyberDoomTeamX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 }

condition:
		$a0 at pe.entry_point
}

rule tElockv041x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 }

condition:
		$a0 at pe.entry_point
}

rule ZCodeWin32PEProtectorv101 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }

condition:
		$a0 at pe.entry_point
}

rule ABCCryptor10byZloY {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 }

condition:
		$a0
}

rule FSGv120EngdulekxtMicrosoftVisualC60 {
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }

condition:
		$a0 at pe.entry_point
}

rule SLVc0deProtectorv061SLV {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 }
	$a1 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule FSG131dulekxt {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 }

condition:
		$a0 at pe.entry_point
}

rule RLPackV112V114aPlib043ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }

condition:
		$a0
}

rule Crypter31SLESH {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }

condition:
		$a0
}

rule PseudoSigner01VBOX43MTEAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeBJFNT13emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule FreeCryptor02build002GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A }

condition:
		$a0
}

rule PackItBitchV10archphase {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule nPackv11250BetaNEOx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }

condition:
		$a0 at pe.entry_point
}

rule UnpackedBSSFXArchivev19 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01VideoLanClientAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01PECompact14Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01DxPack10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

rule Splice11byTw1stedL0gic {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv140v145 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11 }

condition:
		$a0 at pe.entry_point
}

rule Armadillo300aSiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F }

condition:
		$a0 at pe.entry_point
}

rule NullsoftInstallSystemv20b4 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 }
	$a1 = { 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 }

condition:
		$a0 or $a1
}

rule PESHiELDv01bMTE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }

condition:
		$a0 at pe.entry_point
}

rule BeRoEXEPackerV100BeRo {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }

condition:
		$a0
}

rule MSLRHv32aemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 }

condition:
		$a0 at pe.entry_point
}

rule SpecialEXEPaswordProtectorv101EngPavolCerven {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv166 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv167 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11 }

condition:
		$a0 at pe.entry_point
}

rule VIRUSIWormHybris {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 }

condition:
		$a0
}

rule GPInstallv50332 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0 }

condition:
		$a0
}

rule PseudoSigner02PEIntro10Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }

condition:
		$a0 at pe.entry_point
}

rule Armadillov410SiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 }

condition:
		$a0 at pe.entry_point
}

rule AverCryptor102betaos1r1s {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }

condition:
		$a0 at pe.entry_point
}

rule FSGv131 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 }

condition:
		$a0 at pe.entry_point
}

rule FSGv133 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }

condition:
		$a0 at pe.entry_point
}

rule HidePE101BGCorp {
      meta:
		author="malware-lu"
strings:
		$a0 = { BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D }

condition:
		$a0 at pe.entry_point
}

rule EXEStealthv11 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC }

condition:
		$a0 at pe.entry_point
}

rule Thinstallvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule Obsidium1200ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 3F 1E 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PrivatePersonalPackerPPP103ConquestOfTroycom {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }

condition:
		$a0 at pe.entry_point
}

rule VIRUSIWormBagle {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 }

condition:
		$a0
}

rule RLPackv118BasicLZMAAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

condition:
		$a0 at pe.entry_point
}

rule StonesPEEncryptorv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }

condition:
		$a0 at pe.entry_point
}

rule Upackv029betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02BJFNT11bAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }

condition:
		$a0 at pe.entry_point
}

rule UPXScramblerRCv1x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }

condition:
		$a0 at pe.entry_point
}

rule PECrypt15BitShapeSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }

condition:
		$a0 at pe.entry_point
}

rule Upackv021BetaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }

condition:
		$a0 at pe.entry_point
}

rule UPXFreakV01HMX0101 {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 }

condition:
		$a0 at pe.entry_point
}

rule UnnamedScrambler20p0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }

condition:
		$a0
}

rule HACKSTOPv100 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }

condition:
		$a0 at pe.entry_point
}

rule ExeShield36wwwexeshieldcom {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }

condition:
		$a0 at pe.entry_point
}

rule Pe123v200644 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }

condition:
		$a0 at pe.entry_point
}

rule SDProtectorV11xRandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 }

condition:
		$a0 at pe.entry_point
}

rule BobPackv100BoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }

condition:
		$a0 at pe.entry_point
}

rule DBPEv210 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }

condition:
		$a0 at pe.entry_point
}

rule NsPackv31NorthStar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
	$a1 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }

condition:
		$a0 at pe.entry_point or $a1
}

rule SVKProtectorV13XPavolCerven {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakePECrypt102FEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02WATCOMCCEXEAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 90 90 90 90 57 41 }

condition:
		$a0 at pe.entry_point
}

rule PENinja: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule UpackV036Dwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01 }
	$a1 = { BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule yodasProtectorv101AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule UPX050070 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D }

condition:
		$a0 at pe.entry_point
}

rule VxVCLencrypted {
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3 }
	$a1 = { 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule VxXRCV1015 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }

condition:
		$a0 at pe.entry_point
}

rule RLPackv118BasicDLLaPLibAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

condition:
		$a0 at pe.entry_point
}

rule PellesC290300400DLLX86CRTLIB {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }

condition:
		$a0 at pe.entry_point
}

rule UnnamedScrambler13Bp0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }

condition:
		$a0 at pe.entry_point
}

rule HyingsPEArmor075exeHyingCCG {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }

condition:
		$a0
}

rule SimbiOZPolyCryptorvxxExtranger {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 }

condition:
		$a0 at pe.entry_point
}

rule AVPACKv120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }

condition:
		$a0 at pe.entry_point
}

rule Armadillov220 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule XPack167 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }

condition:
		$a0 at pe.entry_point
}

rule NullsoftInstallSystemv1xx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
	$a1 = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule BobSoftMiniDelphiBoBBobSoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 }
	$a1 = { 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8 }
	$a2 = { 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

rule UltraProV10SafeNet {
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv1242v1243 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }

condition:
		$a0 at pe.entry_point
}

rule SimplePack121build0909Method2bagie {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}

rule Obsidium13037ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxPhoenix927 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }

condition:
		$a0 at pe.entry_point
}

rule Petite14c199899IanLuck {
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }

condition:
		$a0 at pe.entry_point
}

rule eXPressorV10CGSoftLabs {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RECryptv07xCruddRETh2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }

condition:
		$a0 at pe.entry_point
}

rule PassEXEv20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A }

condition:
		$a0 at pe.entry_point
}

rule RECryptv07xCruddRETh1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B }

condition:
		$a0 at pe.entry_point
}

rule WIBUKeyV410Ahttpwibucomus {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }

condition:
		$a0 at pe.entry_point
}

rule Mew501NorthFoxHCC {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01ExeSmasherAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }

condition:
		$a0 at pe.entry_point
}

rule UnnamedScrambler12C12Dp0ke {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54 }

condition:
		$a0
}

rule AlexProtectorv04beta1byAlex {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }

condition:
		$a0
}

rule UG2002Cruncherv03b3 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 }

condition:
		$a0 at pe.entry_point
}

rule FishPEShield101HellFish {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14 }
	$a1 = { 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule PseudoSigner01Neolite20Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule PEIntrov10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48 }

condition:
		$a0 at pe.entry_point
}

rule Obsidiumv1250ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

condition:
		$a0 at pe.entry_point
}

rule DevC4992BloodshedSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D }

condition:
		$a0 at pe.entry_point
}

rule RLPackV119DllLZMA430ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }

condition:
		$a0 at pe.entry_point
}

rule XJXPALLiNSoN {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }

condition:
		$a0 at pe.entry_point
}

rule Armadillov220b1 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}

rule RCryptor20Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF }

condition:
		$a0 at pe.entry_point
}

rule SentinelSuperProAutomaticProtectionv641Safenet {
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }

condition:
		$a0 at pe.entry_point
}

rule TMTPascalv040 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02CrunchPEHeuristicAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeMSVCDLLMethod4emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule VcAsmProtectorV10XVcAsm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VBOXv42MTE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeUPX0896102105124emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualC {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
	$a1 = { C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule VxHafen809 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117LZMAAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01LTC13Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }

condition:
		$a0 at pe.entry_point
}

rule ACProtectv141 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtectorV1031AshkbizDanehkar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

condition:
		$a0 at pe.entry_point
}

rule tElock096tE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C }

condition:
		$a0 at pe.entry_point
}

rule WerusCrypter10byKas {
      meta:
		author="malware-lu"
strings:
		$a0 = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule HEALTHv51byMuslimMPolyak {
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26 }

condition:
		$a0 at pe.entry_point
}

rule PCGuardv303dv305d {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule VxNovember17768 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC }

condition:
		$a0 at pe.entry_point
}

rule BeRoTinyPascalBeRo {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }

condition:
		$a0 at pe.entry_point
}

rule PrivateexeProtector21522XSetiSoftTeam {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }

condition:
		$a0
}

rule Protectorv1111DDeMPEEnginev09DDeMCIv092 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01XCR011Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }

condition:
		$a0 at pe.entry_point
}

rule Trivial173bySMTSMF {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }

condition:
		$a0 at pe.entry_point
}

rule ASProtectv11MTE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }

condition:
		$a0 at pe.entry_point
}

rule WARNINGTROJANRobinPE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule PiCryptor10byScofield {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 }
	$a1 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3 }
	$a2 = { 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9 }

condition:
		$a0 or $a1 at pe.entry_point or $a2
}

rule PseudoSigner02MacromediaFlashProjector60Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeWWPack321xemadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule PEArmor07600765hying {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 }

condition:
		$a0
}

rule PECryptv102 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }

condition:
		$a0 at pe.entry_point
}

rule ILUCRYPTv4015exe {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }

condition:
		$a0 at pe.entry_point
}

rule NJoy13NEX {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

rule VBOXv43v46 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
	$a1 = { 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40 }

condition:
		$a0 or $a1
}

rule CodeLockvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 }

condition:
		$a0 at pe.entry_point
}

rule CipherWallSelfExtratorDecryptorGUIv15 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }

condition:
		$a0 at pe.entry_point
}

rule ARMProtectorv01bySMoKE {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }

condition:
		$a0
}

rule Upackv037betaDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
	$a1 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule PrivateExeProtector1xsetisoft {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3 }

condition:
		$a0 at pe.entry_point
}

rule Petitev14 {
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00 }

condition:
		$a0 at pe.entry_point
}

rule NullsoftInstallSystemv20a0 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }

condition:
		$a0
}

rule Obsidium1332ObsidiumSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00 }

condition:
		$a0 at pe.entry_point
}

rule modifiedHACKSTOPv111f {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8 }

condition:
		$a0 at pe.entry_point
}

rule VxKuku886 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }

condition:
		$a0 at pe.entry_point
}

rule VxCIHVersion12TTITWIN95CIH {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }

condition:
		$a0 at pe.entry_point
}

rule ShegerdDongleV478MSCo {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }

condition:
		$a0 at pe.entry_point
}

rule SDProtectRandyLi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 }

condition:
		$a0 at pe.entry_point
}

rule SmokesCryptv12 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }

condition:
		$a0 at pe.entry_point
}

rule PEncryptv31 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 ?? ?? ?? 00 F0 0F C6 }

condition:
		$a0 at pe.entry_point
}

rule PEncryptv30 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA }

condition:
		$a0 at pe.entry_point
}

rule RJoiner12byVaska250320071658 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }

condition:
		$a0 at pe.entry_point
}

rule Minke101byCodius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }

condition:
		$a0 at pe.entry_point
}

rule CrypWrapvxx {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }

condition:
		$a0 at pe.entry_point
}

rule WarningmaybeSimbyOZpolycryptorby3xpl01tver2xx250320072200 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }

condition:
		$a0 at pe.entry_point
}

rule WARNINGTROJANHuiGeZi {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeyodascryptor12emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

rule EPv10 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 }

condition:
		$a0 at pe.entry_point
}

rule D1S1Gv11betaD1N {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 }

condition:
		$a0
}

rule PROPACKv208 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53 }

condition:
		$a0 at pe.entry_point
}

rule BlackEnergyDDoSBotCrypter {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F }

condition:
		$a0 at pe.entry_point
}

rule HACKSTOPv113 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }

condition:
		$a0 at pe.entry_point
}

rule FreeJoiner151GlOFF {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52 }

condition:
		$a0 at pe.entry_point
}

rule PeXv099EngbartCrackPl {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

condition:
		$a0 at pe.entry_point
}

rule HACKSTOPv119 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }

condition:
		$a0 at pe.entry_point
}

rule HACKSTOPv118 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv200b {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }

condition:
		$a0 at pe.entry_point
}

rule PKLITEv200c {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv032afakeNeolite20emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv300v301Relocationspack {
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02CodeSafe20Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner02ZCode101Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VxCaz1204 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }

condition:
		$a0 at pe.entry_point
}

rule ZealPack10Zeal {
      meta:
		author="malware-lu"
strings:
		$a0 = { C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4 }

condition:
		$a0 at pe.entry_point
}

rule CPAV: Packer PEiD {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEdition117iBoxLZMAAp0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }

condition:
		$a0 at pe.entry_point
}

rule INCrypter03INinYbyz3e_NiFe {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3 }

condition:
		$a0
}

rule MorphineV27Holy_FatherRatter29A {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }

condition:
		$a0
}

rule nBinderv361 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C }

condition:
		$a0
}

rule MatrixDongleTDiGmbH {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
	$a1 = { E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF }

condition:
		$a0 or $a1 at pe.entry_point
}

rule NullsoftInstallSystemv20RC2 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }

condition:
		$a0
}

rule UnoPiX075BaGiE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61 }

condition:
		$a0 at pe.entry_point
}

rule WWPACKv305c4UnextractablePasswordchecking {
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

rule FSGv110EngdulekxtBorlandDelphi20 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }

condition:
		$a0 at pe.entry_point
}

rule Reg2Exe225byJanVorel {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov420SiliconRealmsToolworks {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }

condition:
		$a0 at pe.entry_point
}

rule DalKrypt10byDalKiT {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv15Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor239compressedresources {
      meta:
		author="malware-lu"
strings:
		$a0 = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5 }

condition:
		$a0 at pe.entry_point
}

rule GameGuardv20065xxexesignbyhot_UNP {
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00 }

condition:
		$a0 at pe.entry_point
}

rule EnigmaProtectorv112LITE {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }

condition:
		$a0 at pe.entry_point
}

rule MSLRHv01emadicius {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 }
	$a1 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }

condition:
		$a0 or $a1 at pe.entry_point
}

rule Apex_cbeta500mhz {
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule VProtector11A12vcasm {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }

condition:
		$a0
}

rule codeCrypter031 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }

condition:
		$a0
}

rule PKTINYv10withTINYPROGv38 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }

condition:
		$a0 at pe.entry_point
}

rule AHTeamEPProtector03fakePESHiELD2xFEUERRADER {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

condition:
		$a0 at pe.entry_point
}

rule RLPackFullEditionV11Xap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }

condition:
		$a0
}

rule Excalibur103forgot {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

rule RLPack118DllaPlib043ap0x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01MicrosoftVisualC50MFCAnorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }

condition:
		$a0 at pe.entry_point
}

rule Pohernah101byKas {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

condition:
		$a0 at pe.entry_point
}

rule Armadillov25xv26x {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }

condition:
		$a0 at pe.entry_point
}

rule PESpinv11Cyberbob {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}

rule Escargot01byueMeat {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50 }

condition:
		$a0
}

rule EncryptPE2200461622006630WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0 at pe.entry_point
}

rule tElockv060 {
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01BorlandDelphi30Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

rule ActiveMARKTMR5311140Trymedia {
      meta:
		author="malware-lu"
strings:
		$a0 = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }

condition:
		$a0 at pe.entry_point
}

rule PEBundlev244 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD }

condition:
		$a0 at pe.entry_point
}

rule PECompactv120v1201 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40 }

condition:
		$a0 at pe.entry_point
}

rule ASPackv104bAlexeySolodovnikov {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D }

condition:
		$a0 at pe.entry_point
}

rule MESSv120 {
      meta:
		author="malware-lu"
strings:
		$a0 = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }

condition:
		$a0 at pe.entry_point
}

rule RCryptorv13v14Vaska {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 }
	$a1 = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

rule ThinstallV27XJitit {
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 }

condition:
		$a0 at pe.entry_point
}

rule eXPressor120BetaPEPacker {
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }

condition:
		$a0 at pe.entry_point
}

rule Packanoid10ackanoid {
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 }

condition:
		$a0 at pe.entry_point
}

rule EncryptPE1200331812003518WFS {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv09781 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }

condition:
		$a0 at pe.entry_point
}

rule PECompactv09782 {
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85 }

condition:
		$a0 at pe.entry_point
}

rule PseudoSigner01Gleam100Anorganix {
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }

condition:
		$a0 at pe.entry_point
}

rule UPackAltStubDwing {
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }

condition:
		$a0 at pe.entry_point
}

rule VxModificationofHi924 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B }

condition:
		$a0 at pe.entry_point
}

rule EXECryptor226DLLminimumprotection {
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9 }

condition:
		$a0 at pe.entry_point
}

rule yodasProtector102AshkibizDanehlar {
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

condition:
		$a0 at pe.entry_point
}

rule ACProtectv135riscosoftwareIncAnticrackSoftware {
      meta:
		author="malware-lu"
strings:
		$a0 = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }

condition:
		$a0
}

rule upx_0_80_to_1_24 : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="UPX 0.80 to 1.24"

	strings:
		$str1={6A 60 68 60 02 4B 00 E8 8B 04 00 00 83 65 FC 00 8D 45 90 50 FF 15 8C F1 48 00 C7 45 FC FE FF FF FF BF 94 00 00 00 57}

	condition:
		$str1 at pe.entry_point
}

rule upx_1_00_to_1_07 : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		description="UPX 1.00 to 1.07"

	strings:
		$str1={60 BE 00 ?0 4? 00 8D BE 00 B0 F? FF ?7 8? [3] ?0 9? [0-9] 90 90 90 90 [0-2] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0}

	condition:
		$str1 at pe.entry_point
}

rule upx_3 : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="UPX 3.X"

	strings:
		$str1={60 BE 00 [2] 00 8D BE 00 [2] FF [1-12] EB 1? 90 90 90 90 90 [1-3] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01}

	condition:
		$str1 at pe.entry_point
}

rule obsidium : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="21/01/2013"
		last_edit="17/03/2013"
		description="Obsidium"

	strings:
		$str1={EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04} /*EntryPoint*/

	condition:
		$str1 at pe.entry_point
}

rule pecompact2 : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="PECompact"

	strings:
		$str1={B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43} /*EntryPoint*/

	condition:
		$str1 at pe.entry_point
}

rule aspack : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="ASPack"

	strings:
		$str1={60 E8 00 00 00 00 5D 81 ED 5D 3B 40 00 64 A1 30 00 00 00 0F B6 40 02 0A C0 74 04 33 C0 87 00 B9 ?? ?? 00 00 8D BD B7 3B 40 00 8B F7 AC} /*EntryPoint*/

	condition:
		$str1 at pe.entry_point
}

rule execryptor : Protector {
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="EXECryptor"

	strings:
		$str1={E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 64 8F 05 00 00 00 00} /*EntryPoint*/

	condition:
		$str1 at pe.entry_point
}

rule winrar_sfx : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="18/03/2013"
		description="Winrar SFX Archive"

	strings:
		$signature1={00 00 53 6F 66 74 77 61 72 65 5C 57 69 6E 52 41 52 20 53 46 58 00}

	condition:
		$signature1
}

rule mpress_2_xx_x86 : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		last_edit="24/03/2013"
		description="MPRESS v2.XX x86  - no .NET"

	strings:
		$signature1={60 E8 00 00 00 00 58 05 [2] 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6}

	condition:
		$signature1 at pe.entry_point
}

rule mpress_2_xx_x64 : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		last_edit="24/03/2013"
		description="MPRESS v2.XX x64  - no .NET"

	strings:
		$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31}

	condition:
		$signature1 at pe.entry_point
}

rule mpress_2_xx_net : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="24/03/2013"
		description="MPRESS v2.XX .NET"

	strings:
		$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}

	condition:
		$signature1
}

rule rpx_1_xx : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="24/03/2013"
		description="RPX v1.XX"

	strings:
		$signature1= "RPX 1."
		$signature2= "Copyright 20"

	condition:
		$signature1 and $signature2
}

rule mew_11_xx : Packer {
	meta:
		author="Kevin Falcoz"
		date_create="25/03/2013"
		description="MEW 11"

	strings:
		$signature1={50 72 6F 63 41 64 64 72 65 73 73 00 E9 [6-7] 00 00 00 00 00 00 00 00 00 [7] 00}
		$signature2="MEW"

	condition:
		$signature1 and $signature2
}

rule yoda_crypter_1_2 : Crypter {
	meta:
		author="Kevin Falcoz"
		date_create="15/04/2013"
		description="Yoda Crypter 1.2"

	strings:
		$signature1={60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [19] EB 01 [27] AA E2 CC}

	condition:
		$signature1 at pe.entry_point
}

rule yoda_crypter_1_3 : Crypter {
	meta:
		author="Kevin Falcoz"
		date_create="15/04/2013"
		description="Yoda Crypter 1.3"

	strings:
		$signature1={55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}

	condition:
		$signature1 at pe.entry_point
}

rule  dotfuscator : packer {
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "Dotfuscator"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0"

	strings:
		$a = "Obfuscated with Dotfuscator"

	condition:
		$a
}

rule  AutoIt_2 : packer {
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "AutoIT packer"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0"

	strings:
		$a = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."

	condition:
		$a
}

rule  mumblehard_packer {
    meta:
        description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
        author = "Marc-Etienne M.Leveille"
        date = "2015-04-07"
        reference = "http://www.welivesecurity.com"
        version = "1"

    strings:

	$decrypt = { 31 db [1-10] ba ?? 00 00 00 [0-6] (56 5f | 89 F7) 39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00 00 31 db 43 ac 30 d8 aa 43 e2 e2 }

    condition:
        $decrypt
}


================================================
FILE: yara_rules/packer_compiler_signatures.yar
================================================
/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/

import "pe"
import "math"

rule IsPE32 {
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint16(uint32(0x3C)+0x18) == 0x010B
}

rule IsPE64 {
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint16(uint32(0x3C)+0x18) == 0x020B
}

rule IsNET_EXE {
	condition:
		pe.imports ("mscoree.dll","_CorExeMain")
}

rule IsNET_DLL {
	condition:
		pe.imports ("mscoree.dll","_CorDllMain")
}

rule IsDLL {
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		(uint16(uint32(0x3C)+0x16) & 0x2000) == 0x2000

}

rule IsConsole {
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint16(uint32(0x3C)+0x5C) == 0x0003
}

rule IsWindowsGUI {
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint16(uint32(0x3C)+0x5C) == 0x0002
}

rule IsPacked {
	meta: 
		description = "Entropy Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		math.entropy(0, filesize) >= 7.0
}


rule HasOverlay {
	meta: 
		author="_pusher_"
		description = "Overlay Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//stupid check if last section is 0		
		//not (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x0 and

		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) < filesize
		
}

rule HasTaggantSignature {
	meta: 
		author="_pusher_"
		description = "TaggantSignature Check"
		date="2016-07"
	strings:		
		$a0 = { 54 41 47 47 ?? ?? ?? ?? ?? ?? 00 00 ?? 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 09 30 07 06 05 2B 0E 03 02 1A 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 01 A0 82 ?? ?? 04 82 ?? ?? ?? 00 01 00 ?? ?? }
		//$c0 = { 06 09 2A 86 }
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//TAGG+4E==packerid
		//(uint32be(@a0+0x4E) == 0x0B51D132) and
		//(uint32be(@a0+0x12) == 0x006092a86) and
		//(uint32be(@a0+0x12)) == uint32be(@c0) and

		//uint32be(@a0+0x04) < (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) and
		$a0
}


rule HasDigitalSignature {
	meta: 
		author="_pusher_"
		description = "DigitalSignature Check"
		date="2016-07"
	strings:		
		//size check is wildcarded
		$a0 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0B 30 09 06 05 2B 0E 03 02 1A 05 00 30 68 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 5A 30 58 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14 }
		$a1 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0B 30 09 06 05 2B 0E 03 02 1A 05 00 30 ?? 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 ?? 30 ?? 30 ?? 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 ?? 03 01 00 A0 ?? A2 ?? 80 00 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14 }
		$a2 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0E 30 ?? 06 ?? ?? 86 48 86 F7 0D 02 05 05 00 30 67 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 59 30 57 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 20 30 0C 06 08 2A 86 48 86 F7 0D 02 05 05 00 04 }
		$a3 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0F 30 ?? 06 ?? ?? 86 48 01 65 03 04 02 01 05 00 30 78 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 6A 30 68 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 31 30 0D 06 09 60 86 48 01 65 03 04 02 01 05 00 04 }
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(for any of ($a*) : ($ in ( (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size)..filesize)) )
		//its not always like this:
		//and  uint32(@a0) == (filesize-(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size))
}

rule HasDebugData {
	meta: 
		author = "_pusher_"
		description = "DebugData Check"
		date="2016-07"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//orginal
		//((uint32(uint32(0x3C)+0xA8) >0x0) and (uint32be(uint32(0x3C)+0xAC) >0x0))
		//((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) x64/x32
		(IsPE32 or IsPE64) and
		((uint32(uint32(0x3C)+0xA8+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)) >0x0) and (uint32be(uint32(0x3C)+0xAC+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)) >0x0))
}

rule IsBeyondImageSize {
	meta: 
		author = "_pusher_"
		date = "2016-07"
		description = "Data Beyond ImageSize Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		for any i in (0..pe.number_of_sections-1):
		( 
		(pe.sections[i].virtual_address+pe.sections[i].virtual_size) > (uint32(uint32(0x3C)+0x50)) or
		(pe.sections[i].raw_data_offset+pe.sections[i].raw_data_size) > filesize
		)
}

rule ImportTableIsBad {
	meta: 
		author = "_pusher_ & mrexodia"
		date = "2016-07"
		description = "ImportTable Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(IsPE32 or IsPE64) and
		(
		((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))))     > (uint32(uint32(0x3C)+0x50)) 
		or
		(((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))))  == 0x0)
		or
		(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) > filesize)
		)				
}

rule ExportTableIsBad {
	meta: 
		author = "_pusher_ & mrexodia"
		date = "2016-07"
		description = "ExportTable Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(IsPE32 or IsPE64) and
		( 		//Export_Table_RVA+Export_Data_Size .. cannot be outside imagesize
		((uint32(uint32(0x3C)+0x78+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x7C+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))))     > (uint32(uint32(0x3C)+0x50)) 
		)		
}


rule HasModified_DOS_Message {
	meta: 
		author = "_pusher_"
		description = "DOS Message Check"
		date="2016-07"
	strings:	
		$a0 = "This program must be run under Win32" wide ascii nocase
		$a1 = "This program cannot be run in DOS mode" wide ascii nocase
		//UniLink
		$a2 = "This program requires Win32" wide ascii nocase
		$a3 = "This program must be run under Win64" wide ascii nocase
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and not
		(for any of ($a*) : ($ in (0x0..uint32(0x3c) )))
}

rule HasRichSignature {
	meta: 
		author = "_pusher_"
		description = "Rich Signature Check"
		date="2016-07"
	strings:	
		$a0 = "Rich" ascii
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(for any of ($a*) : ($ in (0x0..uint32(0x3c) )))
}

rule IsSuspicious {
	meta:
		author="_pusher_"
		date = "2016-07"
		description="Might be PE Virus"
	condition:
		uint32(0x20) == 0x20202020	
}

rule IsGoLink {
	meta:
		author="_pusher_"
		date = "2016-08"
		description="www.GoDevTool.com"
	strings:
		$a0 = { 47 6F 4C 69 6E 6B }
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		$a0 at 0x40

}


rule borland_cpp {
	meta:
		author = "_pusher_"
		description = "Borland C++"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { 59 5F 6A 00 E8 ?? ?? ?? ?? 59 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
		$c1 = { A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52 6A 00 E8 ?? ?? ?? ?? 8B D0 E8 ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? 59 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
		$c2 = { 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
	condition:
		(
		//linker 2.25 and 5.00
		((pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )) or
		((pe.linker_version.major == 5) and (pe.linker_version.minor == 0 ))
		) and
		any of them
}

rule borland_delphi {
	meta:
		author = "_pusher_"
		description = "Borland Delphi 2.0 - 7.0 / 2005 - 2007"
		date = "2016-03"
		version = "0.2"
	strings:
		$c0 = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 }
		$c1 = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 8D 43 08 A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 5B C3 }
		// some x64 version of delphi
		$c2 = { 53 48 83 EC 20 48 89 CB C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 33 C9 E8 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 43 10 48 89 05 ?? ?? ?? ?? 48 8D 05 ?? FC FF FF 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D9 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 C4 20 5B C3 }
		// unusual delphi version unknown version (unpackme- FSG 1.31 - dulek)
		$c3 = { 50 6A 00 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
		// delphi2
		$c4 = { E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }
		// delphi3
		$c5 = { 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0 }
		// delphi5
		$c6 = { 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
	condition:
		any of them
		and
		(
		//if its not linker 2.25 its been modified (unpacked usually)
												//unknown x64 build of delphi
		((pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )) or ((pe.linker_version.major == 8) and (pe.linker_version.minor == 0 ))
		//unpacked files usually have this linker:
		or ((pe.linker_version.major == 0) and (pe.linker_version.minor == 0 )) )
		//could check for dvclal.. maybe too much
}

rule free_pascal {
	meta:
		author = "_pusher_"
		description = "Free Pascal"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { 55 89 E5 83 ?? ?? 89 5D FC B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? A0 ?? ?? ?? ?? 84 C0 75 0C 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 }
		$c1 = { 55 89 E5 53 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? 00 75 0C 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 }
		$c2 = { 55 89 E5 83 EC 04 89 5D FC B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A0 ?? ?? ?? ?? 84 C0 75 05 E8 ?? ?? ?? ?? C7 05 }
	condition:
		any of them
}

rule borland_delphi_dll {
	meta:
		author = "_pusher_"
		description = "Borland Delphi DLL"
		date = "2015-08"
		version = "0.1"
		info = "one is at entrypoint"
	strings:
		$c0 = { BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04 }
		$c1 = { 55 8B EC 83 C4 ?? B8 ?? ?? ?? ?? E8 ?? ?? FF FF E8 ?? ?? FF FF 8D 40 00 }
	condition:
		any of them
}

rule borland_component {
	meta:
		author = "_pusher_"
		description = "Borland Component"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { E9 ?? ?? ?? FF 8D 40 00 }
	condition:
		$c0 at pe.entry_point
}

rule PureBasic : Neil Hodgson {
      	meta:
		author="_pusher_"
		date="2016-07"
	strings:
		//make check for msvrt.dll
		$c0 = { 55 8B EC 6A 00 68 00 10 00 00 6A ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 C7 05 ?? ?? ?? ?? 10 00 00 00 A1 ?? ?? ?? ?? 50 6A ?? 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC }
		$c1 = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
		$aa0 = "\x00MSVCRT.dll\x00" ascii
		$aa1 = "\x00CRTDLL.dll\x00" ascii
	condition:
		(for any of ($c0,$c1) : ( $ at pe.entry_point  )) and 
		(any of ($aa*) ) and
		((pe.linker_version.major == 2) and (pe.linker_version.minor == 50 ))
}

rule PureBasicDLL : Neil Hodgson {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8 }

condition:
		$a0 at pe.entry_point
}

rule PureBasic4xDLL : Neil Hodgson {
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }

condition:
		$a0 at pe.entry_point
}

rule SkDUndetectabler : SkDrat {
	meta:
		author = "_pusher_"
	condition:
		(
		borland_delphi or //check All FSG or
		((pe.linker_version.major == 6) and (pe.linker_version.minor == 0 ))
		)
		and
		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size < filesize) and
		//is overlay at offset 2A00,1A00,C00,745,739
		//pe.overlay & pe.overlay_size would have been prettier
		( 
		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000739)  or
		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000745)  or
		//Uncompressed
		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000C00)  or
		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00002A00)  or
		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00001A00)
		)
		and
		//is xored MZ ?
		( 
		uint16(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x6275 or
		uint16(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x4057
		)
}

rule MicrosoftVisualCV80 {
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 68 [4] E8 [4] BB 94 00 00 00 53 6A 00 8B [5] FF D7 50 FF [5] 8B F0 85 F6 75 0A 6A 12 E8 [4] 59 EB 18 89 1E 56 FF [5] 56 85 C0 75 14 50 FF D7 50 FF [5] B8 }

condition:
		$a0 at pe.entry_point
}

rule Cygwin : Red Hat {
	meta:
		author = "_pusher_"
		date = "2016-07"
	strings:		
		$a0 = "cygwin1.dll" ascii nocase
		$aa1 = "cygwin_internal"
		$aa2 = "cygwin_detach_dll"
	condition:
		(
		(pe.linker_version.major == 2) and (pe.linker_version.minor == 56 ) or
		(pe.linker_version.major == 2) and (pe.linker_version.minor == 24 ) or
		(pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )
		)
		and
		($a0 and (any of ($aa*) ))
}

rule MinGW_1 {
	meta:
		author = "_pusher_"
		date = "2016-07"
	strings:		
		$a0 = "msvcrt.dll" ascii nocase
		$aa1 = "Mingw-w64 runtime failure:"
		$aa2 = "-LIBGCCW32-EH-3-SJLJ-GTHR-MINGW32" wide ascii nocase
		$aa3 = "_mingw32_init_mainargs"
		//too wild ?
		$aa4 = "mingw32"
		$aa5 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32" wide ascii nocase
		$aa6 = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32" wide ascii nocase
		$aa7 = "Mingw runtime failure:"
	condition:
		(
		(pe.linker_version.major == 2) and (pe.linker_version.minor == 56 ) or
		(pe.linker_version.major == 2) and ((pe.linker_version.minor >= 21) and (pe.linker_version.minor <= 25))
		)
		and
		($a0 and (any of ($aa*) ))
}

rule FASM : flat assembler {
//abit weak, needs more targets & testing
	meta:
		author = "_pusher_"
		date = "2016-01"
		description = "http://flatassembler.net"
	//strings:
		//$c0 = { 55 89 E5 83 EC 1C 8D 45 E4 6A 1C 50 FF 75 08 FF 15 ?? ?? ?? ?? 8B 45 E8 C9 C2 04 00 }
	condition:
		(
		//linker 1.60..1.79
		(pe.linker_version.major == 1) and ((pe.linker_version.minor >= 60) and (pe.linker_version.minor < 80))
		) 
		//and $c0
}

rule AutoIt {
	meta:
		author = "_pusher_"
		date = "2016-07"
		description = "www.autoitscript.com/site/autoit/"
	strings:		
		$aa0 = "AutoIt has detected the stack has become corrupt.\n\nStack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.\n\nAutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions.  The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead.  See the DllCall() documentation for details on changing the calling convention." wide ascii nocase
		$aa1 = "AutoIt Error" wide ascii nocase
		$aa2 = "Missing right bracket ')' in expression." wide ascii nocase
		$aa3 = "Missing operator in expression." wide ascii nocase
		$aa4 = "Unbalanced brackets in expression." wide ascii nocase
		$aa5 = "Error parsing function call." wide ascii nocase
	
		$aa6 = ">>>AUTOIT NO CMDEXECUTE<<<" wide ascii nocase
		$aa7 = "#requireadmin" wide ascii nocase
		$aa8 = "#OnAutoItStartRegister" wide ascii nocase
		$aa9 = "#notrayicon" wide ascii nocase
		$aa10 = "Cannot parse #include" wide ascii nocase
	condition:
		5 of ($aa*)
}


rule PellesC : Pelle Orinius {
	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "www.smorgasbordet.com/pellesc"
	strings:		
		$aa0 = " -- terminating\x0D\x0A\x00 -- terminating\x0A\x00CRT: \x00unexpected error\x00" wide ascii nocase	
		$aa1 = "unhandled exception (main)\x00unhandled exception in thread\x00unable to create thread\x00unable to destroy semaphore\x00" wide ascii nocase
		$aa2 = "unable to wait on semaphore\x00unable to post semaphore\x00unable to init semaphore\x00unable to unlock mutex\x00unable to lock mutex\x00unable to init mutex\x00" wide ascii nocase
		$aa3 = "invalid stream lock number\x00corrupt per-thread data\x00out of memory\x00unable to init threads\x00unable to init HEAP" wide ascii nocase
	condition:
		3 of ($aa*) and
		(pe.linker_version.major == 2) and (pe.linker_version.minor == 50 )
}

rule QtFrameWork {
      	meta:
		author="_pusher_"
		date="2016-08"
	strings:
		$aa0 = "\x00Qt5Core.dll\x00" ascii
		$aa1 = "\x00QtCore4.dll\x00" ascii
	condition:
		(any of ($aa*) )
}

/* usefull ? 18:32 2016-08-10
rule masm32_tasm32 {
	meta:
		author = "PEiD"
		description = "MASM32 / TASM32"
		group = "20"
		function = "0"
	strings:
		$a0 = { 6A ?? E8 ?? ?? ?? ?? A3 }
	condition:
		$a0
}
*/


================================================
FILE: yara_rules/peid.yar
================================================
/*
YARA rules generated with ./peid2yara.py
BY: Jaume Martin
GITHUB: https://git.todoparami.net/Xumeiquer/PEiD_to_Yara
GENERATED ON: 2016-08-29 21:22:29.883920

Rules generated from:

https://raw.githubusercontent.com/joxeankoret/pyew/VERSION_3X/plugins/UserDB.TXT
https://raw.githubusercontent.com/AlienVault-Labs/AlienVaultLabs/master/peid2yar/dbs/userdb_panda.txt
https://raw.githubusercontent.com/AlienVault-Labs/AlienVaultLabs/master/peid2yar/dbs/userdb_jclausing.txt
https://raw.githubusercontent.com/AlienVault-Labs/AlienVaultLabs/master/peid2yar/dbs/userdb_exeinfope.txt
https://raw.githubusercontent.com/AlienVault-Labs/AlienVaultLabs/master/peid2yar/dbs/eppackersigs.peid
https://raw.githubusercontent.com/AlienVault-Labs/AlienVaultLabs/master/peid2yar/dbs/epcompilersigs.peid
https://raw.githubusercontent.com/AlienVault-Labs/AlienVaultLabs/master/peid2yar/dbs/UserDB.TXT
https://raw.githubusercontent.com/cuckoosandbox/cuckoo/master/data/peutils/UserDB.TXT
http://handlers.sans.org/jclausing/userdb.txt
https://raw.githubusercontent.com/seifreed/PEID/master/userdb.txt
https://raw.githubusercontent.com/guelfoweb/peframe/5beta/peframe/signatures/userdb.txt


*/

import "pe"

rule NsPacK_V33_LiuXingPing_additional {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ACProtect_109_additional {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule PEnguinCrypt_v10 {
    strings:
        $a = { B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_30xx_Jitit_Software_additional {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v02_v20x_additional {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_19901992 {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Cpp_1999_additional {
    strings:
        $a = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
    condition:
        $a at pe.entry_point
}

rule PerlApp_602_ActiveState {
    strings:
        $a = { 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55 }
        $b = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Symantec_Visual_Cafe_v30_additional {
    strings:
        $a = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Elicense_System_V4000_ViaTech_Inc {
    strings:
        $a = { 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule nBinder_v361 {
    strings:
        $a = { 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C }
        $b = { 6E 73 70 61 63 6B 24 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v30_EXE_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v107b_DLL {
    strings:
        $a = { 90 90 90 75 }
        $b = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_C_for_Windows {
    strings:
        $a = { 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule Ciphator_46 {
    strings:
        $a = { 93 93 E8 E4 0C 54 4C 4F 53 53 20 65 72 72 6F 72 05 23 00 00 00 00 00 00 8C C0 2E 31 06 18 0D B8 00 0D CD 21 33 C0 8E D8 66 0F B7 C8 0E 8F 06 06 00 68 DF 0C 8F 06 04 00 8C C8 8E D8 8E C0 B9 44 06 BE D8 0C 8B FE 2E 8B 16 14 00 FD CD 01 E2 FC }
    condition:
        $a at pe.entry_point
}

rule Vx_Phoenix927_additional {
    strings:
        $a = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }
    condition:
        $a at pe.entry_point
}

rule Thoreador_12_Sergi {
    strings:
        $a = { 55 E8 00 00 00 00 5D 83 ED 06 81 ED E2 00 00 00 60 EB 6F 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule QinYingShieldLicense_V10X_V121_Lei_Peng_20080122 {
    strings:
        $a = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 FE B9 FE 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SEN_Debug_Protector_Hint_DOS_EP {
    strings:
        $a = { BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1337_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_25 {
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule Symantec_Visual_Cafe_v30 {
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 8B C5 2D ?? 50 81 ED 05 ?? ?? ?? 8B C5 2B 85 03 0F ?? ?? 89 85 03 0F ?? ?? 8B F0 03 B5 0B 0F ?? ?? 8B F8 03 BD 07 0F ?? ?? 83 7F 0C ?? 74 2B 56 57 8B 7F 10 03 F8 }
        $b = { 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stones_PE_Encruptor_v113 {
    strings:
        $a = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_LZMA_430_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_V56X_DLL_Kenonic_Controls_Ltd_additional {
    strings:
        $a = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }
    condition:
        $a at pe.entry_point
}

rule ExeSafeguard_v10_simonzh_h_additional {
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF }
    condition:
        $a at pe.entry_point
}

rule VPacker_ttui {
    strings:
        $a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
        $b = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_C_20_1988_EXE {
    strings:
        $a = { BA 00 00 2E 89 16 00 01 B4 30 00 00 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 C7 06 00 00 FF FF E8 00 00 C4 3E 00 00 8B C7 8B D8 B9 FF 7F 26 81 3D 38 37 75 19 26 8B 55 02 80 FA 3D 75 10 80 E6 DF FF 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule codeCrypter_031_Tibbar_additional {
    strings:
        $a = { 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC1 {
    strings:
        $a = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC4_build_0807_dll_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V07_cyberbobnbsp_nbsp_SignByfly_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 01 ?? 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB ?? 83 04 24 0C C3 }
    condition:
        $a at pe.entry_point
}

rule Trap_118_EXE {
    strings:
        $a = { 8C D0 BB 99 CB 8E D3 33 C9 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E }
    condition:
        $a at pe.entry_point
}

rule beria_v007_public_WIP_symbiont_h_additional {
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7 }
    condition:
        $a at pe.entry_point
}

rule YZPack_12_UsAr_additional {
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C }
    condition:
        $a at pe.entry_point
}

rule PECompact_2xx_Slim_Loader_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_049_Hying_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSVCpp_DLL_v8_typical_OEP_recognized_h {
    strings:
        $a = { 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_MinGW_GCC_2x_Anorganix {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
    condition:
        $a at pe.entry_point
}

rule RSCs_Process_Patcher_v151 {
    strings:
        $a = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }
        $b = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_V13betaX_cyberbobnbsp_nbsp_SignByfly_20080311 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 }
    condition:
        $a at pe.entry_point
}

rule ThinstallVS_v3104_Jitit_Software {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB CC 1A 00 00 2B C3 50 68 00 00 ?? ?? 68 00 28 00 00 68 C8 00 00 00 E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_SFX_Custom {
    strings:
        $a = { E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50 }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorbased_additional {
    strings:
        $a = { E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 }
    condition:
        $a at pe.entry_point
}

rule eXcalibur_v103_forgotus_h {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 }
        $b = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_2021_protected_IAT_wwwstrongbitcom {
    strings:
        $a = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1350_Obsidium_Software {
    strings:
        $a = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 }
        $b = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Trivial173_by_SMTSMF_additional {
    strings:
        $a = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_V15_FEUERRADER {
    strings:
        $a = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        $a at pe.entry_point
}

rule StarForce_Protection_Driver_Protection_Technology {
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_minimum_protection_wwwstrongbitcom {
    strings:
        $a = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 }
    condition:
        $a at pe.entry_point
}

rule UPX_v070_Hint_WIN_EP {
    strings:
        $a = { 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73 }
    condition:
        $a at pe.entry_point
}

rule MinGW_32x_main {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D }
        $b = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Hide_PE_101_BGCorp {
    strings:
        $a = { ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D }
        $b = { BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MacroMedia_ShockWave_Movie_file {
    strings:
        $a = { 46 57 53 }
    condition:
        $a at pe.entry_point
}

rule UPX_020_EXE {
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 AF AD 0E 0E 0E 06 1F 07 16 68 00 00 BD FF FF F7 E1 93 CB 55 50 58 21 03 03 02 07 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1X_Oreans_Technologies_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule theWRAP_by_TronDoc {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }
        $b = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Visual_Cpp_50_SP3 {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 98 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF C7 05 00 00 40 00 FF FF FF FF FF 15 00 00 }
    condition:
        $a at pe.entry_point
}

rule XComp_097_098_EXE_JoKo {
    strings:
        $a = { 68 ?? ?? ?? ?? 9C 60 E8 75 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 4C ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 59 ?? 01 00 6A ?? 01 00 79 ?? 01 00 88 ?? 01 00 96 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V18X_V19X_Oreans_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9 }
        $b = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPAck_1061b {
    strings:
        $a = { 90 90 75 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1988_additional {
    strings:
        $a = { 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC }
    condition:
        $a at pe.entry_point
}

rule PRO_PACK_v208_emphasis_on_packed_size_locked_additional {
    strings:
        $a = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule RoboForm_Installer {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 F3 40 00 68 44 90 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 68 F0 40 00 33 D2 8A D4 89 15 04 6B 41 00 8B C8 81 E1 FF 00 00 00 89 0D }
    condition:
        $a at pe.entry_point
}

rule ASPack_108 {
    strings:
        $a = { 90 90 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point
}

rule PeCompact2_253_276_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_60_70 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }
    condition:
        $a at pe.entry_point
}

rule SuckStop_v111_Hint_DOS_EP {
    strings:
        $a = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig4_h {
    strings:
        $a = { FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
        $b = { C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_v118_Basic_DLL_LZMA {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
    condition:
        $a at pe.entry_point
}

rule DOS_Extender_by_Doug_Hoffmann_1994 {
    strings:
        $a = { 16 53 66 5B 72 EC 3B C8 75 E8 36 66 89 36 D2 01 57 36 8B 3E 00 00 8B 0E 06 00 8B 36 18 00 66 C1 CB 10 66 0F B7 C3 8B D0 AD 8B 1C 3B DF 0F 8D 08 00 03 DA 8E C3 26 67 01 10 83 C6 02 E2 EA B4 0F CD 10 2E A2 00 00 5F 16 1F 66 8F 06 D6 01 66 8F }
    condition:
        $a at pe.entry_point
}

rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_signed_additional {
    strings:
        $a = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_Dev_Cpp_v4991_h {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v10061_additional {
    strings:
        $a = { E8 AF 1C 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LTC_13 {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098_tE {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_13x_14x_DLL_Risco_Software_Inc_additional {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_MinGW_GCC_2x {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule N_Joy_10_NEX_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule mPack_003_DeltaAziz {
    strings:
        $a = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5 }
        $b = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Eddie2000 {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule aPack_082_d_EXE {
    strings:
        $a = { 8C CB BA 00 00 03 DA 8D 87 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E C3 8E D8 33 FF BE 2F 00 05 00 00 0E 50 6A 00 CB }
    condition:
        $a at pe.entry_point
}

rule HackStop_099_EXE {
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 D5 03 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 AE 12 E8 C0 03 8D EB 02 40 93 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1150_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 35 2E 30 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V215_V220_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SecurePE_1X_wwwdeepzoneorg {
    strings:
        $a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_V12_BG_Software_Protect_Technologies {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }
    condition:
        $a at pe.entry_point
}

rule LY_WGKX_wwwszleyucom_additional {
    strings:
        $a = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_25A_p0ke {
    strings:
        $a = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00 }
        $b = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Pack_Master_10_PEX_Clone_Anorganix {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_1451_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
    condition:
        $a at pe.entry_point
}

rule XCR_v012_X_Lock {
    strings:
        $a = { 60 9C E8 00 00 00 00 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_v11_PKWare {
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1992_1994_Hint_DOS_EP {
    strings:
        $a = { 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1989_1994_additional {
    strings:
        $a = { 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V1304_cyberbobnbsp_nbsp_SignByfly_20080310 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 ?? ?? ?? ?? EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 }
    condition:
        $a at pe.entry_point
}

rule ICE_Archive_Hint_FILE_START {
    strings:
        $a = { 2D 6C 68 ?? 2D }
    condition:
        $a at pe.entry_point
}

rule SafeGuard_V10X_simonzh2000 {
    strings:
        $a = { E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098_additional {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E }
    condition:
        $a at pe.entry_point
}

rule Upack_0399_Dwing_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22007121_WFS_SignByfly_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V15_Vaska_Sign_by_fly {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_152_Stub_engine_16_GlOFF_additional {
    strings:
        $a = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_DLL_Berczi_Gabor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule PeCompact_v208_Bitsum_Technologiessignature_by_loveboom {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D }
    condition:
        $a at pe.entry_point
}

rule PE_Protect_09 {
    strings:
        $a = { E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F }
    condition:
        $a at pe.entry_point
}

rule TheHypers_protector_TheHyper {
    strings:
        $a = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_1214_SE_DLL_SIS_Team_additional {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point
}

rule AVI_movie_file_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v14_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
        $b = { 65 58 50 72 2D 76 2E 31 2E 34 2E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_MSVCpp_DLL_Method_4_emadicius_h {
    strings:
        $a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Ciphator_v46_Hint_DOS_EP {
    strings:
        $a = { 93 93 E8 ?? ?? 58 6A 00 0E 68 ?? ?? CF EB }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_046_China_Cracking_Group {
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ASM {
    strings:
        $a = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }
    condition:
        $a at pe.entry_point
}

rule AHPack_V01_FEUERRADER {
    strings:
        $a = { 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V097_V099_MATCODE_Softwarenbsp_nbsp_SignByfly_20080416 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_h2_additional {
    strings:
        $a = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule HSI_JPEG_graphics_file {
    strings:
        $a = { 68 73 69 31 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_CodeSafe_20_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Soft_Defender_v112_additional {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v1010_win32_console {
    strings:
        $a = { C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_Delphi_stub_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_v04_beta_1_by_Alex {
    strings:
        $a = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }
        $b = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UnoPiX_103_110_BaGiE {
    strings:
        $a = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }
        $b = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule XCF_File_Format_by_Adeline_Software_additional {
    strings:
        $a = { 46 72 61 6D 65 4C 65 6E F4 0F }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_v12_Seek_and_Destroy_Patch_additional {
    strings:
        $a = { E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1989_1994 {
    strings:
        $a = { 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 }
    condition:
        $a at pe.entry_point
}

rule VBOX_v42_MTE {
    strings:
        $a = { 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 }
    condition:
        $a at pe.entry_point
}

rule PeCompact_2xx_Slim_Loader_BitSum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Studio_NET_2003_Hotfix_Custom {
    strings:
        $a = { 6A 60 68 E8 87 00 01 E8 37 14 00 00 BF 94 00 00 00 8B C7 E8 B3 05 00 00 89 65 E8 8B F4 89 3E 56 FF 15 14 10 00 01 8B 4E 10 89 0D 58 22 01 01 8B 46 04 A3 64 22 01 01 8B 56 08 89 15 68 22 01 01 }
    condition:
        $a at pe.entry_point
}

rule PE_Encrypt_10_Liwuyue_additional {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1987_additional {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_Pro_112_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_PolyCryptor_vxx_Extranger_additional {
    strings:
        $a = { 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point
}

rule Wise_Installer_Stub_11010291 {
    strings:
        $a = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }
    condition:
        $a at pe.entry_point
}

rule PGMPACK_v013_additional {
    strings:
        $a = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule MinGW_32x_Dll_WinMain_additional {
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        $a at pe.entry_point
}

rule TTPpack_additional {
    strings:
        $a = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ACProtect_109 {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
        $b = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TurboBAT_v310_50_Patched_Hint_DOS_EP {
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point
}

rule Vx_Trivial25 {
    strings:
        $a = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }
    condition:
        $a at pe.entry_point
}

rule MingWin32_GCC_V3X {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Protect_Visage {
    strings:
        $a = { 55 8B EC 51 53 56 57 C7 05 ?? ?? ?? 00 00 00 00 00 68 ?? ?? ?? 00 FF 15 00 ?? ?? 00 A3 ?? ?? ?? 00 68 ?? ?? ?? 00 A1 ?? ?? ?? 00 50 FF 15 04 ?? ?? 00 A3 ?? ?? ?? 00 6A 00 FF 15 ?? ?? ?? 00 A3 ?? ?? ?? 00 8B 0D ?? ?? ?? 00 51 E8 ?? ?? 00 00 83 C4 04 89 45 FC 83 7D FC 00 74 03 FF 65 FC 5F 5E 5B 8B E5 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_v200_1988_1989_Hint_DOS_EP {
    strings:
        $a = { FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E }
    condition:
        $a at pe.entry_point
}

rule ExeTools_COM2EXE_additional {
    strings:
        $a = { E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_v10_additional {
    strings:
        $a = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule RECSmall_v101_Hint_DOS_EP {
    strings:
        $a = { 8C D8 1E E8 ?? ?? 5D 83 ?? ?? 81 ?? ?? ?? B9 ?? ?? 40 8E D8 2B DB B2 55 }
    condition:
        $a at pe.entry_point
}

rule RLP_073beta_ap0x_h {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V307_SetiSoft_Team_20090603 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 00 00 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp {
    strings:
        $a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Registration_file_v10_additional {
    strings:
        $a = { 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point
}

rule MacroMedia_ShockWave_Movie_file_Hint_FILE_START {
    strings:
        $a = { 46 57 53 }
    condition:
        $a at pe.entry_point
}

rule LTC_v13_additional {
    strings:
        $a = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_h1_additional {
    strings:
        $a = { 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule aPack_098_i_m_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 41 73 12 FF D5 BB 10 00 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V30_V30X_SetiSoft_Team_20090215 {
    strings:
        $a = { 00 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 E0 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 E0 2E 72 73 72 63 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 40 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC4_build_0807_exe_Alexey_Solodovnikov_h {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_V2X_SoftComplete_Developement {
    strings:
        $a = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V102_Ashkbiz_Danehkar_Sign_by_fly {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Stelth_PE_101 {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SmokesCrypt_v12 {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1337_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_FSG_10_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point
}

rule ExeJoiner_10_Yoda_f2f_additional {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }
    condition:
        $a at pe.entry_point
}

rule EXELOCK_666_15 {
    strings:
        $a = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_Custom_additional {
    strings:
        $a = { 60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        $a at pe.entry_point
}

rule Vx_Backfont900 {
    strings:
        $a = { E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_Pro_v261 {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 2A 6A 00 00 E9 3E 6A 00 00 E9 39 6A 00 00 E8 6E FB FF FF 7E 04 01 00 ?? 96 00 00 ?? ?? ?? ?? ?? ?? F1 ?? ?? ?? A4 ?? ?? ?? A1 ?? ?? ?? E0 ?? ?? ?? 19 ?? ?? ?? BE ?? ?? ?? 13 }
    condition:
        $a at pe.entry_point
}

rule tElock_099_additional {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_additional {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_Protector_v10x_2 {
    strings:
        $a = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v30xx {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74 }
    condition:
        $a at pe.entry_point
}

rule PolyBox_C_Anskya {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }
        $b = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WATCOM_C_1991_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 83 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 03 DC }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v20_1984_additional {
    strings:
        $a = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v212_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_v131 {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 }
    condition:
        $a at pe.entry_point
}

rule FSG_v133 {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_LZMA_430_ap0x_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22008618_WFS {
    strings:
        $a = { 68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v126b1_v126b2 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule Kodak_Color_management_for_Windows_file_Hint_FILE_START {
    strings:
        $a = { 4B 43 4D 53 }
    condition:
        $a at pe.entry_point
}

rule EXE_Manager_30 {
    strings:
        $a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 89 0A 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BF 0A 00 B9 45 05 2E 8B 16 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 45 01 26 8C 0E 0E 00 2E 89 }
    condition:
        $a at pe.entry_point
}

rule EXE_Manager_32 {
    strings:
        $a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 F6 0B 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BD 0A 00 B9 FB 05 2E 8B 1E 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 70 01 26 8C 0E 0E 00 BE 47 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v13_CGSoftLabs {
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
        $b = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule BlackEnergy_DDoS_Bot_Crypter_additional {
    strings:
        $a = { 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? B8 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_130824_beta {
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Borland_Delphi_60_70_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 }
    condition:
        $a at pe.entry_point
}

rule EXELOCK_666_15_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }
    condition:
        $a at pe.entry_point
}

rule Themida_1201_compressed_Oreans_Technologies_h {
    strings:
        $a = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_19881989_additional {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule PeX_099_Eng_bartCrackPl {
    strings:
        $a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_Portions_Copyright_c_198396_Borland_h_additional {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_111_Method_2NT_bagieTMX_h {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB }
    condition:
        $a at pe.entry_point
}

rule RCryptor_15_by_Vaska_UsAr_sign_individual_version_21032007_2215 {
    strings:
        $a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }
    condition:
        $a at pe.entry_point
}

rule The_aPE_Inline_Patch_ExtraStealth_SuperStealth_additional {
    strings:
        $a = { E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_10xx_BitArts {
    strings:
        $a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V13X_vcasm_additional {
    strings:
        $a = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MPEG_Layer_IIIII_music_file_Hint_FILE_START_additional {
    strings:
        $a = { FF FE }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer_h {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }
    condition:
        $a at pe.entry_point
}

rule Vx_Caz1204 {
    strings:
        $a = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_ExeSmasher_Anorganix {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Lockless_Intro_Pack_Anorganix {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point
}

rule PCrypt_v351_Hint_DOS_EP {
    strings:
        $a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16_Vaska_additional {
    strings:
        $a = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule InstallShield_Cabinet_Archive_Hint_FILE_START {
    strings:
        $a = { 49 53 63 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V107_V125_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_Poly_21_Extranger_additional {
    strings:
        $a = { 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90 }
    condition:
        $a at pe.entry_point
}

rule APatch_GUI_v11 {
    strings:
        $a = { 52 31 C0 E8 FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1364_Obsidium_Software_20090428 {
    strings:
        $a = { EB 02 ?? ?? 50 EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 1E EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 02 ?? ?? 64 89 20 EB 01 ?? EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? ?? ?? ?? EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule NME_11_Public_by_redlime_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_v112_LITE {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_DEF_10_Anorganix {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_1xx_additional {
    strings:
        $a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v20_Vaska_additional {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 }
    condition:
        $a at pe.entry_point
}

rule LHARC_SFX_Archive_v113L_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 05 ?? ?? 8E C0 B8 ?? ?? CD 21 BE ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? AC E8 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V50X_Silicon_Realms_Toolworks {
    strings:
        $a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC ?? 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule Crunch_5_Bit_Arts_additional {
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v1xx_v2xx_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 50 8C 4C 00 68 D0 82 4A 00 64 A1 }
    condition:
        $a at pe.entry_point
}

rule LockProg_v05a_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? BF ?? ?? 8B EC 8B ?? ?? 2E ?? ?? ?? 03 F9 89 0D B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule XComp_V098_LZMA_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 75 06 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V22X_softcompletecom_additional {
    strings:
        $a = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }
    condition:
        $a at pe.entry_point
}

rule Mess_107_EXE {
    strings:
        $a = { 4D 45 53 53 B9 FF FF 83 C4 04 F3 26 AC E3 46 EB 50 0D 0A 0D 0A 53 74 6F 6E 65 68 65 61 64 27 73 20 4D 45 53 53 20 76 31 2E 30 37 20 FE 20 52 65 67 67 65 64 20 74 6F 20 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1338_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule MaskPE_16_yzkzero {
    strings:
        $a = { 36 81 2C 24 ?? ?? ?? 00 C3 60 }
    condition:
        $a at pe.entry_point
}

rule Adlib_Sample_Audio_file {
    strings:
        $a = { 47 4F 4C 44 20 53 41 4D 50 4C 45 }
    condition:
        $a at pe.entry_point
}

rule E_additional {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule NsPack_30_North_Star_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 }
    condition:
        $a at pe.entry_point
}

rule USSR_V031_SpiritST {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Slowload_Hint_DOS_EP {
    strings:
        $a = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_v10_additional {
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4 }
    condition:
        $a at pe.entry_point
}

rule Solidshield_Protector_V1X_DLL_Solidshield_Technologies {
    strings:
        $a = { 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF }
    condition:
        $a at pe.entry_point
}

rule InterLok_V5X_PACE_Anti_Piracy_SignByfly {
    strings:
        $a = { 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 48 3C 03 C8 89 ?? ?? ?? ?? ?? EB 06 8B ?? ?? ?? ?? ?? 66 8B 59 16 C1 EB 0D 83 E3 01 74 0A 83 7D 0C 01 0F 85 38 01 00 00 8D 45 F8 50 8D 45 FC 50 E8 47 01 00 00 8B F8 59 3B FE 59 75 52 83 7D FC FF FF 75 F8 75 17 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C EB 18 FF 75 FC 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 10 6A 30 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? E9 BB 00 00 00 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 FF D7 57 6A 01 8B F0 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 F6 0F 84 96 00 00 00 83 FE F6 7F 32 74 29 83 FE 97 74 75 83 FE F3 74 18 83 FE F4 74 0C 83 FE F5 75 2B B8 ?? ?? ?? ?? EB 4F B8 ?? ?? ?? ?? EB 48 B8 ?? ?? ?? ?? EB 41 B8 ?? ?? ?? ?? EB 3A 83 FE FA 74 30 83 FE FC 74 24 83 FE FD 74 18 56 8D 45 E0 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C 8D 45 E0 EB 13 B8 ?? ?? ?? ?? EB 0C B8 ?? ?? ?? ?? EB 05 B8 ?? ?? ?? ?? 6A 30 68 ?? ?? ?? ?? 50 6A 00 FF 15 ?? ?? ?? ?? 85 DB 75 08 6A 01 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B C9 C2 0C 00 }
        $b = { 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_JDPack_1x_JDProtect_09 {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule The_Norton_Antivirus_Information_file {
    strings:
        $a = { 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20_additional {
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
    condition:
        $a at pe.entry_point
}

rule Soft_Defender_v112 {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8 }
    condition:
        $a at pe.entry_point
}

rule Dropper_Creator_V01_Conflict {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v20_Ian_Luck {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A 00 FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v20 {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PEtite_21_emadicius_h {
    strings:
        $a = { B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule PcShare_v40_ {
    strings:
        $a = { 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_DLL_aPLib_Ap0x_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_or_Borland_Cpp_additional {
    strings:
        $a = { BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v244_additional {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD }
    condition:
        $a at pe.entry_point
}

rule Pack_Master_v10 {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
    condition:
        $a at pe.entry_point
}

rule UPack_v011_Dwing {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Cpp_19901992 {
    strings:
        $a = { B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule Mew_11_SE_v12_Eng_Northfox_ {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C }
    condition:
        $a at pe.entry_point
}

rule Stirling_Archive {
    strings:
        $a = { 13 5D 65 8C 3A }
    condition:
        $a at pe.entry_point
}

rule NTPacker_V2X_ErazerZ {
    strings:
        $a = { 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule BIN_Lock_tm_1994_Hint_DOS_EP {
    strings:
        $a = { EB ?? 31 C0 8E C0 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? CC CD 01 EB }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V31_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_C_1988_1989_1990_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FB 8C C9 BB ?? ?? 8E C1 26 ?? ?? ?? ?? 26 ?? ?? ?? 3D ?? ?? 73 ?? B8 ?? ?? 03 D8 8E D1 8B E3 26 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 8B D3 D1 EA D1 EA D1 EA D1 EA 8B ?? ?? ?? 8C C0 2B C8 3B D1 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v2xx {
    strings:
        $a = { 60 E8 70 05 ?? ?? EB }
        $b = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SVK_Protector_v132_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
        $c = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VMProtect_v125_PolyTech_additional {
    strings:
        $a = { 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V041_cyberbob_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 02 D2 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 ?? 68 3C 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 59 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 ?? E8 1A 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_302 {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C }
    condition:
        $a at pe.entry_point
}

rule Vaccine_103_110 {
    strings:
        $a = { FA 33 DB B9 00 00 0E 1F 33 F6 FC AD 35 00 00 03 D8 E2 F8 81 FB 00 00 74 42 E8 26 00 94 A0 A9 AB 20 A8 A7 AC A5 AD A5 AD 21 20 8F E0 AE A4 AE AB A6 A0 E2 EC 20 28 79 2F 6E 29 3F 20 07 24 00 01 00 00 B4 09 5A 8B F2 CD 21 C6 04 02 B4 0A CD 21 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v21_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_075exe_Hying_CCG_h {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C9 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Enigma_protector_112_Vladimir_Sukhov_h_additional {
    strings:
        $a = { 55 46 41 C6 D2 C1 00 00 }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_04_beta_1_by_Alex {
    strings:
        $a = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }
    condition:
        $a at pe.entry_point
}

rule Upack_v036_alpha_Sign_by_hot_UNP_additional {
    strings:
        $a = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }
    condition:
        $a at pe.entry_point
}

rule ComProtector_10 {
    strings:
        $a = { B9 00 00 BB 03 01 BF 00 01 2E 8A 07 34 B9 FE C8 C0 C0 9A 2E 88 05 2E 00 0D 2E 00 2D 47 43 E2 E9 B9 CD 01 E8 00 00 5B 83 C3 12 90 2E C0 07 A4 2E 30 0F 2E 30 2F 43 E2 F3 42 DC AC 09 94 A0 C0 6C D7 BC 2C 0F 00 A2 6B F2 0F CD 7D ED AC 89 29 99 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v22_wwwun4seencompetite {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule WWPack32_v100_v111_v112_v120_additional {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_25_ {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule Vx_Lehigh555_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5E 83 ?? ?? 8B DE 81 ?? ?? ?? 53 81 ?? ?? ?? B4 19 CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 4A CD 21 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_JDPack_1x_JDProtect_09_Anorganix {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule UPX_Scrambler_RC_v1x {
    strings:
        $a = { 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }
        $b = { 66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V121_aPlib_043_ap0x_20080504 {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule DWC_Archive {
    strings:
        $a = { 44 57 43 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_Delphi_stub_Laszlo_Markus {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }
    condition:
        $a at pe.entry_point
}

rule Goats_PE_Mutilator_16 {
    strings:
        $a = { E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_06_additional {
    strings:
        $a = { FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC }
    condition:
        $a at pe.entry_point
}

rule nBinder_v40 {
    strings:
        $a = { 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 }
        $b = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WATCOM_CCpp {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F }
        $b = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PackItBitch_V10_archphase_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Spanz_additional {
    strings:
        $a = { E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84 }
    condition:
        $a at pe.entry_point
}

rule Windows_PIF_file {
    strings:
        $a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 02 }
    condition:
        $a at pe.entry_point
}

rule LY_WGKX_V2X_wwwszleyucom_SignByfly_20080122 {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 01 00 4D 79 46 75 6E 00 62 73 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_Stub_b_Farb_rausch_Consumer_Consulting {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC }
    condition:
        $a at pe.entry_point
}

rule Ningishzida_10_CyberDoom {
    strings:
        $a = { 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule PCIENC_Cryptor {
    strings:
        $a = { 06 50 43 49 45 4E }
    condition:
        $a at pe.entry_point
}

rule FileShield_Hint_DOS_EP {
    strings:
        $a = { 50 1E EB ?? 90 00 00 8B D8 }
    condition:
        $a at pe.entry_point
}

rule vprotector_12_vcasm_h_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_WATCOM_CCpp_EXE {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 E9 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V30_LiuXingPing_additional {
    strings:
        $a = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Vx_Backfont900_additional {
    strings:
        $a = { E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule ARJ_SFX_Custom_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A }
    condition:
        $a at pe.entry_point
}

rule Upack_010_012_beta_Dwing {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }
    condition:
        $a at pe.entry_point
}

rule StarForce_ProActive_11_StarForce_Technology_additional {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 }
    condition:
        $a at pe.entry_point
}

rule Petite_21 {
    strings:
        $a = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }
    condition:
        $a at pe.entry_point
}

rule Petite_20 {
    strings:
        $a = { B8 00 00 00 00 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 18 8B CC 8D A0 54 BC 00 00 8B C3 8D 90 E0 15 00 00 68 00 00 00 00 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 E3 00 00 FF 8B }
    condition:
        $a at pe.entry_point
}

rule ActiveMARKTM_R5311140_Trymedia_additional {
    strings:
        $a = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1400_Obsidium_Software_20091005 {
    strings:
        $a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 71 49 EB 01 ?? EB 03 ?? ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? 58 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 ?? 00 00 00 EB 04 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Themida_18xx_Oreans_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v030_beta_By_Dwing_h_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_V020_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v139_SteelBytes {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule USERNAME_v300_Hint_DOS_EP_additional {
    strings:
        $a = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_One_layer_encryption_MANtiCORE {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule MarjinZ_EXE_Scrambler_SE_by_MarjinZ {
    strings:
        $a = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3 }
        $b = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule X_Pack_v142 {
    strings:
        $a = { 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3 }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_Stub_c_Farb_rausch_Consumer_Consulting {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_bartxt_WinRAR_SFX_additional {
    strings:
        $a = { EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v190g_Risco_software_Inc {
    strings:
        $a = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule ExeTools_COM2EXE {
    strings:
        $a = { E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_71_additional {
    strings:
        $a = { 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule ASPack_102b {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 2B 85 7D 7C 43 00 89 85 89 7C 43 00 80 BD 74 7C 43 00 00 75 15 FE 85 74 7C 43 00 E8 1D 00 00 00 E8 F7 01 00 00 E8 8E 02 00 00 8B 85 75 7C 43 00 03 85 89 7C 43 00 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule PKLite_150_COM {
    strings:
        $a = { 50 B8 00 00 BA 00 00 3B C4 73 79 8B C4 2D 42 03 25 F0 FF 8B F8 B9 A1 00 BE 8E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 90 32 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_vxx_DLL {
    strings:
        $a = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3 }
        $b = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_v1304_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 0? }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v168_v184_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_V80_Debug {
    strings:
        $a = { E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v250_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_R_Full_text_index_file {
    strings:
        $a = { 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2501_Jitit_Sign_by_fly {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule Windows_9x_User_password_file {
    strings:
        $a = { E3 82 85 96 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Lockless_Intro_Pack {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point
}

rule DEF_v10_additional {
    strings:
        $a = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 }
    condition:
        $a at pe.entry_point
}

rule Unpacked_BS_SFX_Archive_v19 {
    strings:
        $a = { 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 }
    condition:
        $a at pe.entry_point
}

rule HideProtect_V1016C_SoftWar_Company_SignByfly {
    strings:
        $a = { 90 90 90 E9 D8 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1530_additional {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Obsidium_10061_Obsidium_Software {
    strings:
        $a = { E8 AF 1C 00 00 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V10_V12_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
    condition:
        $a at pe.entry_point
}

rule HackStop_117EXE {
    strings:
        $a = { 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A 53 BB EB 04 5B EB FB 9A B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 B0 AD E6 64 53 BB EB }
    condition:
        $a at pe.entry_point
}

rule PENinja_modified {
    strings:
        $a = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v20b5_v23 {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD }
    condition:
        $a at pe.entry_point
}

rule RCC_II286_v102_Hint_DOS_EP {
    strings:
        $a = { FA BD ?? ?? 93 C8 ?? ?? ?? 54 62 E9 }
    condition:
        $a at pe.entry_point
}

rule NsPack_34_North_Star {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }
        $b = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Mew_10_V10_Eng_Northfox {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule North_Star_PE_Shrinker_v13_by_Liuxingping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }
        $b = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PAK_SFX_Archive_Hint_DOS_EP {
    strings:
        $a = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1339_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00 }
        $b = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PKLITE32_v11 {
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10 }
        $b = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule dxp_Decrementing_1_byte_XOR_at_OEP {
    strings:
        $a = { ?? ?? 83 EC ?? D9 34 24 8B 44 24 ?? ?? ?? ?? BF ?? ?? ?? ?? 8A 17 ?? ?? 8B C8 81 E1 ?? ?? ?? ?? EB ?? ?? ?? 30 10 FE CA 48 49 }
    condition:
        $a at pe.entry_point
}

rule Upack_v010_v012Beta_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_Pro_Edition_116_Randy_Li_h {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
        $b = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_239_DLL_compressed_resources_additional {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V3104_V3332_Thinstall_Company_20080318 {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB CC 1A 00 00 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 C8 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_112_Vladimir_Sukhov {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }
        $b = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
        $c = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_200_30X_Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser {
    strings:
        $a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
        $b = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_Pack_Master_10_PEX_Clone_additional {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v21 {
    strings:
        $a = { 60 E9 3D }
        $b = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cue_60 {
    strings:
        $a = { EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b6_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14 }
    condition:
        $a at pe.entry_point
}

rule nPack_v11xxx_NEOx {
    strings:
        $a = { 83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v13_additional {
    strings:
        $a = { EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF }
    condition:
        $a at pe.entry_point
}

rule DrHalo_or_DrGenius_Palette_Graphics_format {
    strings:
        $a = { 41 48 E3 00 00 00 0A 00 }
    condition:
        $a at pe.entry_point
}

rule LHA_SFX_Archive_v205_v213_Hint_DOS_EP {
    strings:
        $a = { EB ?? FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB ?? ?? ?? ?? ?? E8 ?? ?? 06 1F B4 30 CD 21 8B D8 1E 3C 03 72 ?? 36 ?? ?? ?? ?? 33 C0 8B F8 B9 }
    condition:
        $a at pe.entry_point
}

rule Exe_Locker_v10_IonIce {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_TrojanShock_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BE ?? ?? E8 ?? ?? B2 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? BE ?? ?? E8 ?? ?? B8 00 4C CD 21 ?? 50 52 AC }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1333_Obsidium_Software_SignByhaggar {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1200_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 30 2E 30 }
    condition:
        $a at pe.entry_point
}

rule BlackEnergy_DDoS_Bot_Crypter {
    strings:
        $a = { 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F }
    condition:
        $a at pe.entry_point
}

rule FishPE_V10X_hellfish_Sign_by_fly {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_v17_Exeshield_Corp {
    strings:
        $a = { EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 }
    condition:
        $a at pe.entry_point
}

rule SciFax_Graphics_file_Hint_FILE_START {
    strings:
        $a = { 44 54 3D 00 }
    condition:
        $a at pe.entry_point
}

rule PeX_v099_Eng_bartCrackPl {
    strings:
        $a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
        $b = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Shrinker_34 {
    strings:
        $a = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_33 {
    strings:
        $a = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_32 {
    strings:
        $a = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }
    condition:
        $a at pe.entry_point
}

rule CipherWall_Self_ExtratorDecryptor_Console_v15 {
    strings:
        $a = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
        $b = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Delphi_3_Portions_Copyright_c_198397_Borland {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule Norton_Speed_Disk_Configuration_file_Hint_FILE_START {
    strings:
        $a = { 4E 6F 72 74 6F 6E 20 53 70 65 65 64 }
    condition:
        $a at pe.entry_point
}

rule yzpack_V20_UsAr_Sign_by_fly {
    strings:
        $a = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28 }
    condition:
        $a at pe.entry_point
}

rule Histogram_graphics_file {
    strings:
        $a = { 6D 68 77 61 6E 68 00 04 01 02 01 02 }
    condition:
        $a at pe.entry_point
}

rule CALS_Raster_graphics_format_additional {
    strings:
        $a = { 73 72 63 64 6F 63 69 64 3A 20 }
    condition:
        $a at pe.entry_point
}

rule FSG_131_Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
        $b = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_MinGW_GCC_2x_Anorganix {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
    condition:
        $a at pe.entry_point
}

rule GIF89a_Graphics_format {
    strings:
        $a = { 47 49 46 38 39 61 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_Bczi_Gor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40 }
        $b = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Compiler_additional {
    strings:
        $a = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v50v60 {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_V038_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5B 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? 69 ED 00 0C 00 00 8D AC 2B 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 FB 00 00 00 04 F9 1A C0 B1 30 8B 6B 08 03 D1 FF 16 73 49 03 D1 FF 16 72 17 03 D1 FF 16 72 27 24 02 04 09 50 8B C7 2B 43 08 8A 00 E9 CD 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 24 03 04 08 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 95 00 00 00 24 03 04 07 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10 }
    condition:
        $a at pe.entry_point
}

rule Trainer_Creation_Kit_5_Trainer {
    strings:
        $a = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1337_20070623_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00 }
    condition:
        $a at pe.entry_point
}

rule Reflexive_Arcade_Installer {
    strings:
        $a = { 55 8B EC 6A FF 68 98 48 42 00 68 B4 DC 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 31 42 00 33 D2 8A D4 89 15 8C CA 42 00 8B C8 81 E1 FF 00 00 00 89 0D }
    condition:
        $a at pe.entry_point
}

rule DoPs_CryptExe_104 {
    strings:
        $a = { 8B DC EB 01 EA BC 03 00 EB 01 EA 83 FC 03 74 05 EB 01 EA CD 20 EB 01 EA 8B E3 2E 89 26 13 00 EB 01 EA E8 C1 01 EA 2E 8B 26 13 00 1E 33 C0 8E D8 FA FF 06 06 00 2E F7 06 00 00 EB 00 FF 0E 06 00 FB 1F 2E 8C 1E 15 00 2E 8C 16 11 00 2E 89 26 13 }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_20_junkcode_additional {
    strings:
        $a = { EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v120_extra_3_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? 8B FC 81 ?? ?? ?? 57 57 52 80 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_Berczi_Gabor_Pierre_Muller_Peter_Vreman_ {
    strings:
        $a = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix_additional {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule codeCrypter_031_Tibbar {
    strings:
        $a = { 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule PoPa_001_Packer_on_Pascal_bagie {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF }
        $b = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Go32Stub_v200T_DOS_Extender_Hint_DOS_EP {
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Morphine_12_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v25_Retail_Slim_Loader_Bitsum_Technologies_ {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_30xx_Jitit_Software {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 }
    condition:
        $a at pe.entry_point
}

rule UPX_070_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 99 01 00 00 60 E8 00 00 00 00 58 83 E8 48 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 FC 01 00 00 83 CD FF 31 DB EB 0C 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKLite_103_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 03 01 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252b2_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Cabinet_file_Hint_FILE_START {
    strings:
        $a = { 4D 53 43 46 }
    condition:
        $a at pe.entry_point
}

rule PackerAspack_v212_wwwaspackcom {
    strings:
        $a = { ?8 ?? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F ?? ?? ?3 ?? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8? ?? ?D ?? ?? ?? ?? 5? }
    condition:
        $a at pe.entry_point
}

rule RE_Crypt_v07x_Crudd_RET_h1_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v10059_Final_additional {
    strings:
        $a = { E8 AB 1C }
    condition:
        $a at pe.entry_point
}

rule DotFix_Nice_Protect_21_GPcH_Soft {
    strings:
        $a = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }
        $b = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 }
        $c = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MS_Run_Time_Library_OS2_FORTRAN_Compiler_1989_additional {
    strings:
        $a = { B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 }
    condition:
        $a at pe.entry_point
}

rule AI1_Creator_1_Beta_2_by_MZ {
    strings:
        $a = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pohernah_103_by_Kas {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PolyCryptor_by_SMT_Version_v3v4 {
    strings:
        $a = { EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29 }
    condition:
        $a at pe.entry_point
}

rule UPX_Alternative_stub_additional {
    strings:
        $a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v300a_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_p_Virus_Shield_additional {
    strings:
        $a = { 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule X_Pack_v142_Hint_HDR_FILESIZE_32 {
    strings:
        $a = { 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3 }
    condition:
        $a at pe.entry_point
}

rule GLBS_Install_Stub_32_bit_Wise {
    strings:
        $a = { 55 8B EC 81 EC 2C 05 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 54 40 40 00 FF 15 50 40 40 00 8B F8 89 7D F4 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D F4 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D F4 EB EF 80 3F 22 75 04 47 89 7D F4 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D F4 53 FF 15 6C }
    condition:
        $a at pe.entry_point
}

rule RJcrush_v100_Hint_DOS_EP {
    strings:
        $a = { 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v1010_win32_GUI_additional {
    strings:
        $a = { C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_v30 {
    strings:
        $a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_DEF_10_Anorganix {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Possibly_PCX_graphics_format {
    strings:
        $a = { 10 ?? 01 }
        $b = { 0A ?? 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WinZip_32_bit_SFX_v6x_module_additional {
    strings:
        $a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84 }
    condition:
        $a at pe.entry_point
}

rule SWAG_Archive {
    strings:
        $a = { ?? ?? 2D 73 77 31 2D }
        $b = { 2D 73 77 31 2D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule STUD_RC4_10_Jamie_Edition_ScanTime_UnDetectable_by_MarjinZ_additional {
    strings:
        $a = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Crunch_V50_Bitarts_additional {
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_120_Beta_PE_Packer {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }
    condition:
        $a at pe.entry_point
}

rule EYouDiDai_YueHeiFengGao {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_132_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_kkryptor_9kryptor_a_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_8_additional {
    strings:
        $a = { 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Pack_Master_v10_additional {
    strings:
        $a = { 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81 }
    condition:
        $a at pe.entry_point
}

rule WarWind_Save_file {
    strings:
        $a = { 57 41 52 53 41 56 }
    condition:
        $a at pe.entry_point
}

rule PECompact_2x_Jeremy_Collake {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_NTkrnl_team_h {
    strings:
        $a = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 }
        $b = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_v2460_Jitit {
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2609_Jitit {
    strings:
        $a = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_Extranger {
    strings:
        $a = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_020_beta_Dwing_ {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b7 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14 }
    condition:
        $a at pe.entry_point
}

rule Safeguard_10_Simonzh_additional {
    strings:
        $a = { E8 00 00 00 00 EB 29 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_SVKP_13x_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACProtect_V14X_risco {
    strings:
        $a = { 60 E8 01 00 00 00 7C 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule NsPack_V14_LiuXingPing_ {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule PassCOM_v20_PPC_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BE ?? ?? B9 ?? ?? 87 1C EB ?? FB FA 87 ?? ?? ?? 87 ?? ?? ?? FB 1F 58 4B EB ?? 50 1E 33 C0 8E D8 EB }
    condition:
        $a at pe.entry_point
}

rule LX_Exe_Executable_Image {
    strings:
        $a = { 4C 58 }
    condition:
        $a at pe.entry_point
}

rule EEXE_112_113 {
    strings:
        $a = { B4 30 CD 21 3C 03 73 00 BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Basic_v10_1987_Hint_DOS_EP {
    strings:
        $a = { 2E 8C ?? ?? ?? 2E C7 }
    condition:
        $a at pe.entry_point
}

rule Vx_Trivial46 {
    strings:
        $a = { B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule RLPack_117p_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 }
    condition:
        $a at pe.entry_point
}

rule COMPACK_v45_2_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE }
    condition:
        $a at pe.entry_point
}

rule UPX_123_Markus_Laszlo {
    strings:
        $a = { 31 2E 32 33 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_Hint_WIN_EP {
    strings:
        $a = { 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68 }
    condition:
        $a at pe.entry_point
}

rule STNPEE_113 {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v14_CGSoftLabs_h_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
    condition:
        $a at pe.entry_point
}

rule UPX_071_072_PE {
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA 00 00 FF 57 66 81 87 00 00 00 00 00 00 81 C6 B3 01 00 00 EB 0A 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098b1_tHE_EGOiSTE {
    strings:
        $a = { E9 25 E4 FF FF }
    condition:
        $a at pe.entry_point
}

rule ActiveMARK_5x_Trymedia_Systems_Inc_h_additional {
    strings:
        $a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
    condition:
        $a at pe.entry_point
}

rule Upack_036_beta_Dwing_additional {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4X_SafeNet_SignByfly {
    strings:
        $a = { 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7 ?? ?? ?? ?? ?? ?? ?? E9 13 09 00 00 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 05 E9 C1 11 00 00 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 8B ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 ?? ?? ?? ?? ?? EB 04 66 ?? ?? ?? 8B ?? ?? 25 FF FF 00 00 83 ?? ?? 0F 8D DF 00 00 00 8B ?? ?? 25 FF FF 00 00 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 83 ?? ?? 89 ?? ?? ?? ?? ?? EB 7E }
        $b = { 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Unknown_by_SMT_Hint_WIN_EP {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }
    condition:
        $a at pe.entry_point
}

rule tElock_096_tE {
    strings:
        $a = { E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C }
        $b = { E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACProtect_13x_14x_DLL_Risco_Software_Inc {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
        $b = { 80 7C 24 08 01 0F 85 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_012_beta_Dwing {
    strings:
        $a = { BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_NorthStar_PE_Shrinker_13 {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PECompact_14x_emadicius {
    strings:
        $a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A }
    condition:
        $a at pe.entry_point
}

rule Vx_Gotcha879 {
    strings:
        $a = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }
    condition:
        $a at pe.entry_point
}

rule ChSfx_small_v11_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_v27_Exeshield_Corp {
    strings:
        $a = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule GEM_Image_graphics_file {
    strings:
        $a = { 00 01 00 08 00 04 00 02 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_GCC_3x {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_LCC_Win32_1x_Anorganix {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }
    condition:
        $a at pe.entry_point
}

rule TrueType_Font_file {
    strings:
        $a = { 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32 }
        $b = { 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v211c_additional {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v114_v120_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_041_FEUERRADER {
    strings:
        $a = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_v01_Cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_017_GlOFF {
    strings:
        $a = { 55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50 }
    condition:
        $a at pe.entry_point
}

rule tElock_098_tE {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }
        $b = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TurboBAT_v310_50_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_iBox_aPLib_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
    condition:
        $a at pe.entry_point
}

rule EP_10 {
    strings:
        $a = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 }
    condition:
        $a at pe.entry_point
}

rule Zurenava_DOS_Extender_v045_v049_additional {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }
    condition:
        $a at pe.entry_point
}

rule NET_executable_Microsoft_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_V1X_V2X_Fisun_AV_Sign_by_fly {
    strings:
        $a = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }
        $b = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Slowload {
    strings:
        $a = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }
    condition:
        $a at pe.entry_point
}

rule Duals_eXe_10 {
    strings:
        $a = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 }
    condition:
        $a at pe.entry_point
}

rule Inbuild_v10_hard_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V1X_Sukhov_Vladimir {
    strings:
        $a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
    condition:
        $a at pe.entry_point
}

rule XCR_v012_additional {
    strings:
        $a = { 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_ {
    strings:
        $a = { EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2521_Jitit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v30_additional {
    strings:
        $a = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch_or_any_Version_Sign_by_hot_UNP_additional {
    strings:
        $a = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_aPLib {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }
        $b = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DiskDupe_c_MSD_Configuration_file {
    strings:
        $a = { 4D 53 44 20 44 61 74 61 20 56 65 72 73 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_EXE32Pack_13x_emadicius {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Packman_v0001_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cue_70_DLL {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V21X_SoftCompletecom {
    strings:
        $a = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Packer_Northfox {
    strings:
        $a = { 54 59 68 61 7A 79 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v71_DLL_Debug_additional {
    strings:
        $a = { 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_Pro_Edition_116_Randy_Li_h_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PE_Intro_10 {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_02_Hint_DOS_EP {
    strings:
        $a = { FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB }
    condition:
        $a at pe.entry_point
}

rule ICE_Archive {
    strings:
        $a = { ?? ?? 2D 6C 68 ?? 2D }
        $b = { 2D 6C 68 ?? 2D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_Modified_Stub_b_Farb_rausch_Consumer_Consulting_ {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V06_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v03 {
    strings:
        $a = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }
    condition:
        $a at pe.entry_point
}

rule Krypton_v02 {
    strings:
        $a = { 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1250_Obsidium_Software {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point
}

rule FixupPak_v120 {
    strings:
        $a = { 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }
        $b = { 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Krypton_v05 {
    strings:
        $a = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF }
    condition:
        $a at pe.entry_point
}

rule Krypton_v04 {
    strings:
        $a = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140b2_v140b4_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }
    condition:
        $a at pe.entry_point
}

rule unknown_by_GyikSoft_1 {
    strings:
        $a = { 8C C9 81 C1 00 00 51 B9 00 00 51 00 00 00 00 00 00 06 00 00 00 00 00 83 EB 18 53 51 B8 00 00 8C CA 03 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 79 EE 00 00 00 00 00 00 BE 00 00 CB }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_17_coban2k_additional {
    strings:
        $a = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3 }
    condition:
        $a at pe.entry_point
}

rule unknown_by_GyikSoft_2 {
    strings:
        $a = { 8C C8 05 00 00 50 B8 00 00 50 B0 FF 06 8C D2 06 83 EA 1E 50 B0 08 52 FC 50 8C D2 8C CD BB 00 00 03 EB 4A 8E DD 8E C2 4D B9 08 00 33 FF BE 00 00 AD 35 00 00 AB E2 F9 4B 79 E8 8E DA 0E BE 00 00 33 DB 8B FB 07 CB }
    condition:
        $a at pe.entry_point
}

rule kkryptor_5_rsc {
    strings:
        $a = { E8 03 00 00 00 E9 EB 6C 58 40 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Stirling_Archive_Hint_FILE_START {
    strings:
        $a = { 13 5D 65 8C 3A }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v200_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13017_Obsidium_software {
    strings:
        $a = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule JExeCompressor_V10_UsAr_additional {
    strings:
        $a = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_36x_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76 }
    condition:
        $a at pe.entry_point
}

rule PENightMare_2_Beta {
    strings:
        $a = { 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1342_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }
    condition:
        $a at pe.entry_point
}

rule aPack_058_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 8E 01 BF 00 01 50 57 FC B6 01 BD 6F 01 FF D5 73 4C FF D5 73 18 FF D5 73 2A BB 86 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 43 B1 01 EB 26 E8 3E 00 49 49 AC 8A E1 93 E8 35 00 83 FB 40 73 15 83 C1 04 EB 10 AC }
    condition:
        $a at pe.entry_point
}

rule codeCrypter_031 {
    strings:
        $a = { 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }
        $b = { 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ENIGMA_Protector_V10_V12_Sukhov_Vladimir_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_3035_Jtit {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Cruncher_v10_additional {
    strings:
        $a = { 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule UPX_v062_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70 {
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }
        $b = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Exe_Stealth_275a_WebtoolMaster_additional {
    strings:
        $a = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 }
    condition:
        $a at pe.entry_point
}

rule DEF_100_Eng_bartxt {
    strings:
        $a = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v100_BoB_BobSoft {
    strings:
        $a = { 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule ActiveMARK_5x_Trymedia_SystemsInc_h_additional {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC_Anorganix {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12_Alexey_Solodovnikov_h1 {
    strings:
        $a = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_06_Hint_DOS_EP {
    strings:
        $a = { EB ?? B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 }
    condition:
        $a at pe.entry_point
}

rule ICrypt_10_by_BuGGz {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65 }
        $b = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Unknown_Protected_Mode_compiler_2 {
    strings:
        $a = { FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Protected_Mode_compiler_1 {
    strings:
        $a = { FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_Run_Time_systempDOS4GW_DOS_Extender_1988_93_additional {
    strings:
        $a = { BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3 }
    condition:
        $a at pe.entry_point
}

rule AVP_Antiviral_Database_additional {
    strings:
        $a = { 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_10_beta_2_by_Alex_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_30_Anorganix_additional {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_MSVCpp_60_DLL_emadicius {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v102_dllocx_Ashkbiz_Danehkar {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
        $b = { 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
        $c = { 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v032_beta_Dwing {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 }
    condition:
        $a at pe.entry_point
}

rule PEnguinCrypt_10_Pingvin {
    strings:
        $a = { B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 32 0C 03 40 81 F8 00 01 00 00 75 F4 BB 75 ?? ?? 00 33 C0 32 0C 03 40 81 F8 36 01 00 00 75 F4 A1 35 ?? ?? 00 8B D9 68 75 ?? ?? 00 6A 40 }
    condition:
        $a at pe.entry_point
}

rule SecureEXE_30_ZipWorx {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule VMProtect246_PolyTech {
    strings:
        $a = { E9 ?? ?? ?? ?? 60 C7 ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 E8 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v118_additional {
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point
}

rule PackerUPX_CompresorGratuito_wwwupxsourceforgenet {
    strings:
        $a = { 60 BE ?? ?0 ?? 00 8D BE ?? ?? F? FF }
    condition:
        $a at pe.entry_point
}

rule HASP_HL_Protection_V1X_Aladdin {
    strings:
        $a = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_70_for_Windows {
    strings:
        $a = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule SoftProtect_wwwsoftprotectbyru_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule RAZOR_1911_encruptor_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule DAEMON_Protect_v067_additional {
    strings:
        $a = { 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 }
    condition:
        $a at pe.entry_point
}

rule RTPatch_software_update_package_data_file {
    strings:
        $a = { 4B 2A }
    condition:
        $a at pe.entry_point
}

rule PECompact_v20_beta_Jeremy_Collake {
    strings:
        $a = { B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_V1X_vcasm {
    strings:
        $a = { EB ?? 5B 56 50 72 6F 74 65 63 74 5D }
    condition:
        $a at pe.entry_point
}

rule fEaRzCrypter_v10_fEaRz_additional {
    strings:
        $a = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00 }
    condition:
        $a at pe.entry_point
}

rule XPack_165_EXE {
    strings:
        $a = { 8B EC EB 01 E8 B8 82 03 FF E0 FA 33 C0 8E D0 BC 10 00 2E 8F 06 C1 03 2E 8F 06 C6 03 EB 01 9A 0E BB B6 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00 }
    condition:
        $a at pe.entry_point
}

rule CExe_v10a {
    strings:
        $a = { 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Stones_PE_Encryptor_20_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 }
    condition:
        $a at pe.entry_point
}

rule ExeLock_v100_Hint_DOS_EP {
    strings:
        $a = { 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_40_additional {
    strings:
        $a = { 55 8B EC 83 C4 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_DLL_2xx {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Metafile {
    strings:
        $a = { D7 CD C6 9A }
    condition:
        $a at pe.entry_point
}

rule ASPack_v104b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE }
    condition:
        $a at pe.entry_point
}

rule Shrinker_33_additional {
    strings:
        $a = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch_Dwing {
    strings:
        $a = { 81 3A 00 00 00 02 00 00 00 00 }
        $b = { 2A A3 F2 54 CE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CryExe_v40_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E9 ?? ?? 31 ED EB ?? F5 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_vxx {
    strings:
        $a = { 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD }
    condition:
        $a at pe.entry_point
}

rule Portable_BitMap_PBM_Graphics_format {
    strings:
        $a = { 50 36 0A }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LTC_13_Anorganix {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_VOB_ProtectCD_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_10_additional {
    strings:
        $a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }
    condition:
        $a at pe.entry_point
}

rule Morphine_v27_Holy_Father_Ratter29A_h_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule Real_Networks_VideoAudio_file_Hint_FILE_START {
    strings:
        $a = { 2E 52 4D 46 }
    condition:
        $a at pe.entry_point
}

rule Upack_V036_Dwing_additional {
    strings:
        $a = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MoleBoxPro_2522_Mole_Studio {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E8 6E FB FF FF 7E ?? ?? 00 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A4 ?? ?? ?? A1 ?? ?? ?? E0 ?? ?? ?? 19 ?? ?? ?? BE ?? ?? ?? 13 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1B ?? ?? ?? D5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9E ?? ?? ?? ?? ?? ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v015b {
    strings:
        $a = { E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEBundle_02_3x_emadicius {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_Win16_1991 {
    strings:
        $a = { 9A FF FF 00 00 0B C0 75 03 E9 D5 00 8C 06 16 00 89 1E 1C 00 89 36 1A 00 89 3E 18 00 89 16 1E 00 B8 FF FF 50 9A FF FF 00 00 33 C0 1E 07 BF DE 03 B9 7E 0A 2B CF FC F3 AA 33 C0 50 9A FF FF 00 00 FF 36 18 00 9A FF FF 00 00 0B C0 75 03 E9 91 00 }
    condition:
        $a at pe.entry_point
}

rule Pe123_v2006412_additional {
    strings:
        $a = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }
    condition:
        $a at pe.entry_point
}

rule MultiEdits_compiled_macros_Hint_FILE_START {
    strings:
        $a = { 1E AA }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v177_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Gardian_Angel_10 {
    strings:
        $a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_10e_vcasm_additional {
    strings:
        $a = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Pasword_Protector_V101_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v13b_Vaska_additional {
    strings:
        $a = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v09781 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v09782 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13037_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V13X_vcasm {
    strings:
        $a = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule TaiShanXiangYu_LockSoft_V10_zlocksoft_SignByfly {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8B D5 81 ?? ?? ?? ?? ?? 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V540_Silicon_Realms_Toolworks_20080214 {
    strings:
        $a = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_v31_additional {
    strings:
        $a = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }
    condition:
        $a at pe.entry_point
}

rule iLUCRYPT_4019 {
    strings:
        $a = { 8B EC FA C7 46 FE 00 00 4C 4C C3 FB BF 00 0A B8 00 00 2E 31 05 D1 C8 4F 81 FF 00 00 EB 00 73 F2 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4X_SafeNet_SignByfly_additional {
    strings:
        $a = { 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point
}

rule CHECKPRG_c_1992_additional {
    strings:
        $a = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }
    condition:
        $a at pe.entry_point
}

rule DotFix_Nice_Protect_V21_GPcH_Soft_SignByhaggar_additional {
    strings:
        $a = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        $a at pe.entry_point
}

rule Silicon_Realms_Install_Stub_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 50 92 40 00 68 E4 69 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 FC 90 40 00 33 D2 8A D4 89 15 94 E8 40 00 8B C8 81 E1 FF 00 00 00 89 0D 90 E8 40 00 C1 E1 08 03 CA 89 0D 8C E8 40 00 C1 E8 10 A3 88 E8 40 00 33 F6 56 E8 2F 0B 00 00 59 85 C0 75 08 }
    condition:
        $a at pe.entry_point
}

rule Go32Stub_v200_DOS_Extender_Hint_DOS_EP {
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEBundle_02_3x_emadicius_additional {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 }
    condition:
        $a at pe.entry_point
}

rule PluginToExe_v101_BoB_BobSoft_additional {
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A }
    condition:
        $a at pe.entry_point
}

rule Thinstall_2628_Jtit_h {
    strings:
        $a = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_WATCOM_CCue_EXE {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 E9 }
    condition:
        $a at pe.entry_point
}

rule EXEJoiner_v10 {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V310X_Thinstall_Company_additional {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 }
    condition:
        $a at pe.entry_point
}

rule FSG_v130_Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VProtector_V11A_vcasm_additional {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_vxx_additional {
    strings:
        $a = { 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ExeSmasher_Anorganix {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Protected_Mode_compiler_1_additional {
    strings:
        $a = { FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V25_V26_NsPacK_Private {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 }
    condition:
        $a at pe.entry_point
}

rule UPX_050_070 {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D }
    condition:
        $a at pe.entry_point
}

rule muckis_protector_II_mucki {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3 }
        $b = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ORiEN_201_A_Fisun {
    strings:
        $a = { E9 5D 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_29_North_Star {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }
        $b = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Macromedia_Windows_Flash_ProjectorPlayer_50 {
    strings:
        $a = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1341_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00 }
        $b = { EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Alpha_BMP_graphics_file {
    strings:
        $a = { FF FF 00 01 64 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Doom666_additional {
    strings:
        $a = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1258_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00 }
        $b = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EP_v20 {
    strings:
        $a = { 60 BE ?? B0 42 ?? 8D BE ?? 60 FD FF C7 87 B0 E4 02 ?? 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB ?? ?? ?? }
        $b = { 6A ?? 60 E9 01 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule JDPack_2x_JDPack_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ExeStealth_WebToolMaster {
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F }
    condition:
        $a at pe.entry_point
}

rule REC_v034_3_additional {
    strings:
        $a = { 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_150X_CGSoftLabs_additional {
    strings:
        $a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_additional {
    strings:
        $a = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v37_North_Star {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D }
    condition:
        $a at pe.entry_point
}

rule SimplePack_10X_bagie {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }
    condition:
        $a at pe.entry_point
}

rule RLPack_116_LZMA_compression_ap0x_h {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2 }
    condition:
        $a at pe.entry_point
}

rule Hasp_4_envelope_dongle_Alladin {
    strings:
        $a = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 ?? ?? ?? ?? 5C 5C 2E 5C 46 45 6E 74 65 44 65 }
        $b = { 10 02 D0 51 0F 00 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXpressor_v145_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point
}

rule Upack_01x_020_021_024_beta_Dwing_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule Vx_Lucee1888_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5E 83 ?? ?? FC 50 53 B8 ?? ?? CD 21 3D ?? ?? 75 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0971_v0976_additional {
    strings:
        $a = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v310 {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }
        $b = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v1xx_v2xx_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }
    condition:
        $a at pe.entry_point
}

rule DOS32_v33_DOS_Extender_and_Loader_Hint_DOS_EP {
    strings:
        $a = { 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_13_FinalBuild_81026 {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 62 01 00 00 50 45 00 00 4C 01 01 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PROTECT_EXECOM_v60 {
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule PESpin_03_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule PEiD_653_624_Six_to_Four_v10 {
    strings:
        $a = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }
    condition:
        $a at pe.entry_point
}

rule tElock_v051_additional {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
    condition:
        $a at pe.entry_point
}

rule pirit_v15_Hint_DOS_EP {
    strings:
        $a = { 5B 24 55 50 44 FB 32 2E 31 5D }
    condition:
        $a at pe.entry_point
}

rule EPW_v130_additional {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_PCGuard_403_415_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }
        $b = { 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WATCOM_CCpp_32_Run_Time_System_1989_1994_Hint_DOS_EP {
    strings:
        $a = { 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v177 {
    strings:
        $a = { 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

/* False positive - #39
rule Armadillo_v171 {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 }
    condition:
        $a at pe.entry_point
}*/

rule AsCrypt_v01_SToRM_4 {
    strings:
        $a = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2 }
    condition:
        $a at pe.entry_point
}

rule UPX_071_072_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE EF 00 00 FF 57 66 81 87 00 00 00 00 00 00 81 C6 B1 01 00 00 EB 07 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE }
    condition:
        $a at pe.entry_point
}

rule RLPack_V112_V114_LZMA_430_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_3 {
    strings:
        $a = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_1 {
    strings:
        $a = { 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ASProtect_Anorganix_additional {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V20_risco_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v04_yadolockless {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED 61 34 ?? 00 2B 85 60 37 ?? 00 83 E8 06 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v146 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_Crypter_V102_Kas {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 }
        $b = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v0761_dos_exe_additional {
    strings:
        $a = { B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule Video_Lan_Client {
    strings:
        $a = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Code_Lock {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v31_North_Star {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
        $b = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v147_v150_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_One_layer_encryption_MANtiCORE_ {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V36_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1995_Open_Watcom {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v20_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v253_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 }
    condition:
        $a at pe.entry_point
}

rule tElock_v092a_additional {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_13_Extranger {
    strings:
        $a = { 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3 }
    condition:
        $a at pe.entry_point
}

rule tElock_10_private_tE_additional {
    strings:
        $a = { E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 }
    condition:
        $a at pe.entry_point
}

rule Solidshield_Protector_V1X_DLL_Solidshield_Technologies_SignByfly {
    strings:
        $a = { 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF FF 83 FE 02 57 8B 7D 10 75 53 FF 75 24 FF 75 20 FF 75 1C FF 75 18 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 20 3C 01 75 04 8B C6 EB 6A 57 FF 75 0C E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 14 3C 01 74 DF 6A 03 5E 83 FE 03 75 1B 57 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 6A 00 FF 15 ?? ?? ?? ?? 83 FE 04 75 0D FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 59 59 83 FE 05 75 11 FF 75 30 FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 83 C4 0C 33 C0 5F 5E 5D C3 }
        $b = { 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_Armadillo_300_Anorganix {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_aPlib_043_ap0x_SignByfly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v1304_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Inno_Installer_v512_collides_with_Borland_Delphi_20_Overlay {
    strings:
        $a = { 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V20X_Jitit_Sign_by_fly {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V121_aPlib_043_ap0xnbsp_nbsp_SignByfly_20080504 {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_226_DLL_minimum_protection_wwwstrongbitcom {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 }
        $b = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_105b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED CE 3A 44 00 B8 C8 3A 44 00 03 C5 2B 85 B5 3E 44 00 89 85 C1 3E 44 00 80 BD AC 3E 44 }
    condition:
        $a at pe.entry_point
}

rule C_Cpp_Library_file {
    strings:
        $a = { F0 0D 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_V194_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_016b_0161b {
    strings:
        $a = { EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 6D 23 40 00 52 8B 54 24 08 E8 A5 FD FF FF 89 95 D1 2A 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b5_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }
    condition:
        $a at pe.entry_point
}

rule UCEXE_v23_v24_Hint_DOS_EP {
    strings:
        $a = { 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1304_Obsidium_Software_h_additional {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v141 {
    strings:
        $a = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule DotFix_Nice_Protect_V21_GPcH_Soft_SignByhaggar {
    strings:
        $a = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }
        $b = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Borland_Cpp_1999_ {
    strings:
        $a = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
    condition:
        $a at pe.entry_point
}

rule RJoiner_12a_Vaska_additional {
    strings:
        $a = { 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11 }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v40 {
    strings:
        $a = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule ILUCRYPT_v4015_exe_Hint_DOS_EP {
    strings:
        $a = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_150_for_Win16 {
    strings:
        $a = { 50 53 51 52 56 57 55 1E 06 06 33 C0 50 2E FF 1E 01 0F 0B C0 74 F4 50 8C CB 53 50 2E FF 1E 09 0F 0B C0 75 03 58 EB EF 8E D8 58 07 A3 ED 0E 89 3E EB 0E 8C 06 EF 0E B8 D7 8A BF EA 0E 2D 62 8A 8B D0 B9 75 0E 96 FD F6 C1 1F 75 02 8B F2 AC BB 88 }
    condition:
        $a at pe.entry_point
}

rule FreeBASIC_016b_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_v30_additional {
    strings:
        $a = { E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_01_015_NTkrnl_Software_additional {
    strings:
        $a = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 }
    condition:
        $a at pe.entry_point
}

rule RobinPE_vnew_Robin {
    strings:
        $a = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule HideProtect_1016_SoftWar_Company_additional {
    strings:
        $a = { 90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_30 {
    strings:
        $a = { 55 8B EC 83 C4 F4 53 56 57 }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_Pascal_v55_Unit {
    strings:
        $a = { 54 50 55 36 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_MSVCpp_70_DLL_Method_3_emadicius {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point
}

rule yC_13_by_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_v10 {
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_153_Stub_engine_171_GlOFF {
    strings:
        $a = { E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00 }
        $b = { 86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LZEXE_v091_v100a_3 {
    strings:
        $a = { 50 06 0E 1F 8B 0E }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_2 {
    strings:
        $a = { BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_1 {
    strings:
        $a = { 06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_bartxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Simple_UPX_Cryptor_v3042005_multi_layer_encryption_MANtiCORE_ {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V20X_Jitit {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule ARJ_SFX_Archive_Hint_FILE_START {
    strings:
        $a = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 4A 53 58 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_FSG_10 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point
}

rule PEEncrypt_v40b_JunkCode {
    strings:
        $a = { 66 ?? ?? 00 66 83 ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v13beta_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Aspack_v212_wwwaspackcom_additional {
    strings:
        $a = { ?8 ?? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F ?? ?? ?3 ?? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8? ?? ?D ?? ?? ?? ?? 5? }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Packed_Hint_DOS_EP {
    strings:
        $a = { BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v20_Hide_EP_Vaska {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_50_60_ {
    strings:
        $a = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule TurboBAT_v310_50_Patched_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_Protector_V36_wwwexeshieldcom {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }
    condition:
        $a at pe.entry_point
}

rule RLPack_116_aPLib_compression_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_v531009_LINK_v369 {
    strings:
        $a = { 8B E8 8C C0 }
    condition:
        $a at pe.entry_point
}

rule Upack_024_beta_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V50X_Silicon_Realms_Toolworks_SignByfly {
    strings:
        $a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC ?? 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_CIH_Version_12_TTIT_WIN95CIH_Hint_WIN_EP {
    strings:
        $a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
    condition:
        $a at pe.entry_point
}

rule MIDI_Music_file_Hint_FILE_START {
    strings:
        $a = { 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54 }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_006_by_Dmitry_quotANDquot_Andreev {
    strings:
        $a = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V3035_V3043_Thinstall_Company_Sign_by_fly {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point
}

rule SND_music_file {
    strings:
        $a = { 00 00 F8 2A ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_DLL_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_10X_Sukhov_Vladimir_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v33_Silent_Software_Silent_Shield_c2005_h_additional {
    strings:
        $a = { BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Macromedia_Flash_Projector_60_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_20x_Heuristic_Mode_Jeremy_Collake {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v11_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule Khrome_Crypt_03 {
    strings:
        $a = { B9 EB 09 B8 05 FE EB FC 80 C4 3B EB F4 EB 37 90 FE DF DF DF DF DF DF DF DF DF DF DF DF DF DF FE DD 20 4B 68 72 6F 6D 65 20 43 72 79 70 74 20 DE FE DC DC DC DC DC DC DC DC DC DC DC DC DC DC FE EF 00 00 00 00 00 EB 02 66 BC D9 FF EB 02 66 BC }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V01b_V08_SMoKE_additional {
    strings:
        $a = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V10_cyberbob_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_36_wwwexeshieldcom {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }
    condition:
        $a at pe.entry_point
}

rule FakeNinja_V28_Private_Spirit_SignByfly {
    strings:
        $a = { 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 17 E5 FF 60 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_041_FEUERRADER_additional {
    strings:
        $a = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PE_Pack_099_Anorganix {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Code_Lock_Anorganix {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Lockless_Intro_Pack_Anorganix_additional {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PENightMare_2_Beta {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_VIRUSI_Worm_Hybris_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v202c_additional {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_07_Hint_DOS_EP {
    strings:
        $a = { 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83 }
    condition:
        $a at pe.entry_point
}

rule ExeSafeguard_v10_simonzh {
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
        $b = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_WATCOM_CCpp_EXE_Anorganix {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_19881989 {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule Inno_Installer_v512 {
    strings:
        $a = { 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
        $b = { 9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEBundle_20b5_31x_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 00 87 DD 01 AD ?? ?? ?? ?? 01 AD }
    condition:
        $a at pe.entry_point
}

rule ExeJoiner_10_Yoda_additional {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }
    condition:
        $a at pe.entry_point
}

rule X_Hider_10_GlobaL {
    strings:
        $a = { 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00 }
        $b = { 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_PACK_10 {
    strings:
        $a = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }
        $b = { 74 00 E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DBPE_vxxx_additional {
    strings:
        $a = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_V61X_DLL_CrypKey_Canada_Inc {
    strings:
        $a = { 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_03_by_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_DEF_10_Anorganix {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_REALBasic {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule DzA_Patcher_v13_Loader {
    strings:
        $a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
        $b = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PowerBASICWin_800 {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02 }
    condition:
        $a at pe.entry_point
}

rule XJ_XPAL_LiNSoN {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }
    condition:
        $a at pe.entry_point
}

rule PowerBASICCC_30x {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85 }
    condition:
        $a at pe.entry_point
}

rule FreeCryptor_01_build_002_GlOFF {
    strings:
        $a = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }
    condition:
        $a at pe.entry_point
}

rule PROTECT_EXECOM_v60_additional {
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule PECompact_20betastudent_version_Jeremy_Collake {
    strings:
        $a = { B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_14_SE_SIS_Team_additional {
    strings:
        $a = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL_encrypted_Hint_DOS_EP_additional {
    strings:
        $a = { 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2312_Jitit {
    strings:
        $a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_com {
    strings:
        $a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }
    condition:
        $a at pe.entry_point
}

rule PKZIP_Archive {
    strings:
        $a = { 50 4B 03 04 }
    condition:
        $a at pe.entry_point
}

rule LHA_Archive_Hint_FILE_START {
    strings:
        $a = { 6C 68 35 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2545_Jitit_Sign_by_fly {
    strings:
        $a = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4093_Dll_SafeNet {
    strings:
        $a = { 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D }
    condition:
        $a at pe.entry_point
}

rule tElock_v071b7_additional {
    strings:
        $a = { 60 E8 48 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v135_risco_software_Inc_Anticrack_Software_h {
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point
}

rule EXE_v10_ {
    strings:
        $a = { 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1 }
    condition:
        $a at pe.entry_point
}

rule Windows_Group_file {
    strings:
        $a = { 50 4D 43 43 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v27 {
    strings:
        $a = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_ASPack_212_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_CodeSafe_20_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_p_Password_checking {
    strings:
        $a = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule A3E_TXT2COM {
    strings:
        $a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }
    condition:
        $a at pe.entry_point
}

rule RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch_additional {
    strings:
        $a = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }
    condition:
        $a at pe.entry_point
}

rule Exact_Audio_Copy {
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
        $b = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v302_v302a_v304_Relocations_pack {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }
    condition:
        $a at pe.entry_point
}

rule EXEStealth_v275a_WebtoolMaster_h_additional {
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5 }
    condition:
        $a at pe.entry_point
}

rule TMT_Pascal_v040_Hint_DOS_EP {
    strings:
        $a = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v265b1_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 }
    condition:
        $a at pe.entry_point
}

rule Obsiduim_1304_Obsiduim_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }
    condition:
        $a at pe.entry_point
}

rule PENinja_modified_pDZA {
    strings:
        $a = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }
    condition:
        $a at pe.entry_point
}

rule UPX_Alternative_stub_Laszlo_Markus {
    strings:
        $a = { EB 02 EB EA EB FC 8A 06 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_198889 {
    strings:
        $a = { B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 }
    condition:
        $a at pe.entry_point
}

rule TPCs_COM_Scrambler_v100_Hint_DOS_EP {
    strings:
        $a = { EB ?? 2E ?? ?? ?? ?? 8E C0 8C D8 BE ?? ?? BF ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 0E 07 B9 ?? ?? FC F3 A4 CC }
    condition:
        $a at pe.entry_point
}

rule DIET_v100d_additional {
    strings:
        $a = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule WinRAR_32_bit_SFX_Module {
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89 {
    strings:
        $a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule PEiD_813_32Lite_v003a_Oleg_Prokhorov {
    strings:
        $a = { 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 00 10 ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_Dll_LZMA_430_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_Grazie883_additional {
    strings:
        $a = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_23_SKE_build_0426_Beta_additional {
    strings:
        $a = { 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60 {
    strings:
        $a = { 51 }
        $b = { ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 0D ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule KByS_V028_DLL_shoooo {
    strings:
        $a = { B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v50 {
    strings:
        $a = { EB 15 03 ?? ?? ?? 06 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_additional {
    strings:
        $a = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_REALBasic {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule nMacro_recorder_10_additional {
    strings:
        $a = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }
    condition:
        $a at pe.entry_point
}

rule JDPack_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_FSG_10_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_02_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v071_Virogen {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 50 50 2D ?? ?? ?? 00 89 85 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL_Anorganix {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule WinRAR_SFX {
    strings:
        $a = { E8 E3 FE FF FF 33 C0 50 50 50 50 E8 BE 2B 00 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_04_beta_1_by_Alex_additional {
    strings:
        $a = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v10_Northfox_additional {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Lattice_C_v30 {
    strings:
        $a = { FA B8 ?? ?? 8E D8 B8 ?? ?? 8E }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v039_final_By_Dwing_c2005_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V220070411_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule SysPack_v01_Hint_DOS_EP {
    strings:
        $a = { ?? ?? 0E 2E ?? ?? ?? ?? 06 53 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? 74 ?? 26 ?? ?? ?? ?? ?? 5B 07 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 }
    condition:
        $a at pe.entry_point
}

rule tElock_v07x_v084 {
    strings:
        $a = { 60 E8 02 ?? ?? ?? CD 20 E8 ?? ?? ?? ?? 5E 2B C9 58 74 }
        $b = { 60 E8 00 00 C3 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_0977 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 00 87 DD 8B 85 2A 87 40 00 01 85 94 86 40 00 66 C7 85 91 86 40 00 90 90 BB E1 06 00 00 03 9D 2E 87 40 00 03 9D 2A 87 40 00 53 53 53 58 2D FB }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v137_additional {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }
    condition:
        $a at pe.entry_point
}

rule PECompact_0978 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 00 87 DD 8B 85 A9 88 40 00 01 85 18 88 40 00 66 C7 85 15 88 40 00 90 90 BB A8 09 00 00 03 9D AD 88 40 00 03 9D A9 88 40 00 53 53 53 58 2D 7F }
    condition:
        $a at pe.entry_point
}

rule Inset_Systems_PIX_Graphics_format {
    strings:
        $a = { 03 00 ?? 00 00 00 20 00 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_12C_12D_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54 }
    condition:
        $a at pe.entry_point
}

rule IDA_Interactive_Disassembler_database_Hint_FILE_START {
    strings:
        $a = { 49 44 41 }
    condition:
        $a at pe.entry_point
}

rule Lotus_Word_Pro_document_file_Hint_FILE_START {
    strings:
        $a = { 57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37 }
    condition:
        $a at pe.entry_point
}

rule Splice_11_by_Tw1sted_L0gic {
    strings:
        $a = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76 }
        $b = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v080_v084_additional {
    strings:
        $a = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V16d_Vaska_Sign_by_fly {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule Xtreme_Protector_100_105_Rafael_Ahucha_Sergio_Lara {
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v11_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }
    condition:
        $a at pe.entry_point
}

rule Gem_VDI_Image_graphics_file_Hint_FILE_START {
    strings:
        $a = { 00 01 00 ?? 00 ?? 00 01 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1987_or_Borland_Cpp_1991_additional {
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v0251 {
    strings:
        $a = { 5D 83 ED 06 EB 02 EA 04 8D }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_com_additional {
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v203_additional {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule UPX_v071_DLL_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 }
    condition:
        $a at pe.entry_point
}

rule Sphinx_C_v_19_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B4 34 CD 21 8C 06 ?? ?? 89 1E ?? ?? B8 ?? ?? E8 ?? ?? B8 ?? ?? BB }
    condition:
        $a at pe.entry_point
}

rule VProtect_2050618Cloud_CoooLie {
    strings:
        $a = { 60 F6 D3 66 F7 D2 66 F7 D2 F6 D3 61 66 91 60 F7 D3 F7 D3 61 66 91 8B 67 28 8B C9 66 55 66 5D 61 66 8B FF 66 52 66 5A 66 50 66 58 8D 80 F3 FF FF FF 9C 9D 8D 80 0D 00 00 00 60 61 9D 51 8D 80 E5 FF FF FF 8D 80 1B 00 00 00 59 8D 9B ED FF FF FF 50 66 87 CE 8B D2 66 87 CE 58 8D 9B 13 00 00 00 8D 89 FB FF FF FF 60 66 F7 D3 8D 89 FD FF FF FF 8D 89 03 00 00 00 66 F7 D3 61 8D 89 05 00 00 00 66 53 8D AD F5 FF FF FF 8A FF 8D AD 0B 00 00 00 66 5B }
    condition:
        $a at pe.entry_point
}

rule Vx_Keypress1212_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
    condition:
        $a at pe.entry_point
}

rule WIBU_Key_V410A_WIBU_SYSTEMS_AG_Sign_by_fly {
    strings:
        $a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cue_50p_MFC {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_GPcH_additional {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Borland_Cpp {
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
        $b = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Exe_Locker_V10_IonIce {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140b5_v140b6 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }
    condition:
        $a at pe.entry_point
}

rule Werus_Crypter_10_by_Kas {
    strings:
        $a = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2021_wwwstrongbitcom {
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
        $b = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule fds0ft_c0m_pr0tect_v04b_Hint_DOS_EP {
    strings:
        $a = { 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Comt_010d_original {
    strings:
        $a = { 45 4E 43 2E 43 4F 4D 2E 42 26 46 3D 0D 0A 25 30 30 25 40 40 50 5A 2D 72 6D 2D 72 6D 2D 4C 23 50 5F 52 5E 4E 31 35 52 58 2D 71 6E 2D 71 6E 50 2D 40 21 50 59 2D 21 70 2D 21 60 2D 21 30 50 5D 3D 0D 0A 58 2D 62 21 50 5F 57 52 5E 21 35 47 47 21 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_2122_dll_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v133a_dulekxt {
    strings:
        $a = { BE A8 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
    condition:
        $a at pe.entry_point
}

rule SLR_OPTLINK_1 {
    strings:
        $a = { 87 C0 EB ?? 71 ?? 02 D8 }
    condition:
        $a at pe.entry_point
}

rule StarForce_Protection_Driver_Protection_Technology_h {
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule vfpexeNc_v600_Wang_JianGuo {
    strings:
        $a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point
}

rule UPX_v072_Hint_DOS_EP {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PENinja_131_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule ExeSafeguard_v10_simonzh_additional {
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
    condition:
        $a at pe.entry_point
}

rule EPW_v130 {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }
    condition:
        $a at pe.entry_point
}

rule IMP_Packer_10_Mahdi_Hezavehi_IMPOSTER_h {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
        $b = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_V1258_V133X_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Vx_Hafen1641_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b2_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule Installer_VISE_Custom_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D }
    condition:
        $a at pe.entry_point
}

rule Petite_v_after_v14_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule UPXLock_v11_CyberDoom_Bob_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60 }
    condition:
        $a at pe.entry_point
}

rule DOS32_33 {
    strings:
        $a = { 0E 1F FC 9C 5B 8B C3 80 F4 40 50 9D 9C 58 3A E7 75 0B BA 87 20 B4 09 CD 21 B4 4C CD 21 8C 06 CA 00 26 A1 2C 00 A3 C8 00 8C 0E 98 00 8C 06 9C 00 8C 06 A0 00 0E 07 33 C0 BF A0 22 B9 A0 51 2B CF D1 E9 F3 AB BA EE 0D 81 EA C4 47 B9 6A 10 BB BF }
    condition:
        $a at pe.entry_point
}

rule aPack_069_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE A0 01 BF 00 01 50 57 FC B6 01 BD 81 01 FF D5 73 61 FF D5 73 1C FF D5 73 3F BB 98 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 3A 93 EB 3C E8 4C 00 49 49 75 0A 2E 8B 1E 00 01 E8 40 00 EB 26 49 AC }
    condition:
        $a at pe.entry_point
}

rule IMPostor_Pack_10_Mahdi_Hezavehi_additional {
    strings:
        $a = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_V12_Sukhov_Vladimir_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ {
    strings:
        $a = { 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_18X_19X_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 }
    condition:
        $a at pe.entry_point
}

rule T_PACK_v05c_m1 {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE }
    condition:
        $a at pe.entry_point
}

rule T_PACK_v05c_m2 {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD }
    condition:
        $a at pe.entry_point
}

rule Virtual_Image_Maker_Graphics_file_Hint_FILE_START {
    strings:
        $a = { 53 4F 4D 56 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_BeRo_Farbrausch {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8 }
        $b = { 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule bambam_V004_bedrock {
    strings:
        $a = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 }
    condition:
        $a at pe.entry_point
}

rule ACE_SFX_Archive_Hint_HDR_FILESIZE_p_7 {
    strings:
        $a = { 2A 2A 41 43 45 2A 2A }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v19x {
    strings:
        $a = { 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Microsoft_Visual_Basic_50_60_Anorganix {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_03 {
    strings:
        $a = { 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule Encriptor_100 {
    strings:
        $a = { B9 60 EA BE 87 01 BF 87 01 AC D0 C8 AA E2 FA BE 6E 01 BF 48 EE AC AA 81 FE 87 01 75 F8 8C C8 BF 48 EE FF E7 BE 88 01 BF 00 01 B9 60 EA F3 A4 B8 00 00 BB 00 00 B9 00 00 BF 00 01 FF E7 24 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_01 {
    strings:
        $a = { EB ?? ?? BE ?? ?? BF ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_07 {
    strings:
        $a = { 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_06 {
    strings:
        $a = { FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_05 {
    strings:
        $a = { FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_04 {
    strings:
        $a = { BC ?? ?? C3 2E FF 2E ?? ?? CF }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_08 {
    strings:
        $a = { 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp {
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
        $b = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SDProtector_V11X_Randy_Li_Sign_by_fly {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 }
    condition:
        $a at pe.entry_point
}

rule PKTINY_v10_with_TINYPROG_v38_additional {
    strings:
        $a = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_440_Silicon_Realms_Toolworks_h {
    strings:
        $a = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 }
        $b = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sentinel_UltraPro_Dongle_V110_SafeNet_Inc_SignByfly_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Registration_file_v10_Hint_FILE_START {
    strings:
        $a = { 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point
}

rule Upx_Lock_10_12_CyberDoom_Team_X_BoB_BobSoft {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }
    condition:
        $a at pe.entry_point
}

rule GameGuard_nProtect_additional {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v133_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_DLL_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_runtime_system_1995 {
    strings:
        $a = { 53 56 57 55 8B 00 24 14 8B 00 24 18 8B 6C 24 1C 83 00 03 0F 87 00 01 00 00 89 00 2E FF 24 85 }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtectionV1701_CGSoftLabs_20090606 {
    strings:
        $a = { C3 EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 ?? ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 EB 01 ?? 83 65 F8 00 EB 07 8B 45 F8 40 89 45 F8 83 7D F8 61 73 1F EB 02 ?? ?? 8B 45 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 EB EB ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 F4 EB 02 ?? ?? 83 7D F4 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 FC 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 F4 E8 01 00 00 00 81 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v20_Hide_EP_Vaska_additional {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }
    condition:
        $a at pe.entry_point
}

rule DIET_v102b_v110a_v120_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule Pi_Cryptor_10_by_Scofield {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 }
        $b = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3 }
        $c = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_140b2_140b4 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 86 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }
    condition:
        $a at pe.entry_point
}

rule EPW_130_COM {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 83 C0 10 50 B8 D1 00 50 CB 8C C0 83 C0 10 8E C0 83 C0 05 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 1E 00 B4 09 CD 21 BB 0E 00 B9 10 00 B4 00 CD 16 3C 0D 74 09 3C }
    condition:
        $a at pe.entry_point
}

rule Vx_Agiplan1536_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 50 B0 ?? BA ?? ?? EE BA ?? ?? EC 3C ?? 76 ?? E9 ?? ?? B8 ?? ?? CD 21 8C D8 8E C0 83 ?? ?? 75 ?? E9 ?? ?? BA ?? ?? B8 ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_CrunchPE_Heuristic_Anorganix {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_v500d {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HACKSTOP_v119 {
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point
}

rule Vx_CIH_Version_12_TTIT_WIN95CIH_additional {
    strings:
        $a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v113 {
    strings:
        $a = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v272_additional {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }
    condition:
        $a at pe.entry_point
}

rule JEDMICS_CCITT4_Graphics_format {
    strings:
        $a = { 80 00 00 00 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule CreateInstall_200335 {
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
    condition:
        $a at pe.entry_point
}

rule Phar_Lap_DOS_Extender_1986_91_Hint_DOS_EP {
    strings:
        $a = { EB ?? 8C D8 8E C0 B8 ?? ?? 8E D8 BB ?? ?? 8C C0 2B D8 81 ?? ?? ?? B4 4A CD 21 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098_m_additional {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }
    condition:
        $a at pe.entry_point
}

rule aPack_066_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 9C 01 BF 00 01 50 57 FC B6 01 BD 7D 01 FF D5 73 5D FF D5 73 1C FF D5 73 3B BB 94 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 36 93 EB 38 E8 48 00 49 49 75 06 2E A1 00 01 EB 08 49 AC 8A E1 2E A3 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC4_build_0807_dll_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule COOLcryptor_09_kongfoo {
    strings:
        $a = { E8 03 00 00 00 E9 EB 07 FF 04 24 EB 01 FF C3 E8 03 00 00 00 EB 02 EA C3 EB 08 8D 8D 72 08 }
    condition:
        $a at pe.entry_point
}

rule PEnguinCrypt_v10_additional {
    strings:
        $a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_10_JunkCode_additional {
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_for_Windows {
    strings:
        $a = { A1 C1 A3 83 75 57 51 33 C0 }
        $b = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_108_additional {
    strings:
        $a = { 90 90 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V310X_Thinstall_Company {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Jam_211_EXE {
    strings:
        $a = { 50 06 16 07 BE 22 02 8B FE B9 12 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 00 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 5E 5D }
    condition:
        $a at pe.entry_point
}

rule Vx_FaxFreeTopo_additional {
    strings:
        $a = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }
    condition:
        $a at pe.entry_point
}

rule SimplePack_1X_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190c {
    strings:
        $a = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_V01_V015_NTkrnl_Software {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190a {
    strings:
        $a = { 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_ADinjector_additional {
    strings:
        $a = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }
    condition:
        $a at pe.entry_point
}

rule EPW_120_COM {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 05 10 00 50 B8 F3 00 50 CB 8C C0 05 10 00 8E C0 05 05 00 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 20 00 B4 09 CD 21 BB 00 00 B9 10 00 B8 20 09 CD 10 BA 0E 00 B4 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_620 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point
}

rule SuckStop_v111_additional {
    strings:
        $a = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 }
    condition:
        $a at pe.entry_point
}

rule XCR_v013_additional {
    strings:
        $a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_V01_Teraphy {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v150_Device_driver_compression {
    strings:
        $a = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_12_Bill_Prisoner_TPOC_additional {
    strings:
        $a = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE }
    condition:
        $a at pe.entry_point
}

rule PEtite_v13_additional {
    strings:
        $a = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_1X_Sukhov_Vladimir_Serge_N_Markin {
    strings:
        $a = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }
        $b = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_2xx_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PE_Protect_09_Anorganix {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v60 {
    strings:
        $a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule D1S1G_v11_beta_D1N {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 }
        $b = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v305c4_Extractable_p_Virus_Shield {
    strings:
        $a = { 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_MSVCpp_60_DLL_emadicius_h {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32_v1x_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10 }
    condition:
        $a at pe.entry_point
}

rule ZM_Exe_Executable_Image {
    strings:
        $a = { 5A 4D }
    condition:
        $a at pe.entry_point
}

rule PuNkMoD_10_PuNkDuDe {
    strings:
        $a = { 94 B9 60 01 00 00 BC ?? ?? 40 00 80 34 0C ?? E2 FA EB DF }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_07 {
    strings:
        $a = { 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB }
    condition:
        $a at pe.entry_point
}

rule aPack_099_f_m_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 41 73 12 FF D5 BB 10 00 72 00 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 00 8A }
    condition:
        $a at pe.entry_point
}

rule UPX_p_ECLiPSE_layer {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_151_GlOFF {
    strings:
        $a = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52 }
        $b = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEncrypt_v30 {
    strings:
        $a = { E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZMA {
    strings:
        $a = { 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
    condition:
        $a at pe.entry_point
}

rule HiJaak_Image_Draw_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 47 53 44 31 02 00 11 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16d_by_Vaska_UsAr_sign_21032007_2222_additional {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v109a_additional {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule FSG_v133_Eng_dulekxt {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF }
    condition:
        $a at pe.entry_point
}

rule UPXHiT_001_sibaway7yahoocom {
    strings:
        $a = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MarjinZ_EXE_Scrambler_SE_by_MarjinZ_additional {
    strings:
        $a = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 }
    condition:
        $a at pe.entry_point
}

rule AutoLogic_Graphics_format {
    strings:
        $a = { FF 04 00 07 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v090_additional {
    strings:
        $a = { EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }
    condition:
        $a at pe.entry_point
}

rule Vx_Gotcha879_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V10X_V17X_DLL_Oreans_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        $a at pe.entry_point
}

rule Added_HYPDOC_v10_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? 2E C6 ?? ?? ?? ?? 2E C6 06 ?? ?? ?? B9 ?? ?? 2E 8A 26 ?? ?? B0 ?? E8 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_620 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ExeSmasher {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V01_cyberbob_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? B9 A5 08 00 00 8D ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule LameCrypt_v10_additional {
    strings:
        $a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }
    condition:
        $a at pe.entry_point
}

rule ASDPack_v10_asd_additional {
    strings:
        $a = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1258_V133X_Obsidium_Software_Sign_by_fly {
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule NsPack_31_by_North_Star_Liu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 }
    condition:
        $a at pe.entry_point
}

rule RPolyCryptor_V142_Vaska_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Protect_09_by_Cristoph_Gabler_1998_additional {
    strings:
        $a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_31 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 FF 15 00 00 00 00 33 D2 8B C8 8A D4 81 E1 FF 00 00 00 C1 E8 10 89 15 00 00 40 00 89 0D 00 00 40 00 A3 00 00 40 00 C1 E1 08 03 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_QBasic_v30_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 8C C8 8E D8 E8 ?? ?? 8A 17 0A D2 74 ?? B4 ?? CD 21 43 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006710_V220070411_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
        $b = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EncryptPE_12003518_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2422_2428_Jitit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule SelfEnc_10 {
    strings:
        $a = { BB 0F 01 B9 8F 18 33 C0 2E 80 2F 00 43 E2 F9 }
    condition:
        $a at pe.entry_point
}

rule Encapsulated_Postscript_graphics_file_v20_EPSF_12 {
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig1h_additional {
    strings:
        $a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_V121_LZMA_430_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Help_file {
    strings:
        $a = { 3F 5F 03 }
    condition:
        $a at pe.entry_point
}

rule AinEXE_21 {
    strings:
        $a = { A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA FE C9 D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF 8B FE FE CA 78 07 B9 00 80 F3 A5 EB E5 8B C8 }
    condition:
        $a at pe.entry_point
}

rule LHARC_SFX_Archive_v1131c_Hint_DOS_EP {
    strings:
        $a = { EB ?? ?? ?? ?? ?? 24 4C 48 61 72 ?? 27 73 ?? 53 46 58 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v1010_win32_console_additional {
    strings:
        $a = { C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC }
    condition:
        $a at pe.entry_point
}

rule Trivial173_by_SMTSMF {
    strings:
        $a = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }
    condition:
        $a at pe.entry_point
}

rule EXELOCK_666_105 {
    strings:
        $a = { BA 7E 08 BF 27 01 EB 01 EA E8 FB FE 48 79 7A 7F 2C 7E 2A 1C FA 48 78 F5 E3 AE 45 14 04 5A E9 F8 9E 89 18 96 01 5A B1 E0 08 E6 F2 8E FB 4A B1 9C 1D 9C 08 84 11 B1 F1 1F 1C F6 E5 22 CB 23 44 A0 CC 1B D9 BD D2 78 B6 B7 74 A6 E6 AF C4 71 62 AE }
    condition:
        $a at pe.entry_point
}

rule EXELOCK_666_104 {
    strings:
        $a = { BA 20 08 BF E3 00 EB 01 EA E8 3F FF 7C 29 79 2F 1F F7 9C 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D EB 0D 55 BC E3 0D E1 F7 8D E6 55 AC FD 19 9B 0D E5 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE }
    condition:
        $a at pe.entry_point
}

rule Pe123_2006412 {
    strings:
        $a = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }
    condition:
        $a at pe.entry_point
}

rule EXELOCK_666_103 {
    strings:
        $a = { BA 6C 07 BF 20 01 EB 01 EA E8 02 FF 7C 29 79 2F 1F F7 51 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D 7C 0D 55 BC E3 0D E1 F7 8D E6 55 AC 66 19 9B 0D 6E 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE }
    condition:
        $a at pe.entry_point
}

rule PCShrink_v040b_additional {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }
    condition:
        $a at pe.entry_point
}

rule EXEStealth_275_WebtoolMaster_additional {
    strings:
        $a = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule PESpin_13x_Cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Thinstall_3035_Jtit_additional {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_iBox_aPLib_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
    condition:
        $a at pe.entry_point
}

rule Packanoid_V10_Arkanoid {
    strings:
        $a = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b2_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 }
    condition:
        $a at pe.entry_point
}

rule Unknown_SFX_Archive_IDSKA32_Hint_FILE_START {
    strings:
        $a = { 69 64 73 6B 61 33 32 }
    condition:
        $a at pe.entry_point
}

rule FreeBASIC_016b {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AZProtect_0001_by_AlexZ_aka_AZCRC_additional {
    strings:
        $a = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 }
    condition:
        $a at pe.entry_point
}

rule Launcher_Generator_103 {
    strings:
        $a = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_NorthStar_PE_Shrinker_13_Anorganix {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_UPX_0896_102_105_124_emadicius_h {
    strings:
        $a = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule SPEC_beta_3 {
    strings:
        $a = { 5B 53 50 45 43 5D E8 00 00 00 00 5D 8B C5 81 ED 41 24 40 00 2B 85 89 26 40 00 83 E8 0B 89 85 8D 26 40 00 0F B6 B5 91 26 40 00 8B FD 8B 9D 8D 26 40 00 8B 87 96 26 40 00 03 D8 8B 8F 9A 26 40 00 8A 85 7C 26 40 00 00 03 FE C0 43 E2 F9 83 C7 08 }
    condition:
        $a at pe.entry_point
}

rule Diet_110a120_EXE {
    strings:
        $a = { FC 06 1E 0E 8C C8 01 06 35 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 52 00 AD 8B E8 B2 10 EA 00 00 00 00 64 6C 7A }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_22004810_22005314_WFS_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A }
    condition:
        $a at pe.entry_point
}

rule PureBasic_DLL_Neil_Hodgson {
    strings:
        $a = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8 }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL_Hint_DOS_EP {
    strings:
        $a = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }
    condition:
        $a at pe.entry_point
}

rule mPack_V003_DeltaAziz_additional {
    strings:
        $a = { 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ?? 32 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 C9 C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 04 00 00 00 E8 C5 C9 FF FF 83 3D ?? ?? ?? ?? 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 92 C9 FF FF BA 18 A5 00 10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9 FF FF 83 F8 04 74 0A E8 14 B2 FF FF E9 A7 00 00 00 E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 63 C9 FF FF 83 F8 FF 75 0A E8 F1 B1 FF FF E9 84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 D4 CD FF FF 84 C0 75 07 E8 CF B1 FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 0F FA FF FF 3B 05 ?? ?? ?? ?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB FF FF 6A 03 E8 07 C4 FF FF A1 ?? ?? ?? ?? E8 C1 C6 FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 AA C6 FF FF A1 ?? ?? ?? ?? E8 A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F0 E8 A7 B5 FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF FF }
    condition:
        $a at pe.entry_point
}

rule Vprotect_V200_CoooLie {
    strings:
        $a = { 57 5F 8D BF FA FF FF FF 55 66 8B C0 5D 8D BF 06 00 00 00 8A D2 8B C9 66 50 8D AD FD FF FF FF 8D AD 03 00 00 00 66 58 87 DF 66 F7 D2 55 8A C9 5D 66 F7 D2 87 DF 8B 67 28 50 66 8B C0 58 61 F6 D5 53 5B F6 D5 66 87 C6 51 59 66 87 C6 F7 D6 66 52 66 5A F7 D6 9D 8D B6 E5 FF FF FF 66 51 F6 D2 8B D2 F6 D2 66 59 8D B6 1B 00 00 00 66 51 66 59 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_v37_ExeShield_Team_h {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }
        $b = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SVK_Protector_v132_Eng_Pavol_Cerven_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
    condition:
        $a at pe.entry_point
}

rule UPX_v20_Markus_Laszlo_Reiser_h_additional {
    strings:
        $a = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12x_New_Strain_additional {
    strings:
        $a = { 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V102_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_v405d_v410d_v415d_additional {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_20_SetiSoft_additional {
    strings:
        $a = { 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_apk2_V018_Dmitry_AND_Andreev_20080731 {
    strings:
        $a = { FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule PrivateEXE_v20a_Hint_WIN_EP {
    strings:
        $a = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }
    condition:
        $a at pe.entry_point
}

rule Vx_Hafen809_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }
    condition:
        $a at pe.entry_point
}

rule pex_V099_params_additional {
    strings:
        $a = { E9 F5 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_015b_defiler {
    strings:
        $a = { E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule PowerBASICCC_40_additional {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v099_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_23_Alexey_Solodovnikov {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C }
    condition:
        $a at pe.entry_point
}

rule Diet_145f_EXE {
    strings:
        $a = { F9 9C EB 09 00 00 0A 00 00 00 55 F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA 00 00 03 D0 52 BA 00 00 52 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 67 00 AD 8B E8 B2 10 CB 64 6C 7A }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Protect_09_Anorganix_additional {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Predator2448 {
    strings:
        $a = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_V15_FEUERRADER_additional {
    strings:
        $a = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Morphine_12 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Trilobytes_JPEG_graphics_Library {
    strings:
        $a = { 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule XPack_167_additional {
    strings:
        $a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }
    condition:
        $a at pe.entry_point
}

rule Phonebook_packed_datafile_Hint_FILE_START {
    strings:
        $a = { 21 50 48 32 50 41 43 4B 24 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v42_DLL {
    strings:
        $a = { 55 8B EC 6A FF 68 68 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 53 56 }
        $b = { 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CRYPT_Version_17_c_Dismember {
    strings:
        $a = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v13037_Obsidium_Software_h_additional {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Microsoft_Visual_Cpp_70_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 }
    condition:
        $a at pe.entry_point
}

rule SecuPack_v15 {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V18X_V19X_DLL_Oreans_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b4 {
    strings:
        $a = { 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule RUE_132 {
    strings:
        $a = { 68 00 01 60 BF 03 01 B9 00 00 B0 00 2E 30 05 FE C0 47 E2 F8 61 C7 06 00 01 E9 00 C6 06 02 01 00 C3 48 69 6E 74 3A 20 27 00 27 20 77 61 73 20 63 6F 6E 76 65 72 74 65 64 20 75 73 69 6E 67 20 52 4F 53 45 27 73 20 52 55 45 21 20 73 55 4D 73 44 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b3 {
    strings:
        $a = { 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b1 {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule ASDPack_20_asd {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }
        $b = { 8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ActiveMARKTM_additional {
    strings:
        $a = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }
    condition:
        $a at pe.entry_point
}

rule AVI_movie_file {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_VOB_ProtectCD_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Gleam_100 {
    strings:
        $a = { 83 EC 0C 53 56 57 E8 24 02 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_Microsoft_Visual_Cpp_emadicius {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252_beta2 {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24 }
    condition:
        $a at pe.entry_point
}

rule Sc_Obfuscator_SuperCRacker_Sign_by_fly {
    strings:
        $a = { 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_SVKP_111_emadicius_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule MIDI_Music_file {
    strings:
        $a = { 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11_BRS_additional {
    strings:
        $a = { 60 E9 ?? 05 }
    condition:
        $a at pe.entry_point
}

rule CorelDraw_8_CDR_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 52 38 }
    condition:
        $a at pe.entry_point
}

rule Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200 {
    strings:
        $a = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_15_BitShape_Software {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_mainCRTStartup {
    strings:
        $a = { E8 FF FF E8 FF }
        $b = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Simple_UPX_Cryptor_V3042005_MANtiCORE_additional {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_01_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1333_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Registration_file_v11_additional {
    strings:
        $a = { 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006115_WFS {
    strings:
        $a = { 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35 }
        $b = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC_Anorganix_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Modification_of_Hi924 {
    strings:
        $a = { 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_V100_V124_cyclotron_additional {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_Debug_ {
    strings:
        $a = { E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V13X_V14X_RiSco {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_151_GlOFF_additional {
    strings:
        $a = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Patch_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Vx_MTE_non_encrypted {
    strings:
        $a = { F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1987_Hint_DOS_EP {
    strings:
        $a = { FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule CPAV_additional {
    strings:
        $a = { E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 }
    condition:
        $a at pe.entry_point
}

rule MSCC_10 {
    strings:
        $a = { 0E 07 BE 00 00 BF 00 01 B9 05 00 F3 A4 B9 64 02 BE 10 01 AC CC 98 03 D8 E2 F9 FA 53 50 58 4C 4C 5B 3B C3 5B FB 74 02 FA F4 1E 33 C0 8E D8 F7 16 05 00 EB 01 9A F7 16 05 00 1F 50 58 4C 4C 5B 3B C3 75 7A B9 00 00 BE 05 01 BF 05 01 B3 00 FE C3 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable {
    strings:
        $a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule XcomOR_v099i_Hint_DOS_EP {
    strings:
        $a = { 66 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? D3 ?? ?? C2 ?? ?? B9 ?? ?? EB ?? 0F 23 F8 0F 23 D8 0F 23 F8 0F 23 C8 E2 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Dongle_V54200_Rainbow_Technologies_SignByfly {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E DF 80 E8 ?? ?? ?? ?? 68 B9 10 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 12 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 07 2A A3 00 E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 88 B5 5B FF E8 ?? ?? ?? ?? 68 B9 30 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 }
        $b = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_V036_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 18 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 1C 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 1C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 14 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 3C E2 E3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v4x {
    strings:
        $a = { 64 A1 ?? ?? ?? ?? 55 8B EC 6A FF 68 68 50 64 83 53 56 57 89 }
        $b = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Themida_10xx_18xx_no_compression_Oreans_Technologies_additional {
    strings:
        $a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1352_Obsidium_Software_SignByfly {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 }
        $b = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_LCC_Win32_DLL_Anorganix_additional {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_JDPack_1x_JDProtect_09_Anorganix_additional {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_V131_Build_20070615_Dll_Sukhov_Vladimir_Serge_N_Markin {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule QuickLink_II_Fax_Graphics_format {
    strings:
        $a = { 51 4C 49 49 46 41 58 20 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_EXE32Pack_13x_emadicius_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V11A_V12_vcasm {
    strings:
        $a = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v029_beta_Dwing_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29 }
    condition:
        $a at pe.entry_point
}

rule Vx_Danish_tiny_additional {
    strings:
        $a = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule PEQuake_006_forgat_additional {
    strings:
        $a = { E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
    condition:
        $a at pe.entry_point
}

rule ShellModify_01_pll621_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_50_60_additional {
    strings:
        $a = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_420_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_p_Phar_Lap_DOS_Extender_1983_89_Hint_DOS_EP_additional {
    strings:
        $a = { EB ?? 33 ED 2E 8E 1E ?? ?? 26 A1 ?? ?? A3 ?? ?? 26 8B 1E ?? ?? B1 ?? 4B }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v114_v120 {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule Wicat_GED_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 0D 00 40 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Protect_09 {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v42 {
    strings:
        $a = { 64 A1 ?? ?? ?? ?? 55 8B EC 6A FF 68 68 50 64 83 53 56 57 89 }
        $b = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ChSfx_small_v11_additional {
    strings:
        $a = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule MASK_v23_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 ?? ?? ?? FF ?? ?? 5D 49 E8 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_emadicius_additional {
    strings:
        $a = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
    condition:
        $a at pe.entry_point
}

rule Packanoid_v1_Arkanoid_additional {
    strings:
        $a = { BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Fish_PE_Shield_112116_HellFish {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B }
        $b = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40 }
        $c = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CodeSafe_20 {
    strings:
        $a = { 83 3D 14 00 00 01 00 0F 84 08 00 00 00 A1 14 00 00 01 FF E0 C3 55 8B EC 83 EC 10 53 56 57 E8 C4 01 00 00 A1 98 00 00 01 2B 05 94 00 00 01 89 45 F4 A1 D4 00 00 01 03 05 C8 00 00 01 89 45 F8 A1 98 00 00 01 39 45 F8 0F 85 22 00 00 00 A1 A4 00 }
    condition:
        $a at pe.entry_point
}

rule TINYPROG_v36_v39_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? EB ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Sc_Obfuscator_SuperCRacker_additional {
    strings:
        $a = { 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v200_alpha_38_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule yzpack_V11_UsAr {
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V20_Private_Vaskanbsp_nbsp_SignByfly_additional {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF 59 BA ?? ?? ?? ?? F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF C0 0A ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 80 32 ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? ?? 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_075exe_Hying_CCG_h_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C9 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_13_Extranger_additional {
    strings:
        $a = { 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypter_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1355_Obsidium_Software_20080411 {
    strings:
        $a = { EB 01 ?? E8 2B 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8 }
    condition:
        $a at pe.entry_point
}

rule NSIS_Installer_NullSoft {
    strings:
        $a = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_NorthStar_PE_Shrinker_13_Anorganix {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Stony_Brook_Pascal_v614_Hint_DOS_EP {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A }
    condition:
        $a at pe.entry_point
}


rule SPEC_b2_additional {
    strings:
        $a = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_aPlib_043_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1210_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 31 2E 30 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_multi_layer_encryption_additional {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_10_101 {
    strings:
        $a = { 8B 44 24 04 8D 54 24 FC 23 05 11 10 00 00 E8 C3 04 00 00 FF 35 CC 13 00 00 50 FF 25 D4 13 00 00 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 }
    condition:
        $a at pe.entry_point
}

rule Upx_Lock_v10_CyberDoom_Team_X {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }
    condition:
        $a at pe.entry_point
}

rule LY_WGKX_wwwszleyucom {
    strings:
        $a = { 4D 79 46 75 6E 00 62 73 }
        $b = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_PESHiELD_025_Anorganix {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V21X_SoftCompletecom_ {
    strings:
        $a = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V27_V35_NsPacK_Private_additional {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54 }
    condition:
        $a at pe.entry_point
}

rule Mess_107_COM {
    strings:
        $a = { 46 55 43 4B 59 4F 55 1A FF 5F B9 FF FF F3 26 AC E3 02 EB 0C B8 00 70 50 9D 9C 58 25 00 70 75 18 BA 29 01 B4 09 CD 21 CD 20 33 38 36 2B 20 72 65 71 75 69 72 65 64 21 24 B4 30 CD 21 3C 02 77 02 CD 20 BD 47 01 FF E5 FA 66 33 C0 0F 23 F8 0F 23 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PECompact_14p {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule Symantec_C_v400_p_Libraries_additional {
    strings:
        $a = { FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1352_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_CIH_Version_12_TTIT_WIN95CIH_ {
    strings:
        $a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
    condition:
        $a at pe.entry_point
}

rule North_Star_PE_Shrinker_13_Liuxingping_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }
    condition:
        $a at pe.entry_point
}

rule Vx_Noon1163_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }
    condition:
        $a at pe.entry_point
}

rule Protect_31_EXE {
    strings:
        $a = { 2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E D8 FA FC BE 04 00 0E 07 BF 08 00 A5 A5 BE 0C 00 A5 A5 1E 07 BE 04 00 BF 0C 00 B8 D4 01 AB 87 FE AB 2E A1 06 00 87 FE AB 87 F7 AB 89 E0 8C D3 0E 17 BC 85 00 B9 CD 01 4C }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_12 {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_24x_25x_Jitit_Software_additional {
    strings:
        $a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v23_North_Star_h {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
    condition:
        $a at pe.entry_point
}

rule Crypto_Lock_202_Eng_Ryan_Thian_additional {
    strings:
        $a = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_10069_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 A3 1C 00 00 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_11x_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PC_Guard_v500d_additional {
    strings:
        $a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
    condition:
        $a at pe.entry_point
}

rule PAK_SFX_Archive_additional {
    strings:
        $a = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Xtreme_Protector_105_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule GEM_Image_graphics_file_Hint_FILE_START {
    strings:
        $a = { 00 01 00 08 00 04 00 02 }
    condition:
        $a at pe.entry_point
}

rule CRC2COM_v124_packed_Hint_DOS_EP {
    strings:
        $a = { EB ?? 8B FC 83 EF ?? 83 EC ?? BE ?? ?? B9 ?? ?? 57 F3 A4 5F FF E7 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v14xp_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_50_60 {
    strings:
        $a = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }
    condition:
        $a at pe.entry_point
}

rule Vx_Igor_additional {
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule NsPack_14_Liuxingping_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_V028_V0399_Dwing_20080321 {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v111c_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }
    condition:
        $a at pe.entry_point
}

rule Microsoft_QBasic {
    strings:
        $a = { B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 0B 33 C0 36 C7 06 00 00 00 00 EB 7D 83 E4 FE 36 89 26 00 00 8B C6 B1 04 D3 E0 48 36 A3 00 00 03 F7 89 36 02 00 8C C3 2B DE F7 DB }
    condition:
        $a at pe.entry_point
}

rule ActiveMark_Trymedia_Systems_Inc {
    strings:
        $a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
        $b = { 89 25 ?? ?? ?? ?? EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FreeJoiner_Small_build_033_GlOFF {
    strings:
        $a = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_1304_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_301_305 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
    condition:
        $a at pe.entry_point
}

rule TAV_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 4D 5A CB }
    condition:
        $a at pe.entry_point
}

rule Safeguard_103_Simonzh {
    strings:
        $a = { E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260b2_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v12_RC_additional {
    strings:
        $a = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Compiled_Datafile_Version_additional {
    strings:
        $a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule Comprot_v10b_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5E 8B EE 81 ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? F6 14 46 E2 ?? 4B }
    condition:
        $a at pe.entry_point
}

rule Pohernah_Crypter_V103_Kas {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED }
    condition:
        $a at pe.entry_point
}

rule XMI_music_file_additional {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_FSG_10_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_VOB_ProtectCD_5 {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_06_SLV {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LCC_Win32_DLL {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Upack_021_beta_Dwing_ {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
    condition:
        $a at pe.entry_point
}

rule AntiKill_PAGELK_Trojan_20090624 {
    strings:
        $a = { 50 45 00 00 4C 01 05 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 02 00 00 10 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 5F 50 41 47 45 4C 4B 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2E 69 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2E 72 65 6C 6F 63 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_MEW_11_SE_10_Anorganix {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }
    condition:
        $a at pe.entry_point
}

rule VOB_ProtectCD_5_additional {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_300_400_450_EXE_X86_CRT_LIB_additional {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PESHiELD_025_Anorganix {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }
    condition:
        $a at pe.entry_point
}

rule Petite_12_c1998_Ian_Luck_h {
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }
        $b = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEBundle_005_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 8D 85 A8 22 40 00 50 FF 95 42 23 40 00 0B C0 0F 85 B5 01 00 00 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 4A 23 40 00 0B C0 0F 84 99 01 00 00 89 85 D0 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_WAV_Audio_file_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_BJFNT_12 {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }
    condition:
        $a at pe.entry_point
}

rule SHOWV20_Show_Text_Utility_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B8 ?? ?? 2B ?? ?? ?? A3 ?? ?? E8 ?? ?? E8 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule SoftComp_1x_BG_Soft_PT {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v37_North_Star_h {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D }
    condition:
        $a at pe.entry_point
}

rule REC_v032_Hint_DOS_EP {
    strings:
        $a = { 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D }
    condition:
        $a at pe.entry_point
}

rule HideProtect_V1016C_SoftWar_Company {
    strings:
        $a = { 90 90 90 E9 D8 }
    condition:
        $a at pe.entry_point
}

rule _MSLRH_v032a_emadicius_additional {
    strings:
        $a = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
    condition:
        $a at pe.entry_point
}

rule Dev_Cpp_v5_additional {
    strings:
        $a = { 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2 {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule MPEG_movie_file {
    strings:
        $a = { 00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V230_V23X_SetiSoft_Team_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Explosion1000_additional {
    strings:
        $a = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }
    condition:
        $a at pe.entry_point
}

rule Image_Systems_Technology_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 03 3A ?? ?? 00 ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v081_v084_Modified {
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
        $b = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sierras_audio_file {
    strings:
        $a = { 8D 0C 53 4F 4C 00 22 56 0D }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v_If_you_know_this_version_post_on_PEiD_board {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_40 {
    strings:
        $a = { 68 ?? ?? ?? 00 E8 ?? FF FF FF 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_v061_SLV_additional {
    strings:
        $a = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 }
    condition:
        $a at pe.entry_point
}

rule FreeCryptor_01_build_002_GlOFF_additional {
    strings:
        $a = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_V61X_DLL_CrypKey_Canada_Inc_additional {
    strings:
        $a = { 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Encapsulated_Postscript_graphics_file_v30_EPSF_30_Hint_FILE_START {
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30 }
    condition:
        $a at pe.entry_point
}

rule Duals_eXe_10_additional {
    strings:
        $a = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1300_Obsidium_Software {
    strings:
        $a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
    condition:
        $a at pe.entry_point
}

rule PolyCrypt_PE_214b215_JLab_Software_Creations {
    strings:
        $a = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }
    condition:
        $a at pe.entry_point
}

rule DOS16M_DOS_Extender_c_Tenberry_Software_Inc_1987_1995 {
    strings:
        $a = { BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7 }
    condition:
        $a at pe.entry_point
}

rule NoClip_41 {
    strings:
        $a = { FF 26 00 02 9C 50 53 51 8C D8 A3 0C 01 FA 8E D0 FB 81 C4 00 01 FF 16 00 00 EB 01 A1 FF 16 00 00 74 03 E9 86 00 A1 0C 01 03 06 16 01 73 02 83 BF 03 C1 50 B8 4E 03 75 02 FF 1E 50 8B EC BF 70 01 E8 15 10 4F E8 38 10 56 EB 01 A1 B8 00 29 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Jovian_VI_graphics_file_Hint_FILE_START {
    strings:
        $a = { 56 49 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_ASPack_211d_emadicius {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule TheHypers_protector_TheHyper_h_additional {
    strings:
        $a = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_v31 {
    strings:
        $a = { E9 ?? ?? ?? 00 F0 0F C6 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V520_Silicon_Realms_Toolworks_20080214 {
    strings:
        $a = { E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 FE 1A 00 00 59 89 7D FC FF 75 08 E8 56 45 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 96 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 A4 19 00 00 59 C3 3B DF 75 0D 8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3 E8 CC 1D 00 00 C3 55 8B EC 51 83 65 FC 00 57 8D 45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B F8 83 C4 0C 85 FF 75 19 56 8B 75 FC 85 F6 74 10 E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89 30 5E 8B C7 5F C9 C3 6A 0C 68 ?? ?? ?? ?? E8 3B 1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ?? ?? ?? 75 43 6A 04 E8 FF 19 00 00 59 83 65 FC 00 56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56 50 E8 A0 3C 00 00 59 59 C7 45 FC FE FF FF FF E8 0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A 6A 04 E8 ED 18 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule Symantec_Visual_Cafe_30 {
    strings:
        $a = { 64 8B 05 00 00 00 00 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 E8 00 0D 00 00 E8 00 0C 00 00 6A 00 FF 15 00 00 40 00 A3 00 00 40 00 E8 00 0C 00 00 FF 15 00 00 40 }
    condition:
        $a at pe.entry_point
}

rule PrincessSandy_v10_eMiNENCE_Process_Patcher_Patch_additional {
    strings:
        $a = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }
    condition:
        $a at pe.entry_point
}

rule PEX_v099_additional {
    strings:
        $a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development {
    strings:
        $a = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLP_v073beta_ap0x_h_additional {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }
    condition:
        $a at pe.entry_point
}

rule VIRUS_I_WormKLEZ {
    strings:
        $a = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }
    condition:
        $a at pe.entry_point
}

rule V_Load_09 {
    strings:
        $a = { 33 F6 2E F6 06 B0 06 FF 74 12 0E 58 8B D8 81 E3 00 F0 75 08 B1 04 D3 E0 2B F0 D3 EE 06 5B 0E 58 2B C3 B1 04 BB 3A 07 8B D3 D3 EB 81 E2 0F 00 74 01 43 2B F3 7D 02 03 F3 03 D8 03 DE B8 00 4A CD 21 73 04 B4 4C CD 21 A1 2C 00 2E A3 0A 07 2E 8C }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_Dll_aPlib_043_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule FACRYPT_v10_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Delphi_DLL_Anorganix {
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LCC_Win32_1x_Anorganix_additional {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }
    condition:
        $a at pe.entry_point
}

rule BopCrypt_v10_additional {
    strings:
        $a = { 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_vxx {
    strings:
        $a = { B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Code_Lock_vxx_additional {
    strings:
        $a = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_v124_cyclotron {
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule MacPaint_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 00 00 02 FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule UPX_V194_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional {
    strings:
        $a = { FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_V11X_V15X_Sukhov_Vladimir_Serge_N_Markin {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_Read_A_Matic_v10_additional {
    strings:
        $a = { B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21 }
    condition:
        $a at pe.entry_point
}

rule tElock_099_10_private_tE_additional {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
    condition:
        $a at pe.entry_point
}

rule ASPR_Stripper_v2x_unpacked_additional {
    strings:
        $a = { BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8 }
    condition:
        $a at pe.entry_point
}

rule Petite_v22_Compresor_wwwun4seencompetite {
    strings:
        $a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_V1601_CGSoftLabsnbsp_nbsp_SignByfly_20080308 {
    strings:
        $a = { EB 01 ?? EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 E2 05 00 00 EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 ?? 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 ?? ?? 8B 45 F4 0F B6 ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 81 ?? ?? ?? ?? EB 01 ?? EB D4 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 FC EB 02 ?? ?? 83 7D FC 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 A0 05 00 00 A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 F8 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 FC E8 01 00 00 00 ?? 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_101 {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB 03 FF CD 20 56 57 55 89 A3 4B 20 00 00 8B EB 80 BB FA 1F 00 00 01 0F 84 D3 17 00 00 C6 83 FA 1F 00 00 01 80 BB 21 20 00 00 00 75 26 8B 83 07 20 00 00 53 2B D8 EB 02 CD 20 EB 03 FF }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_102 {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 }
    condition:
        $a at pe.entry_point
}

rule Apex_c_beta_500mhz {
    strings:
        $a = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Protection_Plus_vxx_additional {
    strings:
        $a = { 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v60_v70_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule UPX_p_ECLiPSE_layer_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_XCR_011_Anorganix {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
    condition:
        $a at pe.entry_point
}

rule tElock_v042_additional {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
    condition:
        $a at pe.entry_point
}

rule UPX_120_Markus_Laszlo {
    strings:
        $a = { 31 2E 32 30 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1333_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule EP_v10 {
    strings:
        $a = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 }
        $b = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_Virtualization_Suite_V3049_V3080_Thinstall_Company {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_PEtite_2x_level_0 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_v125_PolyTech {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 }
        $b = { 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 }
        $c = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Packer_Vecna {
    strings:
        $a = { FC 8B 35 70 01 40 00 83 EE 40 6A 40 68 00 30 10 }
    condition:
        $a at pe.entry_point
}

rule COM2EXE_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 8C CA 81 C2 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule Xenocode_Virtual_Application_Studio_2009_Xenocode_20090203 {
    strings:
        $a = { 58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 3A 00 20 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_V10X_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }
    condition:
        $a at pe.entry_point
}

rule LC_300_1986 {
    strings:
        $a = { FA B8 00 00 05 10 00 B1 04 D3 E8 8C CB 03 C3 8E D8 8E D0 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_v254_Teggo_additional {
    strings:
        $a = { 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule ORiEN_V1X_V2X_Fisun_AV_Sign_by_fly_additional {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
    condition:
        $a at pe.entry_point
}

rule NeoLite_104 {
    strings:
        $a = { 8B 44 24 04 8D 54 24 FC 23 05 11 10 00 00 E8 EB 04 00 00 FF 35 F4 13 00 00 50 FF 25 FC 13 00 00 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE }
    condition:
        $a at pe.entry_point
}

rule EXE_Manager_Version_30_1994_c_Solar_Designer_Hint_DOS_EP {
    strings:
        $a = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }
    condition:
        $a at pe.entry_point
}

rule bambam_V001_bedrock {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
        $b = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_Yodas_Protector_102_Anorganix {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 }
    condition:
        $a at pe.entry_point
}

rule eXPressorPacK_V150X_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_37x_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC }
    condition:
        $a at pe.entry_point
}

rule FreeHand_8_document_Hint_FILE_START {
    strings:
        $a = { 41 47 44 33 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20b4_additional {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
    condition:
        $a at pe.entry_point
}

rule WinZip_32_bit_SFX_v8x_module_additional {
    strings:
        $a = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Upack_V038_Dwing_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5B 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? 69 ED 00 0C 00 00 8D AC 2B 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 FB 00 00 00 04 F9 1A C0 B1 30 8B 6B 08 03 D1 FF 16 73 49 03 D1 FF 16 72 17 03 D1 FF 16 72 27 24 02 04 09 50 8B C7 2B 43 08 8A 00 E9 CD 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 24 03 04 08 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 95 00 00 00 24 03 04 07 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v102a_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule CubiComp_PictureMaker_graphics_format_red_Hint_FILE_START {
    strings:
        $a = { 16 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Watcom_CCpp_DLL_Anorganix {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v119_Hint_DOS_EP {
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ACProtect_109_Anorganix {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_131_Build_20070615_Dll_Sukhov_Vladimir_Serge_N_Markin {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_VOB_ProtectCD_5 {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_Brczi_Gbor_Pierre_Muller_Peter_Vreman_additional {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_v_h_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v01b_MTE_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140b2_v140b4 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11 }
    condition:
        $a at pe.entry_point
}

rule NT_Shell_40 {
    strings:
        $a = { 2E 8C 1E FE 00 8C CA 8E DA 8E C2 FA 8E D2 BC FE 00 FB E8 00 00 EB 01 EA B9 A7 1E 5E 8B FE EB 01 EA 83 C7 65 2B CF EB 01 EA 32 D2 33 ED 33 DB EB 01 CD 8A 05 8A F0 EB 01 EA 2A C2 34 00 EB 01 EA 2C 00 51 EB 01 CD 8B CD EB 01 EA EB 01 EA D2 C8 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_Method1_bagie {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_60_70 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Vx_Heloween1172_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D }
    condition:
        $a at pe.entry_point
}

rule PESpin_v11_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_301_350a_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_04_by_delikon {
    strings:
        $a = { 55 8B EC ?? ?? ?? ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 E9 ?? E2 ?? C3 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1820_p_Oreans_Technologies {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v13_v14_Vaska_additional {
    strings:
        $a = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V1X_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v300a {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }
    condition:
        $a at pe.entry_point
}

rule SoftSentry_v30_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_50_60_ {
    strings:
        $a = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Joiner_sign_from_pinch_26032007_0212_additional {
    strings:
        $a = { 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80 }
    condition:
        $a at pe.entry_point
}

rule UPX_124_Markus_Laszlo {
    strings:
        $a = { 31 2E 32 34 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PE_Pack_099_Anorganix {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }
    condition:
        $a at pe.entry_point
}

rule FASM_15x {
    strings:
        $a = { 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_additional {
    strings:
        $a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule FreeCryptor_03_GlOFF {
    strings:
        $a = { 1E 98 3? }
    condition:
        $a at pe.entry_point
}

rule Upack_V022_V023_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 6A 07 BE ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20_RC2 {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
    condition:
        $a at pe.entry_point
}

rule Minke_101_by_Codius_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v10b_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v70_DLL {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 }
        $b = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_Modifier_v01x {
    strings:
        $a = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_Portions_Copyright_c_198396_Borland_h {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule Tiny_Xor_01 {
    strings:
        $a = { FC B8 00 00 BB 00 00 B9 00 00 BE 03 01 30 04 02 C3 86 C4 86 DF 46 E2 F5 BE 00 01 C7 04 00 00 C6 44 02 00 33 C0 33 DB 33 C9 FF E6 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_023_alpha_2_Ryd_additional {
    strings:
        $a = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_DLL_LZBRS_BeRo_Farbrausch {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        $a at pe.entry_point
}

rule Vx_Sonik_Youth_Hint_DOS_EP {
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point
}

rule DBPE_v233_Ding_Boy {
    strings:
        $a = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }
    condition:
        $a at pe.entry_point
}

rule Winkript_v10 {
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v10_Stone {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_CD_Cops_II {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0761_pe_exe {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point
}

rule PESpin_03_cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_10 {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }
    condition:
        $a at pe.entry_point
}

rule XPack_152_164_EXE {
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC 10 00 2E 8F 06 CD 03 2E 8F 06 D2 03 EB 01 9A 0E BB C2 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00 0E 1F 8B EC EB 01 9A FA }
    condition:
        $a at pe.entry_point
}

rule ROD_High_TECH_Ayman {
    strings:
        $a = { 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Automatic_Protection_641_Safenet_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v10_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PESHiELD_025_emadicius {
    strings:
        $a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule PECompact_200_alpha_38 {
    strings:
        $a = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }
    condition:
        $a at pe.entry_point
}

rule R_Crypt_091 {
    strings:
        $a = { 68 00 01 60 BF 03 01 B9 00 00 B0 00 2E 30 05 FE C0 47 E2 F8 61 C7 06 00 01 00 00 C6 06 02 01 00 C3 }
    condition:
        $a at pe.entry_point
}

rule EPW_120_EXE {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 05 10 00 2E A3 0A 00 8E D8 A1 08 00 2E 03 06 0A 00 2E A3 0C 00 A1 0E 00 2E 03 06 0A 00 2E A3 06 00 A1 10 00 2E A3 04 00 A1 14 00 2E A3 00 00 A1 16 00 2E 03 06 0A 00 2E A3 02 00 0E 1F BA 32 00 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_V01_NTkrnl_Software {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_11_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule CryptCom_v11 {
    strings:
        $a = { BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_additional {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? B8 }
    condition:
        $a at pe.entry_point
}

rule FreeHand_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 41 47 44 32 }
    condition:
        $a at pe.entry_point
}

rule CauseWay_DOS_Extender_v264_v325_1992_95_Hint_DOS_EP {
    strings:
        $a = { EB ?? 8B E8 8C C6 0E 1F 8C C0 05 ?? ?? 01 ?? ?? ?? B8 ?? ?? CD 21 3C ?? 73 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v110p1_additional {
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB }
    condition:
        $a at pe.entry_point
}

rule Morphnah_Beta_Kas_additional {
    strings:
        $a = { 2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_p_Virus_Shield {
    strings:
        $a = { 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Encrypted_without_selfcheck {
    strings:
        $a = { B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v410_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v12_additional {
    strings:
        $a = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ACProtect_109_Anorganix_additional {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v2xx {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_DLL {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_30_old_crap {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF }
        $b = { 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_CD_Cops_II_Anorganix_additional {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V13X_V14X_RiSco_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v15x_CGSoftLabs_h_additional {
    strings:
        $a = { 55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23 }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_p_Phar_Lap_DOS_Extender_1983_89_additional {
    strings:
        $a = { B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 }
    condition:
        $a at pe.entry_point
}

rule Go32Stub_v200T_DOS_Extender {
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C }
    condition:
        $a at pe.entry_point
}

rule ASPack_v2000_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 70 05 00 00 EB 4C }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v261_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_DEF_10 {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }
    condition:
        $a at pe.entry_point
}

rule SoftDefender_V11X_Randy_Li {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }
    condition:
        $a at pe.entry_point
}

rule CrypWrap_CrypKey_Canada_Inc {
    strings:
        $a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
    condition:
        $a at pe.entry_point
}

rule Utah_RLE_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1987_or_Borland_Cpp_1991_Hint_DOS_EP {
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Morphine_27_Holy_Father_Ratter29A_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point
}

rule nPack_V112752006Beta_NEOx_SignByfly_200800212 {
    strings:
        $a = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
        $b = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Phonebook_configuration_file_Version_v3v4 {
    strings:
        $a = { 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F }
        $b = { 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70 {
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LCC_Win32_1x_Anorganix {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v25_Retail_Bitsum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_090_m_p_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 73 14 FF D5 73 00 33 DB B1 04 FF D5 13 DB E2 FA 75 00 93 AA EB E4 E8 00 00 49 E2 07 5B 53 E8 00 00 EB 00 49 AC 8A E1 93 E8 }
    condition:
        $a at pe.entry_point
}

rule Guardant_Stealth_aka_Novex_Dongle {
    strings:
        $a = { 50 53 51 52 57 56 8B 75 1C 8B 3E 8B 5D 08 8A FB 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF }
        $b = { 55 8B EC 83 C4 F0 60 E8 51 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v02Beta_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
    condition:
        $a at pe.entry_point
}

rule Vx_KBDflags1024_additional {
    strings:
        $a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_3_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 1E 06 8C D8 05 ?? ?? 8E D8 8E C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8B E8 2E }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_11_PKWARE_Inc_additional {
    strings:
        $a = { 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_stub_additional {
    strings:
        $a = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        $a at pe.entry_point
}

rule PESpin_v07_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v032_Beta_Patch {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Escargot_01_final_ppMeat {
    strings:
        $a = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 }
        $b = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Petite_22_c1998_99_Ian_Luck_h_additional {
    strings:
        $a = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional {
    strings:
        $a = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
    condition:
        $a at pe.entry_point
}

rule VBOX_v43_v46_additional {
    strings:
        $a = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
    condition:
        $a at pe.entry_point
}

rule ARC_SFX_Archive {
    strings:
        $a = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1338_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }
        $b = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule IMP_Packer_10_Mahdi_Hezavehi_IMPOSTER_additional {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point
}

rule modified_HACKSTOP_v111f_Hint_DOS_EP {
    strings:
        $a = { 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8 }
    condition:
        $a at pe.entry_point
}

rule FACRYPT_v10 {
    strings:
        $a = { B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule PMODEW_v112_116_121_133_DOS_extender_Hint_DOS_EP {
    strings:
        $a = { FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_aPlib_043_ap0xnbsp_nbsp_Sign_by_fly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule WinRAR_32_bit_SFX_Module_additional {
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Rec_014 {
    strings:
        $a = { 06 1E 0E 0E 07 1F 52 B8 00 30 1E CD 21 86 E0 3D FF 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A EB 2D FE 20 E7 E4 9B 20 30 2E 31 34 20 28 87 29 20 EB 98 20 E7 30 24 EE 20 FE 20 9F AD 64 30 3A 20 32 3A }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v2018_additional {
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v160_v165_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }
    condition:
        $a at pe.entry_point
}

rule OS2_Icon_Graphics_format {
    strings:
        $a = { 43 49 4E 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule AMGC_Archive {
    strings:
        $a = { AD 36 22 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_40_50_ {
    strings:
        $a = { EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v102_dllocx_Ashkbiz_Danehkar_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule PEStubOEP_v1x {
    strings:
        $a = { 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v27_additional {
    strings:
        $a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }
    condition:
        $a at pe.entry_point
}

rule eXPressorPacK_150X_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }
    condition:
        $a at pe.entry_point
}

rule Crunch_v40_additional {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v17 {
    strings:
        $a = { EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1337_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule Password_protector_my_SMT_additional {
    strings:
        $a = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F }
    condition:
        $a at pe.entry_point
}

rule SoftProtect_wwwsoftprotectbyru {
    strings:
        $a = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_11_additional {
    strings:
        $a = { B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_13x_Eng_Pavol_Cerven_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT1Family_additional {
    strings:
        $a = { 01 B9 ?? 00 31 17 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Protect_09_Anorganix {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }
    condition:
        $a at pe.entry_point
}

rule RJcrush_v100_additional {
    strings:
        $a = { 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Heloween1172 {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D }
    condition:
        $a at pe.entry_point
}

rule Armadillo_300a_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F }
    condition:
        $a at pe.entry_point
}

rule ARJ_SFX_Archive {
    strings:
        $a = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 4A 53 58 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_BJFNT_11b_Anorganix {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v22 {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v20 {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v21 {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v50_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V500_Silicon_Realms_Toolworks {
    strings:
        $a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? C1 E0 02 A3 }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_Dll_mainCRTStartup {
    strings:
        $a = { 55 89 E5 83 EC 08 6A ?? 6A ?? 6A ?? 6A ?? E8 0D ?? ?? ?? B8 ?? ?? ?? ?? C9 C3 90 90 90 90 90 90 FF 25 38 20 40 ?? 90 90 ?? ?? ?? ?? ?? ?? ?? ?? FF FF FF FF ?? ?? ?? ?? FF FF FF }
        $b = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_2021_wwwstrongbitcom_SignByhaggar_additional {
    strings:
        $a = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_Dll_aPlib_043_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 6F 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PKZIP_Archive_Hint_FILE_START {
    strings:
        $a = { 50 4B 03 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_SYP {
    strings:
        $a = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }
    condition:
        $a at pe.entry_point
}

rule PECompact_V2X_Bitsum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V12_SIS_Team {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_Sukhov_Vladimir_additional {
    strings:
        $a = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 }
    condition:
        $a at pe.entry_point
}

rule Upack_028_0399_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing_h {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100c_2_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_ZCode_101 {
    strings:
        $a = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v126b1_v126b2_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_12_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SuckStop_111 {
    strings:
        $a = { 4B 41 4F 54 58 EB 02 8E 7C BE 10 00 B4 30 CD 21 EB 0A 9B 00 00 00 00 00 BF 00 00 B9 3C 03 77 02 CD 20 4E 75 E7 6A 00 0E 6A 69 FE C3 CF AC 66 64 33 06 0C 00 66 65 2B 06 90 06 8C EA 03 C2 CF 32 C7 AA CF 47 72 65 65 74 7A 20 74 6F 20 61 6C 6C }
    condition:
        $a at pe.entry_point
}

rule SuckStop_110 {
    strings:
        $a = { 4B 41 4F 54 5C EB 02 8E 7C BE 10 00 B4 30 CD 21 EB 0A 9B 00 00 00 00 00 BF 00 00 B9 3C 03 77 02 CD 20 4E 75 E7 6A 00 0E 6A 5E FE C3 CF AC 66 64 33 06 0C 00 66 65 2B 06 90 06 8C EA 03 C2 CF 32 C7 AA CF 41 6E 61 72 63 68 79 20 77 69 6C 6C 20 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_FORTRAN_Hint_DOS_EP {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_delikon {
    strings:
        $a = { FF 96 ?? ?? ?? 00 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_Debug {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65 }
        $b = { E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule code {
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_multi_layer_encryption {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
        $b = { 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v11_additional {
    strings:
        $a = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Desktop_File_additional {
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1337_20070620_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v095_additional {
    strings:
        $a = { E9 D5 E4 FF FF 00 }
    condition:
        $a at pe.entry_point
}

rule shoooos_Pack_shoooo {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v13_CGSoftLabs_additional {
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_v20a {
    strings:
        $a = { 53 E8 00 00 00 00 5B 8B C3 2D }
        $b = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PKLITE_v200b_extra_Hint_DOS_EP {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_additional {
    strings:
        $a = { F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 }
    condition:
        $a at pe.entry_point
}

rule RLP_V073beta_ap0x_additional {
    strings:
        $a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule ProActivate_V10X_TurboPower_Software_Company_additional {
    strings:
        $a = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33 }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_V150X_CGSoftLabs_Sign_by_fly {
    strings:
        $a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB }
        $b = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPXHiT_v001_DJ_Siba {
    strings:
        $a = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_24x_25x_Jitit_Software {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8 }
        $b = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Haryanto_additional {
    strings:
        $a = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }
    condition:
        $a at pe.entry_point
}

rule PC_PE_Encryptor_Alpha_preview {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140_v145_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V2736_Jitit_Sign_by_fly {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule CopyControl_v303 {
    strings:
        $a = { CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C }
    condition:
        $a at pe.entry_point
}

rule CERBERUS_v20 {
    strings:
        $a = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule DotFix_Nice_Protect_21_GPcH_Soft_additional {
    strings:
        $a = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1304_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V2021_protected_IAT_wwwstrongbitcom {
    strings:
        $a = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_225_by_Jan_Vorel_additional {
    strings:
        $a = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 }
    condition:
        $a at pe.entry_point
}

rule Zylom_encrypted_game_Zylom_games {
    strings:
        $a = { 2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 7A 79 6C 6D 73 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2E 7A 79 6C 6D 69 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 }
    condition:
        $a at pe.entry_point
}

rule UPX_v060_v061 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 66 81 87 8D B0 F0 01 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 }
        $b = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_293_LZMA {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule SQZ_Archive {
    strings:
        $a = { 48 4C 53 51 5A }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v029_Virogen {
    strings:
        $a = { ?? BD ?? ?? ?? ?? 01 AD 55 39 40 00 8D B5 35 39 40 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_13045_SoftComplete_Development {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 31 C0 89 41 14 89 41 18 80 A1 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22007411_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v22_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule AinEXE_222 {
    strings:
        $a = { A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD FE CA 78 17 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF 8B FE B9 00 80 F3 A5 EB E5 8B F0 B9 04 }
    condition:
        $a at pe.entry_point
}

rule vfpexeNc_V500_Wang_JianGuo_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point
}

rule ChinaProtect_dummy_Sign_by_fly {
    strings:
        $a = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Metrowerks_CodeWarrior_v20_Console {
    strings:
        $a = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Adys_Glue_v010 {
    strings:
        $a = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }
    condition:
        $a at pe.entry_point
}

rule _v10_Li_Jianjun {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 }
    condition:
        $a at pe.entry_point
}

rule Shrink_20_2 {
    strings:
        $a = { 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 1F CB AC }
    condition:
        $a at pe.entry_point
}

rule Ionic_Wind_Software_additional {
    strings:
        $a = { 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8 }
    condition:
        $a at pe.entry_point
}

rule Shrink_20_1 {
    strings:
        $a = { E9 00 00 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 }
    condition:
        $a at pe.entry_point
}

rule PECompact_V2X_Bitsum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }
    condition:
        $a at pe.entry_point
}

rule ExeCode_v10_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FA 8C C3 02 DF 50 33 C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8E D0 BC ?? ?? BE ?? ?? B9 ?? ?? 33 FF 2E ?? ?? ?? ?? ?? ?? 32 DB B0 ?? E6 64 AC }
    condition:
        $a at pe.entry_point
}

rule Erdas_LANGIS_Image_graphics_format_additional {
    strings:
        $a = { 48 45 41 44 37 34 00 00 03 00 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_v303d_v305d_additional {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Code_Lock_Anorganix {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10_Demo_12_SIS_Team {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule Mask_23 {
    strings:
        $a = { 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 6E 06 03 FF 76 06 5D 49 E8 00 00 5B 81 EB A6 05 50 D6 51 52 56 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_V23X_MoleStudiocom {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ProPack_208_m2_EXE {
    strings:
        $a = { 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 2E 00 50 8B 2E 0A 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 8E C2 8E DB BE 12 }
    condition:
        $a at pe.entry_point
}

rule Mask_25 {
    strings:
        $a = { 55 57 CD 03 FC 4D 41 53 4B FD 50 FA 8B C4 F7 DC BC 01 00 94 49 FB D6 51 52 1F 52 56 B4 30 CD 21 C7 06 00 00 0D 0A C7 06 00 00 07 24 BA 00 00 B4 09 EB 00 B9 53 01 56 5D BE 00 00 56 5F B8 15 35 CD 21 06 53 BA 00 00 0E 07 B4 25 CD 21 EB 1B 05 }
    condition:
        $a at pe.entry_point
}

rule Upack_v0399_Dwing {
    strings:
        $a = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 }
        $b = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Matrix_Dongle_TDi_GmbH {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
        $b = { E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Trilobytes_RNR_graphics_library {
    strings:
        $a = { 84 10 ?? ?? ?? ?? ?? ?? ?? 10 }
    condition:
        $a at pe.entry_point
}

rule ILUCRYPT_v4015_exe {
    strings:
        $a = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_nSPack_13_emadicius {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 }
    condition:
        $a at pe.entry_point
}

rule BAFF_BMPs_graphics_library_Hint_FILE_START {
    strings:
        $a = { 42 41 46 46 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v0399_Dwing_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V125_Obsidium_Software {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1304_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Inset_Systems_IGF_graphics_file {
    strings:
        $a = { 01 80 04 00 01 00 58 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_022_023_beta_Dwing_ {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_30_by_North_Star_Liu_Xing_Ping_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v50_Unit_Hint_FILE_START {
    strings:
        $a = { 54 50 55 35 00 }
    condition:
        $a at pe.entry_point
}

rule DzA_Patcher_13_Loader {
    strings:
        $a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
    condition:
        $a at pe.entry_point
}

rule CopyControl_v303_additional {
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9 }
    condition:
        $a at pe.entry_point
}

rule Datafile_from_Norton_Utilities {
    strings:
        $a = { 50 4E 43 49 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v102_v104_BoB_BobSoft {
    strings:
        $a = { 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point
}

rule aPack_098_f_m_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 41 73 12 FF D5 BB 10 00 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 00 8A }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b1_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63 }
    condition:
        $a at pe.entry_point
}

rule COM2EXE_Hint_FILE_START_p14 {
    strings:
        $a = { F0 FF FE FF }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_12003518_WFS_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v123b3_v1241_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 }
    condition:
        $a at pe.entry_point
}

rule Unknown_by_SMT {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }
    condition:
        $a at pe.entry_point
}

rule nPack_v11_150_200_Beta_NEOx {
    strings:
        $a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 }
        $b = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_098_tE_additional {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2223_protected_IAT {
    strings:
        $a = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v14_CGSoftLabs_ {
    strings:
        $a = { 65 58 50 72 2D 76 2E 31 2E 34 2E }
    condition:
        $a at pe.entry_point
}

rule CryEXE_40 {
    strings:
        $a = { E9 A1 FF E8 5C FF 55 E9 08 00 A5 12 BB 06 00 E8 95 FF E9 62 FF B9 FE 0C BE 0B 0F 2E 8A 14 89 F3 80 C2 46 80 F2 73 81 F3 E4 35 80 EA 22 30 DA 30 FA 2E 88 14 4E 49 74 02 EB E1 E5 46 C2 A3 2B 4B F8 59 54 DC 59 09 F4 A5 01 52 F5 56 B2 D3 7E 1B }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_DLL_LZBRS_additional {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v250b3 {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
    condition:
        $a at pe.entry_point
}

rule Morphine_27_Holy_Father_Ratter29A_h {
    strings:
        $a = { ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Excalibur_103_forgot {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PEtite_2x_level_0_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v11b_additional {
    strings:
        $a = { EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V0X_V12X_vcasm {
    strings:
        $a = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_EVC161_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 06 FA 33 DB 8E C3 26 ?? ?? ?? ?? 8F ?? ?? ?? 26 ?? ?? ?? ?? 8F ?? ?? ?? B8 21 25 BA ?? ?? CD 21 FB 07 BA ?? ?? CD 27 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt32_v102_additional {
    strings:
        $a = { E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v025_additional {
    strings:
        $a = { 60 E8 2B 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v50 {
    strings:
        $a = { 68 }
        $b = { FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Anti007_NsPacK_Private_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule TopSpeed_v301_1989 {
    strings:
        $a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ExeSmasher_Anorganix {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_Microsoft_Visual_Cpp_emadicius {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_2xx_Mole_Studio {
    strings:
        $a = { 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 8C 36 00 00 E9 A0 36 00 00 E9 9B 36 00 00 E8 4A FF FF FF 79 ?? ?? ?? ?? ?? ?? ?? 4E }
    condition:
        $a at pe.entry_point
}

rule FSG_13_additional {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }
    condition:
        $a at pe.entry_point
}

rule themida_1005_httpwwworeanscom_additional {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }
    condition:
        $a at pe.entry_point
}

rule ABKprot_v100_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? 9C 8C C0 06 5B 59 51 53 BA ?? ?? 87 F2 56 CF 0E 1F 0E 07 }
    condition:
        $a at pe.entry_point
}

rule CICompress_v10_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Microsoft_Visual_Cpp_60_additional {
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }
    condition:
        $a at pe.entry_point
}

rule PerlApp_602_ActiveState_additional {
    strings:
        $a = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_27b_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
    condition:
        $a at pe.entry_point
}

rule UPX_wwwupxsourceforgenet_additional {
    strings:
        $a = { 60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_DEF_10_Anorganix {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_MFC_additional {
    strings:
        $a = { C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MS_Visual_Cpp_v8_DLL_h_small_sig2_additional {
    strings:
        $a = { 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2xx_max_compressed_resources_wwwstrongbitcom_SignByhaggar_additional {
    strings:
        $a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 }
    condition:
        $a at pe.entry_point
}

rule Upack_v038_beta_Dwing_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
    condition:
        $a at pe.entry_point
}

rule SVKP_v143_Pavol_Cerven_h_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v30_additional {
    strings:
        $a = { 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68 }
    condition:
        $a at pe.entry_point
}

rule Elicense_System_V4000_ViaTech_Inc_additional {
    strings:
        $a = { 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ADEX_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 50 49 43 54 00 08 ?? 02 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PESHiELD_025 {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PiMP_Stub_SFX {
    strings:
        $a = { 81 EC ?? ?? ?? ?? 53 55 56 }
    condition:
        $a at pe.entry_point
}

rule Splasher_v10_v30 {
    strings:
        $a = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Anticrack_Software_Protector_v109_ACProtect_additional {
    strings:
        $a = { 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD }
    condition:
        $a at pe.entry_point
}

rule PECompact_v092_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v275a_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v113_Stone {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 ?? 3B 40 2B 95 2D ?? 3C 40 83 EA ?? 0B 89 95 36 3C 40 01 ?? 95 24 3C 40 01 ?? 95 28 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_vxxxx_Obsidium_Software {
    strings:
        $a = { E8 47 19 }
    condition:
        $a at pe.entry_point
}

rule DCrypt_Private_09b_drmist {
    strings:
        $a = { B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }
    condition:
        $a at pe.entry_point
}

rule UPX_051_PE {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 D8 01 00 00 83 CD FF 31 DB 90 90 90 90 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90 90 90 B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Dongle_V54200_Rainbow_Technologies_SignByfly_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 }
    condition:
        $a at pe.entry_point
}

rule unknown_by_Mr_Wicked {
    strings:
        $a = { BE 03 01 8B FE 8B CE 33 C0 8E D8 C7 06 0E 00 00 00 C6 06 04 00 0D 26 AC BA 00 00 52 FE 0E 04 00 74 0B E8 F7 FF D0 C8 FE C8 32 06 0E 00 C3 AA FF 0E 0E 00 75 DC 0E 1F BE 00 00 BF 00 01 2B CF 57 F3 A4 C3 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_07x_08_PolyTech_additional {
    strings:
        $a = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_LZMA_430_ap0xnbsp_nbsp_Sign_by_fly_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 }
    condition:
        $a at pe.entry_point
}

rule Upack_V03X_Dwing_additional {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E }
    condition:
        $a at pe.entry_point
}

rule EPExE_Pack_V14_lite_b2_6aHguT_g_l_u_k {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 }
    condition:
        $a at pe.entry_point
}

rule LE_Exe_Executable_Image {
    strings:
        $a = { 4C 45 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_v206_additional {
    strings:
        $a = { 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_12B_p0ke_additional {
    strings:
        $a = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8 }
    condition:
        $a at pe.entry_point
}

rule Upack_037_beta_Dwing {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
        $b = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v062_DLL_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_V12_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_compressed_resources {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5 }
    condition:
        $a at pe.entry_point
}

rule EPW_v12 {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule SCRAMBLE_02_beta3 {
    strings:
        $a = { 60 9C FC 00 00 01 00 00 01 BA 13 00 01 55 01 2A D2 FF E7 B9 00 00 57 51 F3 A4 59 5E 03 F1 05 00 B4 00 00 31 04 E2 FA 9D 61 68 00 01 C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_v50_for_Windows_Hint_WIN_EP {
    strings:
        $a = { EB ?? 53 51 06 33 C0 50 9A ?? ?? ?? ?? 58 07 59 5B 9A }
    condition:
        $a at pe.entry_point
}

rule Yodas_Protector_v1032_Beta2_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v100_BoB_BobSoft_additional {
    strings:
        $a = { 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_018_Dmitry_Andreev {
    strings:
        $a = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8? }
    condition:
        $a at pe.entry_point
}

rule MPEG_movie_file_Hint_FILE_START {
    strings:
        $a = { 00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB }
    condition:
        $a at pe.entry_point
}

rule kkryptor_3_rsc {
    strings:
        $a = { EB 66 87 DB 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? B8 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_18_SetiSoft_h {
    strings:
        $a = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }
    condition:
        $a at pe.entry_point
}

rule IProtect_10_Fxlibdll_mode_by_FuXdas {
    strings:
        $a = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF }
        $b = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DJoin_v07_public_xor_encryption_drmist {
    strings:
        $a = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Packman_Executable_Image_Packer_0001_bubba {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Morphnah_Beta_Kas {
    strings:
        $a = { 2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule CRYPT_Version_17_c_Dismember_COM {
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_V12X_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule XE_Executable_Image_using_DOSExtender {
    strings:
        $a = { 58 45 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v184_additional {
    strings:
        $a = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2021_wwwstrongbitcom_SignByhaggar {
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
        $b = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SVK_Protector_v143_wwwanticrackingsk_additional {
    strings:
        $a = { 78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05 6? }
    condition:
        $a at pe.entry_point
}

rule dUP2_diablo2oo2_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V041_cyberbobnbsp_nbsp_SignByfly_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 02 D2 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 ?? 68 3C 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 59 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 ?? E8 1A 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPXFreak_v01_Borland_Delphi_HMX0101_additional {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1992_1994 {
    strings:
        $a = { 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule Upack_01x_Dwing {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Protected_Mode_compiler_2_additional {
    strings:
        $a = { FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_029_GlOFF {
    strings:
        $a = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Copy_Protector_v20_Hint_DOS_EP {
    strings:
        $a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PEX_099_Anorganix {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_for_Windows_2_additional {
    strings:
        $a = { 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89 }
    condition:
        $a at pe.entry_point
}

rule UPX_200_30X_Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser_additional {
    strings:
        $a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF }
    condition:
        $a at pe.entry_point
}

rule Upack_v035_alpha_Sign_by_hot_UNP_additional {
    strings:
        $a = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }
    condition:
        $a at pe.entry_point
}

rule CALS_Raster_graphics_format {
    strings:
        $a = { 73 72 63 64 6F 63 69 64 3A 20 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_regular_additional {
    strings:
        $a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v300_v301_Relocations_pack_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }
    condition:
        $a at pe.entry_point
}

rule dePACK_deNULL_additional {
    strings:
        $a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1250_Obsidium_Software_additional {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_15_coban2k_additional {
    strings:
        $a = { BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v20_Stone {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Exact_Audio_Copy_UnknownCompiler {
    strings:
        $a = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_LINK_v360_v364_v365_or_50121_Hint_DOS_EP {
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule ass_crypter_by_santasdad_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B }
    condition:
        $a at pe.entry_point
}

rule Prepared_by_SLR_OPTLINK {
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }
    condition:
        $a at pe.entry_point
}

rule Encrypted_by_RSCC286_v101 {
    strings:
        $a = { FE 52 53 43 43 2F 31 2E 30 31 FE }
    condition:
        $a at pe.entry_point
}

rule FCRYPT_v100_1990_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 50 53 51 BE ?? ?? BF ?? ?? 8B EF B9 ?? ?? FC AC 32 C1 AA E2 ?? 59 5B 58 FF }
    condition:
        $a at pe.entry_point
}

rule MultiEdits_compiled_macros {
    strings:
        $a = { 1E AA }
    condition:
        $a at pe.entry_point
}

rule PKTiny_162 {
    strings:
        $a = { 1E 0E 1F B8 F0 FF 8E C0 26 8A 1E 0E 00 80 FB FD 72 0E B4 09 BA 58 01 CD 21 1F B8 00 4C CD 21 E9 FA 55 89 E5 8D 06 46 00 05 00 01 50 83 C4 02 31 DB C7 07 E9 DD C7 47 02 01 F4 C7 87 57 02 B9 08 8B 5E FE FF E3 EA FB 31 DB B8 0D 0E CD 10 B4 03 }
    condition:
        $a at pe.entry_point
}

rule XorCom_v10_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? AC 34 ?? AA E2 ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_Noon1163 {
    strings:
        $a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }
    condition:
        $a at pe.entry_point
}

rule Upack_022_023_beta_Dwing {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
        $b = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pelock_10x {
    strings:
        $a = { 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }
    condition:
        $a at pe.entry_point
}

rule beria_v007_public_WIP_symbiont {
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_ASPack_211d_emadicius_h {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig2 {
    strings:
        $a = { C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig1 {
    strings:
        $a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Rpoly_crypt_by_Vaska_200307_1841 {
    strings:
        $a = { 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_Hafen809 {
    strings:
        $a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }
    condition:
        $a at pe.entry_point
}

rule PROTECT_EXECOM_v60_Hint_DOS_EP {
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule ASPack_105b_by_Hint_WIN_EP {
    strings:
        $a = { 75 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PureBasic_4x_Neil_Hodgson_additional {
    strings:
        $a = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
    condition:
        $a at pe.entry_point
}

rule tElock_v041x_additional {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12x_additional {
    strings:
        $a = { 00 00 68 01 ?? ?? ?? C3 AA }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_aPLib_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }
    condition:
        $a at pe.entry_point
}

rule Werus_Crypter_10_by_Kas_additional {
    strings:
        $a = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v50_additional {
    strings:
        $a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule UPX_v30_DLL_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_2628_Jtit {
    strings:
        $a = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
    condition:
        $a at pe.entry_point
}

rule Themida_10xx_18xx_no_compression_Oreans_Technologies_h {
    strings:
        $a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
        $b = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule aPack_061_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 8B 01 BF 00 01 50 57 FC B6 01 BD 6C 01 FF D5 73 4C FF D5 73 18 FF D5 73 2A BB 83 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 43 B1 01 EB 26 E8 3B 00 49 49 AC 8A E1 93 E8 32 00 83 FB 40 73 15 83 C1 04 EB 10 AC }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PENightMare_2_Beta {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_3x_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55 }
    condition:
        $a at pe.entry_point
}

rule PocketPC_MIB {
    strings:
        $a = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 }
        $b = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MinGW_32x_WinMain_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D }
    condition:
        $a at pe.entry_point
}

rule Netopsystems_FEAD_Optimizer_2 {
    strings:
        $a = { 50 E8 00 00 00 00 5B 81 EB A2 01 00 00 B9 ?? ?? 01 00 2B D9 8B F3 81 EB 00 ?? ?? 00 8B FB 81 EB 00 10 00 00 57 51 56 E8 89 FE FF FF 83 C4 0C 8B AB C0 00 00 00 8D 2C 2B 4D 8A 4D 00 80 F9 CC 74 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16c_by_Vaska_UsAr_sign_21032007_2225_additional {
    strings:
        $a = { 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3 }
    condition:
        $a at pe.entry_point
}

rule PEiD_1658_3DMark_Database_file_Hint_FILE_START {
    strings:
        $a = { 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule AHpack_01_FEUERRADER_h {
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
        $b = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TrueType_Font_file_Hint_FILE_START {
    strings:
        $a = { 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100_v103_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_LZMA_430_ap0 {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC_Anorganix {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2117_StrongbitSoftComplete_Development_h_additional {
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V12_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 77 1E 00 00 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_12DLLDemo_SIS_Team {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule StarForce_V1X_V3X_StarForce_Copy_Protection_System {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PackMan_v0001 {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_v211_DEMO {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
        $b = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule COMPACK_51 {
    strings:
        $a = { BD 00 00 50 06 8C CB 03 DD 8C D2 4B 8E DB BE 4A 00 BF 00 07 8E C2 B9 08 00 F3 A5 4A 4D 75 EC 8B F7 8E DA 0E 07 06 16 BF 63 06 57 33 FF F9 CB 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 31 20 57 20 43 6F 6C 6C 69 73 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v022_v023Beta {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule FFSE_04R {
    strings:
        $a = { 60 E9 B2 00 EB 01 C7 E8 6C 00 FC 0F 21 D1 FA 68 00 00 07 06 1F FF E1 52 91 A7 B5 D8 6A 50 A8 67 76 6E 30 86 D8 87 91 A7 40 88 92 71 25 EB 03 EB FC 83 66 C1 CC 10 EB 01 F7 E8 3A 00 B9 EB 03 EB FC C6 B9 00 08 33 F6 BF EB 03 EB FC C0 8B FE 8B }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1258_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Rec_038 {
    strings:
        $a = { 06 1E B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 66 23 8B 36 02 00 2B F7 81 FE 00 10 EB 0A B4 4A CD 21 BF 77 13 B9 81 17 00 00 EB 04 00 EB FB 9A EB }
    condition:
        $a at pe.entry_point
}

rule FASM_v13x_additional {
    strings:
        $a = { 6A ?? FF 15 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule Hardlock_dongle_Alladin_additional {
    strings:
        $a = { 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }
    condition:
        $a at pe.entry_point
}

rule FIDO_mail_packet_Hint_FILE_START {
    strings:
        $a = { 03 00 03 00 CD 07 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v12_DLL {
    strings:
        $a = { 00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Extended_Datafile_Version {
    strings:
        $a = { 23 03 45 58 54 44 ?? ?? 3A 03 }
    condition:
        $a at pe.entry_point
}

rule CSV_v01_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FC BE ?? ?? 8B FE B9 ?? ?? 51 56 57 B4 ?? 04 ?? AC ?? ?? 2A C4 32 C4 AA E2 ?? 5F 5E 59 }
    condition:
        $a at pe.entry_point
}

rule CipherWall_Self_ExtratorDecryptor_GUI_v15_additional {
    strings:
        $a = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
    condition:
        $a at pe.entry_point
}

rule Cracked_by_Autohack_2 {
    strings:
        $a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_VOB_ProtectCD_5_Anorganix {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie2100_additional {
    strings:
        $a = { E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC }
    condition:
        $a at pe.entry_point
}

rule VProtector_11A_12_vcasm_additional {
    strings:
        $a = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V10beta_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule aPack_090_COM {
    strings:
        $a = { 8C C8 80 C4 10 8E C0 FC B9 00 00 BE 00 01 8B FE 57 F3 A5 5F BE 00 01 06 68 20 01 1E 07 8E D8 CB 06 57 B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 73 14 FF D5 73 00 33 DB B1 04 FF D5 13 DB E2 FA 75 00 93 AA EB E4 E8 00 00 49 E2 07 5B 53 E8 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEtite_21_emadicius {
    strings:
        $a = { B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Automatic_Protection_641_Safenet {
    strings:
        $a = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule GZIP_Archive {
    strings:
        $a = { 1F 8B 08 08 ?? ?? ?? 35 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1988_Hint_DOS_EP {
    strings:
        $a = { 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig2h {
    strings:
        $a = { C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_12_Seek_and_Destroy_Patch {
    strings:
        $a = { E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 }
    condition:
        $a at pe.entry_point
}

rule MS_Visual_Cpp_v8_h_good_sig_but_is_it_MSVC {
    strings:
        $a = { E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC }
        $b = { E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule BeRoEXEPacker_v100_DLL_LZMA_BeRo_Farbrausch {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
    condition:
        $a at pe.entry_point
}

rule ASPack_1083 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E 44 00 0F 85 17 05 00 00 8D 85 D1 50 44 00 50 FF 95 94 51 44 00 89 85 CD 50 44 00 8B F8 8D 9D DE 50 44 00 53 50 FF 95 90 51 44 00 }
    condition:
        $a at pe.entry_point
}

rule PassLock_2000_10_Eng_Moonlight_Software {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_12Demo_SIS_Team_additional {
    strings:
        $a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_101_Ashkbiz_Danehkar_h {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule COMPACK_v51_Hint_DOS_EP {
    strings:
        $a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Trap_v121_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5B 83 ?? ?? ?? 8B D3 E8 ?? ?? ?? 5B 2E ?? ?? ?? 74 ?? ?? ?? 8B DA B9 ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule OS2_Icon_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 43 49 4E 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEQuake_v006_by_fORGAT_additional {
    strings:
        $a = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB }
    condition:
        $a at pe.entry_point
}

rule EPW_v12_additional {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule PLINK86_1984_1985 {
    strings:
        $a = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v201 {
    strings:
        $a = { 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule SEA_AXE {
    strings:
        $a = { FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3 }
    condition:
        $a at pe.entry_point
}

rule App_Encryptor_Silent_Team {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule Packanoid_v1_Arkanoid_ {
    strings:
        $a = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic {
    strings:
        $a = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v50v60_MFC_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 }
    condition:
        $a at pe.entry_point
}

rule A_program_by_Jupiter_additional {
    strings:
        $a = { 2B C0 74 05 68 ?? ?? ?? ?? 50 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_211_212_Fisun_Alexander_additional {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
    condition:
        $a at pe.entry_point
}

rule Splash_Bitmap_v100_With_Unpack_Code_BoB_Bobsoft {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40 }
    condition:
        $a at pe.entry_point
}

rule LSI_C_86_Run_Time_Libray_additional {
    strings:
        $a = { B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule EXEHigh_101 {
    strings:
        $a = { 8C CA 8B 2E 01 00 8E DA 8C 06 90 06 8C DA 2B EA 8B 3E 94 06 81 FF 00 01 73 07 BF 00 01 89 3E 94 06 81 C7 DE 16 03 3E 92 06 B1 04 D3 EF 47 D3 E7 FA 8E D2 8B E7 FB E8 00 00 56 57 55 8B EC B4 4A 8E 06 90 06 BB FF FF CD 21 B4 4A 8E 06 90 06 CD }
    condition:
        $a at pe.entry_point
}

rule NextSun_Audio_file {
    strings:
        $a = { 2E 73 6E 64 }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_v10_Alex_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V121build0909_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule PCShrink_071_beta_additional {
    strings:
        $a = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Caz1204_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }
    condition:
        $a at pe.entry_point
}

rule RAZOR_1911_encruptor_additional {
    strings:
        $a = { E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule DJoin_v07_public_RC4_encryption_drmist_additional {
    strings:
        $a = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_vxxxx {
    strings:
        $a = { E9 5D 01 ?? ?? CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 }
        $b = { E8 47 19 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LameCrypt_LaZaRus {
    strings:
        $a = { 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v200_alpha_38 {
    strings:
        $a = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }
        $b = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule JDProtectV2009Xdemo_20090503 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 }
    condition:
        $a at pe.entry_point
}

rule Amiga_AIFF_8SFX_Audio_file {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52 }
    condition:
        $a at pe.entry_point
}

rule Minke_V101_Codius {
    strings:
        $a = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MS_Visual_Cpp_Borland_Cpp_Watcom_Cpp {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }
    condition:
        $a at pe.entry_point
}

rule SoftDefender_1x_Randy_Li_additional {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_dulekxt_Microsoft_Visual_Cpp_70 {
    strings:
        $a = { EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_or_Borland_Cpp {
    strings:
        $a = { BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule Password_Protector_c_MiniSoft_1992 {
    strings:
        $a = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
    condition:
        $a at pe.entry_point
}

rule VITec_graphics_file_format {
    strings:
        $a = { 00 5B 07 20 00 00 00 2C }
    condition:
        $a at pe.entry_point
}

rule Crunch_v40 {
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
        $b = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_Portions_Copyright_c_198397_Borland_h {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Spanz {
    strings:
        $a = { E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84 }
    condition:
        $a at pe.entry_point
}

rule DxPack_10_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45 }
    condition:
        $a at pe.entry_point
}

rule Datafile_from_Norton_Utilities_Hint_FILE_START {
    strings:
        $a = { 50 4E 43 49 }
    condition:
        $a at pe.entry_point
}

rule IcebergLock_Protector_V310141_Iceberg_Software_Lab_20081209 {
    strings:
        $a = { E8 D7 FF FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 8B EC 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB F8 5D C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B EC 83 C4 ?? B8 A8 ?? ?? ?? E8 94 EC FD FF E8 43 DE FF FF B8 58 ?? ?? ?? E8 71 FE FF FF E8 F4 CD FD FF }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_SVKP_13x_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_Kenonic_Controls {
    strings:
        $a = { 8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 }
    condition:
        $a at pe.entry_point
}

rule DSHIELD_Hint_DOS_EP {
    strings:
        $a = { 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule TMT_Pascals_Unit_file_Hint_FILE_START {
    strings:
        $a = { 50 00 00 00 53 50 46 50 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10E_vcasm_additional {
    strings:
        $a = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_v06_SLV_additional {
    strings:
        $a = { E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 }
    condition:
        $a at pe.entry_point
}

rule Windows_or_OS2_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 42 4D }
    condition:
        $a at pe.entry_point
}

rule RLPack_V115_V116_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14 }
    condition:
        $a at pe.entry_point
}

rule AINEXE_v21 {
    strings:
        $a = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }
    condition:
        $a at pe.entry_point
}

rule ReversingLabsProtector_074_beta_Ap0x {
    strings:
        $a = { 68 00 00 41 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Admin_10_EncryptPE_12003518_Sold_Flying_Cat {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22004810_V22005314_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Scrunch_102 {
    strings:
        $a = { EB 13 73 43 65 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB FF FF B4 4A CD 21 81 EB F0 1F 73 18 BA 2B 01 B9 0F 00 E9 79 01 4F 75 74 20 6F 66 20 6D 65 6D 6F 72 79 2E 07 8C D8 A3 D2 02 05 00 10 A3 58 01 8E C0 E8 B4 01 B9 00 FF FC BE 00 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v310 {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01 }
    condition:
        $a at pe.entry_point
}

rule EPW_v130_Hint_DOS_EP {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }
    condition:
        $a at pe.entry_point
}

rule ATT_Group_4_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 01 00 ?? 00 3A 03 }
    condition:
        $a at pe.entry_point
}

rule Sharp_GPB_Graphics_format_additional {
    strings:
        $a = { 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v2xx_CopyMem_II_additional {
    strings:
        $a = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_32Lite_003_Anorganix {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20_additional {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
    condition:
        $a at pe.entry_point
}

rule Ultra_Compressors_Archive_Hint_FILE_START {
    strings:
        $a = { 55 43 32 1A }
    condition:
        $a at pe.entry_point
}

rule LGLZ_v104_com_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_1992_09_additional {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Goldeds_Output_text_file {
    strings:
        $a = { C4 20 5B }
    condition:
        $a at pe.entry_point
}

rule Wavelet_compressed_bitmap {
    strings:
        $a = { 57 49 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_2x_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }
    condition:
        $a at pe.entry_point
}

rule Private_Exe_Protector_1x_setisoft {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule SmartE_Microsoft {
    strings:
        $a = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }
    condition:
        $a at pe.entry_point
}

rule Program_Protector_XP_v10 {
    strings:
        $a = { E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50 }
    condition:
        $a at pe.entry_point
}

rule Img_Software_Set_graphics_file_Hint_FILE_START {
    strings:
        $a = { 53 43 4D 49 20 20 20 31 41 54 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v134_v140b1 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260b1 {
    strings:
        $a = { 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260b2 {
    strings:
        $a = { 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_nSPack_13_emadicius_h {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_50_60_additional {
    strings:
        $a = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }
    condition:
        $a at pe.entry_point
}

rule InstallShield_3x_Custom {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1 }
    condition:
        $a at pe.entry_point
}

rule UPolyx_05_by_delikon {
    strings:
        $a = { 51 ?? C9 B9 ?? ?? ?? ?? 83 ?? 01 E2 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V22X_V2308_Jitit_Sign_by_fly_additional {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule GameGuard_v20065xx_exe_additional {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_12_Beta_Demo_SIS_Team_additional {
    strings:
        $a = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Prolog_1986 {
    strings:
        $a = { FA B8 00 00 8E D8 B8 00 00 A3 00 00 8E D0 BC 00 01 FB 8C 06 00 00 26 8E 06 2C 00 8C 06 00 00 B8 00 00 A3 00 00 9A 00 00 00 00 89 1E 00 00 A3 00 00 9A 00 00 00 00 00 00 9A 00 00 00 00 83 C4 04 00 00 00 00 00 00 00 00 00 00 00 00 9A 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule pscrambler_12_by_p0ke {
    strings:
        $a = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65 }
        $b = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Solidshield_Protector_V1X_DLL_Solidshield_Technologies_SignByfly_additional {
    strings:
        $a = { 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_410_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 }
    condition:
        $a at pe.entry_point
}

rule Cracked_by_AutoHack_1 {
    strings:
        $a = { FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC }
    condition:
        $a at pe.entry_point
}

rule SecurePE_V1X_wwwdeepzoneorg {
    strings:
        $a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Vprotect_V17X_187_CoooLie {
    strings:
        $a = { 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 C7 47 50 00 00 00 00 8B 7F 1C C3 }
    condition:
        $a at pe.entry_point
}

rule VPacker_ttui_additional {
    strings:
        $a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_V2X_DLL_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD }
    condition:
        $a at pe.entry_point
}

rule PrincessSandy_v10_eMiNENCE_Process_Patcher_Patch {
    strings:
        $a = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }
        $b = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Intel_DCX_Graphics_format_Hint_FILE_START {
    strings:
        $a = { B1 68 DE 3A 04 10 00 }
    condition:
        $a at pe.entry_point
}

rule FakeNinja_V28_Private_Spirit {
    strings:
        $a = { 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 17 E5 FF 60 }
    condition:
        $a at pe.entry_point
}

rule Video_CD_file {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40 }
    condition:
        $a at pe.entry_point
}

rule ProPack_214_m1_COM {
    strings:
        $a = { 83 EC 10 8B EC BE FA 02 FC E8 41 00 05 00 01 8B C8 E8 39 00 8B D0 03 C6 05 06 00 8B F8 E8 2D 00 AD 88 66 0A 32 E4 89 76 00 8B F7 03 C1 8B F8 3B FE 76 0E }
    condition:
        $a at pe.entry_point
}

rule ASPack_v108_additional {
    strings:
        $a = { 90 75 01 FF E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_50_DLL {
    strings:
        $a = { ?? ?? 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule ASPack_102a_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 3E D9 43 00 B8 38 ?? ?? 00 03 C5 2B 85 0B DE 43 00 89 85 17 DE 43 00 80 BD 01 DE 43 00 00 75 15 FE 85 01 DE 43 00 E8 1D 00 00 00 E8 79 02 00 00 E8 12 03 00 00 8B 85 03 DE 43 00 03 85 17 DE 43 00 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v132 {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule Upack_v039_final_Dwing {
    strings:
        $a = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
        $b = { FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WebCops_EXE_LINK_Data_Security {
    strings:
        $a = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_Debug_Version_additional {
    strings:
        $a = { 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule TElock_v098b1_Modifly_by_forgothexer {
    strings:
        $a = { 9C 6A 03 73 0B EB 02 75 75 }
    condition:
        $a at pe.entry_point
}

rule VMware_ThinApp_VV339600_VMware_20090124 {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB C1 20 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2E 00 00 68 28 01 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V3X_V6X_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_LZMA_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v10061 {
    strings:
        $a = { E8 47 }
        $b = { E8 AF 1C 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SimplePack_111_Method_1_bagieTMX_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
    condition:
        $a at pe.entry_point
}

rule PESpin_v07_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ACProtectUltraProtect_V10X_V20X_RiSco {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_096 {
    strings:
        $a = { BE 0D 01 BF 00 70 8B CF FC 57 F3 A4 C3 BF 00 01 57 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2312_Jitit_Sign_by_fly {
    strings:
        $a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule Maked_by_Grabber_v384_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FC 8C DB 8C C8 8E D8 8E C0 89 1E ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v70_additional {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_CracKed_By_shoooo_fly_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 C5 FA 81 }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_2_PK7Tjrvx_Hint_DOS_EP {
    strings:
        $a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }
    condition:
        $a at pe.entry_point
}

rule vprotector_12_vcasm_h {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }
    condition:
        $a at pe.entry_point
}

rule Naked_Packer_V10_BigBoote_additional {
    strings:
        $a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v20_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_50 {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 00 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point
}

rule MacPaint_Graphics_format {
    strings:
        $a = { 00 00 00 02 FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v2xx_CopyMem_II {
    strings:
        $a = { 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }
    condition:
        $a at pe.entry_point
}

rule Vx_Hymn1865 {
    strings:
        $a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_V56X_DLL_Kenonic_Controls_Ltd {
    strings:
        $a = { 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Packanoid_Arkanoid_additional {
    strings:
        $a = { BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 }
    condition:
        $a at pe.entry_point
}

rule Inset_Systems_IGF_graphics_file_Hint_FILE_START {
    strings:
        $a = { 01 80 04 00 01 00 58 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_14_by_North_Star_Liu_Xing_Ping_ {
    strings:
        $a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v12_CGSoftLabs {
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Anti007_V25_V26_LiuXingPing_SignByfly {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_2005_DLL_Microsoft {
    strings:
        $a = { 8B FF 55 8B EC 83 7D 0C 01 }
    condition:
        $a at pe.entry_point
}

rule PECompact_09781 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 00 87 DD 8B 85 CE 87 40 00 01 85 3D 87 40 00 66 C7 85 3A 87 40 00 90 90 BB A6 09 00 00 03 9D D2 87 40 00 03 9D CE 87 40 00 53 53 53 58 2D A4 }
    condition:
        $a at pe.entry_point
}

rule PECompact_09784 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 00 87 DD 8B 85 56 85 40 00 01 85 C5 84 40 00 66 C7 85 C2 84 40 00 90 90 BB A6 09 00 00 03 9D 5A 85 40 00 03 9D 56 85 40 00 53 53 53 58 2D 2C }
    condition:
        $a at pe.entry_point
}

rule Micrografix_Draw_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 01 FF 02 04 03 02 00 02 }
    condition:
        $a at pe.entry_point
}

rule ASPR_Stripper_v2x_unpacked {
    strings:
        $a = { BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC }
    condition:
        $a at pe.entry_point
}

rule tElock_099_Special_Build_heXer_forgot {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule AIN_Archive_Hint_FILE_START_additional {
    strings:
        $a = { 21 12 00 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_V212_Fisun_AV {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CD 0D }
    condition:
        $a at pe.entry_point
}

rule Armadillo_4000053_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }
    condition:
        $a at pe.entry_point
}

rule Vx_Doom666_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }
    condition:
        $a at pe.entry_point
}

rule FSG_v13 {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE }
        $c = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v12 {
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v11 {
    strings:
        $a = { BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 }
    condition:
        $a at pe.entry_point
}

rule FSG_v10 {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point
}

rule MinGW_32x_WinMain {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_yodas_cryptor_12_emadicius {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule GP_Install_v50332 {
    strings:
        $a = { 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v147_v150 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_additional {
    strings:
        $a = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule ZealPack_10_Zeal_additional {
    strings:
        $a = { C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD }
    condition:
        $a at pe.entry_point
}

rule VProtect2060702Cloud_CoooLie {
    strings:
        $a = { 66 8B C9 8D 89 F9 FF FF FF 8A D2 8D 89 07 00 00 00 66 53 8B C9 66 5B 9C 9D 8B 67 28 8D AD FF FF FF FF 66 F7 D1 9C 9D 66 F7 D1 8D AD 01 00 00 00 61 52 5A 9D 66 51 66 87 CD 66 87 CD 66 59 C3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V01_cyberbobnbsp_nbsp_SignByfly_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? B9 A5 08 00 00 8D ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Netsend_100 {
    strings:
        $a = { 58 50 50 50 59 5A 49 51 44 5B 4C 2D 66 36 2D 67 34 31 47 44 53 58 75 27 40 2C 7E 50 5E 50 5F 4F 2C 21 28 47 55 28 47 5A 28 47 6E 75 35 2D 4E 45 54 53 45 4E 44 5F 56 31 2E 30 30 5F 4A 52 54 3D 0D 0A 43 46 46 46 52 58 2C 60 2C 60 32 24 46 3D }
    condition:
        $a at pe.entry_point
}

rule EXE_yy66 {
    strings:
        $a = { 68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_HuiGeZi_additional {
    strings:
        $a = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }
    condition:
        $a at pe.entry_point
}

rule KGCrypt_vxx_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule PackWin_10_202 {
    strings:
        $a = { 8C C0 FA 8E D0 BC FE 00 FB 06 0E 1F 2E 8B 0E 0C 00 8B F1 4E 8B FE 8C DB 2E 03 1E 0A 00 8E C3 FD F3 A4 53 B8 38 00 50 CB 2E 8B 2E 08 00 8C DA 8B C5 3D 00 10 76 03 B8 00 10 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_11 {
    strings:
        $a = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v106b_additional {
    strings:
        $a = { 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v200b2_200b3 {
    strings:
        $a = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v50_Unit {
    strings:
        $a = { 54 50 55 35 00 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10_Build_20041213_test_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule SecuROM_V7X_Sony_DADC_SignByfly_20080114 {
    strings:
        $a = { 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 6C 24 1C C1 E2 00 8B 6C 24 0C 83 C4 18 9D ?? 74 12 81 04 24 ?? ?? ?? ?? ?? 81 04 24 C3 D1 FF 00 EB FA 6B 81 04 24 ?? ?? ?? ?? 0F AC F8 00 81 04 24 C2 04 00 3E FF 74 24 04 9D EB F5 EE 93 9D }
        $b = { 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MEW_11_SE_v11 {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v12 {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vprotect_V202_V203_CoooLie {
    strings:
        $a = { 66 F7 D7 66 50 66 58 66 F7 D7 9C 9D 8B 67 28 57 66 8B DB 5F 61 8D AD F4 FF FF FF 8D AD 0C 00 00 00 66 57 66 5F 8B FF 9D 9C 8D 80 F0 FF FF FF 8D 80 10 00 00 00 9D 66 F7 D2 66 F7 D2 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win16_1991 {
    strings:
        $a = { 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule TurboBAT_v310_50 {
    strings:
        $a = { BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 }
    condition:
        $a at pe.entry_point
}

rule BopCrypt_v10 {
    strings:
        $a = { 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Password_Protector_10_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }
    condition:
        $a at pe.entry_point
}

rule Setup_Factory_6x_Custom_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
    condition:
        $a at pe.entry_point
}

rule Exe_Guarder_v18_Exeiconcom {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
        $b = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MASM_TASM_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Lattice_C_v30_additional {
    strings:
        $a = { FA B8 ?? ?? 8E D8 B8 ?? ?? 8E }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_VBOX_43_MTE {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }
    condition:
        $a at pe.entry_point
}

rule dUP2_diablo2oo2 {
    strings:
        $a = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68 }
        $b = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Borland_Delphi_60_70_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }
    condition:
        $a at pe.entry_point
}

rule CRYPT_Version_17_c_Dismember_EXE_additional {
    strings:
        $a = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule IBM_PictureMaker_graphics_file {
    strings:
        $a = { 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v13x_Eng_Pavol_Cerven_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Stelth_PE_101_Anorganix_additional {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule vprotector_12_vcasm {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 }
    condition:
        $a at pe.entry_point
}

rule Protect_Shareware_V11_eCompserv_CMS_additional {
    strings:
        $a = { 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Petite_13_additional {
    strings:
        $a = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_1401_SoftComplete_Development {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }
    condition:
        $a at pe.entry_point
}

rule Vx_Compiler {
    strings:
        $a = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_UPX_06_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Yodas_Protector_102_Anorganix {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13013_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00 }
    condition:
        $a at pe.entry_point
}

rule XPack_167_Hint_DOS_EP {
    strings:
        $a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v200b2_200b3_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_035_GlOFF {
    strings:
        $a = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Delphi_vxx_Component_additional {
    strings:
        $a = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V36_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122 {
    strings:
        $a = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 }
        $b = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressor_v1501_Options_Light_Full_support_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 }
    condition:
        $a at pe.entry_point
}

rule ESO_Eclipse_Operating_System_v208_p_DOS_Extender_Hint_DOS_EP {
    strings:
        $a = { 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PE_Protector_093_CRYPToCRACk_additional {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 }
    condition:
        $a at pe.entry_point
}

rule COM2EXE {
    strings:
        $a = { F0 FF FE FF }
    condition:
        $a at pe.entry_point
}

rule Alloy_4x_PGWare_LLC {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v_If_you_know_this_version_post_on_PEiD_board_h2_additional {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V2021_wwwstrongbitcom {
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule JExeCompressor_10_by_Arash_Veyskarami_additional {
    strings:
        $a = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Trap_121_EXE {
    strings:
        $a = { E8 00 00 5B 83 C3 2B 90 8B D3 E8 01 00 01 5B 2E 80 3F 00 74 19 90 90 8B DA B9 94 04 EB 01 90 2E C0 07 00 2E 80 37 00 2E 80 2F 00 43 E2 F1 }
    condition:
        $a at pe.entry_point
}

rule Crunch_5_Fusion_4_additional {
    strings:
        $a = { EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PiMP_Install_System_v1x_additional {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_v102 {
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }
    condition:
        $a at pe.entry_point
}

rule LHA_SFX_Archive_v213L_Hint_DOS_EP {
    strings:
        $a = { EB ?? FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 E8 ?? ?? BB ?? ?? E8 ?? ?? 06 1F B4 30 CD 21 8B D8 1E }
    condition:
        $a at pe.entry_point
}

rule TTPpack {
    strings:
        $a = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05 }
    condition:
        $a at pe.entry_point
}

rule GX_Protector_12_GurueXe_additional {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule LGLZ_v104b_additional {
    strings:
        $a = { FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_emadicius {
    strings:
        $a = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
    condition:
        $a at pe.entry_point
}

rule mkfpack_llydd_additional {
    strings:
        $a = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }
    condition:
        $a at pe.entry_point
}

rule Watcom_CCpp_additional {
    strings:
        $a = { E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 }
    condition:
        $a at pe.entry_point
}

rule Ice_100 {
    strings:
        $a = { BE 26 01 8B FE 8B 0E 08 01 8B 16 02 01 B8 77 01 50 FC AD 33 C2 AB 8B D0 E2 F8 00 00 00 00 00 8D 0F 47 8C 77 F4 37 C6 FE 41 FC 0F 4D 0C BD 59 78 53 CD 7C 48 8D 0F 47 8C 7F F4 3F 85 AD 7F 55 83 85 08 FF F1 81 86 01 94 15 7B 2A 45 48 D1 DE EF }
    condition:
        $a at pe.entry_point
}

rule CrypKey_v5_v6_CrypKey_Canada_Inc {
    strings:
        $a = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PC_Guard_4xx_emadicius {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Patch_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule SecurePE_1X_additional {
    strings:
        $a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Trap_119_EXE {
    strings:
        $a = { 8C D0 BB 99 CB 8E D3 33 D2 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E }
    condition:
        $a at pe.entry_point
}

rule Image_Systems_Technology_Graphics_format {
    strings:
        $a = { 03 3A ?? ?? 00 ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v50_additional {
    strings:
        $a = { EB 15 03 ?? ?? ?? 06 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ASM_ {
    strings:
        $a = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Help_File_additional {
    strings:
        $a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }
    condition:
        $a at pe.entry_point
}

rule unknown_by_Woody {
    strings:
        $a = { B8 B9 0F 8E D8 8C 1E 04 00 8C 1E 08 00 8C C8 A3 00 00 E9 54 36 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V2010_p_Hide_from_PE_scanners_Type2 {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CorelDraw_CMX_Graphics_format_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }
    condition:
        $a at pe.entry_point
}

rule Rec_Small_103 {
    strings:
        $a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED EA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 27 04 2E 03 86 2B 04 FA BC 05 00 8E D0 2E 8B A6 29 04 EB 00 EA 01 00 00 00 7E 01 }
    condition:
        $a at pe.entry_point
}

rule Rec_Small_102 {
    strings:
        $a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED BA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA }
    condition:
        $a at pe.entry_point
}

rule Rec_Small_101 {
    strings:
        $a = { 8C D8 1E E8 00 00 5D 83 C0 0F 81 ED BA 03 B9 00 00 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA 00 00 00 00 7E 01 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_v05_ {
    strings:
        $a = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2717_V2719_Jitit_Sign_by_fly {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule VProtector_13X_vcasm_additional {
    strings:
        $a = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule NsPack_31_North_Star_h {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_bartxt_WinRAR_SFX {
    strings:
        $a = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
    condition:
        $a at pe.entry_point
}

rule PEQuake_v006_by_fORGAT {
    strings:
        $a = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
        $b = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DCrypt_Private_09b_drmist_additional {
    strings:
        $a = { B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }
    condition:
        $a at pe.entry_point
}

rule Fish_PE_Shield_112116_HellFish_additional {
    strings:
        $a = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressorPacK_V150X_CGSoftLabs_Sign_by_fly {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }
    condition:
        $a at pe.entry_point
}

rule Borland_Graphics_Interface_Driver {
    strings:
        $a = { 46 42 47 44 }
    condition:
        $a at pe.entry_point
}

rule Vx_Quake518_Hint_DOS_EP {
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v106_additional {
    strings:
        $a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EPW_v12_Hint_DOS_EP {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule TXTMaker_v122_Hint_DOS_EP {
    strings:
        $a = { EB ?? B4 ?? 33 DB CD 10 80 ?? ?? 74 ?? B0 ?? EB ?? 8B }
    condition:
        $a at pe.entry_point
}

rule Upack_v024_v028_Alpha_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }
    condition:
        $a at pe.entry_point
}

rule PRO_PACK_v208_additional {
    strings:
        $a = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule AcidCrypt_AciDLeo {
    strings:
        $a = { 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }
    condition:
        $a at pe.entry_point
}

rule PE_PaCK_v10_C_Copyright_1998_by_ANAKiN_additional {
    strings:
        $a = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V13X_risco_additional {
    strings:
        $a = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }
    condition:
        $a at pe.entry_point
}

rule PackItBitch_10_archphase_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        $a at pe.entry_point
}

rule Nuts_Bolts_Disk_Image {
    strings:
        $a = { 4E 42 69 6D }
    condition:
        $a at pe.entry_point
}

rule Upack_020_beta_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Yodas_Protector_102 {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule ExeBundle_v30_standard_loader_additional {
    strings:
        $a = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_compressed_resources_wwwstrongbitcom_additional {
    strings:
        $a = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }
    condition:
        $a at pe.entry_point
}

rule PuNkMoD_11a_PuNkDuDe {
    strings:
        $a = { 94 B9 5E 01 00 00 BC ?? ?? ?? 00 80 34 0C ?? 80 2C 0C ?? D2 }
    condition:
        $a at pe.entry_point
}

rule CExe_v10a_TinyWare_Inc {
    strings:
        $a = { 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A 00 FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }
    condition:
        $a at pe.entry_point
}

rule PESpin_13beta_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_01_by_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pelles_C_2x_4x_DLL_Pelle_Orinius_additional {
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }
    condition:
        $a at pe.entry_point
}

rule PE_Intro_v10 {
    strings:
        $a = { 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48 }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_WWPack32_1x_emadicius_additional {
    strings:
        $a = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_CAB_SFX {
    strings:
        $a = { E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule yzpack_20_UsAr {
    strings:
        $a = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28 }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_Stub_b_Farb_rausch_Consumer_Consulting_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13013_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00 }
        $b = { EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LaunchAnywhere_v4001_additional {
    strings:
        $a = { 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_32Lite_003_Anorganix {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }
    condition:
        $a at pe.entry_point
}

rule Blade_Joiner_v15_additional {
    strings:
        $a = { 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v251_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_10_beta_2_by_Alex {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AsCrypt_v01_SToRM {
    strings:
        $a = { 83 ?? ?? E2 ?? ?? E2 ?? FF }
        $b = { 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule aPack_090_099_d_s_EXE {
    strings:
        $a = { 8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 2E 00 05 00 00 0E 50 6A 00 CB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v25_Retail_Slim_Loader_Bitsum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140b5_v140b6_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_PolyCryptor_vxx_Extranger {
    strings:
        $a = { 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_01_Hint_DOS_EP {
    strings:
        $a = { EB ?? ?? BE ?? ?? BF ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule EPack_14_lite_final_by_6aHguT_additional {
    strings:
        $a = { 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule BJFNT_11 {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 EB 01 C7 57 EB 01 C7 55 EB 02 CD 20 EB 02 C7 05 EB 01 EA EB 01 EA FC EB 01 EA E8 00 00 00 00 EB 01 C7 5E EB 02 CD 20 83 C6 50 EB 02 CD 20 8B FE EB 02 C7 05 B9 65 06 00 00 EB 02 C7 }
    condition:
        $a at pe.entry_point
}

rule BJFNT_12 {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD 20 60 EB 03 3A 4D 3A E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 17 EB 02 CD 20 EB 03 CD 20 EB EB 01 EB FC EB 01 EB EB 02 CD 20 E8 00 00 00 00 EB 03 CD 20 17 5E EB 02 C7 }
    condition:
        $a at pe.entry_point
}

rule BJFNT_13 {
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 17 EB 02 CD 20 EB 03 3A 4D 3A FC EB 02 C7 85 E8 00 00 00 00 EB 02 C7 05 EB 02 CD 20 5E EB 02 CD 20 83 C6 3F }
    condition:
        $a at pe.entry_point
}

rule RLPack_V115_V116_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule DrWeb_Virus_Finding_Engine_InSoft_EDV_Systeme_additional {
    strings:
        $a = { 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_0760_0765_hying {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_com {
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point
}

rule nPack_111502006Beta_NEOx_additional {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2545_Jitit {
    strings:
        $a = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RE_Crypt_07x_Crudd_RET {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_V01_V015_DLL_NTkrnl_Software {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Upack_v036_beta_Dwing_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B }
    condition:
        $a at pe.entry_point
}

rule SVKP_v143_Pavol_Cerven_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_50_KOLMCK {
    strings:
        $a = { 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule _MSLRH_v031a {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
    condition:
        $a at pe.entry_point
}

rule InstallShield_3x_Custom_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1 }
    condition:
        $a at pe.entry_point
}

rule AVPack_12x_COM {
    strings:
        $a = { EB 12 41 56 50 41 43 4B 16 01 01 00 00 00 00 00 00 00 00 00 8C DA 03 16 12 01 39 16 02 00 73 18 B4 09 BA 28 01 CD 21 C3 4F 75 74 20 6F 66 20 6D 65 6D 6F 72 79 0D 0A 24 8B DC 83 EA 40 FA 8E D2 BC 00 04 FB 50 1E 53 8E C2 B9 00 01 8B F1 33 FF }
    condition:
        $a at pe.entry_point
}

rule PPC_PROTECT_V11X_Alexey_Gorchakov {
    strings:
        $a = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_R_Full_text_index_file_additional {
    strings:
        $a = { 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78 }
    condition:
        $a at pe.entry_point
}

rule fasm_Tomasz_Grysztar_additional {
    strings:
        $a = { 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v100_v101_BoB_BobSoft_additional {
    strings:
        $a = { 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V107_V125_MATCODE_Software_20080730 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_12_Solodovnikov_Alexey {
    strings:
        $a = { 68 01 ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_20_ {
    strings:
        $a = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }
    condition:
        $a at pe.entry_point
}

rule UPolyX_V01_Delikon {
    strings:
        $a = { E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_file_protector_Hint_DOS_EP {
    strings:
        $a = { EB ?? BE ?? ?? BF ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Berio_100_beta_h_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_v30_additional {
    strings:
        $a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }
    condition:
        $a at pe.entry_point
}

rule UPX_v080_v084 {
    strings:
        $a = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
        $b = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NoodleCrypt_v200_Eng_NoodleSpa {
    strings:
        $a = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }
        $b = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_V1322_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_XiaoHui {
    strings:
        $a = { 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule Unpacked_BS_SFX_Archive_v19_additional {
    strings:
        $a = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 }
    condition:
        $a at pe.entry_point
}

rule SkD_Undetectabler_3_No_FSG_2_Method_SkD_additional {
    strings:
        $a = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule Virogen_Crypt_v075_additional {
    strings:
        $a = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_031032_GlOFF {
    strings:
        $a = { 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HEALTH_v51_by_Muslim_MPolyak_additional {
    strings:
        $a = { 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v132_Pavol_Cerven_h_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 }
    condition:
        $a at pe.entry_point
}

rule Jam_221_COM {
    strings:
        $a = { 50 06 16 07 BE 06 02 8B FE B9 04 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 8D 9E 00 10 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 43 5D 2E }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10x_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SoftSentry_v211_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 E9 50 }
    condition:
        $a at pe.entry_point
}

rule SkD_Undetectabler_Pro_20_No_UPX_Method_SkD {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40 }
    condition:
        $a at pe.entry_point
}

rule Unknown_SFX_Archive_aWAW_Hint_FILE_START {
    strings:
        $a = { 61 57 41 57 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v211d_additional {
    strings:
        $a = { 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Basic_60_DLL {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }
    condition:
        $a at pe.entry_point
}

rule Cruncher_v10_Hint_DOS_EP {
    strings:
        $a = { 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule PESPin_v13_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule iPB_Protect_013_017_forgot {
    strings:
        $a = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule InstallAnywhere_V61_Zero_G_Software_Inc {
    strings:
        $a = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C {
    strings:
        $a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }
        $b = { E8 ?? ?? 2E FF ?? ?? ?? FC 06 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v01_emadicius_ {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v12_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }
    condition:
        $a at pe.entry_point
}

rule UPX_v103_v104_Modified_additional {
    strings:
        $a = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_XCR_011 {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v201_additional {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }
    condition:
        $a at pe.entry_point
}

rule PcShare_v40_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V34_V35_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v15x_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_v061_SLV {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 }
        $b = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Alloy_v1x2000_Prakash_Gautam {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 6A 04 68 00 10 ?? ?? 68 00 02 ?? ?? 6A 00 FF 95 46 23 40 ?? 0B }
    condition:
        $a at pe.entry_point
}

rule PESpin_1304_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_224_by_Jan_Vorel_additional {
    strings:
        $a = { 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encrypter_20 {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 BD 0F 34 40 00 00 75 1D 90 90 90 90 C7 85 0F 34 40 00 01 00 00 00 E8 1E 00 00 00 E8 25 02 00 00 E8 DA 02 00 }
    condition:
        $a at pe.entry_point
}

rule UPack_011 {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }
    condition:
        $a at pe.entry_point
}

rule Upack_012_beta_Dwing_additional {
    strings:
        $a = { BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_05_Smoke {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1300_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00 }
        $b = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_50_71 {
    strings:
        $a = { 55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_V037_V039_Dwing {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00 }
        $b = { BE ?? ?? ?? ?? AD 50 FF ?? ?? EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_099_tE_additional {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v300_v301_Extractable_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC }
    condition:
        $a at pe.entry_point
}

rule tElock_051_tE_additional {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V12_V14_SIS_Team {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
    condition:
        $a at pe.entry_point
}

rule Interplays_MVE_file {
    strings:
        $a = { 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V16c_Vaska_Sign_by_fly {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_08_additional {
    strings:
        $a = { 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F }
    condition:
        $a at pe.entry_point
}

rule NSPack_Nort_Star_Software_urlwwwnsdsncom {
    strings:
        $a = { 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57 }
        $b = { 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stones_PE_Encryptor_v113_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_Net_LiuXingPing_Sign_by_fly {
    strings:
        $a = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule Pohernah_Crypter_V101_Kas_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED }
    condition:
        $a at pe.entry_point
}

rule MaskPE_V20_yzkzero {
    strings:
        $a = { B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1200_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 3F 1E 00 00 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_007 {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 BE 3D 35 40 00 03 F5 B9 E4 02 00 00 E8 E4 02 00 00 71 99 00 00 83 3E 32 B8 77 40 00 74 38 67 BE C0 63 76 40 83 69 E1 82 1C C8 6B 76 40 BE 09 80 77 40 03 F6 A3 A9 6A 06 A4 77 40 66 }
    condition:
        $a at pe.entry_point
}

rule nSPack_2x3x_NET_North_StarLiu_Xing_Ping {
    strings:
        $a = { FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACProtect_v135_risco_software_Inc_Anticrack_Software_h_additional {
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 }
    condition:
        $a at pe.entry_point
}

rule tElock_v095_tHE_EGOiSTE {
    strings:
        $a = { E9 D5 E4 FF FF 00 }
    condition:
        $a at pe.entry_point
}

rule PS_AdobeFont_v10 {
    strings:
        $a = { 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A }
    condition:
        $a at pe.entry_point
}

rule PESpin_0b_01_CyberBob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 }
    condition:
        $a at pe.entry_point
}

rule Fly_Crypter_10_ut1lz {
    strings:
        $a = { 53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3 }
        $b = { 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ExePack_10_ {
    strings:
        $a = { 60 E8 36 FE FF FF C3 90 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v15_Private_Vaska_additional {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_23_Alexey_Solodovnikov_h {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C }
    condition:
        $a at pe.entry_point
}

rule mPACK_v002_DeltaAziz_h_additional {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_30_Anorganix {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PENightMare_2_Beta {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_023_alpha_Ryd_additional {
    strings:
        $a = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_V12X_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 }
        $b = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_140_141 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB C3 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_Cryptor_13RC_Tom_Commander_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
    condition:
        $a at pe.entry_point
}

rule RLPack_V111_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_MSVCpp_60_DLL_emadicius_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v114_beta_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 67 02 00 00 8D 9D 2E 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 3B 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_Brczi_Gbor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 }
        $b = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule StarForce_V3X_DLL_StarForce_Copy_Protection_System_ {
    strings:
        $a = { E8 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V112_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point
}

rule Vx_XRCV1015 {
    strings:
        $a = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule UPX_v20_Markus_Laszlo_Reiser {
    strings:
        $a = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 }
        $b = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stealth_PE_v11 {
    strings:
        $a = { BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2 }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_p_Phar_Lap_DOS_Extender_1983_89_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V34_V35_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cue_70_80 {
    strings:
        $a = { 53 56 8B 44 24 18 0B C0 75 18 8B 4C 24 14 8B 44 24 10 33 D2 F7 F1 8B D8 8B 44 24 0C F7 F1 8B D3 EB 41 8B C8 8B 5C 24 14 8B 54 24 10 8B 44 24 0C D1 E9 D1 DB D1 EA D1 D8 0B C9 75 F4 F7 F3 8B F0 F7 64 24 18 8B C8 8B 44 24 14 F7 E6 03 D1 72 0E 3B 54 24 10 77 }
    condition:
        $a at pe.entry_point
}

rule EXE_Packer_v70_by_TurboPower_Software_Hint_DOS_EP {
    strings:
        $a = { 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_11_Northfox_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00 }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_03_by_SMoKE_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12_Alexey_Solodovnikov_h1_additional {
    strings:
        $a = { 90 ?? 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_10_p0ke_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }
    condition:
        $a at pe.entry_point
}

rule FSG_v20_additional {
    strings:
        $a = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_additional {
    strings:
        $a = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_additional {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PDS_graphics_file_format {
    strings:
        $a = { 49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_UltraPro_Dongle_V110_SafeNet_Inc_SignByfly {
    strings:
        $a = { A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 04 83 F8 64 7C E7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 8B 4D 00 83 C5 08 ?? ?? ?? ?? ?? ?? ?? 66 8B 75 FA ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B 55 FC 81 E1 FF FF 00 00 81 F9 }
        $b = { A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Petite_v_after_v14 {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule XMI_music_file {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44 }
    condition:
        $a at pe.entry_point
}

rule Macs_StuffIt_Archive_Hint_FILE_START {
    strings:
        $a = { 53 49 54 21 00 }
    condition:
        $a at pe.entry_point
}

rule nPack_v113002006_Beta {
    strings:
        $a = { 83 3D 4C ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_444a_public_build_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF }
    condition:
        $a at pe.entry_point
}

rule PKLite_100_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 00 01 50 4B 6C 69 74 65 20 43 6F 70 72 2E 20 31 39 39 30 20 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Bitmap_Graphics_format {
    strings:
        $a = { 01 00 09 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_Debug_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_035_GlOFF_additional {
    strings:
        $a = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_206_additional {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
    condition:
        $a at pe.entry_point
}

rule XWD_graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 00 00 71 00 00 00 07 00 00 00 02 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Cryptic_20_Tughack_additional {
    strings:
        $a = { B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_13beta_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Packman_v0001 {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Microsoft_Visual_Cpp_60_additional {
    strings:
        $a = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b3_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V520Beta1_Silicon_Realms_Toolworks_20080214 {
    strings:
        $a = { E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13 00 00 59 89 7D FC FF 75 08 E8 AC 47 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 7C D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 AD 11 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule PureBasic_DLL_Neil_Hodgson_additional {
    strings:
        $a = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8 }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_Dll_WinMain {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 ?? ?? ?? FF 15 E4 40 40 ?? E8 68 ?? ?? ?? 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 ?? ?? ?? FF 15 E4 40 40 ?? E8 48 ?? ?? ?? 89 EC 31 C0 5D C3 89 }
        $b = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ROD_High_TECH_Ayman_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig4 {
    strings:
        $a = { C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule RIX_graphics_file {
    strings:
        $a = { 52 49 58 33 }
    condition:
        $a at pe.entry_point
}

rule Themida_1201_compressed_Oreans_Technologies_h_additional {
    strings:
        $a = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_yy66_additional {
    strings:
        $a = { 68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v05_yadolockless {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED 71 44 ?? 00 2B 85 64 60 ?? 00 EB 43 DF }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v15_Vaska_additional {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F }
    condition:
        $a at pe.entry_point
}

rule aPack_096_i_m {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 B1 01 73 13 FF D5 BB 10 00 72 25 FF D5 12 DB 73 FA 75 00 93 AA EB E3 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 }
    condition:
        $a at pe.entry_point
}

rule UPX_V194_Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser {
    strings:
        $a = { FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule UPX_0896_102_PE {
    strings:
        $a = { 60 BE 00 00 00 00 8D BE 00 00 00 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 }
    condition:
        $a at pe.entry_point
}

rule DIET_v144_v145f_Hint_DOS_EP_p_11 {
    strings:
        $a = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1300_Obsidium_Software_additional {
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_ {
    strings:
        $a = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }
    condition:
        $a at pe.entry_point
}

rule EXE_Protector_137a {
    strings:
        $a = { 68 54 14 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 5C C3 4D EA 29 A6 D2 11 BB FF 44 45 53 54 00 00 00 00 00 00 00 00 01 00 00 00 00 00 B5 09 00 A0 70 72 66 45 6D 62 65 64 64 65 64 43 6F 64 65 }
    condition:
        $a at pe.entry_point
}

rule Gem_VDI_Image_graphics_file {
    strings:
        $a = { 00 01 00 ?? 00 ?? 00 01 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v114_v120_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1987_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92 }
    condition:
        $a at pe.entry_point
}

rule Unknown_UPX_modifyer {
    strings:
        $a = { E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3 }
    condition:
        $a at pe.entry_point
}

rule SC_Obfuscator_SuperCRacker {
    strings:
        $a = { 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C }
    condition:
        $a at pe.entry_point
}

rule tElock_099c_Private_ECLIPSE_tE {
    strings:
        $a = { E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }
        $b = { E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Noodlecrypt2_rsc {
    strings:
        $a = { EB 01 9A E8 76 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_for_Windows_1_Hint_WIN_EP {
    strings:
        $a = { 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule ExeLock_v100_additional {
    strings:
        $a = { 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_30x_3300_Thinstall_Inc {
    strings:
        $a = { CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 ?? ?? ?? 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 ?? ?? 73 0E 8B 4D F8 E8 27 01 ?? ?? 02 45 F7 AA EB E9 E8 04 01 ?? ?? 0F 82 96 ?? ?? ?? E8 F9 ?? ?? ?? 73 5B B9 04 ?? ?? ?? E8 05 01 ?? ?? 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF ?? ?? ?? 73 1B 55 BD ?? ?? ?? ?? E8 DF ?? ?? ?? 88 07 47 4D 75 F5 E8 C7 ?? ?? ?? 72 E9 5D }
    condition:
        $a at pe.entry_point
}

rule X_Hider_10_GlobaL_additional {
    strings:
        $a = { 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF }
    condition:
        $a at pe.entry_point
}

rule RLPack_10_beta_ap0x_h {
    strings:
        $a = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C }
    condition:
        $a at pe.entry_point
}

rule NsPack_v37_North_Star_h_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V12_SIS_Team_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_131_dulekxt_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16x_Vaska_additional {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Encriptor_v100c_Hint_DOS_EP {
    strings:
        $a = { EB ?? B9 ?? ?? BE ?? ?? BF ?? ?? AC D0 C8 AA E2 ?? BE ?? ?? BF ?? ?? AC AA }
    condition:
        $a at pe.entry_point
}

rule Anskya_Binder_v11_Anskya_additional {
    strings:
        $a = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_076_Hying_CCG_h {
    strings:
        $a = { 01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_p_Password_checking_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_075exe_Hying_CCG_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_password_protector_by_SMT {
    strings:
        $a = { E8 04 00 00 00 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 00 81 EF 00 00 00 00 83 EF 05 89 AD 88 27 40 00 8D 9D 07 29 40 00 8D B5 62 28 40 00 46 80 3E 00 74 24 56 FF 95 9D 29 40 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 A1 29 40 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_V031_emadicius {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }
        $b = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v260b1_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC }
    condition:
        $a at pe.entry_point
}

rule DShield {
    strings:
        $a = { 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Celsius_Crypt_21_Z3r0 {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }
        $b = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v031_beta_Dwing {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point
}

rule SEA_AXE_v22_additional {
    strings:
        $a = { FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_FSG_131_Anorganix {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_280_290_EXE_X86_CRT_LIB_additional {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_vxx_additional {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_LCC_Win32_DLL_Anorganix {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1X_NoCompression_SecureEngine_Oreans_Technologies {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Escargot_01_final_ppMeat_additional {
    strings:
        $a = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V200_V20X_MATCODE_Software_20090423 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v20_additional {
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2C }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Automatic_Protection_v640_Safenet {
    strings:
        $a = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 }
        $b = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
        $c = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_1311_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1341_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_Berczi_Gabor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v30_1985_Hint_DOS_EP {
    strings:
        $a = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35 }
    condition:
        $a at pe.entry_point
}

rule UPX_030_EXE {
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 AF AD 0E 0E 0E 06 1F 07 16 68 00 00 BD FF FF F7 E1 93 CB 55 50 58 21 04 03 02 07 }
    condition:
        $a at pe.entry_point
}

rule Lattice_C_v101_additional {
    strings:
        $a = { FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC4_build_0807_exe_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_015_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie2000_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v212 {
    strings:
        $a = { 60 E8 03 ?? ?? ?? E9 EB 04 5D 45 55 C3 E8 }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v211 {
    strings:
        $a = { 60 E8 02 ?? ?? ?? EB 09 5D 55 81 ED 39 39 44 ?? C3 E9 3D }
        $b = { 60 E9 3D 04 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_v118_Basic_DLL_aPLib {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
        $b = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ExeCode_100_COM {
    strings:
        $a = { 8B E8 BA 4C 01 B4 09 CD 21 2E A1 09 01 8C C3 03 C3 B1 02 2E 8B 1E 0F 01 F7 C3 03 00 74 03 83 C3 03 D3 EB 2E 89 1E 19 01 BE 09 01 BF F0 01 B9 09 00 F3 A5 03 C3 05 2D 00 8E C0 05 0E 00 03 C3 FA 8E D0 BC 00 02 FB 1E 8C D8 05 1F 00 8E D8 2E 8B }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2717_V2719_Jitit {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PC_Guard_4xx_emadicius_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 }
    condition:
        $a at pe.entry_point
}

rule Crypto_Lock_V202_Eng_Ryan_Thian {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }
        $b = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPXHiT_v001 {
    strings:
        $a = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }
    condition:
        $a at pe.entry_point
}

rule nPack_v11_150_200_Beta_NEOx_additional {
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        $a at pe.entry_point
}

rule Password_Protector_for_the_UPX_030_g0d_additional {
    strings:
        $a = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86 }
    condition:
        $a at pe.entry_point
}

rule CryptEXE_10 {
    strings:
        $a = { 50 FC 0E 1F 1E 07 BA 37 03 B4 09 CD 21 33 C9 8B FA 57 B4 00 CD 16 3C 1B 75 05 E8 E0 02 EB 35 3C 0D 74 36 3C 08 75 0A 80 F9 00 74 E6 FE C9 4F EB E1 3C 20 72 DD 3C EF 77 D9 80 F9 14 74 D4 3C 61 72 06 3C 7A 77 02 2C 20 AA FE C1 EB C5 BA 7E 03 }
    condition:
        $a at pe.entry_point
}

rule Scitech_Software_Display_Driver {
    strings:
        $a = { 56 42 45 41 46 2E 44 52 56 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ASPack_2xx_Heuristic_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_01_Teraphy_Phrozen_Crew {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_12_Memory_Patch_additional {
    strings:
        $a = { E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 }
    condition:
        $a at pe.entry_point
}

rule BamBam_001 {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point
}

rule ChinaProtect_dummy_SignByfly {
    strings:
        $a = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_103_ConquestOfTroycom_additional {
    strings:
        $a = { E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_50 {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_03_by_delikon {
    strings:
        $a = { ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 80 }
        $b = { 8B ?? B9 ?? ?? ?? ?? 80 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Borland_Cue {
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }
    condition:
        $a at pe.entry_point
}

rule PeCompact_2xx_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule HelpEXE_12 {
    strings:
        $a = { FA 2E 8C 16 00 00 2E 89 26 00 00 8C C8 8E D0 8D 06 DC 00 89 C4 FB FC BE 81 00 AC 3C 20 74 FB 3C 3F 74 24 3C 2F 75 05 AC 3C 3F 74 1B 8C D8 05 10 00 2E 01 06 00 00 FA 2E 8E 16 00 00 2E 8B 26 00 00 FB 2E FF 2E 00 00 0E 1F BA 00 00 B4 09 CD 21 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098_m {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_v200_additional {
    strings:
        $a = { E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b4_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule RTPatch_software_update_package_data_file_Hint_FILE_START {
    strings:
        $a = { 4B 2A }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v302_v302a_Extractable_additional {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Vx_Necropolis1963_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 }
    condition:
        $a at pe.entry_point
}

rule Adys_Glue_110 {
    strings:
        $a = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_LCC_Win32_DLL_Anorganix {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V10X_V17X_DLL_Oreans_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9 }
        $b = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Exe_Shield_v27b {
    strings:
        $a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
        $b = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SLR_OPTLINK_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v13x {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 }
    condition:
        $a at pe.entry_point
}

rule DIET_v100d_Hint_DOS_EP {
    strings:
        $a = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_430a_Silicon_Realms_Toolworks {
    strings:
        $a = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }
        $b = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Adlib_Sample_Audio_file_additional {
    strings:
        $a = { 47 4F 4C 44 20 53 41 4D 50 4C 45 }
    condition:
        $a at pe.entry_point
}

rule kryptor_5_additional {
    strings:
        $a = { E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_620_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v50v60_MFC {
    strings:
        $a = { 55 8B EC ?? }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ORiEN_v211_212_Fisun_Alexander_additional {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D }
    condition:
        $a at pe.entry_point
}

rule Vx_TrojanTelefoon_Hint_DOS_EP {
    strings:
        $a = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_build_0807_exe_Alexey_Solodovnikov {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Maked_by_Graphic_WorkShops_Self_Displayer_v60_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 2E C7 ?? ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43 2E 01 1E ?? ?? E8 ?? ?? 3D }
    condition:
        $a at pe.entry_point
}

rule IProtect_10_FxSubdll_mode_by_FuXdas {
    strings:
        $a = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF }
        $b = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Nullsoft_PIMP_Install_System_v1x_additional {
    strings:
        $a = { 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_DLL_additional {
    strings:
        $a = { 8B 44 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule Windows_Type_1_font_metric_file {
    strings:
        $a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_v11_SLV_h {
    strings:
        $a = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C }
        $b = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TMT_Pascals_Unit_file {
    strings:
        $a = { 50 00 00 00 53 50 46 50 }
    condition:
        $a at pe.entry_point
}

rule MEGALITE_v120a_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90 }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_v124_cyclotron_additional {
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_V102_DLL_BoB_BobSoft {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_0896_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 00 00 00 00 60 BE 1A 00 00 00 8D BE E6 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule XPack_167_EXE {
    strings:
        $a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 0E 1F 8B EC EB 01 9A FA 33 DB 8E D3 BC 04 00 8F 06 EA 03 8F 06 EF 03 EB 01 9A 0E BE E2 03 56 5E 17 8B E5 83 C4 10 FB 1F 59 E8 C6 FF 33 DB 1E 8E DB C7 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098 {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E }
    condition:
        $a at pe.entry_point
}

rule Vx_KBDflags1024_Hint_DOS_EP {
    strings:
        $a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }
    condition:
        $a at pe.entry_point
}

rule SecurePE_1X {
    strings:
        $a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }
        $b = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CopyMinder_MicrocosmLtd_additional {
    strings:
        $a = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        $a at pe.entry_point
}

rule PCPEC_alpha_preview_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }
    condition:
        $a at pe.entry_point
}

rule yzPack_10_UsAr {
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_v29_Exeshield_Corp {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule BDC_HelpSystem_Help_file_additional {
    strings:
        $a = { 42 44 43 20 48 65 6C 70 53 79 73 74 65 6D }
    condition:
        $a at pe.entry_point
}

rule MS_Visual_Cpp_v8_DLL_h_small_sig1_additional {
    strings:
        $a = { 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule muckis_protector_mucki {
    strings:
        $a = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9 }
    condition:
        $a at pe.entry_point
}

rule Pksmart_10b {
    strings:
        $a = { BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3 }
    condition:
        $a at pe.entry_point
}

rule XCompXPack_V097_V098_JoKo_20080219 {
    strings:
        $a = { 68 ?? ?? ?? ?? 9C 60 E8 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 }
    condition:
        $a at pe.entry_point
}

rule XCompXPack_V097_V098_JoKo_20080218 {
    strings:
        $a = { 68 ?? ?? ?? ?? 9C 60 E8 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 }
    condition:
        $a at pe.entry_point
}

rule PENightMare_2_Beta_additional {
    strings:
        $a = { 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_LCC_Win32_1x_Anorganix {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PENightMare_2_Beta_Anorganix {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }
    condition:
        $a at pe.entry_point
}

rule SC_Obfuscator_SuperCRacker_additional {
    strings:
        $a = { 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C }
    condition:
        $a at pe.entry_point
}

rule COMPACK_v45_2 {
    strings:
        $a = { BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE }
    condition:
        $a at pe.entry_point
}

rule AZProtect_0001_by_AlexZ_aka_AZCRC {
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 }
        $b = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C }
        $c = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NoodleCrypt_v20_NoodleSpa {
    strings:
        $a = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Blade_Joiner_v15 {
    strings:
        $a = { 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85 }
    condition:
        $a at pe.entry_point
}

rule Alias_PIXVivid_IMG_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v25_Retail_Bitsum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_120b {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_12_Ding_Boy {
    strings:
        $a = { 55 57 56 52 51 53 9C FA 90 E8 00 00 00 00 5D 8B D5 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Stelth_PE_101 {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule nbuild_v10_soft_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point
}

rule Vx_August_16th_Iron_Maiden_additional {
    strings:
        $a = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }
    condition:
        $a at pe.entry_point
}

rule Compiled_InstallSHIELD_Installation_Script_Hint_FILE_START {
    strings:
        $a = { B8 C9 0C 00 }
    condition:
        $a at pe.entry_point
}

rule fasm_Tomasz_Grysztar_flat_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_500_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        $a at pe.entry_point
}

rule Banners_font_file {
    strings:
        $a = { AB CD 00 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_v03_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 }
    condition:
        $a at pe.entry_point
}

rule ASPack_101b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D2 2A 44 00 B8 CC 2A 44 00 03 C5 2B 85 A5 2E 44 00 89 85 B1 2E 44 00 80 BD 9C 2E 44 }
    condition:
        $a at pe.entry_point
}

rule yzpack_112_UsAr {
    strings:
        $a = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_Version_1501 {
    strings:
        $a = { 55 8B EC 81 EC 50 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PESHiELD_025_Anorganix {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V071_cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22008618_WFS_20080626 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65 46 69 6C 65 41 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 32 32 30 30 38 30 36 31 38 2E 45 50 45 00 00 00 45 6E 63 72 79 70 74 50 45 5F 49 6E 69 74 00 }
    condition:
        $a at pe.entry_point
}

rule ExeJoiner_V10_Yoda_f2f_additional {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Intro_10 {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional {
    strings:
        $a = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_bartxt_Watcom_CCpp_EXE_ {
    strings:
        $a = { EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }
    condition:
        $a at pe.entry_point
}

rule MS_Visual_Cpp_v8_DLL_h_small_sig1 {
    strings:
        $a = { 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule MS_Visual_Cpp_v8_DLL_h_small_sig2 {
    strings:
        $a = { 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2422_V2428_Jitit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule ZProtect_v146_lifeengines {
    strings:
        $a = { 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? E9 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Launcher_Generator_v103 {
    strings:
        $a = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }
        $b = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Aspack_v212_wwwaspackcom {
    strings:
        $a = { ?8 ?? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F ?? ?? ?3 ?? ?? ?? 8? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8? }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL_encrypted {
    strings:
        $a = { 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3 }
    condition:
        $a at pe.entry_point
}

rule MEW_10_Northfox {
    strings:
        $a = { 33 C0 E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PESHiELD_025_Anorganix_additional {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cue_60_Debug_Version {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule AutoDesk_Animation_file {
    strings:
        $a = { ?? ?? ?? 00 12 AF ?? ?? 40 01 C8 }
        $b = { 00 12 AF ?? ?? 40 01 C8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v2xx_Alexey_Solodovnikov {
    strings:
        $a = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
    condition:
        $a at pe.entry_point
}

rule Rec_032 {
    strings:
        $a = { 06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 03 73 02 CD 20 3C 03 73 02 33 C0 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 53 BB EB 04 5B EB FB 9A EB 2D FE 20 }
    condition:
        $a at pe.entry_point
}

rule Thunderbolt_V002_deXep_forgot_SignByfly_additional {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CALS_Raster_graphics_format_Hint_FILE_START {
    strings:
        $a = { 73 72 63 64 6F 63 69 64 3A 20 }
    condition:
        $a at pe.entry_point
}

rule Upack_V036_V037_DLL_Dwing_additional {
    strings:
        $a = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_225_by_Jan_Vorel {
    strings:
        $a = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35 }
        $b = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Virogens_PE_Shrinker_v014_Hint_WIN_EP {
    strings:
        $a = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_WAV_Audio_file_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule ASYLUM_Music_File_v10_Hint_FILE_START {
    strings:
        $a = { 41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_0x_Delikon_additional {
    strings:
        $a = { 81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_ZCode_101_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32 {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 }
        $b = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule InterGraph_Graphics_format {
    strings:
        $a = { 08 09 FE 01 18 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKTINY_v10_with_TINYPROG_v38 {
    strings:
        $a = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule PE_Protector_V260hyings_PE_Armor_V0460_modify_Engprog_SignByfly_additional {
    strings:
        $a = { 55 53 51 52 56 57 E8 E1 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_2628_Jtit_additional {
    strings:
        $a = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
    condition:
        $a at pe.entry_point
}

rule Goldeds_Output_text_file_Hint_FILE_START {
    strings:
        $a = { C4 20 5B }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v2xx_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 F0 67 4D 00 68 50 92 4B 00 64 A1 }
    condition:
        $a at pe.entry_point
}

rule aPack_v082_Hint_DOS_EP {
    strings:
        $a = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }
    condition:
        $a at pe.entry_point
}

rule PrivateEXE_v20a {
    strings:
        $a = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }
    condition:
        $a at pe.entry_point
}

rule Silicon_Realms_Install_Stub {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 }
        $b = { 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_PE_Intro_10_Anorganix {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100_v103 {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v27b_additional {
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
    condition:
        $a at pe.entry_point
}

rule Freshbind_v20_gFresh_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_11X_13X_Sukhov_Vladimir_Serge_N_Markin_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }
    condition:
        $a at pe.entry_point
}

rule XPack_167_com {
    strings:
        $a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACKs_PE_Protector_V092_Lukas_Fleischer {
    strings:
        $a = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }
    condition:
        $a at pe.entry_point
}

rule ass_crypter_by_santasdad {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45 }
        $b = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule File_Analyzer_Compiled_Datafile_Version {
    strings:
        $a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule MINI_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 46 8B C4 2D 24 03 90 25 F0 FF 8B F8 B9 92 00 90 BE 6C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 00 4D 49 4E 49 20 28 43 29 20 76 31 2E 30 31 20 62 79 20 41 6C 62 65 72 74 20 53 65 6E 20 31 39 39 32 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V12003318_V12003518_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
        $b = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v220_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Upack_024_027_beta_028_alpha_Dwing_ {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }
    condition:
        $a at pe.entry_point
}

rule WebCops_EXE_LINK_Data_Security_additional {
    strings:
        $a = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }
    condition:
        $a at pe.entry_point
}

rule DIET_v102b_v110a_v120_additional {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi {
    strings:
        $a = { C3 E9 FF 8D }
        $b = { 55 8B EC 83 C4 F4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Lock_NT_v204_MARQUISDESOIRE {
    strings:
        $a = { EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3 }
    condition:
        $a at pe.entry_point
}

rule AEP_v100_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? E4 21 2E ?? ?? ?? 33 C0 8B D8 5D B9 ?? ?? 50 B8 ?? ?? E6 21 0F A9 E6 ?? 53 }
    condition:
        $a at pe.entry_point
}

rule AEP_100 {
    strings:
        $a = { E4 21 2E A3 64 00 33 C0 8B D8 5D B9 00 01 50 B8 FF 03 E6 21 0F A9 E6 A1 53 8B DF E4 21 23 D8 4B 0F A1 4B 66 65 FF 37 83 EB 04 49 75 F6 2E C6 06 9C 00 CB 68 17 00 C3 F4 02 41 05 FF 3E E7 5F 32 25 8A 2D 8C C8 F5 FC 8C C0 C0 FE 8C D0 C2 FE FE }
    condition:
        $a at pe.entry_point
}

rule Name_of_the_Packer_v10 {
    strings:
        $a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V109X_Nooby_20081218 {
    strings:
        $a = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ComprEXE_10_COM {
    strings:
        $a = { FC 1E 06 8C DD 83 C5 10 89 E8 BA 00 00 8B 1E 02 00 29 D3 53 8E D8 8E C3 31 F6 31 FF B9 08 00 F3 A5 40 43 4A 75 EE B8 2B 00 50 CB 0E 1F BE 2A 01 B3 01 8E C5 31 FF 81 FF 00 80 72 0B 8C C0 05 00 08 8E C0 81 EF 00 80 E8 8A 00 74 08 B7 08 E8 9D }
    condition:
        $a at pe.entry_point
}

rule PE_Prot_09 {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 00 00 00 00 58 83 C0 07 C6 00 C3 EA E8 00 00 00 00 5D 8B D5 81 ED 68 45 40 00 60 8D 9D AC 45 40 00 B9 1D 03 00 00 B2 00 33 C0 02 03 D2 0B E8 0B 00 00 00 0F 21 C7 28 13 EB 02 9A EA 80 33 C3 43 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v27_Holy_Father_Ratter29A_h {
    strings:
        $a = { ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule N_Joiner_01_Asm_Version_NEX {
    strings:
        $a = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00 }
        $b = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v2001_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 72 05 00 00 EB 4C }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_12_Seek_and_Destroy_Patch_additional {
    strings:
        $a = { 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 }
    condition:
        $a at pe.entry_point
}

rule CalComp_Graphics_format {
    strings:
        $a = { 02 50 0A }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v20 {
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }
        $b = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_PENightMare_2_Beta_Anorganix {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule InstallShield_Custom_additional {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_42_2 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7 }
    condition:
        $a at pe.entry_point
}

rule Lattice_C_v101_Hint_DOS_EP {
    strings:
        $a = { FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB }
    condition:
        $a at pe.entry_point
}

rule iPBProtect_013 {
    strings:
        $a = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }
    condition:
        $a at pe.entry_point
}

rule QrYPt0r_by_NuTraL_additional {
    strings:
        $a = { EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_FaxFreeTopo_Hint_DOS_EP {
    strings:
        $a = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }
    condition:
        $a at pe.entry_point
}

rule PolyCryptor_by_SMT_Version_v3v4_additional {
    strings:
        $a = { EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29 }
    condition:
        $a at pe.entry_point
}

rule A_program_by_Jupiter_ {
    strings:
        $a = { 2B C0 74 05 68 ?? ?? ?? ?? 50 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v50_v60 {
    strings:
        $a = { 5A 68 68 52 E9 }
        $b = { FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF }
        $c = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_CD_Cops_II_Anorganix {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
    condition:
        $a at pe.entry_point
}

rule XXPack_01_bagie {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule PELOCKnt_204 {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_vxx_DLL_additional {
    strings:
        $a = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Windows_Group_file_Hint_FILE_START {
    strings:
        $a = { 50 4D 43 43 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_15_Vaska {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v136_additional {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1200_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKLite_112_120_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0C 01 50 4B 4C 49 54 45 20 43 6F 70 72 2E 20 31 39 39 31 20 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_110111_Vladimir_Sukhov_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_2x_4x_DLL_Pelle_Orinius {
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }
    condition:
        $a at pe.entry_point
}

rule Themida_Oreans_Technologies_2004 {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Limited_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule UPX_Protector_v10x_additional {
    strings:
        $a = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_Berczi_Gabor_Pierre_Muller_Peter_Vreman_additional {
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_22x_SoftComplete_Developement_additional {
    strings:
        $a = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 }
    condition:
        $a at pe.entry_point
}

rule MegaLite_120 {
    strings:
        $a = { B8 00 00 BA 00 00 05 00 00 3B 2D 73 67 72 1B B4 09 BA 18 01 CD 21 CD 90 4E 6F 74 20 65 6E 6F 75 67 68 20 6D 65 6D 6F 72 79 24 2D 20 00 8E D0 2D 00 00 8E C0 50 B9 00 00 33 FF 56 BE 42 01 FC F2 A5 CA FD 8C DB 53 83 C3 00 03 DA 8C CD 8B C2 80 }
    condition:
        $a at pe.entry_point
}

rule NakedPacker_10_by_BigBoote {
    strings:
        $a = { 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }
        $b = { 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressor_v15x_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23 }
    condition:
        $a at pe.entry_point
}

rule Windows_9x_registry_file {
    strings:
        $a = { 43 52 45 47 }
    condition:
        $a at pe.entry_point
}

rule CICompress_10 {
    strings:
        $a = { 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_ {
    strings:
        $a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_UPX_06 {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Basic_Edition_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_ASPack_212_emadicius {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPack_v011_additional {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 }
    condition:
        $a at pe.entry_point
}

rule APatch_GUI_v11_additional {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3 }
    condition:
        $a at pe.entry_point
}

rule ACProtectUltraProtect_10X_20X_RiSco {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LY_WGKX_V2X_wwwszleyucom_SignByfly_20080122_additional {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V18_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32_1x {
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? 00 68 9A 10 40 00 50 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10x_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule HASP_HL_Protection_V1X_Aladdin_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_28x_45x_Pelle_Orinius {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC }
    condition:
        $a at pe.entry_point
}

rule Vx_Hafen1641 {
    strings:
        $a = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }
    condition:
        $a at pe.entry_point
}

rule Vx_November_17768_additional {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule PENinja_modified_additional {
    strings:
        $a = { 5D 83 ED 06 EB 02 EA 04 8D }
    condition:
        $a at pe.entry_point
}

rule Reflexive_Arcade_Wrapper {
    strings:
        $a = { 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_v20 {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65 }
    condition:
        $a at pe.entry_point
}

rule REC_v032 {
    strings:
        $a = { 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D }
    condition:
        $a at pe.entry_point
}

rule Vx_Predator2448_additional {
    strings:
        $a = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_CracKed_By_shoooo_fly_Sukhov_Vladimir_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 C5 FA 81 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20_RC2_additional {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Packer_V10_hmimys {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ASPack_2xx_Heuristic_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12x_New_Strain {
    strings:
        $a = { 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v13037_Obsidium_Software_h {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 }
        $b = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Crinkler_V01_V02_Rune_LHStubbe_and_Aske_Simon_Christensen {
    strings:
        $a = { B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Petite_14_additional {
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
    condition:
        $a at pe.entry_point
}

rule VIRUS_I_WormKLEZ_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule Password_Protector_c_MiniSoft_1992_additional {
    strings:
        $a = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
    condition:
        $a at pe.entry_point
}

rule Vx_August_16th_Iron_Maiden_Hint_DOS_EP {
    strings:
        $a = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v12_v13_additional {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_V2X_MoleStudiocom_additional {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16_by_Vaska_Damrai_sign_20032007_2041_additional {
    strings:
        $a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_102_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 }
    condition:
        $a at pe.entry_point
}

rule xPEP_03x_xIkUg_additional {
    strings:
        $a = { 55 53 56 51 52 57 E8 16 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v1051 {
    strings:
        $a = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule FSG_v12_additional {
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_for_Win32_v500_SofProBlagoje_Ceklic_h {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule kryptor_6_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        $a at pe.entry_point
}

rule SEA_AXE_Hint_DOS_EP {
    strings:
        $a = { FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3 }
    condition:
        $a at pe.entry_point
}

rule theWRAP_by_TronDoc_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }
    condition:
        $a at pe.entry_point
}

rule Soft_Defender_v11x_Randy_Li {
    strings:
        $a = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_CrunchPE_Heuristic {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule HPA_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_exe {
    strings:
        $a = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_pack_only_GPcH {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3 }
        $b = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Password_v02_SMTSMF_SMT {
    strings:
        $a = { E8 04 00 00 00 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 00 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_0460_0759_hying {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CRYPTCOM_11 {
    strings:
        $a = { BF E1 FF 57 BE 0E 01 90 B9 1B 00 F3 A4 C3 8B 16 25 01 8B 0E 27 01 BF 00 01 57 BE 29 01 90 AD 33 C2 AB E2 FA C3 }
    condition:
        $a at pe.entry_point
}

rule SoftDefender_v112_Randy_Li {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v142_Pavol_Cerven_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point
}

rule Jam_221_EXE {
    strings:
        $a = { 50 06 16 07 BE 24 02 8B FE B9 13 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 00 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 5F 5D }
    condition:
        $a at pe.entry_point
}

rule ProtEXE_30 {
    strings:
        $a = { 9C 50 53 51 52 56 57 55 1E 06 FC B8 00 30 CD 21 84 C0 75 02 CD 20 A8 EB 04 00 EB FB 9A BA 21 00 EC 0C 02 EB 01 D0 EE BD 00 00 A8 EB 04 00 EB FB 9A BA 64 00 B0 AD EB 01 B1 EE B9 94 01 A8 EB 04 00 EB FB 9A 89 E8 34 00 2E 28 46 00 4D 49 74 02 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Protected_Mode_compiler_2_Hint_DOS_EP {
    strings:
        $a = { FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_CodeSafe_20 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }
    condition:
        $a at pe.entry_point
}

rule iLUCRYPT_v4018_exe {
    strings:
        $a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_aPLib_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_106107_PolyTech_additional {
    strings:
        $a = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }
    condition:
        $a at pe.entry_point
}

rule UPX_072_additional {
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }
    condition:
        $a at pe.entry_point
}

rule LSI_C_86_Run_Time_Libray_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule PESpin_v11_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8? }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule COM_Crypt_II_386_by_ROSE_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BF ?? ?? 57 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 47 47 E2 ?? 33 FF C3 }
    condition:
        $a at pe.entry_point
}

rule Imaging_Technology_Graphics_format {
    strings:
        $a = { 49 4D 00 00 }
    condition:
        $a at pe.entry_point
}


rule UPX_290_LZMA_Delphi_stub_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v1501_Options_Light_Full_support_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 }
    condition:
        $a at pe.entry_point
}

rule tElock_v100_tHE_EGOiSTE {
    strings:
        $a = { E9 E5 E2 FF FF }
    condition:
        $a at pe.entry_point
}

rule Upack_v035_alpha_Sign_by_hot_UNP {
    strings:
        $a = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }
    condition:
        $a at pe.entry_point
}

rule aPack_082_EXE {
    strings:
        $a = { 1E 06 8C CB BA 00 00 03 DA 8D 87 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E C3 8E D8 33 FF BE 31 00 05 00 00 0E 50 6A 00 CB }
    condition:
        $a at pe.entry_point
}

rule Virogens_PE_Shrinker_v014 {
    strings:
        $a = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v107b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule MESS_v120_additional {
    strings:
        $a = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_Microsoft_Visual_Cpp_emadicius_additional {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }
    condition:
        $a at pe.entry_point
}

rule FIDO_mail_packet {
    strings:
        $a = { 03 00 03 00 CD 07 }
    condition:
        $a at pe.entry_point
}

rule T_PACK_v05c_m2_additional {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL_Anorganix_additional {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_v230_Teggo_additional {
    strings:
        $a = { 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Enhanced_Metafile_Hint_FILE_START {
    strings:
        $a = { 01 00 00 00 58 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1995 {
    strings:
        $a = { FB 83 89 E3 89 89 66 66 BB 29 C0 B4 30 CD }
        $b = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1994 {
    strings:
        $a = { E9 57 }
        $b = { FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Ninja_v10_pDzA_kRAker_TNT_additional {
    strings:
        $a = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule KByS_V028_shoooo {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v100b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule Upack_V036_Dwing_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 18 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 1C 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 1C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 14 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 3C E2 E3 }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_12_Bill_Prisoner_TPOC {
    strings:
        $a = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08 }
        $b = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Cpp_for_Win32_1995_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 }
    condition:
        $a at pe.entry_point
}

rule Vx_Kuku448 {
    strings:
        $a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Joiner_sign_from_pinch_25032007_2010 {
    strings:
        $a = { 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1033_Ashkbiz_Danehkar_Sign_by_fly {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
    condition:
        $a at pe.entry_point
}

rule LGLZ_v104b_Hint_DOS_EP {
    strings:
        $a = { FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v211c_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_dulekxt_Microsoft_Visual_Cpp_60_70 {
    strings:
        $a = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32 {
    strings:
        $a = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }
        $b = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Inno_Setup_Module {
    strings:
        $a = { 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 }
        $b = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_70 {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 }
        $b = { 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_71 {
    strings:
        $a = { 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00 }
        $b = { 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00 }
        $c = { 55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_239_compressed_resources_wwwstrongbitcom {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v211b_additional {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V05_Smoke_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10b_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule ASPack_105b_by {
    strings:
        $a = { 75 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_for_Windows_2_Hint_WIN_EP {
    strings:
        $a = { 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_MinGW_GCC_2x_Anorganix {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }
    condition:
        $a at pe.entry_point
}

rule ACE_Archive_additional {
    strings:
        $a = { 2A 2A 41 43 45 2A 2A }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_09910 {
    strings:
        $a = { E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29 }
    condition:
        $a at pe.entry_point
}

rule SoftProtect_SoftProtectbyru {
    strings:
        $a = { EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C }
        $b = { E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v200b1_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v0251_additional {
    strings:
        $a = { 5D 83 ED 06 EB 02 EA 04 8D }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_p_Phar_Lap_DOS_Extender_1983_89 {
    strings:
        $a = { B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 }
    condition:
        $a at pe.entry_point
}

rule UPX_200_Markus_Laszlo {
    strings:
        $a = { 32 2E 30 30 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_BJFNT_12_Anorganix {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_emadicius {
    strings:
        $a = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C }
        $b = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cue_80 {
    strings:
        $a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B }
    condition:
        $a at pe.entry_point
}

rule Crypto_Lock_v202_Eng_Ryan_Thian_additional {
    strings:
        $a = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
    condition:
        $a at pe.entry_point
}

rule UG2002_Cruncher_v03b3_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v34_Hint_DOS_EP {
    strings:
        $a = { BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }
    condition:
        $a at pe.entry_point
}

rule Petite_v21_1 {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PEX_099_emadicius_h {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule BookManager_v9510_additional {
    strings:
        $a = { FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50 }
    condition:
        $a at pe.entry_point
}

rule Silicon_Realms_Install_Stub_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1033_exescrcom_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC }
    condition:
        $a at pe.entry_point
}

rule Crunch_5_Fusion_4 {
    strings:
        $a = { EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8 }
    condition:
        $a at pe.entry_point
}

rule OLE2_Document_WinWord_Excel_ {
    strings:
        $a = { D0 CF 11 E0 A1 B1 1A E1 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PE_Protect_09_Anorganix {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }
    condition:
        $a at pe.entry_point
}

rule NE_Exe_Executable_Image_Hint_FILE_START {
    strings:
        $a = { 4E 45 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2117_StrongbitSoftComplete_Development_additional {
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
    condition:
        $a at pe.entry_point
}

rule EEXE_Version_112 {
    strings:
        $a = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200c_Hint_DOS_EP {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule Inno_Installer_v512_additional {
    strings:
        $a = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_01_by_SMoKE_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
    condition:
        $a at pe.entry_point
}

rule LTC_v13 {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 }
    condition:
        $a at pe.entry_point
}

rule StarForce_Protection_Driver_Protection_Technology_additional {
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_36x_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76 }
    condition:
        $a at pe.entry_point
}

rule WinZip_SFX {
    strings:
        $a = { 8A CB D3 E7 4F FF 4D D8 0F B7 08 23 FE 3B F9 75 E4 E9 9F FD FF FF FF 45 EC 8B 45 EC 39 45 E0 0F 8D 7F FD FF FF 83 7D DC 00 74 32 83 7D E0 01 74 2C B8 01 00 00 00 EB 27 83 7D D8 00 74 0E FF B5 38 FF FF FF E8 1D 00 00 00 83 C4 04 68 00 00 40 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_110_unregistered_additional {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }
    condition:
        $a at pe.entry_point
}

rule Erdas_LANGIS_Image_graphics_format_Hint_FILE_START {
    strings:
        $a = { 48 45 41 44 37 34 00 00 03 00 }
    condition:
        $a at pe.entry_point
}

rule VMware_ThinApp_V4012866_VMware_20090124 {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 72 13 00 00 2B C3 50 68 00 00 20 46 68 00 60 00 00 68 58 01 00 00 E8 71 FC FF FF E9 DA FC FF FF 55 8B EC 8B 48 3C 83 EC 0C 53 56 57 8D 7C 01 78 8B 0F 85 C9 74 7E 8B 77 04 83 FE 28 72 76 8D 1C 01 8B 53 18 85 D2 74 6C 8B 43 20 3B C1 72 65 8D 14 90 03 F1 3B F2 72 5C 83 65 FC 00 2B C1 03 C3 83 7B 18 00 89 45 F4 76 4B 8B 4D FC 8B 45 F4 8D 04 88 8B 0F 3B 08 77 31 8B 30 FF 75 08 8B C1 89 45 F8 FF 15 2C 30 20 46 8B 4F 04 03 4D F8 8D 44 30 01 3B C1 77 13 2B 75 F8 FF 75 08 03 F3 56 FF 15 28 30 20 46 85 C0 74 12 FF 45 FC 8B 45 FC 3B 43 18 72 B5 33 C0 5F 5E 5B C9 C3 8B 55 FC 39 53 14 76 F1 8B 43 1C 8B 0F 3B C1 72 E8 8D 04 90 8B 57 04 03 D1 8D 70 04 3B D6 72 D9 2B C1 8B 04 18 EB D4 FF 25 5C 14 20 46 00 00 00 00 56 6A 01 FF 74 24 14 6A 00 FF 74 24 18 E8 DC 07 00 00 8B F0 83 C4 10 85 F6 75 04 33 C0 EB 28 68 AB 14 20 46 E8 0B FF FF FF 59 85 C0 74 ED 8B 4C 24 14 68 5C 14 20 46 FF 74 24 10 03 C6 6A 01 C7 01 56 14 20 46 FF D0 5E C2 10 00 }
    condition:
        $a at pe.entry_point
}

rule Themida_1201_Oreans_Technologies {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }
        $b = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Basic_v60_additional {
    strings:
        $a = { FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point
}

rule HideProtect_V10X_SoftWar_Company {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
        $b = { 90 90 90 E9 D8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASProtect_v11_BRS {
    strings:
        $a = { 68 01 }
        $b = { 60 E9 ?? 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE2COM_Method_1 {
    strings:
        $a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule Windows_Write_file_Hint_FILE_START {
    strings:
        $a = { BE 00 00 00 AB 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKZIP_SFX_v11_1989_90_Hint_DOS_EP {
    strings:
        $a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
    condition:
        $a at pe.entry_point
}

rule tELock_051 {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 }
    condition:
        $a at pe.entry_point
}

rule RLPack_117p {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10_beta_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }
    condition:
        $a at pe.entry_point
}

rule DBPE_v210_Ding_Boy {
    strings:
        $a = { EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }
    condition:
        $a at pe.entry_point
}

rule Dev_Cpp_4992_Bloodshed_Software_additional {
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_SYP_additional {
    strings:
        $a = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Cpp_1999 {
    strings:
        $a = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
    condition:
        $a at pe.entry_point
}

rule Themida_Oreans_Technologies_2004_additional {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 }
    condition:
        $a at pe.entry_point
}


rule Petite_12_c1998_Ian_Luck_h_additional {
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24 }
    condition:
        $a at pe.entry_point
}

rule FileShield_additional {
    strings:
        $a = { 50 1E EB ?? 90 00 00 8B D8 }
    condition:
        $a at pe.entry_point
}

rule WWPack32_v1x_additional {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2117_Strongbit_SoftComplete_Development_h {
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
    condition:
        $a at pe.entry_point
}

rule UPX_v103_v104_Laszlo_Markus {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule InterLok_V551_PACE_Anti_Piracy_SignByfly_additional {
    strings:
        $a = { EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic_ {
    strings:
        $a = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }
    condition:
        $a at pe.entry_point
}

rule tElock_v090_additional {
    strings:
        $a = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v27_additional {
    strings:
        $a = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Spalsher_1x_3x_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Cracked_by_Autohack_2_additional {
    strings:
        $a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }
    condition:
        $a at pe.entry_point
}

rule Com4mail_v10_additional {
    strings:
        $a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }
    condition:
        $a at pe.entry_point
}

rule Morphine_V33_Holy_Father_Ratter29A_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v111_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b3_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }
    condition:
        $a at pe.entry_point
}

rule AINEXE_v230_Hint_DOS_EP {
    strings:
        $a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Borland_Delphi_Borland_Cpp {
    strings:
        $a = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }
        $b = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ORiEN_212_A_Fisun {
    strings:
        $a = { E9 5D 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 78 3B }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_153_Stub_engine_171_GlOFF_additional {
    strings:
        $a = { 86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6 }
    condition:
        $a at pe.entry_point
}

rule NsPack_29_North_Star_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_aPLib_Ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_80_additional {
    strings:
        $a = { 3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Upack_V037_V039_Dwing_additional {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Duals_eXe_Encryptor_10b_Dual {
    strings:
        $a = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50 }
        $b = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PowerBASICWin_800_additional {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02 }
    condition:
        $a at pe.entry_point
}

rule HP_48sx_graphics_format {
    strings:
        $a = { 48 50 48 50 34 38 2D 41 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V11_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }
    condition:
        $a at pe.entry_point
}

rule BGI_Stroked_Font_v11 {
    strings:
        $a = { 50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31 }
    condition:
        $a at pe.entry_point
}

rule Upack_v039_final {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_ASPack_212_emadicius_h_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule VX_TibsZhelatin_StormWorm_variant {
    strings:
        $a = { FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8 }
    condition:
        $a at pe.entry_point
}

rule pirit_v15_additional {
    strings:
        $a = { 5B 24 55 50 44 FB 32 2E 31 5D }
    condition:
        $a at pe.entry_point
}

rule SimplePack_1X_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Shrink_v10 {
    strings:
        $a = { 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V314_SetiSoft_Team_Mato_20100705 {
    strings:
        $a = { 50 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 65 00 78 00 65 00 20 00 50 00 72 00 6F 00 74 00 65 00 63 00 74 00 6F 00 72 00 00 00 34 00 08 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 33 00 2E 00 31 00 2E 00 34 00 2E 00 30 }
    condition:
        $a at pe.entry_point
}

rule PowerBASICCC_40_ {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03 }
    condition:
        $a at pe.entry_point
}

rule tElock_v100_additional {
    strings:
        $a = { E9 E5 E2 FF FF }
    condition:
        $a at pe.entry_point
}

rule WinZip_Self_Extractor_22_personal_edition_WinZip_Computing {
    strings:
        $a = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 }
        $b = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
        $c = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule BeRoEXEPacker_v100_LZBRS_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_BJFNT_13_emadicius {
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 }
    condition:
        $a at pe.entry_point
}

rule FSG_V130Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10802_additional {
    strings:
        $a = { 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point
}

rule StarForce_V3X_DLL_StarForce_Copy_Protection_System {
    strings:
        $a = { E8 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2620_V2623_Jitit_Sign_by_fly {
    strings:
        $a = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_v14_osCE {
    strings:
        $a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_430_440_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig4_h_additional {
    strings:
        $a = { C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule TurboChainer_103 {
    strings:
        $a = { BA 24 00 8E DA 8C D3 2B DA D1 E3 D1 E3 D1 E3 D1 E3 FA 8E D2 03 E3 FB B8 24 00 8E D8 1E FC 8D 06 B0 00 83 C0 0C 50 1E BE 80 00 8C C0 8E D8 07 5F 8B 0C 32 ED 51 46 F3 A4 59 1F 00 0E AF 00 1E B4 51 32 C0 CD 21 8E DB BB 2C 00 8B 07 8E D8 33 DB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v133 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }
    condition:
        $a at pe.entry_point
}

rule ASPack_v2001_additional {
    strings:
        $a = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v12_additional {
    strings:
        $a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 }
    condition:
        $a at pe.entry_point
}

rule PocketPC_ARM {
    strings:
        $a = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00 }
        $b = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Packman_0001_Bubbasoft_h_additional {
    strings:
        $a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v14_LITE_BG_Software_Protect_Technologies_h {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }
        $b = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Horse1776_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_DLL_BeRo_Farbrausch {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
        $b = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_R_Incremental_Linker_Version_5128078_MASMTASM {
    strings:
        $a = { 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40 }
    condition:
        $a at pe.entry_point
}

rule Upack_v02_Beta_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
    condition:
        $a at pe.entry_point
}

rule TopSpeed_v301_1989_Hint_DOS_EP {
    strings:
        $a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Extended_Datafile_Version_additional {
    strings:
        $a = { 23 03 45 58 54 44 ?? ?? 3A 03 }
    condition:
        $a at pe.entry_point
}

rule MIDI_Music_file_additional {
    strings:
        $a = { 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54 }
    condition:
        $a at pe.entry_point
}

rule Upack_v030_beta_Dwing {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v015b_additional {
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2x_SoftComplete_Developement {
    strings:
        $a = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule QuickLink_II_Fax_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 51 4C 49 49 46 41 58 20 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_build_0807_dll_Alexey_Solodovnikov_h {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v30_DLL_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1987_additional {
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_LCC_Win32_1x_Anorganix {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_With_CRC_check_Hint_DOS_EP {
    strings:
        $a = { B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule XComp_V097_LZRW_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 9B 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 34 ?? ?? 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V11_Sukhov_Vladimir_ {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
    condition:
        $a at pe.entry_point
}

rule Sun_Icon_Graphics_format {
    strings:
        $a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006710_WFS_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_SCRAMBLER_306_OnToL_additional {
    strings:
        $a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
    condition:
        $a at pe.entry_point
}

rule Exact_Audio_Copy_UnknownCompiler_additional {
    strings:
        $a = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_11_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Alias_PIXVivid_IMG_Graphics_format_additional {
    strings:
        $a = { 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule MASM32_TASM32 {
    strings:
        $a = { 2B C0 50 E8 }
    condition:
        $a at pe.entry_point
}

rule UPXHiT_001_DJ_Siba {
    strings:
        $a = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_037_beta_Dwing_additional {
    strings:
        $a = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT2Family_additional {
    strings:
        $a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1400Beta_Obsidium_Software_SignByfly_20080102_additional {
    strings:
        $a = { EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 }
    condition:
        $a at pe.entry_point
}

rule InstallShield_Stub_2003 {
    strings:
        $a = { 55 8B EC 6A FF 68 C8 3B 42 00 68 ?? B8 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 C0 31 42 00 33 D2 8A D4 89 15 ?? EB 42 00 8B C8 81 E1 FF 00 00 00 89 0D ?? EB 42 00 C1 E1 08 03 CA 89 0D ?? EB 42 00 C1 E8 10 A3 ?? EB 42 00 6A 01 E8 C0 1C 00 00 59 85 C0 75 08 6A }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2312_Jitit_Sign_by_fly_additional {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098b2_tHE_EGOiSTE {
    strings:
        $a = { E9 1B E4 FF FF }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v14_LITE_BG_Software_Protect_Technologies {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v13x_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? ?? 00 64 A0 23 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_BasicPro_Edition_112_Randy_Li_h_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }
    condition:
        $a at pe.entry_point
}

rule Limit_Archive {
    strings:
        $a = { 4C 4D 1A }
    condition:
        $a at pe.entry_point
}

rule RoseTiny_095 {
    strings:
        $a = { 50 53 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 06 50 2B C0 8E C0 85 06 0B EA B8 EB 03 EB FC EA 26 81 36 05 00 D8 83 85 06 1C EA B8 EB 03 EB FC EA 26 81 36 0D 00 0B 9E 85 06 2D EA B8 EB 03 EB FC EA 26 81 36 41 00 BF B4 EB 01 81 58 07 50 B8 EB }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_v04_beta_1_by_Alex_additional {
    strings:
        $a = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v120 {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule Exe_Guarder_v18_Exeiconcom_h {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
        $b = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ProtEXE_211_EXE {
    strings:
        $a = { 9C 9C 58 25 FF 0F 50 9D 9C 58 25 00 F0 3D 00 F0 74 2A 9C 58 25 FF 0F 0D 00 70 50 9D 9C 58 25 00 70 74 19 BA 64 00 B0 AD EB 01 88 EE EB 01 A0 0F 20 00 F8 BA 64 00 B0 AE EB 01 88 EE 9D 1E 06 33 C0 8E D8 FF 36 0C 00 FF 36 0E 00 B8 00 02 A3 0C }
    condition:
        $a at pe.entry_point
}

rule PESpin_v01_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ENIGMA_Protector_Sukhov_Vladimir_additional {
    strings:
        $a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V03_cyberbob_20080312 {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 }
    condition:
        $a at pe.entry_point
}

rule D1NS1G_D1N {
    strings:
        $a = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_PE_loader {
    strings:
        $a = { 8C C8 8E D8 8C 1E 42 00 8C 06 3C 00 8C 06 46 00 8C 06 4A 00 8B DC 83 C3 0F D1 EB D1 EB D1 EB D1 EB 8C D0 03 D8 2B 1E 3C 00 B8 00 4A CD 21 B8 42 FB BB 33 32 CD 2F 83 FB 00 0F 84 00 01 BA 52 00 1E 07 BB 3E 00 B8 00 4B CD 21 0F 83 00 01 8E 06 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v107b {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D B8 03 }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Protect_60 {
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 02 CD 20 BE 00 00 E8 18 00 E8 08 00 1F 8C D8 8E C0 E9 15 00 BB 00 00 B4 00 AC 04 00 AA 4B 75 F9 C3 0E 1F FC 0E 07 8B FE C3 }
    condition:
        $a at pe.entry_point
}

rule Themida_10xx_1800_compressed_engine_Oreans_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        $a at pe.entry_point
}

rule EXEJoiner_v10_additional {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_yodas_cryptor_12_emadicius_additional {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098b1 {
    strings:
        $a = { E9 1B E4 FF }
        $b = { E9 25 E4 FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v098b2 {
    strings:
        $a = { E9 FF FF ?? ?? ?? ?? ?? ?? ?? }
        $b = { E9 1B E4 FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASProtect_10_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 01 00 00 00 90 5D 81 ED ?? ?? ?? 00 BB ?? ?? ?? 00 03 DD 2B 9D }
    condition:
        $a at pe.entry_point
}

rule RECSmall_v102_additional {
    strings:
        $a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable {
    strings:
        $a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_LZMA {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_DLL_additional {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 }
    condition:
        $a at pe.entry_point
}

rule LY_WGKX_V2X_wwwszleyucom_20080122 {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Themida_1920_additional {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_096_tE_additional {
    strings:
        $a = { E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_80 {
    strings:
        $a = { 53 56 8B 44 24 18 0B C0 75 18 8B 4C 24 14 8B 44 24 10 33 D2 F7 F1 8B D8 8B 44 24 0C F7 F1 8B D3 EB 41 8B C8 8B 5C 24 14 8B 54 24 10 8B 44 24 0C D1 E9 D1 DB D1 EA D1 D8 0B C9 75 F4 F7 F3 8B F0 F7 64 24 18 8B C8 8B 44 24 14 F7 E6 03 D1 72 0E 3B 54 24 10 77 08 72 07 }
    condition:
        $a at pe.entry_point
}

rule vfpexeNc_v600_Wang_JianGuo_additional {
    strings:
        $a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point
}

rule _Protector_v1111_DDeM_PE_Engine_v09_DDeM_CI_v092 {
    strings:
        $a = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_Einstein_additional {
    strings:
        $a = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }
    condition:
        $a at pe.entry_point
}

rule UPX_com_additional {
    strings:
        $a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v300_v301_Relocations_pack_additional {
    strings:
        $a = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }
    condition:
        $a at pe.entry_point
}

rule PESpin_07_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_13037_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_099 {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
        $b = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_LTC_13_Anorganix {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V112_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZMA_BeRo_Farbrausch {
    strings:
        $a = { 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
    condition:
        $a at pe.entry_point
}

rule JPEG_Graphics_format_p_description_Hint_FILE_START {
    strings:
        $a = { FF D8 FF FE 00 27 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v150_1_additional {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_v038_Beta_Strip_base_relocation_table_Option_Sign_by_hot_UNP {
    strings:
        $a = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V6X_Dll_Silicon_Realms_Toolworks_20081227 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 D0 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 80 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorIVPbased {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v300_v301_Relocations_pack {
    strings:
        $a = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }
    condition:
        $a at pe.entry_point
}

rule aPack_098_099_t_EXE {
    strings:
        $a = { 1E 06 0E 1F 0E 07 BE 13 00 BF 00 7F 8B CF FC 57 F3 A4 C3 33 FF BE 00 7F B2 80 BD 00 7F 50 A4 BB 10 00 FF D5 73 F8 FF D5 41 73 0F FF D5 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF }
    condition:
        $a at pe.entry_point
}

rule XComp_V098_LZSS_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 E5 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule COM2TXT_103_112 {
    strings:
        $a = { 54 5F 4F 4F 57 57 33 3D 58 58 57 58 35 20 32 50 59 35 77 33 50 5F 2D 6C 2E 50 2D 4B 44 31 45 70 2D 4F 4C 50 5A 2D 70 4A 50 2D 70 77 34 30 50 51 58 35 66 73 50 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 35 46 65 2C 78 50 51 58 2D 3D 2E 50 }
    condition:
        $a at pe.entry_point
}

rule ASPack_100b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 92 1A 44 00 B8 8C 1A 44 00 03 C5 2B 85 CD 1D 44 00 89 85 D9 1D 44 00 80 BD C4 1D 44 }
    condition:
        $a at pe.entry_point
}

rule Code_Virtualizer_V1310_Oreans_Technologies {
    strings:
        $a = { 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Update_CAB_SFX_module_additional {
    strings:
        $a = { E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_0163b {
    strings:
        $a = { EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 6D 23 40 00 52 8B 54 24 08 E8 A5 FD FF FF 89 95 59 2B 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7 }
    condition:
        $a at pe.entry_point
}

rule HackStop_112_EXE {
    strings:
        $a = { 52 1E B4 30 CD 21 86 E0 3D FF 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A E8 7B 06 55 FA 8B EC C7 46 FE 00 00 8B 46 FE 50 9C 16 17 9D FB 58 A9 00 01 74 06 B0 FF B4 4C CD 21 5D E8 41 00 8D E8 E6 06 11 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_151_153_SoftComplete_Development {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_310 {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_22004810_22005314_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A }
    condition:
        $a at pe.entry_point
}

rule AZProtect {
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 }
    condition:
        $a at pe.entry_point
}

rule Packman_0001_bubba_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule Xenocode_Virtual_Application_Studio_Xenocode_20090203 {
    strings:
        $a = { 58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_20a {
    strings:
        $a = { 53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 E8 2F F5 FD 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF }
    condition:
        $a at pe.entry_point
}

rule Crunch_40 {
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V23_LiuXingPing {
    strings:
        $a = { 9C 60 70 61 63 6B 24 40 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Borland_Cpp {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pelles_C_300_400_450_EXE_X86_CRT_LIB {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_14 {
    strings:
        $a = { 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_11 {
    strings:
        $a = { B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_13 {
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule PROTECT_EXECOM_v40_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 81 ED ?? ?? 33 C0 8E D8 8B F0 BF ?? ?? B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Microsoft_Visual_Basic_50_60 {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RE_Crypt_v07x_Crudd_RET_h2_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }
    condition:
        $a at pe.entry_point
}

rule fEaRzCrypter_v10_fEaRz {
    strings:
        $a = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1994_additional {
    strings:
        $a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_07_additional {
    strings:
        $a = { 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v098 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v099 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win16_1991_additional {
    strings:
        $a = { 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v090 {
    strings:
        $a = { EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v092 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v094 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }
    condition:
        $a at pe.entry_point
}

rule deep_CRyPTer_v01c_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 59 8B E9 81 ?? ?? ?? 81 ?? ?? ?? BE ?? ?? 8D ?? ?? ?? 66 ?? ?? 66 ?? ?? 8D ?? ?? ?? 8B D7 8B DF }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_vxx {
    strings:
        $a = { 53 55 56 8B 85 F6 57 B8 75 8B 85 C9 75 33 C0 5F 5E 5D 5B }
        $b = { 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule InstallShield_Archive_Hint_FILE_START {
    strings:
        $a = { 2A AB 79 D8 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_ASM_ {
    strings:
        $a = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v101b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_V1290_Nooby_20090218 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 39 2E 30 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Morphine_12 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
        $b = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _v10_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00 }
    condition:
        $a at pe.entry_point
}

rule Exe_Guarder_v18_Exeiconcom_additional {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_v20_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 60 E8 4F }
    condition:
        $a at pe.entry_point
}

rule Mew_501_NorthFox_HCC {
    strings:
        $a = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }
        $b = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_2xx_compressed_resources_wwwstrongbitcom {
    strings:
        $a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v071 {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }
    condition:
        $a at pe.entry_point
}

rule EP_v01_CoDe_Inside {
    strings:
        $a = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC AA 86 C4 }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_75_Coverpage_additional {
    strings:
        $a = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v01b_MTE {
    strings:
        $a = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }
    condition:
        $a at pe.entry_point
}

rule HA_Archive_Hint_FILE_START {
    strings:
        $a = { 48 41 }
    condition:
        $a at pe.entry_point
}

rule GX_Protector_12_GurueXe {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PeCompact_253_DLL_Slim_Loader_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_vxx_Exeshield_Corp {
    strings:
        $a = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }
    condition:
        $a at pe.entry_point
}

rule WinZip_32_bit_6x {
    strings:
        $a = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }
    condition:
        $a at pe.entry_point
}

rule Compiled_InstallSHIELD_Installation_Script {
    strings:
        $a = { B8 C9 0C 00 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_Lenguaje_Compilador {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Protector_093_CRYPToCRACk {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 }
    condition:
        $a at pe.entry_point
}

rule Inset_Systems_PIX_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 03 00 ?? 00 00 00 20 00 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4093_Dll_SafeNet_SignByfly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D FC 00 74 0F 8B 45 EC 0F AF 45 FC 25 FF FF 00 00 01 45 F0 8B 45 EC 0F AF 45 F8 8B 4D F0 C1 E1 10 81 E1 00 00 FF FF 03 C1 40 89 45 E8 8B 45 E8 8B 4D 08 89 01 C1 6D E8 10 81 65 E8 FF 7F 00 00 66 8B 45 E8 EB 00 5F 5E 5B C9 C3 }
        $b = { 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule XWD_graphics_format_additional {
    strings:
        $a = { 00 00 00 71 00 00 00 07 00 00 00 02 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Packed {
    strings:
        $a = { BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_CrunchPE_Heuristic {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Encrypted_without_selfcheck_Hint_DOS_EP {
    strings:
        $a = { B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6 }
    condition:
        $a at pe.entry_point
}

rule NOTA_Version_11_c_Novitex_1990_Hint_DOS_EP {
    strings:
        $a = { EB ?? 06 1E 33 C0 8E D8 BE ?? ?? 0E 07 BF ?? ?? B9 ?? ?? FC F3 A4 1F 8C D3 BE ?? ?? 8B D4 8E D6 BC ?? ?? 8B F4 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V30_LiuXingPing {
    strings:
        $a = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V500_V5X_Dll_Silicon_Realms_Toolworks {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 }
    condition:
        $a at pe.entry_point
}

rule Vx_Number_One {
    strings:
        $a = { F9 07 3C 53 6D 69 6C 65 3E E8 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v10b_Ashkbiz_Danehkar_h {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10801_additional {
    strings:
        $a = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Cpp_30_1990 {
    strings:
        $a = { 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_300_400_450_EXE_X86_CRT_DLL_additional {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule UPX_Shit_v01_500mhz {
    strings:
        $a = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
        $b = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ANDpakk2_006_by_Dmitry_AND_Andreev_additional {
    strings:
        $a = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_v17_coban2k {
    strings:
        $a = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule NTKrnlPacker_Ashkbiz_Danehkar {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_V13X_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule IBM_IOCA_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 11 D3 A6 FB }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Dongle_V54200_Rainbow_Technologies {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E DF 80 E8 ?? ?? ?? ?? 68 B9 10 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 12 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 07 2A A3 00 E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 88 B5 5B FF E8 ?? ?? ?? ?? 68 B9 30 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V2100_p_Oreans_Technologies_20090917 {
    strings:
        $a = { 83 EC 04 50 53 E8 ?? ?? 00 00 CC 58 8B D8 40 2D ?? ?? ?? ?? 2D ?? ?? ?? ?? 05 ?? ?? ?? ?? 80 3B CC 75 19 C6 03 00 BB 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 50 E8 0A 00 00 00 83 C0 00 89 44 24 08 5B 58 C3 55 8B EC 60 8B 75 08 8B 4D 0C C1 E9 02 8B 45 10 8B 5D 14 EB 08 31 06 01 1E 83 C6 04 49 0B C9 75 F4 61 C9 C2 10 00 }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_v12_Byte_Patch {
    strings:
        $a = { E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54 }
        $b = { E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Krypton_v02_additional {
    strings:
        $a = { 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48 }
    condition:
        $a at pe.entry_point
}

rule Upack_v010_v012Beta_Sign_by_hot_UNP {
    strings:
        $a = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Nullsoft_PIMP_Install_System_v13x_Nullsoft {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD }
    condition:
        $a at pe.entry_point
}

rule CorelPhotoPaint_Image {
    strings:
        $a = { 43 50 54 37 46 49 4C 45 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v301_v305_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_MinGW_GCC_2x {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_vxx {
    strings:
        $a = { E9 9B ?? ?? ?? }
        $b = { 9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3_emadicius {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt32_v102 {
    strings:
        $a = { E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_FORTRAN_additional {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Petite_22_c1998_99_Ian_Luck_h {
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
        $b = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Private_exe_Protector_V25X_V27X_SetiSoft_Team_20080718 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098b1_additional {
    strings:
        $a = { E9 25 E4 FF FF }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Sign_by_hot_UNP {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 }
        $b = { BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NET_DLL_Microsoft_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V13_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1820_p_Oreans_Technologies_Sign_by_fly {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_098_099_x_EXE {
    strings:
        $a = { 1E 06 8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 00 00 05 00 00 0E 50 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1400Beta_Obsidium_Software_SignByfly_20080102 {
    strings:
        $a = { EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 }
        $b = { EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v032_Beta {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 }
    condition:
        $a at pe.entry_point
}

rule UPX_v070_Laszlo_Markus {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h {
    strings:
        $a = { 60 }
        $b = { 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_32Lite_003 {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule VOB_ProtectCD_5 {
    strings:
        $a = { 5F 81 EF BE 40 8B 87 03 C6 57 56 8C A7 FF 10 89 87 5E }
        $b = { 36 3E 26 8A C0 60 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CDS_SS_10_beta1_CyberDoom {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50 }
        $b = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule V10_tjszlqq_20090823 {
    strings:
        $a = { E9 15 AC 00 00 00 00 E9 ED 3A 01 00 00 00 E9 A1 9A 01 00 00 00 E9 CD 76 02 00 00 00 E9 8D FA 01 00 00 00 E9 CB 04 00 00 00 00 E9 A4 9F 00 00 00 00 66 B8 00 02 66 85 C0 0F 85 F0 5E 04 00 00 00 00 00 00 00 00 00 66 B8 00 00 E9 73 8F 02 00 00 00 00 00 00 E9 1A 57 03 00 00 00 E9 35 4E 04 00 00 00 E9 74 9D 00 00 00 00 E9 44 4D 02 00 00 00 E9 9B F2 03 00 00 00 E9 8B 63 03 00 00 00 E9 06 95 01 00 00 00 E9 77 7D 03 00 00 00 B0 02 E9 74 BB 02 00 00 00 00 00 00 00 00 E9 3C E5 03 00 00 00 E9 F4 83 02 00 00 00 E9 9D 9F 00 00 00 00 E9 72 CB 00 00 00 00 E9 88 C2 00 00 00 00 E9 42 3B 04 00 00 00 E9 F4 4C 00 00 00 00 E9 B8 28 04 00 00 00 E9 0F 4F 00 00 00 00 66 83 E8 00 E9 02 F4 00 00 00 00 00 00 00 84 C0 E9 B9 90 01 00 00 00 00 00 00 00 00 E9 78 C5 02 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_200_30X_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
        $b = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_MSVCpp_60_DLL_emadicius {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v30_1985_additional {
    strings:
        $a = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0978_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11 }
    condition:
        $a at pe.entry_point
}

rule tElock_v085f_additional {
    strings:
        $a = { 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02 }
    condition:
        $a at pe.entry_point
}

rule Histogram_graphics_file_Hint_FILE_START {
    strings:
        $a = { 6D 68 77 61 6E 68 00 04 01 02 01 02 }
    condition:
        $a at pe.entry_point
}

rule _MSLRH_v01_emadicius {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule XCR_v012 {
    strings:
        $a = { 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10D_vcasm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule Vx_Backfont900_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Com_Cryptor_BTS_912 {
    strings:
        $a = { B7 00 E8 05 00 83 ED 02 EB 03 5D 55 C3 BF 1A 00 03 FD 8B F7 B9 71 02 AC 02 C7 AA E2 FA }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_BJFNT_13_emadicius_h {
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1032_Ashkbiz_Danehkar_Sign_by_fly_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_v12_Byte_Patch_additional {
    strings:
        $a = { E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_MEW_11_SE_10 {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }
    condition:
        $a at pe.entry_point
}

rule Alias_PIXVivid_IMG_Graphics_format {
    strings:
        $a = { ?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01 }
        $b = { 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_C_v104_Hint_DOS_EP {
    strings:
        $a = { FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB }
    condition:
        $a at pe.entry_point
}

rule Themida_v2018_c2007_Oreans_Technologies {
    strings:
        $a = { 83 EC 04 50 53 E8 00 00 00 00 58 8B D8 2D 00 ?? ?? 00 2D ?? ?? ?? 00 05 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_CrunchPE_Heuristic_Anorganix {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PROTECT_EXECOM_v50_additional {
    strings:
        $a = { 1E 0E 0E 1F 07 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10A_vcasm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v099_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63 }
    condition:
        $a at pe.entry_point
}

rule Mew_10_v10_Eng_Northfox {
    strings:
        $a = { 33 C0 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1334_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 }
    condition:
        $a at pe.entry_point
}

rule CopyMinder_MicrocosmLtd {
    strings:
        $a = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
        $b = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_PESHiELD_025 {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }
    condition:
        $a at pe.entry_point
}

rule EXEStealth_276_Unregistered_WebtoolMaster_additional {
    strings:
        $a = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }
    condition:
        $a at pe.entry_point
}

rule Upack_v039_final_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_21x_dll_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule MEGALITE_v120a_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90 }
    condition:
        $a at pe.entry_point
}

rule eXPressorLight_V1601_CGSoftLabs_20080308 {
    strings:
        $a = { 55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule SPLayer_v008_additional {
    strings:
        $a = { 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule mPack_003_DeltaAziz_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_VBOX_43_MTE {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
    condition:
        $a at pe.entry_point
}

rule Upack_v021Beta_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule Vx_Necropolis_Hint_DOS_EP {
    strings:
        $a = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }
    condition:
        $a at pe.entry_point
}

rule USERNAME_v300_additional {
    strings:
        $a = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PEX_099_emadicius {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule PCIENC_Cryptor_Hint_FILE_START {
    strings:
        $a = { 06 50 43 49 45 4E }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_11_additional {
    strings:
        $a = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }
    condition:
        $a at pe.entry_point
}

rule Trap_114a {
    strings:
        $a = { B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 33 83 C1 FE 83 C2 01 EB ED EB FE EB 25 0D 0A 09 09 09 20 C4 C4 C4 C4 C4 C4 C4 C4 5B 20 54 52 41 50 20 31 2E 31 34 20 5D C4 C4 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_BasicPro_Edition_112_Randy_Li_h {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }
    condition:
        $a at pe.entry_point
}

rule ThinstallVS_v3x_Jitit_Software {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? 00 00 2B C3 50 68 00 00 ?? ?? 68 00 ?? 00 00 68 ?? ?? 00 00 E8 ?? ?? FF FF E9 90 FF FF FF CC CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_V092_Lukas_Fleischer {
    strings:
        $a = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Armadillo_300 {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point
}

rule BamBam_001_additional {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point
}

rule EXEStealth_276_Unregistered_WebtoolMaster {
    strings:
        $a = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }
    condition:
        $a at pe.entry_point
}

rule KenPack_V0X_CHKenCom_20080108 {
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E9 ?? FF FF FF 50 50 FF 35 ?? ?? ?? ?? E9 ?? FF FF FF FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        $a at pe.entry_point
}

rule Naked_Packer_V1X_BigBoote_additional {
    strings:
        $a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Cracked_by_AutoHack_1_Hint_DOS_EP {
    strings:
        $a = { FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC }
    condition:
        $a at pe.entry_point
}

rule ShellModify_01_pll621 {
    strings:
        $a = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_aPlib_043_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }
    condition:
        $a at pe.entry_point
}

rule PECrc32_088_ZhouJinYu {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_yodas_cryptor_12_emadicius {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v07x_v084_additional {
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule X_PEOR_v099b_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40 }
    condition:
        $a at pe.entry_point
}

rule N_Joy_10_NEX {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule PeCompact2_253_276_BitSum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }
    condition:
        $a at pe.entry_point
}

rule Vx_XRCV1015_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_42_DLL {
    strings:
        $a = { 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75 }
    condition:
        $a at pe.entry_point
}

rule Vx_SK_Hint_DOS_EP {
    strings:
        $a = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b6_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_Instant_Stealth_50161 {
    strings:
        $a = { E8 00 00 00 00 58 83 E8 05 50 5F 57 8B F7 81 EF A7 1F 00 00 83 C6 39 BA 00 00 00 00 8B DF B9 0B 00 00 00 8B 06 33 03 89 06 83 C6 04 83 C3 04 E2 F2 42 83 FA 05 74 02 EB E3 6A 11 B6 AC 0D 65 DF D4 35 20 31 19 67 C0 CB 2D BA 36 19 73 C5 DB 70 }
    condition:
        $a at pe.entry_point
}

rule UPX_093_UnHack32_11 {
    strings:
        $a = { 60 BE 00 80 43 00 8D BE 00 90 FC FF C7 87 D0 64 04 00 26 81 74 8D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorIVPbased_additional {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
    condition:
        $a at pe.entry_point
}

rule UPX_093_UnHack32_12 {
    strings:
        $a = { 60 BE 00 A0 43 00 8D BE 00 70 FC FF C7 87 D0 84 04 00 98 C1 DF 2D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_251Beta_2_252_p0ke {
    strings:
        $a = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }
        $b = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RCryptor_v16b_v16c_Vaska_additional {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v155 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v156 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1400Beta_Obsidium_Software_20080102 {
    strings:
        $a = { EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Paint_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 4C 69 6E 53 }
    condition:
        $a at pe.entry_point
}

rule VProtector_10X_vcasm_additional {
    strings:
        $a = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_aPlib_043_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule AutoDesk_Animation_file_Hint_FILE_START {
    strings:
        $a = { 00 12 AF ?? ?? 40 01 C8 }
    condition:
        $a at pe.entry_point
}

rule Scitech_Software_Display_Driver_Hint_FILE_START {
    strings:
        $a = { 56 42 45 41 46 2E 44 52 56 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_v14_osCE_Sing_by_osCppCoDeR_additional {
    strings:
        $a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }
    condition:
        $a at pe.entry_point
}

rule Aluwain_v809_Hint_DOS_EP {
    strings:
        $a = { 8B EC 1E E8 ?? ?? 9D 5E }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_LZMA_430_ap0x_SignByfly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PolyCryptor_by_SMT {
    strings:
        $a = { EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29 }
    condition:
        $a at pe.entry_point
}

rule Upx_v12_Marcus_Lazlo {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_11114_11115_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 3F 1D 00 00 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V23_LiuXingPing_additional {
    strings:
        $a = { 9C 60 70 61 63 6B 24 40 }
    condition:
        $a at pe.entry_point
}

rule PureBasic_4x_DLL_Neil_Hodgson {
    strings:
        $a = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22007121_WFS_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 45 4D 61 69 6C 3A 20 77 66 73 23 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Crunch_5_Fusion_4_Bit_Arts_additional {
    strings:
        $a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_Protector_v10x_2_additional {
    strings:
        $a = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point
}

rule RAR_SFX_Archive_1_Hint_FILE_START {
    strings:
        $a = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V12_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 77 1E 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Pack_v10 {
    strings:
        $a = { FC 8B 35 70 01 40 83 EE 40 6A 40 68 30 }
        $b = { 74 ?? E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_Full_Edition_117_aPLib_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
    condition:
        $a at pe.entry_point
}

rule HSI_JPEG_graphics_file_Hint_FILE_START {
    strings:
        $a = { 68 73 69 31 00 00 }
    condition:
        $a at pe.entry_point
}

rule themida_1005_http58wwworeanscom {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1337_20070623_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_2122_exe_Alexey_Solodovnikov_h {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
        $b = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C }
        $c = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PassCOM_20_PPC {
    strings:
        $a = { BE 00 00 B9 64 01 87 }
    condition:
        $a at pe.entry_point
}

rule Wind_of_Crypt_10_by_DarkPressure_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Microsoft_Visual_Cpp_60 {
    strings:
        $a = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }
        $b = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Windows_Update_CAB_SFX_module {
    strings:
        $a = { E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 }
        $b = { E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Video_Lan_Client {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10802_Hint_WIN_EP {
    strings:
        $a = { 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddiebased1745_additional {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v31_North_Star_h_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v200 {
    strings:
        $a = { 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule SOFTWrapper_for_Win9xNT_Evaluation_Version {
    strings:
        $a = { E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF }
    condition:
        $a at pe.entry_point
}

rule WIBU_Key_V410A_httpwibucomus {
    strings:
        $a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v05_additional {
    strings:
        $a = { 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v13_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_406 {
    strings:
        $a = { 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 8B 16 0E 00 50 B8 38 00 50 CB 8C C3 8C D8 2B C2 8E D8 8E C0 BF 0F 00 B9 10 00 B0 FF F3 AE 47 8B F7 8B C3 2B C2 8E C0 BF 0F 00 B1 04 8B C6 F7 D0 D3 E8 74 09 }
    condition:
        $a at pe.entry_point
}

rule Encapsulated_Postscript_graphics_file_v20_EPSF_12_additional {
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_83_Coverpage {
    strings:
        $a = { FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65 }
        $b = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECrc32_088_ZhouJinYu_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_1 {
    strings:
        $a = { EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_aPlib_043_ap0xnbsp_nbsp_Sign_by_fly_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }
    condition:
        $a at pe.entry_point
}

rule RAZOR_1911_encruptor {
    strings:
        $a = { E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule VMware_ThinApp_V4002200_VMware_20090124 {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 94 1A 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 C8 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v2xx_additional {
    strings:
        $a = { A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v304_betav306v307_additional {
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V1X_Method1_bagie {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }
    condition:
        $a at pe.entry_point
}

rule BeRo_Tiny_Pascal_BeRo {
    strings:
        $a = { E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v143_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point
}

rule CRYPT_Version_17_c_Dismember_additional {
    strings:
        $a = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_v11_additional {
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Shortcut_file_Hint_FILE_START {
    strings:
        $a = { 4C 00 00 00 01 14 02 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V085_V092_MATCODE_Softwarenbsp_nbsp_SignByfly_20080414 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1336_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_MASM32_TASM32_additional {
    strings:
        $a = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2xx_compressed_resources {
    strings:
        $a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Cpp_1999_Anorganix {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp {
    strings:
        $a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 }
    condition:
        $a at pe.entry_point
}

rule PRO_PACK_v208 {
    strings:
        $a = { 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53 }
    condition:
        $a at pe.entry_point
}

rule Noodlecrypt2_rsc_additional {
    strings:
        $a = { EB 01 9A E8 76 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_minimum_protection_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1357_Obsidium_Softwarenbsp_nbsp_SignByfly_20080521 {
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 03 ?? ?? ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8 }
    condition:
        $a at pe.entry_point
}

rule X_PEOR_v099b {
    strings:
        $a = { E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_additional {
    strings:
        $a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Limit_Archive_Hint_FILE_START {
    strings:
        $a = { 4C 4D 1A }
    condition:
        $a at pe.entry_point
}

rule PluginToExe_v102_BoB_BobSoft {
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00 }
        $b = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pohernah_103_by_Kas_additional {
    strings:
        $a = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_apk2_V018_Dmitry_quotANDquot_Andreevnbsp_nbsp_SignByfly_20080731 {
    strings:
        $a = { FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_300_400_450_EXE_X86_CRT_DLL {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_MASM32_TASM32 {
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
        $b = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Basic_Compiler_v560_1982_97_additional {
    strings:
        $a = { 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Basic_50_60 {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PEX_099_Anorganix {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v101b {
    strings:
        $a = { 60 E8 5D 81 ED 3E D9 43 B8 38 03 C5 2B 85 0B DE 43 89 85 17 DE 43 80 BD 01 DE 43 75 15 FE 85 01 DE 43 E8 1D E8 79 02 E8 12 03 8B }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXpressor_v10x_v11x {
    strings:
        $a = { 55 8B EC 81 EC D4 01 ?? ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E }
    condition:
        $a at pe.entry_point
}

rule ProActivate_V10X_TurboPower_Software_Company_ {
    strings:
        $a = { 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53 }
    condition:
        $a at pe.entry_point
}

rule nPack_V115002008_Beta_NEOx {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule MS_Visual_Cpp_v8_h_good_sig_but_is_it_MSVC_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 }
    condition:
        $a at pe.entry_point
}

rule PEShield_02b2 {
    strings:
        $a = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 8D 00 31 00 00 00 00 00 00 00 00 8A 00 00 32 00 80 00 00 80 00 00 88 00 00 00 EB 00 75 ED }
    condition:
        $a at pe.entry_point
}

rule by_Central_Point_Software {
    strings:
        $a = { 50 51 52 56 57 8B EB 1E 2E }
    condition:
        $a at pe.entry_point
}

rule RosAsm_2050a_Betov_additional {
    strings:
        $a = { 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v035_alpha_Dwing {
    strings:
        $a = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }
    condition:
        $a at pe.entry_point
}

rule SoftDefender_V11x_Randy_Li {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_1451_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
    condition:
        $a at pe.entry_point
}

rule Crunch_4_Bit_Arts {
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MS_FORTRAN_Library_19_Hint_DOS_EP {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9 }
    condition:
        $a at pe.entry_point
}

rule Upack_024_027_beta_028_alpha_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_MSVCpp_DLL_Method_4_emadicius {
    strings:
        $a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }
    condition:
        $a at pe.entry_point
}

rule InstallShield_Archive {
    strings:
        $a = { 2A AB 79 D8 }
    condition:
        $a at pe.entry_point
}

rule JExeCompressor_10_by_Arash_Veyskarami {
    strings:
        $a = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0 }
        $b = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEiD_Bundle_v102_BoB_BobSoft {
    strings:
        $a = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point
}

rule MZ0oPE_106b_TaskFall_additional {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 }
    condition:
        $a at pe.entry_point
}

rule Install_Stub_32_bit {
    strings:
        $a = { 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_12B_p0ke {
    strings:
        $a = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8 }
        $b = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CAN_Crunched_ANsi_file {
    strings:
        $a = { CA 01 }
    condition:
        $a at pe.entry_point
}

rule Upack_Unknown_DLL_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule UPX_v062_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 }
    condition:
        $a at pe.entry_point
}

rule Password_protector_my_SMT {
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 }
    condition:
        $a at pe.entry_point
}

rule Exe_Locker_v10_IonIce_ {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v1451_CGSoftLabs_h_additional {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC }
    condition:
        $a at pe.entry_point
}

rule MESS_v120 {
    strings:
        $a = { ?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }
        $b = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPXFreak_v01_Borland_Delphi_HMX0101 {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 }
        $b = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM {
    strings:
        $a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
    condition:
        $a at pe.entry_point
}

rule PE_PROTECT_09 {
    strings:
        $a = { E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
        $b = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DIET_v100_v100d_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_V02X_Ryd {
    strings:
        $a = { BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v285 {
    strings:
        $a = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1357_Obsidium_Software_20080521 {
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 03 ?? ?? ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_PEtite_22_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_ADinjector {
    strings:
        $a = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V24X_25X_Jitit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 }
    condition:
        $a at pe.entry_point
}

rule UPX_Inliner_v10_by_GPcH {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 }
        $b = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrypKey_V56X_Kenonic_Controls_Ltd_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }
    condition:
        $a at pe.entry_point
}

rule AcidCrypt_additional {
    strings:
        $a = { BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 }
    condition:
        $a at pe.entry_point
}

rule nPack_112502006Beta_NEOxuinC_additional {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V121_Dll_aPlib_043_ap0xnbsp_nbsp_SignByfly_20080504 {
    strings:
        $a = { 80 7C 24 08 01 0F 85 74 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Armadillo_300_Anorganix {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_MASM32_ {
    strings:
        $a = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v303_additional {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53 }
    condition:
        $a at pe.entry_point
}

rule FreeCryptor_02_build_002_GlOFF_additional {
    strings:
        $a = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_34_additional {
    strings:
        $a = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_112_Vladimir_Sukhov {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }
        $b = { 55 46 41 C6 D2 C1 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v099 {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Borland_Cpp_1999 {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule XComp_097_098_DLL_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 ?? ?? 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 59 ?? ?? 00 6A ?? ?? 00 79 ?? ?? 00 88 ?? ?? 00 96 ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 }
    condition:
        $a at pe.entry_point
}

rule tElock_v090 {
    strings:
        $a = { ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }
        $b = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v095 {
    strings:
        $a = { E9 59 E4 FF }
        $b = { E9 D5 E4 FF FF 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v096 {
    strings:
        $a = { E9 25 E4 FF FF ?? ?? ?? }
        $b = { E9 59 E4 FF FF 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEZip_v10_by_BaGIE {
    strings:
        $a = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }
        $b = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_EXE32Pack_13x_emadicius_h {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1331_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_1_Hint_DOS_EP {
    strings:
        $a = { EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_18 {
    strings:
        $a = { BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0 }
        $b = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Goats_Mutilator_v16_Goat_e0f {
    strings:
        $a = { E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 }
        $b = { E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule nPack_111502006Beta_NEOx {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
        $b = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HideProtect_1016_SoftWar_Company {
    strings:
        $a = { 90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V13_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20a0 {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }
        $b = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NsPacK_V37_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Alloy_v1x2000 {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Cpp_NE_Loader {
    strings:
        $a = { 30 CD 21 86 E0 2E A3 00 00 3D 00 02 73 00 B8 00 00 8E D8 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_25xx_Jtit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule PECompact_133 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB E8 0E 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V145x_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_Setup_Module_additional {
    strings:
        $a = { 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45 }
    condition:
        $a at pe.entry_point
}

rule CGM_Graphics_format_additional {
    strings:
        $a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }
    condition:
        $a at pe.entry_point
}


rule Armadillo_4000053_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }
    condition:
        $a at pe.entry_point
}

rule PassLock_2000_v10_Eng_Moonlight_Software_additional {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_109_Risco_Software {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 85 DF E8 01 00 00 00 76 83 04 24 06 C3 0F 81 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_021_beta_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v03_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Inno_Installer_v405 {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20b2_v20b3_additional {
    strings:
        $a = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_40 {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ACProtect_109 {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v11_Cyberbob_ {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8? }
    condition:
        $a at pe.entry_point
}

rule Vx_Paybackdropper_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B9 ?? ?? B8 ?? ?? BE ?? ?? 49 78 ?? 30 04 86 E0 D3 C8 4E EB }
    condition:
        $a at pe.entry_point
}

rule Banners_font_file_Hint_FILE_START {
    strings:
        $a = { AB CD 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_02x_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_11x_Randy_Li_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v031a {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
        $b = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule MZ0oPE_106b_TaskFall {
    strings:
        $a = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_v05 {
    strings:
        $a = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_2403_Jitit {
    strings:
        $a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule V_Load_09used_in_Kartz_03 {
    strings:
        $a = { 33 F6 2E F6 06 B0 06 FF 74 12 0E 58 8B D8 81 E3 00 F0 75 08 B1 04 D3 E0 2B F0 D3 EE 06 5B 0E 58 2B C3 B1 04 BB 35 07 8B D3 D3 EB 81 E2 0F 00 74 01 43 2B F3 7D 02 03 F3 03 D8 03 DE B8 00 4A CD 21 73 04 B4 4C CD 21 A1 2C 00 2E A3 05 07 2E 8C }
    condition:
        $a at pe.entry_point
}

rule Packman_V0001_Bubbasoft {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PESHiELD_025_emadicius_additional {
    strings:
        $a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A }
    condition:
        $a at pe.entry_point
}

rule PocketPC_MIB_additional {
    strings:
        $a = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v302_v302a_Extractable_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_10_JunkCode {
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Trap_113_COM {
    strings:
        $a = { 8A F6 87 C9 B8 01 FA BA 45 59 87 C9 E8 00 00 8B FC 33 D2 36 8B 2D 87 DB 81 ED 0F 01 87 D2 44 44 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 02 CD 20 81 F9 E2 03 74 58 83 C1 FE 83 C2 01 EB EE 20 DC DC DC DC DC DC DC DC DC DC DC }
    condition:
        $a at pe.entry_point
}

rule PESpin_V1304_cyberbob_20080310 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 ?? ?? ?? ?? EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_076_Hying_CCG {
    strings:
        $a = { 01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_226_minimum_protection_additional {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB }
    condition:
        $a at pe.entry_point
}

rule UltraPro_V10_SafeNet {
    strings:
        $a = { A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_40_50 {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }
        $b = { EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEiD_Bundle_v104_BoB_BobSoft {
    strings:
        $a = { 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V11X_vcasm {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point
}

rule CubiComp_PictureMaker_graphics_format_green_Hint_FILE_START {
    strings:
        $a = { 26 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_v102_ConquestOfTroycom {
    strings:
        $a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v172_v173 {
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule yodas_Crypter_13_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v09782_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85 }
    condition:
        $a at pe.entry_point
}

rule Can2Exe_v001 {
    strings:
        $a = { 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PIMP_Install_System_v1x {
    strings:
        $a = { 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b3_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1331_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule Video_CD_file_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_pack_GPcH {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 }
        $b = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DxPack_V086_Dxd {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule LamCrypt_v10_LaZaRuS {
    strings:
        $a = { 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Soft_Defender_11x_Randy_Li {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }
    condition:
        $a at pe.entry_point
}

rule SA2_Adlib_Module_music_file {
    strings:
        $a = { 53 41 64 54 }
    condition:
        $a at pe.entry_point
}

rule InterGraph_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 08 09 FE 01 18 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule VProtect_ExeDLL_v1x_ASL {
    strings:
        $a = { 3B C0 74 1C EB 00 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 FF 56 50 72 6F 74 65 63 74 00 }
    condition:
        $a at pe.entry_point
}

rule Adlib_Sample_Audio_file_Hint_FILE_START {
    strings:
        $a = { 47 4F 4C 44 20 53 41 4D 50 4C 45 }
    condition:
        $a at pe.entry_point
}

rule PEiD_3046_624_Six_to_Four_v10_additional {
    strings:
        $a = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }
    condition:
        $a at pe.entry_point
}

rule VPacker_ttui_Sign_by_fly {
    strings:
        $a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
    condition:
        $a at pe.entry_point
}

rule Packman_0001 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 8D A8 }
    condition:
        $a at pe.entry_point
}

rule PESpin_10_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Upack_v033_v034_Beta_Sign_by_hot_UNP_additional {
    strings:
        $a = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
    condition:
        $a at pe.entry_point
}

rule Pksmart_10b_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Windows_Icon_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 00 01 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEBundle_20x_24x_emadicius_additional {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 }
    condition:
        $a at pe.entry_point
}

rule The_Best_Cryptor_FsK_SignByfly {
    strings:
        $a = { EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v190g_Risco_software_Inc_additional {
    strings:
        $a = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Armadillo_300_Anorganix {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_3035_3043_Thinstall_Company_additional {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point
}

rule MZ_Crypt_10_by_BrainSt0rm_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Duals_eXe_Encryptor_10b_Dual_additional {
    strings:
        $a = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Encrypt_10_Liwuyue {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 }
        $b = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MPEG_movie_file_additional {
    strings:
        $a = { 00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_main {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 ?? ?? ?? FF 15 FC 40 40 ?? E8 68 ?? ?? ?? 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 ?? ?? ?? FF 15 FC 40 40 ?? E8 48 ?? ?? ?? 89 EC 31 C0 5D C3 89 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_Virtualization_Suite_3049_3080_Thinstall_Company_additional {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
    condition:
        $a at pe.entry_point
}

rule NFO_10 {
    strings:
        $a = { 60 9C 8D 50 12 2B C9 B1 1E 8A 02 34 00 88 02 42 E2 F7 }
    condition:
        $a at pe.entry_point
}

rule ARJ_Archive {
    strings:
        $a = { 60 EA }
    condition:
        $a at pe.entry_point
}

rule aPack_098_099_COM {
    strings:
        $a = { BE 0D 01 BF 00 7F 8B CF FC 57 F3 A4 C3 BF 00 01 57 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10Demo_SIS_Team_additional {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_09910_additional {
    strings:
        $a = { E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V121build0909_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule with_added_PK_signature {
    strings:
        $a = { C7 ?? ?? ?? ?? ?? 8C D8 05 }
    condition:
        $a at pe.entry_point
}

rule HackStop_099_COM {
    strings:
        $a = { 50 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 EB 02 53 8F 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 69 8F 8B EC BC 03 00 2E 85 06 D8 F6 B8 EB 03 EB FC EA 83 FC 03 74 02 FA F4 2E 85 06 EA F6 B8 EB 03 EB FC EA 33 C0 FA 8E D0 BC }
    condition:
        $a at pe.entry_point
}

rule BamBam_v001_additional {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Trilobytes_RNR_graphics_library_Hint_FILE_START {
    strings:
        $a = { 84 10 ?? ?? ?? ?? ?? ?? ?? 10 }
    condition:
        $a at pe.entry_point
}

rule TaiShanXiangYu_LockSoft_V10_zlocksoft {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8B D5 81 ?? ?? ?? ?? ?? 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_for_Win32_v500_SofProBlagoje_Ceklic_h_additional {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_pack_only_GPcH_additional {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1250_Obsidium_Software_h {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_070_PE {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 EC 01 00 00 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
    condition:
        $a at pe.entry_point
}

rule Vx_Slowload_additional {
    strings:
        $a = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_14x_RISCO_soft_additional {
    strings:
        $a = { 47 53 44 31 02 00 11 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_2736_Jitit {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule PPC_PROTECT_11X_Alexey_Gorchakov_additional {
    strings:
        $a = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v12_NorthfoxHCC_additional {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v33_Silent_Software_Silent_Shield_c2005 {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
        $b = { BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $c = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ZipWorxSecureEXE_v25_ZipWORX_Technologies_LLC_h_additional {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v11_by_cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_215_22X_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10803_additional {
    strings:
        $a = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }
    condition:
        $a at pe.entry_point
}

rule PAVCryptor_Pawning_AntiVirus_Cryptor_masha_dev_additional {
    strings:
        $a = { 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_v01_Teraphy_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 }
    condition:
        $a at pe.entry_point
}

rule ASDPack_v10_asd {
    strings:
        $a = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F }
        $b = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_Scrambler_by_GurueXe {
    strings:
        $a = { 66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Packer_V12_hmimys {
    strings:
        $a = { E8 95 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 ?? ?? ?? ?? E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 ?? ?? ?? ?? 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3 }
    condition:
        $a at pe.entry_point
}

rule Trap_116_117 {
    strings:
        $a = { 8C D0 BB 99 CB 8E D3 33 C9 8E D0 B9 7D 04 EB 03 90 CD 20 E2 F9 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0E 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE F4 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E E3 66 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v1501_Options_Protection_CGSoftLabs_additional {
    strings:
        $a = { 5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0 }
    condition:
        $a at pe.entry_point
}

rule Program_Protector_XP_v10_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1X_NoCompression_SecureEngine_Oreans_Technologies_additional {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_099_100_101_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 00 00 00 00 60 BE AE 00 00 00 8D BE 52 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule Protector_v1111_DDeM_PE_Engine_v09_DDeM_CI_v092 {
    strings:
        $a = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v03_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_090_099_d_s_m_EXE {
    strings:
        $a = { 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD 00 00 33 C9 50 A4 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_VBOX_43_MTE_Anorganix {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_50 {
    strings:
        $a = { 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_Neolite_20_emadicius {
    strings:
        $a = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule MPEG_Video_file_2 {
    strings:
        $a = { 00 00 01 B3 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_DS_ES_not_saved_additional {
    strings:
        $a = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_V07X_hying {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_CAB_SFX_module_additional {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2501_Jitit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule Upack_v030_beta_Dwing_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V11X_ap0x_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_Portions_Copyright_c_198397_Borland_h_additional {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule RCC_II286_v114_hard_Hint_DOS_EP {
    strings:
        $a = { FA BD ?? ?? B2 ?? 50 3F F2 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_30 {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Access_Database_file_Hint_FILE_START {
    strings:
        $a = { 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v198_additional {
    strings:
        $a = { 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 }
    condition:
        $a at pe.entry_point
}

rule XPack_144_EXE {
    strings:
        $a = { 8B EC EB 01 E8 B8 5A 03 FF E0 FA 33 C0 2E 21 06 01 01 8E D0 BC 10 00 2E 8F 06 9E 03 2E 8F 06 A3 03 EB 01 9A 0E BB 93 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1339_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule TASM_MASM {
    strings:
        $a = { E9 E5 E2 FF }
        $b = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SVK_Protector_v132_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_XCR_011_Anorganix {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Dev_Cpp_4992_Bloodshed_Software_ {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule FSG_v130_Eng_dulekxt_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Armadillo_300 {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_ExeSmasher {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point
}

rule SimplePack_121build0909_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V20_Private_Vaska {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF 59 BA ?? ?? ?? ?? F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF C0 0A ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 80 32 ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? ?? 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC }
    condition:
        $a at pe.entry_point
}

rule Pohernah_101_by_Kas {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_Cryptor_13RC_Tom_Commander {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_Microsoft_Visual_Cpp_emadicius_h {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22004616_V22006630_WFS_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule DxPack_V086_Dxd_additional {
    strings:
        $a = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Pack_Master_10_PEX_Clone {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9 }
        $b = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule aPack_v098b_Jibz {
    strings:
        $a = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V18X_V19Xnbsp_Oreans_Technologiesnbsp_nbsp_SignByfly {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9 }
    condition:
        $a at pe.entry_point
}

rule FishPE_V10X_hellfish_Sign_by_fly_additional {
    strings:
        $a = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40 }
    condition:
        $a at pe.entry_point
}

rule PolyBox_D_Anskya_additional {
    strings:
        $a = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }
    condition:
        $a at pe.entry_point
}

rule ASProtect_V2X_Registered_Alexey_Solodovnikov {
    strings:
        $a = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule LGLZ_v104b {
    strings:
        $a = { FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_251Beta_2_252_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }
    condition:
        $a at pe.entry_point
}

rule UPX_v071_v072 {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 60 BE 8D BE 57 83 CD }
        $b = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PROTECT_EXECOM_v50_Hint_DOS_EP {
    strings:
        $a = { 1E 0E 0E 1F 07 }
    condition:
        $a at pe.entry_point
}

rule eXPressorLightV1601_CGSoftLabs_20080308 {
    strings:
        $a = { 55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule HP_48sx_graphics_format_Hint_FILE_START {
    strings:
        $a = { 48 50 48 50 34 38 2D 41 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v1451_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
        $b = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_Borland_Cpp_1999_Anorganix {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule ABC_Cryptor_10_by_ZloY_additional {
    strings:
        $a = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 }
    condition:
        $a at pe.entry_point
}

rule PolyBox_C_Anskya_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v113_additional {
    strings:
        $a = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }
    condition:
        $a at pe.entry_point
}

rule Obsidium_unknown_version {
    strings:
        $a = { EB 01 ?? 50 EB 03 ?? ?? ?? E8 ?? 00 00 00 EB 03 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098_tHE_EGOiSTE_h {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
        $b = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_104b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? 00 B8 ?? ?? ?? 00 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? 00 80 BD 08 9D ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Dev_Cpp_4992_Bloodshed_Software {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D }
    condition:
        $a at pe.entry_point
}

rule WinKript_v10_Mr_Crimson_h {
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_099 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 00 87 DD 8B 85 B4 85 40 00 01 85 23 85 40 00 66 C7 85 20 85 40 00 90 90 BB C0 09 00 00 03 9D B8 85 40 00 03 9D B4 85 40 00 53 53 53 58 2D 8A }
    condition:
        $a at pe.entry_point
}

rule PECompact_098 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 00 87 DD 8B 85 5C 85 40 00 01 85 CB 84 40 00 66 C7 85 C8 84 40 00 90 90 BB A6 09 00 00 03 9D 60 85 40 00 03 9D 5C 85 40 00 53 53 53 58 2D 32 }
    condition:
        $a at pe.entry_point
}

rule Upack_V024_V028_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_v531009_LINK_v369_Hint_DOS_EP {
    strings:
        $a = { 8B E8 8C C0 }
    condition:
        $a at pe.entry_point
}

rule PECompact_092 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 BD 00 00 00 00 B9 02 00 00 00 B0 90 8D BD A5 4F 40 00 F3 AA 01 AD 04 51 40 00 FF B5 00 51 40 00 6A 40 FF 95 38 51 40 00 50 50 2D F7 4F 40 00 89 85 F8 4F 40 00 5F 8D B5 F7 4F 40 00 B9 35 03 00 00 F3 A5 5F 8B D7 }
    condition:
        $a at pe.entry_point
}

rule MaskPE_16_yzkzero_additional {
    strings:
        $a = { 36 81 2C 24 ?? ?? ?? 00 C3 60 }
    condition:
        $a at pe.entry_point
}

rule Virus_Self_Destructor_200 {
    strings:
        $a = { BE 00 00 B9 4C 00 FC 2E 81 34 EA C7 AD 2E 81 34 7E 20 AD E2 F2 81 EE 86 01 1E 06 8E 06 2C 00 33 FF 33 C0 26 3A 05 74 07 B9 FF FF F2 AE EB F4 83 C7 03 8B D7 06 1F 1E 52 B8 00 3D CD 21 72 17 8B D8 B4 3F B9 18 00 0E 1F 56 8B FE 81 C6 9C 01 8B }
    condition:
        $a at pe.entry_point
}

rule Crinkler_V03_V04_Rune_LHStubbe_and_Aske_Simon_Christensen_additional {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_v405d_v410d_v415d {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Basic_Edition_aPLib_or_LZMA_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule DiskDupe_c_MSD_Configuration_file_Hint_FILE_START {
    strings:
        $a = { 4D 53 44 20 44 61 74 61 20 56 65 72 73 }
    condition:
        $a at pe.entry_point
}

rule ASPack_107b_Solodovnikov_Alexey {
    strings:
        $a = { 90 75 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule RLP_v073beta_ap0x_h {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }
    condition:
        $a at pe.entry_point
}

rule quote {
    strings:
        $a = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point
}

rule DiskDupe_c_MSD_Users_file {
    strings:
        $a = { 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule FASM_v15x_additional {
    strings:
        $a = { 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Morphine_12_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_018_by_Dmitry_quotANDquot_Andreev {
    strings:
        $a = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule Install_Shield_2000 {
	meta:
		author = "PEiD"
		description = "Microsoft Visual C++ 5.0"
		group = "15"
		function = "16"
	strings:
		$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 }
	condition:
		$a0 at pe.entry_point
}

rule SimbiOZ_Poly_21_Extranger {
    strings:
        $a = { 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt32_102_randomkilla_and_acpizer {
    strings:
        $a = { E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21 }
    condition:
        $a at pe.entry_point
}

rule Packanoid_Arkanoid {
    strings:
        $a = { BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 }
    condition:
        $a at pe.entry_point
}

rule CI_Crypt_V01_FearlesS_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PEBundle_02_3x_emadicius {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule CreateInstall_v200335_additional {
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
    condition:
        $a at pe.entry_point
}

rule RatPacker_Glue_stub {
    strings:
        $a = { 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF }
        $b = { 40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PassLock_2000_v10_Eng_Moonlight_Software {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }
        $b = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Soft_Defender_v10_v11_additional {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Ionic_Wind_Software {
    strings:
        $a = { 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_MASM32_additional {
    strings:
        $a = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_103_A_Fisun {
    strings:
        $a = { E8 FD 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5B EB 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v71_DLL {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC }
        $b = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CRYPTCOM_by_unknown {
    strings:
        $a = { BE 00 01 56 B9 00 00 C7 04 00 00 C6 44 02 00 81 34 00 93 46 46 E2 F8 31 F6 31 C9 C3 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_DLL_Laszlo_Markus {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1X_Oreans_Technologies {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ActiveMARK_5x_Trymedia_SystemsInc {
    strings:
        $a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
        $b = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sphinx_C_v_19_Hint_DOS_EP_additional {
    strings:
        $a = { EB ?? 31 C0 8E C0 26 C7 06 ?? ?? ?? ?? 26 8C 0E ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_444a_public_build_Silicon_Realms_Toolworks_h_additional {
    strings:
        $a = { 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF }
    condition:
        $a at pe.entry_point
}

rule yC_v13_by_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22007411_V22008610_WFS_20080610 {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Scodl_Graphics_format {
    strings:
        $a = { E0 01 ?? 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_Bczi_Gor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule ocBat2Exe_10_OC {
    strings:
        $a = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_NorthStar_PE_Shrinker_13_Anorganix {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PolyEnE_001p_by_Lennart_Hedlund_ {
    strings:
        $a = { 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule Aluwain_v809_additional {
    strings:
        $a = { 8B EC 1E E8 ?? ?? 9D 5E }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v13_CGSoftLabs_h_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }
    condition:
        $a at pe.entry_point
}

rule KByS_Packer_v028 {
    strings:
        $a = { 68 ?? ?? ?? 00 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v103b {
    strings:
        $a = { 60 E8 5D 81 ED CE 3A 44 B8 C8 3A 44 03 C5 2B 85 B5 3E 44 89 85 C1 3E 44 80 BD AC 3E }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_v1111 {
    strings:
        $a = { EB 02 ?? ?? E8 E7 1C 00 00 }
    condition:
        $a at pe.entry_point
}

rule Morphine_12 {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ASProtect {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_DLL_minimum_protection_wwwstrongbitcom {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C }
    condition:
        $a at pe.entry_point
}

rule with_added_PK_signature_additional {
    strings:
        $a = { C7 ?? ?? ?? ?? ?? 8C D8 05 }
    condition:
        $a at pe.entry_point
}

rule PPC_PROTECT_11X_Alexey_Gorchakov {
    strings:
        $a = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1800_additional {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_290_300_400_DLL_X86_CRT_LIB_additional {
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_v254_Teggo {
    strings:
        $a = { ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
        $b = { 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stranik_13_ModulaCPascal {
    strings:
        $a = { E9 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D }
        $b = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_Virtualization_Suite_3049_3080_Thinstall_Company {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pack_10 {
    strings:
        $a = { EB 08 00 00 00 00 00 00 00 00 2E 8C 1E 06 00 2E 8C 06 08 00 8C C3 83 C3 10 8C C8 8E D8 BE 52 00 FC AD 3D FF FF 75 0B AD 3D FF FF 74 0C 03 C3 8E C0 AD 8B F8 26 01 1D EB E8 2E 8E 06 08 00 2E 8E 1E 06 00 8B C3 2E 03 06 04 00 50 2E A1 02 00 50 }
    condition:
        $a at pe.entry_point
}

rule Upack_v021_Beta_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule Packman_v10_Brandon_LaCombe {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B }
    condition:
        $a at pe.entry_point
}

rule FishPE_V11X_hellfish_SignByfly {
    strings:
        $a = { 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 18 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C2 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 E0 }
        $b = { 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PC_Shrinker_v071_additional {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }
    condition:
        $a at pe.entry_point
}

rule Pe123_200644 {
    strings:
        $a = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACKs_PE_Protector_V092_Lukas_Fleischer_additional {
    strings:
        $a = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_16_coban2k {
    strings:
        $a = { 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_v405_v406_additional {
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }
    condition:
        $a at pe.entry_point
}

rule Hyper_Archive_Hint_FILE_START {
    strings:
        $a = { 1A 48 50 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_Component {
    strings:
        $a = { 55 89 E5 83 EC 04 83 }
        $b = { C3 E9 ?? ?? ?? FF 8D 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXEStealth_275_WebtoolMaster {
    strings:
        $a = { 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1334_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 }
        $b = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V115_V117_Dll_ap0x_Sign_by_fly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
    condition:
        $a at pe.entry_point
}

rule XPack_167 {
    strings:
        $a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2xx_max_compressed_resources_wwwstrongbitcom {
    strings:
        $a = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PiMP_Install_System_1x {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 }
    condition:
        $a at pe.entry_point
}

rule Upack_V010_V012_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 }
    condition:
        $a at pe.entry_point
}

rule MCLock_v12_v13_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 90 90 90 FA 29 C0 8E C0 26 C6 06 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V25_V26_NsPacK_Private_additional {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10_beta_Spy_Instructor {
    strings:
        $a = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_aPlib_043_ap0x_Sign_by_fly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_11_Northfox {
    strings:
        $a = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_2_PK7Tjrvx_additional {
    strings:
        $a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_111_Method_2NT_bagieTMX {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }
    condition:
        $a at pe.entry_point
}

rule TIFF_Graphics_file_IBM {
    strings:
        $a = { 49 49 2A }
    condition:
        $a at pe.entry_point
}

rule Upack_V037_Dwing_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10 }
    condition:
        $a at pe.entry_point
}

rule Borland_C_Borland_Builder {
    strings:
        $a = { 3B CF 76 05 2B CF FC F3 AA 59 }
    condition:
        $a at pe.entry_point
}

rule Escargot_01_by_ueMeat {
    strings:
        $a = { EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50 }
        $b = { EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Hitachi_Raster_Format_graphics_format {
    strings:
        $a = { 43 41 44 43 2F 4B 52 20 52 53 54 }
    condition:
        $a at pe.entry_point
}

rule Windows_PIF_file_Hint_FILE_START {
    strings:
        $a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 02 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_tElock_061_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Patch_Creation_Wizard_12_Byte_Patch {
    strings:
        $a = { E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 }
    condition:
        $a at pe.entry_point
}

rule ASPack_102b_or_10803 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Morphine_12_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_REALBasic {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule NsPack_14_by_North_Star_Liu_Xing_Ping {
    strings:
        $a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_102_by_Kas_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_pack_only_GPcH_ {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0? }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v14_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encruptor_v113_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V12003318_V12003518_WFS_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Adys_Glue_110_Hint_DOS_EP {
    strings:
        $a = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }
    condition:
        $a at pe.entry_point
}

rule Upack_020_beta_Dwing_additional {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_FSG_10_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point
}

rule tElock_v071 {
    strings:
        $a = { 60 E8 ED 10 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule tElock_v070 {
    strings:
        $a = { 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v55_Unit_Hint_FILE_START {
    strings:
        $a = { 54 50 55 36 00 }
    condition:
        $a at pe.entry_point
}

rule nPack_V115002008_Beta_NEOx_20080217 {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule VX_TibsZhelatin_StormWorm_variant_additional {
    strings:
        $a = { FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8 }
    condition:
        $a at pe.entry_point
}

rule PowerBASICCC_30x_additional {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Profiler_Areas_file_Hint_FILE_START {
    strings:
        $a = { 54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule Copy_Protector_v20_Hint_DOS_EP_additional {
    strings:
        $a = { E9 ?? ?? 50 53 51 52 1E 06 57 E8 ?? ?? 5F 83 EF ?? B4 ?? 1E 0E 1F }
    condition:
        $a at pe.entry_point
}

rule AntiDote_1214_SE_DLL_SIS_Team {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v30xx_additional {
    strings:
        $a = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }
    condition:
        $a at pe.entry_point
}

rule ICrypt_10_by_BuGGz_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_1992_09 {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Embed_PE_v113_cyclotron_additional {
    strings:
        $a = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Private_Exe_Protector_1x_setisoft_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Apex_30_alpha_500mhz {
    strings:
        $a = { 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule Petite_v21_2_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v273_additional {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 77 0C 00 00 90 8D BD 61 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule RLPack_119_Basic_Edition {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 ?? ?? 00 00 EB 0C }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_Debug_Version {
    strings:
        $a = { 6A 68 E8 BF 8B C7 E8 89 65 8B F4 89 3E 56 FF 15 8B 4E 89 0D 8B 46 }
        $b = { 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Soft_Defender_11x_Randy_Li_additional {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v045 {
    strings:
        $a = { ?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40 }
        $b = { BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_SHiELD_02_additional {
    strings:
        $a = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_bartxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v211d {
    strings:
        $a = { 60 E8 03 ?? ?? ?? E9 EB 04 5D 45 55 C3 E8 01 ?? ?? ?? EB 5D BB ED FF FF FF 03 DD 81 }
        $b = { 60 E8 02 00 00 00 EB 09 5D 55 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_V1363_Obsidium_Softwarenbsp_nbsp_SignByfly_20080730 {
    strings:
        $a = { EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v211b {
    strings:
        $a = { 60 E8 02 ?? ?? ?? EB 09 5D 55 81 ED 39 39 44 ?? C3 E9 59 }
        $b = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v211c {
    strings:
        $a = { 60 E8 02 ?? ?? ?? EB 09 5D }
        $b = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrypKey_v5_v6_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50 }
    condition:
        $a at pe.entry_point
}

rule DOS_Device_Driver_Hint_DOS_EP {
    strings:
        $a = { FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_aPlib_043_ap0x_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Protect_Shareware_V11_eCompserv_CMS {
    strings:
        $a = { 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 }
        $b = { 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_1311_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_GCC_v34X {
    strings:
        $a = { 55 89 E5 83 EC ?? C7 04 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 8D B4 26 ?? ?? ?? ?? 55 89 E5 83 EC ?? C7 04 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 8D B4 26 ?? ?? ?? ?? 55 8B 0D ?? ?? ?? ?? 89 E5 5D FF E1 8D 74 26 ?? 55 8B 0D ?? ?? ?? ?? 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? ?? ?? 90 90 90 90 90 90 90 53 89 C1 0F B6 19 80 FB ?? 74 34 90 8D 74 26 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PC_Guard_4xx_emadicius_h {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZBRR_BeRo_Farbrausch {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point
}

rule RAR_SFX_Archive_1_additional {
    strings:
        $a = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Cpp_19901992_additional {
    strings:
        $a = { B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule EXE_joiner_Amok {
    strings:
        $a = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v71_DLL_Debug {
    strings:
        $a = { 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00 }
        $b = { 55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACProtect_141_AntiCrack_Software_additional {
    strings:
        $a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30 }
    condition:
        $a at pe.entry_point
}

rule Trap_114 {
    strings:
        $a = { 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA B9 E8 03 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 05 00 CD 21 EB 6E 90 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E E3 66 3D 00 00 }
    condition:
        $a at pe.entry_point
}

rule Trap_115 {
    strings:
        $a = { B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 0C 00 CD 21 EB 73 90 EA 00 00 FF FF EB F9 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C }
    condition:
        $a at pe.entry_point
}

rule AHpack_01_FEUERRADER_additional {
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_DLL_Debug {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Compiled_Datafile {
    strings:
        $a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v101_Ashkbiz_Danehkar_h {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UCOMCRY_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 60 06 FA E4 64 0C 40 E6 64 B8 ?? ?? 8E C0 26 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC1_additional {
    strings:
        $a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point
}

rule Turbo_or_Borland_Pascal_v70_additional {
    strings:
        $a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }
    condition:
        $a at pe.entry_point
}

rule PE_PACK_v10_by_ANAKiN_1998_additional {
    strings:
        $a = { 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V22X_V24X_StrongBit_Technology_SignByfly {
    strings:
        $a = { E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V2736_Jitit {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 }
    condition:
        $a at pe.entry_point
}

rule PE_Protect_09_by_Cristoph_Gabler_1998 {
    strings:
        $a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        $a at pe.entry_point
}

rule Unknown_by_SMT_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }
    condition:
        $a at pe.entry_point
}

rule Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200_additional {
    strings:
        $a = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_18_additional {
    strings:
        $a = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1350_Obsidium_Software_additional {
    strings:
        $a = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cue_V80 {
    strings:
        $a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
    condition:
        $a at pe.entry_point
}

rule Vx_Involuntary1349_additional {
    strings:
        $a = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v098_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }
    condition:
        $a at pe.entry_point
}

rule Vx_XPEH4768_additional {
    strings:
        $a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_206 {
    strings:
        $a = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56 }
    condition:
        $a at pe.entry_point
}

rule CorelDraw_8_CDR_Graphics_format_additional {
    strings:
        $a = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1300_Obsidium_Software_h {
    strings:
        $a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_OS2_FORTRAN_Compiler_1989_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_V101_BoB_BobSoft {
    strings:
        $a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT2Family {
    strings:
        $a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
    condition:
        $a at pe.entry_point
}

rule CauseWay_DOS_Extender_v325_additional {
    strings:
        $a = { FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07 }
    condition:
        $a at pe.entry_point
}

rule xPEP_03x_xIkUg {
    strings:
        $a = { 55 53 56 51 52 57 E8 16 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule REC_C0ded_by_ROSE_Hint_DOS_EP {
    strings:
        $a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule DrWeb_Virus_Finding_Engine_InSoft_EDV_Systeme {
    strings:
        $a = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }
    condition:
        $a at pe.entry_point
}

rule PeCompact_253_DLL_BitSum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v20 {
    strings:
        $a = { 50 6A E8 FF FF BA 52 89 05 89 42 04 E8 5A 58 E8 C3 55 8B EC 33 }
        $b = { E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HA_Archive {
    strings:
        $a = { 48 41 }
    condition:
        $a at pe.entry_point
}

rule The_Guard_Library {
    strings:
        $a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v29 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_v2460_Jitit_additional {
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }
    condition:
        $a at pe.entry_point
}

rule HQR_data_file_additional {
    strings:
        $a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule UNITA3_tm_by_Sanitary_Equipment_Research_additional {
    strings:
        $a = { E8 ?? ?? 4D 5A 3E }
    condition:
        $a at pe.entry_point
}

rule RLPack_V121_LZMA_430_ap0x_20080504 {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_TravJack883_additional {
    strings:
        $a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v1x_Modified_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule A3E_TXT2COM_additional {
    strings:
        $a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }
    condition:
        $a at pe.entry_point
}

rule yzpack_V112_UsAr {
    strings:
        $a = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_v15b3 {
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_274_additional {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v220 {
    strings:
        $a = { 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule PackItBitch_10_archphase {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V115_V117_LZMA_430_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14 }
    condition:
        $a at pe.entry_point
}

rule Virogen_Crypt_v075_Virogen {
    strings:
        $a = { 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 }
    condition:
        $a at pe.entry_point
}

rule SDProtect_Randy_Li_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v1451_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
        $b = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_V03_cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 }
    condition:
        $a at pe.entry_point
}

rule RSCs_Process_Patcher_151_additional {
    strings:
        $a = { E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v310_additional {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01 }
    condition:
        $a at pe.entry_point
}

rule PIRIT_v15_Hint_DOS_EP {
    strings:
        $a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Vx_Number_One_additional {
    strings:
        $a = { F9 07 3C 53 6D 69 6C 65 3E E8 }
    condition:
        $a at pe.entry_point
}

rule Safedisc_V450000_Macrovision_Corporation_20080117 {
    strings:
        $a = { 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ?? ?? ?? FF 10 61 5D EB 47 80 7C 24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ?? 89 4C 24 04 59 EB 29 50 B8 FD ?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04 FF D0 58 B8 25 ?? ?? ?? FF 30 C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74 05 E9 91 FE FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule tElock_v099_Special_Build_heXer_forgot {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
        $b = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Keypress1212_additional {
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_Dll_main_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule VProtect_v1x_ASL {
    strings:
        $a = { 3B C0 74 1C EB 00 DB 2D ?? ?? ?? 00 FF FF FF FF FF FF FF FF 3D 40 FF 56 50 72 6F 74 65 63 74 00 ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Maked_by_Graphic_WorkShop_Self_Displayer_v70_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 2E C7 06 ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43 2E }
    condition:
        $a at pe.entry_point
}

rule KByS_V028_DLL_shoooo_Sign_by_fly {
    strings:
        $a = { B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20b4_additional {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 }
    condition:
        $a at pe.entry_point
}

rule KGB_SFX_additional {
    strings:
        $a = { 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        $a at pe.entry_point
}

rule CERBERUS_v20_Hint_DOS_EP {
    strings:
        $a = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule PMODEW_v112_116_121_133_DOS_extender_additional {
    strings:
        $a = { FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v274 {
    strings:
        $a = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 }
        $b = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 91 0C 00 00 90 8D BD 38 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE_Stealth_v272 {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v273 {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 }
        $b = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 77 0C 00 00 90 8D BD 61 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE_Stealth_v271 {
    strings:
        $a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }
    condition:
        $a at pe.entry_point
}

rule Amiga_IFFILBM_Graphics_format {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Basic_v10_1987_additional {
    strings:
        $a = { 2E 8C ?? ?? ?? 2E C7 }
    condition:
        $a at pe.entry_point
}

rule PEiD_3376_32Lite_v003a {
    strings:
        $a = { 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule Vx_Uddy2617_additional {
    strings:
        $a = { 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98 }
    condition:
        $a at pe.entry_point
}

rule WWPack32_v100_v111_v112_v120 {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_75_Coverpage {
    strings:
        $a = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80 }
    condition:
        $a at pe.entry_point
}

rule LOCK98_V10028_keenvim {
    strings:
        $a = { 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08 }
    condition:
        $a at pe.entry_point
}

rule NSPack_3x_Liu_Xing_Ping_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D }
    condition:
        $a at pe.entry_point
}

rule DotFix_NiceProtect_vna_additional {
    strings:
        $a = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_113_cyclotron_additional {
    strings:
        $a = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v184_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Vx_SK_additional {
    strings:
        $a = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Registration_file_v11 {
    strings:
        $a = { 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Registration_file_v10 {
    strings:
        $a = { 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_V0760_V0765_hying {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_DSES_not_saved_Hint_HDR_FILESIZE_16 {
    strings:
        $a = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }
    condition:
        $a at pe.entry_point
}

rule vcasm_10_11_vcasm {
    strings:
        $a = { EB 01 9A 60 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V071a_V075b_MATCODE_Softwarenbsp_nbsp_SignByfly_20080310 {
    strings:
        $a = { 57 56 53 51 52 55 E8 10 00 00 00 E8 7A 00 00 00 5D 5A 59 5B 5E 5F E9 84 01 00 00 E8 00 00 00 00 58 05 84 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 AC 0A C0 74 37 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1E F6 C1 40 75 0A 8B C8 2B C0 F3 AA 75 FC EB D9 8B D6 8B CF 03 F0 E8 8F 00 00 00 03 F8 EB CA 8B C8 F3 A4 75 FC EB C2 C3 E8 00 00 00 00 5F 81 C7 71 FF FF FF B0 E9 AA B8 9A 01 00 00 AB 2B FF E8 00 00 00 00 58 05 FE 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 53 8B 30 03 F0 2B F2 8B EE 8B C2 8B 45 3C 03 C5 8B 48 34 2B CD 74 3D E8 00 00 00 00 58 05 DD 00 00 00 8B 10 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_102_DLL_BoB_BobSoft {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Pe_Ninja_pDzA_kRAker_TNT_additional {
    strings:
        $a = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule PEiD_3394_32Lite_v003a_additional {
    strings:
        $a = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32_additional {
    strings:
        $a = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_Dll_LZMA_430_ap0x_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v14_LITE_BG_Software_Protect_Technologies_additional {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v105b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }
    condition:
        $a at pe.entry_point
}

rule Vprotect_204110505_CoooLie {
    strings:
        $a = { 8D BF FF FF FF FF 66 87 F9 60 61 66 87 F9 8D BF 01 00 00 00 F7 D2 9C 9D F7 D2 8B FF 8D AD F6 FF FF FF 66 52 8D 9B F9 FF FF FF F6 D1 66 8B FF F6 D1 8D 9B 07 00 00 00 66 5A 8D AD 0A 00 00 00 8D AD E1 FF FF FF 66 F7 D0 55 F7 D6 8D AD EB FF FF FF 8B FF 8D AD 15 00 00 00 F7 D6 5D 66 F7 D0 8D AD 1F 00 00 00 66 52 66 5A 8B 67 28 8B ED 61 66 57 66 5F 52 5A 9D 66 50 F6 D4 F6 D4 66 58 F6 D1 8D 9B E4 FF FF FF 8D AD E7 FF FF FF 8D 89 EF FF FF FF 55 5D 8D 89 11 00 00 00 8D AD 19 00 00 00 8D 9B 1C 00 00 00 F6 D1 60 8A C9 61 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16d_Vaska_additional {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 }
    condition:
        $a at pe.entry_point
}

rule PGMPACK_v014_Hint_DOS_EP {
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_5_Portions_Copyright_c_198399_Borland_h_additional {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v029_Beta_v031_Beta_Sign_by_hot_UNP {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule DBPE_v233 {
    strings:
        $a = { EB 20 40 9C 55 57 56 52 51 53 9C E8 5D 81 }
        $b = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VcAsm_Protector_VcAsm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v29_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_ASPack_212_emadicius_additional {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_Keys_ShellClient_Library_V1211_SafeNet_Inc_20090524 {
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 53 56 57 85 C0 0F 85 A3 18 00 00 A1 ?? ?? ?? ?? 33 FF BB 01 00 00 00 3B C7 89 1D ?? ?? ?? ?? 0F 85 6C 07 00 00 75 03 74 01 ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 81 7C 24 3C 7C 03 7D 01 E8 9B 83 FF FF 7E 03 7F 01 ?? 89 1D ?? ?? ?? ?? 72 03 73 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 7C 24 28 75 03 74 01 A1 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 A3 ?? ?? ?? ?? 7C 03 7D 01 ?? 39 3D ?? ?? ?? ?? 74 17 75 03 74 01 ?? 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B C1 A3 ?? ?? ?? ?? 75 03 74 01 ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_additional {
    strings:
        $a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_303_305_Blagoje_Ceklic {
    strings:
        $a = { 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_20_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 }
    condition:
        $a at pe.entry_point
}

rule D1S1G_v11_Beta_pp_Scrambled_EXE_D1N_additional {
    strings:
        $a = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22004616_V22006630_WFS_SignByfly {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_440_Silicon_Realms_Toolworks_h_additional {
    strings:
        $a = { 30 31 2E 30 31 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V22X_softcompletecom_ {
    strings:
        $a = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }
    condition:
        $a at pe.entry_point
}

rule unknown_jac {
    strings:
        $a = { 55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3 }
    condition:
        $a at pe.entry_point
}

rule PS_AdobeFont_v10_additional {
    strings:
        $a = { 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A }
    condition:
        $a at pe.entry_point
}

rule Vx_Sonik_Youth {
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V06_SMoKE_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
    condition:
        $a at pe.entry_point
}

rule AHpack_01_FEUERRADER {
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V11_cyberbobnbsp_nbsp_SignByfly_20080311 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB }
    condition:
        $a at pe.entry_point
}

rule DZA_Patcher_v13_DZA {
    strings:
        $a = { EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 }
        $b = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
        $c = { EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Private_EXE_v20a_additional {
    strings:
        $a = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D }
    condition:
        $a at pe.entry_point
}

rule Wise_Installer_Stub {
    strings:
        $a = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
        $b = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V118_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 }
    condition:
        $a at pe.entry_point
}

rule UPX_com_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }
    condition:
        $a at pe.entry_point
}

rule Vx_KBDflags1024 {
    strings:
        $a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_Sukhov_Vladimir {
    strings:
        $a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_10 {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB 03 FF CD 20 56 57 55 89 A3 10 20 00 00 8B EB 80 BB BF 1F 00 00 01 0F 84 AB 17 00 00 C6 83 BF 1F 00 00 01 80 BB E6 1F 00 00 00 75 26 8B 83 CC 1F 00 00 53 2B D8 EB 02 CD 20 EB 03 FF }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v112_v115_v120_1_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule DIET_v144_v145f {
    strings:
        $a = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 }
    condition:
        $a at pe.entry_point
}

rule RAR_SFX {
    strings:
        $a = { E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90 }
    condition:
        $a at pe.entry_point
}

rule Fusion_10_jaNooNi_additional {
    strings:
        $a = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_3x {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V101_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_OS2_FORTRAN_Compiler_1989 {
    strings:
        $a = { B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v1051_additional {
    strings:
        $a = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule Upack_V021_Dwing_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEZip_v10_by_BaGIE_additional {
    strings:
        $a = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }
    condition:
        $a at pe.entry_point
}

rule UPX_v062_Hint_WIN_EP {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZBRS_BeRo_Farbrausch {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v25_Retail_Bitsum_Technologies_ {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule AverCryptor_10_os1r1s_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 }
    condition:
        $a at pe.entry_point
}

rule VIRUS_I_WormBagle_additional {
    strings:
        $a = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_DLL_minimum_protection {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87 }
    condition:
        $a at pe.entry_point
}

rule Setup2Go_Installer_Stub_additional {
    strings:
        $a = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_11_CGSoftLabs_additional {
    strings:
        $a = { E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_V200_V290_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional {
    strings:
        $a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule PuNkMoD_1x_PuNkDuDe {
    strings:
        $a = { 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C }
    condition:
        $a at pe.entry_point
}

rule Netopsystems_FEAD_Optimizer_additional {
    strings:
        $a = { E8 00 00 00 00 58 BB 00 00 40 00 8B }
    condition:
        $a at pe.entry_point
}

rule NsPack_31_Liu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_LZMA_430_ap0xnbsp_nbsp_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT4Family_additional {
    strings:
        $a = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_04_Hint_DOS_EP {
    strings:
        $a = { BC ?? ?? C3 2E FF 2E ?? ?? CF }
    condition:
        $a at pe.entry_point
}

rule Xorer_v10_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BE ?? ?? 8B FE B9 ?? ?? 33 DB 80 ?? ?? AC 32 C3 AA E2 }
    condition:
        $a at pe.entry_point
}

rule tElock_v060_additional {
    strings:
        $a = { E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_DxPack_10 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_DLL_BeRo_Farbrausch_additional {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v210b2 {
    strings:
        $a = { 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule DOS32_v33_DOS_Extender_and_Loader {
    strings:
        $a = { 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}


rule WinRAR_32_bit_SFX_Module_WinRar {
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Setup2Go_Installer_Stub {
    strings:
        $a = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2312_Jitit {
    strings:
        $a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule tElock_v080_additional {
    strings:
        $a = { 60 E8 F9 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v150_Device_driver_compression_Hint_DOS_EP {
    strings:
        $a = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }
    condition:
        $a at pe.entry_point
}

rule Shegerd_Dongle_V478_MSCo_ {
    strings:
        $a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Configuration_File {
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule ASPack_v102b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }
    condition:
        $a at pe.entry_point
}

rule FSG_v13_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_11_MTE_Solodovnikov_Alexey {
    strings:
        $a = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_VBOX_43_MTE_Anorganix {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
    condition:
        $a at pe.entry_point
}

rule PackerMASMTASM_Lenguaje_Compilador_additional {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? ?? ?? ?0 ?0 00 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_11x_SLV_ICU_additional {
    strings:
        $a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }
    condition:
        $a at pe.entry_point
}

rule Solidshield_Protector_V1X_Solidshield_Technologies {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v101_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
        $b = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_Lockless_Intro_Pack {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point
}

rule Sierras_audio_file_Hint_FILE_START {
    strings:
        $a = { 8D 0C 53 4F 4C 00 22 56 0D }
    condition:
        $a at pe.entry_point
}

rule PolyEnE_V001p_Lennart_Hedlund_ {
    strings:
        $a = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule RLP_V073beta_ap0x_Sign_by_fly_additional {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        $a at pe.entry_point
}

rule MESS_v120_Hint_DOS_EP {
    strings:
        $a = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }
    condition:
        $a at pe.entry_point
}

rule ASPack_108_Solodovnikov_Alexey {
    strings:
        $a = { 90 75 01 FF E9 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1994_Hint_DOS_EP {
    strings:
        $a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 }
    condition:
        $a at pe.entry_point
}

rule The_Best_Cryptor_FsK {
    strings:
        $a = { EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_152_Stub_engine_16_GlOFF {
    strings:
        $a = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V31_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102_Ashkibiz_Danehlar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_500_Dll_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75 }
    condition:
        $a at pe.entry_point
}

rule hyings_PE_Armor_049_Hying {
    strings:
        $a = { 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule nPack_V111502006Beta_NEOx {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70 {
    strings:
        $a = { B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E }
    condition:
        $a at pe.entry_point
}

rule dePACK_V10_deNULL {
    strings:
        $a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2 }
    condition:
        $a at pe.entry_point
}

rule SuckStop_v111 {
    strings:
        $a = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }
    condition:
        $a at pe.entry_point
}

rule XPack_152_164_additional {
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Armadillo_300_Anorganix_additional {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule UPX_SCRAMBLER_306 {
    strings:
        $a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
    condition:
        $a at pe.entry_point
}

rule ZCode_Win32PE_Protector_101_Giuliano_Bertoletti {
    strings:
        $a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }
    condition:
        $a at pe.entry_point
}

rule May_be_Pklite_Header_Version_v6v2_extra_0_v5_2_Hint_HDR_END {
    strings:
        $a = { 50 6B }
    condition:
        $a at pe.entry_point
}

rule UPXLock_v10_CyberDoom {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Borland_Cpp_additional {
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
    condition:
        $a at pe.entry_point
}

rule PECompact_v1242_v1243_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }
    condition:
        $a at pe.entry_point
}

rule JAR_Archive_additional {
    strings:
        $a = { 1A 4A 61 72 1B }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v1401 {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }
    condition:
        $a at pe.entry_point
}

rule GOES_graphics_file {
    strings:
        $a = { C8 C4 D9 40 C1 D9 C5 C1 }
    condition:
        $a at pe.entry_point
}

rule DiskDupe_c_MSD_Users_file_Hint_FILE_START {
    strings:
        $a = { 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140_v145 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11 }
    condition:
        $a at pe.entry_point
}

rule Crypt_17_COM {
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 74 03 EB 4C 90 B4 01 BE 24 01 BF FF FD B9 81 00 68 00 01 68 A5 01 68 00 00 57 F3 A4 C3 B0 02 E6 21 60 B8 99 01 33 FF 8E C7 BF 0C 00 AB 8C C8 AB BB 6C 04 B8 3A FE BF 04 00 26 C6 07 00 AB 8C C8 AB 26 80 3F 00 75 09 2E 9C }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v12_CGSoftLabs_h_additional {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }
    condition:
        $a at pe.entry_point
}

rule Phonebook_packed_datafile {
    strings:
        $a = { 21 50 48 32 50 41 43 4B 24 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V12build3009_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
        $b = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE_Stealth_v271_additional {
    strings:
        $a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }
    condition:
        $a at pe.entry_point
}

rule T_PACK_v05c_m1_Hint_DOS_EP {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_PE_Crypt_102_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V102_Ashkbiz_Danehkar_ {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_V11X_ap0x_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v272_v273_WebToolMaster {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_DxPack_10 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Stony_Brook_Pascalp_v70 {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC }
    condition:
        $a at pe.entry_point
}

rule NsPack_V11_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cppx_additional {
    strings:
        $a = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }
    condition:
        $a at pe.entry_point
}

rule unknown_by_JVP {
    strings:
        $a = { B4 30 CD 21 3C 02 73 06 33 C0 06 50 CB 81 BF 00 00 BE 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Mew_11_SE_v12_Eng_Northfox {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C }
    condition:
        $a at pe.entry_point
}

rule Vx_Grazie883 {
    strings:
        $a = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_13_SplitpCrypt_Method_Bill_Prisoner_TPOC {
    strings:
        $a = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
        $b = { E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v051 {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
    condition:
        $a at pe.entry_point
}

rule Creative_Audio_file_additional {
    strings:
        $a = { 43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule HASP_HL_Protection_1X_Aladdin {
    strings:
        $a = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Morphine_33_Silent_Software_Silent_Shield_c2005_h {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point
}

rule MEW_10_packer_v10_Northfox {
    strings:
        $a = { 33 C0 E9 ?? ?0 }
    condition:
        $a at pe.entry_point
}

rule PNG_Graphics_format {
    strings:
        $a = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        $a at pe.entry_point
}

rule RAR_Configuration_file_Hint_FILE_START {
    strings:
        $a = { 52 41 52 20 43 4F 4E 46 49 47 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V13finalbuild81026_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_V11x_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 }
    condition:
        $a at pe.entry_point
}

rule RSCs_Process_Patcher_151 {
    strings:
        $a = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V11A_vcasm {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Prepared_by_SLR_OPTLINK_additional {
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }
    condition:
        $a at pe.entry_point
}

rule eXPressor_120_Beta_PE_Packer_additional {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_aPlib_043_ap0xnbsp_nbsp_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_REALBasic_Anorganix {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_XRCV1015_additional {
    strings:
        $a = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ACProtect_109_Anorganix_additional {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Possibly_PCX_graphics_format_Hint_FILE_START {
    strings:
        $a = { 0A ?? 01 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_014_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 8C 33 40 00 0B C0 0F 84 DE 01 00 00 89 85 12 33 40 00 83 BD D0 32 40 00 01 74 0D 83 BD CC 32 40 00 01 74 2A }
    condition:
        $a at pe.entry_point
}

rule ProPack_208_m1_EXE {
    strings:
        $a = { 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 2E 00 50 8B 2E 0A 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 8E C2 8E DB 83 EC }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Microsoft_Visual_Cpp_70_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Symantec_C_v400_p_Libraries_Hint_DOS_EP {
    strings:
        $a = { FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule DBPE_v210_additional {
    strings:
        $a = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule FucknJoy_10c_UsAr {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
    condition:
        $a at pe.entry_point
}

rule Packman_Executable_Image_Packer_0001_bubba_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V22X_V2308_Jitit_Sign_by_fly {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v1061b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }
    condition:
        $a at pe.entry_point
}

rule Vx_November_17768 {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_13_Split_Method_Bill_Prisoner_TPOC {
    strings:
        $a = { E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC }
        $b = { E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_ {
    strings:
        $a = { 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68 }
    condition:
        $a at pe.entry_point
}

rule Interchange_Format_File_IFF_type_WVQA_Hint_FILE_START {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v32a_emadicius {
    strings:
        $a = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 }
        $b = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Trilobytes_JPEG_graphics_Library_additional {
    strings:
        $a = { 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PassEXE_v20_additional {
    strings:
        $a = { 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A }
    condition:
        $a at pe.entry_point
}

rule Themida_1201_compressed_Oreans_Technologies {
    strings:
        $a = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        $a at pe.entry_point
}

rule CauseWay_DOS_Extender_v325_Hint_DOS_EP {
    strings:
        $a = { FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07 }
    condition:
        $a at pe.entry_point
}


rule Exe_Guarder_v18_Exeiconcom_h_additional {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v12_BG_Software_Protect_Technologies_h {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_v038_Beta_Strip_base_relocation_table_Option_Sign_by_hot_UNP_additional {
    strings:
        $a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule ExeJoiner_V10_Yoda_f2f {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule MinGW {
    strings:
        $a = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule EXE_Cryptor_v240_v241_or_newer {
    strings:
        $a = { E8 3B FF FF FF 05 ?? ?? 00 00 FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_XCR_011_Anorganix {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V102_Ashkbiz_Danehkar_Sign_by_fly_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule nPack_V112002006Beta_NEOxuinC_additional {
    strings:
        $a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1995_Hint_WIN_EP {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75 }
    condition:
        $a at pe.entry_point
}

rule FreeBasic_014 {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }
    condition:
        $a at pe.entry_point
}

rule Packman_v10_Brandon_LaCombe_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B }
    condition:
        $a at pe.entry_point
}

rule Compact_105 {
    strings:
        $a = { 81 FC E8 80 77 04 B4 4C CD 21 FC BF 00 41 BE 00 01 B9 00 00 F3 A4 E9 00 40 BE 52 41 BF 00 01 AD 8B D6 8A D8 B7 00 03 F3 AC 3A C4 75 0D AC 3A C4 74 08 56 8B F2 8B CB F3 A4 5E AA 81 FF 00 00 72 E7 BF 52 41 88 0E 16 41 FE 0E 51 41 75 C0 E9 AF }
    condition:
        $a at pe.entry_point
}

rule PrivateEXE_v20a_Hint_WIN_EP_additional {
    strings:
        $a = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_2005_Release_Microsoft {
    strings:
        $a = { E8 ?? ?? ?? ?? E9 ?? FD FF FF }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_01_015_DLL_NTkrnl_Software {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_150X_CGSoftLabs {
    strings:
        $a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB }
        $b = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule T_PACK_v05c_m2_Hint_DOS_EP {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Paint_Graphics_format {
    strings:
        $a = { 4C 69 6E 53 }
    condition:
        $a at pe.entry_point
}

rule Xtreme_Protector_v106_additional {
    strings:
        $a = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PE_Crypt_102_emadicius_additional {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 }
    condition:
        $a at pe.entry_point
}

rule Petite_v14_Hint_WIN_EP {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00 }
    condition:
        $a at pe.entry_point
}

rule PECrc32_V088_ZhouJinYu {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Lotus_Word_Pro_document_file {
    strings:
        $a = { 57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v142_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20a0_additional {
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03 }
    condition:
        $a at pe.entry_point
}

rule COMPACK_v45_2_additional {
    strings:
        $a = { BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Delphi_Setup_Module {
    strings:
        $a = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SkD_Undetectabler_3_No_FSG_2_Method_SkD {
    strings:
        $a = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74 }
        $b = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CodeCrypt_014b {
    strings:
        $a = { EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 00 00 40 00 52 8B 54 24 08 E8 00 00 FF FF 89 95 00 00 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7 }
    condition:
        $a at pe.entry_point
}

rule Berio_200_beta {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01 }
    condition:
        $a at pe.entry_point
}

rule Rec_033a {
    strings:
        $a = { 06 1E 52 B8 16 30 1E CD 21 86 C4 3D FF 02 73 02 CD 20 B4 09 0E 1F E8 02 00 24 24 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 03 73 02 CD 20 3C 03 73 02 33 C0 BF 08 08 8B 08 90 2B F7 90 BF 08 08 B9 08 08 52 BA EB 04 5A EB FB 9A EB 2E FE 20 E7 }
    condition:
        $a at pe.entry_point
}

rule Hide_PE_101_BGCorp_additional {
    strings:
        $a = { BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZMA_additional {
    strings:
        $a = { 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
    condition:
        $a at pe.entry_point
}

rule SCRAMB_v120_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5B 0E 1F 81 ?? ?? ?? 8B C3 05 ?? ?? 50 8B C8 03 D1 2B FA C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1304_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Embed_PE_v113_cyclotron {
    strings:
        $a = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Lockless_Intro_Pack_Anorganix {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEBundle_20x_24x_emadicius {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v13beta_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Macromedia_Flash_Projector_60_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }
    condition:
        $a at pe.entry_point
}

rule VProtector_vcasm_additional {
    strings:
        $a = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C {
    strings:
        $a = { 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06 }
        $b = { BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_Full_Edition_117_DLL_aPLib_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_70 {
    strings:
        $a = { EB 01 }
        $b = { EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_20_additional {
    strings:
        $a = { EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 }
    condition:
        $a at pe.entry_point
}

rule SMK_movie_file {
    strings:
        $a = { 53 4D 4B 32 }
    condition:
        $a at pe.entry_point
}

rule Spalsher_v10_v30_additional {
    strings:
        $a = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_MinGW_GCC_2x {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v50_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16d_Vaska {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 }
        $b = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_30_old_crap_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional {
    strings:
        $a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43 }
    condition:
        $a at pe.entry_point
}

rule nPack_V113002006_Beta_NEOx {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V097_V099_MATCODE_Software_20080416 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }
    condition:
        $a at pe.entry_point
}

rule BINLock_10 {
    strings:
        $a = { 31 C0 8E C0 26 C7 06 04 00 64 01 26 8C 0E 06 00 26 C7 06 0C 00 46 01 26 8C 0E 0E 00 2E C7 06 0A 00 33 01 2E 8C 0E 0C 00 CC CD 01 EB CD B9 00 00 BF 00 00 B8 00 41 8E C0 B0 00 F3 AA B4 4C CD 21 B8 BB 01 BB 64 01 29 D8 89 C1 BE 64 01 2E 8A 14 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1300_Obsidium_Software_h {
    strings:
        $a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V10_V2X_NsPacK_Private_additional {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v102b_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule SGI_Image_Graphics_format {
    strings:
        $a = { 01 DA 00 01 00 03 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102_103_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule S3M_music_file {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 53 43 52 4D }
        $b = { 53 43 52 4D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_PEBundle_20x_24x_emadicius {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v410_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 }
        $b = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PCC_12 {
    strings:
        $a = { 36 8C 1E 00 00 A1 02 00 8C D3 2B C3 77 03 E9 D3 00 48 3D 00 10 72 03 B8 FF 0F B1 04 D3 E0 3B C4 73 03 E9 BF 00 36 8B 1E 00 00 36 03 1E 02 00 83 C3 7F 3B E3 75 02 8B E0 36 89 26 00 00 B4 30 CD 21 3C 02 72 06 36 C6 06 00 00 01 C6 06 FF 00 0D }
    condition:
        $a at pe.entry_point
}

rule mkfpack_APlib_llydd_20080131 {
    strings:
        $a = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A ?? 68 ?? ?? ?? ?? 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_V092_Lukas_Fleischer_Sign_by_fly {
    strings:
        $a = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }
    condition:
        $a at pe.entry_point
}

rule MEW_10_by_Northfox {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Packer_10 {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 }
        $b = { E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule BeRo_Tiny_Pascal_BeRo_Farbrausch {
    strings:
        $a = { E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_500d {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_2122_exe_Alexey_Solodovnikov {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Caz1204_additional {
    strings:
        $a = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }
    condition:
        $a at pe.entry_point
}

rule nPack_V112002006Beta_NEOxuinC {
    strings:
        $a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v1501_Options_Protection_CGSoftLabs {
    strings:
        $a = { 5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0 }
    condition:
        $a at pe.entry_point
}

rule Vx_Involuntary1349 {
    strings:
        $a = { ?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
        $b = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Delphi_v50_KOL_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule SDProtector_Pro_112 {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v4000053_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_v200_1988_1989_additional {
    strings:
        $a = { FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E }
    condition:
        $a at pe.entry_point
}

rule CreateInstall_v200335 {
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
        $b = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WebCops_DLL_LINK_Data_Security {
    strings:
        $a = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_DxPack_10_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_Protector_V36_wwwexeshieldcom_additional {
    strings:
        $a = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }
    condition:
        $a at pe.entry_point
}

rule XPack_129_130_COM {
    strings:
        $a = { 8C C8 05 00 10 8E C0 BF 00 01 8B F7 FC B9 60 6D F3 A5 06 B8 77 01 50 CB 1E 06 1F 07 BE 00 02 BF 00 01 06 57 E8 11 00 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 8B E8 06 1F CB EB 1D 80 E2 0F 75 05 50 AD 8B E8 58 FE C2 D1 E5 C3 33 C9 E8 EC FF D1 D1 }
    condition:
        $a at pe.entry_point
}

rule PESPin_v13_Cyberbob_ {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC }
    condition:
        $a at pe.entry_point
}

rule Khrome_Crypt_v03_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? B8 ?? ?? EB ?? 80 ?? ?? EB ?? EB ?? EB ?? 66 ?? ?? ?? ?? ?? 66 }
    condition:
        $a at pe.entry_point
}

rule ActiveMARK_5x_Trymedia_Systems_Inc {
    strings:
        $a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
    condition:
        $a at pe.entry_point
}

rule Wise_Installer_Stub_additional {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }
    condition:
        $a at pe.entry_point
}

rule SND_music_file_Hint_FILE_START {
    strings:
        $a = { 00 00 F8 2A ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_v08 {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }
    condition:
        $a at pe.entry_point
}

rule beria_v007_public_WIP_symbiont_h {
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }
        $b = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Dev_Cpp_v4 {
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Dev_Cpp_v5 {
    strings:
        $a = { 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule from_NORMAN_Anti_Virus_Utilites_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }
    condition:
        $a at pe.entry_point
}

rule RCC_II386_v051_Hint_DOS_EP {
    strings:
        $a = { FA BC ?? ?? FE ?? ?? 0E 1F 3E ?? ?? ?? ?? ?? 3E ?? ?? ?? ?? ?? B8 ?? ?? CD 21 06 53 B8 ?? ?? CD 21 06 53 8B D5 8C C8 8E D8 B8 ?? ?? CD 21 8B D5 B8 ?? ?? CD 21 CD 01 9C }
    condition:
        $a at pe.entry_point
}

rule Vx_Caterpillar1575_Hint_DOS_EP {
    strings:
        $a = { EB ?? 06 1E 8C C0 0E 1F 0E 07 A3 ?? ?? 8C D0 A3 ?? ?? B0 ?? E6 20 FC ?? C0 8E D8 ?? F6 BF ?? ?? B9 ?? ?? F2 A4 1E 17 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Gleam_100 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point
}

rule FMC_Faust_Module_music_file {
    strings:
        $a = { 46 4D 43 21 }
    condition:
        $a at pe.entry_point
}

rule TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft_SignByfly {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_VBOX_43_MTE_Anorganix {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_additional {
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E }
    condition:
        $a at pe.entry_point
}

rule XPack_167_COM {
    strings:
        $a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }
    condition:
        $a at pe.entry_point
}

rule DBPE_v210 {
    strings:
        $a = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v40_additional {
    strings:
        $a = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule MrHDKiller_ProtectioN_v12_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 48 51 44 2E ?? ?? ?? 2D ?? ?? 8B D8 05 ?? ?? 8B F0 BF ?? ?? B9 ?? ?? ?? F3 A4 8B CB D1 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v220b1 {
    strings:
        $a = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v34_additional {
    strings:
        $a = { 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
    condition:
        $a at pe.entry_point
}

rule UPXHiT_v001_additional {
    strings:
        $a = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }
    condition:
        $a at pe.entry_point
}

rule SLR_OPTLINK_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_needs_to_be_added_additional {
    strings:
        $a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
    condition:
        $a at pe.entry_point
}

rule CRYPTCOM_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BE 00 01 56 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 46 46 E2 ?? 31 F6 31 C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_Portions_Copyright_c_198396_Borland {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule Petite_v22_wwwun4seencompetite_additional {
    strings:
        $a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_50_60 {
    strings:
        $a = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule Vx_Mh757_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B8 ?? ?? CD 21 3C 07 75 ?? FB B8 ?? ?? CD 21 8C C8 48 8E C0 26 ?? ?? ?? ?? ?? 74 ?? B4 ?? BB ?? ?? CD 21 81 ?? ?? ?? 72 ?? B4 ?? CD 21 72 ?? 48 8E C0 FA }
    condition:
        $a at pe.entry_point
}

rule Fish_Pe_Packer_V103_V10X_hellfish_20090119 {
    strings:
        $a = { 60 E8 21 00 00 00 EB 18 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E 56 8B 56 1C 89 F3 }
    condition:
        $a at pe.entry_point
}

rule TurboBAT_v310_50_Patched {
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point
}


rule Cryptic_20_Tughack {
    strings:
        $a = { B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3 }
    condition:
        $a at pe.entry_point
}

rule XCompXPack_V09X_JoKo_20080218 {
    strings:
        $a = { AC 84 C0 74 03 AA EB F8 E8 0B 00 00 00 20 6E 6F 74 20 66 6F 75 6E 64 00 5E AC AA 84 C0 75 FA 6A 00 57 52 6A 00 E8 06 00 00 00 45 72 72 6F 72 00 5E AC AA 84 C0 75 FA E8 0B 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 FF 55 2C E8 0C 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 50 FF 55 28 FF D0 83 C4 7C 48 C3 }
    condition:
        $a at pe.entry_point
}

rule Crunch_4_additional {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 }
    condition:
        $a at pe.entry_point
}

rule unknown_by_RAO {
    strings:
        $a = { 8B C4 2D A6 02 24 00 8B F8 57 B9 53 00 BE 14 01 F3 A5 FD C3 97 4F 4F B9 00 00 03 F1 D1 E9 F3 A5 FC E8 91 00 8D 75 02 BF 00 01 3C A4 E8 80 00 72 FA E8 77 00 AC 93 B7 FF 73 65 E8 72 00 D0 D7 E8 6D 00 72 12 B6 02 E8 66 00 72 09 E8 61 00 D0 D7 }
    condition:
        $a at pe.entry_point
}

rule PCrypt_350_COM {
    strings:
        $a = { 50 43 52 59 50 54 E9 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_bartxt_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V20_Private_Vaskanbsp_nbsp_SignByfly {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }
    condition:
        $a at pe.entry_point
}

rule tElock_V099_10_Private_tE {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1363_Obsidium_Software_20080730 {
    strings:
        $a = { EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Vx_Sonik_Youth_additional {
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point
}

rule Packman_0001_Bubbasoft {
    strings:
        $a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }
        $b = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_WWPack32_1x_emadicius_h {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_V102_ConquestOfTroycom {
    strings:
        $a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }
    condition:
        $a at pe.entry_point
}

rule PS_AdobeFont_v10_Hint_FILE_START {
    strings:
        $a = { 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A }
    condition:
        $a at pe.entry_point
}

rule UPX_Shit_01_500mhz {
    strings:
        $a = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v12_RC {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }
    condition:
        $a at pe.entry_point
}

rule FixupPak_120 {
    strings:
        $a = { 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_13_Split_Method_Bill_Prisoner_TPOC_additional {
    strings:
        $a = { E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260 {
    strings:
        $a = { 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v261 {
    strings:
        $a = { 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C }
    condition:
        $a at pe.entry_point
}

rule PECompact_v20 {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D }
        $b = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RE_Crypt_v07x_Crudd_RET_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }
    condition:
        $a at pe.entry_point
}

rule eXPressor_10_beta_CGSoftLabs {
    strings:
        $a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }
        $b = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AHPack_01_FEUERRADER {
    strings:
        $a = { 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V26_LiuXingPing {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v03_additional {
    strings:
        $a = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }
    condition:
        $a at pe.entry_point
}

rule VcAsm_Protector_VcAsm {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point
}

rule PCPEC_alpha {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule ActiveMARK_5x_Trymedia_SystemsInc_h {
    strings:
        $a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
        $b = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ThemidaWinLicense_V18X_V19X_Other_Oreans_Technologies_20080131 {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule E2C_by_DoP_additional {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V25X_V26X_SetiSoft_Team_SignByfly_20080116_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Modified_additional {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v114_v115_v120_3_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1988_04_additional {
    strings:
        $a = { 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule NTKrnlPacker_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PE_Crypt_102_emadicius {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule PEQuake_v006_forgotus {
    strings:
        $a = { E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 }
    condition:
        $a at pe.entry_point
}

rule ZealPack_10_Zeal {
    strings:
        $a = { C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4 }
        $b = { C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE_Shield_v27b_Exeshield_Corp {
    strings:
        $a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95 }
    condition:
        $a at pe.entry_point
}

rule iPBProtect_v013_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_v12003518_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Neolite_20_Anorganix_additional {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_12_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Feokt_additional {
    strings:
        $a = { 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule F_Xlock_116 {
    strings:
        $a = { 50 50 50 53 51 52 56 1E 8B DC 8C D8 05 00 00 36 89 47 0E 36 C7 47 0C 00 00 8E 1E 2C 00 33 DB 8B 07 43 3D 00 00 74 02 75 F6 43 83 3F 01 75 45 43 43 8B D3 B8 00 3D CD 21 72 3A 8B D8 0E 1F 33 D2 8B F2 B9 1B 00 B4 3F CD 21 83 7C 14 00 75 30 81 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Cpp_19901992_Hint_DOS_EP {
    strings:
        $a = { B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Video_Lan_Client_Anorganix {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v11_additional {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v085f {
    strings:
        $a = { 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02 }
    condition:
        $a at pe.entry_point
}

rule Petite_v14 {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00 }
    condition:
        $a at pe.entry_point
}

rule CopyMinder_MicrocosmLtd_Sign_by_fly {
    strings:
        $a = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V31_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }
    condition:
        $a at pe.entry_point
}

rule DrWeb_v400p_Virus_DataBase_Hint_FILE_START_p_144 {
    strings:
        $a = { 49 44 52 57 }
    condition:
        $a at pe.entry_point
}

rule Launcher_Generator_v103_additional {
    strings:
        $a = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }
    condition:
        $a at pe.entry_point
}

rule HackStop_119_build_197_EXE {
    strings:
        $a = { 56 BE EB 04 5E EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 56 BE EB 04 5E EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 56 BE EB 04 5E EB FB 9A EB 02 D8 88 5A 1F 56 BE EB 04 5E EB FB 9A B0 AD E6 64 E8 0E F3 56 BE EB 04 5E EB FB }
    condition:
        $a at pe.entry_point
}

rule PeCompact_2xx_Slim_Loader_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_CrunchPE_Heuristic {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Watcom_CCpp {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 }
        $b = { E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Code_Virtualizer_V1310_Oreans_Technologies_Sign_by_fly {
    strings:
        $a = { 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_TASM32 {
    strings:
        $a = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B }
    condition:
        $a at pe.entry_point
}

rule Crackstop_103a {
    strings:
        $a = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC 03 46 FA 05 05 00 FF E0 9A 53 45 EB 05 B8 08 00 EB EE B8 06 00 29 46 FA EB 02 8E F8 2B E0 CF EA 11 0E 1F E8 02 00 24 24 5A B4 09 CD 21 FA 33 C0 89 46 FA B8 D2 04 40 2B D8 8B 46 FA 0B C0 75 B2 FB B0 }
    condition:
        $a at pe.entry_point
}

rule NsPack_V2X_LiuXingPing_additional {
    strings:
        $a = { 6E 73 70 61 63 6B 24 40 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v12_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 }
    condition:
        $a at pe.entry_point
}

rule TTProtect_V10X_somuchnbsp_nbsp_SignByfly_20080806 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 50 57 53 9C E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule TTProtect_V10X_somuchnbsp_nbsp_SignByfly_20080807 {
    strings:
        $a = { 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule diPacker_1x_diProtector_Software {
    strings:
        $a = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_197_SetiSoft_h_additional {
    strings:
        $a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_Win32_1994 {
    strings:
        $a = { A1 59 00 00 00 C1 E0 02 A3 5D 00 00 00 57 51 33 C0 BF 00 00 00 00 B9 00 00 00 00 3B CF 76 05 2B CF FC F3 AA 59 5F 64 67 8B 16 04 00 8B 42 F8 A3 61 00 00 00 8B 42 FC A3 65 00 00 00 83 EA 04 89 15 00 00 00 00 83 EA 04 3B D4 73 02 8B E2 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_Win32_1995 {
    strings:
        $a = { A1 5A 00 00 00 C1 E0 02 A3 5E 00 00 00 57 51 33 C0 BF 00 00 00 00 B9 00 00 00 00 3B CF 76 05 2B CF FC F3 AA 59 5F 64 67 8B 16 04 00 89 15 6E 00 00 00 8B 42 F8 A3 66 00 00 00 8B 42 FC A3 6A 00 00 00 83 EA 04 89 15 00 00 00 00 83 EA 04 3B D4 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100c_2 {
    strings:
        $a = { BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100c_1 {
    strings:
        $a = { 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v33 {
    strings:
        $a = { 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v102a_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }
    condition:
        $a at pe.entry_point
}

rule eXcalibur_v103_forgotus_h_additional {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_vxx_additional {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v039_final_By_Dwing_c2005_h1 {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
        $c = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 7? }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RSCs_Process_Patcher_v14 {
    strings:
        $a = { E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 }
        $b = { E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Inno_Setup_Module_v129 {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_additional {
    strings:
        $a = { E8 ?? ?? CD 20 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_DLL_Berczi_Gabor_Pierre_Muller_Peter_Vreman_ {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Number_One_Hint_DOS_EP {
    strings:
        $a = { F9 07 3C 53 6D 69 6C 65 3E E8 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v2018 {
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_DLL_LZMA_Ap0x_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v145_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C }
    condition:
        $a at pe.entry_point
}

rule Frusion_biff {
    strings:
        $a = { 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 }
    condition:
        $a at pe.entry_point
}

rule EXEGUARD_v13_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? BF ?? ?? EB ?? E8 ?? ?? 7C ?? 79 ?? FA EA ?? ?? ?? ?? 76 ?? D8 FD }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10X_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_2xwithouth_Poly_Solodovnikov_Alexey {
    strings:
        $a = { ?? 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB EC FF FF FF 03 DD 81 EB 00 40 1C 00 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_V01_DLL_NTkrnl_Software {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Enhanced_Metafile {
    strings:
        $a = { 01 00 00 00 58 }
    condition:
        $a at pe.entry_point
}

rule FishPE_V11X_hellfish {
    strings:
        $a = { 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 }
        $b = { 50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 18 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C2 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VMProtect_V1X_PolyTech {
    strings:
        $a = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_11_Hint_DOS_EP {
    strings:
        $a = { B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule FreeCryptor_02_build_002_GlOFF {
    strings:
        $a = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A }
        $b = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CGM_Graphics_format {
    strings:
        $a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }
    condition:
        $a at pe.entry_point
}

rule OAZ_Fax_Graphics_format {
    strings:
        $a = { 0F 0F 0F 0F 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V10_V2X_NsPacK_Private {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 }
    condition:
        $a at pe.entry_point
}

rule tElock_051_tE {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }
        $b = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsiduim_1304_Obsiduim_Software {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }
    condition:
        $a at pe.entry_point
}

rule Thunderbolt_V002_deXep_forgot_SignByfly {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 }
        $b = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ARM_Protector_02_SMoKE_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }
    condition:
        $a at pe.entry_point
}

rule HackStop_098_COM {
    strings:
        $a = { 50 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 EB 02 4C 8F 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 62 8F 8B EC BC 03 00 2E 85 06 D1 F6 B8 EB 03 EB FC EA 83 FC 03 74 02 FA F4 2E 85 06 E3 F6 B8 EB 03 EB FC EA 33 C0 FA 8E D0 BC }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_BJFNT_12 {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_UPX_06_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule yP_v10b_by_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v50_v60_additional {
    strings:
        $a = { FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Vx_Kuku886_additional {
    strings:
        $a = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }
    condition:
        $a at pe.entry_point
}

rule Xtreme_Protector_v105_additional {
    strings:
        $a = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }
    condition:
        $a at pe.entry_point
}

rule CrypWrap_vxx {
    strings:
        $a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
    condition:
        $a at pe.entry_point
}

rule UPX_Shit_01_500mhz_additional {
    strings:
        $a = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cppx {
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }
    condition:
        $a at pe.entry_point
}

rule EP_v02_CoDe_Inside {
    strings:
        $a = { 6A 00 60 E9 01 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_224_by_Jan_Vorel {
    strings:
        $a = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }
        $b = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HackStop_119_build_217 {
    strings:
        $a = { 53 BB EB 04 5B EB FB EA 9C 1E 52 B4 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 53 BB EB 04 5B EB FB EA E8 02 00 24 24 5A B4 09 CD 21 53 BB EB 04 5B EB FB EA EB 02 D8 88 5A 1F 53 BB EB 04 5B EB FB EA B0 AD E6 64 58 E8 D6 F1 53 BB EB 04 5B EB }
    condition:
        $a at pe.entry_point
}

rule tElock_v099_tHE_EGOiSTE {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 }
    condition:
        $a at pe.entry_point
}

rule Username_300_COM {
    strings:
        $a = { E8 00 00 5D 83 ED 03 FA FC 33 F6 8E DE BF 99 01 03 FD B9 14 00 F3 A4 8B FC 8B 1E 84 00 A1 86 00 89 1E 0C 00 A3 0E 00 8B 16 40 00 8B 1E 42 00 B8 AD FD 8E D0 B8 38 25 8B E0 53 52 8C C8 8B E7 8E D0 FB 0E 1F BE 51 00 B9 24 01 3E 31 0A 46 46 E2 }
    condition:
        $a at pe.entry_point
}

rule Escargot_V01_ppMeat {
    strings:
        $a = { EB 04 40 30 2E 31 60 68 61 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_Keys_Shell_V1130Dongle_Driver_V740_SafeNet_Inc_20090524 {
    strings:
        $a = { 55 8B EC 81 EC 0C 01 00 00 53 56 57 C7 85 04 FF FF FF 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 F8 00 00 00 00 C7 85 08 FF FF FF 00 00 00 00 C7 45 E4 04 00 00 00 83 3D ?? ?? ?? ?? 00 74 05 E9 ?? ?? 00 00 A1 ?? ?? ?? ?? 83 C0 01 }
    condition:
        $a at pe.entry_point
}

rule UFA_Archive_Hint_FILE_START {
    strings:
        $a = { 55 46 41 C6 D2 C1 00 00 }
    condition:
        $a at pe.entry_point
}

rule AVPACK_v120_Hint_DOS_EP {
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v42_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 }
    condition:
        $a at pe.entry_point
}

rule CGM_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0978_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer_h_additional {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1031_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule Upack_Unknown_DLL_Sign_by_hot_UNP_additional {
    strings:
        $a = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Pack_Master_10_PEX_Clone {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Immun_12_registered_COM {
    strings:
        $a = { 50 53 51 52 56 57 1E 06 E8 00 00 5E 81 EE 79 08 2E 89 36 00 01 8B FE 81 C7 6C 08 2E 8B 1D 2B FB 83 C7 02 81 EF 00 01 8B EF B4 30 CD 21 2E 88 85 63 01 3C 03 72 50 8E 1E 2C 00 8C C8 8E C0 8B EF 2E 8B 3E 00 01 81 C7 4A 0C 33 F6 B9 00 20 FC AC }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v09910_additional {
    strings:
        $a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_V15_FEUERRADER_ {
    strings:
        $a = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v274_WebToolMaster_additional {
    strings:
        $a = { 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1028_additional {
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
    condition:
        $a at pe.entry_point
}

rule codeCrypter_031_additional {
    strings:
        $a = { 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v1304_Cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule CubiComp_PictureMaker_graphics_format_blue {
    strings:
        $a = { 36 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressorStandardV1601_CGSoftLabs_20080308 {
    strings:
        $a = { 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v10_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 }
    condition:
        $a at pe.entry_point
}

rule ComProt_10_beta {
    strings:
        $a = { E8 00 00 5E 8B EE 81 ED 03 01 8D B6 16 01 B9 0A 01 F6 14 46 E2 FB 4B F6 72 69 28 FE 32 DE 4B FC 32 EF 76 69 DA FD 44 FE FF 4B FF 32 E9 C3 FF 8B 07 C3 F2 8B C8 C3 F7 8A E7 7C 04 FE 8B 14 4F DF 17 7F FF 01 34 01 71 DA FD 17 88 FF 17 8B FF 14 }
    condition:
        $a at pe.entry_point
}

rule Go32Stub_v200_DOS_Extender_additional {
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80 }
    condition:
        $a at pe.entry_point
}

rule PKLite_115_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 69 8B C4 2D 44 03 90 25 F0 FF 8B F8 B9 A2 00 90 BE 7E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01 }
    condition:
        $a at pe.entry_point
}

rule DotFix_Nice_Protect_V2X_GPcH_Soft {
    strings:
        $a = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }
    condition:
        $a at pe.entry_point
}

rule DzA_Patcher_v13_Loader_additional {
    strings:
        $a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78 }
    condition:
        $a at pe.entry_point
}

rule EEXE_Version_112_additional {
    strings:
        $a = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v13x_SteelBytes {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_v01_by_SMoKE_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_LCC_Win32_DLL {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V19X_Jitit_Sign_by_fly {
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v134_v140b1_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_GCC_3x_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_p_Password_checking_additional {
    strings:
        $a = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_MEW_11_SE_10_Anorganix {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }
    condition:
        $a at pe.entry_point
}

rule BookManager_v9510_Hint_DOS_EP {
    strings:
        $a = { FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_V02X_Ryd_Sign_by_fly {
    strings:
        $a = { BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 }
    condition:
        $a at pe.entry_point
}

rule MaskPE_V20_yzkzero_additional {
    strings:
        $a = { B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3 }
    condition:
        $a at pe.entry_point
}

rule DAEMON_Protect_v067 {
    strings:
        $a = { 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_V1X_vcasm_additional {
    strings:
        $a = { EB ?? 5B 56 50 72 6F 74 65 63 74 5D }
    condition:
        $a at pe.entry_point
}

rule GameGuard_v20065xx_dll {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_7 {
    strings:
        $a = { ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 }
        $b = { 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PKZIP_SFX_v11_1989_90_additional {
    strings:
        $a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V3049_V3080_Thinstall_Company_Sign_by_fly {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point
}

rule Cruncher_v10 {
    strings:
        $a = { 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule ZProtect_v149_lifeengines {
    strings:
        $a = { E8 ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 ?? 87 }
    condition:
        $a at pe.entry_point
}

rule MultiEdits_Programming_Language_help {
    strings:
        $a = { 0C 2A 20 }
    condition:
        $a at pe.entry_point
}

rule DotFix_NiceProtect_vna {
    strings:
        $a = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 }
    condition:
        $a at pe.entry_point
}


rule Mew_11_SE_v12_Eng_Northfox_additional {
    strings:
        $a = { 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D }
    condition:
        $a at pe.entry_point
}

rule hyings_PE_Armor_hyingCCG {
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_Bczi_Gor_Pierre_Muller_Peter_Vreman_additional {
    strings:
        $a = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40 }
    condition:
        $a at pe.entry_point
}

rule Code_Lock_vxx {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 }
    condition:
        $a at pe.entry_point
}

rule hmimyss_PE_Pack_01_hmimys {
    strings:
        $a = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75 }
        $b = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrunchPE_v20xx_additional {
    strings:
        $a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_32_additional {
    strings:
        $a = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2620_V2623_Jitit {
    strings:
        $a = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEX_099_emadicius {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V10beta_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b2_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule LTC_v13_lockless {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 }
    condition:
        $a at pe.entry_point
}

rule LGLZ_v104_com_additional {
    strings:
        $a = { BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_DLL_Berczi_Gabor_Pierre_Muller_Peter_Vreman_additional {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule XCR_v011_additional {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
    condition:
        $a at pe.entry_point
}

rule Upack_V032_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 85 5C FF 16 72 57 2C 03 73 02 ?? ?? 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? ?? ?? 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 16 5A 9F 12 C0 D0 E9 74 0E ?? ?? ?? ?? ?? ?? ?? ?? ?? B5 01 FF 56 08 ?? ?? FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F ?? ?? D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 ?? ?? 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_UltraPro_Dongle_V110_SafeNet_Inc {
    strings:
        $a = { A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 04 83 F8 64 7C E7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 8B 4D 00 83 C5 08 ?? ?? ?? ?? ?? ?? ?? 66 8B 75 FA ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B 55 FC 81 E1 FF FF 00 00 81 F9 }
    condition:
        $a at pe.entry_point
}

rule ProPack_214_m2_EXE {
    strings:
        $a = { 0E 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 35 00 50 8B 2E 0A 00 03 16 0C 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 07 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13021_Obsidium_Software {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00 }
        $b = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MinGW_32x_Dll_main {
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        $a at pe.entry_point
}

rule yP_10b_by_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
    condition:
        $a at pe.entry_point
}

rule PEtite_vxx {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule Imploder_v104_BoB_BobSoft {
    strings:
        $a = { 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point
}

rule Upack_038_beta_Dwing_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PEX_099 {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_MASM32_TASM32 {
    strings:
        $a = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }
        $b = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Delphi_v60 {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 45 ?? E8 FF A1 45 ?? 8B ?? E8 FF FF 8B }
        $b = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_NorthStar_PE_Shrinker_13 {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddiebased1745_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Resource_Cursors_file_additional {
    strings:
        $a = { 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16 }
    condition:
        $a at pe.entry_point
}

rule FASM_v15x {
    strings:
        $a = { 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PKLITE_v150_1_Hint_DOS_EP {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule UPX_Protector_v10x {
    strings:
        $a = { EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
        $b = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EmbedPE_V100_V124_cyclotron_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_200 {
    strings:
        $a = { 8B 44 24 04 23 05 00 00 00 00 E8 ED 04 00 00 FE 05 00 00 00 00 FF E0 80 3D 00 00 00 00 00 75 13 90 90 90 90 50 2B C0 E8 D0 04 00 00 58 FE 05 00 00 00 00 C3 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 }
    condition:
        $a at pe.entry_point
}

rule DOS32_v33_DOS_Extender_and_Loader_additional {
    strings:
        $a = { 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule AVP_Inspector_Database {
    strings:
        $a = { 47 68 6F 73 74 20 42 75 73 74 65 72 }
    condition:
        $a at pe.entry_point
}

rule ID_Application_Protector_V12_ID_Security_Suite_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
    condition:
        $a at pe.entry_point
}

rule Upack_Unknown_DLL_Sign_by_hot_UNP {
    strings:
        $a = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule _MSLRH_V031_emadicius {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20b4 {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 }
        $b = { 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_10_beta_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 }
        $b = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_V010_V011_Dwing {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }
        $b = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v060_v061_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V2x_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }
        $b = { 6E 73 70 61 63 6B 24 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v251_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 }
    condition:
        $a at pe.entry_point
}

rule Escargot_V01_ppMeat_additional {
    strings:
        $a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 }
    condition:
        $a at pe.entry_point
}

rule C_Crypt_v102_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 D9 D0 9C 58 25 ?? ?? 50 9D 50 57 BF ?? ?? B0 ?? AA 5F 58 66 51 }
    condition:
        $a at pe.entry_point
}

rule hmimys_protect_01_hmimys {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_FORTRAN {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_p_Virus_Shield_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Portable_BitMap_PBM_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 50 36 0A }
    condition:
        $a at pe.entry_point
}

rule PowerBASICWin_800_ {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_Crypter_V102_Kas_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Watcom_CCpp_DLL {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }
    condition:
        $a at pe.entry_point
}

rule VIRUS_I_WormHybris_additional {
    strings:
        $a = { EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_v100v101_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }
    condition:
        $a at pe.entry_point
}

rule Upack_V032_Dwing_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 85 5C FF 16 72 57 2C 03 73 02 ?? ?? 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? ?? ?? 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 16 5A 9F 12 C0 D0 E9 74 0E ?? ?? ?? ?? ?? ?? ?? ?? ?? B5 01 FF 56 08 ?? ?? FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F ?? ?? D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 ?? ?? 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Configuration_File_additional {
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule CipherWall_Self_ExtratorDecryptor_GUI_v15 {
    strings:
        $a = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
        $b = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule GameGuard_v20065xx_exe_sign_by_hot_UNP {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_WATCOM_CCpp_EXE_Anorganix {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 E9 }
    condition:
        $a at pe.entry_point
}

rule IMPostor_Pack_10_Mahdi_Hezavehi {
    strings:
        $a = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_Read_A_Matic_v10 {
    strings:
        $a = { B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21 }
    condition:
        $a at pe.entry_point
}

rule AVHRR_Graphics_format_Hint_FILE_START {
    strings:
        $a = { D5 C8 00 01 00 03 00 01 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_102_Vladimir_Sukhov_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point
}

rule PKLite_105_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 05 01 50 4B 4C 49 54 45 20 43 6F 70 72 2E 20 31 39 39 31 20 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC4_build_0807_dll_Alexey_Solodovnikov_h {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_410_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 }
    condition:
        $a at pe.entry_point
}

rule GIF87a_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 47 49 46 38 37 61 }
    condition:
        $a at pe.entry_point
}

rule FSG_v131_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_v_h {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_aPlib_043_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Fusion_10_jaNooNi {
    strings:
        $a = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v100_additional {
    strings:
        $a = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_V093_Lukas_Fleischer {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }
    condition:
        $a at pe.entry_point
}

rule ASPack_1061b_DLL {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED EA A8 43 00 B8 E4 A8 43 00 03 C5 2B 85 78 AD 43 00 89 85 84 AD 43 00 80 BD 6E AD 43 00 00 75 15 FE 85 6E AD 43 00 E8 1D 00 00 00 E8 73 02 00 00 E8 0A 03 00 00 8B 85 70 AD 43 00 03 85 84 AD 43 00 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1032_dllocx_Ashkbiz_Danehkar {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
        $b = { 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
        $c = { 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ZOO_Archive_Hint_FILE_START {
    strings:
        $a = { 5A 4F 4F }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extr_Passwcheck_Vir_shield {
    strings:
        $a = { 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule kryptor_3_additional {
    strings:
        $a = { EB 66 87 DB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1342_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00 }
        $b = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PocketPC_ARM_additional {
    strings:
        $a = { 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Upack_v029_beta_Dwing {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29 }
    condition:
        $a at pe.entry_point
}

rule RELOC_100 {
    strings:
        $a = { 1E 06 8C C8 2E 2B 06 6E 00 8E C0 8B D0 2E 8C 06 6E 00 2E 8B 36 70 00 2E 8B 0E 72 00 E3 1E BD 74 00 2E 8B 36 70 00 2E 03 76 00 2E A1 6E 00 2E 03 46 02 8E C0 83 C5 04 26 01 14 E2 E5 07 1F FA 2E 8B 26 6C 00 8C C8 2E 2B 06 6A 00 8E D0 8C C8 2E }
    condition:
        $a at pe.entry_point
}

rule Metrowerks_CodeWarrior_v20_GUI_additional {
    strings:
        $a = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule muckis_protector {
    strings:
        $a = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9 }
    condition:
        $a at pe.entry_point
}

rule Anticrack_Software_Protector_109_ACProtect {
    strings:
        $a = { 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32_v1x {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 FF 75 10 FF 75 0C FF 75 08 }
        $b = { 64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEStubOEP_v1x_additional {
    strings:
        $a = { 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_120_1201 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB CC 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Ncu_Li1688_additional {
    strings:
        $a = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_nSPack_13_emadicius {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule NET_SmartAssemby_Obfuscator_60_chars_sign_ASL {
    strings:
        $a = { 50 6F 77 65 72 65 64 20 62 79 20 53 6D 61 72 74 41 73 73 65 6D 62 6C 79 20 36 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_4x_LCC_Win32_1x_additional {
    strings:
        $a = { B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v101_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        $a at pe.entry_point
}

rule Wise_Installer_Stub_v11010291 {
    strings:
        $a = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }
        $b = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TXT2COM_v206_Hint_DOS_EP {
    strings:
        $a = { 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20 }
    condition:
        $a at pe.entry_point
}

rule Vx_Haryanto {
    strings:
        $a = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_05_Hint_DOS_EP {
    strings:
        $a = { FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V520_Silicon_Realms_Toolworks_SignByfly_20080214 {
    strings:
        $a = { E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 FE 1A 00 00 59 89 7D FC FF 75 08 E8 56 45 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 96 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 A4 19 00 00 59 C3 3B DF 75 0D 8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3 E8 CC 1D 00 00 C3 55 8B EC 51 83 65 FC 00 57 8D 45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B F8 83 C4 0C 85 FF 75 19 56 8B 75 FC 85 F6 74 10 E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89 30 5E 8B C7 5F C9 C3 6A 0C 68 ?? ?? ?? ?? E8 3B 1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ?? ?? ?? 75 43 6A 04 E8 FF 19 00 00 59 83 65 FC 00 56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56 50 E8 A0 3C 00 00 59 59 C7 45 FC FE FF FF FF E8 0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A 6A 04 E8 ED 18 00 00 59 C3 }
        $b = { E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CryptC_by_unknown {
    strings:
        $a = { FD 53 56 5B 0F A1 BE 00 00 AD 64 8B 16 05 00 64 31 06 05 00 64 89 16 0D 00 AD FF 36 33 01 64 33 06 05 00 C7 07 EB 17 64 33 06 0D 00 8F 06 33 01 31 04 E9 CB FF }
    condition:
        $a at pe.entry_point
}

rule UPack_v011 {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }
        $b = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 }
        $c = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_PESHiELD_025_Anorganix {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }
    condition:
        $a at pe.entry_point
}

rule ASYLUM_Music_File_v10 {
    strings:
        $a = { 41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00 }
    condition:
        $a at pe.entry_point
}

rule DragonArmor_Orient_additional {
    strings:
        $a = { BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 }
    condition:
        $a at pe.entry_point
}

rule UPX_Shit_06_snaker {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 15 00 00 00 80 34 08 ?? E2 FA E9 }
    condition:
        $a at pe.entry_point
}

rule Fish_PE_Shield_116_HellFish {
    strings:
        $a = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2620_2623_Jitit {
    strings:
        $a = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKLite_201_COM {
    strings:
        $a = { 50 B8 00 00 BA 00 00 3B C4 73 79 8B C4 2D 42 03 25 F0 FF 8B F8 B9 A1 00 BE 8E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 90 01 02 50 4B 4C 49 54 45 20 43 6F 70 72 2E 20 31 39 39 30 2D 31 39 39 35 20 }
    condition:
        $a at pe.entry_point
}

rule Delphi_v20_Unit {
    strings:
        $a = { 44 43 55 32 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Shortcut_file {
    strings:
        $a = { 4C 00 00 00 01 14 02 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SCRAM_vC5 {
    strings:
        $a = { B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule InterLok_V551_PACE_Anti_Piracy_SignByfly {
    strings:
        $a = { EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 ?? ?? EB FA ?? EB 01 ?? EB F8 ?? EB 01 ?? 57 EB 03 ?? ?? ?? EB 11 ?? ?? ?? EB 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 08 ?? EB F0 ?? EB 07 ?? ?? EB FA ?? ?? ?? EB 02 ?? ?? BB ?? ?? ?? ?? EB 03 ?? ?? ?? 0F 85 ?? ?? ?? ?? EB 07 }
        $b = { EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v081_v084_Modified_additional {
    strings:
        $a = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF }
    condition:
        $a at pe.entry_point
}

rule mPack_V003_DeltaAziz {
    strings:
        $a = { 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ?? 32 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 C9 C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 04 00 00 00 E8 C5 C9 FF FF 83 3D ?? ?? ?? ?? 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 92 C9 FF FF BA 18 A5 00 10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9 FF FF 83 F8 04 74 0A E8 14 B2 FF FF E9 A7 00 00 00 E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 63 C9 FF FF 83 F8 FF 75 0A E8 F1 B1 FF FF E9 84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 D4 CD FF FF 84 C0 75 07 E8 CF B1 FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 0F FA FF FF 3B 05 ?? ?? ?? ?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB FF FF 6A 03 E8 07 C4 FF FF A1 ?? ?? ?? ?? E8 C1 C6 FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 AA C6 FF FF A1 ?? ?? ?? ?? E8 A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F0 E8 A7 B5 FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF FF }
        $b = { 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VMProtect_0x_PolyTech {
    strings:
        $a = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_5 {
    strings:
        $a = { 83 ?? ?? E2 ?? ?? E2 ?? FF }
    condition:
        $a at pe.entry_point
}

rule ID_Application_Protector_12_ID_Security_Suite {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b1 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_2 {
    strings:
        $a = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b3 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b2 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b5 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b4 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44 }
    condition:
        $a at pe.entry_point
}

rule NME_11_Public_by_redlime {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62 }
        $b = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v110b6 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 }
    condition:
        $a at pe.entry_point
}

rule Libraries_by_John_Socha {
    strings:
        $a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v13 {
    strings:
        $a = { EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB }
        $b = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_Video_Lan_Client_Anorganix {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32_DLL {
    strings:
        $a = { 8B 44 24 08 56 83 E8 74 48 }
        $b = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Securom7_Sony_DADC {
    strings:
        $a = { B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule TAV_additional {
    strings:
        $a = { E8 ?? ?? 4D 5A CB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v100_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Code_Lock_Anorganix {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }
    condition:
        $a at pe.entry_point
}

rule beria_v007_public_WIP_symbiont_additional {
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PE_Protect_09 {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
    condition:
        $a at pe.entry_point
}

rule Symantec_C_v400_p_Libraries {
    strings:
        $a = { FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26 }
    condition:
        $a at pe.entry_point
}


rule UPX_050_070_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D }
    condition:
        $a at pe.entry_point
}

rule NTPacker_V2X_ErazerZ_Sign_by_fly {
    strings:
        $a = { 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule VProtector_11X_vcasm {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point
}

rule FACRYPT_v10_additional {
    strings:
        $a = { B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule Shrink_v20_additional {
    strings:
        $a = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_109g_Risco_software_Inc_additional {
    strings:
        $a = { 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule TTProtect_V10X_somuch_20080806 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 50 57 53 9C E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule TTProtect_V10X_somuch_20080807 {
    strings:
        $a = { 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule Protection_Plus_vxx {
    strings:
        $a = { 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 }
    condition:
        $a at pe.entry_point
}

rule USSR_V031_SpiritST_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_11_12_vcasm_additional {
    strings:
        $a = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule InterLok_V551_PACE_Anti_Piracy {
    strings:
        $a = { EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Studio_NET {
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_v2x_additional {
    strings:
        $a = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v12_NorthfoxHCC {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_226_minimum_protection {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB }
    condition:
        $a at pe.entry_point
}

rule pscrambler_12_by_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65 }
    condition:
        $a at pe.entry_point
}

rule Frusion_biff_additional {
    strings:
        $a = { 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_PCGuard_403_415_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }
    condition:
        $a at pe.entry_point
}

rule T_PACK_v05c_m1_additional {
    strings:
        $a = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE }
    condition:
        $a at pe.entry_point
}

rule Hasp_dongle_Alladin {
    strings:
        $a = { 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A }
        $b = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
        $c = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Dropper_Creator_V01_Conflict_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Cpp_DLL_Method_2 {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Vx_Necropolis1963_additional {
    strings:
        $a = { B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix_additional {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v_If_you_know_this_version_post_on_PEiD_board_h2 {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }
        $c = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NextSun_Audio_file_Hint_FILE_START {
    strings:
        $a = { 2E 73 6E 64 }
    condition:
        $a at pe.entry_point
}

rule dUP_v2x_Patcher_wwwdiablo2oo2cjbnet {
    strings:
        $a = { 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F }
    condition:
        $a at pe.entry_point
}

rule Upack_v039_final_Dwing_h {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Aluwain_803 {
    strings:
        $a = { B8 00 00 50 E4 21 50 B8 00 00 8C DB 03 C3 50 B8 00 00 50 CB 50 }
    condition:
        $a at pe.entry_point
}

rule Vx_Grazie883_Hint_DOS_EP {
    strings:
        $a = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL_encrypted_additional {
    strings:
        $a = { 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10B_vcasm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10804 {
    strings:
        $a = { A8 03 61 75 08 B8 01 C2 0C 68 C3 8B 85 26 04 8D 8D 3B 04 51 50 FF }
        $b = { 60 E8 41 06 00 00 EB 41 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HackStop_114EXE {
    strings:
        $a = { 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 53 BB EB 04 5B EB FB 9A B9 08 02 }
    condition:
        $a at pe.entry_point
}

rule Upack_01x_beta_Dwing_additional {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_pack_GPcH_additional {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point
}

rule MS_HTML_Help_file_Hint_FILE_START {
    strings:
        $a = { 49 54 53 46 }
    condition:
        $a at pe.entry_point
}

rule AVPACK_v120 {
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }
    condition:
        $a at pe.entry_point
}

rule Vx_Raubkopie2219_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 8C D0 2E ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 8E D0 BC ?? ?? 1E 8E D8 58 A3 ?? ?? E8 ?? ?? 8C C8 8E C0 E8 ?? ?? BA ?? ?? B4 1A CD 21 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2223_compressed_code_wwwstrongbitcom_additional {
    strings:
        $a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
    condition:
        $a at pe.entry_point
}

rule XPack_140_EXE {
    strings:
        $a = { 2E 83 26 01 01 00 8B EC EB 01 E8 FA B8 C9 03 EB 01 9A FF E0 F3 03 FD 03 5E 04 86 04 E2 00 98 04 CF 00 82 04 AC 00 85 04 AA 00 7A 04 FC 00 33 C0 8E D0 BC 10 00 2E 8F 06 0A 04 2E 8F 06 0F 04 EB 01 9A 0E 2E FF 36 B1 03 5F EB 01 9A 17 8B E5 FB }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_V150X_CGSoftLabs_Sign_by_fly_additional {
    strings:
        $a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 }
    condition:
        $a at pe.entry_point
}

rule tElock_v099_tE_TMD {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASL_Crypt_01 {
    strings:
        $a = { 41 2E 53 2E 4C F8 43 72 79 70 74 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v112_v115_v120_1_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1110_Nooby_20081228 {
    strings:
        $a = { E9 18 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 31 2E 30 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v27 {
    strings:
        $a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v25 {
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
        $b = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AntiDote_V12Demo_SIS_Team {
    strings:
        $a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 }
    condition:
        $a at pe.entry_point
}

rule IBM_IOCA_Graphics_format {
    strings:
        $a = { 00 11 D3 A6 FB }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_014_020_GlOFF {
    strings:
        $a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Method_3_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 8C DA 83 ?? ?? 8E DA 4A E8 ?? ?? 81 C3 ?? ?? A1 ?? ?? 2E ?? ?? A1 ?? ?? 03 C2 }
    condition:
        $a at pe.entry_point
}

rule EXE_joiner_Amok_additional {
    strings:
        $a = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V085_V092_MATCODE_Software_20080414 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
        $b = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ARC_SFX_Archive_Hint_DOS_EP {
    strings:
        $a = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_17_coban2k {
    strings:
        $a = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_21x_exe_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_VOB_ProtectCD_5_Anorganix {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Gentee_Installer_Custom_additional {
    strings:
        $a = { 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF }
    condition:
        $a at pe.entry_point
}

rule RAR_Archive {
    strings:
        $a = { 52 61 72 21 }
    condition:
        $a at pe.entry_point
}

rule Kofax_Group_4_graphics_file_Hint_FILE_START {
    strings:
        $a = { 2E 4B 46 68 80 00 01 00 }
    condition:
        $a at pe.entry_point
}

rule JDProtectV20081208demo_DLL_20090119 {
    strings:
        $a = { 8B 44 24 08 83 F8 01 75 1F E8 92 FE FF FF E8 3D 01 00 00 8B 44 24 0C 8B 4C 24 04 50 6A 01 51 E8 5C 57 00 00 83 C4 0C C3 85 C0 75 1E 8B 54 24 0C 52 50 8B 44 24 0C 50 E8 44 57 00 00 83 C4 0C E8 7C 46 00 00 B8 01 00 00 00 C3 8B 4C 24 0C 8B 54 24 04 51 50 52 E8 26 57 00 00 83 C4 0C C3 90 90 E8 }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_v01 {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 }
    condition:
        $a at pe.entry_point
}

rule Petite_14 {
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
        $b = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WinZip_32_bit_SFX_v6x_module {
    strings:
        $a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Petite_12 {
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }
    condition:
        $a at pe.entry_point
}

rule Petite_13 {
    strings:
        $a = { 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 }
        $b = { ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Private_exe_Protector_V230_V23X_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_310_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_v70_Basic_NET_additional {
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Yodas_Protector_v1032_Beta2_Ashkbiz_Danehkar_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_098_tHE_EGOiSTE_h {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule ENcryptCOM_v306_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B4 30 CD 21 3C 02 77 01 C3 }
    condition:
        $a at pe.entry_point
}

rule PeStubOEP_v1x {
    strings:
        $a = { 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF }
        $b = { B8 ?? ?? ?? 00 FF E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LARP_V2X_lena151_20080914 {
    strings:
        $a = { E4 74 04 FF 64 24 FC 81 E8 ?? ?? ?? ?? 81 E8 ?? ?? ?? ?? 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? ?? ?? E4 74 02 FF E0 81 E8 ?? 00 00 00 68 ?? ?? ?? ?? E8 ?? 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 74 08 8D 95 ?? ?? ?? ?? FF E2 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 8D ?? ?? ?? ?? ?? ?? ?? ?? 84 C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 F8 72 08 E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E0 81 ?? ?? ?? ?? C3 E8 ?? 00 00 00 81 2D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v301_v305 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
        $b = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Kbys_Packer_028_Beta_shoooo314 {
    strings:
        $a = { 68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Packer_v70_by_TurboPower_Software_Hint_DOS_EP_additional {
    strings:
        $a = { EB ?? 1E 06 8C C3 83 ?? ?? 0E 1F 01 ?? ?? ?? 01 ?? ?? ?? BE ?? ?? B9 ?? ?? FC AD 3B C1 74 }
    condition:
        $a at pe.entry_point
}

rule FSG_v131_Eng_dulekxt_additional {
    strings:
        $a = { BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }
    condition:
        $a at pe.entry_point
}

rule The_Guard_Library_additional {
    strings:
        $a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
    condition:
        $a at pe.entry_point
}

rule CodeSafe_v20_additional {
    strings:
        $a = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }
    condition:
        $a at pe.entry_point
}

rule COMPACK_v51 {
    strings:
        $a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }
    condition:
        $a at pe.entry_point
}

rule PC_PE_Encryptor_Alpha_preview_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
    condition:
        $a at pe.entry_point
}

rule DiskDupe_c_MSD_Configuration_file_additional {
    strings:
        $a = { 4D 53 44 20 44 61 74 61 20 56 65 72 73 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16_Vaska {
    strings:
        $a = { 33 D0 68 ?? ?? ?? ?? FF D2 }
        $b = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AntiDote_v14_osCE_Sing_by_osCppCoDeR {
    strings:
        $a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 }
        $b = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Safeguard_10_Simonzh {
    strings:
        $a = { E8 00 00 00 00 EB 29 }
    condition:
        $a at pe.entry_point
}

rule NoName_Packer {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
    condition:
        $a at pe.entry_point
}

rule Upack_v029_Beta_v031_Beta {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1988_04 {
    strings:
        $a = { 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule aPack_096_m {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 B1 01 73 13 FF D5 BB 10 00 72 25 FF D5 12 DB 73 FA 75 00 93 AA EB E3 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 }
    condition:
        $a at pe.entry_point
}

rule PrivateEXE_v20a_additional {
    strings:
        $a = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }
    condition:
        $a at pe.entry_point
}

rule nbuild_v10_soft_additional {
    strings:
        $a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_046_Hying {
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_LZMA_430_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 }
    condition:
        $a at pe.entry_point
}

rule AppLok_95_20 {
    strings:
        $a = { 55 8B EC 83 C4 F4 E8 2D 36 FD FF E8 EC 4B FD FF E8 27 7B FD FF E8 EA E4 FD FF E8 21 E6 FD FF E8 6C 05 FE FF E8 73 7C FE FF E8 4E 49 FF FF E8 DD 81 FF FF E8 AC AB FF FF A1 24 16 43 00 E8 92 3F FF FF BA 34 FE 42 00 A1 24 16 43 00 E8 AF 3C FF }
    condition:
        $a at pe.entry_point
}

rule CodeVeil_V12_V13_XHEO_20080409 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 64 24 00 55 8B EC 53 56 57 8B 4D 10 83 81 B8 00 00 00 05 83 A1 C0 00 00 00 DF 33 C0 5F 5E 5B C9 C3 8B FF 60 E8 01 00 00 00 B8 5E E8 01 00 00 00 B8 58 2D 31 01 00 00 8B 00 2B F0 81 E6 00 00 FF FF 03 76 3C 33 C9 66 8B 4E 14 8D 74 31 18 8B 5E 0C 03 DE 81 E3 00 F0 FF FF 8B 56 08 E8 05 00 00 00 E9 ?? 00 00 00 55 8B EC 83 C4 F0 B9 E9 00 00 00 8B F3 03 DA E8 01 00 00 00 B8 58 2D 77 01 00 00 8B 00 03 C6 89 45 F4 E8 01 00 00 00 B8 5A 81 EA 86 }
    condition:
        $a at pe.entry_point
}

rule NFO_v1x_modified_additional {
    strings:
        $a = { 60 9C 8D 50 }
    condition:
        $a at pe.entry_point
}

rule BamBam_v001_Bedrock {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v50_KOL {
    strings:
        $a = { 53 8B D8 33 C0 A3 6A ?? E8 FF A3 A1 A3 33 C0 A3 33 C0 A3 }
        $b = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_PE_Intro_10_Anorganix {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_PENightMare_2_Beta_Anorganix {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_Dll_WinMain_additional {
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v090_v092 {
    strings:
        $a = { EB 06 68 C3 9C 60 E8 5D 55 58 81 ED 2B 85 01 85 50 B9 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_additional {
    strings:
        $a = { EB 02 ?? ?? EB 02 }
    condition:
        $a at pe.entry_point
}

rule nPack_V115002008_Beta_NEOxnbsp_nbsp_SignByfly {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_emadicius_h {
    strings:
        $a = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule CAN_Crunched_ANsi_file_Hint_FILE_START {
    strings:
        $a = { CA 01 }
    condition:
        $a at pe.entry_point
}

rule Unknown_SFX_Archive_aWAW {
    strings:
        $a = { 61 57 41 57 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_Neolite_20_emadicius_additional {
    strings:
        $a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }
    condition:
        $a at pe.entry_point
}

rule Libraries_by_John_Socha_Hint_DOS_EP {
    strings:
        $a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_11_coban2k {
    strings:
        $a = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1361_Obsidium_Softwarenbsp_nbsp_SignByfly_20080521 {
    strings:
        $a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule GHF_Protector_GPcH {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point
}

rule Lcc_win_32_13 {
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 00 00 00 00 68 9A 10 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 }
    condition:
        $a at pe.entry_point
}

rule Img_Software_Set_graphics_file {
    strings:
        $a = { 53 43 4D 49 20 20 20 31 41 54 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20 {
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
    condition:
        $a at pe.entry_point
}

rule StarForce_V3X_StarForce_Copy_Protection_System {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule The_WiZ_Cryptor_v100a_by_SP0T_UCL_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FA 60 56 1E 8E D8 BE ?? ?? BF ?? ?? B8 ?? ?? 87 ?? ?? ?? AB 8C C8 87 ?? ?? ?? AB 1F 68 ?? ?? 9C 58 80 ?? ?? 50 9D FC }
    condition:
        $a at pe.entry_point
}

rule Vx_Manuelbased_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 0E B8 ?? ?? 50 06 1E 55 E8 ?? ?? 43 60 14 ?? 02 E9 53 0C 00 ?? ?? ?? ?? ?? ?? 5D 83 ?? ?? 8D ?? ?? ?? BF ?? ?? A5 A4 B4 ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule UPX_040_051_EXE {
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 21 05 00 02 07 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_BG_Software_additional {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        $a at pe.entry_point
}

rule SoftWrap_additional {
    strings:
        $a = { 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_016b_0163b_defiler {
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule Upack_V010_V011_Dwing_Sign_by_fly {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }
    condition:
        $a at pe.entry_point
}

rule Video_CD_file_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule Lotus_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 01 00 00 00 01 00 08 00 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_NTkrnl_team {
    strings:
        $a = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }
        $b = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AntiVirus_Vaccine_v103 {
    strings:
        $a = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }
    condition:
        $a at pe.entry_point
}

rule KBys_Packer_028_Beta_Shoooo {
    strings:
        $a = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_21Beta_211_p0ke {
    strings:
        $a = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }
        $b = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_Macromedia_Flash_Projector_60 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule Neolite_v20 {
    strings:
        $a = { 9E 37 ?? ?? 48 6F 4C }
        $b = { E9 A6 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CSV_01 {
    strings:
        $a = { FC BE 00 01 8B FE B9 00 00 51 56 57 B4 18 04 0A AC 90 90 2A C4 32 C4 AA E2 F6 5F 5E 59 03 F1 83 EE 03 A5 A4 B8 00 01 50 33 C0 33 DB 33 C9 33 D2 33 F6 33 FF C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_30_additional {
    strings:
        $a = { 55 8B EC 83 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v151x_additional {
    strings:
        $a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }
    condition:
        $a at pe.entry_point
}

rule DrHalo_or_DrGenius_Image_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 3A 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1987_or_Borland_Cpp_1991 {
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule RLPack_116_LZMA_compression_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v100b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }
    condition:
        $a at pe.entry_point
}

rule nSpack_V2x_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }
    condition:
        $a at pe.entry_point
}

rule Vx_Predator2448_Hint_DOS_EP {
    strings:
        $a = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_FSG_131_Anorganix {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }
    condition:
        $a at pe.entry_point
}

rule AinEXE_223 {
    strings:
        $a = { 0E 07 B9 14 00 BE 00 01 33 FF FC F3 A4 A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD FE CA 78 17 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF }
    condition:
        $a at pe.entry_point
}

rule Upack_Upack_030_032_beta_Dwing {
    strings:
        $a = { 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Wicat_GED_Graphics_format {
    strings:
        $a = { 0D 00 40 00 }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Password_Protector_v10 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_CrunchPE_Heuristic_Anorganix {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FASM_v13x {
    strings:
        $a = { E8 ?? 6E ?? ?? 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 }
        $b = { 6A ?? FF 15 ?? ?? ?? ?? A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_GRUNT4Family {
    strings:
        $a = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ACProtect_109_Anorganix {
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20_RC2 {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule XPack_139_EXE {
    strings:
        $a = { 2E C7 06 01 01 00 00 8B EC EB 01 E8 2E C6 06 0E 05 FA EB 00 9A BC 1C 05 2E C6 06 1A 05 C3 EB 00 9A 90 42 05 06 09 95 19 99 26 03 62 F7 03 74 05 8F 05 1A 06 50 06 E2 00 64 06 CF 00 4C 06 AC 00 4F 06 AA 00 43 06 FC 00 33 E4 8E D4 83 C4 10 2E }
    condition:
        $a at pe.entry_point
}

rule SDProtector_BasicPro_Edition_110_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
    condition:
        $a at pe.entry_point
}

rule PackerPetite_v22_Compresor_wwwun4seencompetite {
    strings:
        $a = { B8 00 ?0 ?? 00 6? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V112_V114_aPlib_043_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule UPX_081_083_EXE {
    strings:
        $a = { B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0A 03 03 07 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Watcom_CCpp_DLL_Anorganix {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }
    condition:
        $a at pe.entry_point
}

rule SGI_Image_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 01 DA 00 01 00 03 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V1451_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D }
    condition:
        $a at pe.entry_point
}

rule Dev_Cue_4992_Bloodshed_Software {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D }
    condition:
        $a at pe.entry_point
}

rule Dev_Cpp_v4_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Petite_14_c1998_99_Ian_Luck_h_additional {
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v50v60_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Gotcha879_additional {
    strings:
        $a = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V12X_Obsidium_Software_additional {
    strings:
        $a = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_10_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }
    condition:
        $a at pe.entry_point
}

rule MS_FORTRAN_Library_19 {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }
        $b = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CRYPT_Version_17_c_Dismember_COM_Hint_DOS_EP {
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60 }
    condition:
        $a at pe.entry_point
}

rule AverCryptor_102_beta_os1r1s_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F }
    condition:
        $a at pe.entry_point
}

rule Xtreme_Protector_107_Rafael_Ahucha_Sergio_Lara {
    strings:
        $a = { B8 ?? ?? ?? 00 B9 8E ?? ?? 00 50 51 E8 1E 00 00 00 E8 00 00 00 00 58 2D 16 00 00 00 B9 }
    condition:
        $a at pe.entry_point
}

rule nPack_V112752006Beta_NEOx_200800212 {
    strings:
        $a = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point
}

rule PeCompact_253_DLL_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
        $b = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_PACK_099_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win32_1999_additional {
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2 }
    condition:
        $a at pe.entry_point
}

rule MSVCpp_DLL_v8_typical_OEP_recognized_h_additional {
    strings:
        $a = { 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16d_by_Vaska_UsAr_sign_21032007_2222 {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0971_v0976 {
    strings:
        $a = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }
    condition:
        $a at pe.entry_point
}

rule JAM_v211_Hint_DOS_EP {
    strings:
        $a = { 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v039_final_relocated_image_base_By_Dwing_c2005_h2_additional {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C }
    condition:
        $a at pe.entry_point
}

rule BlindSpot_10_s134k {
    strings:
        $a = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50 }
        $b = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Encrypted_by_RSCC286_v102 {
    strings:
        $a = { FE 52 53 43 43 2F 31 2E 30 32 FE }
    condition:
        $a at pe.entry_point
}

rule VBOX_v43_MTE {
    strings:
        $a = { 36 3E 26 8A C0 60 }
        $b = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MicroJoiner_16_coban2k_additional {
    strings:
        $a = { 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B }
    condition:
        $a at pe.entry_point
}

rule ExeShield_Protector_36_wwwexeshieldcom {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }
    condition:
        $a at pe.entry_point
}

rule AutoLogic_Graphics_format_Hint_FILE_START {
    strings:
        $a = { FF 04 00 07 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_30_ {
    strings:
        $a = { 55 8B EC 83 }
    condition:
        $a at pe.entry_point
}

rule USSR_031_by_Spirit_additional {
    strings:
        $a = { E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3 }
    condition:
        $a at pe.entry_point
}

rule Upack_022_023_beta_Dwing_additional {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_3X_5X_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }
        $b = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TPack_05_m2 {
    strings:
        $a = { 68 00 01 FD 60 BE 00 00 BF 48 FF B9 00 00 F3 A4 8B F7 BF 00 01 FC 46 E9 CE FD }
    condition:
        $a at pe.entry_point
}

rule TPack_05_m1 {
    strings:
        $a = { 68 00 01 FD 60 BE 00 00 BF D3 FF B9 00 00 F3 A4 8B F7 BF 00 01 FC 46 E9 8E FE }
    condition:
        $a at pe.entry_point
}

rule PKLite_200COM {
    strings:
        $a = { 50 B8 00 00 BA 00 00 3B C4 73 79 8B C4 2D 42 03 25 F0 FF 8B F8 B9 A1 00 BE 8E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 90 00 02 }
    condition:
        $a at pe.entry_point
}

rule PCShrink_071_beta {
    strings:
        $a = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }
    condition:
        $a at pe.entry_point
}

rule Rec_Small_102a {
    strings:
        $a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED EB 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 25 04 2E 03 86 29 04 FA 2E 8B A6 27 04 8E D0 EB 00 EA }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_113_cyclotron {
    strings:
        $a = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 }
        $b = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v123b3_v1241 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PECompact_14x_emadicius_h {
    strings:
        $a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule DEF_10_bartxt_additional {
    strings:
        $a = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEX_099_emadicius_additional {
    strings:
        $a = { B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point
}

rule Armadillo_300a_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F }
    condition:
        $a at pe.entry_point
}

rule Unknown_Joiner_sign_from_pinch_26032007_0212 {
    strings:
        $a = { 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80 }
    condition:
        $a at pe.entry_point
}

rule ZCode_Win32PE_Protector_v101 {
    strings:
        $a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V115_V117_aPlib_043_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule aPack_099_m_x_EXE {
    strings:
        $a = { 8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 00 00 05 00 00 0E }
    condition:
        $a at pe.entry_point
}

rule Crypter_31_SLESH_additional {
    strings:
        $a = { 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PECompact_14p {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_minimum_protection {
    strings:
        $a = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_nSPack_13_emadicius_additional {
    strings:
        $a = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_13_SplitpCrypt_Method_Bill_Prisoner_TPOC_additional {
    strings:
        $a = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
    condition:
        $a at pe.entry_point
}

rule Setup_Factory_6x_Custom {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D }
        $b = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Adobe_PhotoShop_Plugin {
    strings:
        $a = { 83 7C 24 08 01 75 09 8B 44 24 04 A3 00 00 00 10 B8 01 00 00 00 C2 0C 00 8D 64 24 00 8D 64 24 00 56 57 8B 74 24 0C 8B 7E 0C 83 C7 0C 83 3F }
    condition:
        $a at pe.entry_point
}

rule ProActivate_V10X_TurboPower_Software_Company_Sign_by_fly {
    strings:
        $a = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33 }
    condition:
        $a at pe.entry_point
}

rule eXPressorLightV1701_CGSoftLabs_20090603 {
    strings:
        $a = { 55 8B EC 81 EC 84 02 00 00 53 56 57 83 A5 A8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 F0 ?? ?? ?? 68 78 ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 F0 FE FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 D8 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 D7 FD FF FF 89 85 AC FD FF FF 8B 85 AC FD FF FF 0F BE 00 83 F8 5C }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_iBox_LZMA_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point
}

rule Themida_1201_Oreans_Technologies_h_additional {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RatPacker_Glue_stub_additional {
    strings:
        $a = { 40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF }
    condition:
        $a at pe.entry_point
}

rule TheHypers_protector_TheHyper_h {
    strings:
        $a = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D }
        $b = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v09782_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }
    condition:
        $a at pe.entry_point
}

rule Crypto_Lock_vV202_Eng_Ryan_Thian {
    strings:
        $a = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 }
    condition:
        $a at pe.entry_point
}

rule Username_300_EXE {
    strings:
        $a = { FB 2E 8C 1E 22 02 2E 8C 06 3F 02 2E 8B 0E 41 02 2E 8B 1E 43 02 8C C8 2B C1 8B C8 2E 89 1E 1E 02 2E 89 0E 20 02 33 C0 8E D8 06 0E 07 FC 33 F6 BF 1B 03 B9 14 00 F3 A4 07 FA A1 84 00 8B 1E 86 00 A3 0C 00 89 1E 0E 00 8B 16 40 00 8B 1E 42 00 B8 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_42_DLL {
    strings:
        $a = { 53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D 00 00 00 00 00 75 09 33 C0 5D 5F 5E 5B C2 0C 00 83 FB 01 74 05 83 FB 02 75 3A 8B 0D 00 00 00 00 85 C9 74 0F 8B 7C 24 1C 8B 74 24 14 57 53 56 FF D1 EB 08 8B 74 24 14 8B 7C 24 1C 85 C0 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v13045 {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 }
    condition:
        $a at pe.entry_point
}

rule RJoiner_12_by_Vaska_25032007_1658_additional {
    strings:
        $a = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v13045_additional {
    strings:
        $a = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_wLZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Trap_116 {
    strings:
        $a = { 8C D0 BB 99 CB 90 8E D3 33 DB 8E D0 8B C3 EB 0F 90 66 0F BD C3 0F 06 66 0F BD C3 66 0F BC C3 B9 7D 04 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0E 90 90 83 C1 FE 83 C2 01 EB EB EB FE CD 78 0F 21 E9 0F 21 DB 66 03 CB }
    condition:
        $a at pe.entry_point
}

rule UPX_293_300_LZMA {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_p_Password_checking_additional {
    strings:
        $a = { 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Batch_Compiler_10 {
    strings:
        $a = { FC BD 58 01 8B 6E 00 8B 66 02 8B 5E 04 B4 4A CD 21 A1 2C 00 89 46 1A 8B 5E 00 FF E3 }
    condition:
        $a at pe.entry_point
}

rule Vx_Uddy2617_Hint_DOS_EP {
    strings:
        $a = { 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_BeRo_Farbrausch_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic_additional {
    strings:
        $a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v153 {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_V1X_V2X_Fisun_AV {
    strings:
        $a = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }
    condition:
        $a at pe.entry_point
}

rule _Protector_v1111_DDeM_PE_Engine_v09_DDeM_CI_v092_additional {
    strings:
        $a = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }
    condition:
        $a at pe.entry_point
}


rule Themida_1920 {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00 }
        $b = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_ASProtect {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v21x {
    strings:
        $a = { BB E9 60 9C FC BF B9 F3 AA 9D 61 C3 55 8B }
    condition:
        $a at pe.entry_point
}

rule kkryptor_9_kkryptor_a_rsc {
    strings:
        $a = { 60 E8 00 00 00 00 5E B9 47 08 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 F6 66 B9 1B }
    condition:
        $a at pe.entry_point
}

rule PE_Spin_v04x_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
    condition:
        $a at pe.entry_point
}

rule TrueVision_Targa_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 00 02 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule US_Patent_Image_graphics_file_Hint_FILE_START {
    strings:
        $a = { 55 53 20 50 54 4F 20 00 }
    condition:
        $a at pe.entry_point
}

rule DrHalo_or_DrGenius_Palette_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 41 48 E3 00 00 00 0A 00 }
    condition:
        $a at pe.entry_point
}

rule Naked_Packer_V1X_BigBoote {
    strings:
        $a = { 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF E8 00 00 00 00 EB 01 ?? 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 }
        $b = { 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Shegerd_Dongle_V478_MSCo_additional {
    strings:
        $a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_V100_BeRo {
    strings:
        $a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }
        $b = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sentinel_SuperPro_Automatic_Protection_v641_Safenet {
    strings:
        $a = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
        $b = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Hardlock_dongle_Alladin {
    strings:
        $a = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }
    condition:
        $a at pe.entry_point
}

rule Upack_v031_beta_Dwing_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point
}

rule AHPack_01_FEUERRADER_additional {
    strings:
        $a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0761_pe_exe_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_10_Alex {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_090_099_m_EXE {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD 00 00 33 C9 50 A4 }
    condition:
        $a at pe.entry_point
}

rule PEiD_4250_624_Six_to_Four_v10_Hint_DOS_EP {
    strings:
        $a = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_20_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }
    condition:
        $a at pe.entry_point
}

rule Trainer_Creation_Kit_v5_Trainer_additional {
    strings:
        $a = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_CAB_SFX_module {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 ?? 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E }
        $b = { 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_Borland_Delphi_30_Anorganix_additional {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Vprotect_V189_193_CoooLie {
    strings:
        $a = { 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 50 33 C0 F0 87 47 50 58 8B 7F 1C C3 }
    condition:
        $a at pe.entry_point
}

rule NoodleCrypt_200_Eng_NoodleSpa {
    strings:
        $a = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_13_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Borland_Delphi_30_Anorganix {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v113_DarkStop_v10 {
    strings:
        $a = { FA BD ?? ?? D4 85 4E 32 EB EB }
    condition:
        $a at pe.entry_point
}

rule UPX_200_30X_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional {
    strings:
        $a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Video_Lan_Client_Anorganix {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule AVP_Antiviral_Database_Hint_FILE_START {
    strings:
        $a = { 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point
}

rule EPExE_Pack_V10_6aHguT_g_l_u_k {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        $a at pe.entry_point
}

rule RLPack_11_BasicEdition_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_50_Dll_Silicon_Realms_Toolworks {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule nPack_113002006_Beta_NEOx_additional {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 }
    condition:
        $a at pe.entry_point
}

rule ExeSplitter_10_Bill_Prisoner_TPOC {
    strings:
        $a = { E9 ?? ?? ?? 00 4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Packer {
    strings:
        $a = { FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 }
    condition:
        $a at pe.entry_point
}

rule hmimyss_PE_Pack_01_hmimys_additional {
    strings:
        $a = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_025_ANAKiN_DaVinci {
    strings:
        $a = { 60 E8 2B 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_293_LZMA_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Morphine_V33_Holy_Father_Ratter29A {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule EPExE_Pack_V14_lite_final_6aHguT_g_l_u_k_additional {
    strings:
        $a = { 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V11_cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E }
    condition:
        $a at pe.entry_point
}

rule Vx_Igor_Hint_DOS_EP {
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Desktop_File_Hint_FILE_START {
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1033_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10804_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Vx_TrojanFormat_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B4 2A CD 21 81 F9 ?? ?? 72 ?? 80 FE ?? 72 ?? 80 FA ?? 72 ?? B8 ?? ?? BB }
    condition:
        $a at pe.entry_point
}

rule Vx_MTE_non_encrypted_Hint_DOS_EP {
    strings:
        $a = { F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 }
    condition:
        $a at pe.entry_point
}

rule SecureEXE_30_ZipWorx_additional {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_131_dulekxt_ {
    strings:
        $a = { BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 }
    condition:
        $a at pe.entry_point
}

rule FSG_20_bartxt {
    strings:
        $a = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_V01_DLL_NTkrnl_Software_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule ESO_Eclipse_Operating_System_v208_p_DOS_Extender {
    strings:
        $a = { 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PuNkMoD_1x_PuNkDuDe_additional {
    strings:
        $a = { 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C }
    condition:
        $a at pe.entry_point
}

rule FakeNinja_v28_Spirit {
    strings:
        $a = { BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 }
    condition:
        $a at pe.entry_point
}

rule XoReR_10 {
    strings:
        $a = { BE 00 00 8B FE B9 6B 00 33 DB 80 C3 00 AC 32 C3 AA E2 F7 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_SPx_additional {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15 }
    condition:
        $a at pe.entry_point
}

rule BDC_HelpSystem_Help_file {
    strings:
        $a = { 42 44 43 20 48 65 6C 70 53 79 73 74 65 6D }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v129_additional {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }
    condition:
        $a at pe.entry_point
}

rule UPX_v081_v084_Modified_Laszlo_Markus {
    strings:
        $a = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF }
    condition:
        $a at pe.entry_point
}

rule PE_Protect_09_by_Cristoph_Gabler_1998_Hint_WIN_EP_p_66 {
    strings:
        $a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        $a at pe.entry_point
}

rule PESpin_10_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_V12X_Method1_bagie {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }
    condition:
        $a at pe.entry_point
}

rule PRO_PACK_v208_emphasis_on_packed_size_locked_Hint_DOS_EP {
    strings:
        $a = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_DLL_LZBRS {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
        $b = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v071_DLL_Hint_WIN_EP {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 }
    condition:
        $a at pe.entry_point
}

rule VProtector_10X_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_25xx_Jtit_additional {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule RCC_II286_v114_mild_Hint_DOS_EP {
    strings:
        $a = { FA BD ?? ?? BE ?? ?? 9C 46 30 ?? ?? ?? 99 }
    condition:
        $a at pe.entry_point
}

rule XM_music_file_Hint_FILE_START {
    strings:
        $a = { 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A }
    condition:
        $a at pe.entry_point
}

rule FakeNinja_v28_Spirit_additional {
    strings:
        $a = { BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_DLL_aPLib_Ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V25X_V26X_SetiSoft_Team_20080116 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft_SignByfly_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
    condition:
        $a at pe.entry_point
}

rule Anslym_FUD_Crypter {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_ {
    strings:
        $a = { EB ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_153_Stub_engine_17_GlOFF_additional {
    strings:
        $a = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_Ryd_additional {
    strings:
        $a = { BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule UPX_092_101_COM {
    strings:
        $a = { 81 FC 00 00 77 02 CD 20 B9 00 00 BE 00 00 BF 00 00 BB 00 80 FD F3 A4 FC 87 F7 83 EE C6 19 ED 57 57 E9 00 00 55 50 58 21 0B 01 04 07 00 00 00 00 00 00 00 00 00 00 00 00 06 00 FF FF }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Lockless_Intro_Pack_Anorganix {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point
}

rule DBPE_vxxx {
    strings:
        $a = { 60 E8 5D 8B FD 81 ED 2B B9 81 EF 83 BD 0F }
        $b = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_PE_Intro_10_Anorganix {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }
    condition:
        $a at pe.entry_point
}

rule GZIP_Archive_Hint_FILE_START {
    strings:
        $a = { 1F 8B 08 08 ?? ?? ?? 35 }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_RobinPE {
    strings:
        $a = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_LINK_v360_v364_v365_or_50121 {
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_vxx_additional {
    strings:
        $a = { 53 E8 00 00 00 00 5B 8B C3 2D }
    condition:
        $a at pe.entry_point
}

rule UPXFreak_V01_HMX0101_additional {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_v062_Hint_DOS_EP {
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win16_1991_Hint_WIN_EP {
    strings:
        $a = { 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule TurboBAT_v310_50_additional {
    strings:
        $a = { BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 }
    condition:
        $a at pe.entry_point
}

rule UPXHiT_001_sibaway7yahoocom_additional {
    strings:
        $a = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_VBOX_43_MTE_Anorganix {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_18_SetiSoft_additional {
    strings:
        $a = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 }
    condition:
        $a at pe.entry_point
}

rule PCShrink_v040b {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_12003318_12003518_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule SciFax_Graphics_file {
    strings:
        $a = { 44 54 3D 00 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v10 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v11 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v12 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V30X_Thinstall_Company_Sign_by_fly {
    strings:
        $a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_for_Windows_additional {
    strings:
        $a = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_075exe_Hying_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v101_BoB_BobSoft_additional {
    strings:
        $a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule ASPack_10801_Solodovnikov_Alexey {
    strings:
        $a = { 90 75 ?? 90 E9 }
    condition:
        $a at pe.entry_point
}

rule nbuild_v10_soft {
    strings:
        $a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_2_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE }
    condition:
        $a at pe.entry_point
}

rule App_Encryptor_Silent_Team_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89_additional {
    strings:
        $a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule ACE_SFX_Archive {
    strings:
        $a = { 2A 2A 41 43 45 2A 2A }
    condition:
        $a at pe.entry_point
}

rule ExeFactor_20_ExeFactor {
    strings:
        $a = { 55 8B EC 81 EC 7C 0B 00 00 53 56 57 E9 00 8B 01 00 55 53 43 41 54 49 4F 4E 33 82 42 9F 51 87 D5 12 BE 0A E2 A9 1B D3 67 F6 81 4F 2C FB 97 2C 96 22 8C EF 0E 7B B8 BE }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_MEW_11_SE_10 {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Upack_v01x_v02x_Dwing_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 }
    condition:
        $a at pe.entry_point
}

rule Celsius_Crypt_21_Z3r0_additional {
    strings:
        $a = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v13_Ian_Luck {
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
    condition:
        $a at pe.entry_point
}

rule LOCK98_V10028_keenvim_additional {
    strings:
        $a = { 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08 }
    condition:
        $a at pe.entry_point
}

rule eXPressorFullSupport_V1601_CGSoftLabsnbsp_nbsp_SignByfly_20080308 {
    strings:
        $a = { 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_420_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_build_0807_exe_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win32_1994 {
    strings:
        $a = { A1 C1 A3 57 51 33 C0 BF B9 3B CF }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Cpp_for_Win32_1995 {
    strings:
        $a = { A1 C1 A3 83 75 80 }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ActiveMARKTM {
    strings:
        $a = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }
        $b = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrypteXeC_09 {
    strings:
        $a = { 8B EC FA C7 46 F7 40 07 42 81 FA BD F3 75 F9 FF 66 F7 08 42 BE 27 1F 5B CC C2 C5 74 4B A3 A3 DB 93 1F C9 A6 C9 3A 7A 27 9F 38 F1 99 67 22 85 50 55 9C 23 39 77 85 94 34 E5 18 F9 06 A3 3E FA C4 3A 69 04 E8 09 AC 5F 97 EE D8 BE DA 05 00 06 99 }
    condition:
        $a at pe.entry_point
}

rule DrHalo_or_DrGenius_Image_Graphics_format {
    strings:
        $a = { ?? ?? 3A 03 00 00 }
        $b = { 3A 03 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule bambam_V004_bedrock_Sign_by_fly {
    strings:
        $a = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win32_1999 {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Crinkler_V01_V02_Rune_LHStubbe_and_Aske_Simon_Christensen_additional {
    strings:
        $a = { B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch {
    strings:
        $a = { 81 3A 00 00 00 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Armadillo_300_Anorganix {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point
}

rule HQR_data_file_Hint_FILE_START {
    strings:
        $a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V20_risco {
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule XPack_097_098_EXE_JoKo {
    strings:
        $a = { 68 ?? ?? ?? ?? 9C 60 E8 2D 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 44 ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? 01 00 62 ?? 01 00 71 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Loader_for_Dos_Extender_by_Doug_Hoffmann {
    strings:
        $a = { 0E 1F 8C C6 B4 4A 50 BB FF FF CD 21 73 C1 58 CD 21 72 BC 03 DE 8B EB B8 21 35 CD 21 06 53 56 B8 87 16 CD 2F 0B C0 75 C9 B8 00 16 CD 2F A8 7F 75 07 E8 51 00 66 C1 CD 10 B8 87 16 CD 2F 80 F9 03 0F 82 16 00 55 68 C0 00 66 5D 80 E3 01 74 9D 66 }
    condition:
        $a at pe.entry_point
}

rule UPX_090_101_EXE {
    strings:
        $a = { B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0B 03 03 07 }
    condition:
        $a at pe.entry_point
}

rule EPW_130_EXE {
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E A3 0A 00 8E D8 A1 08 00 2E 03 06 0A 00 2E A3 0C 00 A1 0E 00 2E 03 06 0A 00 2E A3 06 00 A1 10 00 2E A3 04 00 A1 14 00 2E A3 00 00 A1 16 00 2E 03 06 0A 00 2E A3 02 00 0E 1F BA 30 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_430_440_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_Delphi_stub {
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Delphi_30_Hint_WIN_EP {
    strings:
        $a = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PE_Crypt_102_emadicius_h {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Safengine_Shielden_v2160 {
    strings:
        $a = { E8 1C 00 00 00 53 61 66 65 6E 67 69 6E 65 20 53 68 69 65 6C 64 65 6E 20 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Video_Lan_Client_Anorganix_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Metrowerks_CodeWarrior_v20_Console_additional {
    strings:
        $a = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_bartxt_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_30X_Thinstall_Company_additional {
    strings:
        $a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point
}

rule ASPack_101b {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D2 2A 44 00 B8 CC 2A 44 00 03 C5 2B 85 A5 2E 44 00 89 85 B1 2E 44 00 80 BD 9C 2E 44 00 00 75 15 FE 85 9C 2E 44 00 E8 1D 00 00 00 E8 E4 01 00 00 E8 7A 02 00 00 8B 85 9D 2E 44 00 03 85 B1 2E 44 00 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule EP_ExE_Pack_V10_Elite_Coding_Group_additional {
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v5 {
    strings:
        $a = { 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? F3 FF FF E8 ?? F4 FF FF 33 C0 55 }
    condition:
        $a at pe.entry_point
}

rule Upack_v039_final_Sign_by_hot_UNP {
    strings:
        $a = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPack_Alt_Stub_Dwing_additional {
    strings:
        $a = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }
    condition:
        $a at pe.entry_point
}

rule Upack_v01x_v02x_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 }
    condition:
        $a at pe.entry_point
}

rule Windows_Type_1_font_metric_file_additional {
    strings:
        $a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }
    condition:
        $a at pe.entry_point
}

rule SENs_debug_protection {
    strings:
        $a = { BB 10 00 E8 22 00 BD FE 0F 28 63 29 53 45 4E E8 09 00 98 93 92 8A 80 20 21 52 CB 48 9D BB 00 00 9C 58 23 C5 50 03 C3 C3 B8 00 00 8C DD 03 DD C3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V540_Silicon_Realms_Toolworks_SignByfly_20080214_additional {
    strings:
        $a = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        $a at pe.entry_point
}

rule NsPack_V13_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule PROTECT_EXECOM_v50 {
    strings:
        $a = { 1E 0E 0E 1F 07 }
    condition:
        $a at pe.entry_point
}

rule Upack_V029_V031_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 }
    condition:
        $a at pe.entry_point
}

rule Fly_Crypter_10_ut1lz_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB }
    condition:
        $a at pe.entry_point
}

rule Copy_Protector_v20_additional {
    strings:
        $a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }
    condition:
        $a at pe.entry_point
}

rule KGB_SFX {
    strings:
        $a = { 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        $a at pe.entry_point
}

rule MCLOCK_13 {
    strings:
        $a = { 90 90 90 FA 29 C0 8E C0 26 C6 06 04 00 00 26 C6 06 05 00 00 26 8C 0E 06 00 26 C6 06 0C 00 00 26 C6 06 0D 00 00 26 8C 0E 0E 00 FB CD 01 8C C8 8E C0 CD 03 29 C0 BC 00 00 50 E9 00 00 BE 00 00 B3 00 B9 21 00 2E 30 1C 46 E2 FA CF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v1xx_v2xx {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }
    condition:
        $a at pe.entry_point
}

rule Lattice_C_v101 {
    strings:
        $a = { FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB }
    condition:
        $a at pe.entry_point
}

rule Password_protector_my_SMT_Hint_WIN_EP {
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 }
    condition:
        $a at pe.entry_point
}

rule Upack_v033_v034_Beta_Dwing {
    strings:
        $a = { ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Protect_v10_additional {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_V01_Teraphy_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule DIET_v144_v145f_additional {
    strings:
        $a = { F9 9C EB }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v182_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1032_dllocx_Ashkbiz_Danehkar_h {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
        $b = { 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v300_v301_Extractable {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC }
        $b = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEQuake_v006_forgotus_h {
    strings:
        $a = { E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_aPLib {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1100_Nooby_20081226 {
    strings:
        $a = { 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 30 2E 30 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Cpp_30_COM {
    strings:
        $a = { 8C CA 2E 89 16 00 03 B4 30 CD 21 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 E8 00 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F FC F2 AE E3 61 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 01 00 D3 E3 83 C3 08 83 E3 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10804_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 41 06 00 00 EB 41 }
    condition:
        $a at pe.entry_point
}

rule Unpack_20 {
    strings:
        $a = { 9C BA 00 00 2D 00 00 81 E1 00 00 81 F3 00 00 B4 00 9D 50 B8 00 00 BA 00 00 05 00 00 3B 06 02 00 72 2A B4 09 BA 1C 01 CD 21 B8 01 4C CD 21 4E 6F 74 20 65 6E 6F 75 67 68 20 6D 65 6D 6F 72 79 24 20 20 20 20 20 20 20 B9 00 00 2B FF 57 BE 54 01 }
    condition:
        $a at pe.entry_point
}

rule CRK_Compiler_120 {
    strings:
        $a = { 2F 4D 47 2F EB 04 00 00 00 00 C8 08 00 00 E8 00 00 0E 07 C6 46 FE 00 E8 00 00 E8 00 00 8B 0E 00 00 E3 02 EB 03 E9 D4 00 2B C0 89 46 F8 B8 00 00 89 46 FC C7 46 FA 00 00 51 BA 00 00 F6 06 00 07 01 74 03 BA 00 00 E8 B5 00 8B 56 FC BB 0F 00 E8 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10b_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_CodeSafe_20 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }
    condition:
        $a at pe.entry_point
}

rule FSG_131_dulekxt {
    strings:
        $a = { BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1994_Open_Watcom {
    strings:
        $a = { FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Sun_Icon_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_WinMain_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_DLL {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_MEW_11_SE_10 {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v10_additional {
    strings:
        $a = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule by_Central_Point_Software_Hint_DOS_EP_p_40 {
    strings:
        $a = { 50 51 52 56 57 8B EB 1E 2E }
    condition:
        $a at pe.entry_point
}

rule SDC_12_Self_Decrypting_Binary_Generator_by_Claes_M_Nyberg {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Crypter_31_SLESH {
    strings:
        $a = { 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }
    condition:
        $a at pe.entry_point
}

rule ASPack_103b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED AE 98 43 00 B8 A8 98 43 00 03 C5 2B 85 18 9D 43 00 89 85 24 9D 43 00 80 BD 0E 9D 43 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_20x_24x_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 00 87 DD 83 BD }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Automatic_Protection_640_Safenet {
    strings:
        $a = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_1_additional {
    strings:
        $a = { 06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7 }
    condition:
        $a at pe.entry_point
}

rule UPX_v30_EXE_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56 }
    condition:
        $a at pe.entry_point
}

rule Gamehouse_Media_Protector_Version_Unknown_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule iLUCRYPT_v4018_exe_Hint_DOS_EP {
    strings:
        $a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
    condition:
        $a at pe.entry_point
}

rule LE_Exe_Executable_Image_Hint_FILE_START {
    strings:
        $a = { 4C 45 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp {
    strings:
        $a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
        $b = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Basic_Compiler_v560_1982_97 {
    strings:
        $a = { 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB }
    condition:
        $a at pe.entry_point
}

rule Packman_0001_Bubbasoft_2 {
    strings:
        $a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_v211_212_Fisun_Alexander {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
        $b = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Nullsoft_Install_System_v20_RC2_additional {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
    condition:
        $a at pe.entry_point
}

rule BDC_HelpSystem_Help_file_Hint_FILE_START {
    strings:
        $a = { 42 44 43 20 48 65 6C 70 53 79 73 74 65 6D }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v137_SteelBytes {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 00 }
    condition:
        $a at pe.entry_point
}

rule MultiEdits_Programming_Language_help_Hint_FILE_START {
    strings:
        $a = { 0C 2A 20 }
    condition:
        $a at pe.entry_point
}

rule VProtect_DLL_v1x_ASL {
    strings:
        $a = { 3B C0 74 1C EB 00 DB 2D ?? ?? ?? 10 FF FF FF FF FF FF FF FF 3D 40 FF 56 50 72 6F 74 65 63 74 00 }
    condition:
        $a at pe.entry_point
}

rule DOS_Device_Driver {
    strings:
        $a = { FF FF FF FF }
    condition:
        $a at pe.entry_point
}

rule AZProtect_additional {
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Lockless_Intro_Pack_Anorganix {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ASProtect_Anorganix {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PiMP_Install_System_additional {
    strings:
        $a = { 83 EC ?? 53 55 56 }
    condition:
        $a at pe.entry_point
}

rule iLUCRYPT_4014_4015 {
    strings:
        $a = { 8B EC FA C7 46 F7 00 00 42 81 FA 00 00 75 F9 FF 66 F7 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_2122_dll_Alexey_Solodovnikov_h {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_032a_fake_EXE32Pack_13x_emadicius {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_20 {
    strings:
        $a = { E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Packman_0001_Bubbasoft_h {
    strings:
        $a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }
        $b = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Access_Database_file {
    strings:
        $a = { 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00 }
    condition:
        $a at pe.entry_point
}

rule ExeTools_v21_Encruptor_by_DISMEMBER_additional {
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2021_protected_IAT_wwwstrongbitcom_SignByhaggar {
    strings:
        $a = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_ASM_additional {
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v11_CGSoftLabs {
    strings:
        $a = { E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1032_exescrcom_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule PeX_099_bartCrackPl_additional {
    strings:
        $a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        $a at pe.entry_point
}

rule Morphine_33_Silent_Software_Silent_Shield_c2005_h_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
    condition:
        $a at pe.entry_point
}

rule PESPin_13_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Code_Lock {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }
    condition:
        $a at pe.entry_point
}

rule XoReR_21 {
    strings:
        $a = { BA 00 00 B9 48 20 51 B0 F5 E6 60 FA B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 00 00 8B 36 02 00 59 E2 E3 BB 00 00 90 FC 33 C0 80 EF 9D 81 FB 00 00 74 03 43 2A 17 30 15 47 40 FE C2 86 D6 02 D6 3D 81 01 75 E8 FB 27 EB 13 31 69 AA 78 DF E2 C6 }
    condition:
        $a at pe.entry_point
}

rule XoReR_20 {
    strings:
        $a = { BA 00 00 B9 48 20 51 B8 FF FF E7 21 B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 00 00 8B 36 02 00 59 E2 E3 81 C3 00 00 FC 33 C0 80 EF 9D 81 FB 00 00 74 03 43 2A 17 30 15 47 40 FE C2 86 D6 02 D6 3D 80 01 75 E8 FA 27 EB 13 31 B7 65 6A 8A 1E BC }
    condition:
        $a at pe.entry_point
}

rule Excalibur_V103_forgot_Sign_by_fly {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }
    condition:
        $a at pe.entry_point
}

rule KGCrypt_vxx {
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule Vx_Kuku448_Hint_DOS_EP {
    strings:
        $a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Vx_Kuku448_additional {
    strings:
        $a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule MS_FORTRAN_Library_19_Hint_DOS_EP_additional {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Neolite_20 {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1300_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_31_by_North_Star_Liu_Xing_Ping_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 }
    condition:
        $a at pe.entry_point
}

rule PCPEC_alpha_preview {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }
    condition:
        $a at pe.entry_point
}

rule PIRIT_v15 {
    strings:
        $a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }
    condition:
        $a at pe.entry_point
}

rule aPack_073_074_m_EXE {
    strings:
        $a = { 1E 06 8C C8 BA 00 00 03 C2 8B D8 05 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E D8 8E C3 33 FF 0E BE 32 00 05 00 00 50 6A 00 CB }
    condition:
        $a at pe.entry_point
}

rule PE_Pack_v099_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }
    condition:
        $a at pe.entry_point
}

rule WebCops_EXE {
    strings:
        $a = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Configuration_File_Hint_FILE_START {
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Gleam_100 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorIVPbased_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V01b_V08_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 }
        $b = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 40 50 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VOB_ProtectCD {
    strings:
        $a = { 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F }
    condition:
        $a at pe.entry_point
}

rule Upack_v02Beta {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_CD_Cops_II_Anorganix {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
    condition:
        $a at pe.entry_point
}

rule PrincessSandy_10_eMiNENCE_Process_Patcher_Patch {
    strings:
        $a = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_DxPack_10_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Anslym_Crypter_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B }
    condition:
        $a at pe.entry_point
}

rule UPX_V200_V290_Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser {
    strings:
        $a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule PCPaintPictor_graphics_file_format {
    strings:
        $a = { 34 12 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule DEF_10_bartxt {
    strings:
        $a = { BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_DLL_aPLib {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }
    condition:
        $a at pe.entry_point
}

rule Upack_v036_alpha_Dwing {
    strings:
        $a = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }
    condition:
        $a at pe.entry_point
}

rule GameGuard_nProtect {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
        $b = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule pirit_v15 {
    strings:
        $a = { ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D }
        $b = { 5B 24 55 50 44 FB 32 2E 31 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Metrowerks_CodeWarrior_DLL_v20_additional {
    strings:
        $a = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }
    condition:
        $a at pe.entry_point
}

rule Berio_200_beta_h_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Packer_10_additional {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V14X_risco_additional {
    strings:
        $a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point
}

rule EXE_Manager_Version_30_1994_c_Solar_Designer_additional {
    strings:
        $a = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_200_2 {
    strings:
        $a = { FC BE 00 01 B9 FB 02 8B 3E F9 03 57 03 F9 81 C7 00 01 57 F3 A4 5F 81 C7 35 00 FF E7 BE FB 03 59 BF 00 01 57 F3 A4 C3 9C 50 51 52 56 57 55 1E FC 2E C7 06 00 00 FF FF 2E C7 06 06 00 12 00 8C C8 3D 00 A0 72 10 8E D8 BA CD 02 0E 1F B4 09 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_200_1 {
    strings:
        $a = { FA B8 00 00 05 0F 00 B9 04 00 D3 E8 8C C9 03 C1 8E D8 8C 06 00 00 26 8B 1E 2C 00 89 1E 47 01 8B D8 2B 1E 00 00 89 1E AD 00 26 8B 1E 02 00 2B D8 81 FB 00 10 72 03 BB FF 0F 8B D0 03 D3 42 B1 04 D3 E3 8E D0 8B E3 81 EB 00 00 80 FF 02 73 06 BA }
    condition:
        $a at pe.entry_point
}

rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_signed {
    strings:
        $a = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }
    condition:
        $a at pe.entry_point
}

rule IBM_PictureMaker_graphics_file_additional {
    strings:
        $a = { 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01 }
    condition:
        $a at pe.entry_point
}

rule YZPack_12_UsAr {
    strings:
        $a = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }
    condition:
        $a at pe.entry_point
}

rule CDS_SS_v10_Beta_1_CyberDoom_Team_X_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_226_DLL_minimum_protection {
    strings:
        $a = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_ASProtect_10_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D }
    condition:
        $a at pe.entry_point
}

rule Minke_V101_Codius_Sign_by_fly {
    strings:
        $a = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }
        $b = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stelth_PE_101_BGCorp {
    strings:
        $a = { ?? ?? ?? ?? ?? BA ?? ?? ?? 00 }
        $b = { BA ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NsPack_V11_LiuXingPing_ {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Method_2_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5B 50 8C C0 05 ?? ?? 8B ?? ?? ?? 03 C8 89 ?? ?? 8B ?? ?? ?? 03 C8 89 }
    condition:
        $a at pe.entry_point
}

rule SafeDiscSafeCast_2xx_3xx_Macrovision {
    strings:
        $a = { 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C }
    condition:
        $a at pe.entry_point
}

rule ExeSmasher_vxx_additional {
    strings:
        $a = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v34 {
    strings:
        $a = { 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v32 {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF }
    condition:
        $a at pe.entry_point
}

rule E_Language_WuTao {
    strings:
        $a = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }
    condition:
        $a at pe.entry_point
}

rule PKLite_201 {
    strings:
        $a = { 41 30 00 00 FF FF 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F FF FF 00 00 FF FF }
    condition:
        $a at pe.entry_point
}

rule BlindSpot_10_s134k_additional {
    strings:
        $a = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 }
    condition:
        $a at pe.entry_point
}

rule DBPE_vxxx_Ding_Boy {
    strings:
        $a = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED }
    condition:
        $a at pe.entry_point
}

rule UPXcrypter_archphaseNWC_additional {
    strings:
        $a = { BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_Library_1985_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v135_risco_software_Inc_Anticrack_Software_additional {
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point
}

rule Upack_v022_v023Beta_Sign_by_hot_UNP_additional {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V1451_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_DLL_Ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v265b1 {
    strings:
        $a = { 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 }
    condition:
        $a at pe.entry_point
}

rule Anskya_Binder_v11_Anskya {
    strings:
        $a = { BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }
    condition:
        $a at pe.entry_point
}

rule SafeDisc_4 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }
    condition:
        $a at pe.entry_point
}

rule CrackStop_v101_c_Stefan_Esser_1997_Hint_DOS_EP {
    strings:
        $a = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v10 {
    strings:
        $a = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_2403_Jitit_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF }
    condition:
        $a at pe.entry_point
}

rule XCR_v013_X_Lock {
    strings:
        $a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 00 EB }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v016b_v0163b_additional {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Nuts_Bolts_Disk_Image_Hint_FILE_START {
    strings:
        $a = { 4E 42 69 6D }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_v102_Vladimir_Sukhov {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E BE 01 00 00 00 C1 E6 02 83 EC 04 87 DE 89 1C 24 }
    condition:
        $a at pe.entry_point
}

rule Trilobytes_JPEG_graphics_Library_Hint_FILE_START {
    strings:
        $a = { 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Ultra_Compressors_Archive {
    strings:
        $a = { 55 43 32 1A }
    condition:
        $a at pe.entry_point
}

rule UPX_v070_Hint_DOS_EP {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point
}

rule VMProtect_180_phpbb3 {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A8 }
    condition:
        $a at pe.entry_point
}

rule MoleBoxPro_255_Mole_Studio {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 }
    condition:
        $a at pe.entry_point
}

rule Kofax_Group_4_graphics_file {
    strings:
        $a = { 2E 4B 46 68 80 00 01 00 }
    condition:
        $a at pe.entry_point
}

rule Windows_Write_file {
    strings:
        $a = { ?? BE 00 00 00 AB 00 00 00 }
        $b = { BE 00 00 00 AB 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_bartxt_Watcom_CCpp_EXE {
    strings:
        $a = { EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V130X_Obsidium_Software {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Pasword_Protector_V101_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Registration_file_v11_Hint_FILE_START {
    strings:
        $a = { 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D }
    condition:
        $a at pe.entry_point
}

rule Armadillo_50_Dll_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule Visual_Protect_11 {
    strings:
        $a = { 55 8B EC 51 53 56 57 83 25 6C 00 00 00 00 68 5C 00 00 00 FF 15 00 00 00 00 A3 BC 00 00 00 68 48 00 00 00 FF 35 BC 00 00 00 FF 15 04 00 00 00 A3 50 00 00 00 6A 00 FF 15 50 00 00 00 A3 A0 00 00 00 FF 35 A0 00 00 00 E8 42 04 00 00 59 89 45 FC }
    condition:
        $a at pe.entry_point
}

rule Encapsulated_Postscript_graphics_file_v20_EPSF_12_Hint_FILE_START {
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_v20 {
    strings:
        $a = { 55 8B EC 56 57 BF 8B 3B F7 }
        $b = { 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CubiComp_PictureMaker_graphics_format_red {
    strings:
        $a = { 16 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Soft_Defender_v11x_Randy_Li_additional {
    strings:
        $a = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }
    condition:
        $a at pe.entry_point
}

rule ASPack_v103b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_DLL_compressed_resources_wwwstrongbitcom_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 }
    condition:
        $a at pe.entry_point
}

rule FakeNinja_v28_Anti_Debug_Spirit_additional {
    strings:
        $a = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2223_protected_IAT_wwwstrongbitcom {
    strings:
        $a = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL {
    strings:
        $a = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }
    condition:
        $a at pe.entry_point
}

rule Metrowerks_CodeWarrior_DLL_v20 {
    strings:
        $a = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_ASPack_212_emadicius_h {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v244 {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD }
    condition:
        $a at pe.entry_point
}

rule aPack_v062_additional {
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }
    condition:
        $a at pe.entry_point
}

rule Immun_12_EXE {
    strings:
        $a = { 50 53 51 52 56 57 1E 06 2E 8B 0E FE 08 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE 00 09 BF 98 09 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C }
    condition:
        $a at pe.entry_point
}

rule StarForce_30_StarForce_Technology_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 57 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_vxxxx {
    strings:
        $a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }
    condition:
        $a at pe.entry_point
}

rule PolyEnE_001p_by_Lennart_Hedlund {
    strings:
        $a = { 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule v02Packer_ttt {
    strings:
        $a = { 60 E8 36 FE FF FF C3 90 ?? 00 }
    condition:
        $a at pe.entry_point
}

rule REC_C0ded_by_ROSE {
    strings:
        $a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule DAEMON_Protect_067_DAEMONUG {
    strings:
        $a = { 60 60 9C 8C C9 32 C9 E3 0C }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_main_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Modified_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_LCC_Win32_1x {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
    condition:
        $a at pe.entry_point
}

rule PRO_PACK_v208_emphasis_on_packed_size_locked {
    strings:
        $a = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule eXPressor_12_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_v100v101 {
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule PE_SHiELD_02 {
    strings:
        $a = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_2122_dll_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PECompact_14x_emadicius {
    strings:
        $a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule yzpack_V112_UsAr_Sign_by_fly {
    strings:
        $a = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_Setup_Module {
    strings:
        $a = { 55 8B EC 83 C4 }
        $b = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Private_exe_Protector_V25X_V26X_SetiSoft_Team_SignByfly_20080116 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_620_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LCC_Win32_DLL_Anorganix {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2422_V2428_Jitit_Sign_by_fly {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V20_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CorelPhotoPaint_Image_Hint_FILE_START {
    strings:
        $a = { 43 50 54 37 46 49 4C 45 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v020_Virogen {
    strings:
        $a = { E8 E8 01 00 00 60 01 AD B3 27 40 00 68 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_BJFNT_13_emadicius {
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule SmartE_Microsoft_additional {
    strings:
        $a = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }
    condition:
        $a at pe.entry_point
}

rule Adys_Glue_110_additional {
    strings:
        $a = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v117_Hint_DOS_EP {
    strings:
        $a = { FA BE ?? ?? 05 0C 00 07 1D 4A 46 1E 16 FD AC 44 ?? ?? ?? ?? F1 6D 84 D3 3D ?? ?? CF AF FB 34 DB 33 ?? ?? ?? ?? ?? D0 D6 ?? ?? 92 B4 24 9E }
    condition:
        $a at pe.entry_point
}

rule Upack_022_023_Dwing {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_UPX_06_Anorganix_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v13_CGSoftLabs_ {
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
    condition:
        $a at pe.entry_point
}

rule RLPack_Ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
    condition:
        $a at pe.entry_point
}

rule Armadillo_500_Silicon_Realms_Toolworks {
    strings:
        $a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
        $b = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_Full_Edition_117_DLL_Ap0x_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
    condition:
        $a at pe.entry_point
}

rule EXERefactor_V01_random_additional {
    strings:
        $a = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }
    condition:
        $a at pe.entry_point
}

rule Alloy_v1x2000_additional {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_apk2_V006_Dmitry_AND_Andreev_20080731 {
    strings:
        $a = { 60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule TPACK_v17_Archive_Hint_FILE_START {
    strings:
        $a = { 54 50 41 43 ?? 31 2E 37 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v14xp {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule NFO_v10_additional {
    strings:
        $a = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_Protected_Mode_additional {
    strings:
        $a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }
    condition:
        $a at pe.entry_point
}


rule LX_Exe_Executable_Image_Hint_FILE_START {
    strings:
        $a = { 4C 58 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1304_Obsidium_Software_h {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
        $b = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule COM2TXT_100 {
    strings:
        $a = { 54 58 50 50 50 2D 68 68 2D 67 67 2D 63 30 50 5F 58 33 45 30 5F 5F 35 4F 31 35 30 30 50 5F 2D 78 73 2C 67 31 45 68 35 33 31 35 78 6D 50 2D 3A 70 35 50 65 50 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 2D 68 38 35 38 4F 50 35 36 31 2D 30 70 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v3xx {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_017_GlOFF_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50 }
    condition:
        $a at pe.entry_point
}

rule SCRAMB_120 {
    strings:
        $a = { E8 00 00 5B 0E 1F 81 EB 50 02 8B C3 05 69 02 50 8B C8 03 D1 2B FA C3 56 34 00 D4 23 8B C3 05 00 02 89 87 93 04 8C 9F 95 04 33 C0 8E C0 8B D3 81 C2 86 02 B9 06 00 BE 04 00 26 8B 04 50 83 C6 02 83 F9 01 76 08 52 49 C3 43 76 88 99 11 26 A1 6C }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_iBox_LZMA {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point
}

rule DBPE_v153_Ding_Boy {
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Gleam_100 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
    condition:
        $a at pe.entry_point
}

rule DEF_v100_Eng_bartxt {
    strings:
        $a = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule kkrunchy_023_alpha_2_Ryd {
    strings:
        $a = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF }
        $b = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WATCOM_CCpp_Open_Watcom {
    strings:
        $a = { E9 ?? ?? ?? 00 ?? ?? ?? 00 57 41 }
    condition:
        $a at pe.entry_point
}

rule REALbasic_additional {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_100_Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }
    condition:
        $a at pe.entry_point
}

rule N_Joiner_01_Asm_Version_NEX_additional {
    strings:
        $a = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 }
    condition:
        $a at pe.entry_point
}

rule PECompact_123b3_1241 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB D2 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_1x_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 }
    condition:
        $a at pe.entry_point
}

rule CDS_SS_10_beta1_CyberDoom_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 }
    condition:
        $a at pe.entry_point
}

rule Creative_Audio_file_Hint_FILE_START {
    strings:
        $a = { 43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V11X_Method1_bagie_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }
    condition:
        $a at pe.entry_point
}

rule JAM_v211_additional {
    strings:
        $a = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 }
    condition:
        $a at pe.entry_point
}

rule N_Joy_13_NEX_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule hyings_PE_Armor_V07X_hying {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v014b {
    strings:
        $a = { E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V101_Ashkbiz_Danehkar_Sign_by_fly {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule VPacker_ttui_ImportTable_20080415 {
    strings:
        $a = { 00 00 00 00 FF FF FF FF FF FF FF FF ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 48 65 61 70 43 72 65 61 74 65 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 C3 8D 40 00 55 8B EC 51 E8 28 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1994_additional {
    strings:
        $a = { FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule ID_Application_Protector_V12_ID_Security_Suite {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
    condition:
        $a at pe.entry_point
}

rule Armadillo_430a_Silicon_Realms_Toolworks_h_additional {
    strings:
        $a = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53 }
    condition:
        $a at pe.entry_point
}

rule StarForce_ProActive_11_StarForce_Technology {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 57 }
    condition:
        $a at pe.entry_point
}

rule ProActivate_V10X_TurboPower_Software_Company {
    strings:
        $a = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33 }
        $b = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TIFF_Graphics_file_IBM_Hint_FILE_START {
    strings:
        $a = { 49 49 2A }
    condition:
        $a at pe.entry_point
}

rule HackStop_113_EXE {
    strings:
        $a = { 52 B8 00 30 1E CD 21 86 E0 3D 00 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A }
    condition:
        $a at pe.entry_point
}

rule MASM32_additional {
    strings:
        $a = { 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_102_by_Kas {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
    condition:
        $a at pe.entry_point
}

rule UPX_v072_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule PENightMare_v13 {
    strings:
        $a = { 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9 }
    condition:
        $a at pe.entry_point
}

rule GIF89a_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 47 49 46 38 39 61 }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v11b {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 }
    condition:
        $a at pe.entry_point
}

rule Safengine_Shielden_v2140 {
    strings:
        $a = { E8 ?? ?? ?? ?? 53 61 66 65 6E 67 69 6E 65 20 53 68 69 65 6C 64 65 6E 20 76 32 2E 31 2E 34 2E 30 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v13037_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 }
    condition:
        $a at pe.entry_point
}

rule Upack_V01X_V02X_Dwing_additional {
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule diProtector_1x_diProtector_Software_additional {
    strings:
        $a = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }
    condition:
        $a at pe.entry_point
}

rule LHA_SFX_Archive_v205S_v254S_Hint_DOS_EP {
    strings:
        $a = { EB ?? ?? ?? ?? FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1190_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 39 2E 30 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_TASM32_additional {
    strings:
        $a = { EB 01 ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v198_Nullsoft {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 2C 81 40 }
    condition:
        $a at pe.entry_point
}

rule GameGuard_v20065xx_dll_additional {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v300 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v26_WebToolMaster {
    strings:
        $a = { 60 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 }
    condition:
        $a at pe.entry_point
}

rule Upack_V033_V034_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 57 51 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF C1 ED ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 }
    condition:
        $a at pe.entry_point
}

rule InstallAnywhere_61_Zero_G_Software_Inc_additional {
    strings:
        $a = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule mkfpack_llydd {
    strings:
        $a = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }
        $b = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AntiDote_10_Beta_SIS_Team {
    strings:
        $a = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }
    condition:
        $a at pe.entry_point
}

rule RAR_SFX_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90 }
    condition:
        $a at pe.entry_point
}

rule cramble_v02b3_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 60 9C FC ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? 01 2A ?? FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_DxPack_10 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Upack_v029_Beta_v031_Beta_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule NetRun_310 {
    strings:
        $a = { 58 50 50 50 59 5A 49 51 44 5B 4C 2D 66 36 2D 67 34 31 47 44 53 58 75 27 40 2C 7E 50 5E 50 5F 4F 2C 21 28 47 55 28 47 5A 28 47 6E 75 35 3C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3D 0D 0A 43 46 46 46 52 58 2C 60 2C 60 32 24 46 3D }
    condition:
        $a at pe.entry_point
}

rule Vx_Igor {
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v50_DLL_additional {
    strings:
        $a = { 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Maked_by_The_DRAW_v_Hint_DOS_EP {
    strings:
        $a = { EB ?? B4 ?? CD 10 BB ?? ?? 3C ?? 74 ?? 3C ?? 74 ?? C6 }
    condition:
        $a at pe.entry_point
}

rule MZ_Crypt_10_by_BrainSt0rm {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0 }
        $b = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V119_aPlib_043_ap0x_Sign_by_fly_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF }
    condition:
        $a at pe.entry_point
}

rule Borland_precompiled_header_file {
    strings:
        $a = { 54 50 53 }
    condition:
        $a at pe.entry_point
}

rule ExeBundle_v30_small_loader_additional {
    strings:
        $a = { 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 }
    condition:
        $a at pe.entry_point
}

rule Petite_v14_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200b_extra {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2547_V2600_Jitit {
    strings:
        $a = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2609_Jitit_Sign_by_fly {
    strings:
        $a = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_098_Special_Build_forgot_heXer_additional {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_additional {
    strings:
        $a = { B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v430_440_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24 }
        $b = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule yodas_Protector_v102_exescrcom_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V0b_cyberbobnbsp_nbsp_SignByfly_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0 }
    condition:
        $a at pe.entry_point
}

rule InterLok_V5X_PACE_Anti_Piracy {
    strings:
        $a = { 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule PureBasic_4x_Neil_Hodgson {
    strings:
        $a = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
    condition:
        $a at pe.entry_point
}

rule VIRUS_I_WormHybris {
    strings:
        $a = { EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule SLR_OPTLINK_1_additional {
    strings:
        $a = { 87 C0 EB ?? 71 ?? 02 D8 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_UPX_0896_102_105_124_emadicius {
    strings:
        $a = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Vx_ACME_Clonewar_Mutant {
    strings:
        $a = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT2Family_Hint_DOS_EP {
    strings:
        $a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1992_1994_additional {
    strings:
        $a = { 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule StarForce_30_StarForce_Technology {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 63 }
    condition:
        $a at pe.entry_point
}

rule ExeShield_36_wwwexeshieldcom_additional {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }
    condition:
        $a at pe.entry_point
}

rule Imaging_Technology_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 49 4D 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v02_v02b_v02b2 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v120b_additional {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C }
    condition:
        $a at pe.entry_point
}

rule VOB_ProtectCD_additional {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 }
    condition:
        $a at pe.entry_point
}

rule COMCRYPT {
    strings:
        $a = { B9 00 00 BE 00 01 89 F7 0E 1F 0E 07 BB 00 00 FC AD 31 D8 AB E2 FA C6 06 00 01 00 C6 06 01 01 00 C6 06 02 01 00 E9 00 00 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_10_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }
    condition:
        $a at pe.entry_point
}

rule Vx_Hymn1865_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v172_v173_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule dxp_Decrementing_1_byte_XOR {
    strings:
        $a = { 30 10 FE CA 48 49 ?? 85 C9 75 F5 }
    condition:
        $a at pe.entry_point
}

rule PMODEW_133 {
    strings:
        $a = { FC 16 07 BF 00 01 8B F7 57 B9 5E 16 F3 A5 06 1E 07 1F 5F BE 22 02 06 0E A4 AD 8B E8 B2 10 1E B8 D9 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_ZCode_101_Anorganix {
    strings:
        $a = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v10_CGSoftLabs {
    strings:
        $a = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 }
    condition:
        $a at pe.entry_point
}

rule UPX_062_EXE {
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 07 00 02 07 }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v50 {
    strings:
        $a = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
        $b = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HackStop_115_117_EXE {
    strings:
        $a = { E8 00 00 52 BA EB 04 5A EB FB 9A B0 AD E6 64 52 BA EB 04 5A EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D FE 02 73 02 CD 20 52 BA EB 04 5A EB FB 9A 0E 1F E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F 52 BA EB 04 5A EB FB }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_046_China_Cracking_Group_additional {
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_or_Borland_Cpp_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule Morphine_V27_Holy_Father_Ratter29A {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Microsoft_Visual_Basic_50_60 {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule AVPack_12x_EXE {
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 10 01 FC F3 A5 06 BB 28 00 53 CB 2E 8B 16 0C 00 58 50 03 C2 2E 03 06 0E 00 BE FE FF 8B FE FD 8C D3 BD 00 10 8B CB 2B CA 51 8B CA 3B CD 76 02 8B CD 2B C5 2B DD 8E D8 8E C3 2B D1 D1 E1 D1 E1 D1 E1 F3 A5 0B D2 }
    condition:
        $a at pe.entry_point
}

rule Spalsher_v10_v30 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 89 AD 8C 01 ?? ?? 8B C5 2B 85 FE 75 ?? ?? 89 85 3E }
        $b = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MS_Run_Time_Library_1990_10 {
    strings:
        $a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1334_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule JDPack_V200_JDPack_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_SFX_Custom_additional {
    strings:
        $a = { E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50 }
    condition:
        $a at pe.entry_point
}

rule E2C_by_DoP_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_SVKP_111_emadicius_additional {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v302_v302a_v304_Relocations_pack_additional {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddiebased1745 {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }
    condition:
        $a at pe.entry_point
}

rule SCRAM_v08a1_additional {
    strings:
        $a = { B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C }
    condition:
        $a at pe.entry_point
}

rule Excalibur_103_forgot_additional {
    strings:
        $a = { E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 }
    condition:
        $a at pe.entry_point
}

rule LamCrypt_10_LaZaRuS {
    strings:
        $a = { 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 }
    condition:
        $a at pe.entry_point
}

rule EP_v10_additional {
    strings:
        $a = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_11C_p0ke {
    strings:
        $a = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10 }
        $b = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LaunchAnywhere_4001 {
    strings:
        $a = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1990_or_Turbo_C_1988 {
    strings:
        $a = { BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1033_exescrcom_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point
}

rule Petite_14_c1998_99_Ian_Luck_h {
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
        $b = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CRYPT_Version_17_c_Dismember_EXE_Hint_DOS_EP {
    strings:
        $a = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v07_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v20_bartxt {
    strings:
        $a = { 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Lock_v106 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }
    condition:
        $a at pe.entry_point
}

rule Upack_v033_v034_Beta_Sign_by_hot_UNP {
    strings:
        $a = { ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
        $b = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_v1300_Obsidium_Software_h_additional {
    strings:
        $a = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_450_DLL_X86_CRT_LIB {
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75 }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_RobinPE_additional {
    strings:
        $a = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PackItBitch_V10_archphase {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Goats_Mutilator_v16_Goat_e0f_additional {
    strings:
        $a = { E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10b_Ashkbiz_Danehkar_h {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule PE_Admin_V10_EncryptPE_V12003518_Sold_Flying_Cat {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FOXPRO_DOS_Watcom_C_386_Run_Time_System_Hint_DOS_EP {
    strings:
        $a = { EB ?? 8C D8 8E C0 B8 ?? ?? 8E D8 C7 ?? ?? ?? ?? ?? B8 ?? ?? 2D ?? ?? 3B C4 76 ?? C7 ?? ?? ?? ?? ?? 8F ?? ?? ?? 8F ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V27_V35_NsPacK_Private {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v60_DLL {
    strings:
        $a = { 55 89 E5 E8 C9 C3 45 58 }
        $b = { 5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_Macromedia_Flash_Projector_60_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }
    condition:
        $a at pe.entry_point
}

rule Stealth_PE_v11_additional {
    strings:
        $a = { BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2 }
    condition:
        $a at pe.entry_point
}

rule fds0ft_c0m_pr0tect_v04b {
    strings:
        $a = { 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Zprotect_V1400_V140X_lifeengines_20081019 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule BookManager_v9510 {
    strings:
        $a = { FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V1x_SIS_Team_additional {
    strings:
        $a = { 68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v12_BG_Software_Protect_Technologies {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PIMP_Install_System_v1x_Nullsoft {
    strings:
        $a = { 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1355_Obsidium_Softwarenbsp_nbsp_SignByfly_20080411 {
    strings:
        $a = { EB 01 ?? E8 2B 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_450_DLL_X86_CRT_LIB_additional {
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_for_Win32_v500_SofProBlagoje_Ceklic {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CRYPT_Version_17_c_Dismember_COM_additional {
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Intro_10_Anorganix_additional {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }
    condition:
        $a at pe.entry_point
}

rule VBOX_v42_MTE_additional {
    strings:
        $a = { 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 }
    condition:
        $a at pe.entry_point
}

rule PACKWIN_v101p {
    strings:
        $a = { 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_V1090_V1097_Nooby {
    strings:
        $a = { 53 51 E8 00 00 00 00 8B 1C 24 83 C3 25 33 C9 87 4B FC 83 F9 00 74 06 80 33 ?? 43 E2 FA 83 C4 04 59 5B 9D E9 04 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2_Anorganix {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_waPLib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PENinja_131_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule ASYLUM_Music_File_v10_additional {
    strings:
        $a = { 41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v23_North_Star_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }
    condition:
        $a at pe.entry_point
}

rule SafeDiscSafeCast_2xx_3xx_Macrovision_additional {
    strings:
        $a = { 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100c_1_additional {
    strings:
        $a = { 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE }
    condition:
        $a at pe.entry_point
}

rule Protect_Shareware_11_eCompserv_CMS {
    strings:
        $a = { 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CA_Visual_Objects_20_25_ {
    strings:
        $a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Macromedia_Flash_Projector_60_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_20_junkcode {
    strings:
        $a = { EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 }
    condition:
        $a at pe.entry_point
}

rule Com4mail_v10_Hint_DOS_EP {
    strings:
        $a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2xx_max_compressed_resources_wwwstrongbitcom_SignByhaggar {
    strings:
        $a = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }
        $b = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule North_Star_PE_Shrinker_13_Liuxingping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie2000_additional {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_beta_Dwing {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v022_v023_Beta_Dwing {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Elite_200 {
    strings:
        $a = { FC 8C C8 01 06 00 00 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 FF 33 F6 B9 08 00 F3 A5 48 4B 4A 75 EE }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_ZCode_101 {
    strings:
        $a = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SoftDefender_1x_Randy_Li {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }
    condition:
        $a at pe.entry_point
}

rule BAFF_BMPs_graphics_library {
    strings:
        $a = { 42 41 46 46 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v30_1985 {
    strings:
        $a = { ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35 }
        $b = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressor_v1451_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D }
    condition:
        $a at pe.entry_point
}

rule N_Joy_11_NEX_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule EPExE_Pack_V10_6aHguT_g_l_u_k_additional {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        $a at pe.entry_point
}

rule Phoenix_Protector_v10v11_NTCorecom {
    strings:
        $a = { 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF 07 73 ?? ?? ?? 0A 38 E5 FF FF FF }
        $b = { 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PocketPC_SHA_additional {
    strings:
        $a = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }
    condition:
        $a at pe.entry_point
}

rule DEF_V100Eng_bartxt {
    strings:
        $a = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule QinYingShieldLicense_V10X_V121_Lei_Peng_SignByfly_20080122 {
    strings:
        $a = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 FE B9 FE 00 00 00 00 00 00 00 }
        $b = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vcasm_Protector_10a_10d_vcasm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Exe_Executable_Image_Hint_FILE_START {
    strings:
        $a = { 50 45 00 00 }
    condition:
        $a at pe.entry_point
}

rule Macs_StuffIt_Archive {
    strings:
        $a = { 53 49 54 21 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_7bit_Scrambler_102 {
    strings:
        $a = { 0F 83 FA }
    condition:
        $a at pe.entry_point
}

rule Pi_Cryptor_10_by_Scofield_additional {
    strings:
        $a = { 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 }
    condition:
        $a at pe.entry_point
}

rule CRYPToCRACks_PE_Protector_V093_Lukas_Fleischer_Sign_by_fly {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_DLL_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V1x_SIS_Team {
    strings:
        $a = { 68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF }
    condition:
        $a at pe.entry_point
}

rule _MSLRH_v032a_emadicius {
    strings:
        $a = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v275a {
    strings:
        $a = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
    condition:
        $a at pe.entry_point
}

rule DOS16M_DOS_Extender_c_Tenberry_Software_Inc_1987_1995_additional {
    strings:
        $a = { BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_11_coban2k_additional {
    strings:
        $a = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }
    condition:
        $a at pe.entry_point
}

rule The_Norton_Antivirus_Information_file_additional {
    strings:
        $a = { 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule Scram_07c1_08a1 {
    strings:
        $a = { 53 43 52 41 4D B4 30 CD 21 3C 02 77 02 CD 20 BC 3A 01 B9 00 00 8B FC B2 00 58 4C F6 D8 2A C2 D2 C8 FE CA 32 D1 81 FF D1 02 73 02 EB 09 81 FF 9B 03 73 03 47 EB 01 AA 49 75 DF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Gleam_100_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_DSES_not_saved {
    strings:
        $a = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_emadicius_h_additional {
    strings:
        $a = { E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F 70 79 72 69 67 68 74 20 62 79 20 43 48 52 69 53 54 4F 50 48 20 47 41 42 4C 45 52 20 69 6E 20 31 39 39 38 21 0D 0A 52 65 67 69 73 74 65 72 65 64 20 74 6F 20 3A 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1987 {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098_tHE_EGOiSTE_h_additional {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Rec_027 {
    strings:
        $a = { 06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A B4 30 CD 21 3C 02 73 02 CD 20 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 53 BB EB 04 5B EB FB 9A EB 2D FE 20 E7 E4 9B 20 30 2E 32 37 20 5B }
    condition:
        $a at pe.entry_point
}

rule PE_Spin_0b {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
    condition:
        $a at pe.entry_point
}

rule Delphi_v10_Unit_Hint_FILE_START {
    strings:
        $a = { 44 43 55 31 }
    condition:
        $a at pe.entry_point
}

rule Pe_Ninja_pDzA_kRAker_TNT {
    strings:
        $a = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Shrink_v10_Hint_DOS_EP {
    strings:
        $a = { 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3 }
    condition:
        $a at pe.entry_point
}

rule FixupPak_v120_additional {
    strings:
        $a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Borland_Delphi_DLL_Anorganix {
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Trivial46_Hint_DOS_EP {
    strings:
        $a = { B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule Packman_0001_Bubbasoft_additional {
    strings:
        $a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }
    condition:
        $a at pe.entry_point
}

rule Diet_110_120_COM {
    strings:
        $a = { BE 00 00 BF 00 00 B9 00 00 3B FC 72 04 B4 4C CD 21 FD F3 A5 FC 8B F7 BF 00 01 AD AD 8B E8 B2 10 E9 00 00 64 6C 7A }
    condition:
        $a at pe.entry_point
}

rule ASPack_v101b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }
    condition:
        $a at pe.entry_point
}

rule CA_Visual_Objects_20_25 {
    strings:
        $a = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
        $b = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule yodas_Protector_v10b_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASProtect_v11_MTEb_additional {
    strings:
        $a = { 90 60 E9 ?? 04 }
    condition:
        $a at pe.entry_point
}

rule Borland_precompiled_header_file_Hint_FILE_START {
    strings:
        $a = { 54 50 53 }
    condition:
        $a at pe.entry_point
}

rule tELock_041c {
    strings:
        $a = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v70 {
    strings:
        $a = { 6A 68 }
        $b = { 6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NsPacK_V37_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v40 {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
        $b = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FreeJoiner_153_Stub_engine_17_GlOFF {
    strings:
        $a = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1111_additional {
    strings:
        $a = { EB 02 ?? ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Cabinet_file {
    strings:
        $a = { 4D 53 43 46 }
    condition:
        $a at pe.entry_point
}

rule WinKript_10_Mr_Crimson_h {
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v03_Eng_cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_Dev_Cpp_v4x_h_additional {
    strings:
        $a = { 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule SmokesCrypt_v12_additional {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_SuperPro_Automatic_Protection_v641_Safenet_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule vfpexeNc_V500_Wang_JianGuo {
    strings:
        $a = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point
}

rule UPX_092_094_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 00 00 00 00 60 BE 2B 00 00 00 8D BE D5 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_32_Run_Time_System_1988_1995_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 }
    condition:
        $a at pe.entry_point
}

rule Symantec_C_v210_v400_or_Zortech_C_v30r1_Hint_DOS_EP {
    strings:
        $a = { FA FC B8 ?? ?? 8E D8 }
    condition:
        $a at pe.entry_point
}

rule Exact_Audio_Copy_additional {
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_DLL_LZMA_Ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 }
    condition:
        $a at pe.entry_point
}

rule UPX_081_084_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 00 00 00 00 60 BE D9 00 00 00 8D BE 27 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule UnoPiX_075_BaGiE {
    strings:
        $a = { 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61 }
    condition:
        $a at pe.entry_point
}

rule CC286xv21_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? EB ?? 9A ?? ?? ?? ?? 81 ?? ?? ?? EB ?? 66 ?? ?? ?? ?? ?? EA ?? ?? ?? ?? FF E6 }
    condition:
        $a at pe.entry_point
}

rule Exe_Locker_v10_IonIce_additional {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 }
    condition:
        $a at pe.entry_point
}

rule GameGuard_v20065xx_exe {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00 }
    condition:
        $a at pe.entry_point
}

rule TAV {
    strings:
        $a = { E8 ?? ?? 4D 5A CB }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extr_Passwcheck_Vir_shield_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_32Lite_003_Anorganix_additional {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule VisualUPX_02_emadicius {
    strings:
        $a = { 66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v153_additional {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule JExeCompressor_V10_UsAr {
    strings:
        $a = { 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F BC C8 EB ?? C3 B8 ?? ?? ?? ?? 50 }
        $b = { 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CodeSafe_30 {
    strings:
        $a = { 55 8B EC 83 EC 5C 53 56 57 E8 00 00 00 00 8B 04 24 5A 83 E8 0E 8B D8 89 5D F8 2D 00 00 00 01 89 45 E0 8B C8 81 C1 70 00 00 01 89 19 8B D8 81 C3 E0 00 00 01 89 5D F4 8B 0B 0B C9 74 06 5F 5E 5B C9 FF E1 8B D0 81 C2 6C 00 00 01 8B 0A 8B D0 81 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PIMP_Install_System_v13x_additional {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_102_ConquestOfTroycom_additional {
    strings:
        $a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 }
    condition:
        $a at pe.entry_point
}

rule PassEXE_v20_Hint_DOS_EP {
    strings:
        $a = { 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A }
    condition:
        $a at pe.entry_point
}

rule EZIP_v10_additional {
    strings:
        $a = { E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C }
    condition:
        $a at pe.entry_point
}

rule HEALTH_v51_by_Muslim_MPolyak {
    strings:
        $a = { 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule Virogen_Crypt_v075 {
    strings:
        $a = { 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 }
    condition:
        $a at pe.entry_point
}

rule EP_v20_additional {
    strings:
        $a = { 6A ?? 60 E9 01 01 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_12build3009_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Involuntary1349_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
    condition:
        $a at pe.entry_point
}

rule Vx_SYP_Hint_DOS_EP {
    strings:
        $a = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_multi_layer_encryption_MANtiCORE {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Watcom_CCpp_DLL {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v0164 {
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorbased {
    strings:
        $a = { BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v12_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v13b_Vaska {
    strings:
        $a = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 }
        $b = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_FullEdition_V120_aPlib_043_ap0x_SignByfly_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_V100_BoB_BobSoft {
    strings:
        $a = { 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule FSG_V131Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v40_v50_additional {
    strings:
        $a = { 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10802_Alexey_Solodovnikov {
    strings:
        $a = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v23_North_Star {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
        $b = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrunchPE_v40_additional {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Cpp_DLL_Method_2_Anorganix {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule bambam_V004_bedrock_additional {
    strings:
        $a = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 }
    condition:
        $a at pe.entry_point
}

rule Spalsher_10_30_Amok_additional {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC }
    condition:
        $a at pe.entry_point
}

rule Wise_Installer_Stub_v11010291_additional {
    strings:
        $a = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }
    condition:
        $a at pe.entry_point
}

rule Sun_Raster_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 59 A6 6A 95 }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_2_additional {
    strings:
        $a = { BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Microsoft_Visual_Cpp_60 {
    strings:
        $a = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }
        $b = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_Scrambler_RC_v1x_additional {
    strings:
        $a = { 66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_v01_Teraphy {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Neolite_20_Anorganix_additional {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule PESPin_13_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule ASPack_105b {
    strings:
        $a = { 75 00 E9 }
    condition:
        $a at pe.entry_point
}

rule NE_Exe_Executable_Image {
    strings:
        $a = { 4E 45 }
    condition:
        $a at pe.entry_point
}

rule PECompact_2x_beta_version_Jeremy_Collake {
    strings:
        $a = { B8 ?? ?? ?? 00 80 00 28 40 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10_Build_20041213 {
    strings:
        $a = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule RLPack_116_aPLib_compression_ap0x_h_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional {
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
    condition:
        $a at pe.entry_point
}

rule RLPack_V121_LZMA_430_ap0xnbsp_nbsp_SignByfly_20080504 {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v184 {
    strings:
        $a = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_v104 {
    strings:
        $a = { FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB }
    condition:
        $a at pe.entry_point
}

rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_oep_additional {
    strings:
        $a = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ASPack_2xx_Heuristic {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v07_Cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_XCR_011_Anorganix {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_014015_GlOFF {
    strings:
        $a = { 55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50 }
    condition:
        $a at pe.entry_point
}

rule Rose_Tiny_102 {
    strings:
        $a = { EB 01 EA 06 1E 1E 52 B8 4D 30 CD 21 86 C4 3D FE 02 73 02 CD 20 52 BA EB 04 5A EB FB 9A 0E 1F E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F FA CD 11 8B EC 8B 46 FA 05 0B 00 FF E0 81 EB 03 EA EB F0 81 46 FA 1A 00 83 }
    condition:
        $a at pe.entry_point
}

rule CRYPACK_30 {
    strings:
        $a = { 06 1E 8C D8 05 10 00 8E D8 33 DB 0E 07 33 FF BE A1 01 8A 07 26 8A 25 32 C4 88 07 47 3B FE 74 08 43 83 FB 10 74 06 EB EA 33 FF EB F4 33 DB 8C D8 40 8E D8 8C C9 3B C1 74 02 EB D7 1F 07 06 1E 2E A1 05 00 8C C3 83 C3 10 03 C3 2E A3 05 00 FA 33 }
    condition:
        $a at pe.entry_point
}

rule UPX_081_084_PE {
    strings:
        $a = { 60 BE 00 00 00 00 8D BE 00 00 00 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v60_KOL_additional {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Phoenix927 {
    strings:
        $a = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }
    condition:
        $a at pe.entry_point
}

rule Upack_V037_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100c_1_Hint_DOS_EP {
    strings:
        $a = { 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE }
    condition:
        $a at pe.entry_point
}

rule ComLock_010 {
    strings:
        $a = { EB 0E 90 00 00 00 00 2D 43 4F 4D 4C 4F 43 4B 2D BB 00 00 BE 04 00 81 C6 03 01 03 F3 BF 00 01 B9 03 00 F3 A4 2E 8A 87 06 01 BE 03 01 8B CB 2E 30 04 46 FE C0 E2 F8 33 C0 33 DB 33 C9 33 D2 33 FF 33 F6 33 ED 0E 50 55 8B EC C7 46 02 00 01 5D CB }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_BasicEdition_Stub_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_DEF_10_Anorganix_additional {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_additional {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2 }
    condition:
        $a at pe.entry_point
}

rule PH_Icons_file_Trilobyte {
    strings:
        $a = { 69 63 6F 6E 01 00 10 00 10 }
    condition:
        $a at pe.entry_point
}

rule Sun_Raster_Graphics_format {
    strings:
        $a = { 59 A6 6A 95 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_v211_DEMO_additional {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CD 0D }
    condition:
        $a at pe.entry_point
}

rule Apex_c_beta_500mhz_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08 }
    condition:
        $a at pe.entry_point
}

rule North_Star_PE_Shrinker_v13_by_Liuxingping_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_v20_bartxt_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_60_70 {
    strings:
        $a = { 55 8B EC B9 07 00 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20a0 {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }
    condition:
        $a at pe.entry_point
}

rule GCC_RealBasic_FreePascal_signII_ASL {
    strings:
        $a = { 55 89 E5 83 EC 18 83 3D 00 ?? ?? 00 00 74 01 CC D9 7D FE 0F B7 45 FE 25 C0 F0 FF FF 66 89 45 FE 0F B7 45 FE 0D 3F 03 00 00 66 89 45 FE D9 6D FE 83 C4 }
    condition:
        $a at pe.entry_point
}

rule EXERefactor_V01_random {
    strings:
        $a = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v184 {
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v180 {
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v183 {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v182 {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Vx_XPEH4768_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_iBox_aPLib {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1250_Obsidium_Software_h_additional {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1032_by_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v100 {
    strings:
        $a = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_HuiGeZi {
    strings:
        $a = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }
    condition:
        $a at pe.entry_point
}

rule CodeSafe_v20 {
    strings:
        $a = { CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 }
        $b = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 10 53 56 57 E8 C4 01 00 }
        $c = { 83 EC 10 53 56 57 E8 C4 01 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UCEXE_v23_v24 {
    strings:
        $a = { 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule FSG_133_Eng_dulekxt {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_060_SLV_ICU_additional {
    strings:
        $a = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }
    condition:
        $a at pe.entry_point
}

rule Unknown_virus_1 {
    strings:
        $a = { E9 01 00 1A EB 4E C3 00 00 00 95 E3 AC B1 07 01 01 00 17 05 60 08 01 00 CE 10 20 00 CE 10 0A 04 00 00 FB 04 F8 4F D2 19 72 D3 32 33 AC 1F 73 EA A1 DB C9 38 AD 69 AD 9E 1E 00 20 00 08 00 B4 40 BB 02 00 8B 4C 0A 8B 54 08 03 D6 CD 21 B8 FF 4C }
    condition:
        $a at pe.entry_point
}

rule USSR_031_by_Spirit {
    strings:
        $a = { E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10E_vcasm {
    strings:
        $a = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_06_Hint_DOS_EP {
    strings:
        $a = { FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC }
    condition:
        $a at pe.entry_point
}

rule Code_Lock_vxx_RTSoft {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v118_Hint_DOS_EP {
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_50 {
    strings:
        $a = { FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_V039_V0399_Dwing_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 4F 04 FD 1A D2 22 C2 3C 07 73 F6 50 0F B6 6F FF ?? ?? ?? 66 69 ED 00 03 8D AC AB 08 10 00 00 57 B0 01 E3 1F 2B 7B 08 84 0F 0F 95 C4 FE C4 8D 54 85 00 FF 16 12 C0 D0 E9 74 0E 2A E0 80 E4 01 75 E6 33 C9 B5 01 FF 56 50 33 C9 5F E9 F2 00 00 00 04 F9 1A C0 B1 30 24 03 8B 6B 08 04 08 03 D1 FF 16 73 42 03 D1 FF 16 72 14 03 D1 FF 16 72 24 0C 01 50 8B C7 2B 43 08 B1 80 8A 00 EB CE 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 8F 00 00 00 48 87 6B 0C 50 87 6B 10 8D 93 C0 0B 00 00 89 6B 14 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 B1 40 F6 E1 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5A 33 ED D1 E8 83 D5 02 48 91 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006710_V220061025_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule COMLOCK_v010_c_1994_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BB ?? ?? BE ?? ?? 81 ?? ?? ?? 03 F3 BF ?? ?? B9 ?? ?? F3 A4 2E ?? ?? ?? ?? BE ?? ?? 8B CB 2E ?? ?? 46 FE C0 E2 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v23_North_Star_h_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_Custom {
    strings:
        $a = { 60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_Crypter_V101_Kas {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 }
        $b = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXEPACK_v405_v406 {
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }
    condition:
        $a at pe.entry_point
}

rule Netopsystems_FEAD_Optimizer_1 {
    strings:
        $a = { 60 BE 00 ?? ?? 00 8D BE 00 ?? ?? FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        $a at pe.entry_point
}

rule Netopsystems_FEAD_Optimizer_3 {
    strings:
        $a = { E8 00 00 00 00 58 BB 00 00 40 00 8B ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule JAR_Archive {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B }
        $b = { 1A 4A 61 72 1B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v133_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_V1601_CGSoftLabs_20080308 {
    strings:
        $a = { EB 01 ?? EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 E2 05 00 00 EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 ?? 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 ?? ?? 8B 45 F4 0F B6 ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 81 ?? ?? ?? ?? EB 01 ?? EB D4 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 FC EB 02 ?? ?? 83 7D FC 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 A0 05 00 00 A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 F8 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 FC E8 01 00 00 00 ?? 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_LCC_Win32_1x {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
    condition:
        $a at pe.entry_point
}

rule HackStop_098_EXE {
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 E4 03 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 B1 12 E8 CF 03 8D EB 02 43 93 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 }
    condition:
        $a at pe.entry_point
}

rule ARVIDs_TDR_file {
    strings:
        $a = { 74 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SCAN_AV {
    strings:
        $a = { 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_226_DLL_minimum_protection_additional {
    strings:
        $a = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v60_additional {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL_Anorganix {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PackItBitch_V10_archphase_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V2403_Jitit_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v20_1984_Hint_DOS_EP {
    strings:
        $a = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_v12_Memory_Patch {
    strings:
        $a = { 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_CD_Cops_II {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
    condition:
        $a at pe.entry_point
}

rule ComCryptor_BTS_v912_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B7 ?? E8 ?? ?? 83 ?? ?? EB ?? 5D 55 C3 BF ?? ?? 03 FD 8B F7 B9 }
    condition:
        $a at pe.entry_point
}

rule StarForce_V3X_StarForce_Copy_Protection_System_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_3035_3043_Thinstall_Company {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_PaCK_v10_C_Copyright_1998_by_ANAKiN_h_additional {
    strings:
        $a = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v025 {
    strings:
        $a = { 5D 83 ED 06 EB 02 EA 04 }
        $b = { 60 E8 2B 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v036_alpha_Sign_by_hot_UNP {
    strings:
        $a = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }
    condition:
        $a at pe.entry_point
}

rule Wind_of_Crypt_10_by_DarkPressure {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D }
        $b = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CC_v261_Beta {
    strings:
        $a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule MESS_v120_Hint_DOS_EP_additional {
    strings:
        $a = { FA B9 ?? ?? F3 ?? AC ?? ?? EB ?? 1E 0E 1F BA ?? ?? 81 ?? ?? ?? B4 09 CD 21 1F B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_014015_GlOFF_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50 }
    condition:
        $a at pe.entry_point
}

rule Packed_with_PKLITE_v150_with_CRC_check_1_Hint_DOS_EP_p_146 {
    strings:
        $a = { 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PE_Crypt_102_emadicius {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point
}

rule nSPack_2x_North_StarLiu_Xing_Ping_additional {
    strings:
        $a = { FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Pack_099_Anorganix_additional {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_V1X_PolyTech_additional {
    strings:
        $a = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1033_exescrcom_Ashkbiz_Danehkar_h {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_Pascal_Desktop_File {
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70 }
    condition:
        $a at pe.entry_point
}

rule UPX_v072 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule UPX_v070 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 83 CD FF 31 DB 5E 8D BE FA FF 57 66 81 87 81 C6 B3 01 EB 0A 8A 06 46 88 07 47 01 DB 75 }
        $b = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AVI_movie_file_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V16d_Vaska {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule Secure_21b {
    strings:
        $a = { 8C C8 05 00 00 50 B8 90 01 50 CB 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_August_16th_Iron_Maiden {
    strings:
        $a = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }
    condition:
        $a at pe.entry_point
}

rule Upack_V035_Dwing_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? ?? ?? ?? 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 A8 }
    condition:
        $a at pe.entry_point
}

rule diProtector_1x_diProtector_Software {
    strings:
        $a = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PE_Pack_099 {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }
    condition:
        $a at pe.entry_point
}

rule DEF_v100_Eng_bartxt_additional {
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule UG2002_Cruncher_v03b3 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_LZMA_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v120b {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ExeJoiner_10_Yoda {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }
    condition:
        $a at pe.entry_point
}

rule PEZip_10_by_BaGIE {
    strings:
        $a = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Pasword_Protector_v101_Eng_Pavol_Cerven_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V220080618_V220090726_WFS_20090822 {
    strings:
        $a = { 5D 5F 8B 45 00 83 F8 00 0F 85 87 01 00 00 89 E8 83 C0 24 50 FF 14 2F 89 45 00 89 E8 83 C0 31 50 FF 75 00 FF 54 2F 04 89 45 04 89 E8 83 C0 3E 50 FF 75 00 FF 54 2F 04 89 45 08 89 E8 83 C0 4A 50 FF 75 00 FF 54 2F 04 89 45 0C 89 E8 83 C0 5D 50 FF 75 00 FF 54 2F 04 89 45 10 89 E8 83 C0 6B 50 FF 75 00 FF 54 2F 04 89 45 14 89 E8 83 C0 7B 50 FF 75 00 FF 54 2F 04 89 45 18 89 E8 05 87 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 1C 89 E8 05 94 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 20 89 E8 83 C0 24 50 68 04 01 00 00 FF 55 04 83 F8 04 0F 8C 07 01 00 00 01 E8 83 C0 23 8A 10 80 FA 5C 74 04 40 C6 00 5C 31 C9 8A 94 29 29 01 00 00 88 54 01 01 80 FA 00 74 03 41 EB ED 8B 85 49 01 00 00 83 F8 00 0F 84 87 00 00 00 6A 00 68 80 00 00 00 6A 04 6A 00 6A 00 68 00 00 00 C0 89 E8 83 C0 24 50 FF 55 08 }
    condition:
        $a at pe.entry_point
}

rule MEW_5_10_Northfox_additional {
    strings:
        $a = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Encrypted_without_selfcheck_additional {
    strings:
        $a = { B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v156_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point
}

rule ChSfx_small_v11 {
    strings:
        $a = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule COM2TXT_120_141 {
    strings:
        $a = { 54 5F 4F 4F 57 57 33 3D 58 58 57 58 50 59 35 30 50 50 5A 35 6A 51 50 5F 2D 79 73 2C 41 31 45 61 35 79 38 35 32 63 50 34 5A 34 50 50 2D 70 56 34 30 50 2D 42 4F 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 35 55 71 50 57 58 2C 77 50 35 30 30 }
    condition:
        $a at pe.entry_point
}

rule Freshbind_v20_gFresh {
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_40 {
    strings:
        $a = { 55 8B EC 83 C4 }
    condition:
        $a at pe.entry_point
}

rule Vx_Keypress1212 {
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
    condition:
        $a at pe.entry_point
}

rule ADEX_Graphics_format {
    strings:
        $a = { 50 49 43 54 00 08 ?? 02 }
    condition:
        $a at pe.entry_point
}

rule ExeSafeguard_10_simonzh_h {
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200c_additional {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_FSG_131_Anorganix {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_C_Protected_Mode_386_486_1988_92_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 80 ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC }
    condition:
        $a at pe.entry_point
}

rule TrueVision_Targa_Graphics_format {
    strings:
        $a = { 00 00 02 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_25_h_additional {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Gleam_100_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_MSVCpp_DLL_Method_4_emadicius {
    strings:
        $a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Packman_V10_Brandon_LaCombe_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }
    condition:
        $a at pe.entry_point
}

rule DIET_v144_v145f_Hint_DOS_EP {
    strings:
        $a = { F9 9C EB }
    condition:
        $a at pe.entry_point
}

rule PESpin_07_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule ASProtect_133_21_Registered_Alexey_Solodovnikov {
    strings:
        $a = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule X3 {
    strings:
        $a = { 5E BF 00 01 57 B9 00 00 AC 34 00 AA E2 FA C3 }
    condition:
        $a at pe.entry_point
}

rule PNG_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        $a at pe.entry_point
}

rule Themida_18xx_19xx_Oreans_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }
    condition:
        $a at pe.entry_point
}

rule LGLZ_v104_com {
    strings:
        $a = { BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_215_SetiSoft_Team_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v160a_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Upack_v029_Beta_v031_Beta_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PENightMare_2_Beta_Anorganix {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule Vpacker_ttui {
    strings:
        $a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PESHiELD_025_emadicius_h {
    strings:
        $a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule CC_v261_Beta_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule Scodl_Graphics_format_Hint_FILE_START {
    strings:
        $a = { E0 01 ?? 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt32_Console_v10_v101_v102 {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_v102_additional {
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }
    condition:
        $a at pe.entry_point
}

rule VIRUS_I_WormBagle {
    strings:
        $a = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 }
        $b = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule N_Code_01_NEX {
    strings:
        $a = { BB E8 03 00 00 81 C3 E8 03 00 00 B8 05 00 00 00 B9 73 00 00 00 01 C8 83 E8 32 90 90 90 90 6B C0 02 90 68 FF 64 24 F0 90 90 90 90 90 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_280_290_EXE_X86_CRT_LIB {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point
}

rule RLP_V073beta_ap0x {
    strings:
        $a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v2xx_additional {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule JRC_Archive_Hint_FILE_START {
    strings:
        $a = { 4A 52 63 68 69 76 65 }
    condition:
        $a at pe.entry_point
}

rule PGMPACK_v014_additional {
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_TREXE {
    strings:
        $a = { B4 0F CD 10 3C 03 74 05 B8 03 00 CD 10 BA 00 00 2E 89 16 00 01 8B 2E 02 00 8B 1E 2C 00 8E DA 8C 06 00 00 89 1E 00 00 89 2E 00 00 A1 00 00 8E C0 33 C0 8B D8 8B F8 B9 FF 7F FC F2 AE E3 00 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Basic_v10_1987 {
    strings:
        $a = { 2E 8C ?? ?? ?? 2E C7 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v030_beta_By_Dwing {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
        $b = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v305c4_Modified {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_197_SetiSoft {
    strings:
        $a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
        $b = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v062_Laszlo_Markus {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_BasicEdition_Stub_ap0x_SignByfly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Anskya_NTPacker_Generator_Anskya {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }
        $b = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LZEXE_091 {
    strings:
        $a = { 50 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 FD F3 A4 53 B8 00 00 50 CB 2E 8B 2E 08 00 00 DA 89 E8 3D 00 10 76 03 B8 00 10 29 C5 29 C2 29 C3 8E DA 8E C3 B1 03 D3 E0 89 C1 }
    condition:
        $a at pe.entry_point
}

rule LZEXE_090 {
    strings:
        $a = { 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 B4 00 31 ED FD AC 01 C5 AA E2 FA 8B 16 0E 00 8A C2 29 C5 8A C6 29 C5 39 D5 74 0C BA 91 01 B4 09 CD 21 B8 FF 4C CD 21 53 B8 53 00 50 CB 2E 8B 2E 08 00 8C DA 89 E8 3D 00 10 76 03 B8 }
    condition:
        $a at pe.entry_point
}

rule CRYPACK_v30_Hint_DOS_EP {
    strings:
        $a = { EB ?? 06 1E 8C D8 05 ?? ?? 8E D8 33 DB 0E 07 33 FF BE ?? ?? 8A 07 26 ?? ?? 32 C4 88 07 47 3B FE }
    condition:
        $a at pe.entry_point
}

rule VBOX_v43_v46 {
    strings:
        $a = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
        $b = { ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40 }
        $c = { 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule USERNAME_v300_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 83 ?? ?? FA FC 33 F6 8E DE BF ?? ?? 03 FD B9 ?? ?? F3 A4 8B FC }
    condition:
        $a at pe.entry_point
}

rule Windows_9x_registry_file_Hint_FILE_START {
    strings:
        $a = { 43 52 45 47 }
    condition:
        $a at pe.entry_point
}

rule PENinja_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1333_Obsidium_Software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1338_Obsidium_Software_additional {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_CodeSafe_20 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V21X_softcompletecom {
    strings:
        $a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
        $b = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_ASPack_212_emadicius {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXEPACK_LINK_v360_v364_v365_or_50121_additional {
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule NSPack_3x_Liu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }
    condition:
        $a at pe.entry_point
}

rule _22b_Anti_xiaohui {
    strings:
        $a = { EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v1_Vaska {
    strings:
        $a = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 }
        $b = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_01x_beta_Dwing {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_tElock_061_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_10a_10d_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Morphine_33_Holy_Father_Ratter29A_additional {
    strings:
        $a = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Intel_DCX_Graphics_format {
    strings:
        $a = { B1 68 DE 3A 04 10 00 }
    condition:
        $a at pe.entry_point
}

rule CubiComp_PictureMaker_graphics_format_green {
    strings:
        $a = { 26 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_Dll_aPlib_043_ap0x_SignByfly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 6F 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_LZMA_430_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule NSPack_Nort_Star_Software_httpwwwnsdsncom {
    strings:
        $a = { 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 }
    condition:
        $a at pe.entry_point
}

rule INCrypter_03_INinY_by_z3e_NiFe {
    strings:
        $a = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3 }
        $b = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrunchPE_v10xx {
    strings:
        $a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 }
        $b = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Thinstall_Embedded_2717_2719_Jitit {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_V2X_LiuXingPing {
    strings:
        $a = { 6E 73 70 61 63 6B 24 40 }
    condition:
        $a at pe.entry_point
}

rule EXE_ {
    strings:
        $a = { 55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V26_LiuXingPing_Sign_by_fly {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v12_CGSoftLabs_ {
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
    condition:
        $a at pe.entry_point
}

rule GameGuard_v20065xx_dll_sign_by_hot_UNP {
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00 }
    condition:
        $a at pe.entry_point
}

rule DIET_v100d {
    strings:
        $a = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_15_DEMO_FEUERRADERAHTeam {
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
    condition:
        $a at pe.entry_point
}

rule tElock_v071b7 {
    strings:
        $a = { 60 E8 48 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule tElock_v071b2 {
    strings:
        $a = { 60 E8 44 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v4x_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 }
    condition:
        $a at pe.entry_point
}

rule NsPack_3x_Liu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V30X_Thinstall_Company {
    strings:
        $a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v60_Unit_Hint_FILE_START {
    strings:
        $a = { 54 50 55 39 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_11_PKWARE_Inc {
    strings:
        $a = { 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v12_Northfox {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }
        $b = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEiD_Bundle_V102_BoB_BobSoft {
    strings:
        $a = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point
}

rule FOXSQZ_Archive_Hint_FILE_START {
    strings:
        $a = { 46 4F 58 53 51 5A }
    condition:
        $a at pe.entry_point
}

rule Tiny_Xor_v01_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FC B8 ?? ?? BB ?? ?? B9 ?? ?? BE ?? ?? 30 04 02 C3 86 C4 86 DF 46 E2 ?? BE ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 33 C0 33 DB 33 C9 FF E6 }
    condition:
        $a at pe.entry_point
}

rule CHECKPRG_c_1992 {
    strings:
        $a = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }
    condition:
        $a at pe.entry_point
}

rule FSG_13 {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLP_V073beta_ap0x_Sign_by_fly {
    strings:
        $a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
        $b = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WinZip_32_bit_SFX_v8x_module {
    strings:
        $a = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10_beta_Ashkbiz_Danehkar_ {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }
    condition:
        $a at pe.entry_point
}

rule WinZIP_Self_Extractor {
    strings:
        $a = { 33 ED 55 9A FF FF 00 00 0B C0 74 EE 81 C1 00 01 72 E8 89 0E 90 03 89 36 92 03 89 3E 94 03 89 1E 96 03 8C 06 98 03 89 16 9A 03 33 C0 50 9A FF FF 00 00 FF 36 94 03 9A FF FF 00 00 0B C0 74 BB FF 36 94 03 FF 36 92 03 FF 36 98 03 FF 36 96 03 FF }
    condition:
        $a at pe.entry_point
}

rule NsPack_31_North_Star_h_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_20_1988_COM {
    strings:
        $a = { 8C CA 2E 89 16 D6 02 B4 30 CD 21 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 C7 06 00 00 FF FF E8 13 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F 26 81 3D 38 37 75 19 26 8B 55 02 80 FA 3D 75 10 80 E6 DF FF 06 00 00 80 }
    condition:
        $a at pe.entry_point
}

rule Interplays_MVE_file_Hint_FILE_START {
    strings:
        $a = { 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A }
    condition:
        $a at pe.entry_point
}

rule InstallShield_Custom {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }
    condition:
        $a at pe.entry_point
}

rule MEW_5_Northfox {
    strings:
        $a = { BE ?? ?? ?? ?? AD 91 AD 93 53 AD 96 56 5F AC }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v20_1984 {
    strings:
        $a = { ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
        $b = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule REALbasic {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Adobe_PhotoShop_Graphics_format {
    strings:
        $a = { 38 42 50 53 00 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_LZMA_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point
}

rule JDPack_2x_JDPack {
    strings:
        $a = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1360_Obsidium_Software_20080730 {
    strings:
        $a = { EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Audio_CD_file_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule PPC_PROTECT_V10_Alexey_Gorchakov {
    strings:
        $a = { FF 5F 2D E9 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V01b_V03b_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }
    condition:
        $a at pe.entry_point
}

rule ATT_Group_4_Graphics_format {
    strings:
        $a = { 01 00 ?? 00 3A 03 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZBRR_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_v102_Vladimir_Sukhov_h_additional {
    strings:
        $a = { 55 53 20 50 54 4F 20 00 }
    condition:
        $a at pe.entry_point
}

rule LARP_V20_lena151_20080321 {
    strings:
        $a = { E8 01 00 00 00 81 E8 02 00 00 00 81 84 E8 EF 01 00 00 81 84 E8 01 00 00 00 64 E8 02 00 00 00 E8 81 E8 81 00 00 00 C3 81 84 E8 04 00 00 00 01 31 00 00 50 68 23 31 40 00 E8 A1 01 00 00 81 68 D7 17 40 00 3B D1 0F 87 32 04 00 00 0F 86 52 28 00 00 81 84 68 F1 17 40 00 85 C9 0F 85 84 28 00 00 0F 84 42 04 00 00 81 E8 D4 18 00 00 68 5B 50 E8 76 01 00 00 81 84 68 14 18 40 00 68 B3 2C 40 00 85 C0 0F 84 27 28 00 00 0F 85 FA 03 00 00 81 84 58 83 04 24 01 83 C4 04 0B E4 74 04 FF 64 24 FC 81 E8 4B 01 00 00 81 E8 01 00 00 00 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? 00 0B E4 74 02 FF E0 81 E8 00 00 00 00 68 ?? ?? ?? ?? E8 02 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 E8 FA 00 00 00 81 84 0B E4 74 27 E8 EF 00 00 00 81 84 E8 01 00 00 00 50 E8 02 00 00 00 81 84 0B E4 E8 D9 00 00 00 81 84 74 08 ?? ?? ?? ?? ?? ?? FF E2 }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_v15_DEMO_FEUERRADERAHTeam {
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
        $b = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Enigma_protector_110111_Vladimir_Sukhov {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
        $b = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Solidshield_Protector_V1X_Solidshield_Technologies_SignByfly {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_TravJack883 {
    strings:
        $a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }
    condition:
        $a at pe.entry_point
}

rule FakeNinja_v28_Anti_Debug_Spirit {
    strings:
        $a = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF }
        $b = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_03_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RCryptor_by_Vaska_unknown_ver_sign_from_pinch_21032006_2305 {
    strings:
        $a = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v70_64_Bit_additional {
    strings:
        $a = { 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PluginToExe_v101_BoB_BobSoft {
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00 }
        $b = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Packman_V10_Brandon_LaCombe {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }
    condition:
        $a at pe.entry_point
}

rule UPXcrypter_archphaseNWC {
    strings:
        $a = { BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v50_KOLMCK {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 40 ?? E8 FF FF E8 FF FF E8 FF FF 8B }
        $b = { 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPack32_v1x {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v031a_additional {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_V0X_Ryd_20090618 {
    strings:
        $a = { 89 FE 29 C6 F3 A4 5E EB ?? 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 ?? ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252b2 {
    strings:
        $a = { 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24 }
    condition:
        $a at pe.entry_point
}

rule aPack_082_m_p_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE AE 01 BF 00 01 50 57 FC B6 01 BD 7B 01 FF D5 73 5B FF D5 73 1C FF D5 73 3D BB 92 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 34 93 EB 36 E8 46 00 49 49 75 0A 2E 8B 1E 00 01 E8 3A 00 EB 20 49 AC }
    condition:
        $a at pe.entry_point
}

rule NsPack_14_Liuxingping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_v10_v11 {
    strings:
        $a = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }
    condition:
        $a at pe.entry_point
}

rule ASPack_1061b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED EA A8 43 00 B8 E4 A8 43 00 03 C5 2B 85 78 AD 43 00 89 85 84 AD 43 00 80 BD 6E AD 43 }
    condition:
        $a at pe.entry_point
}

rule NX_PE_Packer_v10 {
    strings:
        $a = { FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_multi_layer_encryption_MANtiCORE_additional {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
    condition:
        $a at pe.entry_point
}

rule Unknown_SFX_Archive_IDSKA32 {
    strings:
        $a = { 69 64 73 6B 61 33 32 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v09781_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1160_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 36 2E 30 }
    condition:
        $a at pe.entry_point
}

rule SuckStop_108 {
    strings:
        $a = { 4B 41 4F 54 5C EB 02 8E 7C BE 10 00 B4 30 CD 21 EB 0A 9B 00 00 00 00 00 BF 00 00 B9 3C 03 77 02 CD 20 4E 75 E7 6A 00 0E 6A 67 FE C3 CF AC 66 64 33 06 0C 00 66 65 2B 06 90 06 8C EA 03 C2 CF 32 C7 AA CF 57 69 6E 64 6F 77 73 20 73 75 78 78 21 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_0760_0765_hying_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Help_File_Hint_FILE_START {
    strings:
        $a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }
    condition:
        $a at pe.entry_point
}

rule Vterminal_V10X_Lei_Peng {
    strings:
        $a = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v103_v104_Modified {
    strings:
        $a = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF }
    condition:
        $a at pe.entry_point
}

rule ARJ_Archive_Hint_FILE_START {
    strings:
        $a = { 60 EA }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_15_BitShape_Software_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_75_Coverpage_Hint_FILE_START {
    strings:
        $a = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80 }
    condition:
        $a at pe.entry_point
}

rule D1NS1G_D1N_additional {
    strings:
        $a = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EPExE_Pack_V14_lite_b2_6aHguT_g_l_u_k_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_V121_aPlib_043_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Modification_of_Hi924_Hint_DOS_EP {
    strings:
        $a = { 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B }
    condition:
        $a at pe.entry_point
}

rule Crypto_Lock_v202_Eng_Ryan_Thian {
    strings:
        $a = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 }
    condition:
        $a at pe.entry_point
}

rule PCrypt_v351 {
    strings:
        $a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }
    condition:
        $a at pe.entry_point
}

rule ARVIDs_TDR_file_Hint_FILE_START {
    strings:
        $a = { 74 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule TrueType_Font_file_additional {
    strings:
        $a = { 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_290_EXE_X86_CRT_LIB_additional {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point
}

rule Lockless_Intro_Pack {
    strings:
        $a = { 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85 }
    condition:
        $a at pe.entry_point
}

rule VisualUPX_02_emadicius_additional {
    strings:
        $a = { 66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_83_Coverpage_additional {
    strings:
        $a = { FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_014_021024_027_GlOFF_additional {
    strings:
        $a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v039_final_relocated_image_base_By_Dwing_c2005_h2 {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }
        $b = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_032a_fake_SVKP_111_emadicius {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v13x {
    strings:
        $a = { 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED }
    condition:
        $a at pe.entry_point
}

rule MoleBoxPro_255_Mole_Studio_h {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 E9 D9 69 00 00 E8 5E FB FF FF 3E F4 00 00 }
        $b = { E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SA2_Adlib_Module_music_file_Hint_FILE_START {
    strings:
        $a = { 53 41 64 54 }
    condition:
        $a at pe.entry_point
}

rule ExeSafeguard_v10_simonzh_h {
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
        $b = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Reg2Exe_222223_by_Jan_Vorel {
    strings:
        $a = { 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8 }
        $b = { 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_032a_fake_PECompact_14x_emadicius_additional {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 }
    condition:
        $a at pe.entry_point
}

rule JEDMICS_CCITT4_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 80 00 00 00 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V27X_Jitit_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 }
    condition:
        $a at pe.entry_point
}

rule ILUCRYPT_v4015_com_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_JDPack_1x_JDProtect_09 {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
    condition:
        $a at pe.entry_point
}

rule SoftComp_1x_BG_Soft_PT_additional {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_090_m_x_EXE {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD }
    condition:
        $a at pe.entry_point
}

rule SLR_OPTLINK_1_Hint_DOS_EP {
    strings:
        $a = { 87 C0 EB ?? 71 ?? 02 D8 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V112_Sukhov_Vladimir_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point
}

rule Fish_PE_Shield_101_HellFish {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14 }
        $b = { 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40 }
        $c = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE32Pack_v139 {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v138 {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 }
    condition:
        $a at pe.entry_point
}

rule COP_10 {
    strings:
        $a = { BF E8 00 BE 1C 01 B9 18 00 AC 32 06 09 01 AA E2 F8 8B 16 18 01 EB D1 90 68 00 00 00 12 98 AD 3C 13 AC AD 3C 27 A2 B6 AD 7D 45 27 BA B4 AD 01 9D 7C 07 4E 56 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v137 {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v136 {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }
    condition:
        $a at pe.entry_point
}

rule y0das_Crypter_v1x_Modified {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1322_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule Adobe_PhotoShop_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 38 42 50 53 00 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix_additional {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL_Anorganix {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule RECSmall_v102_Hint_DOS_EP {
    strings:
        $a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }
    condition:
        $a at pe.entry_point
}

rule PECompact_1242_1243 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB D2 09 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Cue_1999 {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_14_SE_SIS_Team {
    strings:
        $a = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }
        $b = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule kryptor_8_additional {
    strings:
        $a = { EB 6A 87 DB }
    condition:
        $a at pe.entry_point
}

rule XPack_131_166_COM {
    strings:
        $a = { 8C C8 05 00 10 8E C0 BF 00 01 8B F7 FC B9 60 6D F3 A5 06 B8 77 01 50 CB 1E 06 1F 07 BE 00 02 BF 00 01 06 57 E8 11 00 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 8B E8 06 1F CB EB 1D 80 E2 0F 75 05 50 AD 8B E8 58 FE C2 03 ED C3 33 C9 E8 EC FF D1 D1 }
    condition:
        $a at pe.entry_point
}

rule Symantec_C_v210_v400_or_Zortech_C_v30r1 {
    strings:
        $a = { FA FC B8 ?? ?? 8E D8 }
    condition:
        $a at pe.entry_point
}

rule CrypWrap_vxx_additional {
    strings:
        $a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
    condition:
        $a at pe.entry_point
}

rule nMacro_recorder_10 {
    strings:
        $a = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }
    condition:
        $a at pe.entry_point
}

rule First_Publisher_Graphics_format {
    strings:
        $a = { 00 00 ?? 01 00 00 ?? 02 }
        $b = { 00 00 ?? 00 00 00 ?? 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Gleam_v100 {
    strings:
        $a = { 55 8B EC 83 C4 F0 60 E8 51 FF FF }
        $b = { 83 EC 0C 53 56 57 E8 24 02 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FreeHand_Graphics_format {
    strings:
        $a = { 41 47 44 32 }
    condition:
        $a at pe.entry_point
}

rule Nakedbind_v10_nakedcrew {
    strings:
        $a = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V15_Vaska {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_20_Vaska {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v12_RC_MARQUiS {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_DLL_additional {
    strings:
        $a = { 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_211_DEMO {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
    condition:
        $a at pe.entry_point
}

rule Inno_Installer_v405_collides_with_Inno_Setup_Module_Heuristic_Mode_Inno_SFX {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_10_p0ke {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }
        $b = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressor_v12_CGSoftLabs_h {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Special_EXE_Pasword_Protector_101_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
    condition:
        $a at pe.entry_point
}

rule AINEXE_v230_additional {
    strings:
        $a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }
    condition:
        $a at pe.entry_point
}

rule UPX_V200_V3X_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule Docmaker_120 {
    strings:
        $a = { B4 0F CD 10 06 1E 3C 03 76 06 3C 07 74 09 EB 42 B8 00 B8 8E C0 EB 05 B8 00 B0 8E C0 BF 00 00 8C C8 8E D8 BE 40 01 B4 0B B7 00 8A 1E 3D 01 CD 10 8A 3E 3E 01 B8 00 06 31 C9 BA 50 19 CD 10 FC B9 80 07 AC AA 47 E2 FB 1F 07 B4 02 31 DB BA 00 17 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v138_SteelBytes {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule UPXLock_v11_CyberDoom_Bob {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2223_compressed_code_wwwstrongbitcom {
    strings:
        $a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
        $b = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MPRESS_V077b_MATCODE_Softwarenbsp_nbsp_SignByfly_20080313 {
    strings:
        $a = { 60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v109a_JRSoftware {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }
    condition:
        $a at pe.entry_point
}

rule Setup_Factory_v6003_Setup_Launcher_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45 }
    condition:
        $a at pe.entry_point
}

rule Vx_Hafen809_additional {
    strings:
        $a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_006_by_Dmitry_AND_Andreev {
    strings:
        $a = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 }
    condition:
        $a at pe.entry_point
}

rule UPX_v051 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 8D B0 }
        $b = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_Pascal_Version_30_1985_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 06 00 ?? ?? ?? 4B 8E 04 85 00 00 04 ?? ?? ?? ?? ?? ?? 80 ?? ?? EC E8 ?? ?? 45 1B ?? ?? ?? A6 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_V01_Delikon_additional {
    strings:
        $a = { E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Quake518 {
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }
    condition:
        $a at pe.entry_point
}

rule UPXFreak_V01_HMX0101 {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_NTkrnl_Team_Blue_additional {
    strings:
        $a = { 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_DxPack_10_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule LHA_Archive {
    strings:
        $a = { ?? ?? ?? 6C 68 35 }
        $b = { 6C 68 35 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v21_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_20 {
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional {
    strings:
        $a = { 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule CreateInstall_Stub_v2003xx_Gentee {
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp {
    strings:
        $a = { A1 C1 E0 02 }
        $b = { A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_02x_beta_Dwing {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 }
    condition:
        $a at pe.entry_point
}

rule TopSpeed_v301_1989_additional {
    strings:
        $a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }
    condition:
        $a at pe.entry_point
}

rule XorCopy_10 {
    strings:
        $a = { B8 00 05 BB 03 01 BA 00 00 31 07 43 40 39 D3 75 F8 C6 06 00 01 E9 C6 06 01 01 00 C6 06 02 01 00 31 C0 31 DB 31 D2 E9 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PEtite_21_emadicius_additional {
    strings:
        $a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 }
    condition:
        $a at pe.entry_point
}

rule USSR_V031_SpiritST_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SCRAM_v08a1_Hint_DOS_EP_p_5 {
    strings:
        $a = { B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C }
    condition:
        $a at pe.entry_point
}

rule UPack_Alt_Stub_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16_by_Vaska_Damrai_sign_20032007_2041 {
    strings:
        $a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }
        $b = { 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Unknown_SFX_Archive_MRI {
    strings:
        $a = { 4D 52 49 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v132_Pavol_Cerven_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 }
    condition:
        $a at pe.entry_point
}

rule XPack_097_098_DLL_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 ?? ?? 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? ?? 00 62 ?? ?? 00 71 ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_Help_File {
    strings:
        $a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch_Dwing_additional {
    strings:
        $a = { 2A A3 F2 54 CE }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_LZMA_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4093_SafeNet_SignByfly {
    strings:
        $a = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D BD EC FC FF FF 33 C0 B9 3F 00 00 00 F3 AB C7 85 10 FE FF FF A5 A5 00 00 66 C7 85 08 FE FF FF 0A 00 E9 13 09 00 00 90 68 00 10 00 00 E8 B8 F5 FF FF 83 C4 04 89 45 D0 83 7D D0 00 75 05 E9 C1 11 00 00 68 00 10 00 00 A1 ?? ?? ?? ?? 50 8B 45 D0 50 E8 FF F6 FF FF 83 C4 0C A1 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 89 85 34 FE FF FF 8B 85 34 FE FF FF 89 45 CC E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 C7 45 EC 00 00 EB 04 66 FF 45 EC 8B 45 EC 25 FF FF 00 00 83 F8 03 0F 8D DF 00 00 00 8B 45 EC 25 FF FF 00 00 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 83 C0 07 89 85 EC FB FF FF EB 7E }
        $b = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PKLITE32_v11_Hint_WIN_EP {
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_131_Build_20070615_Dll_Sukhov_Vladimir_Serge_N_Markin_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_430a_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }
    condition:
        $a at pe.entry_point
}

rule COP_v10_c_1988_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_v08_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }
    condition:
        $a at pe.entry_point
}

rule CRC2COM_v124_unpacked_Hint_DOS_EP {
    strings:
        $a = { EB ?? C8 ?? ?? ?? E8 ?? ?? 0E 07 C6 ?? ?? ?? E8 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule PEiD_5258_3DMark_Database_file_additional {
    strings:
        $a = { 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PENinja_131_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1354_Obsidium_Software_200800207 {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_290_LZMA {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v0761_pe_exe_Hint_WIN_EP {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point
}

rule UPXShit_006_additional {
    strings:
        $a = { B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Vx_TrojanSurprice_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BF ?? ?? 8B ?? ?? 8D ?? ?? ?? B9 ?? ?? 81 ?? ?? ?? AD E2 }
    condition:
        $a at pe.entry_point
}

rule XorCopy_v10_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B8 ?? ?? BB ?? ?? BA ?? ?? 31 07 43 40 39 D3 75 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 31 C0 31 DB 31 D2 E9 }
    condition:
        $a at pe.entry_point
}

rule PIRIT_v15_additional {
    strings:
        $a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }
    condition:
        $a at pe.entry_point
}

rule PEShit_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v030_beta_By_Dwing_h {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2117_StrongbitSoftComplete_Development {
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
        $b = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_Pascal_v40_Unit_Hint_FILE_START {
    strings:
        $a = { 54 50 55 30 00 }
    condition:
        $a at pe.entry_point
}

rule FishPE_V10X_hellfish_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule HSC_music_file {
    strings:
        $a = { C8 E2 04 20 }
    condition:
        $a at pe.entry_point
}

rule COMPACK_v51_additional {
    strings:
        $a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_MASM32_TASM32_additional {
    strings:
        $a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_100_by_Kas_additional {
    strings:
        $a = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v276_WebToolMaster {
    strings:
        $a = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }
    condition:
        $a at pe.entry_point
}

rule PKLite_114_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_vxx {
    strings:
        $a = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V115_V117_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule PCPEC_alpha_additional {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Amiga_IFFILBM_Graphics_format_additional {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_v405_v406_Hint_DOS_EP {
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v101_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1X_V2X_Oreans_Technologies {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule nPack_v11_250_Beta_NEOx {
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
        $b = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PACKWIN_v101p_Hint_DOS_EP {
    strings:
        $a = { 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v13x_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_V099_V10_Private_tE {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V21X_softcompletecom_additional {
    strings:
        $a = { 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule TIFF_Graphics_file_Macintosh_Hint_FILE_START {
    strings:
        $a = { 4D 4D 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v2000_additional {
    strings:
        $a = { 60 E8 48 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Video_Lan_Client {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_v17_additional {
    strings:
        $a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_16_1994_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? FB B9 ?? ?? 8E C1 26 BB ?? ?? 83 ?? ?? 80 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 01 E3 }
    condition:
        $a at pe.entry_point
}

rule Gentee_Installer_Custom {
    strings:
        $a = { 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF }
    condition:
        $a at pe.entry_point
}

rule Comt_010_duckling {
    strings:
        $a = { 2D 64 55 43 4B 2D 00 2E 42 00 00 3D 0D 0A 25 30 30 25 40 40 50 5A 2D 72 6D 2D 72 6D 2D 4C 23 50 5F 52 5E 4E 31 35 52 58 2D 71 6E 2D 71 6E 50 2D 40 21 50 59 2D 21 70 2D 21 60 2D 21 30 50 5D 3D 0D 0A 58 2D 62 21 50 5F 57 52 5E 21 35 47 47 21 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260c_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4 }
    condition:
        $a at pe.entry_point
}

rule RLPack_10_beta_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_for_Win32_v500_SofProBlagoje_Ceklic_additional {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        $a at pe.entry_point
}

rule Upack_V022_V023_Dwing_20080321 {
    strings:
        $a = { 6A 07 BE ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Code_Lock_Anorganix_additional {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_1x_1710_Nooby {
    strings:
        $a = { ?? ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Delphi_DLL {
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT1Family_Hint_DOS_EP {
    strings:
        $a = { 01 B9 ?? 00 31 17 }
    condition:
        $a at pe.entry_point
}


rule SEA_AXE_v22_Hint_DOS_EP {
    strings:
        $a = { FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_vxxxx_additional {
    strings:
        $a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }
    condition:
        $a at pe.entry_point
}

rule C_Cpp_Library_file_Hint_FILE_START {
    strings:
        $a = { F0 0D 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PEX_099 {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule ExeTools_v21_Encruptor_by_DISMEMBER {
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74 }
    condition:
        $a at pe.entry_point
}

rule PolyEnE_001p_by_Lennart_Hedlund_additional {
    strings:
        $a = { 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0 }
    condition:
        $a at pe.entry_point
}

rule LGLZ_103b_104b {
    strings:
        $a = { FC 1E 06 0E 8C C8 01 06 34 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 46 00 AD 95 B2 10 EA }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Macromedia_Flash_Projector_60_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10_Build_20041213_test_vcasm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v155_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point
}

rule REC_v034_3_Hint_DOS_EP {
    strings:
        $a = { 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule PESpin_V11_cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_197_SetiSoft_h {
    strings:
        $a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
        $b = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PC_Guard_v303d_v305d {
    strings:
        $a = { 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TSCRUNCH_v301_Hint_DOS_EP {
    strings:
        $a = { EB ?? 06 1E 55 57 56 52 51 53 50 16 1F 0E 07 8B F4 }
    condition:
        $a at pe.entry_point
}

rule MOD_8_Track_Oktatracker_music_file {
    strings:
        $a = { 4F 43 54 }
    condition:
        $a at pe.entry_point
}

rule aPack_v082 {
    strings:
        $a = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }
    condition:
        $a at pe.entry_point
}

rule NsPack_14_by_North_Star_Liu_Xing_Ping_additional {
    strings:
        $a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }
    condition:
        $a at pe.entry_point
}

rule Vx_ARCV4 {
    strings:
        $a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_50_debug {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 42 00 68 00 00 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 F0 53 56 57 89 65 E8 FF 15 00 C1 42 00 A3 00 A1 42 00 A1 00 A1 42 00 C1 E8 08 25 FF 00 00 00 A3 00 A1 42 00 8B 0D 00 A1 42 00 81 E1 FF 00 00 00 89 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Macromedia_Flash_Projector_60 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule _SDProtector_11x_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 }
    condition:
        $a at pe.entry_point
}

rule Safengine_Licenseor_1720_Nooby {
    strings:
        $a = { E8 1B 00 00 00 53 00 61 00 66 00 65 00 6E 00 67 00 69 00 6E 00 65 00 20 00 4C 00 69 00 63 00 65 }
    condition:
        $a at pe.entry_point
}

rule PECompact_134_140b1 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB F8 10 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Borland_Cpp_additional {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }
    condition:
        $a at pe.entry_point
}

rule COP_v10_c_1988_additional {
    strings:
        $a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }
    condition:
        $a at pe.entry_point
}

rule _022_beta_shoooo {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_COM {
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_vxx_additional {
    strings:
        $a = { 9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_v31_JunkCode {
    strings:
        $a = { E9 ?? ?? ?? 00 F0 0F C6 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_112_Vladimir_Sukhov_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }
    condition:
        $a at pe.entry_point
}

rule MS_Compress_Archive_Hint_FILE_START {
    strings:
        $a = { 53 5A 44 44 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v33_Silent_Software_Silent_Shield_c2005_h {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule ASPack_106b_Solodovnikov_Alexey {
    strings:
        $a = { 90 75 00 E9 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM_additional {
    strings:
        $a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_V100_BeRo_Sign_by_fly {
    strings:
        $a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_13x_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEQuake_V006_forgat_additional {
    strings:
        $a = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule XcomOR_099a {
    strings:
        $a = { 80 06 01 01 0A B4 01 50 50 C3 BF 00 01 57 B8 00 00 8B 4D 01 8B 5D 03 33 D8 89 1D 83 C7 02 05 87 00 83 F9 01 74 01 49 E2 EB 58 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Turbo_or_Borland_Pascal_v70 {
    strings:
        $a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }
    condition:
        $a at pe.entry_point
}

rule Vx_Einstein_Hint_DOS_EP {
    strings:
        $a = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_3_Hint_DOS_EP {
    strings:
        $a = { 50 06 0E 1F 8B 0E }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102_exescrcom_Ashkbiz_Danehkar_h {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point
}

rule PureBasic_4x_DLL_Neil_Hodgson_additional {
    strings:
        $a = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }
    condition:
        $a at pe.entry_point
}

rule Upack_V039_V0399_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 4F 04 FD 1A D2 22 C2 3C 07 73 F6 50 0F B6 6F FF ?? ?? ?? 66 69 ED 00 03 8D AC AB 08 10 00 00 57 B0 01 E3 1F 2B 7B 08 84 0F 0F 95 C4 FE C4 8D 54 85 00 FF 16 12 C0 D0 E9 74 0E 2A E0 80 E4 01 75 E6 33 C9 B5 01 FF 56 50 33 C9 5F E9 F2 00 00 00 04 F9 1A C0 B1 30 24 03 8B 6B 08 04 08 03 D1 FF 16 73 42 03 D1 FF 16 72 14 03 D1 FF 16 72 24 0C 01 50 8B C7 2B 43 08 B1 80 8A 00 EB CE 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 8F 00 00 00 48 87 6B 0C 50 87 6B 10 8D 93 C0 0B 00 00 89 6B 14 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 B1 40 F6 E1 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5A 33 ED D1 E8 83 D5 02 48 91 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF }
    condition:
        $a at pe.entry_point
}

rule WinKript_v10_Mr_Crimson_h_additional {
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PAVCryptor_Pawning_AntiVirus_Cryptor_masha_dev {
    strings:
        $a = { 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3 }
        $b = { 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v430_440_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24 }
    condition:
        $a at pe.entry_point
}

rule Petite_21_additional {
    strings:
        $a = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }
    condition:
        $a at pe.entry_point
}

rule EXELOCK_666_15_additional {
    strings:
        $a = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }
    condition:
        $a at pe.entry_point
}

rule SCAN_AV_Hint_DOS_EP {
    strings:
        $a = { 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule Img_Software_Set_graphics_file_additional {
    strings:
        $a = { 53 43 4D 49 20 20 20 31 41 54 }
    condition:
        $a at pe.entry_point
}

rule SCRAM_v08a1 {
    strings:
        $a = { B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C }
    condition:
        $a at pe.entry_point
}

rule Lotus_Word_Pro_document_file_additional {
    strings:
        $a = { 57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37 }
    condition:
        $a at pe.entry_point
}

rule DBPE_v153 {
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA }
    condition:
        $a at pe.entry_point
}

rule PECompact_v1242_v1243 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }
    condition:
        $a at pe.entry_point
}

rule PE_Password_v02_SMTSMF {
    strings:
        $a = { E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v10_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_One_layer_encryption_additional {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule PassEXE_v20 {
    strings:
        $a = { 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V30_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v1xx_additional {
    strings:
        $a = { 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1032_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_018_by_Dmitry_AND_Andreev_additional {
    strings:
        $a = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10804_Hint_WIN_EP {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_V100_V124_cyclotron {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_C_v104_additional {
    strings:
        $a = { FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Macromedia_Flash_Projector_60 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Lockless_Intro_Pack {
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }
    condition:
        $a at pe.entry_point
}

rule PGMPACK_v013 {
    strings:
        $a = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_BJFNT_11b {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }
    condition:
        $a at pe.entry_point
}

rule PGMPACK_v014 {
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule Zurenava_DOS_Extender_v045_v049_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_13B_p0ke {
    strings:
        $a = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }
        $b = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule BeRo_Tiny_Pascal_BeRo_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Code_Lock_Anorganix {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v27_WebToolMaster {
    strings:
        $a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }
    condition:
        $a at pe.entry_point
}

rule Name_of_the_Packer_v10_additional {
    strings:
        $a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_compressed_resources_additional {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_DLL {
    strings:
        $a = { 83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? 10 E8 8B FF FF }
        $b = { 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 55 8B EC 53 8B 5D 08 56 8B 75 0C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PMW1_Executable_Image_using_DOSExtender {
    strings:
        $a = { 50 4D 57 31 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_Basic_NET {
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }
        $b = { FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_PE_Pack_099_Anorganix {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }
    condition:
        $a at pe.entry_point
}

rule Pe123_v200644_additional {
    strings:
        $a = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v102_exescrcom_Ashkbiz_Danehkar_h {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule Cygwin32_Cygwin {
    strings:
        $a = { 55 89 E5 83 EC 04 83 3D }
    condition:
        $a at pe.entry_point
}

rule UPX_v103_v104_additional {
    strings:
        $a = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF }
    condition:
        $a at pe.entry_point
}

rule SWAG_Archive_Hint_FILE_START {
    strings:
        $a = { 2D 73 77 31 2D }
    condition:
        $a at pe.entry_point
}

rule Adys_Glue_v010_additional {
    strings:
        $a = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Neolite_20 {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
        $b = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_ZCode_101_Anorganix {
    strings:
        $a = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v010_v012_Beta_Dwing {
    strings:
        $a = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }
    condition:
        $a at pe.entry_point
}

rule RE_Crypt_v07x_Crudd_RET {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }
        $b = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Hyings_PE_Armor_075exe_Hying {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE2COM_Method_1_Hint_DOS_EP {
    strings:
        $a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule Petite_13_c1998_Ian_Luck_h_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3 }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Patch_Sign_by_hot_UNP {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_beta_Dwing_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
    condition:
        $a at pe.entry_point
}

rule KenPack_V07_CHKenCom_20090610 {
    strings:
        $a = { E8 0E 00 00 00 8D 4A 14 58 51 64 8B 08 FF 31 89 21 89 10 5A 6A 18 FF E2 72 8B 44 24 0C 8B ?? A8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 89 E5 31 C9 31 C0 ?? ?? B4 04 50 E2 FD 41 51 51 51 51 49 51 6A FF 89 E3 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? E8 7B 00 00 00 B1 08 FF 16 8D 52 04 B0 01 73 0B FF 16 B0 09 73 05 C1 E1 05 B0 11 50 8D 2C 82 FF 56 04 5D 01 E8 C3 31 C0 40 8D 54 85 00 FF 16 11 C0 39 C8 72 F4 29 C8 C3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v100_Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $c = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_32Lite_003_Anorganix {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_FSG_131 {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }
    condition:
        $a at pe.entry_point
}

rule Vx_Zherkov2968_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? EB ?? ?? ?? ?? 53 51 52 57 06 1E E8 ?? ?? 5E 2E ?? ?? ?? 3C 00 74 ?? 8B FE 83 }
    condition:
        $a at pe.entry_point
}

rule UnoPiX_103_110_BaGiE_additional {
    strings:
        $a = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v40_v50 {
    strings:
        $a = { 55 8B EC 83 }
        $b = { 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v2000 {
    strings:
        $a = { 60 E8 72 05 ?? ?? EB }
        $b = { 60 E8 70 05 00 00 EB 4C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v2001 {
    strings:
        $a = { 60 E8 72 05 ?? ?? EB 33 87 DB }
        $b = { 60 E8 72 05 00 00 EB 4C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_PENightMare_2_Beta_Anorganix_additional {
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix {
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_11_CGSoftLabs {
    strings:
        $a = { E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_PESHiELD_2x_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point
}

rule CWC_301 {
    strings:
        $a = { FA 16 1F 26 A1 02 00 83 E8 40 8E D0 FB 06 16 07 BE F0 03 8B FE B9 10 00 F3 A4 07 36 8C 06 FC 03 8B D8 8C CA 36 03 16 F0 03 36 8B 2E F2 03 FD 8B C5 3D 00 10 76 03 B8 00 10 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b1_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule MOD_8_Track_Oktatracker_music_file_Hint_FILE_START {
    strings:
        $a = { 4F 43 54 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10_Build_20041213_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_02 {
    strings:
        $a = { FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB }
    condition:
        $a at pe.entry_point
}

rule Open_Source_Code_Crypter_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V101_MATCODE_Software_20080730 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule ENcryptCOM_301 {
    strings:
        $a = { B4 30 CD 21 3C 02 77 02 CD 20 B0 4D 6A 64 5A EE }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Morphine_12_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule QinYingShieldLicense_V10X_V121_Lei_Peng_SignByfly_20080122_additional {
    strings:
        $a = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V27X_Jitit {
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_121build0909_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FreeBASIC_v011_additional {
    strings:
        $a = { E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5 }
    condition:
        $a at pe.entry_point
}

rule UPX_062_PE {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 F0 01 00 00 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point
}

rule FIZ_Archive {
    strings:
        $a = { 46 49 5A 1A 01 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_Hint_DOS_EP {
    strings:
        $a = { BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Metrowerks_CodeWarrior_v20_GUI {
    strings:
        $a = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_23_SKE_build_0426_Beta {
    strings:
        $a = { 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E }
    condition:
        $a at pe.entry_point
}

rule WebCops_DLL_LINK_Data_Security_additional {
    strings:
        $a = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }
    condition:
        $a at pe.entry_point
}

rule UPX_v071_v072_additional {
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule DiskDupe_c_MSD_Users_file_additional {
    strings:
        $a = { 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_LZMA {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 }
        $b = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DxPack_10 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 }
    condition:
        $a at pe.entry_point
}

rule aPack_058_074_2_EXE {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 BE 00 00 33 FF FC B6 01 BD }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_12C_12D_p0ke {
    strings:
        $a = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54 }
        $b = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NFO_v10 {
    strings:
        $a = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }
    condition:
        $a at pe.entry_point
}

rule Upack_028_0399_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }
    condition:
        $a at pe.entry_point
}

rule Upack_v028_0399_relocated_image_base_Delphi_NET_DLL_or_something_else_img_srcimagessmiliessmilegif_ {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C }
    condition:
        $a at pe.entry_point
}

rule ExeSmasher_vxx {
    strings:
        $a = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_ASPack_211d_emadicius {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1800 {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule DEF_v10 {
    strings:
        $a = { BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 }
        $b = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Noon1163_additional {
    strings:
        $a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }
    condition:
        $a at pe.entry_point
}

rule Upack_V024_V028_Dwing_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C }
    condition:
        $a at pe.entry_point
}

rule S3M_music_file_Hint_FILE_START {
    strings:
        $a = { 53 43 52 4D }
    condition:
        $a at pe.entry_point
}

rule RAR_Configuration_file {
    strings:
        $a = { 52 41 52 20 43 4F 4E 46 49 47 }
    condition:
        $a at pe.entry_point
}

rule PRO_PACK_v208_Hint_DOS_EP {
    strings:
        $a = { 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53 }
    condition:
        $a at pe.entry_point
}

rule Vx_Trivial25_additional {
    strings:
        $a = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }
    condition:
        $a at pe.entry_point
}

rule Vx_Danish_tiny_Hint_DOS_EP {
    strings:
        $a = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v274_additional {
    strings:
        $a = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 91 0C 00 00 90 8D BD 38 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule VcAsm_Protector_V10X_VcAsm_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V10_CGSoftLabs_additional {
    strings:
        $a = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 }
    condition:
        $a at pe.entry_point
}

rule VBOX_v43_MTE_additional {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
    condition:
        $a at pe.entry_point
}

rule Eagle_Protector_V2X_AntiDebugLIB_20081008 {
    strings:
        $a = { 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 55 73 65 72 33 32 2E 64 6C 6C 00 41 64 76 41 70 69 33 32 2E 64 6C 6C 00 4F 6C 65 61 75 74 33 32 2E 64 6C 6C 00 47 64 69 33 32 2E 64 6C 6C 00 4F 6C 65 33 32 2E 64 6C 6C 00 43 6F 6D 43 74 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 4B 65 79 62 6F 61 72 64 54 79 70 65 00 00 00 57 69 6E 64 6F 77 46 72 6F 6D 50 6F 69 6E 74 00 00 00 52 65 67 51 75 65 72 79 56 61 6C 75 65 45 78 41 00 00 00 52 65 67 53 65 74 56 61 6C 75 65 45 78 41 00 00 00 53 74 61 72 74 53 65 72 76 69 63 65 41 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 45 72 72 6F 72 49 6E 66 6F 00 00 00 53 61 66 65 41 72 72 61 79 50 74 72 4F 66 49 6E 64 65 78 00 00 00 55 6E 72 65 61 6C 69 7A 65 4F 62 6A 65 63 74 00 00 00 43 72 65 61 74 65 53 74 72 65 61 6D 4F 6E 48 47 6C 6F 62 61 6C 00 00 00 49 73 45 71 75 61 6C 47 55 49 44 00 00 00 49 6D 61 67 65 4C 69 73 74 5F 53 65 74 49 63 6F 6E 53 69 7A 65 00 }
    condition:
        $a at pe.entry_point
}

rule STNPEE_113_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102_Ashkibiz_Danehlar_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        $a at pe.entry_point
}

rule NsPack_V14_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1336_Obsidium_Software_additional {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_November_17768_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_mainCRTStartup_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_UPX_0896_102_105_124_emadicius {
    strings:
        $a = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 }
    condition:
        $a at pe.entry_point
}

rule ProPack_214_m2_COM {
    strings:
        $a = { BE 4A 02 FC E8 3C 00 05 00 01 8B C8 E8 34 00 8B D0 03 C6 05 06 00 8B F8 83 C6 04 AD 32 E4 8B EE 8B F7 03 C1 8B F8 3B FE 76 0D FD 57 4E 4F 8B CA F3 A4 47 }
    condition:
        $a at pe.entry_point
}

rule PE_Protect_v09_additional {
    strings:
        $a = { E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F }
    condition:
        $a at pe.entry_point
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v30 {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06 }
        $b = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule DalKrypt_10_by_DalKiT {
    strings:
        $a = { 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }
        $b = { 68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Zortech_C_v30_Hint_DOS_EP {
    strings:
        $a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_Beta_Dwing_additional {
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 }
    condition:
        $a at pe.entry_point
}

rule MSVCpp_v8_procedure_1_recognized_h_additional {
    strings:
        $a = { 55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3 }
    condition:
        $a at pe.entry_point
}

rule SDW_v174_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 54 5B 3B DC 75 ?? EB ?? 9C 5B 81 ?? ?? ?? 53 9D 9C 58 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_11_SLV_h {
    strings:
        $a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }
    condition:
        $a at pe.entry_point
}

rule ABC_Cryptor_10_by_ZloY {
    strings:
        $a = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 }
        $b = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Nullsoft_PiMP_Install_System_v1x {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 }
        $b = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Armor_V046_hying {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule iLUCRYPT_v4018_exe_additional {
    strings:
        $a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v103b_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_83_Coverpage_Hint_FILE_START {
    strings:
        $a = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C }
    condition:
        $a at pe.entry_point
}

rule CipherWall_Self_ExtratorDecryptor_Console_15 {
    strings:
        $a = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_v02_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }
    condition:
        $a at pe.entry_point
}

rule Themida_10xx_18xx_no_compression_Oreans_Technologies {
    strings:
        $a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
        $b = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
        $c = { 55 8B EC 83 C4 D8 60 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V121_Dll_aPlib_043_ap0x_20080504 {
    strings:
        $a = { 80 7C 24 08 01 0F 85 74 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Stelth_PE_101_Anorganix {
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v20_Markus_Laszlo_Reiser_h {
    strings:
        $a = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 }
        $b = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_UPX_06 {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_102_ConquestOfTroycom {
    strings:
        $a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }
        $b = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_2021_wwwstrongbitcom_additional {
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule PEtite_v12_Ian_Luck {
    strings:
        $a = { 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_121_Markus_Laszlo {
    strings:
        $a = { 31 2E 32 31 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule EXE_Manager_Version_30_1994_c_Solar_Designer {
    strings:
        $a = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }
    condition:
        $a at pe.entry_point
}

rule Stony_Brook_Pascal_v614_additional {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_5_Portions_Copyright_c_198399_Borland_h {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_Berczi_Gabor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }
        $b = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PKLITE_v112_v115_v120_2 {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 3B C4 73 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Microsoft_Visual_Cue_70_DLL {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v112_v115_v120_1 {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule NX_PE_Packer_v10_additional {
    strings:
        $a = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190 {
    strings:
        $a = { 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v168_v184 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 }
    condition:
        $a at pe.entry_point
}

rule Upack_V035_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? ?? ?? ?? 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 A8 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v274_WebToolMaster {
    strings:
        $a = { EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Pack_099_Anorganix {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }
    condition:
        $a at pe.entry_point
}

rule Anticrack_Software_Protector_v109_ACProtect {
    strings:
        $a = { 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v25_WebToolMaster {
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_2003_DLL_Microsoft {
    strings:
        $a = { 8B FF 55 8B EC }
    condition:
        $a at pe.entry_point
}

rule HiJaak_Image_Draw_Graphics_format {
    strings:
        $a = { 47 53 44 31 02 00 11 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorbased_Hint_DOS_EP {
    strings:
        $a = { BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v20_beta_Jeremy_Collake_additional {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule GOES_graphics_file_Hint_FILE_START {
    strings:
        $a = { C8 C4 D9 40 C1 D9 C5 C1 }
    condition:
        $a at pe.entry_point
}

rule guruX {
    strings:
        $a = { EB 03 ?? ?? ?? 1E EB 03 ?? ?? ?? 9C EB 02 ED ?? EB 01 ?? 60 EB 03 ?? ?? ?? EB 01 ?? E8 03 00 00 00 ?? ?? ?? 58 40 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1258_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1336_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 }
        $b = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule nPack_113002006_Beta_NEOx {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
        $b = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HACKSTOP_v118 {
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1322_Obsidium_Software {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04 }
    condition:
        $a at pe.entry_point
}

rule NoName_Packer_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
    condition:
        $a at pe.entry_point
}

rule Armadillo_37x_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC }
    condition:
        $a at pe.entry_point
}

rule GIF87a_Graphics_format {
    strings:
        $a = { 47 49 46 38 37 61 }
    condition:
        $a at pe.entry_point
}

rule OAZ_Fax_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 0F 0F 0F 0F 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_MSVCpp_DLL_Method_4_emadicius_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point
}

rule OptLink_Pass_2 {
    strings:
        $a = { 87 C0 EB 0B 00 01 02 D8 01 00 00 02 00 00 00 FC 8C DA 83 C2 10 52 16 07 0E 1F 01 16 09 00 01 16 0D 00 33 F6 33 FF B9 00 00 F3 A5 06 B8 31 00 50 CB FD 8B 1E 00 00 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_2_PK7Tjrvx {
    strings:
        $a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Resource_Cursors_file {
    strings:
        $a = { 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_Pro_Edition_116_Randy_Li_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_10_beta_CGSoftLabs_additional {
    strings:
        $a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }
    condition:
        $a at pe.entry_point
}

rule Petite_v22_wwwun4seencompetite {
    strings:
        $a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
        $b = { B8 00 ?0 ?? 00 6? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASProtect_v11_additional {
    strings:
        $a = { 90 60 E8 1B ?? ?? ?? E9 FC }
    condition:
        $a at pe.entry_point
}

rule COMPACK_45 {
    strings:
        $a = { BE 00 00 E8 00 00 5D 83 C5 FA 55 50 53 51 52 0E 07 0E 1F 8B CE 8D 72 42 BF 82 FF D1 E9 FD 57 F3 A5 8D 75 02 FC F9 8B FD C3 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v045_Virogen {
    strings:
        $a = { BD 01 AD E3 38 40 00 FF B5 DF 38 40 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v220b1_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v300_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1353_Obsidium_Software_20080120 {
    strings:
        $a = { EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V12Demo_SIS_Team_additional {
    strings:
        $a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_046_Hying_additional {
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule hyings_PEArmor_V07X_hying {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
    condition:
        $a at pe.entry_point
}

rule MPEG_Layer_IIIII_music_file {
    strings:
        $a = { FF F5 }
        $b = { FF F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_CrunchPE_Heuristic_Anorganix_additional {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_DEF_10 {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_V01_SToRM_SignByfly {
    strings:
        $a = { B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_20a_22 {
    strings:
        $a = { 53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 64 A1 18 00 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF }
    condition:
        $a at pe.entry_point
}

rule LameCrypt_v10 {
    strings:
        $a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Basic_Edition_aPLib_or_LZMA_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule RJoiner_12_by_Vaska_25032007_1658 {
    strings:
        $a = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v1401_additional {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }
    condition:
        $a at pe.entry_point
}

rule UPX_062_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 83 E8 48 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 F8 01 00 00 83 CD FF 31 DB EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_300a_361_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 }
    condition:
        $a at pe.entry_point
}

rule Protect_3031_COM {
    strings:
        $a = { 50 1E 06 0E 55 0E 1F 33 C0 8E C0 FA FC 26 A1 04 00 50 26 A1 06 00 50 26 A1 0C 00 50 26 A1 0E 00 50 8C C8 26 A3 06 00 26 C7 06 04 00 00 00 26 A3 0E 00 26 C7 06 0C 00 00 00 FB CD 01 }
    condition:
        $a at pe.entry_point
}

rule UPX_V200_V290_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_1704_phpbb3 {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_V121_BasicEdition_Stub_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PoPa_001_Packer_on_Pascal_bagie_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 }
    condition:
        $a at pe.entry_point
}

rule PeStubOEP_v1x_additional {
    strings:
        $a = { B8 ?? ?? ?? 00 FF E0 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_2x {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NoodleCrypt_v200_Eng_NoodleSpa_additional {
    strings:
        $a = { EB 01 9A E8 76 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CorelDraw_8_CDR_Graphics_format {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 52 38 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_v50_for_Windows {
    strings:
        $a = { EB ?? 53 51 06 33 C0 50 9A ?? ?? ?? ?? 58 07 59 5B 9A }
    condition:
        $a at pe.entry_point
}

rule tElock_v090_tHE_EGOiSTE {
    strings:
        $a = { ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16c_by_Vaska_UsAr_sign_21032007_2225 {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3 }
    condition:
        $a at pe.entry_point
}

rule Alloy_104142000 {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 46 23 40 00 0B C0 0F 84 A6 01 00 00 89 85 CC 22 40 00 83 BD 90 22 40 00 01 74 04 8B F8 EB 18 68 D8 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Stones_PE_Encryptor_20_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VMProtect_0x_PolyTech_additional {
    strings:
        $a = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11_MTEc {
    strings:
        $a = { 90 60 E8 1B ?? ?? ?? E9 FC }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11_MTEb {
    strings:
        $a = { 90 60 E8 1B E9 }
        $b = { 90 60 E9 ?? 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule iLUCRYPT_v4018_com_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 31 05 D1 C8 4F 81 }
    condition:
        $a at pe.entry_point
}

rule Go32Stub_v200T_DOS_Extender_additional {
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C }
    condition:
        $a at pe.entry_point
}

rule FreeBASIC_v011 {
    strings:
        $a = { E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5 }
    condition:
        $a at pe.entry_point
}

rule PEQuake_006_forgat {
    strings:
        $a = { E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 }
        $b = { E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Protector_V260hyings_PE_Armor_V0460_modify_Engprog_SignByfly {
    strings:
        $a = { 55 53 51 52 56 57 E8 E1 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 0B 00 00 00 8B 9D 9B 00 00 00 03 9D 9F 00 00 00 0B DB 74 14 8B 83 7F 46 00 00 03 83 87 46 00 00 5F 5E 5A 59 5B 5D FF E0 8D 75 43 56 FF 55 54 8D B5 A3 00 00 00 56 50 FF 55 50 89 85 B0 00 00 00 8D 75 43 56 FF 55 54 8D B5 B4 00 00 00 56 50 FF 55 50 89 85 C0 00 00 00 8D 75 43 56 FF 55 54 8D B5 C4 00 00 00 56 50 FF 55 50 89 85 D0 00 00 00 6A 40 68 00 10 00 00 FF B5 97 00 00 00 6A 00 FF 95 B0 00 00 00 89 85 9B 00 00 00 55 8D 9D F2 01 00 00 53 8D 9D CC 01 00 00 FF D3 8B 74 24 04 8B 7C 24 0C F7 46 04 07 00 00 00 75 08 81 3E 27 00 00 C0 75 06 B8 00 00 00 00 C3 }
        $b = { 55 53 51 52 56 57 E8 E1 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Heloween1172_additional {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D }
    condition:
        $a at pe.entry_point
}

rule Exe_Guarder_18_Exeiconcom_h {
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
    condition:
        $a at pe.entry_point
}

rule NET_Obfuscator_Smartassembly_RSA_sign_ASL {
    strings:
        $a = { 52 53 41 31 00 04 00 00 01 00 01 00 8F C1 0F 45 44 06 BF 85 56 8F 95 86 75 56 73 83 EB 34 4E F5 16 BE C3 93 7A AD 92 39 B1 5E DF 1E B6 63 E2 50 1C E2 }
    condition:
        $a at pe.entry_point
}

rule hyings_PEArmor_V076_hying {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2x_SoftComplete_Developement_additional {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_222223_by_Jan_Vorel_additional {
    strings:
        $a = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v071_additional {
    strings:
        $a = { 60 E8 ED 10 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_V0460_V0759_hying {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_220221_by_Jan_Vorel_additional {
    strings:
        $a = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_v007_additional {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 }
    condition:
        $a at pe.entry_point
}

rule TPAV_Cryptor_V11_msaha_dev {
    strings:
        $a = { 8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D 95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ?? 70 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_v038_Beta_Strip_base_relocation_table_Option_ {
    strings:
        $a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule RLPack_FullEdition_V120_BasicEdition_Stub_ap0x_SignByfly_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 }
    condition:
        $a at pe.entry_point
}

rule Alex_Protector_v10_Alex {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_CodeSafe_20_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_v017_F_Giesen {
    strings:
        $a = { FC FF 4D 08 31 D2 8D 7D 30 BE }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_30 {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
        $b = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule N_Joy_12_NEX {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v180_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v100_Hint_DOS_EP {
    strings:
        $a = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }
    condition:
        $a at pe.entry_point
}

rule SimplePack_111_Method_1_bagieTMX_h {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }
    condition:
        $a at pe.entry_point
}

rule Upack_v035_alpha {
    strings:
        $a = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V112_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule ExeBundle_v30_standard_loader {
    strings:
        $a = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }
    condition:
        $a at pe.entry_point
}

rule Diet_100_EXE {
    strings:
        $a = { FC 06 1E 0E 8C C8 01 06 38 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 4A 00 AD 8B E8 B2 10 EA 00 00 00 00 FF }
    condition:
        $a at pe.entry_point
}

rule NoodleCrypt_v20_additional {
    strings:
        $a = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Petite_22_c1998_99_Ian_Luck {
    strings:
        $a = { ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
        $b = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule yP_v10b_by_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_V119_Dll_LZMA_430_ap0xnbsp_nbsp_Sign_by_fly_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA }
    condition:
        $a at pe.entry_point
}

rule Libraries_by_John_Socha_additional {
    strings:
        $a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_JDPack_1x_JDProtect_09 {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v15_Vaska {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F }
    condition:
        $a at pe.entry_point
}

rule BobPack_v100_BoB_BobSoft {
    strings:
        $a = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_12build3009_Method2_bagie {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MASMTASM_sig1h {
    strings:
        $a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Windows_Type_1_font_metric_file_Hint_FILE_START {
    strings:
        $a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }
    condition:
        $a at pe.entry_point
}

rule Naked_Packer_V10_BigBoote {
    strings:
        $a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 }
        $b = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule XPack_152_164_Hint_DOS_EP {
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_Ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_V12_BG_Software_Protect_Technologies_SignByfly {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Cracked_by_Autohack_2_Hint_DOS_EP {
    strings:
        $a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v1010_win32_GUI {
    strings:
        $a = { C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 }
    condition:
        $a at pe.entry_point
}

rule fasm_Tomasz_Grysztar {
    strings:
        $a = { 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00 }
        $b = { 6A 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEtite_v21_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Studio_NET_additional {
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_106107_PolyTech {
    strings:
        $a = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }
    condition:
        $a at pe.entry_point
}

rule Upack_v021Beta_Sign_by_hot_UNP {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule VProtector_11X_vcasm_additional {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Access_Database_file_additional {
    strings:
        $a = { 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PE_Pack_099 {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Encrupted_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B9 ?? ?? BE ?? ?? 8B FE 51 56 B4 ?? AC 32 C4 C0 ?? ?? 02 E1 AA E2 ?? BF ?? ?? 5E 59 F3 A4 BE ?? ?? 56 C3 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V22X_V2308_Jitit {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule Rec_028 {
    strings:
        $a = { 06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 02 73 02 CD 20 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 FB 1E B8 40 00 8E D8 A1 6C 00 3B 06 6C 00 74 FA 1F 53 }
    condition:
        $a at pe.entry_point
}

rule Themida_10xx_1800_compressed_engine_Oreans_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_UPX_06 {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule eXcalibur_v103_forgotus {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 }
    condition:
        $a at pe.entry_point
}

rule UPX_Inliner_v10_by_GPcH_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V13betaX_cyberbob_20080311 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 }
    condition:
        $a at pe.entry_point
}

rule Petite_12_c1998_Ian_Luck {
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_012_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 7F 23 40 00 0B C0 0F 84 D5 01 00 00 89 85 05 23 40 00 83 BD C3 22 40 00 01 74 0D 83 BD BF 22 40 00 01 74 2A }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_226_DLL_minimum_protection_wwwstrongbitcom_additional {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_50_no_debug {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 41 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 F0 53 56 57 89 65 E8 FF 15 00 00 00 00 33 D2 8A D4 89 15 00 00 41 00 8B C8 81 E1 FF 00 00 00 89 0D 00 00 41 00 C1 E1 08 03 CA 89 0D 00 00 41 00 C1 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v150_with_CRC_check {
    strings:
        $a = { 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v123_RC4_build_0807_exe_Alexey_Solodovnikov {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_Shit_v01_500mhz_additional {
    strings:
        $a = { E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Anti007_V25_V26_LiuXingPing {
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_018_by_Dmitry_AND_Andreev {
    strings:
        $a = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
        $b = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Pack_Master_10_PEX_Clone_Anorganix_additional {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule PolyEnE_V001p_Lennart_Hedlund_additional {
    strings:
        $a = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule ASProtect_20_additional {
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule PCPEC_alpha_Hint_WIN_EP {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_200_Win32_Berczi_Gabor_Pierre_Muller_Peter_Vreman_ {
    strings:
        $a = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_v151x {
    strings:
        $a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_NorthStar_PE_Shrinker_13 {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PCPaintPictor_graphics_file_format_Hint_FILE_START {
    strings:
        $a = { 34 12 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_DLL {
    strings:
        $a = { 53 56 57 BB 01 8B 24 }
        $b = { 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_V1360_Obsidium_Softwarenbsp_nbsp_SignByfly_20080730 {
    strings:
        $a = { EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Exe_Shield_27b {
    strings:
        $a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SLVc0deProtector_v11_SLV {
    strings:
        $a = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C }
        $b = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_V031_emadicius_additional {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_v106 {
    strings:
        $a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Pksmart_10b_additional {
    strings:
        $a = { BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Borland_Delphi_Setup_Module_Anorganix {
    strings:
        $a = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule BobSoft_Mini_Delphi_BoB_BobSoft_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule HEALTH_v51_by_Muslim_MPolyak_Hint_DOS_EP {
    strings:
        $a = { 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_19X_Jitit {
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_13B_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_V100_BeRo_additional {
    strings:
        $a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 }
    condition:
        $a at pe.entry_point
}

rule Vx_Quake518_additional {
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }
    condition:
        $a at pe.entry_point
}

rule Werus_Crypter_10_Kas_additional {
    strings:
        $a = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_stub {
    strings:
        $a = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_MEW_11_SE_10_Anorganix {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190c_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Encapsulated_Postscript_graphics_file_v30_EPSF_30_additional {
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30 }
    condition:
        $a at pe.entry_point
}

rule Stelth_PE_101_BGCorp_additional {
    strings:
        $a = { BA ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_C_Borland_Builder_additional {
    strings:
        $a = { 3B CF 76 05 2B CF FC F3 AA 59 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Borland_Delphi_Borland_Cpp {
    strings:
        $a = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }
    condition:
        $a at pe.entry_point
}

rule Neolite_v20_additional {
    strings:
        $a = { E9 A6 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_MASM32 {
    strings:
        $a = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
    condition:
        $a at pe.entry_point
}

rule id_Softwares_WAD_file_Hint_FILE_START {
    strings:
        $a = { 50 57 41 44 0B 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_build_0807_exe_Alexey_Solodovnikov_h {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PIMP_Install_System_v13x {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD }
        $b = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_PEX_099_Anorganix_additional {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Shrink_v20 {
    strings:
        $a = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }
    condition:
        $a at pe.entry_point
}

rule NTPacker_10_ErazerZ_additional {
    strings:
        $a = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 }
    condition:
        $a at pe.entry_point
}

rule FIZ_Archive_Hint_FILE_START {
    strings:
        $a = { 46 49 5A 1A 01 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v211d_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1341_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_CodeSafe_20_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
    condition:
        $a at pe.entry_point
}

rule RSCs_Process_Patcher_14 {
    strings:
        $a = { E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_v200_1988_1989 {
    strings:
        $a = { FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V071a_V075b_MATCODE_Software_20080310 {
    strings:
        $a = { 57 56 53 51 52 55 E8 10 00 00 00 E8 7A 00 00 00 5D 5A 59 5B 5E 5F E9 84 01 00 00 E8 00 00 00 00 58 05 84 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 AC 0A C0 74 37 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1E F6 C1 40 75 0A 8B C8 2B C0 F3 AA 75 FC EB D9 8B D6 8B CF 03 F0 E8 8F 00 00 00 03 F8 EB CA 8B C8 F3 A4 75 FC EB C2 C3 E8 00 00 00 00 5F 81 C7 71 FF FF FF B0 E9 AA B8 9A 01 00 00 AB 2B FF E8 00 00 00 00 58 05 FE 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 53 8B 30 03 F0 2B F2 8B EE 8B C2 8B 45 3C 03 C5 8B 48 34 2B CD 74 3D E8 00 00 00 00 58 05 DD 00 00 00 8B 10 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v14 {
    strings:
        $a = { 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC }
    condition:
        $a at pe.entry_point
}

rule PEtite_v13 {
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
        $b = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEtite_v12 {
    strings:
        $a = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule COM2EXE_Hint_DOS_EP_additional {
    strings:
        $a = { EB ?? 5B 0E 1F 81 }
    condition:
        $a at pe.entry_point
}

rule kkryptor_8_rsc {
    strings:
        $a = { EB 6A 87 DB 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPolyX_0x_Delikon {
    strings:
        $a = { 81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10Demo_SIS_Team {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
        $b = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_SK {
    strings:
        $a = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_WATCOM_CCpp_EXE {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_11_BRS_Solodovnikov_Alexey {
    strings:
        $a = { 60 E9 ?? 05 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_50_KOLMCK_additional {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v10_additional {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
    condition:
        $a at pe.entry_point
}

rule Upack_v033_v034_Beta {
    strings:
        $a = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v139_additional {
    strings:
        $a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
    condition:
        $a at pe.entry_point
}

rule Interplays_MVE_file_additional {
    strings:
        $a = { 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A }
    condition:
        $a at pe.entry_point
}

rule PE_Ninja_v10_pDzA_kRAker_TNT {
    strings:
        $a = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_MEW_11_SE_10_Anorganix {
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_440_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 61 69 6C 65 64 20 43 52 43 20 63 68 65 63 6B 00 00 00 00 52 }
    condition:
        $a at pe.entry_point
}

rule tElock_099c_Private_ECLIPSE_tE_additional {
    strings:
        $a = { E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_Modifier_v01x_additional {
    strings:
        $a = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        $a at pe.entry_point
}

rule VC8_Microsoft_Corporation {
    strings:
        $a = { E8 ?? ?? ?? ?? E9 ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule UC_2_EXE_24 {
    strings:
        $a = { 50 1E 0E 1F FC 33 F6 E8 00 01 16 07 33 F6 33 FF B9 00 01 F3 A5 06 B8 5D 00 50 CB 03 ED FE CE 75 05 AD 8B E8 B6 10 13 DB C3 03 ED FE CE 75 05 AD 8B E8 B6 10 73 05 43 3A DA 75 EE C3 8A 97 39 30 BB 01 00 0A D2 74 07 E8 D1 FF FE CA 75 F9 8B C3 }
    condition:
        $a at pe.entry_point
}

rule vprotector_13_vcasm_additional {
    strings:
        $a = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v113_Hint_DOS_EP {
    strings:
        $a = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }
    condition:
        $a at pe.entry_point
}

rule UPolyX_v05_additional {
    strings:
        $a = { EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Password_v02_SMTSMF_additional {
    strings:
        $a = { E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }
    condition:
        $a at pe.entry_point
}

rule _ExeShield_Protector_36_wwwexeshieldcom {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch_or_any_Version_Sign_by_hot_UNP {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_112_Vladimir_Sukhov_h {
    strings:
        $a = { 55 46 41 C6 D2 C1 00 00 }
        $b = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_FSG_131_Anorganix {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
    condition:
        $a at pe.entry_point
}

rule EXEGuard_13 {
    strings:
        $a = { BA 98 02 BF B9 00 EB 01 B8 E8 7F FF 7C 29 79 2F FA EA 1D F5 9E 41 76 E5 D8 FD 5D DD 00 88 1C 25 04 55 55 8C 16 15 0A 38 12 2D 0E 8F EF 10 67 36 AC 34 23 DA 39 95 1C 2F 1C 94 00 29 20 3F A9 3D 38 25 15 39 08 29 A0 E8 98 08 A5 39 06 31 BC 2D }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_needs_to_be_added {
    strings:
        $a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
        $b = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF }
        $c = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressor_v16x_CGSoftLabs {
    strings:
        $a = { 68 92 24 49 00 C3 2B 15 CD E3 9E C0 CC 77 3F 49 AD BA F3 57 F2 9A 9F F3 08 F6 9C 84 E1 A9 E4 15 9B 98 60 40 2E E2 8C 4E A5 BF A0 E4 6A A1 70 FC A9 BB A6 85 81 FC FB EB 27 46 72 72 98 E6 5C 2C }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1991 {
    strings:
        $a = { 2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F }
    condition:
        $a at pe.entry_point
}

rule PELOCKnt_204_additional {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_XCR_011 {
    strings:
        $a = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1994 {
    strings:
        $a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_FSG_10_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point
}

rule Thinstall_V2403_Jitit {
    strings:
        $a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
        $b = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASProtect_v12x {
    strings:
        $a = { 00 00 68 01 ?? ?? ?? C3 AA }
    condition:
        $a at pe.entry_point
}

rule ComCrypt_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B9 ?? ?? BE ?? ?? 89 F7 0E 1F 0E 07 BB ?? ?? FC AD 31 D8 AB E2 ?? C6 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_290_300_400_DLL_X86_CRT_LIB {
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }
    condition:
        $a at pe.entry_point
}

rule Ice_v100_Hint_DOS_EP {
    strings:
        $a = { EB ?? BE ?? ?? 8B FE 8B ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? 50 FC AD 33 C2 AB 8B D0 }
    condition:
        $a at pe.entry_point
}

rule ProtEXE_211_COM {
    strings:
        $a = { 9C 9C 58 25 FF 0F 50 9D 9C 58 25 00 F0 3D 00 F0 74 2A 9C 58 25 FF 0F 0D 00 70 50 9D 9C 58 25 00 70 74 19 BA 64 00 B0 AD EB 01 88 EE EB 01 A0 0F 20 00 F8 BA 64 00 B0 AE EB 01 88 EE 9D 1E 06 33 C0 8E D8 FF 36 0C 00 FF 36 0E 00 B8 00 00 A3 0C }
    condition:
        $a at pe.entry_point
}

rule ExeShield_v37_ExeShield_Team_h_additional {
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Help_file_Hint_FILE_START {
    strings:
        $a = { 3F 5F 03 }
    condition:
        $a at pe.entry_point
}

rule ENIGMA_Protector_V1X_Sukhov_Vladimir_additional {
    strings:
        $a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Yodas_Protector_102_Anorganix_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 }
    condition:
        $a at pe.entry_point
}

rule Setup_Factory_v6003_Setup_Launcher {
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
        $b = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RSCs_Process_Patcher_v14_additional {
    strings:
        $a = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v108x {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D BB 03 }
        $b = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_290_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SecuROM_V7X_Sony_DADC_SignByfly_20080114_additional {
    strings:
        $a = { 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v60_Unit {
    strings:
        $a = { 54 50 55 39 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_com_Hint_HDR_FILESIZE_16 {
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point
}

rule Cruncher_10 {
    strings:
        $a = { 2E 8C 1E 00 00 2E A3 02 00 B4 30 CD 21 3C 03 73 12 BB 51 00 8E DB 8D 16 B4 00 B4 09 CD 21 06 33 C0 50 CB BB 51 00 8E C3 BF B3 00 8B 1E 2C 00 0B DB 74 DE 8E DB BE 00 00 83 3C 00 74 03 46 EB F8 83 C6 04 AC AA 0A C0 75 FA BB 51 00 8E C3 8E DB }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v11_Northfox {
    strings:
        $a = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Graphics_Interface_Driver_Hint_FILE_START {
    strings:
        $a = { 46 42 47 44 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_10_beta_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }
    condition:
        $a at pe.entry_point
}

rule ID_Application_Protector_V12_ID_Security_Suite_Sign_by_fly_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1334_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule Alloy_4x_PGWare_LLC_additional {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_v531009_LINK_v369_additional {
    strings:
        $a = { 8B E8 8C C0 }
    condition:
        $a at pe.entry_point
}

rule GCC_CYGWIN_MSYS_sign_ASL {
    strings:
        $a = { 55 89 E5 83 EC 08 A1 00 ?? ?? 00 85 C0 74 01 CC D9 7D FE 0F B7 4D FE 81 E1 C0 F0 FF FF 66 89 4D FE 0F B7 55 FE 81 CA 3F 03 00 00 66 89 55 FE D9 6D FE }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encrypter_113 {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 2B 95 2D 3C 40 00 83 EA 0B 89 95 36 3C 40 00 01 95 24 3C 40 00 01 95 28 3C 40 00 80 BD 2C 3C 40 00 00 75 4A C6 85 2C 3C 40 00 01 8D B5 35 3C 40 00 0F B6 36 8B FD 8D 9D 36 3C 40 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Cpp_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE }
    condition:
        $a at pe.entry_point
}

rule Upack_0399_Dwing {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098_tHE_EGOiSTE {
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextr_Passwcheck_Vir_shield {
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v60 {
    strings:
        $a = { FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PE_Protect_09 {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_v01b_v03b_v03_SMoKE_additional {
    strings:
        $a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
    condition:
        $a at pe.entry_point
}

rule CAN2EXE_v001_additional {
    strings:
        $a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }
    condition:
        $a at pe.entry_point
}

rule PMODEW_120 {
    strings:
        $a = { FC 16 07 BF 00 01 8B F7 57 B9 EE 12 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }
    condition:
        $a at pe.entry_point
}

rule PMODEW_121 {
    strings:
        $a = { FC 16 07 BF 00 01 8B F7 57 B9 05 13 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v094_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }
    condition:
        $a at pe.entry_point
}

rule tElock_V098_Special_Build_forgot_heXer {
    strings:
        $a = { E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_MFC {
    strings:
        $a = { 6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule RERP_002 {
    strings:
        $a = { FC 1E 06 8C C3 83 C3 10 0E 1F BE 38 00 B9 FF FF AD 3B C1 75 0A AD 3B C1 74 0C 03 C3 8E C0 AD 8B F8 26 01 1D EB EA 07 1F 2E 03 1E 36 00 53 2E FF 36 34 00 CB 00 00 00 00 FF FF }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_V15_Demo_FEUERRADER_additional {
    strings:
        $a = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        $a at pe.entry_point
}

rule CD_Cops_II {
    strings:
        $a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point
}

rule RLPack_V111_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule PE_Intro_v10_Predator_NLS {
    strings:
        $a = { 8B 04 24 9C 60 E8 00 00 00 00 5D 81 ED 0A 45 40 00 80 BD 67 44 40 00 00 0F 85 48 }
    condition:
        $a at pe.entry_point
}

rule SafeDisc_v4 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_049_Hying {
    strings:
        $a = { 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CI_Crypt_V01_FearlesS {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Crunch_V50_Bitarts {
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
        $b = { EB 15 03 00 00 00 06 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule JDPack_V200_JDPack {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_NorthStar_PE_Shrinker_13_Anorganix_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule LCC_Win32_DLL_additional {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v1061b {
    strings:
        $a = { 60 E8 5D 81 ED B8 03 C5 2B 85 0B DE 89 85 17 DE 80 BD 01 }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_v036_beta_Dwing {
    strings:
        $a = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10801 {
    strings:
        $a = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 44 BB 10 44 03 DD 2B }
        $b = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v10802 {
    strings:
        $a = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 ?? BB 10 6A 44 ?? 03 DD 2B 9D }
        $b = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v10803 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 4A 44 ?? BB 04 4A 44 ?? 03 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PAK_SFX_Archive {
    strings:
        $a = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1XXX_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v20_additional {
    strings:
        $a = { 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 }
    condition:
        $a at pe.entry_point
}

rule Pe123_v200644_412 {
    strings:
        $a = { 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? 45 ?? 50 E8 ?? FF FF FF ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 45 }
        $b = { 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PRO_MIDI_Music_file_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 52 4D 49 44 }
    condition:
        $a at pe.entry_point
}

rule Unknown_Packer_Northfox_additional {
    strings:
        $a = { 54 59 68 61 7A 79 }
    condition:
        $a at pe.entry_point
}

rule PENightMare_v13_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9 }
    condition:
        $a at pe.entry_point
}

rule XWD_graphics_format {
    strings:
        $a = { 00 00 00 71 00 00 00 07 00 00 00 02 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}


rule _PseudoSigner_01_CD_Cops_II_Anorganix {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PESHiELD_025_emadicius {
    strings:
        $a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_Kenonic_Controls_h_additional {
    strings:
        $a = { 8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 }
    condition:
        $a at pe.entry_point
}

rule COP_v10_c_1988 {
    strings:
        $a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_BitArts {
    strings:
        $a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_v15b3_additional {
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_JDPack_1x_JDProtect_09_Anorganix {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
    condition:
        $a at pe.entry_point
}

rule tElock_v099_additional {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 77 ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_DLL_minimum_protection_wwwstrongbitcom_additional {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 }
    condition:
        $a at pe.entry_point
}

rule IBM_PictureMaker_graphics_file_Hint_FILE_START {
    strings:
        $a = { 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_v230_Teggo {
    strings:
        $a = { 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule HPA_additional {
    strings:
        $a = { E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule IMP_Packer_10_Mahdi_Hezavehi_IMPOSTER {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
        $b = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WinZip_Self_Extractor_22_personal_edition_WinZip_Computing_h {
    strings:
        $a = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }
    condition:
        $a at pe.entry_point
}

rule diProtector_V1X_diProtector_Software {
    strings:
        $a = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_16c_Vaska {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v11_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8? }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_103_ConquestOfTroycom {
    strings:
        $a = { E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }
        $b = { E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_FSG_10 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point
}

rule bambam_001_bedrock {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 }
    condition:
        $a at pe.entry_point
}

rule Aase_Crypter_by_santasdad_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 }
    condition:
        $a at pe.entry_point
}

rule AdFlt2_additional {
    strings:
        $a = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1991_Hint_DOS_EP {
    strings:
        $a = { 2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F }
    condition:
        $a at pe.entry_point
}

rule hmimys_Packer_10_hmimys {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 }
        $b = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v099_Special_Build_heXer_forgot_additional {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Windows_Animation_format_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_25_h {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_Dll_LZMA_430_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule RIX_graphics_file_Hint_FILE_START {
    strings:
        $a = { 52 49 58 33 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_FSG_131 {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
    condition:
        $a at pe.entry_point
}

rule HideProtect_V10X_SoftWar_Company_additional {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Yodas_Protector_102 {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_iBox_LZMA_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point
}

rule ActiveMark_Trymedia_Systems_Inc_additional {
    strings:
        $a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_107b_DLL {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 3E D9 43 00 B8 38 D9 43 00 03 C5 2B 85 0B DE 43 00 89 85 17 DE 43 00 80 BD 01 DE 43 00 00 75 15 FE 85 01 DE 43 00 E8 1D 00 00 00 E8 79 02 00 00 E8 12 03 00 00 8B 85 03 DE 43 00 03 85 17 DE 43 00 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LCC_Win32_1x {
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1530_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule DWC_Archive_Hint_DOS_FILESIZE_3 {
    strings:
        $a = { 44 57 43 }
    condition:
        $a at pe.entry_point
}

rule E2C_by_DoP {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3 }
    condition:
        $a at pe.entry_point
}

rule Packed_with_PKLITE_v150_with_CRC_check_1_additional {
    strings:
        $a = { 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v03_Eng_cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v210b2_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Zylom_encrypted_game_Zylom_games_h {
    strings:
        $a = { 2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 7A 79 6C 6D 73 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2E 7A 79 6C 6D 69 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 }
    condition:
        $a at pe.entry_point
}

rule DBPE_210 {
    strings:
        $a = { EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }
    condition:
        $a at pe.entry_point
}

rule AIN_Archive {
    strings:
        $a = { 21 12 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_CD_Cops_II_Anorganix {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_12_Memory_Patch {
    strings:
        $a = { 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_005 {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 01 AD CD 24 40 00 01 AD 41 25 40 00 01 AD 95 25 40 00 01 AD F0 25 40 00 01 AD 27 26 40 00 E8 FD 01 00 00 FF B5 A6 20 40 00 FF B5 08 21 40 00 E8 7F 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_006 {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 01 AD D5 24 40 00 01 AD 4B 25 40 00 01 AD A0 25 40 00 01 AD FD 25 40 00 01 AD 35 26 40 00 E8 FD 01 00 00 FF B5 A6 20 40 00 FF B5 08 21 40 00 E8 87 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_003 {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 01 AD 42 24 40 00 01 AD A3 24 40 00 01 AD D7 24 40 00 E8 B5 01 00 00 FF B5 9A 20 40 00 FF B5 FC 20 40 00 E8 39 02 00 00 72 13 FF B5 96 20 40 00 FF B5 F8 20 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_DSES_not_saved_additional {
    strings:
        $a = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }
    condition:
        $a at pe.entry_point
}

rule FixupPak_120_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule by_Central_Point_Software_additional {
    strings:
        $a = { 50 51 52 56 57 8B EB 1E 2E }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_p_Virus_Shield_additional {
    strings:
        $a = { 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Outer_Technologies_PECrypt_Outer_Tech {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 9E 00 00 00 8D BD ?? ?? ?? ?? 8B F7 33 DB AD 33 C3 2D 2F 7B 38 13 C1 C0 10 35 3C 75 94 78 AB 43 E2 EC }
    condition:
        $a at pe.entry_point
}

rule Hitachi_Raster_Format_graphics_format_additional {
    strings:
        $a = { 43 41 44 43 2F 4B 52 20 52 53 54 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_32Lite_003 {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }
    condition:
        $a at pe.entry_point
}

rule Histogram_graphics_file_additional {
    strings:
        $a = { 6D 68 77 61 6E 68 00 04 01 02 01 02 }
    condition:
        $a at pe.entry_point
}

rule PEX_v099 {
    strings:
        $a = { 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81 }
    condition:
        $a at pe.entry_point
}

rule CipherWall_Self_ExtratorDecryptor_Console_v15_additional {
    strings:
        $a = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
    condition:
        $a at pe.entry_point
}

rule Vx_FaxFreeTopo {
    strings:
        $a = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix_additional {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_25A_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00 }
    condition:
        $a at pe.entry_point
}

rule themida_1005_httpwwworeanscom {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }
    condition:
        $a at pe.entry_point
}

rule PE_PaCK_v10_C_Copyright_1998_by_ANAKiN_h {
    strings:
        $a = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }
        $b = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v250b3_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10_Beta_SIS_Team_additional {
    strings:
        $a = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70 {
    strings:
        $a = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v141_additional {
    strings:
        $a = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule USCC_13 {
    strings:
        $a = { BB 00 00 B9 AF 00 30 0F 43 E2 FB 55 FE FE FD F9 FC FE FD F4 F6 FD E8 EF F9 4A A1 76 A5 5E C7 EE AC 05 C0 B2 69 6B C4 0E A1 6E 1E 50 E8 06 91 ED 4D 8C 96 87 C6 85 EE C3 9D 39 A4 7F DD 67 7C D8 66 79 9C 13 7A 35 92 17 14 B6 76 71 6E 30 EF AE }
    condition:
        $a at pe.entry_point
}

rule RLPack_V115_V117_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_01b_MTE_ANAKiN_DaVinci {
    strings:
        $a = { E8 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 00 00 D1 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_for_Win32_500_SofProBlagoje_Ceklic_h {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        $a at pe.entry_point
}

rule Vx_Haryanto_Hint_DOS_EP {
    strings:
        $a = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b4_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v20_Vaska {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD }
        $b = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACE_Archive_Hint_FILE_START {
    strings:
        $a = { 2A 2A 41 43 45 2A 2A }
    condition:
        $a at pe.entry_point
}

rule PGMPACK_v013_Hint_DOS_EP {
    strings:
        $a = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Protect_v10 {
    strings:
        $a = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 }
        $b = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00 }
        $c = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule id_Softwares_WAD_file {
    strings:
        $a = { 50 57 41 44 0B 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_42 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v03_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4X_SafeNet {
    strings:
        $a = { 60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point
}

rule XMI_music_file_Hint_FILE_START {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44 }
    condition:
        $a at pe.entry_point
}

rule PACKWIN_v101p_additional {
    strings:
        $a = { 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule UPX_v062 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 66 81 87 8D B0 EC 01 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 }
        $b = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_v13beta_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Duals_Cryptor_dual_additional {
    strings:
        $a = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E }
    condition:
        $a at pe.entry_point
}

rule AHpack_01_FEUERRADER_h_additional {
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 }
    condition:
        $a at pe.entry_point
}

rule BGI_Device_Driver_Hint_FILE_START {
    strings:
        $a = { 70 6B 08 08 42 47 49 20 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_4x_LCC_Win32_1x {
    strings:
        $a = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT1Family {
    strings:
        $a = { 01 B9 ?? 00 31 17 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1000_V1800_Oreans_Technologies {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PRO_MIDI_Music_file_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 52 4D 49 44 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v201_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule MicroDog_Win32Shell_V4093_SafeNet {
    strings:
        $a = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D }
    condition:
        $a at pe.entry_point
}

rule ASProtect_V2X_DLL_Alexey_Solodovnikov_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD }
    condition:
        $a at pe.entry_point
}

rule PeX_099_bartCrackPl {
    strings:
        $a = { E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
        $b = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TPAV_Cryptor_V11_msaha_dev_SignByfly {
    strings:
        $a = { 8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D 95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ?? 70 }
    condition:
        $a at pe.entry_point
}

rule MS_HTML_Help_file {
    strings:
        $a = { 49 54 53 46 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_R_Incremental_Linker_Version_5128078_MASMTASM_additional {
    strings:
        $a = { 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v70_DLL_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule EXEStealth_v275a_WebtoolMaster {
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5 }
    condition:
        $a at pe.entry_point
}

rule APEX_C_BLT_Apex_40_500mhz_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 }
    condition:
        $a at pe.entry_point
}

rule BGI_Stroked_Font_v11_Hint_FILE_START {
    strings:
        $a = { 50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v253b3 {
    strings:
        $a = { 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point
}

rule SPEC_b3_additional {
    strings:
        $a = { 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }
    condition:
        $a at pe.entry_point
}

rule tElock_v04x_v05x_additional {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
    condition:
        $a at pe.entry_point
}

rule aPack_099_i_m_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 41 73 12 FF D5 BB 10 00 72 00 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_DEF_10 {
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
    condition:
        $a at pe.entry_point
}

rule Reg2Exe_220221_by_Jan_Vorel {
    strings:
        $a = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8 }
        $b = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASDPack_20_asd_additional {
    strings:
        $a = { 5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_13_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v22_Ian_Luck {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule PEArmor_V07X_Hying {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule JAM_v211 {
    strings:
        $a = { 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB }
    condition:
        $a at pe.entry_point
}

rule Can2Exe_v001_additional {
    strings:
        $a = { 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_V14_BG_Software_Protect_Technologies_SignByfly {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 }
    condition:
        $a at pe.entry_point
}

rule dePACK_deNULL {
    strings:
        $a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 }
        $b = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_VOB_ProtectCD_5_Anorganix {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule aPack_090_099_EXE {
    strings:
        $a = { 1E 06 8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 30 00 05 00 00 0E 50 6A 00 CB }
    condition:
        $a at pe.entry_point
}

rule ExeLock_100 {
    strings:
        $a = { 06 8C C8 8E C0 BE 17 00 26 8A 04 34 00 26 88 04 46 81 FE 0C 02 75 F1 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_03_Hint_DOS_EP {
    strings:
        $a = { 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_MFC {
    strings:
        $a = { C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Petite_22_PE_EXE {
    strings:
        $a = { B8 00 00 00 00 6A 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 70 BC 00 00 6A 00 FF 50 1C 8B CC 8D A0 70 BC 00 00 89 61 2E 68 00 00 00 00 51 8B 7C 24 04 8B 33 66 81 C7 80 07 8D 74 1E 08 89 3B 53 8B }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_Stub_c_Farb_rausch_Consumer_Consulting_ {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9 }
    condition:
        $a at pe.entry_point
}

rule WinZip_Self_Extractor_22_personal_edition_WinZip_Computing_h_additional {
    strings:
        $a = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v11_Vaska {
    strings:
        $a = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 }
        $b = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CubiComp_PictureMaker_graphics_format_blue_Hint_FILE_START {
    strings:
        $a = { 36 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v60_v70 {
    strings:
        $a = { E8 6A E8 89 05 E8 89 05 C7 05 0A B8 }
        $b = { 55 8B EC 83 C4 F0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Free_Pascal_v09910 {
    strings:
        $a = { 64 A1 55 89 E5 6A FF 68 68 9A 10 40 }
        $b = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 }
        $c = { E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_PEBundle_02_3x_emadicius_h {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V22X_V24X_StrongBit_Technology {
    strings:
        $a = { E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Packman_0001_bubba_ {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v14_additional {
    strings:
        $a = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
    condition:
        $a at pe.entry_point
}

rule PE_PACK_099 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }
    condition:
        $a at pe.entry_point
}

rule HelpCOM_12 {
    strings:
        $a = { FC BE 81 00 AC 3C 20 74 FB 3C 3F 74 1A 3C 2F 75 05 AC 3C 3F 74 11 A1 00 00 A3 00 01 A0 00 00 A2 02 01 BB 00 01 FF E3 BA 00 00 B4 09 CD 21 C3 40 65 63 68 6F 20 6F 66 66 0D 0A 69 66 20 25 31 2E 3D 3D 2E 20 67 6F 74 6F 20 65 6E 64 65 0D 0A 66 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V2xx_compressed_resources_wwwstrongbitcom {
    strings:
        $a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v100 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_V1X_Sukhov_Vladimir_Serge_N_Markin {
    strings:
        $a = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }
    condition:
        $a at pe.entry_point
}

rule IMP_Packer_10_Mahdi_Hezavehi_IMPOSTER_h_additional {
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v302_v302a_v304_Relocations_pack_Hint_DOS_EP {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V12_CGSoftLabs {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_3 {
    strings:
        $a = { E9 00 00 90 90 CD AB 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 31 39 38 35 20 42 4F 52 4C 41 4E 44 20 49 6E 63 02 04 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PECompact_14p_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule ExeBundle_v30_small_loader {
    strings:
        $a = { 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v029 {
    strings:
        $a = { ?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40 }
        $b = { BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sentinel_SuperPro_Automatic_Protection_v640_Safenet_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule NET_DLL_Microsoft {
    strings:
        $a = { 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25 }
    condition:
        $a at pe.entry_point
}

rule tElock_098_Special_Build_forgot_heXer {
    strings:
        $a = { E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA }
        $b = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_2021_protected_IAT {
    strings:
        $a = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v32_additional {
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF }
    condition:
        $a at pe.entry_point
}

rule BobSoft_Mini_Delphi_BoB_BobSoft {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 }
    condition:
        $a at pe.entry_point
}

rule IProtect_10_Fxlibdll_mode_by_FuXdas_additional {
    strings:
        $a = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF }
    condition:
        $a at pe.entry_point
}

rule PE_Protect_v09 {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3 }
        $b = { E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v096_additional {
    strings:
        $a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PE_Lock_NT_204_emadicius {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_20_Vaska_additional {
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_One_layer_encryption_MANtiCORE_additional {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch {
    strings:
        $a = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_additional {
    strings:
        $a = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CrypteXeC_v101_Hint_DOS_EP {
    strings:
        $a = { FD 25 ?? ?? E8 ?? ?? 3E BA ?? ?? EC 0C ?? 26 EE ?? B9 ?? ?? 51 51 ?? 87 C9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_ASProtect {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_04_additional {
    strings:
        $a = { BC ?? ?? C3 2E FF 2E ?? ?? CF }
    condition:
        $a at pe.entry_point
}

rule SEA_AXE_additional {
    strings:
        $a = { FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006710_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v13_v14_Vaska {
    strings:
        $a = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 }
        $b = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Component {
    strings:
        $a = { E9 ?? ?? FE FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1353_Obsidium_Software_SignByfly_20080120 {
    strings:
        $a = { EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 }
        $b = { EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPack_Mutator_11c {
    strings:
        $a = { 00 00 00 00 00 00 00 00 2E 80 00 00 00 00 00 00 00 75 F5 }
    condition:
        $a at pe.entry_point
}

rule XXPack_01_bagie_additional {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Anskya_NTPacker_Generator_Anskya_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 }
    condition:
        $a at pe.entry_point
}

rule PLINK86_1984_1985_Hint_DOS_EP {
    strings:
        $a = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v302_v302a_Extractable {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }
    condition:
        $a at pe.entry_point
}

rule FreeCryptor_01_build_001_GlOFF {
    strings:
        $a = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }
    condition:
        $a at pe.entry_point
}

rule Real_Networks_VideoAudio_file {
    strings:
        $a = { 2E 52 4D 46 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_07_Hint_DOS_EP {
    strings:
        $a = { 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v50_DLL {
    strings:
        $a = { 55 8B EC 6A FF 68 68 64 A1 ?? ?? ?? ?? }
        $b = { 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v0896_v102_v105_v122_Modified_additional {
    strings:
        $a = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_21x_dll_Alexey_Solodovnikov_h {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_500_Dll_Silicon_Realms_Toolworks {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16b_v16c_Vaska {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 }
        $b = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MEW_11_SE_v10_Northfox {
    strings:
        $a = { E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0 }
        $b = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SimplePack_V10X_bagie {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL_additional {
    strings:
        $a = { 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 }
    condition:
        $a at pe.entry_point
}

rule D1S1G_D1N {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 4? }
    condition:
        $a at pe.entry_point
}

rule Norton_Speed_Disk_Configuration_file {
    strings:
        $a = { 4E 6F 72 74 6F 6E 20 53 70 65 65 64 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102_exescrcom_Ashkbiz_Danehkar_h_additional {
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_Modified {
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB 8A 07 EB B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
        $b = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NoodleCrypt_v20 {
    strings:
        $a = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
        $b = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v107b_DLL_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 }
    condition:
        $a at pe.entry_point
}

rule UPX_v051_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_ExeSmasher {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point
}

rule Vx_Explosion1000_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }
    condition:
        $a at pe.entry_point
}

rule HPACK_Archive_Hint_FILE_START {
    strings:
        $a = { 48 50 41 4B }
    condition:
        $a at pe.entry_point
}

rule RJcrush_v100 {
    strings:
        $a = { 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ASPack_2xx_Heuristic {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
    condition:
        $a at pe.entry_point
}

rule _22b_Anti_xiaohui_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_08_Hint_DOS_EP {
    strings:
        $a = { 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v12_BG_Software_Protect_Technologies_additional {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1170_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 37 2E 30 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1802_p_Oreans_Technologies {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V19X_Jitit {
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEcrypt_by_archphase_additional {
    strings:
        $a = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2117_Strongbit_SoftComplete_Development_h_additional {
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F }
    condition:
        $a at pe.entry_point
}

rule aPack_071_074_COM {
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 9B 01 BF 00 01 50 57 FC B6 01 BD 7C 01 FF D5 73 5C FF D5 73 1C FF D5 73 3E BB 93 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 35 93 EB 37 E8 47 00 49 49 75 0A 2E 8B 1E 00 01 E8 3B 00 EB 21 49 AC }
    condition:
        $a at pe.entry_point
}

rule PKLite_113_COM {
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0D 01 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_Pro_Edition_116_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
    condition:
        $a at pe.entry_point
}

rule yodas_Crypter_13_Ashkbiz_Danehkar_additional {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_2003_EXE_Microsoft {
    strings:
        $a = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 57 }
    condition:
        $a at pe.entry_point
}

rule Vx_Ncu_Li1688 {
    strings:
        $a = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_076_Hying_CCG_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point
}

rule UPXHiT_001_dj_siba {
    strings:
        $a = { 94 BC ?? ?? 43 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_Alternative_stub {
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }
    condition:
        $a at pe.entry_point
}

rule PK_Smart_10b {
    strings:
        $a = { BA 00 00 8C C8 8B C8 03 C2 81 C1 00 00 51 B9 00 00 51 1E 8C D3 8D 6F 00 55 B1 00 51 FC 4B BE 3C 00 33 FF 8E D8 8E C3 B1 08 F3 A5 48 4A 79 EE 0E 07 8E DB 33 F6 33 FF CB }
    condition:
        $a at pe.entry_point
}

rule Crunch_4_Bit_Arts_additional {
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FreeHand_8_document {
    strings:
        $a = { 41 47 44 33 }
    condition:
        $a at pe.entry_point
}

rule Upack_021_beta_Dwing_additional {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_029_GlOFF_additional {
    strings:
        $a = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_FSG_10 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point
}

rule Protect_30 {
    strings:
        $a = { 2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E C0 FA FC 26 A1 04 00 2E A3 0A 00 26 A1 06 00 2E A3 08 00 26 A1 0C 00 2E A3 0E 00 26 A1 0E 00 2E A3 0C 00 2E A1 06 00 26 A3 06 00 26 C7 06 04 00 D4 01 26 A3 0E 00 26 C7 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1354_Obsidium_Software {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 }
    condition:
        $a at pe.entry_point
}

rule File_Analyzer_Extended_Datafile {
    strings:
        $a = { 23 03 45 58 54 44 }
    condition:
        $a at pe.entry_point
}

rule setupexe_Section24rdata {
    strings:
        $a = { 50 32 04 00 6A 32 04 00 00 00 00 00 EE 32 04 00 0C 33 04 00 2A 33 04 }
    condition:
        $a at pe.entry_point
}

rule DZA_Patcher_v13_DZA_additional {
    strings:
        $a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
    condition:
        $a at pe.entry_point
}

rule PEMangle_additional {
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_WATCOM_CCpp_EXE {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 }
    condition:
        $a at pe.entry_point
}

rule TIFF_Graphics_file_Macintosh {
    strings:
        $a = { 4D 4D 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1342_Obsidium_Softwarenbsp_nbsp_SignByfly {
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260_Beta_1_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? 68 74 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 }
    condition:
        $a at pe.entry_point
}

rule XPack_V098_LZSS_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 97 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESPin_v13_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point
}

rule Nakedbind_10_nakedcrew_additional {
    strings:
        $a = { 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC }
    condition:
        $a at pe.entry_point
}

rule Unknown_encryptor_1_additional {
    strings:
        $a = { EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF }
    condition:
        $a at pe.entry_point
}

rule MingWin32_Dev_Cpp_v4991 {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule UPX_293_300_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_42_EXE_4 {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 83 EC 6C 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v016b_v0163b {
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch_or_any_Version_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_Protected_Mode_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Armadillo_300 {
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }
    condition:
        $a at pe.entry_point
}

rule Diet_143144_EXE {
    strings:
        $a = { F9 9C EB 09 00 00 0A 00 00 00 55 F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 2E 01 06 49 00 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 66 00 AD 8B E8 B2 10 EA 00 00 00 00 64 6C 7A }
    condition:
        $a at pe.entry_point
}

rule Shrink_Wrap_v14 {
    strings:
        $a = { 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule SoftSentry_v30 {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }
    condition:
        $a at pe.entry_point
}

rule JRC_Archive {
    strings:
        $a = { 4A 52 63 68 69 76 65 }
    condition:
        $a at pe.entry_point
}

rule BamBam_v001 {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5 }
        $b = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_v42_DLL_additional {
    strings:
        $a = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v142_Pavol_Cerven_h_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V125_Obsidium_Software_additional {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v20 {
    strings:
        $a = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }
        $b = { 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Macromedia_Windows_Flash_ProjectorPlayer_v60_additional {
    strings:
        $a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_32Lite_003_Anorganix {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule DIET_v100_v100d_additional {
    strings:
        $a = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule MSLRHv031_xuecao {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 }
    condition:
        $a at pe.entry_point
}

rule Delphi_v10_Unit {
    strings:
        $a = { 44 43 55 31 }
    condition:
        $a at pe.entry_point
}

rule PowerBASICWin_70x {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v109a {
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1361_Obsidium_Software_20080521 {
    strings:
        $a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v02_yadolockless {
    strings:
        $a = { 8B 0C 24 E9 0A 7C 01 00 AD 42 40 BD BE 9D 7A 04 }
    condition:
        $a at pe.entry_point
}

rule MESS_v107_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? F3 ?? AC E3 ?? EB ?? BA ?? ?? B4 09 CD 21 CD 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 30 CD 21 3C 02 77 }
    condition:
        $a at pe.entry_point
}

rule Simple_UPX_Cryptor_v3042005_One_layer_encryption {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypter {
    strings:
        $a = { 60 E8 00 00 00 00 5D EB 26 }
    condition:
        $a at pe.entry_point
}

rule The_aPE_Inline_Patch_ExtraStealth_SuperStealth {
    strings:
        $a = { E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule Morphine_33_Holy_Father_Ratter29A {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
        $b = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Alex_Protector_10_Alex_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Pack_v099 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_V1X_cyclotron {
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule XCOM_100 {
    strings:
        $a = { 43 42 47 BA 1E 01 B8 B4 4C 87 E5 BC 15 01 EB 02 F5 EA 50 B4 09 CD 21 87 E5 33 ED E8 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_060_SLV_ICU {
    strings:
        $a = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }
    condition:
        $a at pe.entry_point
}

rule JAR_Archive_Hint_FILE_START {
    strings:
        $a = { 1A 4A 61 72 1B }
    condition:
        $a at pe.entry_point
}

rule Inno_Setup_Module_v304_betav306v307 {
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }
    condition:
        $a at pe.entry_point
}

rule Interchange_Format_File_IFF_type_WVQA_additional {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }
    condition:
        $a at pe.entry_point
}

rule Audio_CD_file_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_R_Full_text_index_file_Hint_FILE_START_p_16 {
    strings:
        $a = { 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextractable_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_3_additional {
    strings:
        $a = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2 }
    condition:
        $a at pe.entry_point
}

rule CC_261b {
    strings:
        $a = { BA 00 00 B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB B9 EB 09 B8 05 FE EB FC 80 C4 3B EB F4 8D 9D 29 01 CD 21 B0 01 CD 21 EB 02 EB FE E8 00 00 5B C6 47 06 82 B0 80 E6 21 BB 20 FF BE 50 01 8B FB B9 B6 00 F3 A4 8B C3 C1 E8 04 8C CD 03 C5 50 51 CB }
    condition:
        $a at pe.entry_point
}

rule Vx_VirusConstructorbased_Hint_DOS_EP_additional {
    strings:
        $a = { E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 }
    condition:
        $a at pe.entry_point
}

rule NSPack_Nort_Star_Software_urlwwwnsdsncom_additional {
    strings:
        $a = { 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 }
    condition:
        $a at pe.entry_point
}

rule PowerBASICCC_40 {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v020 {
    strings:
        $a = { E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 }
    condition:
        $a at pe.entry_point
}


rule nSpack_V29_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 8A 06 3C 00 74 12 8B F5 8D B5 }
    condition:
        $a at pe.entry_point
}

rule PassEXE_20 {
    strings:
        $a = { 06 1E 0E 0E 07 1F 00 00 00 B9 53 01 87 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v045_additional {
    strings:
        $a = { BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40 }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V077b_MATCODE_Software_20080313 {
    strings:
        $a = { 60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3 }
    condition:
        $a at pe.entry_point
}

rule MS_FORTRAN_Library_19_additional {
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }
    condition:
        $a at pe.entry_point
}

rule CRYPT_Version_17_c_Dismember_EXE {
    strings:
        $a = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule ESO_Eclipse_Operating_System_v208_p_DOS_Extender_additional {
    strings:
        $a = { 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9 }
    condition:
        $a at pe.entry_point
}

rule vprotector_12_vcasm_additional {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v70_64_Bit {
    strings:
        $a = { 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule yodas_Protector_V10b_Ashkbiz_Danehkar_Sign_by_fly {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule tElock_v092a {
    strings:
        $a = { E9 D5 E4 FF }
        $b = { E9 7E E9 FF FF 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE_v10_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1 }
    condition:
        $a at pe.entry_point
}

rule Themida_18xx_Oreans_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 }
    condition:
        $a at pe.entry_point
}

rule Visual_C_20 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 00 01 68 00 00 00 01 50 64 89 25 00 00 00 00 83 EC 00 53 56 57 89 65 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 A3 00 00 00 01 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V10beta_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule PEtite_vxx_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_42_EXE_1 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 00 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 00 FF 15 00 00 00 00 83 C4 04 C7 05 00 00 00 00 FF FF FF FF A1 00 00 00 00 A3 00 00 00 00 FF 15 00 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_42_EXE_2 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 00 00 00 00 A3 00 00 00 00 33 C0 A0 00 00 00 00 A3 00 00 00 00 A1 00 00 00 00 C1 2D 00 00 00 00 10 25 FF 00 00 00 A3 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_42_EXE_3 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 41 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 FF 15 00 00 41 00 33 D2 8B C8 8A D4 81 E1 FF 00 00 00 C1 E8 10 89 15 00 00 41 00 89 0D 00 00 41 00 A3 00 00 41 00 C1 E1 08 03 }
    condition:
        $a at pe.entry_point
}

rule SOFTWrapper_for_Win9xNT_Evaluation_Version_additional {
    strings:
        $a = { E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF }
    condition:
        $a at pe.entry_point
}

rule LZEXE_v091_v100a_1_Hint_DOS_EP {
    strings:
        $a = { 06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7 }
    condition:
        $a at pe.entry_point
}

rule Upack_v028_039_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_DLL {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60 {
    strings:
        $a = { 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule aPack_v062 {
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }
    condition:
        $a at pe.entry_point
}

rule FreeBasic_014_ {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 }
    condition:
        $a at pe.entry_point
}

rule UPX_v103_v104 {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }
        $b = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Mew_501_NorthFox_HCC_additional {
    strings:
        $a = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2547_V2600_Jitit_Sign_by_fly {
    strings:
        $a = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule Winkript_v10_additional {
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 }
    condition:
        $a at pe.entry_point
}

rule Crunch_v5_Bit_Arts {
    strings:
        $a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
        $b = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_REALBasic_Anorganix_additional {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule PolyBox_D_Anskya {
    strings:
        $a = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }
    condition:
        $a at pe.entry_point
}

rule Nakedbind_10_nakedcrew {
    strings:
        $a = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_V05_Smoke {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_110_beta_8 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 9A 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 92 70 40 00 BB 14 08 00 00 03 9D 9E 70 40 00 03 9D 9A 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_5 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 49 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_4 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 44 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_7 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB 14 08 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_6 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB B7 07 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_1 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 00 87 DD 8B 85 AD 63 40 00 01 85 1C 63 40 00 66 C7 85 19 63 40 00 90 90 BB D6 0A 00 00 03 9D B1 63 40 00 03 9D AD 63 40 00 53 53 53 58 2D 83 }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_3 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 95 0A 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point
}

rule PECompact_110_beta_2 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 94 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 7F 0A 00 00 03 9D 98 60 40 00 03 9D 94 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point
}

rule eXPressor_1451_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
        $b = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Software_Compress_BG_Software {
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        $a at pe.entry_point
}

rule Gardian_Angel_10_Hint_DOS_EP {
    strings:
        $a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V18X_V19X_SetiSoft_Team_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule NsPack_23_Liu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_ASProtect_Anorganix {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Pasword_Protector_v101_Eng_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_C_Library_1985_additional {
    strings:
        $a = { BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_DLL_compressed_resources_wwwstrongbitcom {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 }
    condition:
        $a at pe.entry_point
}

rule PLINK86_1984_1985_additional {
    strings:
        $a = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM {
    strings:
        $a = { E8 ?? ?? CD 20 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v11_Vaska_additional {
    strings:
        $a = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_MASM32_TASM32_additional {
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
    condition:
        $a at pe.entry_point
}

rule UPX_071_072_EXE {
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 09 00 02 07 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1530 {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_Basic_NET_additional {
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }
    condition:
        $a at pe.entry_point
}

rule Shegerd_Dongle_V478_MSCo {
    strings:
        $a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V12X_Obsidium_Software {
    strings:
        $a = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point
}

rule LSI_C_86_Run_Time_Libray {
    strings:
        $a = { B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule Unknown_Protected_Mode_compiler_1_Hint_DOS_EP {
    strings:
        $a = { FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1 }
    condition:
        $a at pe.entry_point
}

rule SDProtect_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule LamerStop_v10c_c_Stefan_Esser {
    strings:
        $a = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_14_additional {
    strings:
        $a = { 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v150_Device_driver_compression_additional {
    strings:
        $a = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }
    condition:
        $a at pe.entry_point
}

rule PE_Pack_v10_additional {
    strings:
        $a = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }
    condition:
        $a at pe.entry_point
}

rule ChinaProtect_dummy {
    strings:
        $a = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }
        $b = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v211_additional {
    strings:
        $a = { 60 E8 F9 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule Cracked_by_AutoHack_1_additional {
    strings:
        $a = { FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v12_CGSoftLabs_additional {
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_1x_Nooby {
    strings:
        $a = { ?? 18 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E }
    condition:
        $a at pe.entry_point
}

rule UPX_Inliner_10_by_GPcH {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V220090726_WFS_20090822 {
    strings:
        $a = { 6A ?? 60 E9 01 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 58 8B 44 24 F8 E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_MASM32_TASM32 {
    strings:
        $a = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }
        $b = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule E_language_additional {
    strings:
        $a = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1332_Obsidium_Software {
    strings:
        $a = { EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00 }
        $b = { EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MPEG_Video_file_2_Hint_FILE_START {
    strings:
        $a = { 00 00 01 B3 }
    condition:
        $a at pe.entry_point
}

rule DJoin_v07_public_RC4_encryption_drmist {
    strings:
        $a = { C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PC_Guard_4xx_emadicius {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2422_V2428_Jitit_Sign_by_fly_additional {
    strings:
        $a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point
}

rule EP_ExE_Pack_V10_Elite_Coding_Group {
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Neolite_20_Anorganix {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Packed_additional {
    strings:
        $a = { BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB }
    condition:
        $a at pe.entry_point
}

rule Spalsher_10_30_Amok {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC }
        $b = { 9C 60 8B 44 24 24 E8 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vprotect_V1XX_16X_CoooLie {
    strings:
        $a = { 8B 5F 10 83 6F 10 04 83 EB 04 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 C7 47 4C 00 00 00 00 8B 7F 1C C3 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_exe_additional {
    strings:
        $a = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }
    condition:
        $a at pe.entry_point
}

rule XCF_File_Format_by_Adeline_Software_Hint_FILE_START {
    strings:
        $a = { 46 72 61 6D 65 4C 65 6E F4 0F }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp {
    strings:
        $a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
        $b = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Immun_12_COM {
    strings:
        $a = { 50 53 51 52 56 57 1E 06 E8 00 00 5E 81 EE A4 09 2E 89 36 00 01 8B FE 81 C7 97 09 2E 8B 1D 2B FB 83 C7 02 81 EF 00 01 8B EF B4 30 CD 21 2E 88 85 63 01 3C 03 72 50 8E 1E 2C 00 8C C8 8E C0 8B EF 2E 8B 3E 00 01 81 C7 75 0D 33 F6 B9 00 20 FC AC }
    condition:
        $a at pe.entry_point
}

rule EXE_Packer_v70_by_TurboPower_Software {
    strings:
        $a = { 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE }
    condition:
        $a at pe.entry_point
}

rule Obsidium_vxxxx_additional {
    strings:
        $a = { E8 47 19 }
    condition:
        $a at pe.entry_point
}

rule MASM_TASM {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_30_by_North_Star_Liu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Code_Lock {
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }
    condition:
        $a at pe.entry_point
}

rule tElock_099_tE {
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 }
    condition:
        $a at pe.entry_point
}

rule NsPack_V14_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule Berio_200_beta_h {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01 }
    condition:
        $a at pe.entry_point
}

rule Powerbasic_210 {
    strings:
        $a = { 2E 8C 1E 3E 00 2E C7 06 3C 00 00 00 E8 00 04 E8 00 00 E8 00 0A B8 FF FF 2E F7 06 4A 00 40 00 75 02 32 E4 50 E8 00 0B E8 10 00 58 E8 00 0B 2E 8E 1E 00 28 A1 02 00 B4 4C CD 21 E8 00 00 E8 00 01 72 00 E8 00 02 E8 00 02 E8 00 0E E8 00 16 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V112_V114_LZMA_430_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60 }
    condition:
        $a at pe.entry_point
}

rule LZEXE_091_100 {
    strings:
        $a = { 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 FD F3 A4 53 B8 00 00 50 CB 2E 8B 2E 08 00 00 DA 89 E8 3D 00 10 76 03 B8 00 10 29 C5 29 C2 29 C3 8E DA 8E C3 B1 03 D3 E0 89 C1 00 00 48 48 8B F0 8B F8 F3 A5 09 ED 75 D8 FC 8E C2 8E }
    condition:
        $a at pe.entry_point
}

rule PeCompact_253_DLL_Slim_Loader_BitSum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v12x {
    strings:
        $a = { 55 8B EC 83 EC 64 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E }
    condition:
        $a at pe.entry_point
}

rule TPPpack_clane {
    strings:
        $a = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V1451_CGSoftLabs_SignByfly {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14 }
        $b = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14 89 4D ?? E9 ?? ?? ?? ?? C7 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Packanoid_v1_Arkanoid {
    strings:
        $a = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }
    condition:
        $a at pe.entry_point
}

rule eXPressorProtection_V150X_CGSoftLabs {
    strings:
        $a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB }
    condition:
        $a at pe.entry_point
}

rule y0das_Cryptor_12_y0da {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_UPX_06_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v0164_additional {
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_226_minimum_protection_wwwstrongbitcom {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v122 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v125 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v60_SPx {
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 6A 01 8B F0 FF }
        $b = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule yC_v13_by_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
        $b = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v100 {
    strings:
        $a = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 ?? ?? ?? ?? 5E 83 C6 50 8B FE 68 78 01 59 EB 01 EB AC 54 E8 03 5C EB }
        $b = { E9 E5 E2 FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_0991_0993_PE_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 00 00 00 00 60 BE B0 00 00 00 8D BE 50 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_DLL {
    strings:
        $a = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
        $b = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_JDPack_1x_JDProtect_09_Anorganix {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_3X_5X_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }
    condition:
        $a at pe.entry_point
}

rule UPXLock_v10_CyberDoom_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_50_KOLMCK {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 }
        $b = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASProtect_123_RC4_build_0807_dll_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_for_Win32_1994_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PE_Protect_09_Anorganix {
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
    condition:
        $a at pe.entry_point
}

rule Vx_Compiler_Hint_DOS_EP {
    strings:
        $a = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10802_Hint_WIN_EP_additional {
    strings:
        $a = { 90 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_v200 {
    strings:
        $a = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_23_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C }
    condition:
        $a at pe.entry_point
}

rule FMC_Faust_Module_music_file_Hint_FILE_START {
    strings:
        $a = { 46 4D 43 21 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V10_cyberbobnbsp_nbsp_SignByfly_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3 }
    condition:
        $a at pe.entry_point
}

rule kryptor_3 {
    strings:
        $a = { E8 03 E9 EB 6C 58 40 FF }
        $b = { EB 66 87 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule kryptor_6 {
    strings:
        $a = { E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }
    condition:
        $a at pe.entry_point
}

rule kryptor_5 {
    strings:
        $a = { E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0 }
    condition:
        $a at pe.entry_point
}

rule kryptor_9 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
    condition:
        $a at pe.entry_point
}

rule kryptor_8 {
    strings:
        $a = { 60 E8 5E B9 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 66 }
        $b = { EB 6A 87 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_212withouth_Poly_Solodovnikov_Alexey {
    strings:
        $a = { ?? E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_for_Windows_1 {
    strings:
        $a = { 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_for_Windows_2 {
    strings:
        $a = { 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM_ {
    strings:
        $a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_v206 {
    strings:
        $a = { 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_v11_SLV_h_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule VMProtect_07x_08_PolyTech {
    strings:
        $a = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v030_beta_By_Dwing_ {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1028_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
    condition:
        $a at pe.entry_point
}

rule LHICE_SFX_Archive_v113_v117_Hint_DOS_EP {
    strings:
        $a = { EB ?? FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 2E ?? ?? ?? ?? 8E D8 8E C0 05 ?? ?? 2E ?? ?? ?? ?? 76 ?? BB }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_V1XXX_Nooby_20090201 {
    strings:
        $a = { 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E ?? 00 }
    condition:
        $a at pe.entry_point
}

rule InstallShield_Cabinet_Archive {
    strings:
        $a = { 49 53 63 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Method_1_additional {
    strings:
        $a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_LZMA_430_ap0x_SignByfly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_TravJack883_Hint_DOS_EP {
    strings:
        $a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_CrunchPE_Heuristic_Anorganix {
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule CPAV_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 }
    condition:
        $a at pe.entry_point
}

rule PE_Spin_v0b {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v10803_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
    condition:
        $a at pe.entry_point
}

rule Adobe_PDF_Portable_document_Version_v3v4 {
    strings:
        $a = { 25 50 44 46 2D ?? 2E }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v119_additional {
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v112_v115_v120_2_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 3B C4 73 }
    condition:
        $a at pe.entry_point
}

rule Upack_V01X_V02X_Dwing {
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
        $b = { BE 88 01 ?? ?? AD 8B F8 95 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PeCompact2_253_276_Slim_Loader_BitSum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional {
    strings:
        $a = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F }
    condition:
        $a at pe.entry_point
}

rule A3E_TXT2COM_Hint_DOS_EP {
    strings:
        $a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }
    condition:
        $a at pe.entry_point
}

rule May_be_Pklite_Header_Version_v6v2_extra_0_v5_1_Hint_HDR_END {
    strings:
        $a = { 50 4B }
    condition:
        $a at pe.entry_point
}

rule SQZ_Archive_Hint_FILE_START {
    strings:
        $a = { 48 4C 53 51 5A }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_additional {
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_111_Method_2NT_bagieTMX_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_v131_Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _028_beta_shoooo {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_WATCOM_CCpp_EXE_Anorganix {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 E9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_LTC_13_Anorganix_additional {
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
    condition:
        $a at pe.entry_point
}

rule XM_music_file {
    strings:
        $a = { 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A }
    condition:
        $a at pe.entry_point
}

rule Zurenava_DOS_Extender_v045_v049 {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }
    condition:
        $a at pe.entry_point
}

rule ZipWorxSecureEXE_v25_ZipWORX_Technologies_LLC {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }
    condition:
        $a at pe.entry_point
}

rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_oep {
    strings:
        $a = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0977_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }
    condition:
        $a at pe.entry_point
}

rule FreeBasic_014_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }
    condition:
        $a at pe.entry_point
}

rule nPack_v11xxx_NEOx_additional {
    strings:
        $a = { 83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_V27X_WebtoolMaster_20080109 {
    strings:
        $a = { EB 65 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? 04 ?? ?? 01 EB 05 ?? ?? ?? ?? ?? EB 00 EB 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v098b2_additional {
    strings:
        $a = { E9 1B E4 FF FF }
    condition:
        $a at pe.entry_point
}

rule ASPack_v212_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v104b {
    strings:
        $a = { 75 ?? }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_C_Basic_NET_ {
    strings:
        $a = { EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PE_Lock_NT_204_emadicius_h {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Bitlock_31_Hint_DOS_EP {
    strings:
        $a = { EB ?? B4 30 CD 21 3C 03 72 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Method_4_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 8B CD 83 ?? ?? BF ?? ?? BE ?? ?? 2B CF F3 A4 B9 ?? ?? BE }
    condition:
        $a at pe.entry_point
}

rule nSpack_V13_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_Run_Time_systempDOS4GW_DOS_Extender_1988_93 {
    strings:
        $a = { BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v120_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CAN2EXE_v001 {
    strings:
        $a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V10X_bagie_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v02_v20x {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v111c {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }
    condition:
        $a at pe.entry_point
}

rule MEW_10_by_Northfox_additional {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }
    condition:
        $a at pe.entry_point
}

rule ProPack_214_m1_EXE {
    strings:
        $a = { 0E 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 35 00 50 8B 2E 0A 00 03 16 0C 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D8 2B D0 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 07 }
    condition:
        $a at pe.entry_point
}

rule WordPerfect_Graphics_format {
    strings:
        $a = { FF 57 50 43 10 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encrypter_10 {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 63 3A 40 00 2B 95 C2 3A 40 00 83 EA 0B 89 95 CB 3A 40 00 8D B5 CA 3A 40 00 0F B6 36 8B FD 8D 9D CB 3A 40 00 8B 1B 8D 87 CF 3A 40 00 8B 00 03 D8 8D 8F D3 3A 40 00 8B 09 80 2B 01 43 E2 FA 83 C7 }
    condition:
        $a at pe.entry_point
}

rule Watcom_C_1994 {
    strings:
        $a = { FB B9 00 0B 8E C1 26 BB 00 09 83 C3 0F 80 E3 F0 26 89 1E 00 03 26 8C 1E 00 03 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 03 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 03 00 75 3F 8B 0E 02 00 8C C0 29 C1 39 CA 72 0D BB 01 00 B8 00 00 8C }
    condition:
        $a at pe.entry_point
}

rule Watcom_C_1995 {
    strings:
        $a = { FB B9 00 00 8E C1 26 BB 00 00 83 C3 0F 80 E3 F0 26 89 1E 00 00 26 8C 1E 00 00 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 00 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 00 00 75 3D 8B 0E 02 00 8C C0 29 C1 39 CA 72 0B BB 01 00 B8 00 00 8C }
    condition:
        $a at pe.entry_point
}

rule bambam_V001_bedrock_additional {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_21Beta_211_p0ke_additional {
    strings:
        $a = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }
    condition:
        $a at pe.entry_point
}

rule KBys_Packer_028_Beta_Shoooo_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }
    condition:
        $a at pe.entry_point
}

rule ResCrypt_v102 {
    strings:
        $a = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 }
    condition:
        $a at pe.entry_point
}

rule Vx_Horse1776_additional {
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }
    condition:
        $a at pe.entry_point
}

rule AntiVirus_Vaccine_v103_additional {
    strings:
        $a = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_h3_additional {
    strings:
        $a = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule Open_Source_Code_Crypter_p0ke {
    strings:
        $a = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00 }
        $b = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule JPEG_GIF_library_file_Hint_FILE_START {
    strings:
        $a = { 00 05 16 07 00 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Profiler_Areas_file {
    strings:
        $a = { 54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v120_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule Turbo_or_Borland_Pascal_v70_Hint_DOS_EP {
    strings:
        $a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_ExeSmasher_Anorganix_additional {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_v70_Basic_NET {
    strings:
        $a = { 53 55 56 8B 74 24 14 85 F6 57 B8 }
        $b = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NET_executable_additional {
    strings:
        $a = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }
    condition:
        $a at pe.entry_point
}

rule Windows_Animation_format_additional {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54 }
    condition:
        $a at pe.entry_point
}

rule XComp_V097_LZSS_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 97 03 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 }
    condition:
        $a at pe.entry_point
}

rule Aase_Crypter_by_santasdad {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF }
        $b = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_1200_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 3F 1E 00 00 }
    condition:
        $a at pe.entry_point
}

rule Trainer_Creation_Kit_v5_Trainer {
    strings:
        $a = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }
        $b = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_bartxt_Watcom_CCpp_EXE_additional {
    strings:
        $a = { EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_32Lite_003 {
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190b2 {
    strings:
        $a = { 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule WarWind_Save_file_Hint_FILE_START {
    strings:
        $a = { 57 41 52 53 41 56 }
    condition:
        $a at pe.entry_point
}

rule NeoLite_v10 {
    strings:
        $a = { 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_PE_Lock_NT_204_emadicius_additional {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point
}

rule UltraPro_V10_SafeNet_additional {
    strings:
        $a = { A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v13beta2_Cyberbob_ {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        $a at pe.entry_point
}

rule ASPack_v105b {
    strings:
        $a = { 90 75 ?? }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CryptCom_v11_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Lotus_Graphics_format {
    strings:
        $a = { 01 00 00 00 01 00 08 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressorFullSupport_V1601_CGSoftLabs_20080308 {
    strings:
        $a = { 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00 }
    condition:
        $a at pe.entry_point
}

rule mPACK_v002_DeltaAziz {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD }
    condition:
        $a at pe.entry_point
}

rule Vx_MTE_non_encrypted_additional {
    strings:
        $a = { F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 }
    condition:
        $a at pe.entry_point
}

rule CI_Crypt_V02_FearlesS_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
    condition:
        $a at pe.entry_point
}

rule ExeSmasher {
    strings:
        $a = { 9C FE 03 00 60 BE 00 00 41 00 8D BE 00 10 FF FF 57 83 CD FF EB 10 }
    condition:
        $a at pe.entry_point
}

rule Scrypt_12 {
    strings:
        $a = { BB 00 FE 00 1F 4B EB FB 26 46 FD CE 7E 0C CE 0A D5 D0 97 3B D2 89 EF 50 C0 B3 84 4E 8E CD CA 9D 63 B0 FE C3 5D 9C A3 98 A6 F0 8E 23 BA 71 D7 7E BC B5 B4 06 B2 3F 72 3B 76 D3 4F B1 AA CF 4B B5 A6 CB 6B A9 A6 A1 79 A0 C4 64 A2 A7 9A C6 99 52 }
    condition:
        $a at pe.entry_point
}

rule MPEG_Layer_IIIII_music_file_Hint_FILE_START {
    strings:
        $a = { FF E3 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20b2_v20b3 {
    strings:
        $a = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 }
    condition:
        $a at pe.entry_point
}

rule AZProtect_0x0001_AlexZ_aka_AZCRC {
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 }
    condition:
        $a at pe.entry_point
}

rule pex_V099_params {
    strings:
        $a = { E9 F5 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt32_Console_v10_v101_v102_additional {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_180 {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 00 53 56 57 89 65 E8 FF 15 00 00 40 00 33 D2 8A D4 89 15 00 00 40 00 8B C8 81 E1 FF 00 00 00 89 0D 00 00 40 00 C1 E1 08 03 CA 89 0D 00 00 40 00 C1 }
    condition:
        $a at pe.entry_point
}

rule Vx_VCL_encrypted_Hint_DOS_EP {
    strings:
        $a = { 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v111c_additional {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }
    condition:
        $a at pe.entry_point
}

rule setupexe_Section34data {
    strings:
        $a = { 80 16 42 00 48 05 44 00 00 00 00 00 2E 3F 41 56 5F 63 6F 6D 5F 65 72 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_22x_SoftComplete_Developement {
    strings:
        $a = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF }
        $b = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_TrojanTelefoon_additional {
    strings:
        $a = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie2100_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC }
    condition:
        $a at pe.entry_point
}

rule Symantec_C_v210_v400_or_Zortech_C_v30r1_additional {
    strings:
        $a = { FA FC B8 ?? ?? 8E D8 }
    condition:
        $a at pe.entry_point
}

rule muckis_protector_I_mucki {
    strings:
        $a = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v123b3_v1241_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PEtite_2x_level_0_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }
    condition:
        $a at pe.entry_point
}

rule Minke_V101_Codius_Sign_by_fly_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 }
    condition:
        $a at pe.entry_point
}

rule VProtector_vcasm {
    strings:
        $a = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C }
        $b = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 }
        $c = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_122_Markus_Laszlo {
    strings:
        $a = { 31 2E 32 32 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V115_V117_Dll_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1333_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule KByS_V028_shoooo_Sign_by_fly {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 }
    condition:
        $a at pe.entry_point
}

rule yzpack_V20_UsAr {
    strings:
        $a = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28 }
        $b = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PE_Spin_v0b_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        $a at pe.entry_point
}

rule ACE_Archive {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A }
        $b = { 2A 2A 41 43 45 2A 2A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_JDPack_1x_JDProtect_09_Anorganix {
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
    condition:
        $a at pe.entry_point
}

rule Petite_14_c1998_99_Ian_Luck {
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
        $b = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_20 {
    strings:
        $a = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_exe_Hint_HDR_FILESIZE_16 {
    strings:
        $a = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }
    condition:
        $a at pe.entry_point
}

rule nSPack_2x3x_NET_North_StarLiu_Xing_Ping_additional {
    strings:
        $a = { FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_LZBRS {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
        $b = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule BeRoEXEPacker_v100_LZBRR {
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_SVKP_111_emadicius {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v114_v115_v120_3 {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }
    condition:
        $a at pe.entry_point
}

rule XCR_v013 {
    strings:
        $a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_Ryd {
    strings:
        $a = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }
    condition:
        $a at pe.entry_point
}

rule XCR_v011 {
    strings:
        $a = { 60 9C E8 8B DD 5D 81 ED 89 }
        $b = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sharp_GPB_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule nPack_V111502006Beta_NEOxuinC_additional {
    strings:
        $a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_PiMP_Install_System {
    strings:
        $a = { 83 EC ?? 53 55 56 }
    condition:
        $a at pe.entry_point
}

rule Vx_ARCV4_additional {
    strings:
        $a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }
    condition:
        $a at pe.entry_point
}

rule UPX_SCRAMBLER_306_OnToL {
    strings:
        $a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
    condition:
        $a at pe.entry_point
}

rule Petite_v21_2_Hint_WIN_EP {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule AutoDesk_Animation_file_additional {
    strings:
        $a = { 00 12 AF ?? ?? 40 01 C8 }
    condition:
        $a at pe.entry_point
}

rule PocketPC_SHA {
    strings:
        $a = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_ASPack_211d_emadicius_additional {
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 }
    condition:
        $a at pe.entry_point
}

rule Warning_may_be_RCryptor_by_Vaska_unknown_ver_21032006_2317 {
    strings:
        $a = { EB F3 E8 00 00 00 00 C3 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_LCC_Win32_DLL {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        $a at pe.entry_point
}

rule Vx_Explosion1000 {
    strings:
        $a = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_Dll_mainCRTStartup_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Warning_may_be_RCryptor_by_Vaska_unknown_ver_21032006_2318 {
    strings:
        $a = { C0 14 13 74 06 80 30 }
    condition:
        $a at pe.entry_point
}

rule PCrypt_v351_additional {
    strings:
        $a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_100 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 00 87 DD 8B 85 49 85 40 00 01 85 B8 84 40 00 66 C7 85 B5 84 40 00 90 90 BB AB 0A 00 00 03 9D 4D 85 40 00 03 9D 49 85 40 00 53 53 53 58 2D 1F }
    condition:
        $a at pe.entry_point
}

rule ST_Protector_V15_Silent_Software {
    strings:
        $a = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }
        $b = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HQR_data_file {
    strings:
        $a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_vxx_Component {
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 E8 E8 8D }
        $b = { C3 E9 ?? ?? ?? FF 8D 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_Gleam_100_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
    condition:
        $a at pe.entry_point
}

rule MoleBox_v20 {
    strings:
        $a = { E8 ?? ?? ?? ?? 60 E8 4F }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_273_additional {
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule ZipWorxSecureEXE_25_ZipWORX_Technologies_LLC_h {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }
    condition:
        $a at pe.entry_point
}

rule N_Joy_11_NEX {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule R_CRYPT_v091_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 68 ?? ?? 60 BF ?? ?? B9 ?? ?? B0 ?? 2E ?? ?? FE C0 47 E2 ?? 61 C7 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v146_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 }
    condition:
        $a at pe.entry_point
}

rule Vx_Hafen1641_additional {
    strings:
        $a = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Video_Lan_Client {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule UPX_082_083_COM {
    strings:
        $a = { 81 FC 00 00 77 02 CD 20 B9 00 00 BE 00 00 BF 00 00 BB 00 80 FD F3 A4 FC 87 F7 83 EE C6 19 ED 57 57 E9 00 00 55 50 58 21 0A 01 04 07 00 00 00 00 00 00 00 00 00 00 00 00 06 00 FF FF }
    condition:
        $a at pe.entry_point
}

rule Armadillo_285_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 68 ?? ?? 00 68 00 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 }
    condition:
        $a at pe.entry_point
}

rule HackStop_118_EXE {
    strings:
        $a = { 52 BA EB 04 5A EB FB 9A 1E 52 B8 42 30 CD 21 86 C4 3D FD 02 73 02 CD 20 0E 1F 52 BA EB 04 5A EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F 52 BA EB 04 5A EB FB 9A B0 AD E6 64 52 BA EB 04 5A EB FB 9A FA CD }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v111 {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v31_North_Star_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Shortcut_file_additional {
    strings:
        $a = { 4C 00 00 00 01 14 02 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule D1S1G_v11_beta_D1N_additional {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_21x_dll_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Trap_113_EXE {
    strings:
        $a = { 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA EB 05 90 20 73 6B 00 BA 16 01 B4 4E CD 21 B9 E8 03 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 66 83 C1 FE 83 C2 01 EB ED 54 20 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v27_Holy_Father_Ratter29A {
    strings:
        $a = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $c = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RCryptor_v16x_Vaska {
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_12Demo_SIS_Team {
    strings:
        $a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B }
    condition:
        $a at pe.entry_point
}

rule IcebergLock_Protector_V310136_Iceberg_Software_Lab_200800217 {
    strings:
        $a = { E8 D7 FF FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 00 00 72 F9 C3 8D 40 00 55 8B EC 33 C0 55 ?? ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 5A 59 59 64 89 10 ?? ?? ?? ?? ?? C3 E9 50 CD FD FF EB F8 5D C3 1E 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 8B EC 83 ?? ?? B8 ?? ?? ?? ?? E8 B8 EF FD FF E8 2F DF FF FF B8 ?? ?? ?? ?? E8 71 FE FF FF E8 18 D1 FD FF }
    condition:
        $a at pe.entry_point
}

rule LamerStop_10 {
    strings:
        $a = { E8 9D 01 05 B4 30 CD 21 33 C0 8E C0 26 A1 04 00 2E A3 79 01 26 A1 06 00 2E A3 77 01 BA 3F 01 FA 26 89 16 04 00 26 8C 0E 06 00 8B EC 9C 80 76 FF 01 9D 90 D1 89 00 84 36 90 5C FF 84 3B 90 E1 D8 84 14 90 29 84 06 90 E3 C8 84 18 90 8D 02 84 F7 }
    condition:
        $a at pe.entry_point
}

rule DOS4GW_Extender_by_Tenberry_Software {
    strings:
        $a = { BF 00 00 8E D7 81 C4 0E 12 BE BD 01 2B F7 8B C6 B1 04 D3 E0 48 36 A3 E6 0C 36 89 26 DC 0C BE 23 0F 46 89 36 02 00 8C C3 2B DE F7 DB B4 4A CD 21 36 8C 1E EC 0C 16 07 FC BF 86 11 B9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80 {
    strings:
        $a = { 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF }
        $b = { 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF ?? ?? ?? ?? 3B C7 59 73 0F 8B 06 85 C0 74 02 FF D0 83 C6 04 3B F7 72 F1 }
        $c = { 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MSLRH_v032a_fake_PEBundle_20x_24x_emadicius_h {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule ASPack_v108 {
    strings:
        $a = { 90 90 75 01 FF }
        $b = { 90 75 01 FF E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HASP_HL_Protection_V1X_Aladdin_Sign_by_fly {
    strings:
        $a = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v160_v165 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_C_Basic_NET {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
        $b = { EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_C_1987 {
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
        $b = { FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_C_1988 {
    strings:
        $a = { 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v20xx {
    strings:
        $a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_Keys_ShellClient_Library_V1200_SafeNet_Inc_20090524 {
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 56 85 C0 57 0F 85 A9 18 00 00 A1 ?? ?? ?? ?? 33 FF BE 01 00 00 00 3B C7 89 35 ?? ?? ?? ?? 0F 85 6A 07 00 00 75 03 74 01 ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 81 7C 24 3C 7C 03 7D 01 E8 2C FB FF FF 7E 03 7F 01 ?? 89 ?? ?? ?? ?? ?? 72 03 73 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 7C 24 28 75 03 74 01 A1 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 A3 ?? ?? ?? ?? 7C 03 7D 01 ?? ?? ?? ?? ?? ?? ?? 74 17 75 03 74 01 7A 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B C1 A3 ?? ?? ?? ?? 75 03 74 01 5E FF 15 }
    condition:
        $a at pe.entry_point
}

rule Hasp_dongle_Alladin_additional {
    strings:
        $a = { 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }
    condition:
        $a at pe.entry_point
}

rule EXE_additional {
    strings:
        $a = { 55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V2223_protected_IAT_wwwstrongbitcom {
    strings:
        $a = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 }
    condition:
        $a at pe.entry_point
}

rule ZCode_Win32PE_Protector_v101_additional {
    strings:
        $a = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v3xx_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule PESpin_v10_Cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 }
    condition:
        $a at pe.entry_point
}

rule muckis_protector_II_mucki_additional {
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V071_cyberbob_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 }
    condition:
        $a at pe.entry_point
}

rule LY_WGKX_wwwszleyucom_ {
    strings:
        $a = { 4D 79 46 75 6E 00 62 73 }
    condition:
        $a at pe.entry_point
}

rule Vx_Necropolis {
    strings:
        $a = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }
    condition:
        $a at pe.entry_point
}

rule Soft_Defender_v10_v11 {
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_13_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v12_DLL_additional {
    strings:
        $a = { 00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_ {
    strings:
        $a = { 6A ?? FF 15 ?? 20 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 90 90 ?? EC }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_SE_Public_V1140_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 34 2E 30 }
    condition:
        $a at pe.entry_point
}

rule Upack_v028_039_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing_h {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C }
    condition:
        $a at pe.entry_point
}

rule File_Analyser_14_Encryptor {
    strings:
        $a = { B9 00 00 B3 00 33 D2 BE 00 00 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule Encapsulated_Postscript_graphics_file_v30_EPSF_30 {
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30 }
    condition:
        $a at pe.entry_point
}

rule PEQuake_006_by_fORGAT {
    strings:
        $a = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_for_Windows_1_additional {
    strings:
        $a = { 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule Gleam_v100_additional {
    strings:
        $a = { 00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}


rule KByS_V022_shoooo {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Goats_PE_Mutilator_16_additional {
    strings:
        $a = { E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Pe123_v200644 {
    strings:
        $a = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }
        $b = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule APEX_C_BLT_Apex_40_500mhz {
    strings:
        $a = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 }
    condition:
        $a at pe.entry_point
}

rule Stony_Brook_Pascalp_v70_additional {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC }
    condition:
        $a at pe.entry_point
}

rule bambam_004_bedrock {
    strings:
        $a = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Danish_tiny {
    strings:
        $a = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule HPACK_Archive {
    strings:
        $a = { 48 50 41 4B }
    condition:
        $a at pe.entry_point
}

rule PEBundle_v20b5_v23_additional {
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD }
    condition:
        $a at pe.entry_point
}

rule tELock_042 {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_ASPack_212_emadicius_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule CipherWall_Self_ExtratorDecryptor_GUI_15 {
    strings:
        $a = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
    condition:
        $a at pe.entry_point
}

rule Installer_VISE_Custom {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D }
    condition:
        $a at pe.entry_point
}

rule EEXE_Version_112_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }
    condition:
        $a at pe.entry_point
}

rule KenPack_V02_CHKenCom_20080319 {
    strings:
        $a = { 6A 18 E8 14 00 00 00 58 8D 4A 18 51 8D 92 ?? ?? ?? ?? 64 8B 08 FF 31 89 21 89 10 5A FF E2 72 8B 44 24 0C 8B ?? A8 00 00 00 8D 8A ?? ?? ?? ?? 60 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_033_GlOFF_additional {
    strings:
        $a = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_WWPack32_1x_emadicius {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_023_GlOFF_additional {
    strings:
        $a = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF }
    condition:
        $a at pe.entry_point
}

rule VcAsm_Protector_V10X_VcAsm {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v024_v028alpha_Sign_by_hot_UNP_additional {
    strings:
        $a = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }
    condition:
        $a at pe.entry_point
}

rule UPX_290_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V14X_risco_ {
    strings:
        $a = { 60 E8 01 00 00 00 7C 83 04 24 06 C3 }
    condition:
        $a at pe.entry_point
}

rule SkD_Undetectabler_Pro_20_No_UPX_Method_SkD_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD }
    condition:
        $a at pe.entry_point
}

rule North_Star_PE_Shrinker_13_by_Liuxingping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_v03_FEUERRADER_additional {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Shrink_Wrap_v14_additional {
    strings:
        $a = { 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_01_015_NTkrnl_Software {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MingWin32_v {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55 }
    condition:
        $a at pe.entry_point
}

rule RLPack_120_Basic_Edition_aPLib_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v024_v028alpha_Sign_by_hot_UNP {
    strings:
        $a = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_20 {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_20_p0ke {
    strings:
        $a = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }
        $b = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXE32Pack_v13x_additional {
    strings:
        $a = { 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73 }
    condition:
        $a at pe.entry_point
}

rule diPacker_1x_diProtector_Software_additional {
    strings:
        $a = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }
    condition:
        $a at pe.entry_point
}

rule RLPack_116_LZMA_compression_ap0x_h_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v198 {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 2C 81 40 }
        $b = { 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Eddie1800_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v71_EXE {
    strings:
        $a = { 6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01 }
    condition:
        $a at pe.entry_point
}

rule Phonebook_configuration_file {
    strings:
        $a = { 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F }
    condition:
        $a at pe.entry_point
}

rule Sc_Obfuscator_SuperCRacker {
    strings:
        $a = { 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00 }
        $b = { 60 33 C9 8B 1D 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FreePascal_200_Win32_Berczi_Gabor_Pierre_Muller_Peter_Vreman_additional {
    strings:
        $a = { 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Mew_10_exe_coder_10_Northfox_HCC {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v073beta_ap0x_h {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        $a at pe.entry_point
}

rule yzpack_V11_UsAr_Sign_by_fly {
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190a_additional {
    strings:
        $a = { 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_20_SetiSoft {
    strings:
        $a = { 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule CreateInstall_Stub_vxx {
    strings:
        $a = { 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 }
        $b = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v420_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        $a at pe.entry_point
}

rule PEiD_6472_3DMark_Database_file {
    strings:
        $a = { 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule DBPE_v233_additional {
    strings:
        $a = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED }
    condition:
        $a at pe.entry_point
}

rule Safe_20 {
    strings:
        $a = { 83 EC 10 53 56 57 E8 C4 01 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_BJFNT_11b_Anorganix {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }
    condition:
        $a at pe.entry_point
}

rule Joiner_sign_from_pinch_25032007_2010_additional {
    strings:
        $a = { 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v100_v101_BoB_BobSoft {
    strings:
        $a = { 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule VProtector_13X_vcasm {
    strings:
        $a = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
        $b = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v120_v1201_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v204_additional {
    strings:
        $a = { EB ?? ?? BE ?? ?? BF ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule MSVCpp_v8_procedure_1_recognized_h {
    strings:
        $a = { 55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3 }
    condition:
        $a at pe.entry_point
}

rule FOXSQZ_Archive {
    strings:
        $a = { 46 4F 58 53 51 5A }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_yodas_cryptor_12_emadicius_h {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Safedisc_V450000_Macrovision_Corporation_SignByfly_20080117 {
    strings:
        $a = { 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ?? ?? ?? FF 10 61 5D EB 47 80 7C 24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ?? 89 4C 24 04 59 EB 29 50 B8 FD ?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04 FF D0 58 B8 25 ?? ?? ?? FF 30 C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74 05 E9 91 FE FF FF C3 }
        $b = { 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PESpin_V11_cyberbob_20080311 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB }
    condition:
        $a at pe.entry_point
}

rule XPack_136_EXE {
    strings:
        $a = { 2E C7 06 01 01 00 00 8B EC EB 01 E8 2E C6 06 08 05 FA EB 00 9A BC 15 05 2E C6 06 14 05 C3 EB 00 9A 3B 05 06 09 95 19 99 26 03 62 F1 03 6D 05 88 05 13 06 49 06 E2 00 5D 06 CF 00 45 06 AC 00 48 06 AA 00 3C 06 FC 00 33 E4 8E D4 83 C4 10 2E 8F }
    condition:
        $a at pe.entry_point
}

rule Code_Virtualizer_1310_Oreans_Technologies {
    strings:
        $a = { 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC }
    condition:
        $a at pe.entry_point
}

rule Exe_Locker_10_IonIce_additional {
    strings:
        $a = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D }
    condition:
        $a at pe.entry_point
}

rule PackerMASMTASM_Lenguaje_Compilador {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1339_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_430a_Silicon_Realms_Toolworks_h {
    strings:
        $a = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }
        $b = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_V010_V011_Dwing_additional {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2117_StrongbitSoftComplete_Development_h {
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
        $b = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACProtect_141_AntiCrack_Software {
    strings:
        $a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30 }
        $b = { E8 01 00 00 00 ?? 83 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Private_exe_Protector_V18X_V19X_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11_MTE {
    strings:
        $a = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }
    condition:
        $a at pe.entry_point
}

rule SEN_Debug_Protector {
    strings:
        $a = { BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8 }
    condition:
        $a at pe.entry_point
}

rule BobPack_v100_BoB_BobSoft_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_131_Eng_dulekxt_additional {
    strings:
        $a = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_Dll_aPlib_043_ap0x_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_CAB_SFX_additional {
    strings:
        $a = { E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC }
    condition:
        $a at pe.entry_point
}

rule ASPack_v102b_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }
    condition:
        $a at pe.entry_point
}

rule Phoenix_Protector_v10v11_NTCorecom_additional {
    strings:
        $a = { 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF 07 73 ?? ?? ?? 0A 38 E5 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Audio_CD_file {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V3035_V3043_Thinstall_Company {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_With_CRC_check {
    strings:
        $a = { B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule Mew_10_v10_Northfox {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF }
    condition:
        $a at pe.entry_point
}

rule Xorer_v21_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? BA ?? ?? B9 ?? ?? 51 B0 ?? E6 60 FA B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v10 {
    strings:
        $a = { 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11 {
    strings:
        $a = { 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12 {
    strings:
        $a = { 68 01 C3 AA ?? }
        $b = { 68 01 ?? ?? ?? C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SDProtector_BasicPro_Edition_110_Randy_Li_h_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00 }
    condition:
        $a at pe.entry_point
}

rule NoobyProtect_V1004_Nooby_20081207 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 9C 81 44 24 04 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v_If_you_know_this_version_post_on_PEiD_board_additional {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ZProtect_v144_lifeengines {
    strings:
        $a = { E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule PowerBASICWin_70x_additional {
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_V200_V300_Markus_Oberhumer_Laszlo_Molnar_John_Reiser {
    strings:
        $a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point
}

rule RJoiner_by_Vaska_Sign_from_pinch_25032007_1700_additional {
    strings:
        $a = { E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 }
    condition:
        $a at pe.entry_point
}

rule App_Protector_Silent_Team {
    strings:
        $a = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Neolite_20_Anorganix {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v110b7_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v122_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_21x_exe_Alexey_Solodovnikov {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MoleBox_V2X_MoleStudiocom {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v10_dulekxt {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point
}

rule ASPack_v106b {
    strings:
        $a = { 90 90 75 ?? }
        $b = { 90 90 90 75 00 E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_FSG_131 {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_NTkrnl_team_h_additional {
    strings:
        $a = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule CAN2EXE_v001_Hint_DOS_EP {
    strings:
        $a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_DLL_aPLib_Ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
    condition:
        $a at pe.entry_point
}

rule W32Jeefo_PE_File_Infector_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_DLL_additional {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PEX_099_Anorganix {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Vx_Trivial25_Hint_DOS_EP {
    strings:
        $a = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252_beta2_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24 }
    condition:
        $a at pe.entry_point
}

rule Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode_okkixot_additional {
    strings:
        $a = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v020_additional {
    strings:
        $a = { E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 }
    condition:
        $a at pe.entry_point
}

rule setupexe_Section44rsrc {
    strings:
        $a = { 00 00 00 00 00 00 00 00 04 00 00 00 00 00 04 00 03 00 00 00 30 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v039_final_Dwing_additional {
    strings:
        $a = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1032_Ashkbiz_Danehkar_Sign_by_fly {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule UPX_v071_DLL {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 }
    condition:
        $a at pe.entry_point
}

rule Banners_banner_file {
    strings:
        $a = { D1 BA 01 00 }
    condition:
        $a at pe.entry_point
}

rule SDC_12_Self_Decrypting_Binary_Generator_by_Claes_M_Nyberg_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF }
    condition:
        $a at pe.entry_point
}

rule PECompact_v140b2_v140b4_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11 }
    condition:
        $a at pe.entry_point
}

rule Upack_V037_Dwing {
    strings:
        $a = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 }
        $b = { BE ?? ?? ?? ?? AD 50 FF ?? ?? EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_v4x {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v420_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }
        $b = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_239_DLL_compressed_resources {
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10 }
    condition:
        $a at pe.entry_point
}

rule Lattice_C_v30_Hint_DOS_EP {
    strings:
        $a = { FA B8 ?? ?? 8E D8 B8 ?? ?? 8E }
    condition:
        $a at pe.entry_point
}

rule Pohernah_100_by_Kas {
    strings:
        $a = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }
        $b = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RAR_Archive_Hint_FILE_START {
    strings:
        $a = { 52 61 72 21 }
    condition:
        $a at pe.entry_point
}

rule Delphi_v20_Unit_Hint_FILE_START {
    strings:
        $a = { 44 43 55 32 }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_v15_coban2k {
    strings:
        $a = { BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Upack_V036_Dwing {
    strings:
        $a = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01 }
        $b = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Packed_with_PKLITE_v150_with_CRC_check_1 {
    strings:
        $a = { 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_bartxt_WinRAR_SFX_ {
    strings:
        $a = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
    condition:
        $a at pe.entry_point
}

rule Eagle_Protector_V22_AntiDebugLIB_20081008 {
    strings:
        $a = { E8 ?? ?? ?? ?? EB 01 ?? BB 55 ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? 83 FB 55 E8 ?? ?? ?? ?? EB 01 ?? 75 2E E8 ?? ?? ?? ?? EB 01 ?? C3 60 E8 ?? ?? ?? 00 5D 81 ED ?? ?? ?? ?? 8B D5 81 C2 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? C3 C3 E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E8 ?? ?? ?? ?? EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point
}

rule PolyEnE_V001p_Lennart_Hedlund {
    strings:
        $a = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule Anslym_FUD_Crypter_Sign_by_fly {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A }
    condition:
        $a at pe.entry_point
}

rule Stony_Brook_Pascalp_v70_Hint_DOS_EP {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC }
    condition:
        $a at pe.entry_point
}

rule Borland_Pascal_v70_Protected_Mode {
    strings:
        $a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v122_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v71_EXE_additional {
    strings:
        $a = { 6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v136_SteelBytes {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule TASM_MASM_additional {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200b_additional {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PECompact_14p_Anorganix_additional {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point
}

rule IProtect_10_FxSubdll_mode_by_FuXdas_additional {
    strings:
        $a = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 }
    condition:
        $a at pe.entry_point
}

rule TPCs_COM_scrambler_100 {
    strings:
        $a = { 3E C6 06 08 01 FD 90 EB 03 00 00 00 2E 8A 36 09 01 8E C0 8C D8 BE 4F 01 BF 77 01 2E 03 3E 0A 01 26 A3 06 00 26 89 3E 04 00 26 A3 0E 00 26 C7 06 0C 00 61 01 0E 07 B9 32 00 FC F3 A4 CC BE 77 01 BF 00 01 2E 8B 0E 0A 01 B8 00 01 0E 50 CD 01 58 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_DLL_v2xx_additional {
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_19901992_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_20X_Jitit {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v25x_v26x {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Bitmap_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 01 00 09 00 }
    condition:
        $a at pe.entry_point
}

rule ST_Protector_V15_Silent_Software_additional {
    strings:
        $a = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }
    condition:
        $a at pe.entry_point
}


rule NoobyProtect_SE_Public_V1180_Nooby_20090201 {
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 38 2E 30 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v104b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D }
    condition:
        $a at pe.entry_point
}

rule aPack_v082_additional {
    strings:
        $a = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }
    condition:
        $a at pe.entry_point
}

rule FSG_v133_Eng_dulekxt_additional {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Intro_v10_additional {
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_11X_13X_Sukhov_Vladimir_Serge_N_Markin {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_DLL_v2xx {
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 ?? ?? 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D ?? 30 ?? 10 85 }
        $b = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Guardant_Stealth_aka_Novex_Dongle_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }
    condition:
        $a at pe.entry_point
}

rule PPC_PROTECT_10_Alexey_Gorchakov {
    strings:
        $a = { FF 5F 2D E9 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_1031_Ashkibiz_Danehlar_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule Shield_170 {
    strings:
        $a = { 2E 8C 06 D5 05 2E 87 06 D3 05 8B EC B9 C3 03 90 33 DB 02 46 00 12 E7 45 E2 F8 8C CE 8E DB FA BC 22 02 59 5A 87 0F 43 43 03 D6 87 17 52 51 43 43 83 EC 04 80 FB 10 72 EA CC 90 25 73 67 2B 98 02 FB 5D 07 5A 5F 8B 3D 8B 4E 05 33 C7 33 C1 D1 C0 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200b_Hint_DOS_EP {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }
    condition:
        $a at pe.entry_point
}

rule MrHDKiLLeR_ProtectioN_10 {
    strings:
        $a = { 48 51 44 2E A1 01 01 2D 11 00 8B D8 05 00 01 8B F0 BF 00 01 B9 14 00 90 F3 A4 8B CB D1 E9 B8 00 01 8B F0 8B F8 06 6A 00 07 26 8B 2E 04 00 26 FF 36 06 00 07 26 8A 76 00 6A 00 07 26 8B 2E 0C 00 26 FF 36 0E 00 07 26 8A 56 00 6A 00 07 26 8B 1E }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix {
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Norton_Speed_Disk_Configuration_file_additional {
    strings:
        $a = { 4E 6F 72 74 6F 6E 20 53 70 65 65 64 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_2547_V2600_Jitit {
    strings:
        $a = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Microsoft_Visual_Basic_50_60_Anorganix {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule XPack_152_164 {
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule XE_Executable_Image_using_DOSExtender_Hint_FILE_START {
    strings:
        $a = { 58 45 }
    condition:
        $a at pe.entry_point
}

rule AVP_Antiviral_Database {
    strings:
        $a = { 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point
}

rule CA_Visual_Objects_V20_25 {
    strings:
        $a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_V16c_Vaska {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule AverCryptor_10_os1r1s {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v0761_dos_exe {
    strings:
        $a = { B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_0460_0759_hying_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }
    condition:
        $a at pe.entry_point
}

rule Minke_101_by_Codius {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }
        $b = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Phoenix927_Hint_DOS_EP {
    strings:
        $a = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }
    condition:
        $a at pe.entry_point
}

rule Interchange_Format_File_IFF_type_WVQA {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }
    condition:
        $a at pe.entry_point
}

rule Free_Pascal_106 {
    strings:
        $a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Prepared_by_SLR_OPTLINK_Hint_DOS_EP {
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }
    condition:
        $a at pe.entry_point
}

rule iLUCRYPT_v4018_EXE {
    strings:
        $a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V130X_Obsidium_Software_Sign_by_fly {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule ASPack_V22_Alexey_Solodovnikov_StarForce_2009408 {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD ?? ?? ?? ?? ?? ?? 83 BD 7D 04 00 00 00 89 9D 7D 04 00 00 0F 85 C0 03 00 00 8D 85 89 04 00 00 50 FF 95 09 0F 00 00 89 85 81 04 00 00 8B F0 8D 7D 51 57 56 FF 95 05 0F 00 00 AB B0 00 AE 75 FD 38 07 75 EE 8D 45 7A FF E0 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 8B 9D 8D 05 00 00 0B DB 74 0A 8B 03 87 85 91 05 00 00 89 03 8D B5 BD 05 00 00 83 3E 00 0F 84 15 01 00 00 6A 04 68 00 10 00 00 68 00 18 00 00 6A 00 FF 55 51 89 85 53 01 00 00 8B 46 04 05 0E 01 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 55 51 89 85 4F 01 00 00 56 8B 1E 03 9D 7D 04 00 00 FF B5 53 01 00 00 FF 76 04 50 53 E8 2D 05 00 00 B3 00 80 FB 00 75 5E FE 85 E9 00 00 00 8B 3E 03 BD 7D 04 00 00 FF 37 C6 07 C3 FF D7 8F 07 50 51 56 53 8B C8 83 E9 06 8B B5 4F 01 00 00 33 DB 0B C9 74 2E 78 2C AC 3C E8 74 0A EB 00 3C E9 74 04 43 49 EB EB 8B 06 EB 00 ?? ?? ?? 75 F3 24 00 C1 C0 18 2B C3 89 06 83 C3 05 83 C6 04 83 E9 05 EB CE 5B 5E 59 58 EB 08 }
    condition:
        $a at pe.entry_point
}

rule UPX_Shit_05_snaker {
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule DBPE_233 {
    strings:
        $a = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }
    condition:
        $a at pe.entry_point
}

rule App_Protector_Silent_Team_additional {
    strings:
        $a = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_03_additional {
    strings:
        $a = { 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C }
    condition:
        $a at pe.entry_point
}

rule aPack_082_COM {
    strings:
        $a = { 8C C8 80 C4 10 8E C0 FC B9 00 00 BE 00 01 8B FE 57 F3 A5 5F BE BC 01 06 68 20 01 1E 07 8E D8 CB 06 57 B6 01 BD 89 01 FF D5 73 5B FF D5 73 1C FF D5 73 3D BB A0 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 34 93 EB 36 E8 46 00 49 49 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_v01_SToRM_additional {
    strings:
        $a = { 83 ?? ?? E2 ?? ?? E2 ?? FF }
    condition:
        $a at pe.entry_point
}

rule PECompact_125 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 0D 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule PluginToExe_v102_BoB_BobSoft_additional {
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A }
    condition:
        $a at pe.entry_point
}

rule PECompact_122 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule Banners_banner_file_Hint_FILE_START {
    strings:
        $a = { D1 BA 01 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_LZMA_Ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
    condition:
        $a at pe.entry_point
}

rule FSG_v133_dulekxt {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_023_GlOFF {
    strings:
        $a = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule The_aPE_Inline_Patch_Basic_Advanced_Stealth_additional {
    strings:
        $a = { B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PE_Pack_099 {
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }
    condition:
        $a at pe.entry_point
}

rule Windows_9x_User_password_file_Hint_FILE_START {
    strings:
        $a = { E3 82 85 96 }
    condition:
        $a at pe.entry_point
}

rule Thunderbolt_V002_deXep_forgot {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_109g_Risco_software_Inc {
    strings:
        $a = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PEX_099_Anorganix {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Cpp {
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_REALBasic_Anorganix {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule AVP_Inspector_Database_additional {
    strings:
        $a = { 47 68 6F 73 74 20 42 75 73 74 65 72 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v112_v115_v120_2_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 3B C4 73 }
    condition:
        $a at pe.entry_point
}

rule RLPack_116_aPLib_compression_ap0x_h {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B }
    condition:
        $a at pe.entry_point
}

rule kryptor_9_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
    condition:
        $a at pe.entry_point
}

rule Vx_TrojanTelefoon {
    strings:
        $a = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }
    condition:
        $a at pe.entry_point
}

rule SLR_OPTLINK {
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_Neolite_20_emadicius {
    strings:
        $a = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 }
    condition:
        $a at pe.entry_point
}

rule Copy_Protector_v20 {
    strings:
        $a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }
    condition:
        $a at pe.entry_point
}

rule Splice_11_by_Tw1sted_L0gic_additional {
    strings:
        $a = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v132 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v125_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }
    condition:
        $a at pe.entry_point
}

rule DJoin_07_public_xor_encryption_drmist {
    strings:
        $a = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule XPack_V097_LZSS_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 49 03 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_UPX_0896_102_105_124_emadicius_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_V33_LiuXingPing {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74 }
    condition:
        $a at pe.entry_point
}

rule Password_Protector_c_MiniSoft_1992_Hint_DOS_EP_additional {
    strings:
        $a = { E9 ?? ?? 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1304_Obsidium_Software_h {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13017_Obsidium_software_additional {
    strings:
        $a = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_VOB_ProtectCD_5_Anorganix {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_V12_BG_Software_Protect_Technologies_additional {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v2x {
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99 33 40 ?? ?? }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V13X_risco {
    strings:
        $a = { 60 50 E8 01 00 00 00 75 83 }
    condition:
        $a at pe.entry_point
}

rule NTkrnl_Secure_Suite_V01_NTkrnl_Software_Sign_by_fly_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        $a at pe.entry_point
}

rule Petite_13a {
    strings:
        $a = { B8 00 00 00 00 66 9C 60 50 8D 88 00 00 00 00 8D 90 00 00 00 00 8B DC 8B E1 68 00 00 00 00 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DC 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 }
    condition:
        $a at pe.entry_point
}

rule ChinaProtect_dummy_additional {
    strings:
        $a = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 }
    condition:
        $a at pe.entry_point
}

rule unknown_jac_additional {
    strings:
        $a = { 55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_20_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Xtreme_Protector_v106 {
    strings:
        $a = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }
        $b = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 F? }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Xtreme_Protector_v105 {
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 00 00 }
        $b = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _v10_ {
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00 }
    condition:
        $a at pe.entry_point
}

rule AINEXE_v21_additional {
    strings:
        $a = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }
    condition:
        $a at pe.entry_point
}

rule FreePascal_104_Win32_DLL_Bczi_Gor_Pierre_Muller_Peter_Vreman {
    strings:
        $a = { C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point
}

rule Zprotect_V120_V130BuildX_lifeengines_20080313 {
    strings:
        $a = { 00 00 00 00 00 00 00 00 2E 74 65 78 74 62 73 73 ?? ?? ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2E 69 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_83_Coverpage_Quick_CoverPage {
    strings:
        $a = { FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt_102_randomkilla_and_acpizer {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 }
    condition:
        $a at pe.entry_point
}

rule CryptTrivial173 {
    strings:
        $a = { EB 18 90 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 BB 00 FE 00 1F 4B EB FB D1 81 0F D1 0D D8 9B 0B E8 32 55 D0 4A D2 45 D7 5E 5D 4F 8F CE B4 09 57 1B 94 C4 C3 81 C1 C1 78 FC BD BF D8 01 9B B3 38 B1 94 60 28 E8 41 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_031032_GlOFF_additional {
    strings:
        $a = { 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 }
    condition:
        $a at pe.entry_point
}

rule Safe_20_additional {
    strings:
        $a = { 83 EC 10 53 56 57 E8 C4 01 00 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_20a0_additional {
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0 }
    condition:
        $a at pe.entry_point
}

rule QrYPt0r_by_NuTraL {
    strings:
        $a = { 80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01 }
        $b = { EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASDPack_asd_SignByfly {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }
        $b = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RPoly_crypt_10b_from_Vaska_18032007_1906 {
    strings:
        $a = { E8 00 00 00 00 83 }
    condition:
        $a at pe.entry_point
}

rule RPoly_crypt_10b_from_Vaska_18032007_1905 {
    strings:
        $a = { 83 04 24 05 C3 60 }
    condition:
        $a at pe.entry_point
}

rule RLP_v073beta_ap0x {
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v107b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE }
    condition:
        $a at pe.entry_point
}

rule Packman_V0001_Bubbasoft_additional {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8 }
    condition:
        $a at pe.entry_point
}

rule NakedPacker_10_by_BigBoote_additional {
    strings:
        $a = { 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }
    condition:
        $a at pe.entry_point
}

rule Petite_v21_1_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt {
    strings:
        $a = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
    condition:
        $a at pe.entry_point
}

rule DOS16M_DOS_Extender_c_Tenberry_Software_Inc_1987_1995_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7 }
    condition:
        $a at pe.entry_point
}

rule MinGW_v32x_Dll_main {
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 ?? ?? 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D ?? 30 ?? 10 85 }
        $b = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NTkrnl_Secure_Suite_V01_NTkrnl_Software_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v100_Eng_dulekxt_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
    condition:
        $a at pe.entry_point
}

rule UPXShit_006 {
    strings:
        $a = { B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule MinGW_32x_main_additional {
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 }
    condition:
        $a at pe.entry_point
}

rule CI_Crypt_V02_FearlesS {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule hyings_PEArmor_V076_hying_additional {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_50_additional {
    strings:
        $a = { 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v150_1 {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule ILUCRYPT_v4015_exe_additional {
    strings:
        $a = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v114_v115_v120_3_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1332_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00 }
    condition:
        $a at pe.entry_point
}

rule CrunchPE_v10xx_additional {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_DLL {
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 }
    condition:
        $a at pe.entry_point
}

rule Crypto_Lock_V202_Eng_Ryan_Thian_additional {
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }
    condition:
        $a at pe.entry_point
}

rule Video_Lan_Client_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Berio_100_beta_h {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2609_Jitit {
    strings:
        $a = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Spanz_Hint_DOS_EP {
    strings:
        $a = { E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84 }
    condition:
        $a at pe.entry_point
}

rule SPLayer_v008 {
    strings:
        $a = { 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v101_BoB_BobSoft {
    strings:
        $a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point
}

rule UPX_070_EXE {
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 08 00 02 00 }
    condition:
        $a at pe.entry_point
}

rule EXE32Pack_v138_additional {
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 }
    condition:
        $a at pe.entry_point
}

rule Upack_v032_beta_Dwing_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_Extranger_additional {
    strings:
        $a = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }
    condition:
        $a at pe.entry_point
}

rule v02Packer_ttt_additional {
    strings:
        $a = { 60 E8 36 FE FF FF C3 90 ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EPack_14_lite_final_by_6aHguT {
    strings:
        $a = { 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point
}

rule Upack_v022_v023Beta_Sign_by_hot_UNP {
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1258_Obsidium_Software_additional {
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_20betastudent_version_Jeremy_Collake_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_42_additional {
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 }
    condition:
        $a at pe.entry_point
}

rule PKTINY_v10_with_TINYPROG_v38_Hint_DOS_EP {
    strings:
        $a = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_10X_Sukhov_Vladimir {
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }
        $b = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v108x_Alexey_Solodovnikov {
    strings:
        $a = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }
    condition:
        $a at pe.entry_point
}

rule tElock_099_10_private_tE {
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional {
    strings:
        $a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
    condition:
        $a at pe.entry_point
}

rule ACProtect_v135_risco_software_Inc_Anticrack_Software {
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
        $b = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ActiveMARK_5x_Trymedia_Systems_Inc_h {
    strings:
        $a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
    condition:
        $a at pe.entry_point
}

rule HSC_music_file_Hint_FILE_START {
    strings:
        $a = { C8 E2 04 20 }
    condition:
        $a at pe.entry_point
}

rule MoleboxUltraV40X_Teggo_Software_Ltd_20090518 {
    strings:
        $a = { 55 89 E5 E8 0C 00 00 00 5D C3 CC CC CC CC CC E8 85 08 00 00 6A 00 54 6A 00 E8 8E 04 00 00 87 04 24 E8 90 06 00 00 5F 5E 5E 89 EC 5D FF E0 32 06 74 07 32 26 74 03 31 C0 C3 C1 E8 10 83 C6 02 09 C0 75 EB B8 01 00 00 00 C3 31 C0 8B 74 24 10 8B 76 28 66 8B 06 83 C6 02 09 C0 74 09 83 F0 5C 75 02 89 F7 EB ED 89 FE C3 56 57 E8 DA FF FF FF B8 6E 4E 74 54 E8 B5 FF FF FF 09 C0 74 0E B8 64 44 6C 4C E8 A7 FF FF FF 09 C0 74 00 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule Themida_10xx_18xx_no_compression_Oreans_Technologies_h_additional {
    strings:
        $a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
    condition:
        $a at pe.entry_point
}

rule SalityQ {
    strings:
        $a = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 0C 24 33 04 24 D1 E9 66 AB 58 E2 24 57 B8 FC 4F 00 00 29 04 24 C3 8B 2C 24 B9 18 10 00 00 81 ED 06 10 40 00 90 90 90 81 C1 E8 17 00 00 90 EB 91 FF E3 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_PEX_099 {
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
    condition:
        $a at pe.entry_point
}

rule CreateInstall_Stub_vxx_additional {
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3_emadicius_h {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_5_Portions_Copyright_c_198399_Borland {
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point
}

rule LamerStop_v10c_c_Stefan_Esser_additional {
    strings:
        $a = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }
    condition:
        $a at pe.entry_point
}

rule Inbuild_v10_hard {
    strings:
        $a = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point
}

rule Vprotect_V201110304_CoooLie {
    strings:
        $a = { 8B 67 28 8B C0 F6 D5 F7 D7 8B F6 F7 D7 F6 D5 F7 D7 8D 80 E9 FF FF FF 8D AD FF FF FF FF 60 66 F7 D3 66 F7 D3 61 8D AD 01 00 00 00 8D 80 17 00 00 00 F7 D7 66 56 8D 9B F6 FF FF FF 8D 80 F6 FF FF FF 8D 80 0A 00 00 00 8D 9B 0A 00 00 00 66 5E 61 9C 9D 8D 9B EE FF FF FF 57 86 F1 8D BF F5 FF FF FF F7 D6 66 8B D2 F7 D6 8D BF 0B 00 00 00 86 F1 5F 8D 9B 12 00 00 00 66 52 8D 92 E4 FF FF FF 8D 92 1C 00 00 00 66 5A 9D }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1990_1992_09_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule VProtector_V11_vcasm_additional {
    strings:
        $a = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule OLE2_Document_WinWord_Excel_Hint_FILE_START {
    strings:
        $a = { D0 CF 11 E0 A1 B1 1A E1 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_v5_v6 {
    strings:
        $a = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }
    condition:
        $a at pe.entry_point
}

rule AZProtect_0x0001_AlexZ_aka_AZCRC_additional {
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 }
    condition:
        $a at pe.entry_point
}

rule Sun_Icon_Graphics_format_additional {
    strings:
        $a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PENinja_131 {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule UnoPiX_075_BaGiE_additional {
    strings:
        $a = { 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_DLL_Debug_additional {
    strings:
        $a = { 8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00 }
    condition:
        $a at pe.entry_point
}

rule Vterminal_V10X_Lei_Peng_additional {
    strings:
        $a = { 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Borland_Delphi_Borland_Cpp {
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
        $b = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp {
    strings:
        $a = { 8B 44 24 08 83 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ThinstallVS_3348_Thinstallcom {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 ?? ?? ?? ?? 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 ?? ?? ?? 33 DB BA ?? ?? ?? 80 43 33 C0 E8 19 01 ?? ?? 73 0E 8B 4D F8 E8 27 01 ?? ?? 02 45 F7 AA EB E9 E8 04 01 ?? ?? 0F 82 96 ?? ?? ?? E8 F9 ?? ?? ?? 73 5B B9 04 ?? ?? ?? E8 05 01 ?? ?? 48 74 DE 0F 89 C6 ?? ?? ?? E8 DF ?? ?? ?? 73 1B 55 BD ?? 01 ?? ?? E8 DF ?? ?? ?? 88 07 47 4D 75 F5 E8 C7 ?? ?? ?? 72 E9 5D EB A2 B9 01 ?? ?? ?? E8 D0 ?? ?? ?? 83 C0 07 89 45 F8 C6 45 F7 ?? 83 F8 08 74 89 E8 B1 ?? ?? ?? 88 45 F7 E9 7C FF FF FF B9 07 ?? ?? ?? E8 AA ?? ?? ?? 50 33 C9 B1 02 E8 A0 ?? ?? ?? 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 ?? ?? ?? 89 45 FC E9 48 FF FF FF E8 87 ?? ?? ?? 49 E2 09 8B C3 E8 7D ?? ?? ?? EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D ?? ?? ?? 0B C5 5D 8B D8 E8 5F ?? ?? ?? 3D ?? ?? 01 ?? 73 14 3D FF 37 ?? ?? 73 0E 3D 7F 02 ?? ?? 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 ?? 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 ?? ?? ?? E8 01 ?? ?? ?? C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 11 ?? ?? 5E 11 ?? ?? 70 11 ?? ?? 80 11 ?? ?? 90 11 ?? ?? A0 11 ?? ?? AE 11 ?? ?? BE 11 ?? ?? D4 11 ?? ?? E2 11 ?? ?? F4 11 ?? ?? 06 12 ?? ?? 16 12 ?? ?? 2A 12 ?? ?? 40 12 ?? ?? 52 12 ?? ?? 5E 12 ?? ?? 72 12 ?? ?? 8C 12 ?? ?? 98 12 ?? ?? AA 12 ?? ?? B8 12 ?? ?? C4 12 ?? ?? D6 12 ?? ?? E4 12 ?? ?? FA 12 ?? ?? 14 13 ?? ?? ?? ?? ?? ?? 30 13 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3E 56 C3 47 ?? ?? ?? ?? 02 ?? ?? ?? 5B ?? ?? ?? ?? ?? ?? ?? ?? 1A ?? ?? D8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 22 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3E ?? ?? ?? 70 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? 5E ?? ?? ?? 70 ?? ?? ?? 80 ?? ?? ?? 90 ?? ?? ?? A0 1D ?? ?? AE ?? ?? ?? BE ?? ?? ?? D4 ?? ?? ?? E2 ?? ?? ?? F4 ?? ?? ?? 06 ?? ?? ?? 16 ?? ?? ?? 2A ?? ?? ?? 40 ?? ?? ?? 52 ?? ?? ?? 5E ?? ?? ?? 72 ?? ?? ?? 8C ?? ?? ?? 98 ?? ?? ?? AA ?? ?? ?? B8 ?? ?? ?? C4 ?? ?? ?? D6 ?? ?? ?? E4 ?? ?? ?? FA ?? ?? ?? 14 }
    condition:
        $a at pe.entry_point
}

rule E_ {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
        $b = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PECompact_v166 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v167 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v11_Northfox_HCC {
    strings:
        $a = { E9 ?? ?? ?? FF 0C }
        $b = { E9 ?? ?? ?? FF 0C ?0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_V1354_Obsidium_Software_SignByfly_200800207 {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00 }
        $b = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vx_Kuku886 {
    strings:
        $a = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Dll_LZMA_430_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V18X_V19X_Other_Oreans_Technologies_SignByfly_20080131 {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule Upack_01x_020_021_024_beta_Dwing {
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
        $b = { BE ?? 01 40 00 AD 8B F8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Krypton_v03_yadolockless {
    strings:
        $a = { 8B 0C 24 E9 C0 8D 01 00 C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }
    condition:
        $a at pe.entry_point
}

rule Safeguard_10_101_Simonzh {
    strings:
        $a = { E8 00 00 00 00 EB 29 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v10801_Alexey_Solodovnikov {
    strings:
        $a = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D }
        $b = { 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v303_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53 }
    condition:
        $a at pe.entry_point
}

rule PECompact_25x_Jeremy_Collake {
    strings:
        $a = { B8 ?? ?? ?? ?? FF E0 }
    condition:
        $a at pe.entry_point
}

rule dUP_2x_Patcher_wwwdiablo2oo2cjbnet_additional {
    strings:
        $a = { 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 }
    condition:
        $a at pe.entry_point
}

rule NetSafe_ZIP_Prot {
    strings:
        $a = { FA 5A 86 C6 EE 86 C6 8B EC 8B 5E FA 4B 5F 4B 83 EC 06 75 01 83 8E DB E4 21 8B F3 80 CB 0E 0C 02 13 37 73 01 C5 8F 07 E6 21 2B 7E FE 8B 6F FE 7D 01 83 80 E3 FD 73 02 C5 C5 89 3F CC EA F0 FF 00 F0 CD 20 E9 9F 59 E3 06 2B F9 47 1F 47 30 25 4F }
    condition:
        $a at pe.entry_point
}

rule PKZIP_SFX_v11_1989_90 {
    strings:
        $a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL_Anorganix {
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }
    condition:
        $a at pe.entry_point
}

rule Goats_Mutilator_V16_Goat_e0f {
    strings:
        $a = { E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D }
    condition:
        $a at pe.entry_point
}

rule SafeDisc_v4_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }
    condition:
        $a at pe.entry_point
}

rule RSCs_Process_Patcher_v151_additional {
    strings:
        $a = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_v1032_exescrcom_Ashkbiz_Danehkar_h {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_p_Password_checking_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule LaunchAnywhere_v4001 {
    strings:
        $a = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 }
        $b = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Unknown_packer_02_additional {
    strings:
        $a = { FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB }
    condition:
        $a at pe.entry_point
}

rule MicroJoiner_15_coban2k {
    strings:
        $a = { BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_70_ {
    strings:
        $a = { EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v19x_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point
}

rule Petite_v21_2 {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule Crunch_5_Bit_Arts {
    strings:
        $a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
    condition:
        $a at pe.entry_point
}

rule TMT_Pascal_v040_additional {
    strings:
        $a = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v030_beta_By_Dwing_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_Patch_Sign_by_hot_UNP {
    strings:
        $a = { 81 3A 00 00 00 02 00 00 00 00 }
        $b = { 2A A3 F2 54 CE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Vprotect_V188_CoooLie {
    strings:
        $a = { FF E0 60 A5 8B 5F 10 83 6F 10 04 83 EB 04 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 C7 47 50 00 00 00 00 8B 7F 1C }
    condition:
        $a at pe.entry_point
}

rule MINI_EXE {
    strings:
        $a = { B8 00 00 BA 00 00 05 00 00 3B 06 02 00 73 1C 2D 20 00 FA 8E D0 FB 2D 00 00 90 8E C0 50 B9 00 00 90 33 FF 57 BE 46 01 FC F3 A5 CB B4 09 BA 34 01 CD 21 CD 20 4D 65 6D 6F 72 79 20 6E 6F 74 20 65 6E 6F 75 67 68 24 8C DB 53 83 C3 00 90 03 DA 8C }
    condition:
        $a at pe.entry_point
}

rule PE_PACK_v10_by_ANAKiN_1998_ {
    strings:
        $a = { 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10_beta_Spy_Instructor_additional {
    strings:
        $a = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 }
    condition:
        $a at pe.entry_point
}

rule PELOCknt_201 {
    strings:
        $a = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD 20 EB 60 EB 03 CD 20 03 E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 04 CD EB 03 CD EB 02 CD 20 EB 03 CD 20 EA FC EB 03 CD 20 69 E8 00 00 00 00 EB 02 EB 01 EB 01 EB 5E EB 03 CD 20 EB EB }
    condition:
        $a at pe.entry_point
}

rule PELOCknt_203 {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 01 EB EB 02 CD 20 EB 03 CD 20 EB FC EB 02 C7 85 E8 00 00 00 00 EB 03 CD 20 EA 5E EB 03 CD 20 69 0F 01 4E F4 EB 03 CD 20 EB EB 01 EB }
    condition:
        $a at pe.entry_point
}

rule PELOCknt_202 {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD 20 60 EB 03 CD 20 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 04 CD 20 EB 02 EB 02 CD 20 EB 03 CD 20 EA FC EB 03 CD 20 69 E8 00 00 00 00 EB 02 EB 01 EB 01 EB 5E EB 02 CD 20 0F 01 4E }
    condition:
        $a at pe.entry_point
}

rule Petite_v21_1_Hint_WIN_EP {
    strings:
        $a = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule ExeTools_COM2EXE_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? CD 20 }
    condition:
        $a at pe.entry_point
}

rule Creative_Audio_file {
    strings:
        $a = { 43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v100b {
    strings:
        $a = { 60 E8 5D 81 ED D2 2A 44 B8 CC 2A 44 03 C5 2B 85 A5 2E 44 89 85 B1 2E 44 80 BD 9C 2E }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Amiga_AIFF_8SFX_Audio_file_additional {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_30X_Thinstall_Company {
    strings:
        $a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA }
    condition:
        $a at pe.entry_point
}

rule from_NORMAN_Anti_Virus_Utilites {
    strings:
        $a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }
    condition:
        $a at pe.entry_point
}

rule InstallShield_AFW {
    strings:
        $a = { 55 8B EC 6A FF 68 18 33 41 00 68 80 BA 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 E8 31 41 00 33 D2 8A D4 89 15 5C 63 41 00 8B C8 81 E1 FF 00 00 00 89 0D 58 63 41 00 C1 E1 08 03 CA 89 0D 54 63 41 00 C1 E8 10 A3 50 63 41 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 }
    condition:
        $a at pe.entry_point
}

rule ocBat2Exe_10_OC_additional {
    strings:
        $a = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF }
    condition:
        $a at pe.entry_point
}

rule PESpin_V132_cyberbobnbsp_nbsp_SignByfly_20080310 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 17 E6 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D FF E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF E8 02 00 00 00 ?? ?? 5A 81 ?? ?? ?? ?? ?? 83 EA FE 89 95 A9 57 40 00 2B C0 2B C9 83 F1 06 09 85 CB 57 40 00 9C D3 2C 24 80 C1 FB 21 0C 24 50 52 B8 36 C7 09 FF 05 FE 37 F6 00 F7 64 24 08 8D 84 28 B1 35 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC CD 20 BB 69 74 58 0B C1 C3 }
    condition:
        $a at pe.entry_point
}

rule Unknown_SFX_Archive_MRI_Hint_FILE_START {
    strings:
        $a = { 4D 52 49 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_25x_26x_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
    condition:
        $a at pe.entry_point
}

rule D1S1G_v11_Beta_pp_Scrambled_EXE_D1N {
    strings:
        $a = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B }
        $b = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UPX_v071_v072_Laszlo_Markus {
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point
}

rule PEEncrypt_v40b_JunkCode_additional {
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Anorganix_additional {
    strings:
        $a = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_additional {
    strings:
        $a = { 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25 }
    condition:
        $a at pe.entry_point
}

rule aPack_073_082_d_EXE {
    strings:
        $a = { 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B6 01 BD 00 00 }
    condition:
        $a at pe.entry_point
}

rule Pohernah_101_by_Kas_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
    condition:
        $a at pe.entry_point
}

rule NET_executable_Microsoft {
    strings:
        $a = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12_Alexey_Solodovnikov {
    strings:
        $a = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule FishPE_V10X_hellfish {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
        $b = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MEW_11_SE_v12_additional {
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_301_305_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v160a {
    strings:
        $a = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule Special_EXE_Password_Protector_v10_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }
    condition:
        $a at pe.entry_point
}

rule VProtect2070724Cloud_CoooLie {
    strings:
        $a = { 8D BF EC FF FF FF 66 F7 D5 8A D2 66 F7 D5 8D BF 14 00 00 00 60 61 60 61 9C 66 8B DB 9D 66 F7 D2 8D 89 E5 FF FF FF 8D B6 E2 FF FF FF 56 5E 8D B6 1E 00 00 00 8D 89 1B 00 00 00 66 F7 D2 66 52 66 5A 55 8D AD F9 FF FF FF 66 F7 D2 8D BF FC FF FF FF 8D BF 04 00 00 00 66 F7 D2 8D AD 07 00 00 00 5D 8B 67 28 66 55 66 5D 61 60 61 8D 9B F0 FF FF FF 8D 80 F6 FF FF FF 66 52 F7 D1 F7 D1 66 5A 8D 80 0A 00 00 00 8D 9B 10 00 00 00 66 87 D1 52 86 FB 86 FB 5A 66 87 D1 66 55 8D 92 E8 FF FF FF 8B DB 8D 92 18 00 00 00 66 5D 9D 56 5E F6 D0 F6 D0 C3 }
    condition:
        $a at pe.entry_point
}

rule UNITA3_tm_by_Sanitary_Equipment_Research_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 4D 5A 3E }
    condition:
        $a at pe.entry_point
}

rule NET_executable_ {
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Virogens_PE_Shrinker_v014_additional {
    strings:
        $a = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PE_Lock_NT_204_emadicius {
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule ComprEXE_10_EXE {
    strings:
        $a = { FC 1E 06 8C DD 83 C5 10 89 E8 BA 00 00 8B 1E 02 00 29 D3 53 8E D8 8E C3 31 F6 31 FF B9 08 00 F3 A5 40 43 4A 75 EE B8 2B 00 50 CB 0E 1F BE 00 00 B3 01 8E C5 31 FF 81 FF 00 80 72 0B 8C C0 05 00 08 8E C0 81 EF 00 80 E8 8A 00 74 08 B7 08 E8 9D }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Basic_v60_DLL_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Diet_144_145_COM {
    strings:
        $a = { F9 9C EB 0A 00 00 0C 00 00 00 9D 89 F8 9C 55 06 1E 57 56 52 51 53 50 E8 00 00 59 B1 04 D3 E9 8C C8 03 C1 8E D8 8E C0 BE 00 00 BF 00 00 B9 00 00 FD F3 A5 FC 8B F7 33 FF AD AD 8B E8 B2 10 E9 00 00 64 6C 7A }
    condition:
        $a at pe.entry_point
}

rule Excalibur_V103_forgot {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }
    condition:
        $a at pe.entry_point
}

rule Protect_40_COM {
    strings:
        $a = { E8 00 00 5D 81 ED 13 01 33 C0 8E D8 8B F0 BF 70 00 B9 08 00 FC F3 A5 FD 87 FE 8C C0 8E D8 33 C0 8E C0 4F 4F 8B C2 AB B8 AE 02 03 C5 AB 8B C2 AB B8 BB 01 03 C5 AB 8B C2 AB E4 21 A2 6B 00 B8 EF 01 03 C5 AB 8B C2 AB B8 F8 01 03 C5 AB 1E 07 B0 }
    condition:
        $a at pe.entry_point
}

rule Upack_V029_V031_Dwing_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 }
    condition:
        $a at pe.entry_point
}

rule DataBeam_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 30 31 2E 30 31 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_11_Solodovnikov_Alexey {
    strings:
        $a = { 60 E9 ?? 04 00 00 E9 ?? ?? ?? ?? ?? ?? ?? EE }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_Borland_Delphi_60_70_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AntiDote_V10_SIS_Team {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
    condition:
        $a at pe.entry_point
}

rule PECompact_2x_Bitsum_Technologies {
    strings:
        $a = { B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point
}

rule Crypt_17_EXE {
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 74 03 E9 98 00 1E B0 02 E6 21 8C DA 83 C2 10 8E DA 8E C2 BB 00 00 BA 00 00 85 D2 74 29 B4 01 33 FF 33 F6 B9 00 F0 AC 32 C4 C0 C4 03 02 E1 2E 00 06 22 01 AA E2 F0 8C D8 05 00 0F 8E D8 8E C0 4A 85 D2 74 02 EB D7 60 B4 30 }
    condition:
        $a at pe.entry_point
}

rule Immun_12_registered_EXE {
    strings:
        $a = { 50 53 51 52 56 57 1E 06 2E 8B 0E D3 07 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE D5 07 BF 6D 08 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C }
    condition:
        $a at pe.entry_point
}

rule XJ_XPAL_LiNSoN_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }
    condition:
        $a at pe.entry_point
}

rule FucknJoy_v10c_UsAr {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EncryptPE_V22004616_V22006630_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
        $b = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EXECryptor_V22X_softcompletecom {
    strings:
        $a = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_regular {
    strings:
        $a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }
    condition:
        $a at pe.entry_point
}

rule AntiDote_10_Demo_12_SIS_Team_additional {
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule CDS_SS_v10_Beta_1_CyberDoom_Team_X {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_vna_NV001 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 03 1E 40 00 33 C0 33 DB 33 D2 EB 01 E8 B9 A0 86 01 00 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 0F 83 34 06 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 }
    condition:
        $a at pe.entry_point
}

rule XCF_File_Format_by_Adeline_Software {
    strings:
        $a = { 46 72 61 6D 65 4C 65 6E F4 0F }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V500_V5X_Dll_Silicon_Realms_Toolworks_SignByfly_additional {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 }
    condition:
        $a at pe.entry_point
}

rule RAR_Configuration_file_additional {
    strings:
        $a = { 52 41 52 20 43 4F 4E 46 49 47 }
    condition:
        $a at pe.entry_point
}

rule BeRoEXEPacker_v100_DLL_LZBRR_BeRo_Farbrausch {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point
}

rule UPX_v070_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point
}

rule Patch_Creation_Wizard_v12_Seek_and_Destroy_Patch {
    strings:
        $a = { E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54 }
    condition:
        $a at pe.entry_point
}

rule Shrinker_v33_additional {
    strings:
        $a = { 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v25_additional {
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        $a at pe.entry_point
}

rule CRYPTCOM {
    strings:
        $a = { BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Morphine_v27_Holy_Father_Ratter29A_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Windows_Metafile_Hint_FILE_START {
    strings:
        $a = { D7 CD C6 9A }
    condition:
        $a at pe.entry_point
}

rule SEA_AXE_v22 {
    strings:
        $a = { FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_v14_LITE_BG_Software_Protect_Technologies_h_additional {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v120_v1201 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40 }
    condition:
        $a at pe.entry_point
}

rule Morphine_27_Holy_Father_Ratter29A {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
        $b = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PGMPAK_013 {
    strings:
        $a = { FA 1E 17 50 B4 30 CD 21 3C 02 73 04 B4 4C CD 21 FC BE 91 03 BF 00 09 E8 1E FF E8 1B FF BB 3F 00 BA FF 00 8A C3 8B F3 8B B0 00 0A 8A 8F C0 09 BF 01 00 D3 E7 74 06 BD 00 07 E8 B7 FF 04 02 8B F3 8B B0 40 09 8A 8F 00 09 80 F9 09 73 08 BD 00 01 }
    condition:
        $a at pe.entry_point
}

rule PGMPAK_014 {
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 04 B4 4C CD 21 FC BE 9A 03 BF 00 09 E8 1F FF E8 1C FF BB 3F 00 00 FF 00 8A C3 8B F3 8B B0 00 0A 8A 8F C0 09 BF 01 00 D3 E7 74 06 BD 00 07 E8 B8 FF 04 02 8B F3 8B B0 40 09 8A 8F 00 09 80 F9 09 73 08 BD 00 01 E8 }
    condition:
        $a at pe.entry_point
}

rule PGMPAK_015 {
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 04 B4 4C CD 21 FC BE A5 03 BF 00 09 E8 1F FF E8 1C FF BB 3F 00 00 FF 00 8A C3 8B F3 8B B0 00 0A 8A 8F C0 09 BF 01 00 D3 E7 74 06 BD 00 07 E8 B8 FF 04 02 8B F3 8B B0 40 09 8A 8F 00 09 80 F9 09 73 08 BD 00 01 E8 }
    condition:
        $a at pe.entry_point
}

rule First_Publisher_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 00 00 ?? 00 00 00 ?? 01 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V121_Dll_LZMA_430_ap0xnbsp_nbsp_SignByfly_20080504 {
    strings:
        $a = { 80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule XPack_V098_LZMA_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 2D 06 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_MSVCpp_70_DLL_Method_3_emadicius_additional {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200b_extra_additional {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80 }
    condition:
        $a at pe.entry_point
}

rule Vx_Hymn1865_additional {
    strings:
        $a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }
    condition:
        $a at pe.entry_point
}

rule ZipWorxSecureEXE_v25_ZipWORX_Technologies_LLC_h {
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }
        $b = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stranik_13_ModulaCPascal_additional {
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
    condition:
        $a at pe.entry_point
}

rule TrueType_Font_file_Hint_FILE_START_additional {
    strings:
        $a = { 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32 }
    condition:
        $a at pe.entry_point
}

rule tElock_v080 {
    strings:
        $a = { 60 E8 F9 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule PEncrypt_v10_additional {
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }
    condition:
        $a at pe.entry_point
}

rule ABKprot_100 {
    strings:
        $a = { B4 30 CD 21 86 E0 3D FF 02 73 02 CD 20 9C 8C C0 06 5B 59 51 53 BA 1C 01 87 F2 56 CF 0E 1F 0E 07 BF 00 00 BE 2F 01 B9 22 00 F3 A4 68 00 00 C3 BE 51 01 BF 00 01 B9 00 00 AC 33 C7 35 24 24 AA E2 F7 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 68 00 01 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_LZMA_430_ap0xnbsp_nbsp_Sign_by_fly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V10_CGSoftLabs {
    strings:
        $a = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102b_Ashkbiz_Danehkar {
    strings:
        $a = { E8 03 00 00 00 EB 01 }
    condition:
        $a at pe.entry_point
}

rule PKLITE32_V11_PKWARE_Inc {
    strings:
        $a = { 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point
}

rule nSPack_2x_North_StarLiu_Xing_Ping {
    strings:
        $a = { FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 }
    condition:
        $a at pe.entry_point
}

rule SVK_Protector_v143_wwwanticrackingsk {
    strings:
        $a = { 78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05 }
        $b = { 78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05 6? }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Nullsoft_Install_System_v20b4 {
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RLPack_Full_Edition_117_DLL_LZMA_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 }
    condition:
        $a at pe.entry_point
}

rule XPack_V097_LZRW_JoKo {
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 4D 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_13x_Cyberbob {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SLVc0deProtector_11x_SLV_ICU {
    strings:
        $a = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00 }
        $b = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ReversingLabsProtector_074_beta_Ap0x_additional {
    strings:
        $a = { 68 00 00 41 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Spin_v04x {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B }
        $b = { EB 01 68 60 E8 00 00 00 00 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v133_additional {
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Exe_Locker_10_IonIce {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Overlay {
    strings:
        $a = { 55 8B EC 83 C4 D4 53 56 57 33 C0 89 45 F0 89 45 E4 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200b {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v200c {
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }
    condition:
        $a at pe.entry_point
}

rule ZM_Exe_Executable_Image_Hint_FILE_START {
    strings:
        $a = { 5A 4D }
    condition:
        $a at pe.entry_point
}

rule EXECrypt_10_ReBirth_additional {
    strings:
        $a = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule ComProtector_v10_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? B9 ?? ?? BB ?? ?? BF ?? ?? 2E ?? ?? 34 ?? FE C8 C0 ?? ?? 2E ?? ?? 2E ?? ?? 2E ?? ?? 47 43 E2 }
    condition:
        $a at pe.entry_point
}

rule Erdas_LANGIS_Image_graphics_format {
    strings:
        $a = { 48 45 41 44 37 34 00 00 03 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_024_beta_Dwing_additional {
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v285_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
    condition:
        $a at pe.entry_point
}

rule CrackStop_v101_c_Stefan_Esser_1997_additional {
    strings:
        $a = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v12_additional {
    strings:
        $a = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule BAT2COM_v15_c_Douglas_Boling_PC_Magazine_Hint_DOS_EP {
    strings:
        $a = { EB ?? FC BD ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? B4 4A CD 21 A1 ?? ?? 89 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v202c {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_4x_LCC_Win32_1x_ {
    strings:
        $a = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }
    condition:
        $a at pe.entry_point
}

rule Mew_10_exe_coder_10_Northfox_HCC_additional {
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 }
    condition:
        $a at pe.entry_point
}

rule PECompact_140b5_140b6 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 8A 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Limited_additional {
    strings:
        $a = { BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule Splash_Bitmap_v100_BoB_Bobsoft {
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00 }
    condition:
        $a at pe.entry_point
}

rule PEQuake_V006_forgat {
    strings:
        $a = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { E8 A5 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upx_Lock_10_12_CyberDoom_Team_X_BoB_BobSoft_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }
    condition:
        $a at pe.entry_point
}

rule EXEPACK_369 {
    strings:
        $a = { 8B E8 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 50 B8 34 00 50 CB 8C C3 8C D8 48 8E D8 8E C0 BF 0F 00 B9 10 00 B0 FF F3 AE 47 8B F7 8B C3 48 8E C0 BF 0F 00 B1 04 8B C6 F7 D0 D3 E8 8C DA 2B D0 73 04 }
    condition:
        $a at pe.entry_point
}

rule from_NORMAN_Anti_Virus_Utilites_additional {
    strings:
        $a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }
    condition:
        $a at pe.entry_point
}

rule UnderGround_Crypter_by_Booster2000_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }
    condition:
        $a at pe.entry_point
}

rule PocketPC_ARM_h {
    strings:
        $a = { F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_DLL_additional {
    strings:
        $a = { 48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 }
    condition:
        $a at pe.entry_point
}

rule DJoin_v07_public_xor_encryption_drmist_additional {
    strings:
        $a = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40 }
    condition:
        $a at pe.entry_point
}

rule The_Norton_Antivirus_Information_file_Hint_FILE_START {
    strings:
        $a = { 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point
}


rule Simple_UPX_Cryptor_V3042005_MANtiCORE {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Utah_RLE_Graphics_format {
    strings:
        $a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1802_p_Oreans_Technologies_additional {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v07_Cyberbob_ {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASDPack_asd {
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 }
        $b = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WinZip_32_bit_6x_additional {
    strings:
        $a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point
}

rule Windows_Animation_format {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Basic_Compiler_v560_1982_97_Hint_DOS_EP {
    strings:
        $a = { 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB }
    condition:
        $a at pe.entry_point
}

rule ASPack_102b_Solodovnikov_Alexey {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 2B 85 7D 7C 43 00 89 85 89 7C 43 00 80 BD 74 7C 43 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V0b_cyberbob_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10A_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule AverCryptor_102_beta_os1r1s {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EncryptPE_V22007121_WFS {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 45 4D 61 69 6C 3A 20 77 66 73 23 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SecuROM_V7X_Sony_DADC_20080114 {
    strings:
        $a = { 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 6C 24 1C C1 E2 00 8B 6C 24 0C 83 C4 18 9D ?? 74 12 81 04 24 ?? ?? ?? ?? ?? 81 04 24 C3 D1 FF 00 EB FA 6B 81 04 24 ?? ?? ?? ?? 0F AC F8 00 81 04 24 C2 04 00 3E FF 74 24 04 9D EB F5 EE 93 9D }
    condition:
        $a at pe.entry_point
}

rule nBinder_v40_additional {
    strings:
        $a = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }
    condition:
        $a at pe.entry_point
}

rule DSHIELD_additional {
    strings:
        $a = { 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_ {
    strings:
        $a = { C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 }
    condition:
        $a at pe.entry_point
}

rule Possibly_PCX_graphics_format_Hint_FILE_START_additional {
    strings:
        $a = { 10 ?? 01 }
    condition:
        $a at pe.entry_point
}

rule Petite_22_PE_DLL {
    strings:
        $a = { B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 00 00 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A 00 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 }
    condition:
        $a at pe.entry_point
}

rule UnderGround_Crypter_by_Booster2000 {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v1304_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 0? }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v4000053_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }
        $b = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_ASM {
    strings:
        $a = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v120_extra_2_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? 2D ?? ?? FA 8E D0 BC ?? ?? FB 2D ?? ?? 50 52 80 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_70_DLL_Method_3 {
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 }
    condition:
        $a at pe.entry_point
}

rule tElock_v041x {
    strings:
        $a = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 }
        $b = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule TMT_Pascal_v040 {
    strings:
        $a = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }
    condition:
        $a at pe.entry_point
}

rule PE_Pack_v10_ANAKiN {
    strings:
        $a = { 74 00 E9 ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_130824_Solodovnikov_Alexey {
    strings:
        $a = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Lockless_Intro_Pack_additional {
    strings:
        $a = { B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_117_DLL_LZMA {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 }
    condition:
        $a at pe.entry_point
}

rule SuperDAT_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D }
    condition:
        $a at pe.entry_point
}

rule Video_Lan_Client_UnknownCompiler {
    strings:
        $a = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_V03_V041_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0 }
    condition:
        $a at pe.entry_point
}

rule SMK_movie_file_Hint_FILE_START {
    strings:
        $a = { 53 4D 4B 32 }
    condition:
        $a at pe.entry_point
}

rule PE_Diminisher_v01_additional {
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 }
    condition:
        $a at pe.entry_point
}

rule JPEG_Graphics_format_p_description {
    strings:
        $a = { FF D8 FF FE 00 27 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Cpp_30_1990_additional {
    strings:
        $a = { 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V13X_vcasm_SignByfly {
    strings:
        $a = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Cpp_199092 {
    strings:
        $a = { B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 00 16 1F }
    condition:
        $a at pe.entry_point
}

rule FucknJoy_v10c_UsAr_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
    condition:
        $a at pe.entry_point
}

rule DJoin_07_public_RC4_encryption_drmist {
    strings:
        $a = { C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule WordPerfect_Graphics_format_Hint_FILE_START {
    strings:
        $a = { FF 57 50 43 10 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PESPin_v13_Cyberbob_h_additional {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A }
    condition:
        $a at pe.entry_point
}

rule May_be_Pklite_Header_Version_v6v2_extra_0_v5 {
    strings:
        $a = { ?? ?? 50 6B }
        $b = { ?? ?? 50 4B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_Patch_or_any_Version {
    strings:
        $a = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_additional {
    strings:
        $a = { 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule IDA_Interactive_Disassembler_database {
    strings:
        $a = { 49 44 41 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1322_Obsidium_Software_additional {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04 }
    condition:
        $a at pe.entry_point
}

rule Borland_Cpp_1991_additional {
    strings:
        $a = { 2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F }
    condition:
        $a at pe.entry_point
}

rule PE_PROTECT_09_additional {
    strings:
        $a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_10_Northfox {
    strings:
        $a = { E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00 }
    condition:
        $a at pe.entry_point
}

rule hmimys_Packer_10_hmimys_additional {
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 }
    condition:
        $a at pe.entry_point
}

rule EXE_Packer_v70_by_TurboPower_Software_additional {
    strings:
        $a = { 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE }
    condition:
        $a at pe.entry_point
}

rule Exe_Stealth_275a_WebtoolMaster {
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 }
        $b = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Install_Stub_32_bit_additional {
    strings:
        $a = { 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_LCC_Win32_DLL_Anorganix {
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_additional {
    strings:
        $a = { 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_h2 {
    strings:
        $a = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_h3 {
    strings:
        $a = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_224_StrongbitSoftComplete_Development_h1 {
    strings:
        $a = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }
    condition:
        $a at pe.entry_point
}

rule AsCrypt_V01_SToRM {
    strings:
        $a = { B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_v102_Vladimir_Sukhov_h {
    strings:
        $a = { 55 53 20 50 54 4F 20 00 }
        $b = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E BE 01 00 00 00 C1 E6 02 83 EC 04 87 DE 89 1C 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Armadillo_V540_Silicon_Realms_Toolworks_SignByfly_20080214 {
    strings:
        $a = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 C1 1B 00 00 59 89 7D FC FF 75 08 E8 B1 46 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 86 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 67 1A 00 00 59 C3 }
        $b = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule UNITA3_tm_by_Sanitary_Equipment_Research {
    strings:
        $a = { E8 ?? ?? 4D 5A 3E }
    condition:
        $a at pe.entry_point
}

rule ExeJoiner_10_Yoda_f2f {
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v120_extra_1_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? 8B FC 81 ?? ?? ?? 57 57 52 B9 ?? ?? BE ?? ?? 8B FE FD 49 74 ?? AD 92 03 C2 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v110_v111_additional {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB }
    condition:
        $a at pe.entry_point
}

rule PRO_MIDI_Music_file {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 52 4D 49 44 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V18X_V2X_Oreans_Technologies_20080131 {
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 }
    condition:
        $a at pe.entry_point
}

rule STUD_RC4_10_Jamie_Edition_ScanTime_UnDetectable_by_MarjinZ {
    strings:
        $a = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00 }
        $b = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Anslym_Crypter {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3 }
        $b = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_Cpp_30_EXE {
    strings:
        $a = { BA 00 00 2E 89 16 00 00 B4 30 00 00 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 E8 00 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F FC F2 AE E3 00 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 00 00 D3 E3 83 C3 00 83 }
    condition:
        $a at pe.entry_point
}

rule tElock_10_private_tE {
    strings:
        $a = { E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 }
    condition:
        $a at pe.entry_point
}

rule PDS_graphics_file_format_additional {
    strings:
        $a = { 49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20 }
    condition:
        $a at pe.entry_point
}

rule RAR_SFX_Modification_Possible_Malware {
    strings:
        $a = { 80 3A 52 75 2D 80 7A 01 ?? 75 27 80 7A 02 ?? 75 21 80 7A 03 ?? 75 1B 80 7A 04 ?? 75 15 80 7A 05 ?? 75 0F 80 7A 06 ?? 75 09 }
    condition:
        $a at pe.entry_point
}

rule BGI_Stroked_Font_v11_additional {
    strings:
        $a = { 50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31 }
    condition:
        $a at pe.entry_point
}

rule _VMProtect_v125_PolyTech_additional {
    strings:
        $a = { 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 }
    condition:
        $a at pe.entry_point
}

rule Petite_v_after_v14_Hint_WIN_EP {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_V212_Fisun_AV_additional {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CD 0D }
    condition:
        $a at pe.entry_point
}

rule RLPack_V120_Dll_LZMA_430_ap0xnbsp_nbsp_SignByfly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PluginToExe_v100_BoB_BobSoft_additional {
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF }
    condition:
        $a at pe.entry_point
}

rule SimplePack_V1X_Method2_bagie_additional {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point
}

rule Vx_ACME_Clonewar_Mutant_additional {
    strings:
        $a = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_006_Dmitry_Andreev {
    strings:
        $a = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
        $b = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Basic_50_additional {
    strings:
        $a = { FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule LamerStop_v10c_c_Stefan_Esser_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }
    condition:
        $a at pe.entry_point
}

rule Upx_v12_Marcus_Lazlo_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 }
    condition:
        $a at pe.entry_point
}

rule RLPack_11_BasicEdition_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }
    condition:
        $a at pe.entry_point
}

rule RAR_SFX_Archive_1 {
    strings:
        $a = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58 }
    condition:
        $a at pe.entry_point
}

rule SecuPack_v15_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }
    condition:
        $a at pe.entry_point
}

rule AIN_Archive_Hint_FILE_START {
    strings:
        $a = { 21 11 00 }
    condition:
        $a at pe.entry_point
}

rule Petite_14_c1998_99_Ian_Luck_additional {
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_V12DLLDemo_SIS_Team {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2501_Jitit {
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point
}

rule nSPack_1x2x_North_StarLiu_Xing_Ping {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 }
    condition:
        $a at pe.entry_point
}

rule EPExE_Pack_V14_lite_final_6aHguT_g_l_u_k {
    strings:
        $a = { 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12 }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_v01b_v03b_v03_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }
        $b = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WinUpack_v039_final_By_Dwing_c2005_h1_additional {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Amiga_IFFILBM_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }
    condition:
        $a at pe.entry_point
}

rule XPack_145_EXE {
    strings:
        $a = { 8B EC EB 01 E8 B8 18 04 FF E0 FA 33 C0 8E D0 BC 10 00 2E 8F 06 57 04 2E 8F 06 5C 04 EB 01 9A 0E BB 4C 04 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00 }
    condition:
        $a at pe.entry_point
}

rule Apex_30_alpha_500mhz_additional {
    strings:
        $a = { 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point
}

rule RosAsm_2050a_Betov {
    strings:
        $a = { 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_minimum_protection_wwwstrongbitcom_additional {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_01_additional {
    strings:
        $a = { EB ?? ?? BE ?? ?? BF ?? ?? 2E }
    condition:
        $a at pe.entry_point
}

rule Trap_120_EXE {
    strings:
        $a = { E8 00 00 5B 83 C3 28 90 8B D3 E8 01 00 01 5B 2E 80 3F 00 74 16 90 90 8B DA B9 A2 03 2E C0 07 39 2E 80 37 00 2E 80 2F 00 43 E2 F1 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Yodas_Protector_102_Anorganix {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 E9 }
    condition:
        $a at pe.entry_point
}

rule BITLOK_31 {
    strings:
        $a = { EB 06 B0 65 B4 4C CD 21 B4 30 CD 21 3C 03 72 F2 2E 8C 1E 00 00 8C DB 83 C3 10 2E 01 1E 3A 00 0E 1F EB 25 EA 83 F9 01 EB 0C EA 5F EB 03 EB F5 EA BE 61 00 EB 3D 74 56 EB 34 EA BF D2 00 EB 38 EA EB 3D 81 FE CF 00 EB 08 33 C0 EB EE EA EB F1 EA }
    condition:
        $a at pe.entry_point
}

rule DBPE_v153_additional {
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }
    condition:
        $a at pe.entry_point
}

rule E_language {
    strings:
        $a = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }
    condition:
        $a at pe.entry_point
}

rule UPX_v0896_v102_v105_v122_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        $a at pe.entry_point
}

rule nPack_v11_250_Beta_NEOx_additional {
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_Dev_Cpp_v4991_h_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point
}

rule Enigma_protector_110_unregistered {
    strings:
        $a = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
        $b = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule XPack_166_EXE {
    strings:
        $a = { B8 8C D3 15 33 75 8B EC EB 01 E8 B8 99 03 FF E0 FA BC 10 00 33 C0 8E D0 2E 8F 06 D8 03 2E 8F 06 DD 03 EB 01 9A 0E BB CD 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 }
    condition:
        $a at pe.entry_point
}

rule EmbedPE_V1X_cyclotron_additional {
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_LZMA_430_ap0x_Sign_by_fly {
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Yodas_Protector_102_Anorganix {
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 }
    condition:
        $a at pe.entry_point
}

rule Password_Protector_for_the_UPX_030_g0d {
    strings:
        $a = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86 }
        $b = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Amiga_AIFF_8SFX_Audio_file_Hint_FILE_START {
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_C_v20_additional {
    strings:
        $a = { 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1331_Obsidium_Software_h {
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB }
    condition:
        $a at pe.entry_point
}

rule UPX_290_LZMA_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
    condition:
        $a at pe.entry_point
}

rule ASPack_v102a {
    strings:
        $a = { 60 E8 5D 81 ED 96 78 43 B8 90 78 43 03 C5 2B 85 7D 7C 43 89 85 89 7C 43 80 BD 74 7C }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v102b {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Unpacked_BS_SFX_Archive_v19_Hint_DOS_EP {
    strings:
        $a = { 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 }
    condition:
        $a at pe.entry_point
}

rule fasm_Tomasz_Grysztar_flat {
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
        $b = { 6A 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Nullsoft_Install_System_1xx {
    strings:
        $a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
        $b = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Go32Stub_v200_DOS_Extender {
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22004616_V22006630_WFS_Sign_by_fly {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Alpha_BMP_graphics_file_Hint_FILE_START {
    strings:
        $a = { FF FF 00 01 64 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_1300_Obsidium_Software_additional {
    strings:
        $a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
    condition:
        $a at pe.entry_point
}

rule Anti007_NsPacK_Private {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule hyings_PE_Armor_hyingCCG_additional {
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_239_DLL_minimum_protection_additional {
    strings:
        $a = { 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87 }
    condition:
        $a at pe.entry_point
}

rule PE_Armor_v07x_Hying {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 }
    condition:
        $a at pe.entry_point
}

rule NsPack_V11_LiuXingPing_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v10_CGSoftLabs_additional {
    strings:
        $a = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 }
    condition:
        $a at pe.entry_point
}

rule TXT2COM_Read_A_Matic_v10_Hint_DOS_EP {
    strings:
        $a = { B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_22004616_22006630_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Virtualization_Suite_V3348_V3350_Thinstall_Company_20080318 {
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 59 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 AC 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11_MTEc_additional {
    strings:
        $a = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v108x_additional {
    strings:
        $a = { 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point
}

rule MSCC_v10cs_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 0E 07 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 B9 ?? ?? BE ?? ?? AC CC 98 }
    condition:
        $a at pe.entry_point
}

rule Crunch_5_Fusion_4_Bit_Arts {
    strings:
        $a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 }
        $b = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AMGC_Archive_Hint_FILE_START {
    strings:
        $a = { AD 36 22 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_REALBasic_Anorganix {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule EZIP_v10 {
    strings:
        $a = { E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C }
    condition:
        $a at pe.entry_point
}

rule SCRAM_vC5_additional {
    strings:
        $a = { B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule CA_Visual_Objects_20_25_additional {
    strings:
        $a = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
    condition:
        $a at pe.entry_point
}

rule Turbo_or_Borland_Pascal_v7x_Unit_Hint_FILE_START {
    strings:
        $a = { 54 50 55 51 00 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v102_v103_DLL_BoB_BobSoft {
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Krypton_v04_additional {
    strings:
        $a = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06 }
    condition:
        $a at pe.entry_point
}

rule Video_Lan_Client_UnknownCompiler_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v036_alpha {
    strings:
        $a = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Gleam_100_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
    condition:
        $a at pe.entry_point
}

rule Themida_v2065_or_newer_c2009_Oreans_Technologies {
    strings:
        $a = { 52 BA 64 00 00 00 EB 1B B9 00 10 00 00 EB 05 03 C1 03 C3 49 0B C9 75 F7 52 54 54 FF 15 }
    condition:
        $a at pe.entry_point
}

rule Kodak_Color_management_for_Windows_file {
    strings:
        $a = { ?? ?? ?? ?? 4B 43 4D 53 }
        $b = { 4B 43 4D 53 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VITec_graphics_file_format_Hint_FILE_START {
    strings:
        $a = { 00 5B 07 20 00 00 00 2C }
    condition:
        $a at pe.entry_point
}

rule GP_Install_v50332_additional {
    strings:
        $a = { 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0 }
    condition:
        $a at pe.entry_point
}

rule VProtector_0X_12X_vcasm {
    strings:
        $a = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }
    condition:
        $a at pe.entry_point
}

rule AVPACK_v120_additional {
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }
    condition:
        $a at pe.entry_point
}

rule Pe123_v2006412 {
    strings:
        $a = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }
        $b = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Shrink_10 {
    strings:
        $a = { 50 9C FC BE 1F 01 BF 00 7E 57 B9 34 00 F3 A4 8B 0E 1C 01 BE 52 01 BF E8 80 F3 A4 C3 00 00 00 BE E8 80 8B 0E 1C 01 8A 26 1E 01 BF 00 01 57 AC 3A C4 74 10 8A D8 AA E2 F6 5B 9D 58 53 8B D9 8B F1 8B F9 C3 AC 0A C0 74 ED 49 86 C3 AA FE CB 75 FB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Gleam_100_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point
}

rule WinKript_v10_Mr_Crimson {
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_2122_exe_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_UPX_06_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V07_cyberbob_20080312 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 01 ?? 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB ?? 83 04 24 0C C3 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cue {
    strings:
        $a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 }
    condition:
        $a at pe.entry_point
}

rule SimbiOZ_Russian_PacK {
    strings:
        $a = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }
    condition:
        $a at pe.entry_point
}

rule Themida_v2010_v2065_or_newer {
    strings:
        $a = { 83 EC 04 50 53 E8 ?? 00 00 00 CC 58 8B D8 40 2D 00 ?? ?? 00 2D ?? ?? ?? 00 05 ?? ?? ?? 00 80 3B CC 75 19 C6 03 00 BB 00 10 00 00 68 }
    condition:
        $a at pe.entry_point
}

rule Wavelet_compressed_bitmap_Hint_FILE_START {
    strings:
        $a = { 57 49 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ASM_additional {
    strings:
        $a = { E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 }
    condition:
        $a at pe.entry_point
}

rule Upack_V03X_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E }
    condition:
        $a at pe.entry_point
}

rule MEGALITE_v120a {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90 }
    condition:
        $a at pe.entry_point
}

rule Upack_V020_Dwing_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_BJFNT_12_Anorganix {
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }
    condition:
        $a at pe.entry_point
}

rule PluginToExe_v100_BoB_BobSoft {
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00 }
        $b = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CrypKey_Kenonic_Controls_h {
    strings:
        $a = { 8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 }
    condition:
        $a at pe.entry_point
}

rule UPX_Modified_Stub_c_Farb_rausch_Consumer_Consulting_additional {
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_11_12_vcasm {
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D }
    condition:
        $a at pe.entry_point
}

rule Upack_V036_V037_DLL_Dwing {
    strings:
        $a = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 }
        $b = { 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule dUP_v2x_Patcher_wwwdiablo2oo2cjbnet_additional {
    strings:
        $a = { 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Resource_Cursors_file_Hint_FILE_START {
    strings:
        $a = { 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16 }
    condition:
        $a at pe.entry_point
}

rule W32Jeefo_PE_File_Infector {
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point
}

rule Fusion_V10_jaNooNi {
    strings:
        $a = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule Fish_Pe_Packer_V102_hellfish_20090120 {
    strings:
        $a = { 60 E8 07 00 00 00 61 68 ?? ?? ?? ?? C3 5E 56 8B 56 02 ?? ?? ?? AD 01 D0 5B 36 89 43 02 66 3E C7 43 FA EB 05 53 AD 01 D0 89 C3 C7 43 FC 00 10 00 00 C7 43 F8 00 80 00 00 89 53 F4 AD 01 D0 89 43 F0 AD 01 D0 89 43 10 52 6A 04 FF 73 FC AD 50 6A 00 3E FF 53 08 89 C5 6A 04 FF 73 FC AD 50 6A 00 3E FF 53 08 89 C1 5A 83 EE 08 AD 50 55 AD AD 50 AD 01 D0 50 6A 02 6A 00 6A ?? 51 89 CF FF 53 10 83 C4 20 FF 73 F8 6A 00 57 FF 53 0C }
    condition:
        $a at pe.entry_point
}

rule nPack_V112502006Beta_NEOxuinC {
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v276_WebToolMaster_additional {
    strings:
        $a = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }
    condition:
        $a at pe.entry_point
}

rule ResCrypt_v102_additional {
    strings:
        $a = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 }
    condition:
        $a at pe.entry_point
}

rule Windows_or_OS2_Graphics_format {
    strings:
        $a = { 42 4D }
    condition:
        $a at pe.entry_point
}

rule Turbo_Pascal_v40_Unit {
    strings:
        $a = { 54 50 55 30 00 }
    condition:
        $a at pe.entry_point
}

rule AVP_Inspector_Database_Hint_FILE_START {
    strings:
        $a = { 47 68 6F 73 74 20 42 75 73 74 65 72 }
    condition:
        $a at pe.entry_point
}

rule Petite_13_c1998_Ian_Luck {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }
        $b = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule N_Joy_13_NEX {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extr_Passwcheck_Vir_shield_additional {
    strings:
        $a = { 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule FSG_120_Eng_dulekxt_Microsoft_Visual_Cpp_60 {
    strings:
        $a = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }
        $b = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule NTkrnl_Secure_Suite_NTkrnl_Team_Blue {
    strings:
        $a = { 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_Component_additional {
    strings:
        $a = { C3 E9 ?? ?? ?? FF 8D 40 }
    condition:
        $a at pe.entry_point
}

rule Software_Compress_V14_BG_Software_Protect_Technologies {
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 }
    condition:
        $a at pe.entry_point
}

rule PEcrypt_by_archphase {
    strings:
        $a = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF }
        $b = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule tElock_v060 {
    strings:
        $a = { E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 }
    condition:
        $a at pe.entry_point
}

rule XM_music_file_additional {
    strings:
        $a = { 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1990_or_Turbo_C_1988_additional {
    strings:
        $a = { BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule WinKript_100 {
    strings:
        $a = { 33 C0 8B B8 00 00 00 00 8B 90 04 00 00 00 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 00 00 00 FF }
    condition:
        $a at pe.entry_point
}

rule PECompact_v25_Retail_Slim_Loader_Bitsum_Technologies_additional {
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point
}

rule MEW_5_10_Northfox {
    strings:
        $a = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 }
    condition:
        $a at pe.entry_point
}

rule PeX_099 {
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D5 22 40 00 E8 06 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 27 23 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 C1 01 00 00 8D 52 F9 E8 01 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule RE_Crypt_v07x_Crudd_RET_h1 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B }
    condition:
        $a at pe.entry_point
}

rule RE_Crypt_v07x_Crudd_RET_h2 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_DLL_LZMA_Ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
    condition:
        $a at pe.entry_point
}

rule WebCops_DLL_additional {
    strings:
        $a = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }
    condition:
        $a at pe.entry_point
}

rule PECompact_v167_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 }
    condition:
        $a at pe.entry_point
}

rule Shadow_10_beta {
    strings:
        $a = { B9 00 00 BB 00 00 BE 03 01 BF 00 01 AD 33 C3 AB 86 DF F7 D3 E2 F6 68 00 01 C3 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2xx_compressed_resources_wwwstrongbitcom_SignByhaggar {
    strings:
        $a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }
    condition:
        $a at pe.entry_point
}

rule NET_executable {
    strings:
        $a = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }
        $b = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Patch_Creation_Wizard_v12_Memory_Patch_additional {
    strings:
        $a = { 6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_GRUNT4Family_Hint_DOS_EP {
    strings:
        $a = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }
    condition:
        $a at pe.entry_point
}

rule CrackStop_v101_c_Stefan_Esser_1997 {
    strings:
        $a = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }
    condition:
        $a at pe.entry_point
}

rule EXECrypt_10_ReBirth {
    strings:
        $a = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule Vx_Einstein {
    strings:
        $a = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }
    condition:
        $a at pe.entry_point
}

rule SCAN_AV_additional {
    strings:
        $a = { 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule NsPack_v31_North_Star_h {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
    condition:
        $a at pe.entry_point
}

rule ASPack_v211b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_V031_emadicius_ {
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v11_by_cyberbob {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V2223_compressed_code_wwwstrongbitcom {
    strings:
        $a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point
}

rule Turbo_or_Borland_Pascal_v7x_Unit {
    strings:
        $a = { 54 50 55 51 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_NorthStar_PE_Shrinker_13_Anorganix {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v25x_v26x_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
    condition:
        $a at pe.entry_point
}

rule Mew_10_v10_Eng_Northfox_additional {
    strings:
        $a = { 33 C0 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point
}

rule Themida_1201_Oreans_Technologies_h {
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }
        $b = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ASPack_v105b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }
    condition:
        $a at pe.entry_point
}

rule PeX_v099_Eng_bartCrackPl_additional {
    strings:
        $a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_015b {
    strings:
        $a = { EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 70 23 40 00 52 8B 54 24 08 E8 A2 FD FF FF 89 95 D0 2A 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie2100 {
    strings:
        $a = { E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC }
    condition:
        $a at pe.entry_point
}

rule Protect_40_EXE {
    strings:
        $a = { 8C DB 0E 0E 1F 07 B9 00 00 E8 00 00 5E 81 C6 11 00 89 F7 AC 34 00 AA E2 FA 8E DB 8E C3 }
    condition:
        $a at pe.entry_point
}

rule PCIENC_Cryptor_additional {
    strings:
        $a = { 06 50 43 49 45 4E }
    condition:
        $a at pe.entry_point
}

rule Safedisc_V450000_Macrovision_Corporation_SignByfly_20080117_additional {
    strings:
        $a = { 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 }
    condition:
        $a at pe.entry_point
}

rule Upack_V028_V0399_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0 }
    condition:
        $a at pe.entry_point
}

rule X_Pack_v142_additional {
    strings:
        $a = { 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_PaCK_v10_C_Copyright_1998_by_ANAKiN {
    strings:
        $a = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }
        $b = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule yodas_Protector_V10b_Ashkbiz_Danehkar {
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule TPACK_v17_Archive {
    strings:
        $a = { ?? 54 50 41 43 ?? 31 2E 37 }
        $b = { 54 50 41 43 ?? 31 2E 37 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEQuake_V006_forgot {
    strings:
        $a = { E8 A5 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule aPack_v098_m_Hint_HDR_FILESIZE_16 {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }
    condition:
        $a at pe.entry_point
}

rule dUP_2x_Patcher_wwwdiablo2oo2cjbnet {
    strings:
        $a = { 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V112_V114_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V520Beta1_Silicon_Realms_Toolworks_SignByfly_20080214 {
    strings:
        $a = { E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13 00 00 59 89 7D FC FF 75 08 E8 AC 47 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 7C D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 AD 11 00 00 59 C3 }
        $b = { E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_v10059_Final {
    strings:
        $a = { E8 AF }
        $b = { E8 AB 1C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule CExe_v10a_additional {
    strings:
        $a = { 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }
    condition:
        $a at pe.entry_point
}

rule UPX_wwwupxsourceforgenet {
    strings:
        $a = { 60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF }
        $b = { 60 BE ?? ?0 ?? 00 8D BE ?? ?? F? FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SnoopStop_v115_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? EB ?? 20 ?? ?? ?? 73 ?? 20 ?? ?? 41 1A 05 }
    condition:
        $a at pe.entry_point
}

rule Petite_13_c1998_Ian_Luck_h {
    strings:
        $a = { ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3 }
        $b = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule AINEXE_v230 {
    strings:
        $a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }
    condition:
        $a at pe.entry_point
}

rule Netopsystems_FEAD_Optimizer {
    strings:
        $a = { E8 00 00 00 00 58 BB 00 00 40 00 8B }
        $b = { 60 BE 00 50 43 00 8D BE 00 C0 FC FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VProtector_11A_12_vcasm {
    strings:
        $a = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }
    condition:
        $a at pe.entry_point
}

rule UPX_030_040_COM {
    strings:
        $a = { B9 00 00 BE 00 00 BF C0 FF BD FF FF FD F3 A4 FC F7 E1 93 87 F7 83 C6 00 57 }
    condition:
        $a at pe.entry_point
}

rule Unknown_UPX_modifyer_additional {
    strings:
        $a = { E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_PEtite_21_emadicius {
    strings:
        $a = { B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point
}

rule RPolyCryptor_V142_Vaska {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CryptCom_v11_additional {
    strings:
        $a = { BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3 }
    condition:
        $a at pe.entry_point
}

rule WinZip_32_bit_SFX_v90_module_Winzip {
    strings:
        $a = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A }
    condition:
        $a at pe.entry_point
}

rule PE_Crypt32_Console {
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Borland_Delphi_60_70_Anorganix {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }
    condition:
        $a at pe.entry_point
}

rule Spirit_15 {
    strings:
        $a = { E9 00 00 5B 24 55 50 44 FB 32 2E 31 5D }
    condition:
        $a at pe.entry_point
}

rule BJFnt_v11b_MARQUiS {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 }
    condition:
        $a at pe.entry_point
}

rule Upack_V010_V012_Dwing_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V2xx_max_compressed_resources_wwwstrongbitcom {
    strings:
        $a = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v183_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule CorelDraw_CMX_Graphics_format {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }
    condition:
        $a at pe.entry_point
}

rule REC_v032_additional {
    strings:
        $a = { 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_274 {
    strings:
        $a = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 }
        $b = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Packman_0001_bubba {
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_14_Hint_DOS_EP {
    strings:
        $a = { 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_273 {
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 }
    condition:
        $a at pe.entry_point
}

rule MEW_11_SE_v11_Northfox_HCC_additional {
    strings:
        $a = { E9 ?? ?? ?? FF 0C }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v30 {
    strings:
        $a = { 55 8B EC 83 }
        $b = { 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_C_Library_1985 {
    strings:
        $a = { BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73 }
    condition:
        $a at pe.entry_point
}

rule Cygwin32_additional {
    strings:
        $a = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PMW1_Executable_Image_using_DOSExtender_Hint_FILE_START {
    strings:
        $a = { 50 4D 57 31 }
    condition:
        $a at pe.entry_point
}

rule ActiveMARKTM_R5311140_Trymedia {
    strings:
        $a = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_07_additional {
    strings:
        $a = { 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v300_v301_Extractable_additional {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35 }
    condition:
        $a at pe.entry_point
}

rule Petite_22_c1998_99_Ian_Luck_additional {
    strings:
        $a = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
    condition:
        $a at pe.entry_point
}

rule Vx_Eddie1028 {
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
    condition:
        $a at pe.entry_point
}

rule PE_Protector_V260hyings_PE_Armor_V0460_modify_Engprog {
    strings:
        $a = { 55 53 51 52 56 57 E8 E1 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100c_2_additional {
    strings:
        $a = { BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v110p1_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Pack_Master_10_PEX_Clone_Anorganix_additional {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9 }
    condition:
        $a at pe.entry_point
}

rule NsPacK_Net_LiuXingPing {
    strings:
        $a = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }
    condition:
        $a at pe.entry_point
}

rule Xtreme_Protector_106 {
    strings:
        $a = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }
    condition:
        $a at pe.entry_point
}

rule Fish_Pe_Packer_V104_V10X_hellfish_20090120 {
    strings:
        $a = { 60 B8 ?? ?? ?? ?? FF D0 5A 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 57 56 53 55 89 E5 8B 45 20 01 45 24 50 FC 8B 75 18 01 75 1C 56 8B 75 14 AD 92 52 8A 4E FE 83 C8 FF D3 E0 F7 D0 50 88 F1 83 C8 FF D3 E0 F7 D0 50 00 D1 89 F7 83 EC 0C 29 C0 40 50 50 50 50 50 57 AD 89 C1 AD 29 F6 56 83 CB FF F3 AB 6A 05 59 E8 9C 02 00 00 E2 F9 8D 36 8D 3F 8B 7D FC 8B 45 F0 2B 7D 20 21 F8 89 45 E8 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V500_V5X_Dll_Silicon_Realms_Toolworks_SignByfly {
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 E8 ?? ?? ?? ?? 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 ?? ?? ?? ?? 59 89 7D FC FF 75 08 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 ?? ?? ?? ?? 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 ?? ?? ?? ?? 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 ?? ?? ?? ?? 59 C3 }
        $b = { 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule bambam_V001_bedrock_Sign_by_fly {
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 }
    condition:
        $a at pe.entry_point
}

rule UPX_020_COM {
    strings:
        $a = { B9 00 00 BE 00 00 BF C0 FF BD FF FF FD F3 A4 FC F7 E1 93 87 F7 83 C6 31 57 57 E9 3C FE 55 50 58 21 03 01 02 87 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32_additional {
    strings:
        $a = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_REALBasic_Anorganix {
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }
    condition:
        $a at pe.entry_point
}

rule HackStop_119_build_195198_EXE {
    strings:
        $a = { 50 52 E8 02 00 41 24 5A 1E 0E 1F B4 09 CD 21 1F 5A 58 56 BE EB 04 5E EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 56 BE EB 04 5E EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 56 BE EB 04 5E EB FB 9A EB 02 D8 88 5A 1F 50 52 E8 02 }
    condition:
        $a at pe.entry_point
}

rule MingWin32_Dev_Cpp_v4x_h {
    strings:
        $a = { 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_22X_2308_Jitit {
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_WATCOM_CCpp_EXE_Anorganix {
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 }
    condition:
        $a at pe.entry_point
}

rule AntiVirus_Vaccine_v103_Hint_DOS_EP {
    strings:
        $a = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }
    condition:
        $a at pe.entry_point
}

rule MinGW_GCC_v2x {
    strings:
        $a = { 55 89 E5 FF }
        $b = { 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule VProtector_V10D_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule Vx_Necropolis_additional {
    strings:
        $a = { B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 }
    condition:
        $a at pe.entry_point
}

rule Vx_Ncu_Li1688_Hint_DOS_EP {
    strings:
        $a = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }
    condition:
        $a at pe.entry_point
}

rule SCRAM_vC5_Hint_DOS_EP_p_10 {
    strings:
        $a = { B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_With_CRC_check_additional {
    strings:
        $a = { B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point
}

rule Private_EXE_Protector_18_SetiSoft {
    strings:
        $a = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }
        $b = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule iPB_Protect_013_017_forgot_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule fds0ft_c0m_pr0tect_v04b_additional {
    strings:
        $a = { 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule tElock_v071b2_additional {
    strings:
        $a = { 60 E8 44 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v305c4_Extractable_p_Virus_Shield_Hint_DOS_EP_4_ {
    strings:
        $a = { 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule Unnamed_Scrambler_11C_p0ke_additional {
    strings:
        $a = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1304_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
        $b = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_038_beta_Dwing {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Hyper_Archive {
    strings:
        $a = { 1A 53 54 }
        $b = { 1A 48 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_8 {
    strings:
        $a = { 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 }
        $b = { E8 ?? ?? 00 00 E9 ?? ?? FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Gamehouse_Media_Protector_Version_Unknown {
    strings:
        $a = { 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_023_alpha_Ryd {
    strings:
        $a = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V21X_SoftCompletecom_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }
    condition:
        $a at pe.entry_point
}

rule Matrix_Dongle_TDi_GmbH_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
    condition:
        $a at pe.entry_point
}

rule NTPacker_10_ErazerZ {
    strings:
        $a = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31 }
        $b = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Morphine_v12_v13 {
    strings:
        $a = { FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0 }
        $b = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Crypta_II_30 {
    strings:
        $a = { 26 83 36 53 A3 00 3B C4 5B 53 52 BA EB 04 5A EB FB 79 B9 37 00 81 F1 C1 11 51 B9 EB 04 59 EB FB 09 81 F1 C1 11 2E 80 37 80 43 E2 F9 3A D5 1E F7 C1 6A 4A F9 72 01 09 8E D9 90 53 BB EB 04 5B EB FB 09 F7 16 07 00 F7 C1 13 FE 52 BA EB 05 5A EB }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Borland_Delphi_30_additional {
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Can2Exe_v001_Hint_DOS_EP {
    strings:
        $a = { 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73 }
    condition:
        $a at pe.entry_point
}

rule AI1_Creator_1_Beta_2_by_MZ_additional {
    strings:
        $a = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
    condition:
        $a at pe.entry_point
}

rule SmokesCrypt_v12_Smoke {
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B8 ?? ?? ?? 00 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_v038_Beta_Strip_base_relocation_table_Option_Dwing {
    strings:
        $a = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }
    condition:
        $a at pe.entry_point
}

rule PC_Shrinker_v029_additional {
    strings:
        $a = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
    condition:
        $a at pe.entry_point
}

rule ExeStealth_WebToolMaster_additional {
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252_beta2_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24 }
    condition:
        $a at pe.entry_point
}

rule CRYPTEXE_v104_c_DOP_Hint_DOS_EP {
    strings:
        $a = { EB ?? 8B DC EB ?? EA ?? ?? ?? ?? 01 EA 83 FC ?? 74 ?? EB }
    condition:
        $a at pe.entry_point
}

rule Gleam_100_additional {
    strings:
        $a = { 83 EC 0C 53 56 57 E8 24 02 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Modification_of_Hi924_additional {
    strings:
        $a = { 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B }
    condition:
        $a at pe.entry_point
}

rule Vcasm_Protector_10e_vcasm {
    strings:
        $a = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D }
    condition:
        $a at pe.entry_point
}

rule ACProtectUltraProtect_10X_20X_RiSco_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 }
    condition:
        $a at pe.entry_point
}

rule vprotector_13_vcasm {
    strings:
        $a = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 }
    condition:
        $a at pe.entry_point
}

rule RJoiner_12a_Vaska {
    strings:
        $a = { 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11 }
        $b = { 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Hitachi_Raster_Format_graphics_format_Hint_FILE_START {
    strings:
        $a = { 43 41 44 43 2F 4B 52 20 52 53 54 }
    condition:
        $a at pe.entry_point
}

rule UPX_125_Markus_Laszlo {
    strings:
        $a = { 31 2E 32 35 00 55 50 58 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_133_21_Registered_Alexey_Solodovnikov_additional {
    strings:
        $a = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_440_Silicon_Realms_Toolworks {
    strings:
        $a = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 }
        $b = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 61 69 6C 65 64 20 43 52 43 20 63 68 65 63 6B 00 00 00 00 52 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Turbo_Cpp_30_1990_Hint_DOS_EP {
    strings:
        $a = { 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point
}

rule Private_Personal_Packer_PPP_v102_ConquestOfTroycom_additional {
    strings:
        $a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PE_Intro_10 {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
    condition:
        $a at pe.entry_point
}

rule WIBU_Key_V410A_WIBU_SYSTEMS_AG {
    strings:
        $a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_SKE_21x_exe_Alexey_Solodovnikov_h {
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_1031_Ashkibiz_Danehlar {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_2xx_max_compressed_resources {
    strings:
        $a = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_12_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        $a at pe.entry_point
}

rule OptLink_Pass_1 {
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 C2 10 16 07 0E 1F 01 16 4E 01 01 16 52 01 33 F6 33 FF B9 AD 00 F3 A5 06 B8 30 00 50 BD 01 00 CB FD 8B 1E 54 01 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 C9 03 C9 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v1_Vaska_additional {
    strings:
        $a = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_290_EXE_X86_CRT_LIB {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1331_Obsidium_Software_h_additional {
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }
    condition:
        $a at pe.entry_point
}

rule Jovian_VI_graphics_file {
    strings:
        $a = { 56 49 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1311_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point
}

rule DrWeb_v400p_Virus_DataBase {
    strings:
        $a = { 49 44 52 57 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006710_V220070411_WFS_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Visual_Cpp_50_SP3_debug {
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 94 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF 15 00 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_v037_v038_Beta_Strip_base_relocation_table_Option {
    strings:
        $a = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }
    condition:
        $a at pe.entry_point
}

rule DalKrypt_10_by_DalKiT_additional {
    strings:
        $a = { 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }
    condition:
        $a at pe.entry_point
}

rule Com4mail_v10 {
    strings:
        $a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }
    condition:
        $a at pe.entry_point
}

rule ARJ_SFX_Custom {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A }
        $b = { 60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PEX_v099_bart {
    strings:
        $a = { 68 FA 30 41 00 C3 20 20 }
    condition:
        $a at pe.entry_point
}

rule Setup_Factory_6003_Setup_Launcher {
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_Solodovnikov_Alexey {
    strings:
        $a = { 68 01 F0 58 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule FreeJoiner_Small_build_014_021024_027_GlOFF {
    strings:
        $a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PH_Icons_file_Trilobyte_Hint_FILE_START {
    strings:
        $a = { 69 63 6F 6E 01 00 10 00 10 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v1xx_Nullsoft {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 80 40 00 68 00 04 00 00 FF 15 ?? 81 40 00 50 56 FF 15 ?? 81 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D F4 81 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 }
    condition:
        $a at pe.entry_point
}

rule CC_v261_Beta_additional {
    strings:
        $a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_v60_KOL {
    strings:
        $a = { 55 8B EC 83 C4 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 }
        $b = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressorStandardV1701_CGSoftLabs_20090603 {
    strings:
        $a = { 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 A0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 80 74 61 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 13 83 ?? ?? ?? ?? ?? ?? 74 0A E9 66 0A 00 00 E9 61 0A 00 00 83 ?? ?? ?? ?? ?? ?? 74 05 E9 BE 09 00 00 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 AD 17 00 00 59 50 6A 01 E8 A4 17 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 98 0A 00 00 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 D0 FD FF FF 68 04 01 00 00 8D 85 D8 FD FF FF 50 FF ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 D7 FD FF FF 89 85 A4 FD FF FF 8B 85 A4 FD FF FF 0F BE 00 83 F8 5C }
    condition:
        $a at pe.entry_point
}

rule Obsidium_v1250_Obsidium_Software_ {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point
}

rule Petite_12_additional {
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }
    condition:
        $a at pe.entry_point
}

rule _VMProtect_v125_PolyTech {
    strings:
        $a = { 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 }
        $b = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode_okkixot {
    strings:
        $a = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }
        $b = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_Patch_Sign_by_hot_UNP_additional {
    strings:
        $a = { 81 3A 00 00 00 02 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CERBERUS_v20_additional {
    strings:
        $a = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point
}

rule tElock_v04x_v05x {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Virtual_Image_Maker_Graphics_file {
    strings:
        $a = { 53 4F 4D 56 }
    condition:
        $a at pe.entry_point
}

rule CorelDraw_CMX_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }
    condition:
        $a at pe.entry_point
}

rule Vx_Horse1776 {
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }
    condition:
        $a at pe.entry_point
}

rule INCrypter_03_INinY_by_z3e_NiFe_additional {
    strings:
        $a = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_additional {
    strings:
        $a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v251 {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v250 {
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v253 {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v252 {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_v02_v02b_v02b2_additional {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point
}

rule RLPack_Full_Edition_V11X_ap0x {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule N0Ps_Shit_Protector_0002b {
    strings:
        $a = { 9C 58 25 FF FE 50 9D 8B D4 8C D3 8E D3 BC 03 00 8B E2 8E D3 9C 58 A9 00 01 75 01 2E E8 00 00 5D 81 ED B2 07 B8 A8 07 03 C5 2E 81 B6 B8 07 FF FE 50 58 8B F4 2E 8B BE C3 07 81 EF 4E 58 2B F7 8B 1C 83 C3 32 FF E3 2E 33 FF 8E DF 8E C7 8B F7 FA }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Morphine_12_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_102_103_Ashkbiz_Danehkar_additional {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point
}

rule ASPack_211_Solodovnikov_Alexey {
    strings:
        $a = { 60 E9 3D 04 00 00 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Dll_LZMA_430_ap0x_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0977_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }
    condition:
        $a at pe.entry_point
}

rule CrypKey_V56X_Kenonic_Controls_Ltd {
    strings:
        $a = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8 }
    condition:
        $a at pe.entry_point
}

rule BGI_Device_Driver {
    strings:
        $a = { 70 6B 08 08 42 47 49 20 }
    condition:
        $a at pe.entry_point
}

rule Symantec_WinFax_PRO_83_Coverpage_Quick_CoverPage_Hint_FILE_START {
    strings:
        $a = { FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point
}

rule HackStop_100_EXE {
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 1F 04 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 38 12 E8 0A 04 8D EB 02 CA 92 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20a7_Nullsoft {
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 BC 80 40 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v71_DLL_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_V80 {
    strings:
        $a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
    condition:
        $a at pe.entry_point
}

rule AINEXE_v21_Hint_DOS_EP {
    strings:
        $a = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_v106_additional {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_v007 {
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_VOB_ProtectCD_5 {
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_MASM32 {
    strings:
        $a = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_FSG_131_Anorganix_additional {
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v253b3_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V10B_vcasm {
    strings:
        $a = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_16x_CGSoftLabs {
    strings:
        $a = { 68 ?? ?? ?? ?? C3 ?? ?? ?? ?? ?? ?? CC ?? ?? 49 AD BA ?? ?? ?? ?? 9F F3 08 F6 9C 84 E1 A9 ?? ?? ?? ?? 60 40 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22004616_V22006630_WFS_Sign_by_fly_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule UPX_v0761_dos_exe_Hint_DOS_EP {
    strings:
        $a = { B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule InstallShield_2000_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 }
    condition:
        $a at pe.entry_point
}

rule PEiD_Bundle_v102_v103_BoB_BobSoft {
    strings:
        $a = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point
}

rule EPack_V14_lite_final_6aHguT_additional {
    strings:
        $a = { 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Stealth_v11 {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0978 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }
    condition:
        $a at pe.entry_point
}

rule EPack_V14_lite_final_6aHguT {
    strings:
        $a = { 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Escargot_01_by_ueMeat_additional {
    strings:
        $a = { EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v0977 {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }
    condition:
        $a at pe.entry_point
}

rule Phonebook_configuration_file_Version_v3v4_additional {
    strings:
        $a = { 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F }
    condition:
        $a at pe.entry_point
}

rule Morphine_v12 {
    strings:
        $a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 }
        $b = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 }
        $c = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E2 ?? ?? ?? ?? ?? 82 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Sexe_Crypter_11_by_santasdad {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79 }
        $b = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Visual_Cpp_2008_Release_Microsoft {
    strings:
        $a = { E8 ?? ?? ?? ?? E9 A4 FE FF FF }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V107_V12X_MATCODE_Software_20080730 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Doom666 {
    strings:
        $a = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_123_RC4_build_0807_dll_Alexey_Solodovnikov_h_additional {
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Thinstall_Embedded_V2545_Jitit {
    strings:
        $a = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule NsPack_30_North_Star {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }
        $b = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule USERNAME_v300 {
    strings:
        $a = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_10_1987 {
    strings:
        $a = { BA 00 01 2E 89 16 72 01 B4 30 00 00 8B 2E 02 00 8B 1E 2C 00 8E DA A3 86 00 8C 06 84 00 89 1E 80 00 89 2E 98 00 C7 06 8A 00 FF FF 8E C3 33 C0 B9 FF 7F 8B F8 8B D8 26 81 3D 38 37 75 1D 57 51 50 B0 3D F2 AE E3 11 26 8A 05 24 DF FF 06 8A 00 3C }
    condition:
        $a at pe.entry_point
}

rule mPACK_v002_DeltaAziz_h {
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v15_Private_Vaska {
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point
}

rule JDProtectV20081208demo_20090119 {
    strings:
        $a = { 10 3C 0C 32 54 50 50 83 2D 51 52 B9 E8 ?? 52 2A 10 16 84 01 }
    condition:
        $a at pe.entry_point
}

rule WebCops_DLL {
    strings:
        $a = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }
    condition:
        $a at pe.entry_point
}

rule UPX_072 {
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }
    condition:
        $a at pe.entry_point
}

rule UPXFreak_01_Borland_Delphi_HMX0101 {
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule EXEStealth_v275a_WebtoolMaster_h {
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 }
    condition:
        $a at pe.entry_point
}

rule ANDpakk2_apk2_V006_Dmitry_quotANDquot_Andreevnbsp_nbsp_SignByfly_20080731 {
    strings:
        $a = { 60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_1 {
    strings:
        $a = { 55 8B EC 83 C4 F4 53 56 A1 0C CF 42 00 C6 00 01 B8 00 25 42 00 E8 00 00 FE FF BE 1C E1 42 00 A1 90 CE 42 00 E8 00 00 FE FF A1 CC CE 42 00 BA 00 00 42 00 E8 00 FD FE FF 84 C0 75 05 E8 00 02 FF FF E8 00 07 FF FF 33 C0 A3 14 E1 42 00 33 C0 A3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_3_2 {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 E8 00 00 FF FF E8 00 00 FF FF 33 C0 55 68 00 00 40 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 F0 33 C0 E8 00 00 FF FF 8B 45 F0 E8 00 00 FF FF 50 E8 00 00 FF FF }
    condition:
        $a at pe.entry_point
}

rule AntiDote_12_Beta_Demo_SIS_Team {
    strings:
        $a = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 }
        $b = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MASMTASM_sig2h_additional {
    strings:
        $a = { C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule First_Publisher_Graphics_format_Hint_FILE_START_additional {
    strings:
        $a = { 00 00 ?? 01 00 00 ?? 02 }
    condition:
        $a at pe.entry_point
}

rule ThemidaWinLicense_V1000_V1800_Oreans_Technologies_Sign_by_fly {
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule DIET_v102b_v110a_v120 {
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule RJoiner_by_Vaska_Sign_from_pinch_25032007_1700 {
    strings:
        $a = { E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 }
    condition:
        $a at pe.entry_point
}

rule Vx_Uddy2617 {
    strings:
        $a = { 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98 }
    condition:
        $a at pe.entry_point
}

rule NFO_v1x_modified {
    strings:
        $a = { EB 01 9A E8 3D ?? ?? ?? EB 01 9A E8 EB 01 ?? ?? EB 01 9A E8 2C 04 ?? ?? EB }
        $b = { 60 9C 8D 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Stony_Brook_Pascal_v614 {
    strings:
        $a = { 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A }
    condition:
        $a at pe.entry_point
}

rule PEtite_v21_Ian_Luck {
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }
    condition:
        $a at pe.entry_point
}

rule yzpack_V20_UsAr_Sign_by_fly_additional {
    strings:
        $a = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 }
    condition:
        $a at pe.entry_point
}

rule Upack_V021_Dwingnbsp_nbsp_SignByfly_20080321 {
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_WAV_Audio_file {
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74 }
    condition:
        $a at pe.entry_point
}

rule MinGW_32x_Dll_WinMain {
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_BasicPro_Edition_112_Randy_Li {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v204 {
    strings:
        $a = { EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v203 {
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_Debug_Version {
    strings:
        $a = { 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule PE_Lock_NT_v201 {
    strings:
        $a = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Limited {
    strings:
        $a = { BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point
}

rule RCryptor_v16c_Vaska {
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_Extra_Encruption_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D B2 ?? 8B CD 83 ED ?? BF ?? ?? BE ?? ?? 2B CF AC 32 C2 42 AA E2 ?? B9 ?? ?? BE ?? ?? 03 F5 }
    condition:
        $a at pe.entry_point
}

rule Jam_211_COM {
    strings:
        $a = { 50 06 16 07 BE 08 02 8B FE B9 05 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 10 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 43 5D }
    condition:
        $a at pe.entry_point
}

rule DIET_v100_v100d {
    strings:
        $a = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point
}

rule Packanoid_10_ackanoid {
    strings:
        $a = { BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_dulekxt_Borland_Delphi_Borland_Cpp {
    strings:
        $a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 F3 DD 60 F2 73 A8 C3 45 2E 22 43 C4 FA 15 2E 73 97 BE D5 04 25 A6 D5 E0 FC 54 EC D9 A0 84 C4 04 FA D6 D7 07 3A 14 4F 18 F6 AB D8 88 B8 E7 CB C4 36 B8 51 4E 4B 97 29 7C B4 3F D7 99 BC 66 DA CE 9C AC DD 01 0D 65 6D CD F5 5E F6 8E 7F 36 4F A7 AF 27 C7 70 5? }
    condition:
        $a at pe.entry_point
}

rule WWPACK_v303 {
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53 }
    condition:
        $a at pe.entry_point
}

rule Reflexive_Arcade_Wrapper_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 }
    condition:
        $a at pe.entry_point
}

rule StarForce_Protection_Technology {
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule JPEG_GIF_library_file {
    strings:
        $a = { 00 05 16 07 00 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_v120_Eng_dulekxt_Borland_Cpp {
    strings:
        $a = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
        $b = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule aPack_058_082_1_EXE {
    strings:
        $a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B6 01 BD }
    condition:
        $a at pe.entry_point
}

rule RLPack_V121_Dll_LZMA_430_ap0x_20080504 {
    strings:
        $a = { 80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point
}

rule PGPROT_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 0E 1F 8C C0 01 ?? ?? ?? 01 ?? ?? ?? 26 ?? ?? ?? ?? 07 32 C0 33 FF B9 ?? ?? F2 AE }
    condition:
        $a at pe.entry_point
}

rule ASPack_212b_Solodovnikov_Alexey {
    strings:
        $a = { ?? 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB EC FF FF FF 03 DD 81 EB 00 ?? ?? 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4C 0F 00 00 89 85 26 04 00 00 8B F8 8D 5D 5E 53 50 FF 95 48 0F 00 00 89 85 4C 05 00 00 8D 5D 6B 53 57 FF 95 48 0F }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v1xx {
    strings:
        $a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
        $b = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule USCC_v14_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 60 BB ?? ?? B9 ?? ?? 30 0F 43 E2 ?? 5D F5 F5 FC EF EE FA 4B 9E }
    condition:
        $a at pe.entry_point
}

rule _22b_Shoooo {
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8 }
    condition:
        $a at pe.entry_point
}

rule UCEXE_v23_v24_additional {
    strings:
        $a = { 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point
}

rule Vx_XPEH4768 {
    strings:
        $a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point
}

rule nPack_112502006Beta_NEOxuinC {
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        $a at pe.entry_point
}

rule EXE_Liuli {
    strings:
        $a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }
    condition:
        $a at pe.entry_point
}

rule Berio_100_beta {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F }
    condition:
        $a at pe.entry_point
}

rule nCrypt_1x_Cryptor_InterFac_NEG {
    strings:
        $a = { E9 95 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F1 BB 00 10 40 00 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB 00 00 00 00 75 05 BB 00 00 00 00 8A 23 30 C4 88 23 43 81 FB ?? ?? ?? ?? 75 89 1E 68 ?? ?? ?? ?? C3 BA C9 ?? ?? ?? 0F 10 02 BA 06 ?? ?? ?? 0F 11 02 BA ?? ?? ?? ?? 0F 10 02 BA ?? ?? ?? ?? 0F 11 02 64 8B 0D 20 00 00 00 EB 01 C? }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_ExeSmasher_Anorganix {
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point
}

rule MSLRH_032a_fake_WWPack32_1x_emadicius {
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 }
    condition:
        $a at pe.entry_point
}

rule tElock_v042 {
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
    condition:
        $a at pe.entry_point
}

rule Shrink_v20_Hint_DOS_EP {
    strings:
        $a = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_v50 {
    strings:
        $a = { 24 ?? 8B 24 }
        $b = { 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RJ_Crush_110 {
    strings:
        $a = { 06 FC 8C C8 BA 00 00 03 D0 52 BA 00 00 52 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E D8 8E C3 BE 47 00 AD 8B E8 B2 10 CB FF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_DxPack_10_Anorganix_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point
}

rule Password_Protector_c_MiniSoft_1992_Hint_DOS_EP {
    strings:
        $a = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
    condition:
        $a at pe.entry_point
}

rule Gardian_Angel_10_additional {
    strings:
        $a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }
    condition:
        $a at pe.entry_point
}

rule eXpressor_v11_CGSoftLabs_additional {
    strings:
        $a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v094_Jeremy_Collake {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }
    condition:
        $a at pe.entry_point
}

rule REC_C0ded_by_ROSE_additional {
    strings:
        $a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_Borland_Delphi_DLL {
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule Ding_Boys_PE_lock_Phantasm_v10_v11_additional {
    strings:
        $a = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_V22006115_WFS_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule kkrunchy_v017_F_Giesen_additional {
    strings:
        $a = { FC FF 4D 08 31 D2 8D 7D 30 BE }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_Video_Lan_Client_Anorganix {
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Sentinel_Dongle_Shell_SafeNet_Inc_20090508 {
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C7 85 04 FF FF FF 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 F8 00 00 00 00 C7 85 08 FF FF FF 00 00 00 00 C7 45 E4 04 00 00 00 83 ?? ?? ?? ?? ?? 00 74 05 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C0 01 A3 ?? ?? ?? ?? 83 F4 00 7B 00 8D 80 ?? ?? ?? ?? 8D 80 ?? ?? ?? ?? 76 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260a_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4 }
    condition:
        $a at pe.entry_point
}

rule RLPack_118_LZMA_430_ap0x_additional {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_CodeSafe_20_Anorganix {
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }
    condition:
        $a at pe.entry_point
}

rule ARM_Protector_v01_by_SMoKE {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule WWPACK_v305c4_Unextractable_p_Password_checking {
    strings:
        $a = { 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v02_emadicius_h {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 }
    condition:
        $a at pe.entry_point
}

rule PE_Packer_additional {
    strings:
        $a = { FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 }
    condition:
        $a at pe.entry_point
}

rule SoftProtect_SoftProtectbyru_additional {
    strings:
        $a = { EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C }
    condition:
        $a at pe.entry_point
}

rule ASPack_v1061b_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }
    condition:
        $a at pe.entry_point
}

rule WATCOM_CCpp_Run_Time_systempDOS4GW_DOS_Extender_1988_93_Hint_DOS_EP {
    strings:
        $a = { BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3 }
    condition:
        $a at pe.entry_point
}

rule N_Joy_12_NEX_additional {
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Microsoft_Visual_Cpp_60_additional {
    strings:
        $a = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }
    condition:
        $a at pe.entry_point
}

rule PESpin_v01_Cyberbob_h_additional {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 }
    condition:
        $a at pe.entry_point
}

rule EXECryptor_V21X_softcompletecom_ {
    strings:
        $a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
    condition:
        $a at pe.entry_point
}

rule Crunch_4 {
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 }
    condition:
        $a at pe.entry_point
}

rule CrypteXeC_101 {
    strings:
        $a = { FD 25 29 70 E8 08 01 AE 12 3F E8 27 00 FD E9 12 00 3E 26 F6 D9 26 1C 99 2E F5 FD C3 84 19 22 C5 04 D3 AC E8 33 01 B4 0B CD 21 F5 3E 84 17 F6 DB AC E9 1C 00 F6 D9 35 AC 5E 90 E8 D4 FF F8 3D 19 F0 E8 CD FF 3C 28 E8 C8 FF FB 2C 49 C3 02 09 D7 }
    condition:
        $a at pe.entry_point
}

rule PE_Exe_Executable_Image {
    strings:
        $a = { 50 45 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressorLight_V1601_CGSoftLabsnbsp_nbsp_SignByfly_20080308 {
    strings:
        $a = { 55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V230_V24X_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_Borland_Delphi_Setup_Module_Anorganix {
    strings:
        $a = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_215_SetiSoft_Team {
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule SVKP_v132_Pavol_Cerven {
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 }
    condition:
        $a at pe.entry_point
}

rule Fish_PE_Shield_101_HellFish_additional {
    strings:
        $a = { 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 }
    condition:
        $a at pe.entry_point
}

rule Turbo_Basic {
    strings:
        $a = { 2E 8C 1E B2 00 2E C7 06 AE 00 00 00 E8 54 05 E8 88 00 E8 17 17 E8 AE 17 E8 11 00 2E 8E 1E 64 01 FF 36 02 00 E8 9F 17 58 B4 4C CD 21 E8 A7 00 E8 D6 00 72 53 E8 C4 01 E8 48 02 E8 6C 02 E8 00 1F E8 00 2F E8 52 01 0E 1F A1 56 01 B1 04 D3 E0 A3 }
    condition:
        $a at pe.entry_point
}

rule PESpin_v01_Cyberbob_h {
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_01_MinGW_GCC_2x_Anorganix {
    strings:
        $a = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }
    condition:
        $a at pe.entry_point
}

rule Packanoid_10_ackanoid_additional {
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260a {
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v260c {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v32a_emadicius_additional {
    strings:
        $a = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
    condition:
        $a at pe.entry_point
}

rule Vx_Kuku886_Hint_DOS_EP {
    strings:
        $a = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v310_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC }
    condition:
        $a at pe.entry_point
}

rule Unknown_UPX_Scrambler_vna {
    strings:
        $a = { C7 45 FC ?? ?? ?? ?? 6A 04 6A 00 6A 00 68 FF FF FB FF FF 15 ?? ?? ?? ?? 85 C0 7E ?? 6A 00 FF 15 ?? ?? ?? ?? 8B 45 FC 8B 40 04 83 E8 03 8B 4D FC 89 41 04 83 65 F4 00 EB ?? 8B 45 F4 40 89 45 F4 8B 45 FC 8B 4D F4 3B 48 04 73 ?? 8B 45 FC 8B 40 04 2B 45 F4 8B 4D FC 8B 09 8B 55 FC 8B 44 01 FF 33 42 0C 8B 4D FC 8B 49 04 2B 4D F4 8B 55 FC 8B 12 89 44 11 FF EB ?? 8B 45 FC 8B 40 08 89 45 F8 8B 45 F8 }
    condition:
        $a at pe.entry_point
}

rule ORiEN_211_212_Fisun_Alexander {
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
    condition:
        $a at pe.entry_point
}

rule WordPerfect_EXEPack {
    strings:
        $a = { 95 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 8B 16 0E 00 50 B8 39 00 50 CB 8C D8 2B C2 8E D8 8E C0 BF 0F 00 8B F7 B1 10 B0 FF F3 AE 47 87 F7 8C C8 2B C2 8E C0 B1 04 8B C6 F7 D0 D3 E8 8C DA 2B D0 73 }
    condition:
        $a at pe.entry_point
}

rule DragonArmor_Orient {
    strings:
        $a = { BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 }
        $b = { BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule modified_HACKSTOP_v111f {
    strings:
        $a = { 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8 }
    condition:
        $a at pe.entry_point
}

rule StarForce_V3X_DLL_StarForce_Copy_Protection_System_additional {
    strings:
        $a = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }
    condition:
        $a at pe.entry_point
}

rule XPack_167_com_additional {
    strings:
        $a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }
    condition:
        $a at pe.entry_point
}

rule Borland_Delphi_DLL {
    strings:
        $a = { 55 8B EC 83 }
        $b = { 55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule modified_HACKSTOP_v111f_additional {
    strings:
        $a = { 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8 }
    condition:
        $a at pe.entry_point
}

rule Turbo_C_1990_or_Turbo_C_1988_Hint_DOS_EP {
    strings:
        $a = { BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA }
    condition:
        $a at pe.entry_point
}

rule Hasp_4_envelope_dongle_Alladin_additional {
    strings:
        $a = { 10 02 D0 51 0F 00 83 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_19881989_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72 }
    condition:
        $a at pe.entry_point
}

rule PESHiELD_0251_ANAKiN_DaVinci {
    strings:
        $a = { 5D 83 ED 06 EB 02 EA 04 8D }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v01_emadicius {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
        $b = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_1337_20070623_Obsidium_Software {
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00 }
        $b = { EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Borland_Delphi_v50_KOLMCK_additional {
    strings:
        $a = { 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 83 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point
}

rule ZOO_Archive {
    strings:
        $a = { 5A 4F 4F }
    condition:
        $a at pe.entry_point
}

rule Cexe_10a {
    strings:
        $a = { 55 8B EC 81 EC 0C 02 00 00 56 BE 04 01 00 00 8D 85 F8 FE FF FF 56 50 6A 00 FF 15 54 10 40 00 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 80 F9 5C 75 03 8D 50 01 8A 48 01 40 84 C9 75 F0 85 D2 74 02 20 0A 8D 45 FC 50 8D 85 F8 FE FF }
    condition:
        $a at pe.entry_point
}

rule Unknown_UPX_or_File_modifyer {
    strings:
        $a = { E8 02 00 00 00 CD 03 5A 81 C2 86 EA FE FF 81 C2 45 23 01 00 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3 }
    condition:
        $a at pe.entry_point
}

rule CD_Cops_II_additional {
    strings:
        $a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point
}

rule SDProtector_BasicPro_Edition_110_Randy_Li_h {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
        $b = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule HACKSTOP_v113_DarkStop_v10_Hint_DOS_EP {
    strings:
        $a = { FA BD ?? ?? D4 85 4E 32 EB EB }
    condition:
        $a at pe.entry_point
}

rule Enigma_Protector_1X_Sukhov_Vladimir_Serge_N_Markin_additional {
    strings:
        $a = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }
    condition:
        $a at pe.entry_point
}

rule AVHRR_Graphics_format {
    strings:
        $a = { D5 C8 00 01 00 03 00 01 }
    condition:
        $a at pe.entry_point
}

rule Zortech_C_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 2E FF ?? ?? ?? FC 06 }
    condition:
        $a at pe.entry_point
}

rule SimplePack_111_Method_1_bagieTMX {
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
        $b = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Microsoft_Visual_Cpp_DLL_additional {
    strings:
        $a = { 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_regular_Hint_DOS_EP {
    strings:
        $a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_ASProtect_Anorganix {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }
    condition:
        $a at pe.entry_point
}

rule SPEC_b2 {
    strings:
        $a = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_ASProtect_Anorganix {
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_V15_Demo_FEUERRADER {
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }
        $b = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule EncryptPE_V22008618_WFS_SignByKuNgBiM {
    strings:
        $a = { 68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_BasicPro_Edition_110_Randy_Li_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60 {
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
    condition:
        $a at pe.entry_point
}

rule Crinkler_V03_V04_Rune_LHStubbe_and_Aske_Simon_Christensen {
    strings:
        $a = { B8 00 00 42 00 31 DB 43 EB 58 }
    condition:
        $a at pe.entry_point
}

rule yzpack_V11 {
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V6X_Minimum_Protection_Silicon_Realms_Toolworks_20081227 {
    strings:
        $a = { E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 E4 00 8B 75 08 3B 35 ?? ?? ?? ?? 77 22 6A 04 E8 ?? ?? ?? ?? 59 83 65 FC 00 56 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 45 E4 E8 ?? ?? ?? ?? C3 6A 04 E8 ?? ?? ?? ?? 59 C3 55 8B 6C 24 08 83 FD E0 0F 87 9F 00 00 00 53 8B ?? ?? ?? ?? ?? 56 57 33 F6 39 ?? ?? ?? ?? ?? 8B FD 75 18 E8 ?? ?? ?? ?? 6A 1E E8 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 59 59 ?? ?? ?? ?? ?? 83 F8 01 75 0E 3B EE 74 04 8B C5 EB 03 33 C0 40 50 EB 1E 83 F8 03 75 0B 55 E8 ?? ?? ?? ?? 3B C6 59 75 17 3B EE 75 03 33 FF 47 83 C7 0F 83 E7 F0 57 56 FF 35 ?? ?? ?? ?? FF D3 8B F0 85 F6 75 26 39 05 ?? ?? ?? ?? 6A 0C 5F 74 0D 55 E8 ?? ?? ?? ?? 85 C0 59 75 81 EB 07 E8 ?? ?? ?? ?? 89 38 E8 ?? ?? ?? ?? 89 38 5F 8B C6 5E 5B 5D C3 55 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? C7 00 0C 00 00 00 33 C0 5D C3 }
    condition:
        $a at pe.entry_point
}

rule Nullsoft_Install_System_v20 {
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
        $c = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule RECSmall_v102 {
    strings:
        $a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }
    condition:
        $a at pe.entry_point
}

rule VProtector_V11_vcasm {
    strings:
        $a = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PESHiELD_025 {
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_CD_Cops_II {
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
    condition:
        $a at pe.entry_point
}

rule UPolyx_04_by_delikon {
    strings:
        $a = { C3 ?? ?? ?? ?? ?? 83 EC 04 89 }
    condition:
        $a at pe.entry_point
}

rule AntiDote_12DLLDemo_SIS_Team_additional {
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B }
    condition:
        $a at pe.entry_point
}

rule MPRESS_V101_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730 {
    strings:
        $a = { 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_v14_CGSoftLabs_additional {
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Dll_aPlib_043_ap0x {
    strings:
        $a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 }
    condition:
        $a at pe.entry_point
}

rule REC_v034_3 {
    strings:
        $a = { 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point
}

rule NeoLite_v20_additional {
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75 }
    condition:
        $a at pe.entry_point
}

rule Werus_Crypter_10_Kas {
    strings:
        $a = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
        $b = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule eXPressor_V13_CGSoftLabs {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 }
    condition:
        $a at pe.entry_point
}

rule SecuPack_15 {
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 00 E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 F0 33 C0 E8 46 EA FF FF 8B 45 F0 E8 D6 F2 FF FF 50 E8 0C FD FF FF }
    condition:
        $a at pe.entry_point
}

rule ASPack_v107b_DLL_Alexey_Solodovnikov {
    strings:
        $a = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 }
    condition:
        $a at pe.entry_point
}

rule PUNiSHER_v15_DEMO_FEUERRADERAHTeam_additional {
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_V1342_Obsidium_Softwarenbsp_nbsp_SignByfly_additional {
    strings:
        $a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 }
    condition:
        $a at pe.entry_point
}

rule PMODEW_v112_116_121_133_DOS_extender {
    strings:
        $a = { FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4 }
    condition:
        $a at pe.entry_point
}

rule Adys_Glue_v010_Hint_DOS_EP {
    strings:
        $a = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }
    condition:
        $a at pe.entry_point
}

rule aPack_v098b_DS_ES_not_saved {
    strings:
        $a = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }
    condition:
        $a at pe.entry_point
}

rule PEtite_v20_additional {
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68 }
    condition:
        $a at pe.entry_point
}

rule Pelles_C_28x_45x_Pelle_Orinius_additional {
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC }
    condition:
        $a at pe.entry_point
}

rule iPBProtect_v013 {
    strings:
        $a = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }
        $b = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_02_DxPack_10_Anorganix {
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule CICompress_v10 {
    strings:
        $a = { 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 }
        $b = { 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Crypto_Lock_202_Eng_Ryan_Thian {
    strings:
        $a = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
    condition:
        $a at pe.entry_point
}

rule eXPressor_V145x_CGSoftLabs_additional {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D }
    condition:
        $a at pe.entry_point
}

rule EXE_Shield_v05_Smoke {
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }
    condition:
        $a at pe.entry_point
}

rule Sexe_Crypter_11_by_santasdad_additional {
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B }
    condition:
        $a at pe.entry_point
}

rule CalComp_Graphics_format_Hint_FILE_START {
    strings:
        $a = { 02 50 0A }
    condition:
        $a at pe.entry_point
}

rule PKLITE_v100_v103_additional {
    strings:
        $a = { B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B }
    condition:
        $a at pe.entry_point
}

rule Shrink_v10_additional {
    strings:
        $a = { 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3 }
    condition:
        $a at pe.entry_point
}

rule InterLok_V5X_PACE_Anti_Piracy_SignByfly_additional {
    strings:
        $a = { 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point
}

rule Windows_Icon_Graphics_format {
    strings:
        $a = { 00 00 01 00 }
    condition:
        $a at pe.entry_point
}

rule Vx_Trivial46_additional {
    strings:
        $a = { B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v110_v111 {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v110_v111_Hint_DOS_EP {
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB }
    condition:
        $a at pe.entry_point
}

rule PEQuake_v006_forgotus_h_additional {
    strings:
        $a = { E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 }
    condition:
        $a at pe.entry_point
}

rule PECompact_126b1_126b2 {
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB 05 0E 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point
}

rule tElock_v070_additional {
    strings:
        $a = { 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v01_emadicius_additional {
    strings:
        $a = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_122_123_Beta_21_Solodovnikov_Alexey {
    strings:
        $a = { 68 01 E0 46 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point
}

rule nBinder_v361_additional {
    strings:
        $a = { 6E 73 70 61 63 6B 24 40 }
    condition:
        $a at pe.entry_point
}

rule PECompact_v166_additional {
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11 }
    condition:
        $a at pe.entry_point
}

rule yodas_Protector_V1031_Ashkbiz_Danehkar_Sign_by_fly {
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_Dll_aPlib_043_ap0xnbsp_nbsp_Sign_by_fly_additional {
    strings:
        $a = { 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V111_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point
}

rule Vx_Necropolis1963 {
    strings:
        $a = { B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 }
    condition:
        $a at pe.entry_point
}

rule NsPack_34_North_Star_additional {
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }
    condition:
        $a at pe.entry_point
}

rule SoftSentry_v211 {
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 E9 50 }
    condition:
        $a at pe.entry_point
}

rule The_aPE_Inline_Patch_Basic_Advanced_Stealth {
    strings:
        $a = { B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68 }
    condition:
        $a at pe.entry_point
}

rule LameCrypt_LaZaRus_additional {
    strings:
        $a = { 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0 }
    condition:
        $a at pe.entry_point
}

rule Upack_v038_beta_Dwing {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule MinGW_v32x_WinMain {
    strings:
        $a = { 55 89 E5 83 EC 08 6A ?? 6A ?? 6A ?? 6A ?? E8 0D ?? ?? ?? B8 ?? ?? ?? ?? C9 C3 90 90 90 90 90 90 FF 25 38 20 ?? 10 90 90 ?? ?? ?? ?? ?? ?? ?? ?? FF FF FF FF ?? ?? ?? ?? FF FF FF }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule _PseudoSigner_02_Borland_Delphi_Setup_Module {
    strings:
        $a = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule HackStop_119_build_204_EXE {
    strings:
        $a = { 50 B8 EB 04 58 EB FB 9A 9C 1E 52 B4 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 50 B8 EB 04 58 EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 50 B8 EB 04 58 EB FB 9A EB 02 D8 88 5A 1F 50 B8 EB 04 58 EB FB 9A B0 AD E6 64 58 25 80 00 8C DB 50 B8 EB 04 }
    condition:
        $a at pe.entry_point
}

rule PEiD_7547_624_10 {
    strings:
        $a = { 50 55 4C 50 83 C4 07 FC BF 00 80 BE 14 01 B5 30 57 F3 A5 C3 33 ED BE 6C 80 BF 00 01 57 81 FF 00 00 73 42 E8 3B 00 72 0A B1 08 99 E8 46 00 93 AA EB EB B2 08 E8 2A 00 73 09 41 4A 75 F7 E8 26 00 8B CB E3 10 51 E8 1E 00 59 56 8B F7 2B F3 41 F3 }
    condition:
        $a at pe.entry_point
}

rule CodeCrypt_v014b_additional {
    strings:
        $a = { E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v430_v440_Silicon_Realms_Toolworks {
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
    condition:
        $a at pe.entry_point
}

rule with_added_PK_signature_Hint_DOS_EP {
    strings:
        $a = { C7 ?? ?? ?? ?? ?? 8C D8 05 }
    condition:
        $a at pe.entry_point
}

rule RLPack_v118_Basic_aPLib {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
        $b = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Obsidium_1250_Obsidium_Software {
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Unknown_packer_05_additional {
    strings:
        $a = { FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27 }
    condition:
        $a at pe.entry_point
}

rule Inbuild_v10_hard_additional {
    strings:
        $a = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_additional {
    strings:
        $a = { 83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_02_PE_Intro_10_Anorganix {
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
    condition:
        $a at pe.entry_point
}

rule InstallAnywhere_61_Zero_G_Software_Inc {
    strings:
        $a = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
        $b = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule PseudoSigner_01_Neolite_20_additional {
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point
}

rule Trivial173_by_SMTSMF_Hint_DOS_EP {
    strings:
        $a = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }
    condition:
        $a at pe.entry_point
}

rule MS_Compress_Archive {
    strings:
        $a = { 53 5A 44 44 }
    condition:
        $a at pe.entry_point
}

rule PE_PACK_10_additional {
    strings:
        $a = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }
    condition:
        $a at pe.entry_point
}

rule Vx_ARCV4_Hint_DOS_EP {
    strings:
        $a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_V540_V542_Silicon_Realms_Toolworks_20080214 {
    strings:
        $a = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 C1 1B 00 00 59 89 7D FC FF 75 08 E8 B1 46 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 86 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 67 1A 00 00 59 C3 }
    condition:
        $a at pe.entry_point
}

rule SLVc0deProtector_v06_SLV {
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90 }
        $b = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 }
        $c = { E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Upack_V033_V034_Dwing_20080321 {
    strings:
        $a = { 57 51 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF C1 ED ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V119_LZMA_430_ap0x_Sign_by_fly {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_QBasic_v40_Hint_DOS_EP {
    strings:
        $a = { EB ?? 0E 1F B8 ?? ?? 50 9A ?? ?? ?? ?? 8E DA 93 8A 17 0A D2 74 ?? B4 ?? CD 21 43 }
    condition:
        $a at pe.entry_point
}

rule EXE2COM_200 {
    strings:
        $a = { E8 00 00 5B 81 EB 1D 00 8D B7 00 00 BF 00 01 B9 07 00 F3 A5 8D B7 FC 00 53 8C CF 83 C7 10 AD 09 C0 74 63 91 AD 01 F8 8E C0 AD 93 26 01 3F E2 F9 EB EC 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 31 2D 31 39 39 35 20 62 79 20 50 53 50 }
    condition:
        $a at pe.entry_point
}

rule _PseudoSigner_01_PEtite_2x_level_0 {
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }
    condition:
        $a at pe.entry_point
}

rule nPack_V111502006Beta_NEOxuinC {
    strings:
        $a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule SDProtector_1x_Randy_Li_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 }
    condition:
        $a at pe.entry_point
}

rule Duals_Cryptor_dual {
    strings:
        $a = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v301_v350a_Silicon_Realms_Toolworks_additional {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43 }
    condition:
        $a at pe.entry_point
}

rule RLPack_V118_Basic_Edition_aPlib_043_ap0x {
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v301_v350a_Silicon_Realms_Toolworks {
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43 }
    condition:
        $a at pe.entry_point
}

rule MSLRH_v032a_fake_Neolite_20_emadicius_h {
    strings:
        $a = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point
}

rule MoleBoxPro_255_Mole_Studio_h_additional {
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 }
    condition:
        $a at pe.entry_point
}

rule Sharp_GPB_Graphics_format {
    strings:
        $a = { 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00 }
    condition:
        $a at pe.entry_point
}

rule StarForce_V1X_V5X_StarForce_Copy_Protection_System_20090906 {
    strings:
        $a = { 68 ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule PDS_graphics_file_format_Hint_FILE_START {
    strings:
        $a = { 49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20 }
    condition:
        $a at pe.entry_point
}

rule Private_exe_Protector_V20_SetiSoft_Team_Sign_by_fly {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule XPack_167_com_Hint_DOS_EP {
    strings:
        $a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }
    condition:
        $a at pe.entry_point
}

rule UPX_v062_DLL_Hint_WIN_EP {
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 }
    condition:
        $a at pe.entry_point
}

rule Vx_ACME_Clonewar_Mutant_Hint_DOS_EP {
    strings:
        $a = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }
    condition:
        $a at pe.entry_point
}

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ {
    strings:
        $a = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00 }
    condition:
        $a at pe.entry_point
}

rule WinUpack_v039_final_By_Dwing_c2005 {
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule SimplePack_V11X_Method2_bagie_Sign_by_fly {
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 }
    condition:
        $a at pe.entry_point
}

rule FSG_110_Eng_dulekxt_Borland_Cpp_additional {
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
    condition:
        $a at pe.entry_point
}

rule setupexe_Section14text {
    strings:
        $a = { 55 8B EC B8 7A 31 00 00 83 EC 08 53 56 57 A3 E8 5E 48 00 A3 EC 5E 48 }
    condition:
        $a at pe.entry_point
}

rule Encrypted_by_RSCC286_v102_Hint_DOS_FILESIZE_11 {
    strings:
        $a = { FE 52 53 43 43 2F 31 2E 30 32 FE }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_60_80 {
    strings:
        $a = { 3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3 }
        $b = { 8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 C2 0C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ARC_SFX_Archive_additional {
    strings:
        $a = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }
    condition:
        $a at pe.entry_point
}

rule PE_PaCK_10_C_Copyright_1998_by_ANAKiN_h {
    strings:
        $a = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }
    condition:
        $a at pe.entry_point
}

rule Upack_010_012_beta_Dwing_ {
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }
    condition:
        $a at pe.entry_point
}

rule PC_Guard_50_Blagoje_Ceklic {
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_01_Pack_Master_10_PEX_Clone_Anorganix {
    strings:
        $a = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9 }
    condition:
        $a at pe.entry_point
}

rule PEBundle_02_20x_Jeremy_Collake {
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 }
    condition:
        $a at pe.entry_point
}

rule UPX_051_072_COM {
    strings:
        $a = { B9 00 00 BE 00 00 BF C0 FF FD F3 A4 FC F7 E1 93 87 F7 83 EE 00 19 ED 57 }
    condition:
        $a at pe.entry_point
}

rule SPEC_b3 {
    strings:
        $a = { 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }
    condition:
        $a at pe.entry_point
}

rule ExeLock_v100 {
    strings:
        $a = { 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 }
    condition:
        $a at pe.entry_point
}

rule Pe123_v200644_412_additional {
    strings:
        $a = { 8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 }
    condition:
        $a at pe.entry_point
}

rule Aluwain_v809 {
    strings:
        $a = { 8B EC 1E E8 ?? ?? 9D 5E }
    condition:
        $a at pe.entry_point
}

rule Armadillo_v190_additional {
    strings:
        $a = { 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point
}

rule PEArmor_V07X_Hying_additional {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point
}

rule Armadillo_444a_public_build_Silicon_Realms_Toolworks_h {
    strings:
        $a = { 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF }
    condition:
        $a at pe.entry_point
}

rule Stones_PE_Encryptor_v113 {
    strings:
        $a = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 }
    condition:
        $a at pe.entry_point
}

rule HACKSTOP_v110p1 {
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1992_13_additional {
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_C_19901992_additional {
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 }
    condition:
        $a at pe.entry_point
}

rule diPacker_V1X_diProtector_Software {
    strings:
        $a = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }
    condition:
        $a at pe.entry_point
}

rule ExeTools_v21_Encruptor_by_DISMEMBER_Hint_DOS_EP {
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74 }
    condition:
        $a at pe.entry_point
}

rule Obsidium_13021_Obsidium_Software_additional {
    strings:
        $a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB }
    condition:
        $a at pe.entry_point
}

rule ACProtect_V20X_RiSco {
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point
}

rule Microsoft_Visual_Cpp_80_DLL {
    strings:
        $a = { 48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 }
        $b = { 48 83 EC 28 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Hyper_Archive_Hint_FILE_START_additional {
    strings:
        $a = { 1A 53 54 }
    condition:
        $a at pe.entry_point
}

rule CauseWay_DOS_Extender_v325 {
    strings:
        $a = { FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07 }
    condition:
        $a at pe.entry_point
}

rule MS_Run_Time_Library_1988_04_Hint_DOS_EP {
    strings:
        $a = { 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point
}

rule SEN_Debug_Protector_additional {
    strings:
        $a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 }
    condition:
        $a at pe.entry_point
}

rule ASProtect_v11_MTE_additional {
    strings:
        $a = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }
    condition:
        $a at pe.entry_point
}

rule CHECKPRG_c_1992_Hint_DOS_EP {
    strings:
        $a = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }
    condition:
        $a at pe.entry_point
}

rule AdFlt2_Hint_DOS_EP {
    strings:
        $a = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD }
    condition:
        $a at pe.entry_point
}

rule WARNING_TROJAN_XiaoHui_additional {
    strings:
        $a = { 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 }
    condition:
        $a at pe.entry_point
}

rule PESpin_V132_cyberbob_20080310 {
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 17 E6 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D FF E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF E8 02 00 00 00 ?? ?? 5A 81 ?? ?? ?? ?? ?? 83 EA FE 89 95 A9 57 40 00 2B C0 2B C9 83 F1 06 09 85 CB 57 40 00 9C D3 2C 24 80 C1 FB 21 0C 24 50 52 B8 36 C7 09 FF 05 FE 37 F6 00 F7 64 24 08 8D 84 28 B1 35 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC CD 20 BB 69 74 58 0B C1 C3 }
    condition:
        $a at pe.entry_point
}

rule PseudoSigner_02_BJFNT_11b {
    strings:
        $a = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }
    condition:
        $a at pe.entry_point
}

rule Crunch_v5_Bit_Arts_additional {
    strings:
        $a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 }
    condition:
        $a at pe.entry_point
}

rule AHTeam_EP_Protector_03_fake_PE_Lock_NT_204_FEUERRADER {
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB }
    condition:
        $a at pe.entry_point
}

rule Hyings_PE_Armor_075exe_Hying_CCG {
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule ACProtect_V13X_risco_ {
    strings:
        $a = { 60 50 E8 01 00 00 00 75 83 }
    condition:
        $a at pe.entry_point
}

rule EncryptPE_22006710_220061025_WFS {
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point
}

rule Upack_036_beta_Dwing {
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }
        $b = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}

rule Micrografix_Draw_Graphics_format {
    strings:
        $a = { 01 FF 02 04 03 02 00 02 }
    condition:
        $a at pe.entry_point
}

rule Encrypted_by_RSCC286_v101_Hint_DOS_FILESIZE_11 {
    strings:
        $a = { FE 52 53 43 43 2F 31 2E 30 31 FE }
    condition:
        $a at pe.entry_point
}

rule PCShrink_v040b_Hint_WIN_EP {
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }
    condition:
        $a at pe.entry_point
}

rule ACProtect_14x_RISCO_soft {
    strings:
        $a = { 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 }
        $b = { 47 53 44 31 02 00 11 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )
}